Multiple hackers attacking central laptop displaying code with shields, locks, warning icons, and data streams

Daily Dose of Cybersecurity News - August 30, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

August 30, 2025 6:02 AM 5 min read

Amazon Disrupts APT29's Watering Hole Campaign

High

What happened

Amazon's threat intelligence team identified and disrupted a watering hole campaign orchestrated by APT29, a group linked to Russia's Foreign Intelligence Service. The attackers compromised legitimate websites, injecting malicious JavaScript to redirect visitors to domains mimicking Cloudflare verification pages, aiming to harvest credentials via Microsoft's device code authentication flow.

Who is affected

Users visiting the compromised websites were targeted, with the campaign focusing on credential harvesting from individuals associated with government agencies, enterprises, and military organizations.

Why it matters

This incident highlights APT29's evolving tactics in cyber espionage, demonstrating their ability to compromise legitimate sites and employ sophisticated evasion techniques, posing significant risks to sensitive information and organizational security.

How it could have been prevented

Implementing robust web application security measures to prevent unauthorized code injection, conducting regular security audits of websites, and educating users to recognize and avoid suspicious redirects and authentication requests.

Relevant professional terms

Watering Hole Attack: A cyberattack strategy where attackers compromise legitimate websites to distribute malware or steal information from visitors.
Device Code Authentication Flow: A method allowing devices with limited input capabilities to authenticate users by directing them to a separate device or browser to complete the login process.

Recommended reading: Amazon Identified Internet Domains Abused by APT29

Source: aws.amazon.com

WhatsApp Zero-Click Vulnerability (CVE-2025-55177) Exploited in Targeted Attacks

Critical

What happened

A zero-click vulnerability (CVE-2025-55177) in WhatsApp's iOS and macOS clients was exploited in targeted attacks, allowing unauthorized processing of content from arbitrary URLs on victims' devices.

Who is affected

Fewer than 200 individuals worldwide, including members of civil society organizations, were targeted in this sophisticated cyberespionage campaign.

Why it matters

The exploitation of this vulnerability underscores the persistent threat posed by advanced spyware campaigns targeting high-profile individuals, emphasizing the need for robust security measures and prompt software updates.

How it could have been prevented

Regularly updating software to the latest versions and applying security patches promptly can mitigate the risk of exploitation. Additionally, implementing robust security protocols and monitoring for unusual activity can help detect and prevent such attacks.

Relevant professional terms

Zero-click exploit: A type of cyberattack that does not require any interaction from the victim, such as clicking a link or opening a file, to compromise a device.
Remote code execution (RCE): The ability of an attacker to run arbitrary code on a target device remotely, potentially gaining control over the system.

Recommended reading: reuters.com

Source: bleepingcomputer.com

Microsoft to Enforce MFA for Azure Resource Management in October

High

What happened

Microsoft announced that starting October 1, 2025, it will enforce multi-factor authentication (MFA) for all Azure resource management actions to enhance security against unauthorized access.

Who is affected

All Azure tenants and users performing resource management operations via Azure CLI, PowerShell, SDKs, APIs, and related tools.

Why it matters

Enforcing MFA adds an additional layer of security, significantly reducing the risk of unauthorized access and potential breaches in Azure environments.

How it could have been prevented

Proactively implementing MFA for all Azure resource management activities ahead of the enforcement date ensures compliance and enhances security posture.

Relevant professional terms

Multi-Factor Authentication (MFA): A security process that requires users to provide multiple forms of verification to access a resource, enhancing protection against unauthorized access.
Azure CLI: A command-line interface provided by Microsoft to manage Azure resources and services.

Recommended reading: Understanding Multi-Factor Authentication

Source: bleepingcomputer.com

AI-Generated Exploits Developed in Under 15 Minutes

High

What happened

Israeli cybersecurity researchers developed an AI-powered system that generates proof-of-concept (PoC) exploit code for software vulnerabilities in under 15 minutes. The system utilizes large language models (LLMs) to analyze CVE advisories and code patches, creating and validating exploit code against both vulnerable and patched software versions.

Who is affected

Organizations using open-source software are particularly impacted, as the AI system successfully generated exploits for 14 different vulnerabilities in such packages.

Why it matters

The rapid development of AI-generated exploits significantly reduces the time attackers need to weaponize vulnerabilities, leaving defenders with minimal time to patch systems. This acceleration could lead to more widespread and faster exploitation of software flaws.

How it could have been prevented

Implementing automated defense mechanisms capable of responding at machine speed, such as intrusion detection systems and automated patch management, can help mitigate the risks posed by rapid exploit development.

