Featured image of post Cybersecurity Week in Review: July 8 – 14, 2025
NEWS

Cybersecurity Week in Review: July 8 – 14, 2025

Cyberattacks, data breaches, zero-days, and global responses—discover the biggest cybersecurity headlines of this week.

By Samuel Monsempes

Major Data Breaches and Leaks

  • Qantas Airline (5.7M Records): Australian carrier Qantas confirmed a breach via a third-party contractor’s platform, exposing data of about 5.7 million customers. Stolen information ranged from names and emails to frequent-flyer numbers and some addresses, birth dates, and phone numbers. Qantas emphasized that no passwords, payment, or passport details were compromised and is notifying affected passengers while warning of potential phishing scams.

  • McDonald’s Job Applicant Data (64M Chats): Researchers uncovered a flaw in McHire, McDonald’s chatbot-based job application system, that left 64 million application chat records exposed. The breach stemmed from an admin panel protected by the default credentials “123456” and an IDOR vulnerability allowing sequential retrieval of other applicants’ chat transcripts, personal details, and session tokens. McDonald’s and vendor Paradox.ai fixed the issue the same day it was reported, calling the lapse “unacceptable”.

  • FlirtAI App Leak (160K Screenshots): A misconfigured cloud storage bucket for FlirtAI – Get Rizz & Dates (an iOS “AI wingman” app) exposed 160,000 private chat screenshots used for dating advice. Many leaked conversations involved teenagers seeking help with peer interactions. Users were likely unaware their chats were stored as images; the leak was secured after disclosure, but highlights the risks of uploading personal chats to third-party AI services.

Significant Cyberattacks and Incidents

  • Ingram Micro Ransomware Outage: Global IT distributor Ingram Micro suffered a SafePay ransomware attack over the July 4th weekend, forcing worldwide systems offline. Websites and ordering platforms went down, and employees were instructed to work from home. By mid-week, Ingram Micro had restored most operations (orders via phone/email in key regions) and performed a company-wide password reset and MFA re-enrollment. While no data leak was immediately confirmed, SafePay is known to steal data, raising the possibility of extortion if a ransom isn’t paid.

  • Ransomware Group SatanLock Shuts Down: The emergent SatanLock gang, active since April 2025, abruptly announced it is ceasing operations and intends to leak all stolen victim data. The group had rapidly hit dozens of targets, and its sudden shutdown (revealed July 7) comes amid turmoil in the ransomware ecosystem. The incident underscores the volatility of ransomware-as-a-service crews – with SatanLock following others in an apparent “no honor among thieves” collapse, potentially due to internal conflict or law enforcement pressure.

  • Ongoing Crypto User Malware Campaign: Security researchers warn of an active social engineering campaign targeting cryptocurrency enthusiasts via Telegram, X (Twitter), and Discord. Threat actors are impersonating fake AI, gaming, and Web3 startup firms – complete with polished websites and stolen social media accounts – to trick users into downloading “demo” apps laden with malware. The multi-platform malware toolkit includes info-stealers (like Atomic macOS Stealer on Mac) that siphon browser data and crypto-wallet keys. Victims are lured with promises of crypto payments for testing software, highlighting the need for vigilance against unsolicited app downloads.

Critical Vulnerabilities and Patches

  • Microsoft Patch Tuesday (July 2025): Microsoft’s monthly update fixed 137 security flaws this week, including 14 Critical vulnerabilities and one publicly disclosed zero-day. The zero-day, CVE-2025-49719, is an information disclosure bug in SQL Server that could allow remote, unauthenticated data access. Admins were urged to patch promptly, especially for easily exploitable Office and SharePoint RCE flaws that could be triggered via malicious documents. (Microsoft noted that Office for Mac patches are slightly delayed, pending release.)

