Weekly Roundup: Trump Mobile Data Exposure, FIFA Phishing and Supply-Chain Attacks
Summary
A weekly roundup covers reported data exposures at Trump Mobile and UK Visa Portal, phishing targeting LinkedIn and FIFA, a VS Code Remote-SSH vulnerability warning, software patches, and recent supply-chain attacks.
Key points
- Trump Mobile confirmed customer data—including names, contact details and other information—was exposed online; the company reportedly attributed the exposure to a third-party platform provider.
- Documents in a FOIA lawsuit reportedly show the Russian state-sponsored APT behind the SolarWinds attack accessed Treasury emails, focusing on eight accounts linked to about 300 email addresses.
- A researcher warned that an attacker with access to a system could modify the VS Code Remote-SSH extension’s bootstrap script and use it to deploy a reverse shell on a remote server.
- UK Visa Portal exposed more than 100,000 visa applicants’ documents in an AWS S3 bucket, according to TechCrunch; the files were secured earlier in the week.
- A LinkedIn-themed phishing campaign uses fake contract attachments and Adobe Target to track users and serve credential-stealing login pages.
- Group-IB reported more than 4,300 fraudulent FIFA-impersonating domains and over 300 domains attributed to the Chinese-speaking group Ghost Stadium.
- Veeam, Notepad++ and Roundcube issued security updates; CISA expanded its KEV catalog and warned organizations about recent supply-chain attacks involving Daemon Tools Lite, TanStack and Nx Console.
- Sonatype warned that 176 malicious npm packages use postinstall scripts to steal credentials, system information and secrets; the packages reportedly share version number 99.99.99.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering data exposure, phishing, software vulnerabilities, supply-chain attacks, and cybercrime sentencing.
- Impact
- Trump Mobile confirmed that customer names, addresses, email addresses, phone numbers, and other data were exposed online; it reportedly attributed the exposure to a third-party platform provider. A UK visa portal exposed more than 100,000 applicant documents, which were secured earlier in the week. Phishing campaigns impersonated LinkedIn and FIFA, with the FIFA campaign involving more than 300 domains attributed to Ghost Stadium; the article says the campaign could cause hundreds of millions of dollars in losses. A separate attack involved 176 malicious NPM packages designed to steal credentials and other sensitive information. Maxwell Schultz’s network intrusion caused more than $862,000 in losses. The article also reports security patches, CISA alerts, and remediation actions related to vulnerabilities and supply-chain attacks.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing campaign served fake login pages to capture victims’ credentials.T1078 · Valid AccountsMaxwell Schultz reportedly used credentials obtained while impersonating a contractor to access his former employer’s systems.T1195.002 · Compromise Software Supply ChainThe article describes malicious NPM packages and other software supply-chain attacks.T1566.001 · Spearphishing AttachmentPhishing emails used fake contract attachments presented as PDFs but delivered as HTML files.
People
Threat Actors
GHOST STADIUMGroup-IB identified Ghost Stadium as the Chinese-speaking hacking group behind a phishing campaign involving more than 300 domains impersonating FIFA.Maxwell SchultzSchultz pleaded guilty to hacking his former employer after his contract ended. The article says he impersonated another contractor, obtained login credentials, accessed the employer’s systems, and reset approximately 2,500 passwords; he was sentenced to 24 months in federal prison.
Vendors
Products
Adobe TargetLinkedIn phishing campaign abuses Adobe TargetDAEMON Tools LiteThese include Daemon Tools Lite, TanStack, and Nx Console (which led to the 3.800 internal GitHub repositories hack).Notepad++Veeam, Notepad++, Roundcube patchesnpmNPM invalidated granular access tokens in response to these attacks.Nx ConsoleThese include Daemon Tools Lite, TanStack, and Nx Console (which led to the 3.800 internal GitHub repositories hack).Roundcube WebmailVeeam, Notepad++, Roundcube patchesTanStackThese include Daemon Tools Lite, TanStack, and Nx Console (which led to the 3.800 internal GitHub repositories hack).