Cybersecurity News: US taps private firms in cyber offensive, Microsoft updates cause queuing failures, phishing campaign delivers Phantom Stealer

By
Sarah Lane
-

In today’s cybersecurity news…

US turns to private firms in cyber offensive

Late last week, Bloomberg’s sources said the US administration is preparing a new national cyber strategy that would enlist private companies to help carry out offensive cyber operations against criminal and state-backed attackers. The plan would expand the government’s cyber capacity but raises legal and security risks, since private firms currently lack clear authority to conduct attacks and could become targets themselves. The strategy also calls for streamlining cyber regulations, modernizing federal systems, and accelerating post-quantum security, with more details expected through an executive order or legislation. (Bloomberg)

Microsoft updates cause queuing failures

Microsoft says its latest Patch Tuesday updates introduced a breaking change to the Message Queuing (MSMQ) security model, causing enterprise apps and sites to fail on Windows 10 22H2 and Windows Server 2016 and 2019. The updates altered NTFS permissions on a core MSMQ system folder, requiring write access normally limited to administrators, which can trigger misleading resource errors and disrupt clustered environments. Admins now face rolling back the patches, or leaving systems exposed. MSMQ has a history of critical remote code execution flaws. (BleepingComputer)

Phishing campaign delivers Phantom Stealer

Researchers at Seqrite Labs have identified a Russian-linked phishing campaign, dubbed Operation MoneyMount-ISO, that delivers Phantom Stealer malware using ISO files to bypass email security controls. The attack uses fake payment confirmation emails in Russian, luring finance-related staff into opening a ZIP file that contains a malicious ISO, which mounts a disguised executable and injects the stealer directly into memory. Phantom Stealer harvests browser credentials, financial and crypto data, keystrokes, and tokens, exfiltrating the information via Telegram, Discord, and FTP. (Infosecurity Magazine)

Jaguar Land Rover payroll data stolen

Jaguar Land Rover disclosed that the cyberattack that shut down its factories back in August also included theft of sensitive payroll data belonging to thousands of current and former employees, including bank details and tax information. While JLR says there’s no evidence of misuse so far, it has warned staff to watch for fraud and phishing. The attack is attributed to the Scattered Lapsus Hunters group and has already cost JLR about £1.5 billion in lost sales and has been classified as a systemic event that could cost the UK economy more than £2 billion. (The Register)

Huge thanks to our sponsor, Adaptive Security

This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Attackers don’t need malware anymore; they need trust. Tip: set a simple passphrase for high-risk actions, like wire requests or “urgent” account recovery – especially within finance teams and families. If the caller can’t answer it, pause and verify. Adaptive runs deepfake and vishing simulations so employees practice this before it’s real. Learn more at adaptivesecurity.com.

CISA adds Apple and Gladinet CentreStack and Triofox flaws to exploits

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities catalog, a use-after-free flaw in Apple’s WebKit affecting iOS, iPadOS, and macOS which we told you about yesterday, and a hardcoded AES key issue in Gladinet CentreStack and TrioFox. Both have been actively targeted, including in sophisticated attacks against high-value individuals. Federal agencies are required to remediate these flaws by January 5th. Private organizations should review and patch affected systems to prevent exploitation. (Security Affairs)

Opexus says background checks missed flags before insider breach

US federal contractor Opexus admits it failed to identify red flags when hiring twin brothers Muneeb and Sohaib Akhter, who had pleaded guilty to cybercrimes in 2015. Back in February, minutes after being fired, Muneeb allegedly deleted 96 U.S. government databases and stole sensitive records from DHS, IRS, and EEOC. Opexus acknowledged errors in hiring, termination, and access controls, has enhanced background checks to 10 years. The brothers face up to 45 years in prison for computer fraud, data theft, and aggravated identity theft. (CyberScoop)

Chrome extension intercepts AI chats

Chrome extension Urban VPN Proxy, which has six million users, was found intercepting all prompts and responses from AI chatbots like ChatGPT, Claude, Copilot, Gemini, and Meta AI. The extension was updated in July and collects this data through injected JavaScript and sends it to two servers. The company shares raw data with its affiliated ad intelligence firm BIScience, which also owns Urban Cyber Security. Similar harvesting was observed in three other extensions from the same publisher. (The Hacker News)

Google shutters ‘Dark web’ tool

Google emailed users that on February 16th it’s shutting down its “Dark Web Report” tool, which monitored email addresses on the dark web.. Dark web scans will end January 15th, and all data will be deleted on the shutdown date. Google says feedback claimed it “didn’t provide helpful next steps” and plans to focus on tools offering actionable guidance, like Security Checkup, Password Manager, passkeys, and two-step verification. (9to5Google)