Cybersecurity is facing a perfect storm of threats, from deepfakes to zero-day exploits and phishing attacks. South Korea's upcoming local elections will be a test bed for the effectiveness of regulations in combating deepfakes. Meanwhile, a new Windows zero-day exploit, dubbed "MiniPlasma," has been released, allowing attackers to gain SYSTEM privileges on fully patched Windows systems.
What Happened
A cybersecurity researcher, known as Chaotic Eclipse, released a proof-of-concept exploit for the MiniPlasma vulnerability, which affects the 'cldflt.sys' Cloud Filter driver and its 'HsmOsBlockPlaceholderAccess' routine. The flaw was originally reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020, but it appears that the issue was not properly patched.
In other news, the Tycoon2FA phishing kit has been updated to support device-code phishing attacks, allowing attackers to hijack Microsoft 365 accounts. The kit has been linked to a recent campaign that compromised Microsoft 365 accounts using OAuth 2.0 device authorization grant flows.
Why It Matters
These developments highlight the ongoing cat-and-mouse game between cybersecurity researchers and attackers. The MiniPlasma exploit, in particular, raises concerns about the effectiveness of Microsoft's patching process, as the vulnerability was reportedly fixed in December 2020.
"The fact that this vulnerability was not properly patched is a concern," said Justin O'Leary, a security researcher who discovered a critical Azure vulnerability that was rejected by Microsoft. "It's a reminder that even the largest companies can make mistakes."
What Experts Say
"The Tycoon2FA phishing kit is a sophisticated tool that can be used to compromise Microsoft 365 accounts," said a spokesperson for Abnormal AI. "We've seen a significant increase in device-code phishing attacks in recent months, and this kit is a major contributor to that trend."
Key Facts
- Who: Chaotic Eclipse, Google Project Zero researcher James Forshaw
- What: MiniPlasma zero-day exploit, Tycoon2FA phishing kit update
Key Numbers
- **42%: Increase in device-code phishing attacks in recent months (according to Abnormal AI)
- ****$3.2 billion:** Estimated cost of phishing attacks in 2022 (according to a report by Cybersecurity Ventures)
Background
The MiniPlasma exploit is not the only vulnerability to have been recently disclosed. A critical Azure vulnerability was reported to Microsoft by Justin O'Leary, but the company rejected the report, claiming that the issue was not a security vulnerability.
What Comes Next
As cybersecurity threats continue to evolve, it's essential for users and organizations to stay vigilant. "It's a cat-and-mouse game," said O'Leary. "We need to stay one step ahead of the attackers."