NetSec News Articles of Interest From the Week of July 7, 2025

Read more cybersecurity news in this edition of NetSec News.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Over 40 malicious Firefox extensions target cryptocurrency wallets, stealing user assets

Cybersecurity researchers have uncovered over 40 malicious browser extensions for Mozilla Firefox that are designed to steal cryptocurrency wallet secrets, putting users’ digital assets at risk. (The Hacker News)

“Browser extensions are in-vogue for users and can usually be installed without the same restrictions and or scrutiny that applications face on company devices. This is due to their operation being contained within the browser’s trusted environment, rather than on the endpoint itself. Group Policy may be covering general applications, but companies should consider implementing restrictions on browser choices for company devices and – especially important – deploy centralized browser management with a vetted Allow List. Start by auditing current browser and extension use across the environment to establish a baseline and work with users who will lose unvetted extensions once the refined policies are set in place. Keep in mind, users with local admin rights can potentially bypass these restrictions by disabling/overriding policies, so combine extension controls with least-privilege access policies.” –Jessica Owens, Senior SOC Analyst at C3 Integrated Solutions

Cisco Warns of Hardcoded Credentials in Enterprise Software

Cisco on Wednesday announced patches for a critical vulnerability in its Unified CM and Unified CM SME communication management software that could allow attackers to log in as the root account. The issue, tracked as CVE-2025-20309 (CVSS score of 10/10), exists because the enterprise management tools contain default, static credentials that can not be removed or changed. (SecurityWeek)

Chrome zero-day CVE-2025-6554 under active attack — Google issues security update

Google has released security updates to address a vulnerability in its Chrome browser for which an exploit exists in the wild. The zero-day vulnerability, tracked as CVE-2025-6554 (CVSS score: N/A), has been described as a type confusing flaw in the V8 JavaScript and WebAssembly engine. (The Hacker News)

Atomic macOS infostealer adds backdoor for persistent attacks

Malware analyst discovered a new version of the Atomic macOS info-stealer (also known as ‘AMOS’) that comes with a backdoor, to attackers persistent access to compromised systems. The new component allows executing arbitrary remote commands, it survives reboots, and permits maintaining control over infected hosts indefinitely. (BleepingComputer)

Ingram Micro scrambling to restore systems after ransomware attack

IT distributor giant Ingram Micro has confirmed over the weekend that a ransomware attack was responsible for a widespread outage over its services. One of the largest distributors of IT products and services, Ingram Micro was forced to take certain systems offline on Friday afternoon, in response to the incident. (SecurityWeek)

Alert: Exposed JDWP interfaces lead to crypto mining, Hpingbot targets SSH for DDoS

Threat actors are weaponizing exposed Java Debug Wire Protocol (JDWP) interfaces to obtain code execution capabilities and deploy cryptocurrency miners on compromised hosts. (The Hacker News)