  • Fortinet FortiWeb RCE (CVE-2025-25257): Fortinet released fixes for a Critical SQL injection vulnerability in its FortiWeb web application firewall (CVSS 9.8) that allows pre-auth remote code execution. The flaw, found in a component for Fabric Connector, lets an attacker send crafted HTTP requests to inject SQL via an unsanitized bearer token. Security researchers published proof-of-concept exploits showing how an attacker can drop a web shell on vulnerable FortiWeb servers. With exploits now public, admins are strongly advised to upgrade to the patched FortiWeb versions (7.0.11, 7.2.11, 7.4.8, or 7.6.4+) immediately.

  • “Citrix Bleed 2” on NetScaler (CVE-2025-5777): A critical pre-authentication memory leak in Citrix NetScaler ADC and Gateway (nicknamed CitrixBleed 2) is being actively exploited in the wild. Citrix disclosed the flaw on June 17, but by this week attackers had launched over 11 million exploit attempts against thousands of organizations. The bug (CVSS 9.3) allows leaking sensitive memory contents and resembles a 2023 Citrix issue. In response, U.S. CISA added it to the Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within 24 hours, calling the risk “unacceptable”. All organizations using NetScaler are urged to install Citrix’s update and check for signs of compromise.

  • Google Chrome 0-Day & Android Patch Gap: Google pushed an emergency Chrome update to fix CVE-2025-6554, a high-severity zero-day exploited in the wild. The flaw involves a bug in Chrome’s engine (details withheld by Google) and marks Chrome’s fifth 0-day of the year, reinforcing the need to keep browsers updated. Meanwhile, Google did not release an Android security bulletin in July – breaking a nearly 10-year streak of monthly Android patches. This pause (the first since August 2015) raised industry eyebrows, though Google indicated that no Android fixes were ready; users are advised to stay vigilant and apply the August updates when available.

Government and Industry Cyber Responses

  • UK Cracks Down on Scattered Spider: The UK’s National Crime Agency arrested four individuals (aged 17–20) tied to the notorious “Scattered Spider” hacking crew responsible for high-profile data theft and extortion attacks. Those arrested are suspected in the April ransomware breaches of retailers Marks & Spencer, Co-op, and Harrods, among other intrusions. Authorities seized devices and charged the suspects under computer misuse, blackmail, and organized crime laws. Notably, Scattered Spider has also targeted the aviation sector, and the FBI recently warned that the group (and affiliates) use help-desk impersonation to hijack accounts. The arrests mark a significant win, signaling increased law enforcement pressure on the teen-led hacking cartel.

  • India Busts Tech Support Scam: India’s Central Bureau of Investigation (CBI) conducted “Operation Chakra V” on July 7, raiding a fraudulent call center in Noida that ran a tech support scam targeting victims in the UK and Australia. The scam, which stole over £390,000 (~$525,000) via bogus tech support services, used advanced call infrastructure to appear legitimate. The CBI arrested two key operators and dismantled the call center, with officials citing the operation as a model of international cybercrime cooperation. This follows a broader effort by Indian authorities to shut down scam call operations exploiting overseas victims.

  • CISA Emergency Patching Orders: Highlighting a more aggressive stance on cyber defense, the U.S. Cybersecurity and Infrastructure Security Agency this week issued an emergency directive requiring civilian federal agencies to rapidly patch several newly disclosed vulnerabilities. Notably, CISA mandated 24-hour fixes for the actively exploited Citrix NetScaler bug CVE-2025-5777 and added it to its “Must-Patch” list. CISA also officially “confirmed active exploitation” of the NetScaler flaw and urged all organizations (public and private) to apply updates without delay. Such directives reflect government efforts to shorten the window of exposure for critical flaws being leveraged by attackers.

Miscellaneous

  • Fake News Sites Fuel Investment Fraud: A new report dubbed “BaitTrap” revealed a sprawling network of over 17,000 fake news websites used to promote phony investment schemes across 50 countries. Scammers crafted lookalike news pages (masquerading as outlets like CNN, BBC, etc.) featuring fabricated success stories with celebrities or banks to lend credibility. Unsuspecting readers who click the bait are funneled to professional-looking scam investment platforms (e.g. Trap10, Solara Vynex) where they’re duped into parting with money. The campaign relies heavily on sponsored ads and geo-targeted domains, underscoring the growing sophistication of financial fraud operations online.

