NetSec News Articles of Interest From the Week of March 3, 2025
Read more cybersecurity news in this edition of NetSec News.
Astaroth Phishing Kit Bypasses 2FA Using Reverse Proxy Techniques
A sophisticated new phishing tool dubbed “Astaroth” has emerged on cybercrime platforms, boasting advanced methods to bypass two-factor authentication (2FA). First advertised in January 2025, the kit employs session hijacking and real-time credential interception to compromise accounts on Gmail, Yahoo, Office 365 and other platforms. (Infosecurity)
 |
|
“Man-in-the-middle, demon chaos gods, and cookie stealing are never a good combination, but that is precisely what we see with the “Astaroth” phishing tool. This phishing kit bypasses 2FA tokens using reverse proxies with just the click of a link. Unlike traditional phishing kits that can capture login credentials, Astaroth is not stopped by 2FA protection. It dynamically intercepts and forwards tokens by hijacking cookie sessions. The real challenge is that threat actors can purchase these kits for the low, low price of $2000 while wreaking chaos in a company’s environment. So how does one protect themselves from such havoc? Well, first, don’t click on the link in the email. Second and more important than the first, train your staff to be vigilant. If there is an urgency, it might be a phishing email. If the email contains spelling and grammar errors, it might be a phishing email. If the greeting is unfamiliar, it might be a phishing email. If there are inconsistencies in the sender addresses, it might be a phishing email. And, if the email asks for money, login information, or credentials, say it with me; IT MIGHT BE A PHISHING EMAIL. Don’t be a victim, stay safe out there.” –Candace Respress, Senior SOC Analyst at C3 Integrated Solutions |
What Microsoft’s Majorana 1 Chip Means for Quantum Decryption
The question is whether Majorana 1 advances progress toward quantum computing – or for security professionals, the arrival of computers powerful enough to break PKE. (SecurityWeek)
Bybit’s $1.5B Hack Linked to North Korea’s Lazarus Group
Investigation revealed that BingX, & Phemex hacks were also connected to the same cluster as Bybit’s, confirming the threat actor’s identity as the Lazarus group. (CSO)
12,000+ API Keys and Passwords Found in Public Datasets Used for LLM Training
A dataset used to train large language models (LLMs) has been found to contain nearly 12,000 live secrets, which allow for successful authentication. (The Hacker News)
VSCode Extensions With 9 Million Installs Pulled Over Security Risks
Microsoft has removed two popular VSCode extensions, ‘Material Theme – Free’ and ‘Material Theme Icons – Free,’ from the Visual Studio Marketplace for allegedly containing malicious code. (BleepingComputer)
Cisco Confirms Salt Typhoon Exploitation in Telecom Hits
In addition to using CVE-2018-0171 and other Cisco bugs to break into telecom networks, the China-sponsored APT is also using stolen login credentials for initial access. (Dark Reading)
Critical Microsoft Partner Center Vulnerability Under Attack, CISA Warns
Unpatched flaw CVE-2024-49035 allows unauthenticated privilege escalation, posing supply chain risks. A critical vulnerability in Microsoft’s Partner Center platform is under attack, enabling unauthenticated attackers to escalate privileges, potentially leading to data breaches, malware deployment, and lateral movement across enterprise networks. (CSO)
New FinalDraft Malware Abuses Outlook Mail Service for Stealthy Comms
A new malware called FinalDraft has been using Outlook email drafts for command-and-control communication in attacks against a ministry in a South American country. (BleepingComputer)
Meet the Author