Relevant professional terms

Proof-of-Concept (PoC): A demonstration that a certain concept or theory has practical potential, often used to validate the feasibility of a security exploit.
Large Language Model (LLM): A type of artificial intelligence model trained on vast amounts of text data to understand and generate human-like language.

Source: darkreading.com

Google Workspace Accounts Compromised via Salesloft Drift Integration

High

What happened

Between August 8 and August 18, 2025, attackers exploited compromised OAuth tokens associated with the Salesloft Drift integration to access and exfiltrate data from corporate Salesforce instances. On August 9, 2025, the same method was used to access emails from a small number of Google Workspace accounts. ([securityweek.com](https://www.securityweek.com/google-confirms-workspace-accounts-also-hit-in-salesforce-salesloft-drift-data-theft-campaign/?utm_source=openai))

Who is affected

Organizations using Google Workspace accounts integrated with Salesloft Drift were affected. The threat actor, identified as UNC6395, targeted these integrations. ([securityweek.com](https://www.securityweek.com/google-confirms-workspace-accounts-also-hit-in-salesforce-salesloft-drift-data-theft-campaign/?utm_source=openai))

Why it matters

The compromise of OAuth tokens allowed unauthorized access to sensitive corporate data, including emails and credentials, posing significant security risks. This incident underscores the vulnerabilities associated with third-party integrations and the importance of securing OAuth tokens. ([securityweek.com](https://www.securityweek.com/google-confirms-workspace-accounts-also-hit-in-salesforce-salesloft-drift-data-theft-campaign/?utm_source=openai))

How it could have been prevented

Regularly auditing and monitoring OAuth token usage and permissions. Implementing strict access controls and promptly revoking compromised tokens. ([securityweek.com](https://www.securityweek.com/google-confirms-workspace-accounts-also-hit-in-salesforce-salesloft-drift-data-theft-campaign/?utm_source=openai))

Relevant professional terms

OAuth Token: A secure authorization method that allows third-party services to access user data without exposing credentials.
Credential Harvesting: The unauthorized collection of sensitive information, such as usernames and passwords, often for malicious purposes.

Source: securityweek.com

TransUnion Data Breach Exposes Personal Information of 4.4 Million Individuals

High

What happened

On July 28, 2025, TransUnion experienced a data breach through a third-party application used for U.S. consumer support operations, leading to unauthorized access to personal information of over 4.4 million individuals. ([securityweek.com](https://www.securityweek.com/transunion-data-breach-impacts-4-4-million/?utm_source=openai))

Who is affected

Approximately 4.4 million individuals in the United States had their personal information compromised. ([securityweek.com](https://www.securityweek.com/transunion-data-breach-impacts-4-4-million/?utm_source=openai))

Why it matters

The exposure of sensitive personal data, including Social Security numbers and dates of birth, increases the risk of identity theft and financial fraud for the affected individuals. ([securityweek.com](https://www.securityweek.com/transunion-data-breach-impacts-4-4-million/?utm_source=openai))

How it could have been prevented

Implementing stringent security measures for third-party applications, conducting regular security audits, and ensuring timely patching of vulnerabilities could have mitigated the risk of such breaches.

Relevant professional terms

Third-Party Application: Software developed by an external organization that integrates with or supports a company's operations.
Identity Theft: The fraudulent acquisition and use of a person's private identifying information, usually for financial gain.

Recommended reading: BleepingComputer

Source: securityweek.com

Nevada State Services Disrupted by Ransomware Attack

High

What happened

Nevada's state government experienced a sophisticated ransomware attack, leading to the closure of state offices and disruption of various services. The attackers exfiltrated data from the state's network, though the specific nature of the stolen data is still under investigation.

Who is affected

The attack impacted multiple state agencies, including the Department of Motor Vehicles, the Department of Public Safety, and the Nevada Gaming Control Board. Residents relying on state services also faced disruptions.

Why it matters

This incident underscores the vulnerability of critical state infrastructure to cyberattacks, potentially compromising sensitive citizen data and disrupting essential public services. The involvement of federal agencies highlights the severity and complexity of the attack.

How it could have been prevented

Implementing robust network segmentation to limit the spread of malware. Regularly updating and patching systems to address known vulnerabilities.

Relevant professional terms

Ransomware: A type of malicious software designed to block access to a computer system until a sum of money is paid.
Data Exfiltration: The unauthorized transfer of data from a computer or network.

Recommended reading: CISA's Response to Nevada Cyber Attack

Source: securityweek.com