☕️ Hackers spent year quietly stealing corporate data

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

📌 Hackers spent a year quietly stealing corporate Salesforce data

🍎 New Mac malware poses as Apple crash tool to steal passwords

🔓 Hackers spoof Microsoft logins to test millions of passwords

📦 Hijacked npm packages spread botnet malware to developers

🇷🇺 Russian hackers breach thousands of French accounts via SharePoint flaw

Plus: 💡 4 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.

📌 Hackers spent a year quietly stealing corporate Salesforce data LINK

A year-long series of campaigns tied to the ShinyHunters group quietly stole corporate CRM data by abusing trusted Salesforce OAuth relationships to bypass MFA, with Microsoft observing the activity from mid-2025 through mid-2026 against retail, education, and manufacturing firms.

The attacks exploited no Salesforce software flaw; instead, operators used voice phishing to impersonate IT support and trick employees into approving an attacker-controlled connected app posing as the legitimate Salesforce Data Loader, which then inherited the user's permissions to make API calls without re-authenticating.

Because activity ran through valid OAuth sessions, attackers could enumerate environments, query and bulk-export CRM data, and find credentials to reach other SaaS services while evading login-based detection; Microsoft advises inventorying connected apps, validating OAuth scopes, revoking unused integrations, and tightening Experience Cloud guest permissions.

🍎 New Mac malware poses as Apple crash tool to steal passwords LINK

A new macOS information-stealing malware called CrashStealer disguises itself as Apple's crash-reporting tool, CrashReporter.app, to steal passwords, keychain data, browser logins, and crypto wallets from more than 80 wallet extensions.

Researchers at Jamf observed the malware being used in attacks in early July, delivered through a signed and Apple-notarized installer named "Werkbit Setup" that bypasses Gatekeeper without warnings and shows a fake password prompt to unlock the user's Keychain.

CrashStealer encrypts stolen data with AES-256-GCM before uploading it to a command-and-control server, and Jamf's report shares indicators of compromise including tool names, hashes, delivery infrastructure, and filesystem artifacts.

🔓 Hackers spoof Microsoft logins to test millions of passwords LINK

Attackers are spoofing Microsoft OAuth client IDs to secretly test millions of usernames and passwords against enterprise cloud accounts, letting them confirm valid logins while dodging the sign-in logs defenders normally rely on to spot such activity.

Proofpoint says the technique, tracked in multiple large-scale campaigns hitting millions of accounts across thousands of Microsoft Entra ID tenants, sends POST requests to Microsoft's OAuth 2.0 token endpoint using the Resource Owner Password Credentials flow to submit usernames and passwords directly.

The returned AADSTS error codes let unauthenticated attackers infer whether usernames, passwords, and MFA or conditional access are valid; defenders should treat sign-in entries with blank application IDs, or an AADSTS700016 code, as possible signs of compromised credentials.

📦 Hijacked npm packages spread botnet malware to developers LINK

Attackers hijacked three npm packages in the @asyncapi namespace to spread a multi-stage botnet loader to developers, targeting people who import the packages during normal development or CI workflows.

The compromised versions (@asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator 3.3.1) hide a first-stage dropper in a utility file that runs on import and pulls an encrypted second stage, Miasma, from IPFS.

The decrypted Miasma payload persists as sync.js and acts as a botnet with shell command execution, file operations, credential theft, and command-and-control, so users should rotate npm, GitHub, cloud, SSH, and CI secrets and watch for connections to 85.137.53.71.

🇷🇺 Russian hackers breach thousands of French accounts via SharePoint flaw LINK

French cyber investigators at C4 and CERT-FR linked the Turla espionage group to Russia's Federal Security Service, detailing intrusions against French ministries, diplomatic bodies, defense, justice-sector entities, and technology companies dating back to the 2010s.

In 2019, Turla operators exploited a Microsoft SharePoint vulnerability on a French justice-sector server hosting a staff training service, installing malware that may have exposed information tied to several thousand user accounts.

The group turned ordinary businesses, associations, and individuals into hidden relays to mask attacks, used malware like Uroburos and Kazuar plus Mimikatz and Metasploit, and blended into traffic through compromised servers and satellite communications.

💡 Strategies & Tactics

> Now, defenders are embracing the prompt injection, too: Defenders can plant fake secrets containing forbidden prompts that trigger an attacking AI's own safety refusals, shutting down automated hacking attempts.

> RabbitMQ flaws expose OAuth secrets, risk complete takeover of the broker: RabbitMQ patched two flaws that leaked OAuth login secrets to unauthenticated attackers, potentially handing them full control of the message broker.

> SAP July 2026 Patch Day Fixes Critical NetWeaver, Approuter, and Commerce Cloud Vulnerabilities: SAP's July patch fixes critical remotely exploitable flaws in NetWeaver, Approuter, and Commerce Cloud, so administrators should apply updates and remove sample credentials immediately.

> Google Cloud Dialogflow CX vulnerability allowed AI agent hijacking: A now-patched flaw in Google's chatbot-building platform let low-privilege attackers inject code to hijack AI agents, steal credentials, and read chat logs undetected.

Other news you might like

• RedHook Android malware now uses Wireless ADB for shell accessLINK

• 'The bots are alive!' Jailbroken Gemini spun up new C2 server for Russian fraudster in just 6 minutesLINK

• CISA Adds Cisco IOS CSRF Flaw Enabling Arbitrary Command Execution to KEV CatalogLINK

• LastPass warns users of active campaign targeting master passwordsLINK

• ModHeader Chrome Extension Exposes 900,000 Users to Potential Browsing History TheftLINK

• Forg365 industrializes Microsoft 365 phishing with AI-generated luresLINK

• Pro-Iran Hacktivist Groups Launch DDoS and Hack-and-Leak Attacks Against Critical InfrastructureLINK

🧰 Trending tools

Spotlight by Backplanes: a session reporting tool that reviews Claude Code and Codex workflows, surfacing patterns to help developers improve their AI-assisted coding habits.LINK

Perfai Security: detects and fixes live security vulnerabilities in Vibe Apps using a singleLINK

Playground: a competitive platform where developers earn weekly cash rewards by finding and exploLINK

Clawk: gives coding agents a disposable Linux VM to run in, instead of executing commands directly on your laptop.LINK

Astra Autonomous Pentest: ai agents that automatically find, validate, and remediate vulnerabilities across your web apps without manual intervention.LINK

OpenBox: a runtime governance SDK that enforces cryptographic verification and compliance policies for agentic AI workflows without rewriting existing code.LINK

📚 Trending papers & reports

Vibe coding documentation gets a fix from a new tool that automatically pulls clear written specs from AI chat sessions, scoring 5.74 out of 6.0, so humans can review intent instead of raw code.LINK

AI-written code, once merged into real projects, needs significantly more bug fixes and security patches than human-written code, according to a study of 182 repositories tracking what happens after merging.LINK

Security bug detectors flooded with false alarms get a fix, as language models using double-checking techniques reached at least 98% recall and 94.8% accuracy separating real bugs from noise.LINK

Software tools connecting AI to outside services now have a first large-scale map, with 2,297 real-world projects catalogued from GitHub, revealing Python and TypeScript as the dominant building blocks.LINK

Packaging ML projects into containers is surprisingly wasteful, with 71% of rebuild work redundant, but researchers identified 7 reusable fixes that cut build times and bloated average container sizes of 10.27 GB.LINK

Want to get the latest news differently? Find us on:

See you tomorrow for a new dose of ☕️ Cyberpresso!