In today’s cybersecurity news…

Microsoft Copilot summarizes confidential emails

Microsoft says a code bug in Microsoft 365 Copilot caused the AI to summarize emails marked confidential since late January, bypassing sensitivity labels and data loss prevention policies. The issue was detected on January 21st, and affects the Copilot Chat “work tab,” which incorrectly pulls and summarizes emails from users’ Sent Items and Drafts folders, including messages explicitly restricted from automated access. Microsoft says this is a code error and began rolling out a fix earlier this month. (BleepingComputer)

ShinyHunters takes CarGurus records

The ShinyHunters cybercrime group claims it breached CarGurus and stole 1.7 million corporate records, threatening to leak the data if the company does not respond by February 20th. The gang says this includes personally identifiable information and internal corporate data. CarGurus has not confirmed the breach, but this is part of a broader spree attributed to ShinyHunters and affiliates, who have recently posted alleged breaches involving investment firms Mercer Advisors and Beacon Pointe Advisors, as well as companies including Canada Goose and Figure Technology Solutions. .(The Register)

Texas sues TP-Link over router hack

Texas Attorney General Ken Paxton sued TP-Link Systems, alleging it deceptively markets its products as secure while allowing vulnerabilities that Chinese state-sponsored hackers have exploited. The lawsuit cites a 2023 report linking TP-Link firmware flaws to activity by the Camaro Dragon hacking group, and argues because many components are sourced from China, the company could be subject to Chinese intelligence laws requiring cooperation with state authorities. TP-Link denied the allegations.  (The Record)

Honeywell CCTVs vulnerable to auth bypass

CISA says a 9.8-severity vulnerability affecting multiple Honeywell CCTV models could let unauthenticated attackers take over device accounts and access camera feeds. The flaw stems from an exposed API endpoint that lets attackers change the account’s password recovery email without authentication, effectively enabling account hijacking. The impacted models are commonly used in commercial and some critical infrastructure environments. CISA is telling organizations to limit network exposure, isolate devices behind firewalls, and use secure remote access methods. (BleepingComputer)

Huge thanks to our sponsor, Conveyor

Fraudster hacks hotel system, pays 1 cent

Spanish police arrested a 20-year-old man accused of hacking a hotel booking website to manipulate its payment validation system, letting him book stays for just one cent per night. Authorities say the suspect repeatedly exploited the flaw, including during a four-night, €4,000 stay in Madrid. The scheme initially appeared to process full payments, but when funds were transferred to the hotel, it revealed that only one cent had actually been paid. (The Register)

CRESCENTHARVEST campaign targets Iran protest supporters

Acronis researchers have identified a campaign dubbed CRESCENTHARVEST targeting supporters of Iran’s protests with RAT malware delivered via malicious shortcut files disguised as protest media. The malware uses DLL sideloading through a legitimate Google-signed binary to evade detection and can steal credentials, Telegram data, browser information, and log keystrokes. The activity is likely linked to an Iran-aligned threat group and reflects ongoing state-backed surveillance of activists and dissidents. (The Hacker News)

Threat actor exploits Dell zero-day

Researchers at Mandiant and Google say a suspected China-linked threat group has been exploiting a critical zero-day in Dell RecoverPoint for Virtual Machines since at least mid-2024. The hardcoded credential flaw allows unauthenticated attackers to gain root-level access, move laterally, maintain persistence, and deploy malware. Dell has issued remediation guidance. Google has offered recommendations to help organizations assess potential compromise. (The Cyber Wire)

Lawsuit claims feds used ‘gross mischaracterizations’

A former federal election official told a court that the FBI misrepresented key facts and omitted public evidence in its affidavit used to justify last month’s raid on Fulton County, Georgia election offices. The affidavit cited alleged issues with ballot image storage and vote tabulation to suggest a conspiracy to favor Joe Biden. Researcher Ryan Macias, who tested and certified the county’s 2020 voting machines, said these claims had already been investigated and found baseless. Macias noted standard practices, prior state investigations, and minor discrepancies mischaracterized, with the affidavit containing factual errors on vote counts and reporting timelines, undermining its basis for probable cause. (CyberScoop)