Patch and takedown efforts led the day as WhatsApp closed a zero‑click chain and Amazon disrupted a watering‑hole campaign abusing Microsoft device code flows. At the same time, investigations into OAuth token abuse and package‑registry tampering underscored persistent risks to cloud tenants and developer workstations.
Patches and hardening: zero‑click chain closed, plugin SQLi fixed
Infosecurity reports that WhatsApp addressed CVE-2025-55177, a critical bug in linked‑device synchronization handling that the company believes was used in a targeted campaign, likely in combination with an Apple OS issue (CVE-2025-43300) Apple fixed on August 20. The flaw enabled processing of attacker‑hosted content on victim devices with no user interaction. WhatsApp lists affected iOS and Mac clients and urges immediate updates, audits of linked devices, and targeted forensics where compromise is suspected. Zero‑click chains demand swift response because they can silently grant surveillance‑grade access to messages, camera, microphone and files.
Infosecurity also details CVE-2025-49870, an unauthenticated SQL injection in the WordPress Paid Memberships Subscriptions plugin (10,000+ sites). Versions up to 2.15.1 improperly concatenated a user‑controlled payment ID from PayPal IPN into database queries, enabling arbitrary SQL. Maintainers released v2.15.2 with numeric validation and prepared statements. Admins should patch, review logs and handlers for abuse, and rotate credentials if exposure is suspected. The fix reinforces long‑standing guidance: bind variables and eliminate string‑built queries.
OAuth token abuse ripples via Drift integrations
KrebsOnSecurity chronicles fallout from unauthorized access tied to Salesloft’s Drift chatbot integrations between August 8–18, 2025. According to Google’s Threat Intelligence Group, actors tracked as UNC6395 leveraged stolen tokens—not platform vulnerabilities—to reach numerous Salesforce instances and connected services such as Slack, Google Workspace, Amazon S3, Microsoft Azure and OpenAI, harvesting AWS keys, Snowflake tokens and other secrets for potential pivots. Salesforce temporarily blocked Drift integrations as containment, while responders urged immediate invalidation of tokens associated with Drift connections, broad credential rotation, and monitoring for lateral movement. The incident spotlights the risks of "authorization sprawl" in modern SaaS ecosystems.
BleepingComputer reports that Zscaler detected limited, integration‑scoped access to its Salesforce environment via the same Drift‑related supply‑chain compromise, exposing customer contact and licensing data and some support case content. Zscaler says core products and infrastructure were unaffected; the company revoked Drift connections, rotated API tokens, and hardened support authentication. Google attributed the broader campaign to UNC6395 and noted attempts to collect authentication material from support artifacts. Organizations are advised to revoke Drift‑linked OAuth grants, sweep logs for anomalous access, and tighten governance of third‑party app permissions.
Developer ecosystems targeted through npm supply chain
CSO describes a coordinated npm supply‑chain operation that seeded malicious Nx build‑system packages to harvest developer credentials and sensitive files from enterprise environments. Researchers at Wiz observed exfiltration of GitHub and npm tokens, SSH keys, environment variables and even browser or wallet data, uploaded—often multiply base64‑encoded—to thousands of attacker‑controlled public repositories. The initial vector was a vulnerable GitHub Actions workflow using pull_request_target with unsanitized titles, enabling code injection with elevated permissions. Attackers also coerced installed AI CLI tools using flags such as --dangerously-skip-permissions and --trust-all-tools, leading to hundreds of AI‑assisted exfiltrations. In parallel, JFrog identified eight malicious React‑related packages with 70+ layers of obfuscation and functions to steal Chrome data on Windows.
Scale and persistence risks are notable: Wiz recovered over 1,000 valid GitHub tokens and evidence of compromise across workstations, VSCode extensions and CI/CD pipelines; GitHub later disabled attacker repositories after roughly eight hours, but installed copies may persist. Recommended actions include removing affected Nx versions in favor of patched alternatives, rotating all GitHub, npm, SSH and API credentials, manually inspecting shell profiles and build environments, and deploying automated supply‑chain scanning to block obfuscated packages. Deletions from registries do not disinfect already compromised developer hosts or runners.
Intrusions and operations: watering‑holes, BYOVD and ransomware
Amazon says it disrupted a campaign attributed to APT29 that compromised legitimate sites to selectively redirect about 10% of visitors to pages impersonating Cloudflare and then into a malicious Microsoft device code authorization flow. The goal was to trick users into approving attacker‑controlled devices for persistent access to Microsoft 365 resources. Amazon isolated EC2 instances used in the operation and partnered with Cloudflare and Microsoft to take down identified domains, while noting the actor’s quick infrastructure pivots. Recommended mitigations include tightening conditional access, reviewing device approvals, and disabling unnecessary device code flows.
Infosecurity covers Check Point Research’s findings on Silver Fox using Bring Your Own Vulnerable Driver (BYOVD) techniques to deploy the ValleyRAT backdoor. Attackers abused legitimate but vulnerable Windows drivers—including a Microsoft‑signed WatchDog component and a Zemana‑based driver—to terminate AV and EDR processes, even protected ones, clearing the path for persistence and exfiltration. Loader binaries bundled drivers, anti‑analysis features, persistence, a list of security processes to kill, and a ValleyRAT downloader. Adversaries tweaked driver timestamps—outside the signed region—to evade hash‑based detection while retaining valid signatures. CPR recommends enforcing Microsoft’s driver blocklist, deploying YARA rules, and using behavior‑based monitoring to flag abnormal driver activity.
The Hacker News details Operation HanKook Phantom, where ScarCruft (APT37) targeted South Korean academics and researchers with spear‑phishing ZIPs carrying LNK shortcuts that dropped the RokRAT backdoor. RokRAT can run commands, enumerate files, capture screenshots, and fetch payloads, exfiltrating via cloud services like Dropbox, Google Cloud, pCloud and Yandex Cloud. Variants used obfuscated PowerShell and decoys to conceal execution. The campaign aligns with a focus on intelligence collection against government, research and academic sectors.
Infosecurity reports that Pennsylvania’s Office of Attorney General experienced a ransomware incident that took servers, email, the website and landlines offline earlier in August, prompting some court extensions. The office confirmed file encryption and said no ransom was paid. An active investigation limits disclosures; data‑theft status remains unconfirmed. Email access has been restored for most staff and main lines are back online, but recovery and integrity verification continue. The episode highlights continued pressure on public‑sector resilience.