Today's cybersecurity landscape highlights a range of threats from advanced malware campaigns to significant data breaches, impacting both individuals and major organizations. We're seeing a particular focus on new methods for tricking users into executing malicious code, alongside ongoing concerns about supply chain security and AI-related risks.
New TerminalFix Malware Evades Detection with Fake Cloudflare CAPTCHAsThreat
Microsoft has identified a new variant of the ClickFix malware, named TerminalFix, which uses fake Cloudflare CAPTCHA pages to trick users. This sophisticated campaign directs victims to execute malicious commands directly within Windows Terminal or PowerShell, a departure from previous methods that used the Windows Run dialog. This technique increases the likelihood of successful system compromise.
Why it matters: Website owners and their employees should be extremely wary of unexpected CAPTCHA prompts and never paste commands into their terminal from untrusted sources, as this can lead to remote access malware. Educate your team on social engineering tactics.
Read more at The Hacker News ↗
Manchester Airports Group Suffers Major Data BreachBreach
The FulcrumSec threat group has claimed responsibility for a data breach at Manchester Airports Group (MAG), reportedly stealing 86 GB of sensitive information. BleepingComputer independently verified some of the compromised data, which includes extensive customer, booking, and travel details. This breach goes beyond MAG's initial public disclosure regarding the incident.
Why it matters: If your business collects any customer data, ensure robust security measures are in place and have an incident response plan for potential breaches, as even large organizations can be targeted.
Read more at BleepingComputer ↗
Infostealer Malware Hijacks AI Sessions to Deplete User CreditsThreat
AI company Anthropic has issued a warning to users of its Claude platform regarding infostealer malware. This malware, present on some users' personal computers, is designed to steal active Claude login sessions, allowing attackers to gain unauthorized access to accounts. Once compromised, attackers can consume a victim's paid usage credits or access sensitive data.
Why it matters: Protect your business's AI tool accounts by practicing good endpoint security, using strong unique passwords, and enabling multi-factor authentication where available, especially for services with usage-based billing.
Read more at BleepingComputer ↗
Malicious Chrome and Edge Extensions Steal Crypto and Browser DataThreat
Several extensions available in the Google Chrome Web Store and Microsoft Edge Add-ons have been found delivering a sophisticated malware framework. This framework deploys various modules capable of stealing cryptocurrency, sensitive user data, and browser history. Additionally, these malicious extensions were used to inject ClickFix phishing lures into browsing sessions.
Why it matters: Businesses should restrict employees from installing unapproved browser extensions and regularly audit existing ones, as compromised extensions can act as a direct pipeline for data theft and malware delivery.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.