Cyber Bites

* Extortion Group Briefly Resells Old Ticketmaster Data Stolen in 2024 Snowflake Attacks * OpenAI Shuts Down 10 Malicious Operations Using ChatGPT for Cyber Attacks and Disinformation * Single Threat Actor Behind 100+ Backdoored GitHub Repositories Targeting Cybercriminals * Over 84,000 Roundcube Webmail Instances Exposed to Critical Remote Code Execution Flaw * Massive Supply Chain Attack Targets...

Australia Implements Mandatory Ransomware Payment Disclosure Rules Under New Cyber Security Framework Phishing Campaign Targets CFOs Globally Using Legitimate NetBird Remote Access Tool Critical Vulnerability in GitHub MCP Integration Allows Private Repository Data Theft Critical Flaws Discovered in Popular Software Bill of Materials Generation Tools Microsoft Authenticator Begins Warning Users to...

* Dozens of Malicious NPM Packages Discovered Harvesting System and Network Intelligence * TikTok Becomes New Vector for ClickFix Malware Campaign Targeting User Credentials * Australian Cyber Agency Warns of Russian GRU Targeting Western Logistics and Tech Companies * Apple Blocks Record $9 Billion in Fraudulent Transactions Across Five-Year Security Crackdown https://socket.dev/blog/60-malicious...

* Australian Healthcare Sector Leads in Data Breach Notifications as Human Error Remains a Major Threat * Verizon DBIR Reveals Alarming Surge in Third-Party Breaches and Vulnerability Exploitation * Australian Human Rights Commission Exposes Sensitive Documents Through Search Engine Indexing Blunder * Deceptive KeePass Clone Delivers ESXi Ransomware in Sophisticated Supply Chain Attack * Printer M...

Pearson Educational Giant Suffers Major Cyberattack Through Exposed GitLab Token https://plc.pearson.com/en-GB/news-and-insights/news/cyber-security-incident https://www.bleepingcomputer.com/news/security/education-giant-pearson-hit-by-cyberattack-exposing-customer-data/ Malicious npm Packages Target Cursor Editor Users, Affecting Over 3,200 Developers https://socket.dev/blog/malicious-npm-package...

* Banks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminals * 'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attacks * WhatsApp Introduces 'Private Processing' for Secure Cloud-Based AI Features * Microsoft Warns Default Kubernetes Helm Charts Create Security Vulnerabilities * Security Concerns Grow Over Electric Vehicles as Potential Surveillance Platforms Banks at...

We hit a milestone today as this is our 50th Podcast Episode! A Big thank you to You, our listeners for your continued support! * Kali Linux Users Face Update Issues After Repository Signing Key Loss * CISOs Advised to Secure Personal Protections Against Scapegoating and Whistleblowing Risks * WhatsApp Launches Advanced Chat Privacy to Safeguard Sensitive Conversations * Samsung Confirms Security...

I'm currently on a break and instead of sharing the latest cybersecurity news, I'll be doing a replay of an episode from our sister podcast, AppSec Unlocked. It's an interview episode with seasoned CISO Saut on Executive Security Awareness - Speaking the Board's language. We'll be returning next week with out normal programming of weekly cyber security news. Enjoy the show. This is a public episod...

I'm currently taking a break and instead of sharing the latest cybersecurity news, I'll be doing a replay of an episode from our sister podcast, AppSec unlocked. It's an episode on Crisis response training, preparing for the inevitable. I hope you enjoy it and I'll be bringing you more of the latest in cybersecurity news when we return in May. This is a public episode. If you would like to discuss...

* Cyber Attacks Target Multiple Australian Super Funds, Half Million Dollars Stolen * Intelligence Agencies Warn of "Fast Flux" Threat to National Security * SpotBugs Token Theft Revealed as Origin of Multi-Stage GitHub Supply Chain Attack * ASIC Secures Court Orders to Shut Down 95 "Hydra-Like" Scam Companies * Oracle Acknowledges "Legacy Environment" Breach After Weeks of Denial Cyber Attacks Ta...

* Australian Court System Breach Exposes Thousands of Sensitive Legal Documents, Including Restraining Orders * Nine Newspapers Subscribers Have Data Exposed Online in Breach * Sydney Tools Hammered by Massive Customer Data Exposure * Russian Phishing Sites Target Citizens Seeking to Join Anti-Kremlin Forces * Cybersecurity Expert Troy Hunt Falls Victim to Sophisticated Mailchimp Phishing Attack S...

* Critical Flaw in Next.js Allows Authorization Bypass * Hackers Can Now Weaponize AI Coding Assistants Through Hidden Configuration Rules * Hacker Claims Oracle Cloud Data Theft, Company Refutes Breach * Chinese Hackers Infiltrate Asian Telco, Maintain Undetected Network Access for Four Years * Cloudflare Launches Aggressive Security Measure: Shutting Down HTTP Ports for API Access Critical Flaw...

* Sydney Law Firm Targeted by Foreign Cyber Attackers in Extortion Attempt * AI Coding Assistant Refuses to Generate Code, Suggests User Learn Programming * Widely Used GitHub Action Compromised, Leaking Secrets * Fake "Security Alert" Phishing on GitHub Hijacks Accounts * MyGov Passkey Adoption Surges in Australia Sydney Law Firm Targeted by Foreign Cyber Attackers in Extortion Attempt https://ww...

