May 30, 2025 – Cyber Briefing

👉 What are the latest cybersecurity alerts, incidents, and news?

OneDrive flaw risks full cloud exposure, fake AI apps spread ransomware, and EDDIESTEALER uses fake CAPTCHAs to steal data. State actor hits ScreenConnect, Ivanti breach impacts NHS, and Amalgamated Sugar leaks SSNs. Funnull tied to $200M crypto scams, Cerby raises $40M to secure identities, and EY says cybersecurity adds $36M in business value per project.

Listen to the full podcast

🚨 Cyber Alerts

1. OneDrive Flaw Gives Sites Full Data Access

Cybersecurity researchers have discovered a critical security flaw in Microsoft’s OneDrive File Picker that could allow websites to access a user’s entire cloud storage, not just selected files. The vulnerability stems from overly broad OAuth scopes and misleading consent prompts, with affected applications potentially including ChatGPT, Slack, Trello, and ClickUp. Compounding the risk, OAuth tokens are often stored insecurely in plaintext within browser session storage, and refresh tokens can grant ongoing data access. Microsoft has acknowledged the responsibly disclosed issue but has not yet released a fix, prompting interim recommendations like temporarily disabling the feature or enhancing token security.

2. Fake AI Apps Drop Ransomware And Malware

Cybercriminals are using counterfeit installers for popular AI tools like ChatGPT and InVideo AI to distribute various malicious threats, including the CyberLock and Lucky_Gh0$t ransomware families, as well as a new destructive malware named Numero. These campaigns often involve fake websites promoted through SEO poisoning, luring victims with deceptive offers before deploying ransomware that encrypts files and demands large payments, sometimes with false humanitarian claims. Other tactics include distributing the Yashma-based Lucky_Gh0$t ransomware via fake premium ChatGPT installers and using a counterfeit InVideo AI installer to continuously run the Numero malware, which renders Windows GUIs unusable.

3. EDDIESTEALER Uses Fake CAPTCHAs for Stealing

Cybersecurity researchers have uncovered a sophisticated malware campaign distributing a new Rust-based infostealer called EDDIESTEALER by using deceptive CAPTCHA verification pages as lures. This campaign tricks users into executing malicious code through a multi-stage delivery mechanism starting with compromised websites that copy a PowerShell command to the clipboard via fake reCAPTCHA interactions. EDDIESTEALER is designed to steal a wide range of sensitive data including credentials, cryptocurrency wallets, and browser information, even bypassing recent Chrome security features. The malware also employs advanced evasion techniques such as string and API obfuscation, sandbox detection, and self-deletion to avoid analysis and persist on victim systems.

For more alerts, click here!

Click to See Jobs

💥 Cyber Incidents

4. State Actors Hit ConnectWise ScreenConnect

ConnectWise, developer of ScreenConnect software, disclosed on May 28th that it suffered a cyber attack likely perpetrated by a sophisticated nation-state actor, affecting a few customers. The company has engaged Google Mandiant for a forensic investigation and has notified all impacted customers, though specific details about the attack or attacker remain unconfirmed. While ConnectWise recently patched a high-severity ScreenConnect vulnerability (CVE-2025–3935), it is currently unknown if this flaw is connected to the recent cyber attack.

5. Ivanti Flaw Hits NHS Staff and Patient Data

Several UK NHS trusts, including University College London Hospitals, had information stolen in a recent cyberattack exploiting a vulnerability in Ivanti Endpoint Manager Mobile software. Hackers reportedly accessed staff phone numbers, IMEI numbers, and authentication tokens, raising concerns this could lead to unauthorized access to sensitive patient records via remote code execution. Analysts at EclecticIQ, who uncovered the incident’s extent, identified the attackers using a China-based IP address and operating similarly to previous China-linked actors.

6. Amalgamated Sugar Data Breach Exposes SSNs

Amalgamated Sugar recently reported a data breach to Vermont’s Attorney General after its computer network was compromised around February 5th, 2025. An investigation confirmed an unauthorized individual may have accessed sensitive personal information, which could include names and Social Security numbers, varying by individual. The Idaho-based sugar company began sending data breach notifications to affected individuals on May 28th, offering them complimentary credit monitoring services. These notices will provide a list of the specific types of sensitive information impacted for each person, though the full consequences are still being determined.

For more incidents, click here!

Click to See Tools

📢 Cyber News

7. Cybersecurity Adds $36M Value Per Project

Cybersecurity teams contribute a median value of $36 million to each enterprise initiative they support, yet their budgets have halved as a percentage of annual revenue over two years, an Ernst & Young survey revealed. This discrepancy suggests many organizations still don’t view cybersecurity investment as a value creator, with only 13% of CISOs consulted early in strategic decisions and over half struggling to articulate their value beyond risk mitigation. The study found that CISOs deeply involved in business initiatives significantly boost growth by securely implementing AI, enhancing brand trust, improving customer experience, and assessing new market risks early.

8. Funnull Sanctioned In $200M Crypto Scams

The U.S. Treasury Department has sanctioned Funnull Technology Inc., a Philippines-based company, and its Chinese administrator, Liu Lizhi, for providing critical infrastructure that enabled “pig butchering” cryptocurrency scams. These scams, facilitated by Funnull, have reportedly led to over $200 million in losses for American victims, with the company linked to the majority of virtual currency investment scam websites reported to the FBI. Funnull allegedly acquired IP addresses from major cloud providers and sold them to cybercriminals, also offering domain generation and web design templates to create deceptive platforms. The company was also implicated in the Polyfill.io supply chain attack, redirecting legitimate web traffic to scam and gambling sites, some connected to Chinese money laundering operations.

9. Cerby Announced a $40M Series B Funding

Identity security automation startup Cerby announced a $40 million Series B funding round on May 28, 2025, led by DTCP Capital, bringing its total raised to $72.5 million. The company’s platform helps organizations manage and automate access to disconnected applications that traditional security tools cannot reach, covering the full identity lifecycle across various systems. Cerby plans to use the new capital to invest in agentic AI capabilities, make its platform extensible, and scale its go-to-market operations in North America and EMEA. With significant growth in recurring revenue and customers like L’Oréal and Fox, Cerby aims to eliminate the risks associated with manual identity workflows for all applications.

For more news, click here

📈Cyber Stocks

On May 29, 2025, Zscaler fell 1.00%, CrowdStrike Holdings dropped 2.14%, Palo Alto Networks declined 1.05%, Fortinet decreased 2.36%, and SentinelOne plunged 11.57%.

💡 Cyber Tip

Be very cautious when downloading AI tools

Cybercriminals are creating fake websites that pretend to offer popular AI tools like ChatGPT or InVideo AI. Instead, they trick users into downloading ransomware and destructive malware that can encrypt, wipe, or crash your system.

✅ What you should do

Only download AI tools from official websites or trusted sources like OpenAI, Microsoft, or verified app stores.
Avoid clicking on ads for “premium” or “free” AI tools that appear in search results or on social media.
Do not run files from unknown ZIP archives or installers promising free access to AI tools.
Keep your antivirus software and operating system updated to detect and block malicious files.
Report suspicious websites or ads impersonating legitimate AI platforms.

✅ Why this matters

Fake AI installers can silently infect your system with ransomware, steal your information, or make your computer completely unusable. One wrong click can cost you your data and a lot more.