SAP’s Security Patch Day on September 9, 2025, introduced fixes for 21 newly discovered vulnerabilities across its product portfolio and provided updates to four previously released security notes. With four issues rated as Critical, organizations running SAP environments are urged to prioritize patching to safeguard their systems from potential exploits. This month’s release spans a variety […]
Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT.
The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon sensitive data, and extend its functionality by serving secondary plugins, Fortinet FortiGuard Labs said.
“
An emerging threat campaign has been identified that weaponizes a trojanized version of DeskSoft’s EarthTime application to deploy sophisticated malware, leveraging Remote Desktop Protocol (RDP) access for command execution and network reconnaissance. Security analysts attribute the intrusion to an affiliate operating across multiple ransomware-as-a-service groups and noted that the incident underscores the growing trend of […]
A novel AI-driven email attack toolkit named SpamGPT has surfaced on underground hacking forums, promising cybercriminals an all-in-one platform for launching large-scale phishing campaigns. Advertised as an “AI-powered spam-as-a-service” solution, SpamGPT automates compromise of email servers, bypasses major spam filters, and offers marketing-style campaign analytics. Security researchers warn that its user-friendly interface and AI-assisted content generation significantly […]
Cybersecurity researchers have discovered a variant of a recently disclosed campaign that abuses the TOR network for cryptojacking attacks targeting exposed Docker APIs.
Akamai, which discovered the latest activity last month, said it’s designed to block other actors from accessing the Docker API from the internet.
The findings build on a prior report from Trend Micro in late June 2025, which
⚠️ One click is all it takes.
An engineer spins up an “experimental” AI Agent to test a workflow. A business unit connects to automate reporting. A cloud platform quietly enables a new agent behind the scenes.
Individually, they look harmless. But together, they form an invisible swarm of Shadow AI Agents—operating outside security’s line of sight, tied to identities you don’t even know exist.
Elastic has disclosed a security incident stemming from a third-party breach at Salesloft Drift, which resulted in unauthorized access to an internal email account containing valid credentials.
While the company’s core Salesforce environment was not impacted, the incident exposed sensitive information contained within a limited number of emails.
The chain of events began on August 26, 2025, when Salesloft Drift publicly disclosed a security incident affecting its platform.
A subsequent in-depth report from Google’s Threat Intelligence Group detailed the threat actor’s activities related to the breach.
As a customer using Drift for certain business applications, Elastic initiated its incident response protocols to investigate any potential impact proactively.
Although Elastic was not directly notified of being affected, its security team launched an immediate investigation to determine if any company or customer data was exposed.
Scope Of The Impact
Elastic’s investigation confirmed that its Salesforce environment was not compromised. However, the team discovered that a single email account had been exposed through the “Drift Email” integration.
This exposure may have granted an unauthorized actor read-only access to emails received in that specific inbox.
After conducting a scan of the inbox’s contents, security personnel identified a small number of inbound emails that included potentially valid credentials.
In response to this discovery, Elastic notified the customers who were potentially affected through existing support channels.
The company has stated that any customer who did not receive a direct notification was not identified as being impacted by this credential leak.
Immediately after learning of the Drift incident, Elastic’s Information Security team took decisive action to contain the threat and assess the damage.
The team launched a comprehensive investigation, reviewing access logs, network activity, and system configurations to determine the extent of the data exposure.
A critical first step was to disable all Drift integrations within Elastic’s environment, thereby eliminating any further risk from the compromised third-party platform.
Concurrently, the team monitored open-source intelligence for Indicators of Compromise (IOCs) and coordinated with Drift’s security team to gather additional information.
Elastic has affirmed its commitment to transparency and protecting customer data, and its team continues to monitor for new information related to the event.
Confirmed victims of this supply chain attack include:
Palo Alto Networks: The cybersecurity firm confirmed the exposure of business contact information and internal sales data from its CRM platform.
Zscaler: The cloud security company reported that customer information, including names, contact details, and some support case content, was accessed.
Google: In addition to being an investigator, Google confirmed a “very small number” of its Workspace accounts were accessed through the compromised tokens.
Cloudflare: Cloudflare has confirmed a data breach where a sophisticated threat actor accessed and stole customer data from the company’s Salesforce instance.
PagerDuty has confirmed a security incident that resulted in unauthorized access to some of its data stored in Salesforce.
Tenable has confirmed a data breach that exposed the contact details and support case information of some of its customers.
