Read Time: 5 minutes

Brought to you by:

Super long one this week. Sorry not sorry. I blame Vegas for creating a lot of stuff worth talking about. I hemmed and hawwed about cutting this down to size but decided “f it, we roll.”

Just got back from Defcon this week, was awesome seeing and meeting a bunch of you, thanks to those of you who came to my meetup by the pool. - I thought this edition would be a recap of my trip, but there is just too much news to talk about. I’ll make some videos about the trip soon.

Thank you all who have upgraded to Vuln U premium. It means the world to me. Premium newsletter content starts next week! I’ve seen my team working on some previews and I’m very excited. If you haven’t yet, get in at the current price for early adopters before we launch the community - https://vulnu.com/upgrade

ICYMI

🖊️ Something I wrote: I didn’t write much so how about another YT video? - I ran through some popular npm devs getting phished and their accounts pushing malware to millions.

🎧️ Something I heard: SomeOrdinaryGamers on YouTube - They want to scan your messages now...

🎤 Something I said: I did my first “man on the street” style interview at BlackHat with the legendary Sherrod DeGrippo. She’s a Director of Threat Intel at Microsoft and we chatted a lot about North Korea.

🔖 Something I read: An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects. - ZachXBT

Vulnerable News

ShinyHunters Targets Salesforce Amid Clues of Scattered Spider Collaboration

ShinyHunters just woke up from their year-long nap and decided to go after Salesforce data. What's got researchers super interested is how much their tactics now look like Scattered Spider's playbook - vishing campaigns, Okta phishing pages, and those trademark hyphenated domain names. (i.e. company-sso.com) ReliaQuest dug into the infrastructure and found some pretty compelling evidence of coordination, including a BreachForums user called "Sp1d3rhunters" who's been dropping hints that the two groups "are the same" and "have always been the same."

The domain registration patterns tell an interesting story too. Between June and July, researchers spotted a bunch of ticket-themed domains (ticket-lvmh[.]com, ticket-dior[.]com) all registered through the same infrastructure just before Louis Vuitton got breached. They're also seeing a shift in targeting - early 2025 was all about professional services, but now financial companies are getting hit 12% more while tech targeting dropped 5%. Whether these groups are actually collaborating or just borrowing each other's homework, idk, but focus on the tactics, not the names, because these English-speaking social engineering crews are getting scary good at what they do. (read more)

See What Really Matters: Maze’s AI Agents Triage Vulnerabilities for You*

Security teams spend countless hours chasing vulnerabilities - most of which will never be exploited. A recent Maze case study on CVE‑2025‑27363 shows how our AI Agents investigate vulnerabilities like an expert human would, to confirm if an issue is exploitable in your environment. If it’s irrelevant, it stays low priority. If it's actionable risk, it gets flagged fast.

That means less false positives, efficient remediation, and smarter security posture—without the usual guesswork. (read more)

*Sponsored

Major Enterprise AI Assistants Can Be Abused for Data Theft, Manipulation

Zenity's talked about some findings at Black Hat about how enterprise AI assistants can be weaponized through prompt injection attacks. They demonstrated attacks against ChatGPT, Copilot, Cursor, Gemini, and Salesforce Einstein - showing how attackers can steal data or manipulate responses without any user interaction. The ChatGPT attack was slick - just share a malicious file with someone's email address, and when they ask ChatGPT to process it, boom, the AI starts hunting for API keys in their Google Drive. (reminds me of my ChromeOS hack - share a Google doc that gets sucked up into something else, and XSS popped)

What's wild is how many of these integrations are just sitting out there ready to be exploited. Zenity found over 3,000 Copilot Studio instances engaging with the internet and hundreds of vulnerable Cursor/Jira and Salesforce setups. Initially, most vendors shrugged these off as "won't fix," but after some public pressure (it works!), Google and Salesforce quietly rolled out patches. (read more)

Critical Zero-Day Bugs Crack Open CyberArk, HashiCorp Password Vaults

Some nasty news about two major secrets management platforms. 14 zero-day vulnerabilities across HashiCorp Vault and CyberArk Conjur - the vaults that hold all of an enterprise's most sensitive passwords, API keys, and certificates. Authentication bypass, remote code execution, really a whole nightmare scenario. Some of these bugs had been lurking for years.

