{"id":19105,"date":"2025-04-24T14:59:35","date_gmt":"2025-04-24T12:59:35","guid":{"rendered":"https:\/\/kordon.app\/?p=19105"},"modified":"2025-04-30T07:34:08","modified_gmt":"2025-04-30T05:34:08","slug":"17-cyber-security-news-worth-your-attention-this-week","status":"publish","type":"post","link":"https:\/\/kordon.app\/et\/17-cyber-security-news-worth-your-attention-this-week\/","title":{"rendered":"17 Cyber Security News Worth Your Attention This Week"},"content":{"rendered":"<p>We scour more than 15 cybersecurity news portals every week to surface only the stories worth your attention. This week was a busy one \u2014 from Russia\u2019s foiled cyber-sabotage in the Netherlands to Google\u2019s surprise U-turn on third-party-cookie prompts and rollout of IP Protection.<\/p>\n\n\n\n<div class=\"wp-block-group is-layout-constrained wp-block-group-is-layout-constrained\">\n<h3 class=\"wp-block-heading has-text-align-left\">1. Russia Attempting Cyber Sabotage Attacks Against Dutch Critical Infrastructure<\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Dutch military intelligence (MIVD) says it thwarted the <em><strong>first<\/strong><\/em> confirmed Russian cyber\u2011sabotage attempt on a Dutch public service and uncovered a <strong>separate<\/strong> operation against critical infrastructure that appeared to be reconnaissance for future sabotage.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>No disruption occurred; the public\u2011service target was not named. The second operation aimed to pre\u2011position inside OT networks that power ports and energy sites.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Activity mirrors Moscow\u2019s broader hybrid campaign against NATO logistics hubs.<\/li>\n<\/ul>\n\n\n\n<p>Read more from <a href=\"https:\/\/therecord.media\/dutch-mivd-report-russian-cyber-sabotage\" target=\"_blank\" rel=\"noopener\" title=\"The Record\"><strong>The Record<\/strong><\/a><\/p>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. <strong>British Retailer M&amp;S Confirms Being Hit by \u2018Cyber Incident\u2019 Amid Store Delays<\/strong><\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Marks &amp; Spencer disclosed a cyber\u2011attack that from <strong>21\u202f April \u202f2025<\/strong> disrupted Click\u2011and\u2011Collect and contactless payments nationwide. Although some systems were impacted and down, this is actually a pretty good example of a system that is resillient to attacks.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Card terminals and some card systems failed intermittently, forcing staff to switch to manual checkout flows.<\/li>\n\n\n\n<li>External IR firms and the UK NCSC are assisting; no evidence yet of customer\u2011data compromise.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you process M&amp;S loyalty data, enable credential\u2011stuffing monitoring.<\/li>\n<\/ul>\n\n\n\n<p>Read more from <strong><a href=\"https:\/\/therecord.media\/british-retailer-MS-confirms-cyber-incident-store-delays\" title=\"\">The Record<\/a> <\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Ransomware Groups Test New Business Models to Hit More Victims, Increase Profits<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Secureworks observed DragonForce and Anubis rolling out franchise\u2011style RaaS (Ransomware as a Service) offerings after the LockBit takedown.<br><br>One-click locker builders, white-label leak-site hosting and even VOIP \u201cpressure-call\u201d services mean low-skill crooks can start extorting immediately, driving attacks toward SMBs.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Menu now includes encryption\u2011plus\u2011leak, leak\u2011only extortion, and pure access resale to other gangs.<\/li>\n\n\n\n<li>Revenue splits vary (e.g., 70\/30 for encryption, 90\/10 for raw access resale), broadening appeal to low\u2011skill crooks.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Stress-test insurance &amp; IR playbooks:<\/strong> confirm policies cover leak-only extortion and rehearse response plans that start with public-data disclosure, not decryption.<\/li>\n<\/ul>\n\n\n\n<p>Read more from <a href=\"https:\/\/therecord.media\/ransomware-groups-test-new-business-models-dragonforce-anubis\" target=\"_blank\" rel=\"noopener\" title=\"\"><strong>The Record<\/strong><\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4. Beware of Video-Call Links That Are Attempts to Steal Microsoft 365 Access, Researchers Tell NGOs<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Russia\u2011linked actors lure Ukrainian NGOs to fake video\u2011call portals that harvest OAuth device\u2011code tokens, bypassing passwords and MFA.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Campaign active since Feb\u202f2025; at least 22 civil\u2011society groups targeted.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Disable or restrict Device Code flow to trusted IP ranges.<\/li>\n\n\n\n<li>Train staff: real invites never require signing in on unmanaged browsers.