Qualys has confirmed it was impacted by a widespread supply chain attack that targeted the Salesloft Drift marketing platform, resulting in unauthorized access to a portion of its Salesforce data.
Dynatrace has confirmed it was impacted by a third-party data breach originating from the Salesloft Drift application, resulting in unauthorized access to customer business contact information stored in its Salesforce CRM.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The Akamai Hunt Team has uncovered a new strain of malware that targets exposed Docker APIs with expanded infection capabilities. First observed in August 2025 within Akamai’s honeypot infrastructure, this variant diverges from the June 2025 Trend Micro report by blocking other attackers from accessing the Docker API and delivering a modular payload rather than […]
A sophisticated new cybercrime toolkit named SpamGPT is enabling hackers to launch massive and highly effective phishing campaigns by combining artificial intelligence with the capabilities of professional email marketing platforms.
Marketed on the dark web as a “spam-as-a-service” platform, SpamGPT automates nearly every aspect of fraudulent email operations, significantly lowering the technical barrier for criminals.
The platform’s interface mimics a legitimate marketing service, offering a suite of tools designed for illegal activities.
It features an AI-powered, encrypted framework, along with an AI marketing assistant that helps attackers create and optimize their malicious campaigns.
The creators promote it as an all-in-one solution that blurs the line between commercial marketing software and weaponized automation.
SpamGPT – AI-powered Email Attack Tool
SpamGPT’s dark-themed user interface provides a comprehensive dashboard for managing criminal campaigns.
It includes modules for setting up SMTP/IMAP servers, testing email deliverability, and analyzing campaign results, features typically found in Fortune 500 marketing tools but repurposed for cybercrime.
The platform gives attackers real-time, agentless monitoring dashboards that provide immediate feedback on email delivery and engagement.
SpamGPT Interface
At the core of the platform is an AI assistant, branded “KaliGPT,” which is integrated directly into the dashboard.
This tool can generate persuasive phishing email content, craft convincing subject lines, and even offer advice on targeting specific audiences.
Attackers no longer need strong writing skills; they can simply prompt the AI to create scam templates for them.
The toolkit’s emphasis on scale is equally concerning, as it promises guaranteed inbox delivery to popular providers like Gmail, Outlook, and Microsoft 365 by abusing trusted cloud services such as Amazon AWS and SendGrid to mask its malicious traffic.
One of SpamGPT’s key selling points is its advanced feature set for evading detection and automating infrastructure management.
For a price of $5,000, the toolkit includes a training program on “SMTP cracking mastery,” which teaches users how to compromise or create an unlimited supply of high-quality SMTP servers for sending spam.
This empowers even low-skilled actors to access the infrastructure needed for large-scale attacks.
SpamGPT notes
The platform facilitates advanced spoofing techniques, allowing attackers to customize email headers and impersonate trusted brands or domains.
By using valid SMTP credentials and forged sender details, these emails can bypass basic authentication checks like SPF and DKIM, especially if the target organization has not enforced a strict DMARC policy.
SpamGPT further streamlines operations with a built-in utility for bulk-checking SMTP and IMAP accounts, ensuring credentials are valid before a campaign begins.
It also automates inbox placement tests by sending emails to designated accounts and checking whether they land in the inbox or spam folder, allowing attackers to fine-tune their content for maximum effectiveness.
By packaging a powerful suite of features behind a user-friendly graphical interface, SpamGPT dramatically lowers the entry barrier for conducting sophisticated phishing campaigns.
What once required significant technical expertise can now be executed by a single operator with a ready-made toolkit.
The rise of such AI-driven platforms signals a new evolution in cybercrime, where automation and intelligent content generation make attacks more scalable, convincing, and difficult to detect.
To counter this emerging threat, organizations must harden their email defenses. Enforcing strong email authentication protocols such as DMARC, SPF, and DKIM is a critical first step to make domain spoofing more difficult.
Furthermore, enterprises should deploy AI-powered email security solutions capable of detecting the subtle linguistic patterns and technical signatures of AI-generated phishing content.
As attackers leverage AI, defenders must do the same, combining advanced technology with threat intelligence to stay ahead of the curve.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
It’s budget season. Once again, security is being questioned, scrutinized, or deprioritized.
If you’re a CISO or security leader, you’ve likely found yourself explaining why your program matters, why a given tool or headcount is essential, and how the next breach is one blind spot away. But these arguments often fall short unless they’re framed in a way the board can understand and appreciate.
.webp)
