Hacker figure surrounded by laptop, screens, locks, shields, malware icons, and cryptocurrency symbols displayed

Daily Dose of Cybersecurity News - October 8, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

October 8, 2025 6:03 AM 5 min read

ShinyHunters Launches Extensive Corporate Extortion Campaign

Critical

What happened

The cybercriminal group ShinyHunters initiated a widespread extortion campaign targeting numerous Fortune 500 companies. They employed voice phishing techniques to infiltrate Salesforce portals, exfiltrating sensitive customer data and threatening public disclosure unless ransom demands are met.

Who is affected

Major corporations, including Toyota, FedEx, Disney/Hulu, and UPS, have been listed as victims, with their customer data compromised through Salesforce breaches.

Why it matters

This campaign underscores the escalating threat posed by sophisticated social engineering attacks, leading to significant data breaches and potential financial and reputational damage for large enterprises.

How it could have been prevented

Implementing robust multi-factor authentication (MFA) protocols and conducting regular employee training on recognizing and responding to social engineering tactics could mitigate such threats.

Relevant professional terms

Voice Phishing (Vishing): A type of social engineering attack where attackers use phone calls to deceive individuals into divulging confidential information.
Multi-Factor Authentication (MFA): A security system that requires multiple forms of verification to grant access, enhancing protection against unauthorized entry.

Recommended reading: EclecticIQ Analysis on ShinyHunters' Extortion Tactics

Source: krebsonsecurity.com

Salesforce Declines Ransom Payment Amidst Massive Data Theft Attacks

Critical

What happened

Salesforce has confirmed its refusal to negotiate or pay ransom demands following extensive data theft attacks targeting its customers. The cybercriminal group "Scattered Lapsus$ Hunters" has threatened to leak nearly 1 billion stolen records unless their demands are met.

Who is affected

High-profile companies including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, and others have been listed as victims of these data theft attacks.

Why it matters

The scale of this data breach poses significant risks to the confidentiality and integrity of sensitive customer information, potentially leading to financial losses, reputational damage, and regulatory penalties for the affected organizations.

How it could have been prevented

Implementing robust multi-factor authentication (MFA) protocols, conducting regular security awareness training to prevent social engineering attacks, and closely monitoring OAuth application permissions could have mitigated the risk of unauthorized access.

Relevant professional terms

OAuth: An open standard for access delegation, commonly used for token-based authentication and authorization, allowing third-party services to access user information without exposing credentials.
Social Engineering: The psychological manipulation of individuals into performing actions or divulging confidential information, often used to gain unauthorized access to systems or data.

Recommended reading: Salesforce: Is Your Backup Strategy Ransomware-Resilient?

Source: bleepingcomputer.com

Google Declines to Patch ASCII Smuggling Vulnerability in Gemini

High

What happened

A security researcher identified an ASCII smuggling vulnerability in Google's Gemini AI assistant, allowing attackers to embed hidden commands that can manipulate the AI's behavior and data. Google has chosen not to address this issue, categorizing it as a non-security bug.

Who is affected

Users of Google's Gemini AI assistant, particularly those utilizing its integration with Google Workspace applications like Calendar and Gmail.

Why it matters

The vulnerability enables attackers to inject invisible commands into AI interactions, potentially leading to misinformation, unauthorized data access, and compromised AI behavior, especially concerning given Gemini's autonomous capabilities and access to sensitive user data.

How it could have been prevented

Implementing robust input sanitization to detect and neutralize hidden commands, and enhancing user interface designs to reveal any concealed instructions.

Relevant professional terms

ASCII Smuggling: A technique where attackers embed malicious payloads using special characters that are invisible to users but interpretable by systems.
Input Sanitization: The process of validating and cleaning user inputs to prevent malicious data from causing unintended actions.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

DraftKings Accounts Compromised in Credential Stuffing Attack

High

What happened

DraftKings, a prominent sports betting company, experienced a credential stuffing attack where unauthorized parties accessed customer accounts using stolen login credentials from other services.

Who is affected

An undisclosed number of DraftKings customers who reused login credentials across multiple platforms.