The Conjur exploit chain was creative - researchers tricked the AWS authentication by adding a single question mark to redirect verification to their own server, then authenticated as a policy instead of a user to escalate privileges. Both companies have patched everything. As one researcher put it, compromising a secrets vault would mean "you'd need to replace every single secret in your organization." Sweet dreams, security teams. (read more)

Google Gemini AI Bot Hijacks Smart Homes, Turns Off the Lights

It really was the year of “get a cool prompt injection - give a talk at BlackHat” - An attack against Google Gemini that lets them hijack smart homes through poisoned calendar invites. They hid invisible prompt injections in calendar event titles that lay dormant until someone asks Gemini to summarize their upcoming week. Once triggered, the malicious prompts can control connected lights, smart shutters, and even boilers. (read more)

Booking.com phishing campaign uses sneaky 'ん' character to trick you

Here's a sneaky one that caught my eye. Unicode characters to fool people into clicking malicious Booking[.]com links. They're using the Japanese hiragana character "ん" which can look like "/n" in certain fonts, making URLs like "booking[.]comんdetailんrestric-access.www-account-booking[.]com" appear legit at first glance. The real domain is actually "www-account-booking[.]com" but that visual trickery works surprisingly well.

The attack chain leads to an MSI installer that drops further payloads, likely infostealers or RATs. BleepingComputer also spotted a similar campaign targeting Intuit users with "Lntuit[.]com" domains - simple but effective when viewed on mobile. These homograph attacks aren't new but always fun.(read more)

Hackers reportedly compromise Canadian House of Commons through Microsoft vulnerability

The Canadian House of Commons got hit through a Microsoft vulnerability, with attackers accessing a database containing device management info. They don’t say which Microsoft vuln but my bet is Sharepoint due to timing. The breach exposed employee details, device info, and computer management data - though the full scope isn't clear yet. The House is working with national security teams but keeping quiet on details during the investigation. (read more)

Crypto24 ransomware hits large orgs with custom EDR evasion tool

New ransomware crew called Crypto24 has been making moves against big orgs across the US, Europe, and Asia since September. Not script kiddies! They're running custom EDR evasion tools that can evade security tools like Trend Micro, SentinelOne, and Sophos. The attackers are hitting finance, manufacturing, entertainment, and tech companies with some pretty sophisticated tactics, including a custom keylogger and data exfiltration tools that push stolen files straight to Google Drive. (read more)

Foreign Hackers Said to Access Sealed National Security Cases

(read more)

That 16 Billion Password Story (AKA "Data Troll")

Remember that "16 billion passwords exposed" headline from June that was everywhere? Troy Hunt dug into it and, surprise - it's way less dramatic than reported. The data, dubbed "Data Troll" in HIBP, comes from various infostealer logs that have been floating around this year, not some massive new breach. After analyzing 775GB across 2.7B rows (about 17% of the claimed total), it boiled down to just 109M unique email addresses - a 96% reduction from the raw numbers. And! 96% of those were already in HIBP.

The interesting bits: they found 4.4M previously unknown email addresses and 231M unique passwords (most already known). Worth adding to your threat intel, but definitely not the "biggest ever" breach the media claimed. (read more)

Fortinet warns of FortiSIEM pre-auth RCE flaw with exploit in the wild

Man. VPN and router shops are just 0day factories the recently. Rough. Fortinet patched a critical RCE vulnerability in FortiSIEM (CVE-2025-25256, CVSS 9.8) that's already got exploit code floating around in the wild. The bug lets unauthenticated attackers execute commands through crafted CLI requests, and there's no easy way to tell if you've been hit since it doesn't leave clear IOCs behind.

This comes right after GreyNoise spotted a surge in brute-force attempts against Fortinet SSL VPNs and FortiManager earlier this month. If you're running FortiSIEM (versions 5.4 through 7.3), you'll want to upgrade to the latest patched version ASAP. Running an older version below 6.7? Time to modernize, as those versions won't be getting patches. For a quick band-aid, you can limit access to phMonitor on port 7900, but that's just buying time until you can properly upgrade. (read more)

DEF CON volunteers step up to help water sector after China, Iran attack utilities

Remember when everyone was freaking out about China's Volt Typhoon campaign? Well, Jake Braun decided to do something about it. He launched DEF CON Franklin - basically pairing white-hat hackers with water utilities that desperately need cybersecurity help. The response was insane - 350 volunteers signed up so fast he had to shut down the website. They just wrapped a 9-month pilot program helping utilities in Indiana, Oregon, Utah, and Vermont with basic stuff like password protocols and vulnerability assessments.

