Cybersecurity Threats Escalate as Vulnerabilities and Scams Proliferate

What Happened

In a troubling series of developments, cybersecurity experts have identified multiple zero-day vulnerabilities in Windows, a major data breach involving a contractor's GitHub account, and a surge in cryptocurrency scams using crypto ATMs. These incidents highlight the evolving nature of cyber threats and the need for increased vigilance.

Windows Zero-Day Barrage Continues

Security researchers have disclosed a growing list of zero-day vulnerabilities in Windows, including YellowKey, GreenPlasma, and MiniPlasma. These exploits add to the list of previously disclosed vulnerabilities, underscoring the ongoing challenge of securing the popular operating system.

Contractor’s Public GitHub Account Exposed GovCloud and CISA Credentials

A publicly accessible GitHub repository exposed credentials for both US government AWS accounts and internal Cybersecurity and Infrastructure Security Agency (CISA) systems. The breach was attributed to a CISA contractor who created the repository on their personal GitHub account, highlighting the risks of inadequate security controls.

Discord Rolls Out End-to-End Encryption

In a positive development, Discord has announced the rollout of end-to-end encryption (E2EE) for all voice and video calls on its platform. The implementation, which was completed in March, provides an additional layer of security for the platform's estimated 690 million registered users.

FBI Warns of Crypto ATM Scams

The FBI has issued a public service announcement warning of a surge in cryptocurrency scams using crypto ATMs. The scams, which have resulted in over $388 million in losses in 2025, involve cybercriminals tricking victims into depositing cash into crypto kiosks that transfer funds to attacker-controlled crypto wallets.

Microsoft Self-Service Password Reset Abused in Azure Data Theft Attacks

A threat actor, tracked by Microsoft as Storm-2949, has been using social engineering tactics to target Microsoft 365 and Azure production environments. The actor has been abusing the Self-Service Password Reset (SSPR) flow to gain access to sensitive data, highlighting the need for robust security controls and user education.

Key Facts

• Who: CISA contractor, Microsoft, Discord, FBI
• What: Data breach, zero-day exploits, crypto scams, E2EE rollout
• When: March 2025 (Discord E2EE rollout), 2025 (FBI warning)
• Where: US, global
• Impact: Over $388 million in losses, sensitive data breaches

What Experts Say

"Cybersecurity is a constantly evolving landscape, and these incidents highlight the need for ongoing vigilance and investment in security controls," said a cybersecurity expert. "The rollout of end-to-end encryption by Discord is a positive development, but it's just one part of a broader effort to secure online communications and transactions."

What Comes Next

As the cybersecurity threat landscape continues to evolve, organizations and individuals must remain vigilant and proactive in their efforts to secure sensitive data and transactions. This includes investing in robust security controls, educating users about potential threats, and staying informed about the latest developments in the cybersecurity world.