In today’s cybersecurity news…
Hackers arrested for selling Roblox accounts
Ukrainian authorities arrested three individuals for hijacking more than 610,000 Roblox accounts using info-stealing malware disguised as game enhancement tools. The attackers harvested credentials, sorted accounts by value including at least 357 high-value profiles, and sold them through Russian platforms, generating about $225,000. Police seized devices and cash during raids, and the suspects now face up to 15 years in prison as investigators look for additional victims and accomplices. (BleepingComputer)
Microsoft’s patch for a 0-day falls short
Microsoft and CISA warned that attackers are exploiting a zero-click Windows Shell flaw created by an incomplete fix for an earlier vulnerability used by Russian state-backed group APT28. The bug allows credential theft via forced authentication, exposing Net-NTLMv2 hashes that can be used to access sensitive data and move laterally on networks, even after Microsoft’s February patches blocked the original remote code execution chain. CISA has added the flaw to its Known Exploited Vulnerabilities list with a May 12th remediation deadline. (The Register)
US & China partner on Dubai scam takedown
A joint U.S. and Chinese law enforcement operation raided nine scam centers in Dubai, resulting in 276 arrests tied to cryptocurrency “pig-butchering” schemes that defrauded American victims. Investigators traced the networks using data from Meta, financial records, and blockchain analysis, leading to charges against several organizers accused of running front companies coordinating the scams. This is part of a broader U.S. effort to combat cyber fraud, which cost Americans $16 billion last year. Concerns remain over links between Chinese criminal groups and state-aligned economic activity. (The Record)
Hackers exploit RCE flaws in Qinglong
Attackers are exploiting two authentication bypass flaws in the Qinglong task scheduler to achieve remote code execution and deploy cryptominers on exposed servers. The bugs stem from mismatches in routing and authentication logic, allowing unauthorized access to admin endpoints and enabling attackers to inject malicious commands that install high-CPU mining processes disguised as legitimate system activity. Exploitation began before disclosure, and while initial patches were incomplete, a later fix addressed the root cause as infections spread across multiple environments. (BleepingComputer)
Huge thanks to our sponsor, Guardsquare
Reverse engineering unearths GitHub bug
GitHub disclosed a high-severity flaw that could let attackers with repository push access achieve remote code execution by injecting malicious metadata through unsanitized input. The issue was discovered by Wiz using an AI-powered reverse-engineering tool that analyzed closed-source binaries, reducing what would have taken months to under 48 hours. GitHub patched cloud instances with no evidence of exploitation, but many on-premise Enterprise Server deployments remained vulnerable. (Dark Reading)
Exchange Online blocks old TLS versions
Microsoft will start blocking TLS 1.0 and 1.1 connections to Exchange Online for POP3 and IMAP4 starting in July, fully ending support for the deprecated protocols. The move follows years of warnings, with most traffic already using TLS 1.2 or higher, though legacy clients and devices that opted into older endpoints could still face disruptions. The change reflects broader industry efforts to phase out insecure encryption standards and unsurprisingly, Microsoft is pushing customers toward modern protocols. (The Register)
Flaws found in electronic health record platform
An AI-driven scan of the OpenEMR platform uncovered 38 previously unknown vulnerabilities, including SQL injection, authorization bypass, and XSS flaws that could enable database compromise, patient data theft, and remote code execution. Security firm Aisle identified the issues in three months and provided fixes, all of which have now been patched, with OpenEMR integrating the AI tool into its development workflow. AI is accelerating vulnerability discovery but also increasing pressure on defenders to rapidly triage and remediate risks. (Dark Reading)
SAP-related npm packages compromised
Multiple SAP-related npm packages were compromised in a supply chain attack that inserted credential-stealing malware via malicious pre-install scripts. The payload harvested developer credentials, cloud secrets, and tokens, exfiltrating them through victim-controlled GitHub repositories while also self-propagating by poisoning other packages and injecting malicious workflows. The attack exploited gaps in npm’s OIDC trusted publishing and introduced new persistence techniques targeting AI coding tools, with maintainers now releasing clean versions to replace the infected packages. (The Hacker News)