NetSec News Articles of Interest From the Week of May 26, 2025

Read more cybersecurity news in this edition of NetSec News.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Massive Data Breach Exposes 184 Million Passwords for Google, Microsoft, Facebook, and More

Yet another data breach has exposed passwords and other sensitive information – but this one is a whopper. A cybersecurity researcher revealed their discovery of a massive online database containing more than 184 million unique account credentials, in a report published Thursday. Usernames, passwords, emails, and URLs for a host of applications and websites, including Google, Microsoft, Apple, Facebook, Instagram, and Snapchat, among others, were stored in a file. The database also contained credentials for bank and financial accounts, health platforms, and government portals. (ZDNET)

“This is a slap-in-the-face reminder that your credentials are only as strong as your weakest habit. Downloading “free” apps (including browser extensions or games) from third-party sources that also operate as infostealers, falling for fake credential harvesting sites, reusing passwords, even using the same email for all accounts…cyber hygiene becomes trickier every week. How can end users and organizations protect themselves? There are simple fixes: use a reputable local password manager and ensure passwords / passphrases are maxed out on strength, enable MFA across all domains and applications, for all our sakes stop reusing the same password or derivations of the same password, and keep a vigilant eye out for phishing scams – threat actors are getting much better!” –Andrew Tucker, T3 SOC Analyst at C3 Integrated Solutions

DBatLoader Delivers Remcos via .pif Files and UAC Bypass in New Phishing Campaign

A new phishing campaign is spreading the Remcos Remote Access Trojan (RAT) through DBatLoader. It employs User Account Control (UAC) bypass, obfuscated scripts, Living Off the Land Binaries (LOLBAS) abuse, and persistence mechanisms. (ANY.RUN)

Google Chrome Zero-Day Vulnerability (CVE-2025-4664) Actively Exploited in The Wild

This article details the CVE-2025-4664 vulnerability in Google Chrome, which involves insufficient policy enforcement in the browser’s Loader component, allowing attackers to leak cross-origin data via crafted HTML pages. It notes that Google has released an update (version 136.0.7103.113/.114 for Windows and Mac, 136.0.7103.113 for Linux) to address the flaw, which is actively exploited in the wild. The vulnerability was first reported by a security researcher on May 5, 2025. The article emphasizes the urgency for users to update their browsers to mitigate risks of unauthorized code execution or data leaks. (GBHackers)

Justice Department Seizes Domains Behind Major Information-Stealing Malware Operation

Coordinated Microsoft Actions and Court-Authorized Domain Seizures Disrupt LummaC2 Malware Infrastructure Used to Target Millions Worldwide. The Justice Department announced last week the unsealing of two warrants authorizing the seizure of five internet domains used by malicious cyber actors to operate the LummaC2 information-stealing malware service. (U.S. Department of Justice)