Most of America's 50,000+ water utilities are broke, understaffed, and honestly pretty suspicious of outsiders trying to help them. Braun had to work through the National Rural Water Association just to get his foot in the door. The volunteers aren't dealing with anything fancy either - mostly helping with default passwords and multi-factor authentication. It's kind of wild that we need DEF CON volunteers to fill this gap, but as Braun puts it, "it's one of our volunteers or nothing" right now. The plan is to scale up fast because, spoiler alert, China doesn’t care if you’re understaffed. (read more)

WinRAR Zero-Day Under Active Exploitation – Update to Latest Version Immediately

WinRAR users need to patch up right now - there's an actively exploited zero-day (CVE-2025-8088) that lets attackers execute code through malicious archives. The bug is a path traversal flaw that tricks WinRAR into writing files outside the intended directory during extraction. It got patched in version 7.13 back in July. ESET researchers found it's being used by both the Paper Werewolf and RomCom groups to target organizations across Europe and Canada with resume-themed phishing emails.

What's wild is that someone was hawking this exploit on Russian dark web forums for $80,000 before it went public. The attack chain is pretty slick too: malicious archive gets opened, drops a DLL, sets up persistence through Windows startup, then delivers various backdoors. No successful compromises reported yet, but that's probably more luck than anything else. Time to hit that update button if you haven't already. (read more)

Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere

Here's a fun one from DefCon. Security researcher Eaton Zveare discovered some flaws in an unnamed carmaker's dealership portal that basically turned him into a car hacking god. The bugs let him create a "national admin" account with access to over 1,000 dealers across the US. From there, he could look up anyone's vehicle and driver data using just their name, and even pair their car with his own mobile account for remote control access.

He tested it with a friend's consent and could remotely unlock their car just by knowing their name. The portal had zero real authentication - just a "pinky promise" that you're legit when transferring vehicle ownership. Plus, single sign-on meant he could hop between dealer systems and impersonate other users. The carmaker fixed it within a week of disclosure. Two simple API vulnerabilities and suddenly every car in their network is potentially compromised. (read more)

After researchers unmasked a prolific SMS scammer, a new operation has emerged in its wake

I KNOW you’ve gotten those annoying SMS scams about unpaid tolls and undelivered packages. Turns out there's been a massive operation behind them. Researchers tracked down the guy running "Magic Cat" scamware - a 24-year-old Chinese national named Yucheng C. who went by "Darcula." His operation pulled in 884,000 stolen credit card details over seven months in 2024, complete with phone farms and payment terminals for cashing out. After getting exposed, he went dark, but now there's a new player called "Magic Mouse" that's already stealing 650,000 credit cards monthly.

Law enforcement seems to be treating these as scattered fraud reports instead of going after the bigger operations. (read more)

860K Compromised in Columbia University Data Breach

Columbia University just disclosed a data breach affecting 860,000 people, with the exposed data including names, SSNs, addresses, and financial account numbers. While they haven't seen any misuse of the data yet, the breach apparently happened way back in July 2023 but wasn't discovered until February 2024 - that's concerning. They're doing the usual post-breach dance of free credit monitoring and identity protection services. Guess why we found out? If you’re a long time reader this should be easy. The state of Maine! Thanks Maine for your laws requireing disclosure! (read more)

New Android Malware Wave Hits Banking via NFC Relay Fraud, Call Hijacking, and Root Exploits

Android users are getting hit with some pretty nasty banking malware lately. An interesting one is PhantomCard, which tricks Brazilian users into thinking they're protecting their cards but actually uses NFC to relay their card data to attackers in real-time. Victims put their card on their phone, enter their PIN, and boom - criminals can use their card at any nearby ATM or terminal like they physically have it. It's distributed through fake Google Play pages complete with bogus reviews.

Meanwhile, Indian banking users are dealing with SpyBanker, which does something particularly clever - it hijacks call forwarding so when banks try to call victims for fraud verification, the calls get redirected to the attackers instead. There's also a separate campaign hitting Indian users with fake banking apps that steal credit card info while secretly mining cryptocurrency in the background. These crews are getting creative with combining old-school social engineering with newer attack vectors. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay