🛡️ Weekly Cyber Update – May 26–June 1, 2025: Breaches, Scams & Zero-Day Exploits

Community Center Cybersecurity News
,
1

:shield: Weekly Cyber Update – May 26–June 1, 2025: Breaches, Scams & Zero-Day Exploits

This week’s update covers May 26–June 1, 2025, with 20 critical cybersecurity stories. For everyone, we’ve got breaches, scams, and easy safety tips. For pros, dive into zero-days, supply chain attacks, and botnet disruptions with technical insights. Plus, tools and questions to keep you sharp—let’s get started!

Cybersecurity for Everyone

Your online safety’s under threat this week! Victoria’s Secret’s site goes dark, fake AI tools spread malware, and TikTok videos trick users into downloading dangerous software. Protect yourself with our simple, actionable advice.

:police_car_light: Top Stories

1. Victoria’s Secret Website Taken Offline After Cyberattack :shopping_bags:

  • Summary: Hackers hit Victoria’s Secret, forcing the site offline and raising fears of data theft.
  • Why it matters: If you’ve shopped there, watch for phishing emails or odd charges—your info might be at risk.
  • :link: Read more

2. Fake AI Video Tools Spread Malware :movie_camera:

  • Summary: Scammers push fake AI video apps that install malware to steal your data.
  • Why it matters: Only download apps from trusted stores like Google Play or the App Store—avoid random links.
  • :link: Read more

3. TikTok Videos Trick Users into Malware Downloads :mobile_phone:

  • Summary: Cybercriminals use TikTok to spread videos that trick users into downloading malware.
  • Why it matters: Be careful with links in videos—stick to official sources to keep your device safe.
  • :link: Read more

4. Oversharing Online Puts You at Risk :camera_with_flash:

  • Summary: Posting too much on social media makes you a target for scams and identity theft.
  • Why it matters: Tighten your privacy settings and think twice before sharing personal details.
  • :link: Read more

5. Phone Theft Spikes: Protect Your Device :mobile_phone_with_arrow:

  • Summary: Thieves are snatching phones—even locked ones—for parts, and it’s on the rise.
  • Why it matters: Use a strong passcode and enable tracking to keep your phone secure.
  • :link: Read more

6. AI Voice Scams Target Ex-Government Workers :telephone_receiver:

  • Summary: Scammers use AI-generated voices to trick former government staff into sharing sensitive info.
  • Why it matters: Don’t trust unexpected calls—always verify the caller’s identity first.
  • :link: Read more

7. Lumma Stealer Operation Busted, 2,300 Domains Down :locked_with_key:

  • Summary: Police seized domains behind Lumma Stealer, a malware that steals passwords and more.
  • Why it matters: Use strong, unique passwords and two-factor authentication to protect your accounts.
  • :link: Read more

8. Fake Chrome Extensions Steal Data, Push Ads :police_car_light:

  • Summary: Over 100 malicious Chrome add-ons mimic legit tools to steal data and spam ads.
  • Why it matters: Only install extensions from trusted sources—check your browser settings now.
  • :link: Read more

9. Signal Stops Windows Recall from Snooping Chats :mobile_phone:

  • Summary: Signal’s update blocks Windows Recall from capturing screenshots of your private messages.
  • Why it matters: Use privacy-focused apps like Signal to keep your conversations secure.
  • :link: Read more

10. Marlboro-Chesterfield Pathology Data Breach Impacts 235,000 People :hospital:

Pro Insights: Advanced Cyber Threats (Advanced)

Tech pros, it’s a challenging week! Zero-days, supply chain attacks, and botnets target governments, logistics, and tech sectors. Sharpen your defenses with these technical insights.