Why it matters

The breach exposed personal information, including names, addresses, birth dates, phone numbers, email addresses, and partial payment card details, increasing the risk of identity theft and financial fraud.

How it could have been prevented

Implementing unique, strong passwords for each online account and enabling two-factor authentication (2FA) to add an extra layer of security.

Relevant professional terms

Credential Stuffing: A cyberattack method where attackers use automated tools to attempt access to user accounts by trying large numbers of username and password combinations, often obtained from previous data breaches.
Two-Factor Authentication (2FA): A security process in which users provide two different authentication factors to verify themselves, enhancing account security beyond just a password.

Recommended reading: CISA: Choosing and Protecting Passwords

Source: bleepingcomputer.com

Clop Exploits Oracle EBS Zero-Day (CVE-2025-61882) for Data Theft

Critical

What happened

The Clop ransomware gang exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS) to steal sensitive data from unpatched systems since early August 2025.

Who is affected

Organizations using Oracle EBS versions 12.2.3 through 12.2.14 are at risk, particularly those with internet-exposed instances.

Why it matters

This vulnerability allows unauthenticated remote code execution, enabling attackers to access and exfiltrate sensitive corporate data, leading to potential financial and reputational damage.

How it could have been prevented

Timely application of security patches and updates, regular vulnerability assessments, and minimizing internet exposure of critical systems.

Relevant professional terms

Zero-Day Vulnerability: A software flaw unknown to the vendor, exploited by attackers before a fix is available.
Remote Code Execution (RCE): The ability of an attacker to execute arbitrary code on a target system remotely.

Source: bleepingcomputer.com

North Korean Hackers Steal Over $2 Billion in Cryptocurrency in 2025

Critical

What happened

North Korean state-sponsored hackers have stolen an estimated $2 billion in cryptocurrency assets in 2025, marking the largest annual total on record. The largest single incident was the Bybit hack in February, resulting in a $1.46 billion loss.

Who is affected

Cryptocurrency exchanges, individual holders, and exchange employees have been targeted, with funds reportedly used to support North Korea's nuclear weapons program.

Why it matters

The significant increase in cyber-enabled thefts underscores the growing reliance of North Korea on illicit cyber activities to fund its regime, posing substantial financial and security risks globally.

How it could have been prevented

Implementing robust security measures, including multi-factor authentication, regular security audits, and employee training on social engineering tactics, could mitigate the risk of such attacks.

Relevant professional terms

Social Engineering: Manipulative techniques used by attackers to deceive individuals into divulging confidential information or performing actions that compromise security.
Cryptocurrency Exchange: A platform that allows individuals to buy, sell, or trade cryptocurrencies for other digital assets or traditional currencies.

Source: bleepingcomputer.com

Medusa Ransomware Exploits Critical Fortra GoAnywhere Vulnerability (CVE-2025-10035)

Critical

What happened

A critical deserialization vulnerability (CVE-2025-10035) in Fortra's GoAnywhere Managed File Transfer (MFT) software is being actively exploited by the Medusa ransomware group. Attackers can execute arbitrary commands remotely without authentication by crafting a forged license response signature.

Who is affected

Organizations using vulnerable versions of Fortra's GoAnywhere MFT software are at risk, with multiple entities already compromised by the Medusa ransomware group.

Why it matters

The exploitation of this vulnerability allows attackers to gain full control over affected systems, leading to data exfiltration, system encryption, and significant operational disruptions. The ease of exploitation and the critical nature of the flaw underscore the urgency for immediate remediation.

How it could have been prevented

Timely application of security patches provided by Fortra, restricting public internet exposure of the GoAnywhere Admin Console, and implementing robust monitoring for suspicious activities could have mitigated the risk.

Relevant professional terms

Deserialization Vulnerability: A security flaw that occurs when untrusted data is used to abuse the logic of an application by injecting malicious code during the deserialization process.
Remote Code Execution (RCE): The ability of an attacker to execute arbitrary code on a remote system, potentially leading to full system compromise.

Recommended reading: Microsoft Security Blog

Source: darkreading.com