Team around multiple laptops with central shield displaying spider web, lock, and warning icons
Home»Cybersecurity News Summary»Daily Dose of Cybersecurity News - September 11, 2025

Daily Dose of Cybersecurity News - September 11, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko
September 11, 2025 6:02 AM 5 min read

DDoS Mitigation Service Targeted in 1.5 Bpps Attack

High

What happened

A European DDoS mitigation service provider was targeted by a massive distributed denial-of-service (DDoS) attack, peaking at 1.5 billion packets per second (Bpps). The attack primarily utilized compromised IoT devices and MikroTik routers to generate a UDP flood.

Who is affected

The unnamed DDoS mitigation service provider and its clientele were directly impacted by the attack. The malicious traffic originated from over 11,000 unique networks worldwide.

Why it matters

This incident underscores the escalating scale and sophistication of DDoS attacks, highlighting the vulnerability of even specialized defense services. It emphasizes the need for robust, adaptive mitigation strategies to protect critical infrastructure.

How it could have been prevented

Implementing stringent security measures on IoT devices and routers to prevent compromise, and deploying advanced anomaly detection systems to identify and mitigate such high-volume attacks promptly.

Relevant professional terms

UDP Flood
A type of DDoS attack where large volumes of User Datagram Protocol (UDP) packets are sent to a target to overwhelm its network.
IoT Devices
Internet of Things devices, such as smart home appliances and connected gadgets, which can be exploited if not properly secured.

Recommended reading: Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps

Source: bleepingcomputer.com

Massive NPM Supply-Chain Attack Impacts Cloud Environments

High

What happened

A significant supply-chain attack targeted the NPM ecosystem when a maintainer's account was compromised through a phishing attack. The attackers injected malicious code into widely-used packages, aiming to steal cryptocurrency by redirecting transactions.

Who is affected

Approximately 10% of cloud environments that downloaded the compromised packages during the two-hour window before detection and removal.

Why it matters

This incident underscores the vulnerabilities in software supply chains and the potential for widespread impact when popular open-source packages are compromised. It highlights the need for vigilant security practices among developers and organizations.

How it could have been prevented

Implementing multi-factor authentication (MFA) for maintainer accounts to prevent unauthorized access. Regularly monitoring and auditing package versions for unexpected changes or malicious code.

Relevant professional terms

Supply-Chain Attack
A cyberattack that targets less secure elements in the supply chain to compromise a system.
Phishing
A fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.

Recommended reading: Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack

Source: bleepingcomputer.com

Cursor AI Editor Vulnerability Allows Automatic Execution of Malicious Code

High

What happened

A vulnerability in the Cursor AI-powered code editor allows automatic execution of tasks defined in a project's configuration file upon opening a repository, potentially enabling the execution of malicious code without user consent.

Who is affected

Developers using the Cursor IDE are at risk, especially when opening untrusted or public repositories.

Why it matters

This vulnerability can lead to unauthorized code execution, compromising developer environments, and potentially resulting in data theft or system hijacking.

How it could have been prevented

Implementing a prompt for user consent before executing tasks from a repository and enabling Workspace Trust features to prevent automatic task execution from untrusted sources.

Relevant professional terms

Workspace Trust
A security feature in code editors that prompts users to trust a workspace before executing tasks or extensions, preventing automatic execution of potentially malicious code.
Integrated Development Environment (IDE)
A software application that provides comprehensive facilities to computer programmers for software development, including a code editor, debugger, and build automation tools.

Recommended reading: AI-powered Cursor IDE vulnerable to prompt-injection attacks

Source: bleepingcomputer.com

Jaguar Land Rover Confirms Data Theft Following Cyberattack

High

What happened

Jaguar Land Rover (JLR) experienced a cyberattack that led to the theft of internal data and significant disruptions in production and retail operations.

Who is affected

JLR's internal systems and operations were compromised, affecting employees and potentially sensitive company data.