:police_car_light: Top Technical Updates

1. Chinese Hackers Exploit SAP and SQL Server Flaws in Attacks Across Asia and Brazil :shield:

  • Summary: Hackers exploited flaws in SAP and SQL Server to target organizations in Brazil, India, and Southeast Asia.
  • Why it matters: Patch your systems immediately—zero-days (new flaws hackers exploit) can lead to full system compromise.
  • :link: Read more

2. New Linux Flaws Allow Password Hash Theft via Core Dumps in Ubuntu, RHEL, Fedora :penguin:

  • Summary: Vulnerabilities in Ubuntu, RHEL, and Fedora allow attackers to steal password hashes from core dumps.
  • Why it matters: Update your Linux systems now—core dumps can expose sensitive data if not secured.
  • :link: Read more

3. Hackers Use Fake VPN and Browser NSIS Installers to Deliver Winos 4.0 Malware :desktop_computer:

  • Summary: Fake installers for VPNs and browsers drop Winos 4.0 malware to steal user data.
  • Why it matters: Verify software sources—malware can slip through if you’re not careful.
  • :link: Read more

4. Operation ENDGAME Disrupted Global Ransomware Infrastructure :globe_showing_europe_africa:

  • Summary: Law enforcement took down 300 servers and seized €21.2 million in crypto, crippling ransomware networks.
  • Why it matters: Ransomware is still a threat—ensure your backups are secure and up to date.
  • :link: Read more

5. Silent Ransom Group Targeting Law Firms, the FBI Warns :balance_scale:

  • Summary: The Federal Bureau of Investigation warns that the Silent Ransom Group is using callback phishing to target law firms.
  • Why it matters: Train staff on social engineering—attacks like these can bypass technical defenses.
  • :link: Read more

6. Leader of Qakbot Cybercrime Network Indicted in U.S. Crackdown :robot:

  • Summary: The U.S. indicted the leader of Qakbot, a botnet that infected over 700,000 devices.
  • Why it matters: Botnets fuel DDoS and theft—monitor your network for unusual traffic.
  • :link: Read more

7. Hackers Use TikTok Videos to Distribute Vidar and StealC Malware via ClickFix Technique :video_camera:

  • Summary: Cybercriminals use TikTok to spread malware through fake software activation tips.
  • Why it matters: Educate users—social media can be a vector for sophisticated attacks.
  • :link: Read more

8. New Tool Disables Windows Defender :shield:

  • Summary: ‘Defendnot’ tricks Windows into disabling Defender by posing as an antivirus.
  • Why it matters: Keep Defender updated and monitor system changes to block bypasses.
  • :link: Read more

9. Scattered Spider Targets Retail Sector :shopping_cart:

  • Summary: The group now targets U.S. retailers with social engineering and ransomware.
  • Why it matters: Retail pros, tighten access controls and train staff on phishing.
  • :link: Read more

10. CISA Flags Chromium, DrayTek, SAP Flaws :clipboard:

  • Summary: Cybersecurity and Infrastructure Security Agency listed exploited bugs in Chromium, DrayTek routers, and SAP NetWeaver.
  • Why it matters: Patch these vulnerabilities immediately—hackers are actively exploiting them.
  • :link: Read more

:brain: Takeaway

Breaches, scams, and zero-days are on the rise—stay vigilant!

  • :locked: Use strong passwords and two-factor authentication everywhere.
  • :mobile_phone_with_arrow: Download apps only from trusted stores.
  • :man_detective: Verify links, calls, and emails to avoid fakes.

:hammer_and_wrench: Tools of the Week

  • Bitwarden (Everyone) — A free, open-source password manager to securely store and generate strong passwords.
  • Wireshark (Pros) — A powerful network protocol analyzer for deep packet inspection and troubleshooting.

:speech_balloon: Community Questions

  • Everyone: Have you spotted any suspicious TikTok links or scam calls lately? What’s your top safety tip?
  • Pros: How are you tackling supply chain risks like those in SAP and SQL Server? Share your strategy!

:globe_with_meridians: Stay Connected and Secure

Want more? :bell: Join the Crushing Security newsletter for fresh news and tips: Sign up here.
Drop your thoughts below—let’s keep the conversation going!

:repeat_button: Suggestions

:light_bulb: Got ideas to improve these updates? Comment below, visit the feedback page, or ping Steve.