CISA, the NSA, FBI, DC3, and international partners issued a joint warning about Russian state-sponsored cyber activity targeting communications, energy, government, and other critical infrastructure sectors. The advisory details tactics used by Russian threat actors and urges organizations to implement mitigations. This highlights ongoing cyber threats to essential services and the need for heightened vigilance.

Attackers can exploit an OAuth client ID spoofing vulnerability to validate stolen Microsoft Entra credentials, enabling authentication without legitimate authorization. The flaw undermines the security of Microsoft's identity platform, potentially leading to account takeovers and unauthorized access. This issue highlights critical weaknesses in OAuth implementation.

Researchers discovered 148 malicious npm packages disguised as student proxy tools. When installed, they hijack browsers to form a distributed denial-of-service (DDoS) botnet. This campaign exposes the risk of supply chain attacks targeting developers and students.

Microsoft has detailed a year-long data theft campaign linked to the threat group ShinyHunters, which exploited three distinct attack paths to steal data from Salesforce environments. The breaches underscore ongoing vulnerabilities in cloud-based platforms and the sophistication of modern cybercriminal operations.

Google and Microsoft removed the ModHeader browser extension, which had 1.6 million installs, after discovering a dormant data-collecting mechanism. The extension was designed to modify HTTP headers but secretly contained code that could exfiltrate user data. This incident underscores the ongoing risk of seemingly benign extensions being used for data theft.

This week's cybersecurity highlights include a new threat targeting ShareFile, the emergence of Citrix Bleed 2 ransomware, and attacks exploiting AI coding tools. These incidents underscore the evolving tactics of cybercriminals and the need for updated defenses.

A threat actor used what appears to be an AI-generated PowerShell script to map an organization's Active Directory infrastructure. This marks an emerging tactic where attackers leverage generative AI to automate reconnaissance. It underscores the growing risk of AI-powered cyberattacks targeting enterprise directories.

Security expert Bruce Schneier examines how the massive infrastructure costs of AI data centers funnel profits to a few tech giants, exacerbating economic inequality. The article argues that this concentration of capital and power has broad implications for competition, innovation, and societal fairness.

The jscrambler npm package version 8.14.0 was compromised, causing a Rust-based information-stealing malware to be dropped during installation. This supply chain attack targets developers who install the package, potentially exposing credentials and sensitive data. The incident underscores the persistent security risks in the open-source software supply chain.