Why it matters

The breach underscores the vulnerability of major automotive manufacturers to cyber threats, highlighting the need for robust cybersecurity measures to protect sensitive data and maintain operational continuity.

How it could have been prevented

Implementing multi-factor authentication, regular security audits, and employee cybersecurity training could have mitigated the risk of such breaches.

Relevant professional terms

Data Breach
Unauthorized access and retrieval of sensitive information.
Operational Disruption
Interruption of normal business processes due to unforeseen events.

Recommended reading: reuters.com

Source: bleepingcomputer.com

Clorox Suffers $380M Loss Due to Social Engineering Attack

Critical

What happened

Attackers impersonated Clorox employees and convinced the company's third-party service desk to reset passwords and multi-factor authentication (MFA) settings, leading to unauthorized access and significant financial losses.

Who is affected

Clorox Company and its third-party service provider, Cognizant.

Why it matters

This incident underscores the critical importance of robust verification processes in service desks to prevent social engineering attacks that can result in substantial financial and operational damages.

How it could have been prevented

Implementing strict verification protocols for password and MFA resets, such as requiring multiple forms of identification and using secure communication channels, could have mitigated the risk of unauthorized access.

Relevant professional terms

Social Engineering
A manipulation technique that exploits human error to gain private information, access, or valuables.
Multi-Factor Authentication (MFA)
A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity.

Recommended reading: specopssoft.com

Source: bleepingcomputer.com

Chinese State-Backed Hackers Impersonate U.S. Congressman in Spear-Phishing Campaign

High

What happened

Chinese state-sponsored hackers, suspected to be part of APT41, impersonated U.S. Representative John Moolenaar in a series of spear-phishing attacks aimed at high-level targets during ongoing U.S.-China trade discussions.

Who is affected

Trusted contacts and associates of Rep. John Moolenaar, particularly those involved in U.S.-China trade negotiations.

Why it matters

This campaign highlights the persistent threat posed by state-sponsored cyber-espionage activities targeting U.S. political figures and their networks, aiming to influence policy deliberations and gain strategic advantages.

How it could have been prevented

Implementing robust email authentication protocols, such as DMARC, to prevent email spoofing; conducting regular security awareness training for individuals involved in sensitive communications; and employing advanced threat detection systems to identify and mitigate spear-phishing attempts.

Relevant professional terms

Spear-Phishing
A targeted attempt to steal sensitive information by masquerading as a trustworthy entity in electronic communications.
APT41
An advanced persistent threat group believed to be state-sponsored by China, known for conducting cyber-espionage and financially motivated operations.

Recommended reading: US Charges China's APT-for-Hire Hackers

Source: darkreading.com

ChillyHell macOS Backdoor Resurfaces with Enhanced Capabilities

High

What happened

A modular macOS backdoor known as ChillyHell, initially identified in attacks against Ukrainian officials in 2022, has resurfaced with enhanced capabilities. The malware now includes multiple persistence mechanisms, the ability to brute-force passwords, drop additional payloads, and communicate over various protocols.

Who is affected

Organizations and individuals using macOS systems are at risk, particularly those who may download and execute unverified applications.

Why it matters

The resurgence of ChillyHell underscores the increasing targeting of macOS platforms by sophisticated malware. Its advanced features enable attackers to maintain prolonged access, exfiltrate sensitive data, and deploy additional malicious tools, posing significant security threats.

How it could have been prevented

- Regularly update and patch macOS systems to mitigate vulnerabilities.- Avoid downloading and executing applications from untrusted sources.- Implement endpoint detection and response (EDR) solutions to identify and block malicious activities.

Relevant professional terms

Backdoor
A method by which authorized and unauthorized users can bypass normal security measures to gain high-level user access to a computer system, network, or software application.
Persistence Mechanism
Techniques used by malware to maintain access to a compromised system, even after reboots or removal attempts.

Recommended reading: Jamf ChillyHell: A deep dive into a modular macOS backdoor

Source: darkreading.com