In today’s cybersecurity news…
U.S. Comptroller suffers ‘major incident’
On Tuesday, the U.S. Treasury Department’s Office of the Comptroller of the Currency (OCC) characterized their recent email system breach as a “major incident.” In late February, Microsoft alerted officials to the incident which abused an OCC email administrator account. The initial investigation found no evidence of impact on the financial sector and concluded that only a “limited number” of email accounts were affected. However, new reports from Bloomberg and Microsoft indicate that 103 email accounts with emails totaling 150,000 were compromised and contained highly sensitive financial information. The attack commenced in May of last year, nine months prior to its discovery. It remains unclear who is behind the attack.
Oracle confirms “obsolete servers” hacked
Oracle has finally confirmed via email notifications to customers that hackers leaked credentials stolen from its servers. The notification said, “Oracle would like to state unequivocally that the Oracle Cloud—also known as Oracle Cloud Infrastructure or OCI—has NOT experienced a security breach.“ A hacker was able to access user names and passwords from two obsolete servers that were never a part of OCI. Oracle said, because the passwords were hashed, the hacker was unable to access any customer environments or data. Researcher Kevin Beaumont said that Oracle’s denials of a breach of ‘Oracle Cloud’ is wordplay since the breached servers were part of Oracle’s older cloud services environment which it rebranded as “Oracle Classic.”
Police seize Smokeloader malware servers and detain customers
In a press release on Wednesday, Europol announced that its ongoing Operation Endgame has tracked down and seized Smokeloader botnet servers and detained at least five suspected customers. According to investigators, the Smokeloader pay-per-install botnet service was run by a threat actor called ‘Superstar.’ A database seized during the operation allowed officers to track down the cybercriminals by linking them to their online aliases. Europol has yet to release details about the suspects and said some of them are cooperating and have allowed them to examine digital evidence on their personal devices. Europol has set up a dedicated website to share the latest news related to the investigation.
CentreStack zero-day exploited to breach file sharing servers
Since last month, hackers have been exploiting a vulnerability in Gladinet CentreStack’s secure file-sharing software (CVE-2025-30406). CentreStack is an enterprise file-sharing and access platform that turns on-premise file servers (like Windows servers with SMB shares) into secure, cloud-like file systems. CentreStack is used by thousands of businesses globally, and is popular among Managed Service Providers (MSPs) who host file services for their clients. The issue stems from an improperly protected and hardcoded machineKey in the CentreStack portal configuration (web.config). If an attacker knows this key, they can craft a malicious payload that the server will trust and execute. Gladinet recommends customers upgrade to the latest patched version or manually rotate their ‘machineKey’ as soon as possible.
Huge thanks to our sponsor, Nudge Security
Start a free 14-day trial today
Phishing kits now vet victims in real-time
Threat actors have been spotted employing a new evasion tactic called ‘Precision-Validated Phishing.’ This new technique uses real-time email validation through either validation service API calls or JavaScript code to ensure phishing content is shown only to pre-verified, high-value targets. If an invalid target is identified, they are either presented with an error message or directed to benign sites. Email security firm Cofense said this new tactic is blocking visibility for researchers who typically enter fake or controlled email addresses to map the credential theft campaign. Ultimately, this reduces detection rates and prolongs the lifespan of phishing operations.
Hackers target bugs in EC2 sites to steal AWS credentials
F5 Labs has observed hackers exploiting Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS Elastic Cloud Compute (EC2) instances. The attackers are using credentials from extracted EC2 Metadata to escalate their privileges and access S3 buckets and other AWS services. The attacks are targeting instances running on AWS’s older metadata service, IMDSv1, that allows anyone with access to retrieve the metadata. The system has been superseded by IMDSv2, which requires session token authentication to protect websites. F5 researchers said that the malicious activity culminated between March 13 and 25, 2025 and behavioral patterns strongly suggest that it was carried out by a single threat actor.
Ransomware attacks hit all-time high as payouts dwindle
On Wednesday, BlackFrog issued its State of Ransomware QI, 2025 report. The report revealed that March 2025 set a new high, with over 100 ransomware attacks publicly disclosed, an increase of 81% compared to March 2024. The record-breaking month contributed to the first quarter of 2025 also being a record-breaker, with 278 disclosed ransomware attacks. Data exfiltration played a major part in this surge, with 95% of all publicly disclosed attacks involving some form of data leak. A report from Chainalysis back in February suggests the increased intensity of ransomware activity may be due to profits plummeting. Payouts decreased by 33% to $818 million last year from a record $1.25 billion in 2023.
Lovable AI found most vulnerable to VibeScamming
Lovable is a generative artificial intelligence (AI) powered platform that enables creation of full-stack web applications using text-based prompts. Guardio Labs found Lovable to be most susceptible to jailbreak attacks, allowing novice and aspiring cybercrooks to set up lookalike credential harvesting pages. This technique was dubbed VibeScamming after the AI-dependent programming technique, called vibe coding. Guardio Labs report said, “From pixel-perfect scam pages to live hosting, evasion techniques, and even admin dashboards to track stolen data — Lovable didn’t just participate, it performed. No guardrails, no hesitation.” Guardio said Lovable not only produces a convincing login pages mimicking real Microsoft sign-in pages, but also auto-deploys the page on a URL hosted on its own subdomain (“i.e., *.lovable.app”) and redirects to office[.]com after stealing credentials. The rising popularity of such AI tools will likely significantly reduce the barriers to entry for attackers.