* Critical PHP Vulnerability Under Mass Exploitation Worldwide * Hacktivist Group Claims Responsibility for X Outages, Musk Blames "Massive Cyberattack" * Cybercriminals Use Bogus Copyright Claims to Spread Malware on YouTube * Former Software Developer Found Guilty of Sabotaging Employer's Systems * Melbourne Man Charged in Mobile Number Porting Scam Critical PHP Vulnerability Under Mass Exploita...

* Disney Engineer's Life Destroyed by Malicious AI Download * Global Security Flaw Exposes Sensitive Employee Data and Physical Vulnerabilities * Malicious PyPi Package Pirating Deezer Music for Years * Code Security Remains Crucial, Even in Hardened Environments * Google Introduces AI Scam Detection for Android2025_03_07 - Google Disney Engineer's Life Destroyed by Malicious AI Download https://w...

* Russian Threat Actors Target Signal Messenger Accounts * Australian Fertility Services Giant Genea Suffers Data Breach * Australia Bans Kaspersky Products on Government Systems Over Security Concerns * PayPal "New Address" Feature Abused in Widespread Phishing Scam * Apple Disables iCloud End-to-End Encryption in UK Following Government Demand Russian Threat Actors Target Signal Messenger Accoun...

* "whoAMI" Attack Exploits AWS for Code Execution * Chinese Hackers Exploit Cisco Devices in Global Telecom Attacks * Australian National University Investigates Alleged Ransomware Attack * Phishing Season 2025: Zscaler Predicts Increased Sophistication and New Threats * Chinese Cybercriminals Revive Carding with Mobile Wallet Attacks "whoAMI" Attack Exploits AWS for Code Execution https://www.ble...

* Chinese AI App DeepSeek Banned From Australian Government Devices * OpenAI Data Breach Alleged: 20 Million Logins Reportedly Stolen * Apple Removes Apps Infected with "SparkCat" Malware * Australian Healthcare Sector Hardest Hit by Cyberattacks: Report * Securing the No-Code SDLC: A New Approach Needed Chinese AI App DeepSeek Banned From Australian Government Devices https://www.sbs.com.au/news/...

* PyPI Introduces Project Archiving to Improve Security and Transparency * DeepSeek Exposes Database with Over 1 Million Chat Records * Google Blocked 2.36 Million Risky Android Apps in 2024 * 20% Increase in Exploited Vulnerabilities in 2024 * "Infrastructure Laundering": How Chinese Crime Groups Abuse US Cloud Services PyPI Introduces Project Archiving to Improve Security and Transparency https:...

* Subaru Flaw Could Have Let Hackers Track and Control Vehicles * Hundreds of Fake Reddit Sites Push Lumma Stealer Malware * Cybersecurity Needs to Start Saying 'No' Again * GitHub Desktop and Other Git Clients Vulnerable to Credential Leaks * Sophisticated Voice Phishing Scam Attempt Exploiting Google Workspace Domain Verification Flaw Subaru Flaw Could Have Let Hackers Track and Control Vehicles...

* DDoS Attack Hits Record Breaking 5.6Tbps * Telegram Captcha Trick Lures Users into Running Malicious PowerShell Scripts * 7-Zip Patch Released to Address Mark of the Web Bypass Vulnerability * MasterCard DNS Misconfiguration Exposed for Years * Supply Chain Attack Targets Chrome Extensions, Potentially Impacting Millions DDoS Attack Hits Record Breaking 5.6Tbps https://blog.cloudflare.com/ddos-t...

* Ransomware Gang Exploits AWS Feature to Encrypt and Hold Data Hostage * Phishing Texts Trick iMessage Users into Disabling Security * Fake CrowdStrike Job Offers Used to Distribute Cryptominer * Stealthy WordPress Skimmers Infiltrate Database Tables * A New AI-Driven Ransomware Group Blurs the Lines Between Hacktivism and Cybercrime Ransomware Gang Exploits AWS Feature to Encrypt and Hold Data H...

* Cybersecurity in 2024: Top Stories that Rocked the Digital World * Over 4,000 Compromised Systems Exposed Through Hijacked Web Backdoors * Desperate Job Seekers Targeted by WhatsApp Employment Scams * Voice Phishing Rings Target Crypto Investors Using Apple Support Line * Neglected Domains Fuel Rise in Malicious Email Campaigns Cybersecurity in 2024: Top Stories that Rocked the Digital World htt...

* Fake Stars Inflate Popularity of Malicious GitHub Repositories * Cybercriminals Exploit Chrome Web Store to Infect Millions of Users * Malicious Packages Found on Python Package Index and VSCode Marketplace * One Third of Adults Don't Know How to Erase Their Data from an Old Device * New Clickjacking Technique "DoubleClickjacking" Bypasses Security Measures Fake Stars Inflate Popularity of Malic...

* US Government Considers Ban on TP-Link Routers Over Security Concerns * New Phishing Scam Uses Google Calendar to Bypass Spam Filters * Malicious VSCode Extensions Steal Developer Credentials * Large Language Models Pose New Threat in Generating Undetectable Malware * Malicious NPM Packages and VSCode Extensions Target Developers US Government Considers Ban on TP-Link Routers Over Security Conce...