Daily Dose of Cybersecurity News – September 2, 2025
Salesloft Drift Breach Compromises OAuth Tokens Across Multiple Integrations
CriticalWhat happened
Threat actors exploited a vulnerability in Salesloft's Drift application to steal OAuth tokens, enabling unauthorized access to various third-party services integrated with Drift, including Salesforce, Google Workspace, and AWS.
Who is affected
Organizations utilizing Salesloft's Drift application with integrations to services like Salesforce, Google Workspace, AWS, and other platforms are impacted.
Why it matters
The breach exposes sensitive data across multiple platforms, potentially leading to further compromises, data theft, and operational disruptions.
How it could have been prevented
Regularly auditing third-party integrations for vulnerabilities and implementing stringent access controls could have mitigated the risk.
Relevant professional terms
- OAuth Token
- A credential used to authorize access to resources on behalf of a user without sharing credentials.
- Data Exfiltration
- Unauthorized transfer of data from a computer or network.
Recommended reading: krebsonsecurity.com
Zscaler Data Breach via Salesloft Drift Compromise
HighWhat happened
Threat actors exploited compromised OAuth tokens from Salesloft Drift, a third-party AI chat integration, to access Zscaler's Salesforce instance and exfiltrate customer information.
Who is affected
Zscaler's customers whose information was stored in the compromised Salesforce instance.
Why it matters
The breach exposes sensitive customer data, including support case content, potentially leading to targeted phishing attacks and undermining trust in third-party integrations.
How it could have been prevented
Regularly auditing third-party integrations for security vulnerabilities and implementing strict access controls could have mitigated the risk.
Relevant professional terms
- OAuth tokens
- Tokens used for authorization that allow third-party services to access user data without exposing credentials.
- Supply-chain attack
- A cyberattack that targets less secure elements in the supply chain to gain access to a primary target.
Recommended reading: Zscaler's Response to Salesloft Drift Incident
Amazon Disrupts Russian APT29's Microsoft 365 Targeting Campaign
HighWhat happened
Amazon's threat intelligence team identified and disrupted a cyber operation by the Russian state-sponsored group APT29, also known as Midnight Blizzard. The attackers compromised legitimate websites to redirect visitors to malicious domains, aiming to gain unauthorized access to Microsoft 365 accounts through deceptive device code authentication flows.
Who is affected
Organizations and individuals using Microsoft 365 services, particularly those visiting the compromised websites, were potential targets of this campaign.
Why it matters
This incident underscores the persistent threat posed by state-sponsored actors like APT29, who employ sophisticated techniques to exploit trusted platforms and services. Unauthorized access to Microsoft 365 accounts can lead to significant data breaches, compromising sensitive information and organizational integrity.
How it could have been prevented
Regular monitoring of website integrity to detect unauthorized code injections, implementing robust endpoint detection and response solutions, and educating users about the risks of device code authentication flows can mitigate such threats.
Relevant professional terms
- Watering Hole Attack
- A cyberattack strategy where attackers compromise legitimate websites to distribute malware to unsuspecting visitors.
- Device Code Authentication Flow
- A method allowing devices with limited input capabilities to authenticate users by directing them to a separate device or browser for login.
Recommended reading: Amazon seizes domains used in rogue Remote Desktop campaign to steal data
Malicious npm Package 'nodejs-smtp' Targets Cryptocurrency Wallets
HighWhat happened
A malicious npm package named 'nodejs-smtp' was discovered impersonating the legitimate 'nodemailer' library. Upon import, it injects code into desktop applications for cryptocurrency wallets like Atomic and Exodus on Windows systems, redirecting transactions to attacker-controlled addresses.
Who is affected
Developers and users of Atomic and Exodus cryptocurrency wallets on Windows systems who have integrated the 'nodejs-smtp' package into their applications.
Why it matters
This attack compromises the integrity of cryptocurrency transactions, leading to potential financial losses for users. It also highlights the risks associated with supply chain attacks in software development.
How it could have been prevented
- Implementing strict validation and verification processes for third-party packages before integration. - Regularly auditing and monitoring dependencies for malicious activity.
Relevant professional terms
- Supply Chain Attack
- A cyberattack that targets less secure elements in the supply chain to compromise a system.
- Cryptocurrency Clipper
- Malware that intercepts and alters cryptocurrency transaction details to redirect funds to an attacker's wallet.
Recommended reading: Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses
Android Droppers Now Deliver SMS Stealers and Spyware
HighWhat happened
Cybersecurity researchers have identified a shift in Android malware tactics, where dropper apps-previously used to deliver banking trojans-are now distributing SMS stealers and basic spyware. These droppers often masquerade as legitimate government or banking applications.
Who is affected
Android users, particularly in India and other parts of Asia, are targeted by these malicious dropper apps.
Why it matters
The evolution of droppers to deliver simpler malware like SMS stealers and spyware indicates that threat actors are adapting to bypass enhanced security measures, posing a broader risk to user privacy and data security.
How it could have been prevented
Users should install applications only from official sources, scrutinize app permissions, and keep their devices updated with the latest security patches.
Relevant professional terms
- Dropper
- A type of malware designed to install other malicious software onto a device, often evading initial detection.
- SMS Stealer
- Malware that intercepts and exfiltrates SMS messages, potentially capturing sensitive information like one-time passwords.
Recommended reading: ThreatFabric Blog on Android Droppers
WhatsApp Zero-Click Vulnerability (CVE-2025-55177) Exploited in Targeted Attacks
HighWhat happened
A zero-click vulnerability (CVE-2025-55177) in WhatsApp's iOS and macOS clients was exploited in targeted attacks, allowing unauthorized processing of content from arbitrary URLs on victims' devices.
Who is affected
Users of WhatsApp for iOS versions prior to 2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 are affected.
Why it matters
The exploitation of this vulnerability could lead to unauthorized access and control over affected devices without user interaction, posing significant security risks.
How it could have been prevented
Regularly updating applications to the latest versions and applying security patches promptly can mitigate such vulnerabilities.
Relevant professional terms
- Zero-click vulnerability
- A security flaw that can be exploited without any interaction from the user.
- Arbitrary URL processing
- The unauthorized handling or execution of content from any web address, potentially leading to security breaches.
Recommended reading: bleepingcomputer.com
Scattered Spider Exploits Browser Vulnerabilities to Target Enterprises
HighWhat happened
The cybercriminal group Scattered Spider has been targeting enterprises by exploiting browser vulnerabilities to steal sensitive data, including credentials and session tokens, through advanced phishing techniques and malicious browser extensions.
Who is affected
Enterprises utilizing web browsers such as Chrome, Edge, and Firefox are at risk, particularly those with insufficient browser security measures.
Why it matters
With over 80% of security incidents originating from web applications, the browser has become a critical attack surface. Scattered Spider's tactics highlight the need for robust browser security to protect sensitive enterprise data.
How it could have been prevented
Implementing JavaScript runtime protection to detect and block malicious scripts, enforcing strict browser extension policies, and securing session tokens through contextual security measures can mitigate such attacks.
Relevant professional terms
- Browser-in-the-Browser (BitB) Attack
- A phishing technique that simulates a legitimate browser window within the actual browser to steal user credentials.
- Session Token
- A unique identifier used to maintain a user's session after authentication, which, if stolen, can allow unauthorized access.
Recommended reading: How the Browser Became the Main Cyber Battleground