Team around laptop displaying warning icon with spider shield, locks, plane, ship, and hackers label

Daily Dose of Cybersecurity News - September 22, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

September 22, 2025 6:02 AM 3 min read

Critical Microsoft Entra ID Vulnerability (CVE-2025-55241) Allowed Tenant Hijacking

Critical

What happened

A critical vulnerability in Microsoft Entra ID, identified as CVE-2025-55241, combined with undocumented "actor tokens," allowed unauthorized access to any organization's Entra ID tenant. Exploiting this flaw enabled attackers to impersonate users, including Global Administrators, without detection.

Who is affected

All organizations utilizing Microsoft Entra ID for identity and access management were potentially vulnerable to this exploit.

Why it matters

This vulnerability posed a significant risk, as attackers could gain full administrative control over an organization's Entra ID tenant, leading to unauthorized access to sensitive data and critical systems without leaving traceable logs.

How it could have been prevented

Regular auditing of legacy components and deprecating outdated APIs like Azure AD Graph could have mitigated this risk. Implementing stricter token validation and monitoring for unusual access patterns are also essential preventive measures.

Relevant professional terms

Actor Tokens: Undocumented tokens used for service-to-service communication within Microsoft services, allowing impersonation of users without proper validation.
Azure AD Graph API: A deprecated API used to access Azure Active Directory data, which contained validation flaws that could be exploited for unauthorized access.

Source: bleepingcomputer.com

Cyberattack Disrupts European Airport Check-In Systems

High

What happened

A cyberattack targeted Collins Aerospace's check-in software, causing significant disruptions at major European airports, including Brussels, Berlin, and London. The attack led to flight cancellations and delays as airport staff resorted to manual check-in processes.

Who is affected

Passengers traveling through affected airports, airlines operating in these regions, and Collins Aerospace, the provider of the compromised check-in software.

Why it matters

The incident highlights vulnerabilities in critical aviation infrastructure and underscores the potential for cyberattacks to cause widespread operational disruptions, affecting thousands of passengers and leading to significant economic impacts.

How it could have been prevented

Implementing robust cybersecurity measures, including regular software updates, comprehensive incident response plans, and continuous monitoring of critical systems, could mitigate the risk of such attacks.

Relevant professional terms

Incident Response Plan: A structured approach outlining procedures for detecting, responding to, and recovering from cybersecurity incidents.
Critical Infrastructure: Essential systems and assets vital to national security, economic stability, and public safety, such as transportation and communication networks.

Recommended reading: securityweek.com

Source: securityweek.com

DPRK Hackers Employ ClickFix to Deploy BeaverTail Malware in Cryptocurrency Job Scams

High

What happened

North Korean threat actors utilized ClickFix-style lures to distribute BeaverTail malware, targeting individuals in cryptocurrency and retail sectors under the guise of job recruitment.

Who is affected

Job seekers in the cryptocurrency and retail industries, particularly those applying for marketing and trader positions.

Why it matters

This campaign signifies an evolution in social engineering tactics, expanding the scope of targets beyond software developers to include roles in marketing and trading, thereby increasing the potential for widespread credential theft and unauthorized access to sensitive information.

How it could have been prevented

- Implementing robust email filtering to detect and block phishing attempts. - Educating employees about recognizing and reporting suspicious job offers and recruitment processes.

Relevant professional terms

ClickFix: A social engineering technique that uses fake technical issues to trick users into executing malicious commands.
BeaverTail: A JavaScript-based information-stealing malware that collects browser credentials and can act as a downloader for additional payloads.

Recommended reading: thehackernews.com

Source: thehackernews.com

Google Patches Actively Exploited Chrome Zero-Day Vulnerability (CVE-2025-10585)

High

What happened

Google released a security update for Chrome to address a zero-day vulnerability (CVE-2025-10585) involving a type confusion issue in the V8 JavaScript and WebAssembly engine, which has been actively exploited in the wild.

Who is affected

Users of Google Chrome across Windows, macOS, and Linux platforms, as well as users of other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi.

Why it matters

The exploitation of this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to data breaches, system compromise, and further propagation of malicious activities.

How it could have been prevented

Regularly updating browsers to the latest versions and promptly applying security patches can mitigate the risk of exploitation from known vulnerabilities.

Relevant professional terms

Type Confusion: A programming error where a piece of code uses a variable without verifying its type, leading to unpredictable behavior and potential security vulnerabilities.
Zero-Day Vulnerability: A security flaw that is exploited by attackers before the software vendor has released a fix or patch.

Recommended reading: thehackernews.com

Source: helpnetsecurity.com