Ankura CTIX FLASH Update - March 18, 2025

Ransomware/Malware Activity

Rising Cyber Threats: A Call to Fortify Your Digital Defenses

Malicious actors are exploiting a fake security alert issue on GitHub to hijack user accounts by leveraging OAuth applications, which are designed to authorize third-party services without the need for passwords. The attack involves sending deceptive messages that mimic legitimate security notifications, tricking users into authorizing a malicious application. Once granted access, these attackers can manipulate users' accounts without their knowledge. Meanwhile, a wave of attacks are targeting Microsoft 365 accounts through sophisticated malware exploits particularly those related to Adobe and DocuSign. Cybercriminals are employing tactics that involve spoofing these popular work applications to create deceptive OAuth apps, tricking users into granting malicious actors access to their accounts. This allows attackers to gain unauthorized control, potentially leading to data