<\/li>\n<\/ul>\n\n\n\n<p><strong>Read more: <\/strong><a href=\"https:\/\/therecord.media\/russia-linked-phishing-microsoft365-ukraine-ngos\" target=\"_blank\" rel=\"noopener\" title=\"\">https:\/\/therecord.media\/russia-linked-phishing-microsoft365-ukraine-ngos<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>5. <\/strong>Two Top Cyber Officials Resign From CISA<\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Senior advisers Bob&nbsp;Lord and Lauren&nbsp;Zabierek resigned, warning of possible staff cuts and policy slowdowns.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Both helped launch the Secure\u2011by\u2011Design initiative; continuity now uncertain.<\/li>\n\n\n\n<li>Departure comes amid a federal hiring freeze that has delayed JCDC workstreams.<\/li>\n<\/ul>\n\n\n\n<p><strong>Read more: <\/strong><a href=\"https:\/\/therecord.media\/two-top-cyber-officials-resign-from-cisa\" target=\"_blank\" rel=\"noopener\" title=\"\">https:\/\/therecord.media\/two-top-cyber-officials-resign-from-cisa<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>6. New Payment-Card Scam Involves a Phone Call, Some Malware and a Personal Tap<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Cleafy researchers uncovered a scam in which attackers pose as your bank, talk you through installing a bogus \u201csecurity\u201d app, then persuade you to tap your contactless card to the phone\u2014at which point Android malware \u201cSuperCard X\u201d skims the data in real time and empties the account.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kill\u2011chain: SMS \u279c call\u2011centre \u279c sideloaded APK \u279c card tap \u279c instant drain.<\/li>\n\n\n\n<li>The malware is sold as a service on Telegram for about \u20ac1,200 a month, complete with dashboards for affiliates. <\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Block sideloading via MDM; enforce Play Protect.<\/li>\n\n\n\n<li>Educate: banks never request card taps to phones.<\/li>\n<\/ul>\n\n\n\n<p>Read more from <strong><a href=\"https:\/\/therecord.media\/new-payment-card-scam-involves-malware-tap\" target=\"_blank\" rel=\"noopener\" title=\"\">The Record<\/a> <\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>7. North Korean Operatives Use Deepfakes in IT Job Interviews<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Unit\u202f42 shows DPRK IT workers using real\u2011time deepfakes to secure remote jobs and infiltrate networks.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Building a convincing synthetic identity takes ~70\u202fminutes with free tools.<\/li>\n\n\n\n<li>One operator can interview repeatedly under different personas.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Record interviews; watch for lip\u2011sync and lighting artifacts.<\/li>\n\n\n\n<li>Run document\u2011to\u2011face ID checks pre\u2011hire.<\/li>\n\n\n\n<li>Log applicant IPs\/phone numbers to flag anonymizers.<\/li>\n<\/ul>\n\n\n\n<p>Read more from<strong> <a href=\"https:\/\/www.darkreading.com\/remote-workforce\/north-korean-operatives-deepfakes-it-job-interviews\" target=\"_blank\" rel=\"noopener\" title=\"\">Dark Reading<\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>8. Kubernetes Pods Are Inheriting Too Many Permissions<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Dark Reading reports that default cloud\u2011provider IAM lets pods <strong>inherit node\u2011level rights, enabling lateral movement<\/strong>.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AKS, EKS, and GKE are all affected; attackers can escalate via over\u2011privileged service accounts.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable GKE Workload Identity \/ EKS IRSA \/ AKS managed identities.<\/li>\n\n\n\n<li>Restrict RBAC; avoid wild\u2011card roles.<\/li>\n\n\n\n<li>Scan for pods running privileged or hostNetwork=true.<\/li>\n<\/ul>\n\n\n\n<p>Read more from<strong> <a href=\"https:\/\/www.darkreading.com\/cloud-security\/kubernetes-pods-inheriting-permissions\" target=\"_blank\" rel=\"noopener\" title=\"Dark Reading\">Dark Reading<\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>9. Android Phones Shipped With Pre-Downloaded Malware Targeting Crypto Wallets<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\">Dark Reading cites Doctor&nbsp;Web: budget Android phones ship with pre\u2011loaded malware that steals crypto by hijacking wallet addresses.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>At least 300\u202fk devices sold in SE Asia carry the Trojan; it activates when popular wallet apps are installed.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advise staff to avoid off\u2011brand phones; use hardware wallets.<\/li>\n\n\n\n<li>Block registration of unknown OEM device IDs via MDM.<\/li>\n\n\n\n<li>Re\u2011flash affected phones with clean ROMs or decommission them if you really need to use them.<\/li>\n<\/ul>\n\n\n\n<p>Read more<strong> <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/android-pre-downloaded-malware-crypto-wallets\" target=\"_blank\" rel=\"noopener\" title=\"Dark Reading\">Dark Reading<\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>10. CVE Program Budget Cuts Rattle Cybersecurity Sector<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context<\/strong>: A proposed 40 % budget cut nearly shut down the 25-year-old CVE Program on 16 April 2025. After a loud industry backlash, CISA signed an <strong>11-month bridge contract<\/strong> with MITRE and endorsed a newly formed <strong>CVE Foundation<\/strong> to take the project independent.