Welcome to my weekly cybersecurity roundup! Here, I share updates on the projects I’m currently working on, along with the most insightful cybersecurity videos I watched, articles I found valuable, and podcasts I tuned into this week.

Featured Analysis

Featured article analysis: New ClickFix Malware Variant ‘LightPerlGirl’ Targets Users in Stealthy Hack

The article highlights the stealthy and evasive nature of this new threat. By using LOLBINS (Living Off the Land Binaries) like PowerShell, the malware is designed to evade detection by conventional antivirus software and even modern endpoint detection and response (EDR) systems, which are not commonly found on personal computers. The PowerShell script runs in memory, leaving little to no trace on the disk. This approach exploits the trust users place in legitimate system tools and known security services like Cloudflare. The use of a travel site for an expensive destination like the Galapagos suggests the attackers are targeting affluent individuals, potentially executives, whose personal devices could serve as a gateway to their corporate networks.

Despite successfully identifying the malware and its payload, researchers at Todyl have several unanswered questions about the operation’s infrastructure and the relationships between the different actors involved. For instance, they are unsure whether the developers of LightPerlGirl are directly affiliated with the creators of the Lumma infostealer or if they are separate entities using a malware-as-a-service model. The discovery of this variant was almost accidental, as it was found on a customer’s corporate device which was protected by Todyl’s security platform. This underscores the difficulty in detecting such stealthy attacks, even for advanced security solutions. The article emphasizes that the true danger of ClickFix variants lies in their potential to compromise a company’s enterprise network through an unsuspecting employee’s personal device.

Projects

• TryHackMe – Hydra – Complete
• TryHackMe – Gobuster: The Basics – Complete
• TryHackMe – Shells Overview – Complete
• TryHackMe – SQLMap: The Basics – In Progress

Videos

Articles

• No, Google did not warn 2.5 billion Gmail users to reset passwords – Google has disputed a widely reported story about the company warning all Gmail users to reset their passwords due to a recent data breach that also affected some Workspace accounts.
• FBI cyber cop: Salt Typhoon pwned ‘nearly every American’ – China’s Salt Typhoon cyberspies hoovered up information belonging to millions of people in the United States over the course of the years-long intrusion into telecommunications networks, according to a top FBI cyber official.
• Disney to pay $10M to settle claims it collected kids’ data on YouTube – Disney will pay $10 million to settle claims by the U.S. Federal Trade Commission that it mislabeled videos for children on YouTube, which allowed the collection of kids’ personal information without their consent or notification to their parents.
• Cloudflare Blocks Record-Breaking 11.5 Tbps DDoS Attack – Cloudflare on Tuesday said it automatically mitigated a record-setting volumetric distributed denial-of-service (DDoS) attack that peaked at 11.5 terabits per second (Tbps).
• Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats – An Iran-nexus group has been linked to a “coordinated” and “multi-wave” spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world.
• Google Fined $379 Million by French Regulator for Cookie Consent Violations – The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules.
• VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages – Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics (SVG) files as part of phishing attacks impersonating the Colombian judicial system.
• New ClickFix Malware Variant ‘LightPerlGirl’ Targets Users in Stealthy Hack – Researchers identify a previously unknown ClickFix variant exploiting PowerShell and clipboard hijacking to deliver the Lumma infostealer via a compromised travel site.
• Jury orders Google to pay $425 million for violating user privacy – The class action lawsuit alleged that Google continued to collect user information even after they turned activity tracking off.