Daily Dose of Cybersecurity News - September 9, 2025
Compromise of 18 Popular JavaScript Packages via Phishing Attack
HighWhat happened
A developer's NPM account was compromised through a phishing attack, leading to the injection of malicious code into 18 widely-used JavaScript packages. The inserted code was designed to intercept cryptocurrency transactions by manipulating wallet interactions and redirecting funds to attacker-controlled accounts.
Who is affected
Users and organizations that incorporated the affected JavaScript packages into their projects are at risk, particularly those handling cryptocurrency transactions through web applications.
Why it matters
This incident underscores the vulnerabilities in the software supply chain, where a single compromised developer account can lead to widespread distribution of malicious code, potentially affecting billions of users and numerous applications.
How it could have been prevented
- Implementing hardware-based two-factor authentication (2FA) methods, such as security keys, to reduce the risk of phishing attacks. - Regularly auditing and monitoring code repositories for unauthorized changes or suspicious activities.
Relevant professional terms
- Supply Chain Attack
- A type of cyberattack that targets less secure elements in the supply chain to compromise a system or network.
- Phishing
- A fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
Recommended reading: Aikido's Analysis of Malicious NPM Packages
Plex Data Breach Prompts Mandatory Password Resets
HighWhat happened
Plex, a media streaming platform, experienced a data breach where an unauthorized party accessed a subset of customer data, including emails, usernames, and securely hashed passwords.
Who is affected
All Plex users are affected and are required to reset their account passwords.
Why it matters
The breach exposes users to potential credential stuffing attacks, especially if they reuse passwords across multiple services.
How it could have been prevented
Implementing multi-factor authentication (MFA) and regularly auditing system security could have mitigated the risk of unauthorized access.
Relevant professional terms
- Credential Stuffing
- A cyberattack method where stolen account credentials are used to gain unauthorized access to user accounts through large-scale automated login requests.
- Multi-Factor Authentication (MFA)
- A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity.
Recommended reading: CPO Magazine
Massive Scanning Activity Targets Cisco ASA Devices
HighWhat happened
In late August 2025, over 25,000 unique IP addresses conducted coordinated scanning activities targeting Cisco Adaptive Security Appliance (ASA) devices, with a significant portion originating from a Brazilian botnet.
Who is affected
Organizations utilizing Cisco ASA devices, particularly in the United States, United Kingdom, and Germany, are the primary targets of these scanning activities.
Why it matters
Such large-scale reconnaissance often precedes the disclosure or exploitation of new vulnerabilities, indicating potential upcoming threats to Cisco ASA devices.
How it could have been prevented
Regularly updating and patching Cisco ASA devices, implementing strict access controls, and monitoring for unusual activity can mitigate such threats.
Relevant professional terms
- Botnet
- A network of compromised computers controlled by an attacker to perform coordinated tasks, such as launching attacks.
- Reconnaissance
- The preliminary phase of an attack where information is gathered about a target system to identify vulnerabilities.
Recommended reading: Cisco ASA Software
GhostAction Supply Chain Attack Compromises 3,325 Secrets
CriticalWhat happened
A sophisticated supply chain attack, termed 'GhostAction,' compromised 327 GitHub users across 817 repositories by injecting malicious GitHub Actions workflows that exfiltrated 3,325 secrets, including PyPI, npm, DockerHub tokens, and AWS keys.
Who is affected
Developers and organizations maintaining repositories on GitHub, particularly those utilizing GitHub Actions workflows, were targeted in this campaign.
Why it matters
The theft of sensitive credentials poses significant risks, including unauthorized access to software packages, potential distribution of malicious code, and broader supply chain compromises affecting end-users.
How it could have been prevented
Implementing strict access controls, regularly auditing repository workflows, and monitoring for unauthorized changes can help prevent such attacks.
Relevant professional terms
- Supply Chain Attack
- A cyberattack that targets less secure elements in the supply chain to compromise a system.
- GitHub Actions
- A CI/CD platform that allows developers to automate their build, test, and deployment pipelines directly within GitHub.
Recommended reading: stepsecurity.io
Salesloft GitHub Breach Leads to Widespread Salesforce Data Theft
HighWhat happened
Attackers compromised Salesloft's GitHub account in March 2025, leading to the theft of OAuth tokens from its Drift platform. These tokens were later exploited in August to access and exfiltrate data from multiple Salesforce environments.
Who is affected
Organizations using Salesloft's Drift integration with Salesforce, including companies like Google, Zscaler, Cloudflare, and Workiva, were impacted by unauthorized data access.
Why it matters
The breach underscores the risks associated with third-party integrations and the potential for supply chain attacks to compromise sensitive customer data across multiple organizations.
How it could have been prevented
Implementing robust access controls and monitoring for GitHub repositories, regularly rotating OAuth tokens, and conducting thorough security assessments of third-party integrations could have mitigated the risk.
Relevant professional terms
- OAuth Tokens
- Authorization tokens that allow third-party applications to access user data without exposing credentials.
- Supply Chain Attack
- A cyberattack that targets an organization by compromising elements within its supply chain, such as third-party services or software.
Recommended reading: Dark Reading
MostereRAT Malware Evades Detection and Disables Security Tools
HighWhat happened
A sophisticated malware campaign has been identified, utilizing a variant known as 'MostereRAT' to infiltrate Windows systems. The malware employs an obscure programming language and manipulates legitimate software to disable antivirus and endpoint detection tools, ensuring prolonged undetected access.
Who is affected
The campaign has primarily targeted Microsoft Windows users in Japan, with the potential for broader implications.
Why it matters
The use of advanced evasion techniques and the ability to disable security tools highlight an escalation in cyberattack sophistication, posing significant risks to organizational security and data integrity.
How it could have been prevented
Implementing multi-layered security measures, including behavioral analysis tools, regular system updates, and user education on phishing tactics, can mitigate such threats.
Relevant professional terms
- Remote Access Trojan (RAT)
- A type of malware that allows unauthorized remote control over an infected computer.
- Endpoint Detection and Response (EDR)
- Security solutions focused on detecting, investigating, and responding to suspicious activities on endpoint devices.
Recommended reading: Fortinet's Detailed Analysis of MostereRAT
Salesloft GitHub Account Compromise Leads to Massive Supply Chain Attack
CriticalWhat happened
A threat actor, identified as UNC6395, compromised Salesloft's GitHub account, leading to unauthorized access to the company's repositories. This breach enabled the attacker to infiltrate Salesloft's Drift application and steal OAuth tokens, which were subsequently used to access and exfiltrate data from hundreds of Salesforce instances.
Who is affected
Organizations utilizing Salesloft's Drift application integrated with Salesforce, including companies like Zscaler, Proofpoint, Palo Alto Networks, and Cloudflare, were impacted by this supply chain attack.
Why it matters
This incident underscores the critical vulnerabilities within software supply chains, demonstrating how a single compromised account can cascade into widespread data breaches across multiple organizations. The attack highlights the importance of securing third-party integrations and the potential risks associated with OAuth token theft.
How it could have been prevented
Implementing robust security measures for GitHub accounts, such as enforcing strong, unique passwords and enabling two-factor authentication (2FA), could have mitigated the risk of account compromise. Regular audits of third-party integrations and vigilant monitoring of OAuth token usage are also essential to detect and prevent unauthorized access.
Relevant professional terms
- OAuth Token
- A secure authorization token that allows third-party applications to access user data without exposing credentials.
- Supply Chain Attack
- A cyberattack that targets less secure elements within an organization's supply chain to compromise the end product or service.
Recommended reading: Zscaler, Palo Alto Networks Hacked via Salesloft Drift