Daily Dose of Cybersecurity News – August 29, 2025
Salesloft Breach Compromises OAuth Tokens, Affects Google Workspace Accounts
HighWhat happened
Attackers exploited a breach in Salesloft's Drift integration, stealing OAuth tokens to access customer Salesforce instances and a limited number of Google Workspace email accounts.
Who is affected
Organizations using Salesloft's Drift integration with Salesforce and Google Workspace are impacted.
Why it matters
The breach exposes sensitive data, including AWS access keys and passwords, potentially leading to further unauthorized access and data exfiltration.
How it could have been prevented
Regularly auditing and securing OAuth tokens, implementing strict access controls, and monitoring integrations for unusual activities.
Relevant professional terms
- OAuth Token
- A credential used to authorize access to resources on behalf of a user without sharing credentials.
- Data Exfiltration
- Unauthorized transfer of data from a computer or network.
Recommended reading: Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks
Threat Actors Exploit AI to Develop Ransomware-as-a-Service
HighWhat happened
A UK-based threat actor utilized Anthropic's Claude Code AI to develop and commercialize a ransomware-as-a-service (RaaS) platform, creating sophisticated ransomware tools with advanced evasion capabilities.
Who is affected
Organizations and individuals targeted by the RaaS operation, as well as the cybersecurity community monitoring AI-assisted cyber threats.
Why it matters
This incident highlights the potential misuse of AI technologies in cybercrime, enabling less skilled threat actors to develop complex malware, thereby increasing the frequency and sophistication of ransomware attacks.
How it could have been prevented
Implementing stricter access controls and monitoring mechanisms for AI development tools to prevent their exploitation by malicious actors.
Relevant professional terms
- Ransomware-as-a-Service (RaaS)
- A business model where cybercriminals provide ransomware tools and infrastructure to affiliates in exchange for a share of the ransom payments.
- Reflective DLL Injection
- A technique used by malware to inject a dynamic link library (DLL) into a process's memory space without using the standard Windows loader, aiding in evasion of detection.
Recommended reading: BleepingComputer
Passwordstate Authentication Bypass Vulnerability (CVE-2024-39337)
HighWhat happened
Click Studios identified a high-severity authentication bypass vulnerability in Passwordstate, allowing attackers to access the administration section without proper authentication.
Who is affected
Organizations using Passwordstate versions prior to 9.9 Build 9972 are vulnerable to this security flaw.
Why it matters
Exploitation of this vulnerability could grant unauthorized access to sensitive credentials, posing significant security risks to affected organizations.
How it could have been prevented
Regularly updating software to the latest versions and promptly applying security patches can mitigate such vulnerabilities.
Relevant professional terms
- Authentication Bypass
- A security flaw that allows unauthorized users to gain access to a system without proper credentials.
- Emergency Access Page
- A feature in Passwordstate designed for urgent access to administrative functions, which was exploited in this vulnerability.
Recommended reading: Passwordstate Changelog
MathWorks Ransomware Attack Exposes Data of Over 10,000 Individuals
HighWhat happened
MathWorks, the developer of MATLAB and Simulink, experienced a ransomware attack in April 2025, leading to the theft of personal data from over 10,000 individuals. The breach disrupted critical internal systems and customer-facing services, including multi-factor authentication, Single Sign-On, the MathWorks Cloud Center, file exchange, license center, and online store.
Who is affected
Over 10,000 individuals, including current and former MathWorks employees and customers, had their personal information compromised. The stolen data includes names, addresses, dates of birth, Social Security Numbers, and non-U.S. national identification numbers.
Why it matters
The exposure of sensitive personal information poses significant risks of identity theft and financial fraud for the affected individuals. Additionally, the disruption of MathWorks' services impacted numerous organizations and researchers relying on MATLAB and Simulink for critical projects, highlighting the vulnerability of essential software platforms to cyberattacks.
How it could have been prevented
Implementing robust network monitoring to detect unauthorized access promptly, ensuring timely application of security patches to prevent exploitation of vulnerabilities, and conducting regular security audits to identify and mitigate potential risks.
Relevant professional terms
- Ransomware
- Malicious software designed to block access to a computer system or data, typically by encrypting files, until a ransom is paid.
- Data Exfiltration
- The unauthorized transfer of data from a computer or network, often conducted by cybercriminals to steal sensitive information.
Recommended reading: MathWorks Trust Center: May 2025 Ransomware Incident
Shadow IT Exposures Expand Organizational Attack Surfaces
HighWhat happened
Security researchers identified multiple instances of Shadow IT-unauthorized systems and applications-exposing sensitive data through unsecured backups, open Git repositories, and unauthenticated admin panels.
Who is affected
Organizations with unmanaged or unknown IT assets that are accessible from the internet.
Why it matters
These exposures can lead to unauthorized access, data breaches, and potential exploitation by attackers, increasing the organization's risk profile.
How it could have been prevented
Implementing continuous asset discovery and monitoring to identify and secure unauthorized systems before they become exploitable.
Relevant professional terms
- Shadow IT
- IT systems, devices, software, applications, and services used within an organization without explicit organizational approval.
- Subdomain Enumeration
- The process of identifying subdomains associated with a domain, often used to discover hidden or forgotten assets.
Recommended reading: How to manage shadow IT and reduce your attack surface
TransUnion Data Breach Exposes Personal Information of Over 4.4 Million Individuals
HighWhat happened
TransUnion experienced a data breach on July 28, 2025, involving unauthorized access to a third-party application used in their U.S. consumer support operations. The breach exposed personal information of over 4.4 million individuals. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/transunion-suffers-data-breach-impacting-over-44-million-people/?utm_source=openai))
Who is affected
Approximately 4.4 million individuals in the United States, including 16,828 residents of Maine, had their personal information compromised. ([claimdepot.com](https://www.claimdepot.com/data-breach/transunion-2025-eb52b?utm_source=openai))
Why it matters
The exposed data includes sensitive personal information such as names, Social Security numbers, dates of birth, addresses, and government IDs. This information can be exploited for identity theft, financial fraud, and other malicious activities, posing significant risks to the affected individuals. ([claimdepot.com](https://www.claimdepot.com/data-breach/transunion-2025-eb52b?utm_source=openai))
How it could have been prevented
Implementing robust security measures for third-party applications, conducting regular security audits, and ensuring strict access controls could have mitigated the risk of unauthorized access.
Relevant professional terms
- Third-Party Application
- Software developed by an external organization that integrates with a company's systems to provide additional functionality.
- Unauthorized Access
- Gaining access to a system, network, or data without permission, often leading to data breaches or other security incidents.
Recommended reading: BleepingComputer
CISA, FBI, NSA Warn of Chinese 'Global Espionage System'
CriticalWhat happened
Government agencies, including CISA, FBI, and NSA, issued a joint advisory warning about Chinese state-sponsored cyber actors, notably Salt Typhoon, infiltrating global networks by exploiting known vulnerabilities in network devices.
Who is affected
Organizations in telecommunications, government, transportation, lodging, and defense sectors worldwide are targeted by these cyber actors.
Why it matters
The persistent access gained by these actors poses significant risks, including espionage and potential disruption of critical infrastructure services.
How it could have been prevented
Regularly applying security patches to address known vulnerabilities and monitoring network configurations for unauthorized changes can mitigate such threats.
Relevant professional terms
- Advanced Persistent Threat (APT)
- A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period.
- Access Control List (ACL)
- A set of rules that control network traffic and dictate which users or system processes are granted access to objects.