Daily Dose of Cybersecurity News - September 16, 2025

What happened

Hackers created a fraudulent account within Google's Law Enforcement Request System (LERS), a platform used by law enforcement agencies to submit official data requests. Google identified and disabled the unauthorized account before any requests were made or data accessed.

Who is affected

Google's internal systems were targeted; however, no user data was compromised. The FBI declined to comment on the incident.

Why it matters

Unauthorized access to systems like LERS could allow attackers to impersonate law enforcement, potentially leading to unauthorized data disclosures and undermining trust in such platforms.

How it could have been prevented

Implementing multi-factor authentication (MFA) for all accounts and conducting regular audits of account creation processes can help prevent unauthorized access.

Recommended reading: BleepingComputer

What happened

A former employee of FinWise Bank accessed sensitive customer data after their employment had ended, leading to a significant data breach.

Who is affected

Approximately 689,000 customers of American First Finance, whose loans are originated and funded by FinWise Bank, are impacted by this breach.

Why it matters

The unauthorized access to personal customer information poses risks of identity theft and financial fraud, highlighting vulnerabilities in data access controls and the importance of securing sensitive information against insider threats.

How it could have been prevented

Implementing strict access controls and promptly revoking system access for departing employees could have prevented this incident. Regular audits and monitoring of data access are also essential to detect and deter unauthorized activities.

Recommended reading: CISA Insider Threat Mitigation

What happened

Researchers have developed a new Rowhammer attack variant, named Phoenix, that successfully bypasses existing protection mechanisms in DDR5 memory chips, enabling unauthorized bit flips.

Who is affected

Users and organizations utilizing DDR5 memory modules, particularly those manufactured by SK Hynix, are vulnerable to this attack.

Why it matters

The Phoenix attack compromises data integrity and system security by allowing attackers to escalate privileges, execute malicious code, or access sensitive information, despite existing defenses.

How it could have been prevented

Implementing more robust memory protection mechanisms and regularly updating hardware security protocols could mitigate such vulnerabilities.

Recommended reading: BleepingComputer

What happened

The KillSec ransomware group infiltrated MedicSolution, a Brazilian healthcare software provider, exfiltrating over 34GB of sensitive patient data, including lab results, X-rays, and records of minors.

Who is affected

Patients whose medical information is stored by MedicSolution, as well as healthcare organizations utilizing their services.

Why it matters

The breach exposes sensitive patient data, potentially leading to identity theft and undermining trust in healthcare data security.

How it could have been prevented

Implementing robust security configurations for cloud storage, conducting regular security audits, and ensuring continuous monitoring of data access.

Recommended reading: Ransomware's Grip on Healthcare

What happened

The FBI's Internet Crime Complaint Center (IC3) issued a warning about two threat actors, UNC6040 (also known as ShinyHunters) and UNC6395, targeting Salesforce customers through social engineering and exploitation of OAuth tokens.

Who is affected

Organizations utilizing Salesforce platforms, particularly those with integrated third-party applications like Salesloft's Drift, are at risk.

Why it matters

These attacks can lead to unauthorized access, data exfiltration, and potential extortion, compromising sensitive customer information and organizational integrity.

How it could have been prevented

Implementing phishing-resistant multi-factor authentication (MFA), training employees to recognize and report phishing attempts, and regularly reviewing third-party application permissions could mitigate such threats.

Recommended reading: CISA Alert on Salesforce Threats

What happened

Researchers demonstrated a "lies-in-the-loop" (LITL) attack that manipulates AI coding agents into performing unsafe actions by deceiving them about the nature of the tasks, potentially leading to software supply chain compromises.

Who is affected

Organizations utilizing AI-assisted coding tools, particularly those employing human-in-the-loop (HITL) mechanisms for task approval.

Why it matters

This attack exploits the trust between humans and AI agents, highlighting vulnerabilities in AI-assisted development processes that could be leveraged to introduce malicious code into software supply chains.

How it could have been prevented

Implementing stricter validation and verification processes for AI-generated code, enhancing user training to recognize deceptive prompts, and developing more robust safeguards within AI coding agents to detect and prevent manipulation.

Recommended reading: 3 Ways Security Teams Can Minimize Agentic AI Chaos

What happened

The FBI has released indicators of compromise (IoCs) related to two malicious campaigns targeting Salesforce customers. The first campaign, attributed to threat actor UNC6040, employs voice phishing (vishing) to deceive employees into granting access to Salesforce instances or sharing credentials. The second campaign, linked to UNC6395, exploits compromised OAuth tokens from Drift's AWS instance to access Salesforce data.

Who is affected

Organizations utilizing Salesforce, particularly those integrated with Drift AI chatbot and Salesloft, are at risk. Over 700 organizations have been impacted by these campaigns.

Why it matters

These campaigns highlight sophisticated social engineering tactics and the exploitation of third-party integrations to gain unauthorized access to sensitive data. The potential for data theft and extortion poses significant risks to affected organizations.

How it could have been prevented

Implementing phishing-resistant multi-factor authentication (MFA), training employees on recognizing social engineering tactics, enforcing IP-based access restrictions, and regularly reviewing third-party integrations could mitigate such threats.