Simply Cyber Newsletter #179

Start your work week off at full speed with expert analysis and actionable intel from top cybersecurity news stories. Share with your End Users, Peers, and Executives to support weekly security awareness with the Simply Cyber Newsletter.

Special thanks to Chimeria Gonzalez for her contributions to this week’s newsletter!

FOR END USERS

UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware. Threat actors are impersonating IT help desk staff through Microsoft Teams after flooding inboxes with spam. Victims are tricked into clicking links or installing tools, giving attackers access to systems, credentials, and sensitive data through seemingly legitimate support interactions.

What you need to know: Here's a scenario worth walking your users through this week. Attackers are running a two-step play that turns confusion into access.

It starts with a flood of spam emails designed to overwhelm an inbox and create a sense that something is broken. Minutes later, a Microsoft Teams message arrives from an external account claiming to be IT support, offering to clean up the mess. The "fix" follows a predictable script: click a link, install a quick repair utility, accept a remote support session, or enter mailbox credentials to verify the account. Once any of that happens, the attacker is inside.

Remind your users that legitimate IT will never reach out from an external Teams account or ask them to install software, run a repair tool, or share credentials to resolve a spam issue. If a message claims to be from support, the right move is to stop, verify through the official help desk channel, and report it.

Urgency is what makes this work. Teach your users that pausing is not hesitation, it's the first step in defense.

FOR PEERS

Another npm supply chain worm is tearing through dev environments. A self-propagating npm supply chain attack tied to Namastex Labs is compromising developer environments, stealing credentials, and spreading across packages. The malware targets tokens, cloud and CI/CD secrets, and can republish infected packages, with strong similarities to earlier TeamPCP-linked campaigns.

What you need to know: This recent Node Package Manager (npm) supply chain attack involving agentic AI company Namastex Labs is a stark reminder that our secrets are only as secure as their weakest point of exposure. In this case, malicious packages execute during installation, quietly stealing developer credentials such as tokens and environment variables, then using that access to spread across projects and pipelines. Unlike traditional attacks that exploit system vulnerabilities, this one behaves in a worm-like manner, abusing trusted developer workflows and ecosystems to propagate itself. Basically turning “npm install” into an uninvited plus-one.

What makes this attack particularly relevant is how quietly it operates within normal development workflows. No alarms. No obvious “hack.” No dramatic hoodie-wearing figure in the background. Just a routine package install that behaves as expected, while silently collecting whatever credentials are available. That subtlety is the real risk.

It also shifts the question we should be asking from “Are we using a password manager?” to “What could an attacker access if malicious code ran on our machine right now while we’re just trying to get our app to compile?” That shift is where security awareness programs can make a meaningful impact.

Even trusted tools like the Bitwarden CLI distributed through npm are now being pulled into supply chain attacks targeting developer secrets.

Tools like Bitwarden do a fantastic job of locking credentials away at rest. But the real challenge starts after we retrieve them. Once secrets are pulled from the vault, they’re essentially out in the wild, stretching their legs a little too comfortably. While Bitwarden provides an essential foundation for credential security, the real work is limiting how long those credentials remain exposed, reducing where they can be accessed, and proactively rotating them so that the next attack hits a much shorter fuse.

That looks like not leaving secrets sitting in .env files longer than necessary because they’re not long-term storage, more like a sticky note on your monitor. Also leaning toward ephemeral credentials that expire quickly, scoping tokens so they can only do one thing instead of everything everywhere all at once, and treating any suspicious execution as a signal to rotate immediately rather than waiting around for confirmation that may never come.

These aren’t complex controls, but they directly counter the exact behavior these attacks rely on. At the end of the day, we have to manage secrets responsibly. But this story is a good reminder that security isn’t just about where secrets are stored, it’s about their entire lifecycle. Because in modern supply chain attacks, the goal isn’t to break into the vault… it’s to be waiting patiently for the exact moment you open it.

FOR EXECUTIVES

Ghost breaches: How AI-mediated narratives have become a new threat vector. AI-generated “ghost breaches” are creating a new business risk where false or outdated breach claims can trigger real crisis response. These narratives can affect customer trust, regulators, vendors, markets, and attackers, even when no systems were compromised and no data was stolen.

What you need to know: Picture this: Your company wakes up to a news story claiming it has suffered a major breach. The details are specific. The technical language sounds right. A reporter has already requested comment. The only problem is that none of it happened. An AI model generated the entire story, and now your team is mobilizing a crisis response for a fictional event.

This is the new reality executives need to plan for. AI systems can now fabricate convincing breach narratives complete with technical detail and named sources, and those narratives spread fast enough to trigger real consequences before anyone confirms what is true. Customers panic. Vendors pause access. Regulators ask questions. Employees act on misinformation. The breach is fiction, but the business impact is not.

The exposure here is not only technical. It is reputational, operational, and governance-level. The organizations that handle this well will be the ones that decided in advance who validates the facts, who approves messaging, and how quickly a clear response can reach the public. Traditional incident response focuses on systems and data. Ghost breaches require narrative response, and that means security, legal, communications, vendor management, and executive leadership operating from the same playbook before a claim ever surfaces.

Find the Vulnerabilities That Matter. Fix Them Fast.

