Welcome to my weekly cybersecurity roundup! Here, I share updates on the projects I’m currently working on, along with the most insightful cybersecurity videos I watched, articles I found valuable, and podcasts I tuned into this week.

Featured Analysis

Featured article analysis: Verizon: Mobile Blindspot Leads to Needless Data Breaches

The analysis of Verizon’s 2025 Mobile Security Index (MSI) reveals a critical and dangerous blind spot in enterprise risk management: as employees increasingly rely on personal devices for work, organizations are failing to apply commensurate security controls to the mobile frontier. This gap is rooted in a fundamental, dangerous misconception of security at both the individual and organizational level. Employees exhibit deep overconfidence, engaging in risky practices; like storing passwords in their Notes app or using their phone as the default device for “risky clicks” because they “believe nothing can happen there.” Threat actors have effectively capitalized on this low awareness by pivoting to smishing (SMS phishing), which the data shows is overwhelmingly more effective than email phishing. The 80% reported smishing attempt rate against organizations and the alarmingly high employee failure rates in simulations (with up to half of employees failing in many companies) underscore that mobile devices are now the path of least resistance for initial access breaches.

This issue is amplified by an organizational failure to evolve security policies to match the reality of hybrid work. Companies have invested heavily in desktop and server security, yet the MSI highlights a significant parity gap on the mobile side, slowing detection and response times. This gap is structural, as most organizations do not issue work phones to all employees, meaning the majority of mobile attacks (70%) land on unmanaged personal devices. Simply put, companies are falling into the same trap as their employees, ignoring a known, high-impact vulnerability. For business leaders and security professionals, the Verizon MSI presents a clear strategic mandate for immediate action. The traditional security perimeter is gone, and organizations must shift their focus from preventing device use to managing the risk associated with it. This necessitates a combined approach of robust policy implementation and mandatory, high-frequency employee education. The data provides a powerful incentive: organizations utilizing a comprehensive set of eight mobile security best practices—including Mobile Device Management (MDM) and a zero-trust architecture—are five times less likely to experience major repercussions from a breach. The cost of inaction, leading to longer detection times and system downtime, far outweighs the investment required to bring mobile security up to parity with traditional IT controls, making

Projects

• TryHackMe – Vulnerability Scanner Overview – Complete
• TryHackMe – CyberChef: The Basics – In Progress

Videos

Articles

• Massive SIM farm network powering 49 million fake accounts taken apart by Europol – Law enforcement agencies from Austria, Estonia, Finland, and Latvia, together with Europol, have seized thousands of SIM-box devices and SIM cards used in multiple scam campaigns.
• 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign – Cybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale.
• Foreign hackers breached a US nuclear weapons plant via SharePoint flaws – A foreign actor infiltrated the National Nuclear Security Administration’s Kansas City National Security Campus through vulnerabilities in Microsoft’s SharePoint browser-based app, raising questions about the need to solidify further federal IT/OT security protections.
• Russian hackers evolve malware pushed in “I am not a robot” captchas – The Russian state-backed Star Blizzard hacker group has ramped up operations with new, constantly evolving malware families (NoRobot, MaybeRobot) deployed in complex delivery chains that start with ClickFix social engineering attacks.
• Muji’s minimalist calm shattered as ransomware takes down logistics partner – Japanese retailer halts online orders after attack cripples third-party vendor
• Hundreds of masked ICE agents doxxed by hackers, as personal details posted on Telegram – Hundreds of US government officials working for the FBI, ICE, and Department of Justice have had their personal data leaked by a notorious hacking group.
• Major AWS outage took down Fortnite, Alexa, Snapchat, and more – Amazon says the cause of the AWS outage was related to DNS.
• LA Metro digital signs taken over by hackers – the digital reader boards at a bus stop at 6th Street and Vermont Avenue displaying a message that read “EMERGENCY WARNING. LEAVE IMMEDIATELY. RISK OF SUICIDE BOMB.”
• SoCal man agrees to plead guilty to acting as Beijing’s agent – A California man has agreed to plead guilty to acting as an illegal agent for the Chinese government in Southern California while working as a campaign advisor for a local politician.
• Verizon: Mobile Blindspot Leads to Needless Data Breaches – People habitually ignore cybersecurity on their phones. Instead of compensating for that, organizations are falling into the very same trap, even though available security options could cut smishing success and breaches in half.