  • “PerfektBlue” Car Bluetooth Flaws: Cybersecurity researchers disclosed PerfektBlue, a set of four Bluetooth vulnerabilities in the OpenSynergy BlueSDK stack used by many cars, potentially affecting millions of vehicles. If chained, these flaws enable remote code execution on vehicle infotainment systems via Bluetooth. Major automakers including Mercedes-Benz, Volkswagen, and Skoda are confirmed impacted, among possibly others. While the vulnerable Bluetooth module is in non-driving systems, attackers could theoretically compromise connected car functions. The discovery highlights the need for improved automotive software security; patches are expected from OEMs and suppliers to close the holes.

  • “GPUHammer” Attacks on AI Systems: Academic researchers demonstrated a novel Rowhammer-style attack on GPU memory dubbed GPUHammer, capable of corrupting AI model data on NVIDIA GPUs. By rapidly flipping bits in a GPU’s GDDR6 memory, the attack degraded a test image recognition model’s accuracy from 80% to <1%. NVIDIA acknowledged the issue and advised enabling ECC (error-correcting code) memory on GPUs as a mitigation. While there are no reports of in-the-wild exploits, this research signals that attackers could target AI workloads and highlights hardware-level security as an emerging concern in machine learning environments.

  • Leaked Keys Threaten Web Apps: GitGuardian researchers warned that hundreds of web applications may be vulnerable to takeover due to leaked API/secret keys in public repositories. In a study of GitHub, they found over 260,000 Laravel APP_KEYs (used for encryption in Laravel PHP apps) exposed since 2018, with 600+ live apps confirmed exploitable for remote code execution via a deserialization attack. This serves as a reminder for developers to scrub secrets from code and rotate keys – a single leaked key can allow attackers to run arbitrary code or access sensitive data in cloud and web services. Development teams are urged to use automated secret-scanning and better key management to prevent such supply-chain exposures.

Conclusion

  • Defense-in-Depth is Vital: This week’s incidents – from massive customer data leaks to critical software 0-days – illustrate that no single security measure is foolproof. Organizations must layer defenses (strong access controls, network segmentation, data encryption, etc.) so that even if one layer fails (as seen with an exposed password 123456 or a zero-day exploit), other controls can mitigate damage.

  • Patch Urgently and Continuously: The surge of high-impact vulnerabilities (Microsoft’s 137 fixes, Fortinet and Citrix emergencies) reinforces the importance of aggressive patch management. Enterprises should accelerate testing and deployment of critical patches, especially for internet-facing systems like VPN gateways and WAFs, to shrink the window attackers have to exploit weaknesses. Where possible, enable automatic updates or virtual patching, and monitor threat advisories (e.g. CISA’s alerts) to prioritize urgent fixes.

  • User Awareness and Vigilance: Many attacks this week relied on social engineering – from fake tech support calls to imposter crypto startups on chat apps. Continuous security awareness training for users and employees is crucial. Individuals should be skeptical of unsolicited communications (phishing emails, unexpected phone calls or DMs) and verify before trusting – e.g. contacting companies via official channels. Basic cyber hygiene (unique passwords, multi-factor authentication, not reusing corporate credentials elsewhere) remains a strong defense against account takeovers employed by groups like Scattered Spider.

  • Law Enforcement and Collaboration Yield Results: The international actions (UK and Indian operations) underscore that cybercriminals – even youthful, overseas groups – are not beyond reach. Increased collaboration between tech companies, law enforcement, and intelligence agencies is making it harder for ransomware gangs and scammers to operate with impunity. Organizations should promptly involve authorities (and share threat intelligence) when serious breaches occur. Public-private partnerships and information sharing are key to dismantling criminal infrastructure and deterring future attacks.

Sources

© 2025 Senthorus Blog