Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
2024 Vulnerability Exploitation Trends
– 768 CVEs exploited in 2024; +20% YoY.
– 23.6% of KEVs exploited by disclosure date.
– Monthly spikes linked to industry events and new reporting sources.
– Diverse reporting sources include security vendors, government agencies, and product companies.
– VulnCheck KEV enhances visibility on exploitations; practical insights provided to security teams.
WhatsApp accused Israeli spyware firm Paragon of targeting nearly 100 journalists and civil society members with zero-click malware attacks via malicious PDFs. WhatsApp has identified and blocked the attack method, sending cease-and-desist letters to Paragon and notifying affected users. The incidents occurred in December 2024, with WhatsApp affirming its commitment to user privacy.
https://www.malwarebytes.com/blog/news/2025/02/whatsapp-says-paragon-is-spying-on-specific-users
Extreme TLDR:
Massive geolocation data leak revealed 2000+ apps collecting user location without consent. Research showed my iPhone exposed requests with my IP and location despite Location Services off. Learned about ad data auctions, found high costs for purchasing my data, and discovered methods to track myself using data brokers. Notable findings included Unity and Facebook using my data without consent. The investigation highlighted extensive data sharing with third parties and the ease of accessing personal data linked to device identifiers.
Over 57 nation-state threat groups, including those from China, Iran, North Korea, and Russia, are using Google-powered AI, notably Gemini, for cyber operations. These groups primarily use AI for research, troubleshooting code, and creating content. Iranian group APT42 utilizes Gemini extensively for phishing and reconnaissance, while Chinese APTs leverage it for network infiltration tactics. Russian actors focus on converting malware, and North Koreans use it for job applications to infiltrate Western companies. Google highlights the urgent need for public-private cooperation to enhance cyber defenses.
https://thehackernews.com/2025/01/google-over-57-nation-state-threat.html
New Syncjacking attack exploits benign Chrome extensions to hijack devices via Google profile and browser takeover. Attackers create a malicious Google Workspace domain, trick victims into installing an extension, and gain access to their data after syncing. They further take control through a fake Zoom update, allowing extensive control over the victim's browser and files while remaining stealthy and requiring minimal user interaction.
DeepSeek, a Chinese AI startup, exposed two unsecured databases with over 1 million plaintext chat records, API keys, and operational data. Discovered by Wiz Research during a security assessment, these databases allowed unauthorized access and SQL queries via a web interface. The exposure raises significant security concerns for DeepSeek and its users, as attackers could retrieve sensitive information and potentially exploit the company's internal systems. Wiz reported the issue, prompting DeepSeek to secure the databases promptly.
Malicious Google ads target Microsoft advertisers, attempting to steal login info for Microsoft's ad platform. Attackers use cloaking techniques to redirect users and evade security, ultimately leading to a phishing page that mimics the legitimate site. The campaign highlights ongoing phishing threats in online advertising, urging users to verify URLs, utilize two-factor authentication, monitor accounts, and report suspicious ads.
Chrome updated to version 132.0.6834.159/160 for Windows, Mac, and Linux on January 28, 2025, with rolling release. Includes 2 security fixes, notably a Medium CVE-2025-0762 bug. Thanks to researchers for contributions. More details in the Chrome Security Page.
https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html
Vulnerabilities in Apple chips (A- and M-series) allow side-channel attacks, FLOP and SLAP, to leak sensitive data from browsers like Chrome and Safari. FLOP exploits the load value predictor to steal memory contents, affecting data from services like Gmail and iCloud, while SLAP targets the load address predictor, limited to Safari. Devices from 2021 onwards are affected. Researchers indicated potential mitigations, and Apple intends to address the issues, though they don't view them as immediate threats.
Phishing campaign uses malicious PDFs claiming expired Amazon Prime memberships to trick users into revealing personal and financial data. Researchers at Palo Alto Networks Unit42 found 31 such PDFs linking to fake Amazon sites, utilizing cloaked domains to evade detection. Users are advised to be cautious of suspicious emails.
https://www.darkreading.com/cyberattacks-data-breaches/phishing-campaign-malicious-amazon-pdfs
DeepSeek suspends new registrations on its AI chat platform due to a “large-scale” cyberattack, believed to be a DDoS attack. The platform recently gained attention for outperforming US models, causing a sell-off in US stocks. Existing users can still log in, but cybersecurity researchers report vulnerabilities in DeepSeek's model that could enable malicious outputs.
Microsoft is testing a new “scareware blocker” for Edge browser to detect and block tech support scams using local machine learning. It alerts users about potential scams and allows reporting to improve detection accuracy. Users can find the feature in Edge's privacy settings, and it enhances protection alongside Defender SmartScreen, which catalogs malicious sites.
Apple users must update devices to fix a zero-day vulnerability actively exploited in iOS. Affected devices include iPhone XS and newer, certain iPads, macOS Sequoia, Apple Watch Series 6+, and Apple TV models. Users should check for updates in Settings and consider enabling Automatic Updates. The vulnerability, tracked as CVE-2025-24085, allows privilege escalation via a misuse of memory in Core Media.
iOS 18.3 and iPadOS 18.3 security update released January 27, 2025, addresses multiple vulnerabilities affecting recent devices. Key fixes involve potential unauthorized access, denial-of-service risks, and privilege escalation. Each vulnerability is linked to specific CVE-ID, and Apple prioritizes user safety by withholding details until patches are available. For further details, consult the Apple security releases page.
TV-2025-1001 Summary: Vulnerability (CVE-2025-0065) in TeamViewer Clients allows local privilege escalation on Windows via argument injection; affects versions < 15.62. Fix: Update to version 15.62 or latest.
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1001/
