Daily Dose of Cybersecurity News - September 15, 2025

What happened

The FBI has issued a FLASH alert regarding two cybercriminal groups, UNC6040 and UNC6395, who are compromising organizations' Salesforce environments to steal data and extort victims. UNC6040 employs social engineering and vishing attacks to trick employees into connecting malicious OAuth applications to their Salesforce accounts, while UNC6395 utilizes stolen OAuth and refresh tokens to access and exfiltrate data.

Who is affected

Organizations using Salesforce platforms are at risk, with notable companies such as Google, Adidas, Qantas, Allianz Life, Cisco, Kering, Louis Vuitton, Dior, and Tiffany & Co. having been impacted.

Why it matters

These attacks highlight the vulnerabilities in cloud-based CRM platforms and the effectiveness of social engineering tactics. The exfiltrated data can be used for extortion, leading to financial losses and reputational damage.

How it could have been prevented

Implementing strict access controls and multi-factor authentication can mitigate unauthorized access. Regular employee training on recognizing and reporting social engineering attempts is crucial.

Recommended reading: Google: Hackers target Salesforce accounts in data extortion attacks

What happened

A new phishing-as-a-service platform named VoidProxy has been identified, employing adversary-in-the-middle tactics to steal credentials, multi-factor authentication codes, and session cookies from Microsoft 365 and Google account users.

Who is affected

Users of Microsoft 365 and Google accounts, including those utilizing third-party single sign-on providers like Okta, are targeted by this phishing service.

Why it matters

The sophistication and scalability of VoidProxy pose a significant threat to organizations, as it can bypass traditional security measures, leading to unauthorized access and potential data breaches.

How it could have been prevented

Implementing phishing-resistant authentication methods, such as Okta FastPass, and enforcing risk-based access controls can mitigate the risk posed by such phishing services.

What happened

A recent report indicates that 89% of AI usage within enterprises occurs without the knowledge of IT and security teams, leading to potential risks related to data privacy, compliance, and governance.

Who is affected

Organizations across various sectors, including healthcare, finance, and insurance, are impacted by unmonitored AI usage by employees.

Why it matters

Unsupervised AI activities can result in data leaks, regulatory violations, and ethical concerns, especially when sensitive information is processed without proper oversight.

How it could have been prevented

Implementing comprehensive AI monitoring tools and establishing clear policies for AI usage can help organizations detect and manage AI activities effectively.

Recommended reading: 89% of enterprise AI usage is invisible to the organization

What happened

A sophisticated malvertising campaign has been identified targeting IT professionals in the European Union. Attackers are using malicious Google Ads to direct users to a specific commit in a legitimate GitHub repository, where the README file has been altered to resemble a genuine download page for the GitHub Desktop application. This deceptive page prompts users to download a fake installer, which, when executed, delivers malware designed to steal credentials, exfiltrate sensitive information, and potentially deploy ransomware.

Who is affected

IT workers and organizations within the European Union are the primary targets of this campaign.

Why it matters

This campaign underscores the evolving tactics of cybercriminals who exploit trusted platforms and advertising networks to distribute malware. The use of legitimate GitHub repositories to host malicious content increases the likelihood of successful infections, posing significant risks to organizational security and data integrity.

How it could have been prevented

- Implementing strict controls on software downloads, ensuring that applications are obtained only from verified and official sources. - Educating employees about the risks of malvertising and the importance of scrutinizing download sources, even when they appear legitimate.

Recommended reading: Microsoft Security Blog

What happened

An investigation into the Salesloft Drift data breach has revealed that attackers initially gained access by compromising the company's GitHub account. This unauthorized access allowed the threat actor to download content from multiple repositories, add a guest user, and establish workflows. Subsequently, the attackers accessed Drift's AWS environment, obtained OAuth tokens for Drift customers' technology integrations, and used them to infiltrate customers' Salesforce instances.

Who is affected

Organizations utilizing Drift's chatbot integrated with Salesforce, including companies like Cloudflare, Zscaler, Palo Alto Networks, Elastic, and Bugcrowd, have been impacted by this breach.

Why it matters

This incident highlights the critical importance of securing development environments and the potential cascading effects of a single compromised account. Unauthorized access to OAuth tokens can lead to extensive data breaches across multiple organizations, emphasizing the need for robust security measures in third-party integrations.

How it could have been prevented

- Enforcing multi-factor authentication (MFA) on all developer accounts to add an additional layer of security. - Regularly auditing and monitoring access to repositories and cloud environments to detect and respond to unauthorized activities promptly.

Recommended reading: Cloudflare Blog