Cryptocurrency Stolen in Zoom Social Engineering Campaign; Cursor AI Bot Hallucinates Company Policy; Scammers Claim to be FBI IC3

This vulnerability is currently exploited using Zoom, but this idea will likely work with many different platforms. Remote meeting platforms do not usually prevent duplicate display names (names are often not unique). Users will likely only have their own intuition to flag suspect behaviour.

Johannes Ullrich

More and more auto-response services are leveraging AI to provide an improved customer experience in an attempt to reduce reliance on humans. Unfortunately, AI hallucinations, which you may also see called confabulations, are a challenge, so you really need to monitor and train your responder carefully. Unlike the Air Canada issue from February 2024, Cursor acknowledged the issue and took steps to make amends. Even when labelling generated responses as such, particularly email or SMS responses which appear to come from an official company source, realize that users may miss the distinction, so you need a clear path to a human resource to resolve any issues.

Lee Neely

AI has created a new acronym: GIGMBAO or Garbage In Gets Magnified to Bad Advice Out. I'm pretty sure adding labels to customer advice that say ÒAI created this, so use at your own risk' is not a winning business strategy.

John Pescatore

Not sure that is reason to cancel a subscription but different rules for different folks. Errors, hallucinations, confabulations, whatever we choose to call them will happen, that's a risk in using AI in its early days. That said, care must be given when using AI for customer facing operations. It's best to have a human monitor response and be transparent in labeling its use for that business function. Transparency will usually 'buy' a lot of good will, should something go wrong.

Curtis Dukes

IC3 reminds us they will never make contact with users in this fashion and provides information for identifying or reporting such a scam. Local law enforcement or FBI office are well versed in scams such as these and can help determine if a contact is legitimate. Look them up for contact information, do not use the scammer provided contact number, email/etc.

Lee Neely

The cunning of scammers never ceases to amaze. It's the perfect ruse to get a victim talking and gain access. We, as humans, typically trust law enforcement, especially if they call. The reality though, is that one should never grant anyone access to their account.

Curtis Dukes

IC3 does not come to you. You must go to it.

William Hugh Murray

As a customer, keep a sharp eye on your credentials associated with your finances, both financial institutions and investments. Make sure these are unique and strong, and any MFA capabilities are enabled and required. Make sure you've implemented available transaction monitoring/alerting. If you're a broker or other financial services provider, verify your MFA is comprehensively applied and that you've got automated credential breach monitoring, in addition to existing transaction limits and monitoring. Verify alerts are properly logged and responded to.

Lee Neely

Digital watering holes have been around for decades. Even with periodic awareness training, we can still fall victim to this sort of attack. What's surprising though, is the relatively large number of unauthorized accesses and fraudulent transactions over such a short period of time. This speaks to a level of sophistication by the evildoers and a lapse in user awareness of mitigation strategies.

Curtis Dukes

Think strong authentication and out-of-band confirmation.

William Hugh Murray

AiCloud is a remote access service built into ASUS routers, enabling file sharing via USB devices connected to the router or on home networks. CVE-2025-2492, improper authentication control, CVSS score 9.2, can be triggered by an unauthenticated user. The fix is to both apply the firmware update and make sure that you're using strong, unique, passwords as well as limiting access to the admin interface. If you're on an EOL ASUS product, there is no update; you should replace it. Until you do, disable internet-facing services (AiCloud, WAN Internet access, port forwarding, DDNS, VPN Server, DMZ, port triggering, and FTP). Note to self, create a reminder, upon acquisition, to replace devices prior to EOL.

Lee Neely

Seems like authentication bypass flaws are a fruitful ground for attackers - which makes sense as slow adoption of phishing-resistant MFA is increasing. But putting a steel door and deadbolt lock on a door next to an open window is obviously not raising the security bar. The 2021 OWASP Top Ten Software Vulnerabilities list had dropped the priority of auth bypass flaws (under Identification and Authentication Failures) - I'm sure it will show up much higher in the coming 2025 Top Ten.

John Pescatore

CVE-2025-20236, URL parser flaw, CVSS score 8.8, is another example of not validating input, reminding us that you need to do this comprehensively. If you're a Webex shop, you should have auto-updates set for the client. There are no workarounds, you need to update the client, regardless of configuration or OS. Consider that while version 44.6 has a fix, you really need to get to 44.8.

Lee Neely

It's not clear if this bill can be technically implemented, let alone if the social media providers would be inclined to do so. Florida passed a bill last year restricting social media access for users under 16, which is still having its constitutionality under review in the courts. The EFF notes that there are other forensic approaches which can be used without requiring decryption or weakened security. Sadly, until we get legal precedence, initiatives such as this will continue to arise.

Lee Neely

The bill is another attempt to weaken E2EE 'for the children'. The proposed measures only apply to accounts held by minors, but implementation would likely make the same measure available for all accounts. In addition to restricting E2EE, the bill also aims to limit the use of self-deleting messages and allow them to be recoverable. The unanimous vote for the bill is a testimony to a lack of technical competency among the Florida legislators and staff.

Johannes Ullrich

Digital media has been a gift to investigative efficiency. Instead of saying thank you, government continues to whine and demand more. One must be careful not to harm the goose that lays the golden egg.

William Hugh Murray

Note that the hospital was able to detect the malware in real-time, shut it down and launch an investigation. Beyond EDR, having external/environment monitoring, such as security cameras, is valuable for investigations. Validate where and how long this data is stored, as well as ensuring access is available when needed. Walk through protections on common area and office computers to understand the mitigations from an unauthorized user attempting to use them, adjusting where needed.

Lee Neely

While Mr. Bowie should be prosecuted under the full weight of the law, it also speaks to the state of security at the hospital. The assumption being that the account on the computer was left logged on and accessible by anyone that wandered by. While this was a near miss for the hospital, simply designating a computer for 'employee use only' is not sufficient to pass any cybersecurity audit.

Curtis Dukes

There is no get-out-of-jail-free card for HIPAA violations/breaches. Beyond any HHS penalty is a requirement to implement a risk analysis and corrective action plan, which will be monitored by HHS, likely being more expensive than the fine. Beyond HHS actions, lawsuits are becoming more common, so you not only need to assess and manage your risks but also include your legal team in your incident response plan to ensure your actions are defendable in court.

Lee Neely

While it is important to understand the causes and contributions to breaches, we have been punishing the victims for almost a generation while the problem only gets worse. When something does not work, do something different rather than simply doing harder that which is not working. Perhaps more carrots, fewer sticks?

William Hugh Murray

A lot of strong progress discussed in some critical areas. Since SANS core belief is that a well-managed, highly skilled security staff leading to security operations excellence is the most efficient and effective path to risk avoidance and reduction, I'll focus on the 'Security-First Culture' progress: 'Every Microsoft employee now has a Security Core Priority tied directly to performance reviews. 50,000 employees have participated in the Microsoft Security Academy to improve their security skills. 99% of employees have completed our Security Foundations and Trust Code courses.' Good to see, my only quibble: 50,000 trained employees is about 25% of Microsoft's staff - room to improve there.

John Pescatore

Most of the protections they are implementing are a good idea in most shops, including both technical and training activities. Make sure that you're implementing the latest security protections in Azure, not just MFA, but also dormant/idle account management, detection and response. Ask how often you are checking for updated security best practices from your service providers, as well as the process for implementing and validating them. Offer to assist with any roadblocks.

Lee Neely

This report is more about effort than results. It is about features and functions rather than the quality of their code, the real security problem for Microsoft's customers. A useful metric of code quality is the rate of patches and that shows no sign of going down.

William Hugh Murray