Daily Dose of Cybersecurity News - September 22, 2025
Critical Microsoft Entra ID Vulnerability (CVE-2025-55241) Allowed Tenant Hijacking
CriticalWhat happened
A critical vulnerability in Microsoft Entra ID, identified as CVE-2025-55241, combined with undocumented "actor tokens," allowed unauthorized access to any organization's Entra ID tenant. Exploiting this flaw enabled attackers to impersonate users, including Global Administrators, without detection.
Who is affected
All organizations utilizing Microsoft Entra ID for identity and access management were potentially vulnerable to this exploit.
Why it matters
This vulnerability posed a significant risk, as attackers could gain full administrative control over an organization's Entra ID tenant, leading to unauthorized access to sensitive data and critical systems without leaving traceable logs.
How it could have been prevented
Regular auditing of legacy components and deprecating outdated APIs like Azure AD Graph could have mitigated this risk. Implementing stricter token validation and monitoring for unusual access patterns are also essential preventive measures.
Relevant professional terms
- Actor Tokens
- Undocumented tokens used for service-to-service communication within Microsoft services, allowing impersonation of users without proper validation.
- Azure AD Graph API
- A deprecated API used to access Azure Active Directory data, which contained validation flaws that could be exploited for unauthorized access.
Recommended reading: WIRED: Microsoft Entra ID Vulnerability Could Have Been Catastrophic
Cyberattack Disrupts European Airport Check-In Systems
HighWhat happened
A cyberattack targeted Collins Aerospace's check-in software, causing significant disruptions at major European airports, including Brussels, Berlin, and London. The attack led to flight cancellations and delays as airport staff resorted to manual check-in processes.
Who is affected
Passengers traveling through affected airports, airlines operating in these regions, and Collins Aerospace, the provider of the compromised check-in software.
Why it matters
The incident highlights vulnerabilities in critical aviation infrastructure and underscores the potential for cyberattacks to cause widespread operational disruptions, affecting thousands of passengers and leading to significant economic impacts.
How it could have been prevented
Implementing robust cybersecurity measures, including regular software updates, comprehensive incident response plans, and continuous monitoring of critical systems, could mitigate the risk of such attacks.
Relevant professional terms
- Incident Response Plan
- A structured approach outlining procedures for detecting, responding to, and recovering from cybersecurity incidents.
- Critical Infrastructure
- Essential systems and assets vital to national security, economic stability, and public safety, such as transportation and communication networks.
Recommended reading: securityweek.com
DPRK Hackers Employ ClickFix to Deploy BeaverTail Malware in Cryptocurrency Job Scams
HighWhat happened
North Korean threat actors utilized ClickFix-style lures to distribute BeaverTail malware, targeting individuals in cryptocurrency and retail sectors under the guise of job recruitment.
Who is affected
Job seekers in the cryptocurrency and retail industries, particularly those applying for marketing and trader positions.
Why it matters
This campaign signifies an evolution in social engineering tactics, expanding the scope of targets beyond software developers to include roles in marketing and trading, thereby increasing the potential for widespread credential theft and unauthorized access to sensitive information.
How it could have been prevented
- Implementing robust email filtering to detect and block phishing attempts. - Educating employees about recognizing and reporting suspicious job offers and recruitment processes.
Relevant professional terms
- ClickFix
- A social engineering technique that uses fake technical issues to trick users into executing malicious commands.
- BeaverTail
- A JavaScript-based information-stealing malware that collects browser credentials and can act as a downloader for additional payloads.
Recommended reading: thehackernews.com
Google Patches Actively Exploited Chrome Zero-Day Vulnerability (CVE-2025-10585)
HighWhat happened
Google released a security update for Chrome to address a zero-day vulnerability (CVE-2025-10585) involving a type confusion issue in the V8 JavaScript and WebAssembly engine, which has been actively exploited in the wild.
Who is affected
Users of Google Chrome across Windows, macOS, and Linux platforms, as well as users of other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi.
Why it matters
The exploitation of this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to data breaches, system compromise, and further propagation of malicious activities.
How it could have been prevented
Regularly updating browsers to the latest versions and promptly applying security patches can mitigate the risk of exploitation from known vulnerabilities.
Relevant professional terms
- Type Confusion
- A programming error where a piece of code uses a variable without verifying its type, leading to unpredictable behavior and potential security vulnerabilities.
- Zero-Day Vulnerability
- A security flaw that is exploited by attackers before the software vendor has released a fix or patch.
Recommended reading: thehackernews.com