Large team around central laptop displaying code with falling shields, locks, warning icons, and malware

Daily Dose of Cybersecurity News - September 2, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 2, 2025 6:03 AM 5 min read

Salesloft Drift Breach Compromises OAuth Tokens Across Multiple Integrations

Critical

What happened

Threat actors exploited a vulnerability in Salesloft's Drift application to steal OAuth tokens, enabling unauthorized access to various third-party services integrated with Drift, including Salesforce, Google Workspace, and AWS.

Who is affected

Organizations utilizing Salesloft's Drift application with integrations to services like Salesforce, Google Workspace, AWS, and other platforms are impacted.

Why it matters

The breach exposes sensitive data across multiple platforms, potentially leading to further compromises, data theft, and operational disruptions.

How it could have been prevented

Regularly auditing third-party integrations for vulnerabilities and implementing stringent access controls could have mitigated the risk.

Relevant professional terms

OAuth Token: A credential used to authorize access to resources on behalf of a user without sharing credentials.
Data Exfiltration: Unauthorized transfer of data from a computer or network.

Recommended reading: krebsonsecurity.com

Source: krebsonsecurity.com

Zscaler Data Breach via Salesloft Drift Compromise

High

What happened

Threat actors exploited compromised OAuth tokens from Salesloft Drift, a third-party AI chat integration, to access Zscaler's Salesforce instance and exfiltrate customer information.

Who is affected

Zscaler's customers whose information was stored in the compromised Salesforce instance.

Why it matters

The breach exposes sensitive customer data, including support case content, potentially leading to targeted phishing attacks and undermining trust in third-party integrations.

How it could have been prevented

Regularly auditing third-party integrations for security vulnerabilities and implementing strict access controls could have mitigated the risk.

Relevant professional terms

OAuth tokens: Tokens used for authorization that allow third-party services to access user data without exposing credentials.
Supply-chain attack: A cyberattack that targets less secure elements in the supply chain to gain access to a primary target.

Recommended reading: Zscaler's Response to Salesloft Drift Incident

Source: bleepingcomputer.com

Amazon Disrupts Russian APT29's Microsoft 365 Targeting Campaign

High

What happened

Amazon's threat intelligence team identified and disrupted a cyber operation by the Russian state-sponsored group APT29, also known as Midnight Blizzard. The attackers compromised legitimate websites to redirect visitors to malicious domains, aiming to gain unauthorized access to Microsoft 365 accounts through deceptive device code authentication flows.

Who is affected

Organizations and individuals using Microsoft 365 services, particularly those visiting the compromised websites, were potential targets of this campaign.

Why it matters

This incident underscores the persistent threat posed by state-sponsored actors like APT29, who employ sophisticated techniques to exploit trusted platforms and services. Unauthorized access to Microsoft 365 accounts can lead to significant data breaches, compromising sensitive information and organizational integrity.

How it could have been prevented

Regular monitoring of website integrity to detect unauthorized code injections, implementing robust endpoint detection and response solutions, and educating users about the risks of device code authentication flows can mitigate such threats.

Relevant professional terms

Watering Hole Attack: A cyberattack strategy where attackers compromise legitimate websites to distribute malware to unsuspecting visitors.
Device Code Authentication Flow: A method allowing devices with limited input capabilities to authenticate users by directing them to a separate device or browser for login.

Source: bleepingcomputer.com

Malicious npm Package 'nodejs-smtp' Targets Cryptocurrency Wallets

High

What happened

A malicious npm package named 'nodejs-smtp' was discovered impersonating the legitimate 'nodemailer' library. Upon import, it injects code into desktop applications for cryptocurrency wallets like Atomic and Exodus on Windows systems, redirecting transactions to attacker-controlled addresses.

Who is affected

Developers and users of Atomic and Exodus cryptocurrency wallets on Windows systems who have integrated the 'nodejs-smtp' package into their applications.

Why it matters

This attack compromises the integrity of cryptocurrency transactions, leading to potential financial losses for users. It also highlights the risks associated with supply chain attacks in software development.

How it could have been prevented

- Implementing strict validation and verification processes for third-party packages before integration. - Regularly auditing and monitoring dependencies for malicious activity.

Relevant professional terms

Supply Chain Attack: A cyberattack that targets less secure elements in the supply chain to compromise a system.
Cryptocurrency Clipper: Malware that intercepts and alters cryptocurrency transaction details to redirect funds to an attacker's wallet.

Source: thehackernews.com

Android Droppers Now Deliver SMS Stealers and Spyware

High

What happened

Cybersecurity researchers have identified a shift in Android malware tactics, where dropper apps-previously used to deliver banking trojans-are now distributing SMS stealers and basic spyware. These droppers often masquerade as legitimate government or banking applications.

Who is affected

Android users, particularly in India and other parts of Asia, are targeted by these malicious dropper apps.

Why it matters

The evolution of droppers to deliver simpler malware like SMS stealers and spyware indicates that threat actors are adapting to bypass enhanced security measures, posing a broader risk to user privacy and data security.

How it could have been prevented

Users should install applications only from official sources, scrutinize app permissions, and keep their devices updated with the latest security patches.

Relevant professional terms

Dropper: A type of malware designed to install other malicious software onto a device, often evading initial detection.
SMS Stealer: Malware that intercepts and exfiltrates SMS messages, potentially capturing sensitive information like one-time passwords.

Recommended reading: ThreatFabric Blog on Android Droppers

Source: thehackernews.com

WhatsApp Zero-Click Vulnerability (CVE-2025-55177) Exploited in Targeted Attacks

High

What happened

A zero-click vulnerability (CVE-2025-55177) in WhatsApp's iOS and macOS clients was exploited in targeted attacks, allowing unauthorized processing of content from arbitrary URLs on victims' devices.

Who is affected

Users of WhatsApp for iOS versions prior to 2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 are affected.

Why it matters

The exploitation of this vulnerability could lead to unauthorized access and control over affected devices without user interaction, posing significant security risks.

How it could have been prevented

Regularly updating applications to the latest versions and applying security patches promptly can mitigate such vulnerabilities.

Relevant professional terms

Zero-click vulnerability: A security flaw that can be exploited without any interaction from the user.
Arbitrary URL processing: The unauthorized handling or execution of content from any web address, potentially leading to security breaches.

Recommended reading: bleepingcomputer.com

Source: thehackernews.com

Scattered Spider Exploits Browser Vulnerabilities to Target Enterprises

High

What happened

The cybercriminal group Scattered Spider has been targeting enterprises by exploiting browser vulnerabilities to steal sensitive data, including credentials and session tokens, through advanced phishing techniques and malicious browser extensions.

Who is affected

Enterprises utilizing web browsers such as Chrome, Edge, and Firefox are at risk, particularly those with insufficient browser security measures.

Why it matters

With over 80% of security incidents originating from web applications, the browser has become a critical attack surface. Scattered Spider's tactics highlight the need for robust browser security to protect sensitive enterprise data.

How it could have been prevented

Implementing JavaScript runtime protection to detect and block malicious scripts, enforcing strict browser extension policies, and securing session tokens through contextual security measures can mitigate such attacks.

Relevant professional terms

Browser-in-the-Browser (BitB) Attack: A phishing technique that simulates a legitimate browser window within the actual browser to steal user credentials.
Session Token: A unique identifier used to maintain a user's session after authentication, which, if stolen, can allow unauthorized access.

Recommended reading: How the Browser Became the Main Cyber Battleground

Source: thehackernews.com