Your scanner found another 1,000+ vulnerabilities. Most aren't risky to your org. The few that matter get buried and never fixed.

That's what Maze's AI agents were built to solve. You get:

• Triage that kills the noise. Agents investigate if every finding is exploitable in your specific context. Over 90% of the backlog goes away.

• Fixes your developers actually trust. Rebuild the image, bump a direct dependency, overwrite a transitive. The agents have the context to suggest the right fix for you.

• Mitigations when patching isn't possible. Break the attack chain today, plan the real fix when it’s not midnight.

• Ownership that’s finally right. Fixes assigned to the person who can actually implement the fix.

See how it works.

JOIN US EVERY WEEKDAY DAILY CYBER THREAT BRIEF

Gerald Auger, Ph.D. livestreams the Daily Cyber Threat Brief on Simply Cyber on weekdays at 8:00 AM EDT.

Join the party with cybersecurity enthusiasts and professionals alike who enjoy learning about the latest in cybersecurity news and staying connected.

Meet #TeamSC in live chat and join the community! https://simplycyber.io/streams 

NEW VIDEO: TRUST NO ONE WITH ROBIN DREEKE

Former FBI Spy Recruiter Exposes the Psychology Behind Social Engineering

The most dangerous attack vector in cybersecurity isn't a zero-day... it's a human being. Former FBI counterintelligence expert Robin Dreeke spent over two decades recruiting spies and studying how bad actors manipulate trust. In this conversation, Robin breaks down exactly how social engineers and foreign intelligence operatives use the same playbook, what behavioral signals reveal insider threats before they act, and how security professionals can flip the script to recognize manipulation in real time.

Whether you're a SOC analyst, GRC professional, or security leader, understanding the psychology behind social engineering is no longer optional. Robin also shares practical techniques from his updated book It's Not All About Me, including the single most powerful tool for detecting deception: transparency.

Watch now on Simply Cyber Media Group: https://youtu.be/Uw67vZgILKU

SIMPLY CYBER FIRESIDES: REAL TRUTHS FROM A CYBER HIRING MANAGER

Real Truths From a Cyber Hiring Manager

Thursday, April 30th at 4:30 PM EDT

Breaking into cybersecurity is one challenge. Getting noticed, getting interviews, and getting hired is a completely different game.

In this episode of Simply Cyber Firesides, host Gerald Auger, Ph.D. is joined by Robert Whetstine, also known as @BowTieSecurityGuy for an honest conversation about what hiring managers are actually looking for and what candidates often get wrong.

With more than two decades of experience leading security programs across major enterprises, Robert brings a unique perspective from both the technical and leadership sides of cybersecurity. He has built and led teams, developed security initiatives at scale, and now plays a key role in hiring and mentoring the next generation of cyber professionals.

🎯 Join us to learn more about:
• What hiring managers really look for in cybersecurity candidates
• Why strong resumes still fail to get interviews
• Common mistakes candidates make during the hiring process
• How to stand out in a competitive cyber job market
• The difference between technical skill and hireability
• What entry-level and experienced professionals should focus on today

This session is designed for anyone trying to break into cybersecurity, pivot roles, or better understand how hiring decisions are made behind the scenes.

Expect real talk, practical advice, and insights that can help you approach your job search with more clarity and confidence.

Join us this Thursday in live chat - register to attend and get notified! https://luma.com/mkcuvxhc

SC MEDIA GROUP WEEKLY EVENTS SCHEDULE

Join us for learning and networking every day of the work week at simplycyber.io/streams & meet the community at simplycyber.io/discord!

SIMPLY CYBER MONTHLY EVENTS LINEUP

Want to know what’s happening at Simply Cyber at any given time?

Head over to the SC Monthly Events Calendar to register for new and upcoming events for the month - don’t forget to subscribe! lu.ma/simplycyber 

SC ACADEMY THE PLACE FOR CYBER CAREERS

At Simply Cyber Academy, we specialize in making GRC and Cybersecurity Careers a reality. Empower your career by learning real in-demand skills from cyber experts and the theory behind those skills with Simply Cyber Academy.

The popular GRC Analyst Master Class is a must for kickstarting your GRC Cybersecurity career. In addition, we have new courses covering various areas of focus in cyber available to help you advance in your career.

Check out the NEW FREE courses available in the academy!

SIMPLY CYBER ACADEMY BLOG HIGHLIGHT

Check out the highlighted blog on Simply Cyber Academy: https://academy.simplycyber.io/p/Blog?p=soc-analyst-interview-skills-that-will-get-you-hired 

LET’S CONNECT

Stay current on trending topics, tips, events and resources in cybersecurity, connect with Simply Cyber on socials for new content.

As always, please send me feedback. Which tip above is your favorite? What do you want more or less of? Other suggestions? Please let me know. Just send a DM on X with #actionableintel in the subject so I can find it.

Join us on the Daily Cyber Threat Brief happening every weekday morning at 8 AM Eastern on YouTube and LinkedIn.

Find more about what’s happening this week in the Simply Cyber community, below. Join us on the Daily Cyber Threat Brief happening every weekday morning at 8 AM Eastern on YouTube and LinkedIn.

Thank you and see you again next week, #TeamSC!

Gerry