Daily Dose of Cybersecurity News - September 16, 2025
Unauthorized Account Created in Google's Law Enforcement Request System
MediumWhat happened
Hackers created a fraudulent account within Google's Law Enforcement Request System (LERS), a platform used by law enforcement agencies to submit official data requests. Google identified and disabled the unauthorized account before any requests were made or data accessed.
Who is affected
Google's internal systems were targeted; however, no user data was compromised. The FBI declined to comment on the incident.
Why it matters
Unauthorized access to systems like LERS could allow attackers to impersonate law enforcement, potentially leading to unauthorized data disclosures and undermining trust in such platforms.
How it could have been prevented
Implementing multi-factor authentication (MFA) for all accounts and conducting regular audits of account creation processes can help prevent unauthorized access.
Relevant professional terms
- Law Enforcement Request System (LERS)
- A platform used by law enforcement agencies to submit official data requests to service providers.
- Multi-Factor Authentication (MFA)
- A security process that requires multiple forms of verification to access a system, enhancing security beyond just a password.
Recommended reading: BleepingComputer
FinWise Bank Insider Breach Exposes 689K American First Finance Customers' Data
HighWhat happened
A former employee of FinWise Bank accessed sensitive customer data after their employment had ended, leading to a significant data breach.
Who is affected
Approximately 689,000 customers of American First Finance, whose loans are originated and funded by FinWise Bank, are impacted by this breach.
Why it matters
The unauthorized access to personal customer information poses risks of identity theft and financial fraud, highlighting vulnerabilities in data access controls and the importance of securing sensitive information against insider threats.
How it could have been prevented
Implementing strict access controls and promptly revoking system access for departing employees could have prevented this incident. Regular audits and monitoring of data access are also essential to detect and deter unauthorized activities.
Relevant professional terms
- Insider Threat
- A security risk originating from within the organization, often involving employees or former employees who have access to sensitive information.
- Data Breach
- An incident where unauthorized individuals gain access to confidential data, leading to potential exposure of personal or sensitive information.
Recommended reading: CISA Insider Threat Mitigation
Phoenix Attack Bypasses Rowhammer Defenses in DDR5 Memory (CVE-2025-6202)
HighWhat happened
Researchers have developed a new Rowhammer attack variant, named Phoenix, that successfully bypasses existing protection mechanisms in DDR5 memory chips, enabling unauthorized bit flips.
Who is affected
Users and organizations utilizing DDR5 memory modules, particularly those manufactured by SK Hynix, are vulnerable to this attack.
Why it matters
The Phoenix attack compromises data integrity and system security by allowing attackers to escalate privileges, execute malicious code, or access sensitive information, despite existing defenses.
How it could have been prevented
Implementing more robust memory protection mechanisms and regularly updating hardware security protocols could mitigate such vulnerabilities.
Relevant professional terms
- Rowhammer
- A type of cyberattack that exploits electrical interference between memory cells to induce bit flips.
- Target Row Refresh (TRR)
- A defense mechanism designed to prevent Rowhammer attacks by refreshing adjacent memory rows when frequent accesses are detected.
Recommended reading: BleepingComputer
KillSec Ransomware Compromises Brazilian Healthcare Software Provider
HighWhat happened
The KillSec ransomware group infiltrated MedicSolution, a Brazilian healthcare software provider, exfiltrating over 34GB of sensitive patient data, including lab results, X-rays, and records of minors.
Who is affected
Patients whose medical information is stored by MedicSolution, as well as healthcare organizations utilizing their services.
Why it matters
The breach exposes sensitive patient data, potentially leading to identity theft and undermining trust in healthcare data security.
How it could have been prevented
Implementing robust security configurations for cloud storage, conducting regular security audits, and ensuring continuous monitoring of data access.
Relevant professional terms
- Data Exfiltration
- Unauthorized transfer of data from a computer or network.
- Supply Chain Attack
- A cyberattack that targets an organization by compromising elements within its supply chain.
Recommended reading: Ransomware's Grip on Healthcare
FBI Warns of Threat Actors Targeting Salesforce Customers
HighWhat happened
The FBI's Internet Crime Complaint Center (IC3) issued a warning about two threat actors, UNC6040 (also known as ShinyHunters) and UNC6395, targeting Salesforce customers through social engineering and exploitation of OAuth tokens.
Who is affected
Organizations utilizing Salesforce platforms, particularly those with integrated third-party applications like Salesloft's Drift, are at risk.
Why it matters
These attacks can lead to unauthorized access, data exfiltration, and potential extortion, compromising sensitive customer information and organizational integrity.
How it could have been prevented
Implementing phishing-resistant multi-factor authentication (MFA), training employees to recognize and report phishing attempts, and regularly reviewing third-party application permissions could mitigate such threats.
Relevant professional terms
- Vishing
- A form of phishing where attackers use phone calls to deceive individuals into revealing sensitive information.
- OAuth Tokens
- Authorization tokens that allow third-party applications to access user data without exposing credentials.
Recommended reading: CISA Alert on Salesforce Threats
Lies-in-the-Loop Attack Compromises AI Coding Agents
HighWhat happened
Researchers demonstrated a "lies-in-the-loop" (LITL) attack that manipulates AI coding agents into performing unsafe actions by deceiving them about the nature of the tasks, potentially leading to software supply chain compromises.
Who is affected
Organizations utilizing AI-assisted coding tools, particularly those employing human-in-the-loop (HITL) mechanisms for task approval.
Why it matters
This attack exploits the trust between humans and AI agents, highlighting vulnerabilities in AI-assisted development processes that could be leveraged to introduce malicious code into software supply chains.
How it could have been prevented
Implementing stricter validation and verification processes for AI-generated code, enhancing user training to recognize deceptive prompts, and developing more robust safeguards within AI coding agents to detect and prevent manipulation.
Relevant professional terms
- Human-in-the-loop (HITL)
- A system design where human intervention is required to approve or oversee actions taken by automated systems or AI agents.
- Remote Code Execution (RCE)
- A security vulnerability that allows an attacker to execute arbitrary code on a target system remotely, often leading to full system compromise.
Recommended reading: 3 Ways Security Teams Can Minimize Agentic AI Chaos
FBI Releases IoCs for Salesforce Intrusion Campaigns
HighWhat happened
The FBI has released indicators of compromise (IoCs) related to two malicious campaigns targeting Salesforce customers. The first campaign, attributed to threat actor UNC6040, employs voice phishing (vishing) to deceive employees into granting access to Salesforce instances or sharing credentials. The second campaign, linked to UNC6395, exploits compromised OAuth tokens from Drift's AWS instance to access Salesforce data.
Who is affected
Organizations utilizing Salesforce, particularly those integrated with Drift AI chatbot and Salesloft, are at risk. Over 700 organizations have been impacted by these campaigns.
Why it matters
These campaigns highlight sophisticated social engineering tactics and the exploitation of third-party integrations to gain unauthorized access to sensitive data. The potential for data theft and extortion poses significant risks to affected organizations.
How it could have been prevented
Implementing phishing-resistant multi-factor authentication (MFA), training employees on recognizing social engineering tactics, enforcing IP-based access restrictions, and regularly reviewing third-party integrations could mitigate such threats.
Relevant professional terms
- Voice Phishing (Vishing)
- A form of social engineering where attackers use phone calls to deceive individuals into divulging confidential information.
- OAuth Tokens
- Authorization tokens that allow third-party applications to access user data without exposing credentials.