<\/pre>\n\n\n\n<p>Read more from<strong> <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/cve-program-cuts-cyber-sector\" target=\"_blank\" rel=\"noopener\" title=\"Dark Reading\">Dark Reading<\/a><\/strong> <\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>11. <strong>WhatsApp\u2019s New Advanced Chat Privacy Feature to Protect Sensitive Conversations<\/strong><br><\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context<\/strong>: WhatsApp now lets users lock specific chats behind an extra passcode and hides previews.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Rollout began 24 \u202fApril \u202f2025 on Android and iOS<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Note: screenshots remain possible<\/li>\n\n\n\n<li>Update WhatsApp<\/li>\n\n\n\n<li>Require latest WhatsApp on BYOD via MDM if WhatsApp is used for bussiness and has internal or confidential data.<\/li>\n<\/ul>\n\n\n\n<p>Read more from<strong> <a href=\"https:\/\/cybersecuritynews.com\/whatsapp-advanced-chat-privacy-feature\/\" target=\"_blank\" rel=\"noopener\" title=\"Cyber Security News\">Cyber Security News<\/a> <\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>12. The Shadow\u2011AI Surge: Study Finds 50% of Workers Use Unapproved AI Tools<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context<\/strong>: CyberArk survey: half of employees paste sensitive data into consumer AI tools without sign\u2011off.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>36\u202f% admitted pasting source code; 26\u202f% shared customer data.<\/li>\n\n\n\n<li>Only 22\u202f% of orgs have formal AI\u2011usage policies.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Draft AI\u2011acceptable\u2011use policy; block risky domains. You can download free simple ai use policy from us here.<\/li>\n\n\n\n<li>Offer a logged, sanctioned GPTs.<\/li>\n<\/ul>\n\n\n\n<p>Read more from<strong> <a href=\"https:\/\/www.securityweek.com\/the-shadow-ai-surge-study-finds-50-of-workers-use-unapproved-ai-tools\/\" target=\"_blank\" rel=\"noopener\" title=\"Security Week \">Security Week <\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>13. Google Drops Cookie Prompt in Chrome, Adds IP Protection to Incognito<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context<\/strong>: Google killed the idea of a pop-up that would have asked every Chrome user to allow or block third-party cookies, but the wider cookie phase-out is only delayed (pending U.K. regulator approval), and Chrome will instead test <strong>**IP Protection**<\/strong>\u2014a two-hop proxy relay (Google + Cloudflare) that hides Incognito users\u2019 IP addresses from trackers\u2014starting in Canary builds in May 2025, with stable release no earlier than July.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Decision comes after Google scrapped its new cookie-consent prompt and postponed broader cookie deprecation to avoid breaking ad-tech workflows.<\/li>\n\n\n\n<li>IP Protection masks users\u2019 addresses via a double proxy run by Cloudflare and Google; enterprises can disable it and it is off by default in managed Chrome.<\/li>\n\n\n\n<li>Move helps satisfy EU Digital Markets Act privacy expectations without completely overhauling web-tracking economics.<\/li>\n<\/ul>\n\n\n\n<p>Read more from the<strong> <a href=\"https:\/\/thehackernews.com\/2025\/04\/google-drops-cookie-prompt-in-chrome.html\" target=\"_blank\" rel=\"noopener\" title=\"Hacker News \">Hacker News <\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>14. Phishers Exploit Google Sites and DKIM Replay to Send Signed Emails, Steal Credentials<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context<\/strong>: Until Google closed the loophole on <strong>22 Apr 2025<\/strong>, attackers were grabbing a <em>*legitimate*<\/em> Google-signed email, replaying the same DKIM signature on a doctored message, and pointing users to credential-harvest pages hosted on Sites.google.com\u2014so every message looked 100 % authentic to mail filters.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>How the trick works:<\/strong> the gang captures a real no-reply@google.com message, swaps out the body and From-name inside a Google OAuth app, then replays the signed headers; DKIM and DMARC still pass because the signature matches the original hash.<\/li>\n\n\n\n<li><strong>Why it lands:<\/strong> security tools trust both the DKIM signature <strong>ja<\/strong> the sites.google.com domain hosting the fake login page, so the mail bypasses most enterprise gateways.<\/li>\n\n\n\n<li><strong>Who was hit:<\/strong> campaigns focused on finance teams and SaaS help-desk inboxes, aiming to reuse cloud creds in BEC and payroll-diversion fraud.<\/li>\n<\/ul>\n\n\n\n<p>Read more from <strong><a href=\"https:\/\/thehackernews.com\/2025\/04\/phishers-exploit-google-sites-and-dkim.html\" target=\"_blank\" rel=\"noopener\" title=\"The Hacker News\">The Hacker News<\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>15. Gartner: 85 % of CEOs now view cybersecurity as a growth driver<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context<\/strong>: Gartner\u2019s 2025 <strong>CEO &amp; Senior Executive Survey<\/strong> (\u2248 450 global leaders) shows cybersecurity has shifted from cost centre to strategic enabler of revenue expansion and new-market entry.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>85 %<\/strong> of CEOs say robust security is <em>*critical for business growth*<\/em> and competitive differentiation.<\/li>\n\n\n\n<li><strong>Risk back on the agenda:<\/strong> \u201centerprise risk\u201d returned to CEOs\u2019 top-10 priorities for the first time since 2017, driven by cyber-threats and regulation.<\/li>\n\n\n\n<li><strong>Leadership anxiety:<\/strong> 45 % admit they would not feel comfortable defending a breach to the media, highlighting reputational stakes.<\/li>\n\n\n\n<li><strong>AI double-edge:<\/strong> executives see AI as both a growth lever and a source of new attack surface, increasing demand for mature security programs.<\/li>\n<\/ul>\n\n\n\n<p><strong>Next Steps<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Link security KPIs to growth metrics<\/strong> (faster product launches, quicker market entry) when pitching budgets.<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Rehearse breach-response messaging<\/strong> so leaders can confidently address incidents with press and regulators.<\/li>\n<\/ul>\n\n\n\n<p>Read more<strong> <a href=\"https:\/\/cybermagazine.com\/news\/gartner-85-see-cybersecurity-as-critical-for-growth\" target=\"_blank\" rel=\"noopener\" title=\"Cyber Magazine\">Cyber Magazine<\/a><\/strong><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>16. Cyberwar in Ukraine, Year 3: Fewer wipers, more stealthy OT recon<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong><strong>Context: <\/strong><\/strong> CSO Online\u2019s April-2025 report says Russian operators have shifted from headline-grabbing wiper attacks to quieter espionage and mapping of operational-technology (OT) networks as the conflict grinds on.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ukrainian defenders are now seeing <strong>**many more intrusions aimed at stealing data and charting energy-grid and transport systems**<\/strong> than outright destructive malware.<\/li>\n\n\n\n<li>CERT-UA notes that while wipers still surface, <em>*the bulk of 2024 activity*<\/em> was credential-theft and OT reconnaissance.<\/li>\n\n\n\n<li>Ukrainian critical-infrastructure teams report improved resilience: faster backup restore times and segmented OT help limit impact when destructive code does appear.<\/li>\n<\/ul>\n\n\n\n<p>Read more from<strong> <a href=\"https:\/\/www.csoonline.com\/article\/3965409\/the-state-of-cyberwar-in-ukraine-and-how-cisos-can-help.html\" target=\"_blank\" rel=\"noopener\" title=\"CS Online\">CS Online<\/a><\/strong> <\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>17. Booking.com phishing uses fake CAPTCHA to sneak AsyncRAT into hotel networks<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-verse\"><strong>Context:<\/strong> A global \u201cClickFix\u201d campaign is impersonating Booking.com reservations. Victims are shown a bogus CAPTCHA page that triggers a PowerShell one-liner, downloading an AutoIt wrapped <strong>AsyncRAT<\/strong> payload and handing attackers remote control.<\/pre>\n\n\n\n<p><strong>Key Details<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Social-engineering flow:<\/strong> phishing email \u2192 PDF\/HTML link \u2192 fake CAPTCHA \u2192 hidden PowerShell download \u2192 `AutoIt.exe -r loader.au3` launches AsyncRAT.<\/li>\n<\/ul>\n\n\n\n<p>Read more from <strong><a href=\"https:\/\/hackread.com\/booking-com-phishing-scam-fake-captcha-asyncrat\/\" target=\"_blank\" rel=\"noopener\" title=\"Hack Read\">Hack Read<\/a><\/strong><\/p>\n\n\n\n<p><\/p>","protected":false},"excerpt":{"rendered":"<p>Weekly roundup: 17 must-read cybersecurity stories for April 2025: ransomware franchise models, CVE funding drama, Chrome IP Protection, OT sabotage &#038; more<\/p>","protected":false},"author":1,"featured_media":19106,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32,26],"tags":[],"class_list":["post-19105","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-blog"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/posts\/19105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/comments?post=19105"}],"version-history":[{"count":62,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/posts\/19105\/revisions"}],"predecessor-version":[{"id":19236,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/posts\/19105\/revisions\/19236"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/media\/19106"}],"wp:attachment":[{"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/media?parent=19105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/categories?post=19105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kordon.app\/et\/wp-json\/wp\/v2\/tags?post=19105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}