GitHub repos exposed, HaveIBeenPwned adds 244M stolen passwords, Anagram gamifies cybersecurity training

Summary

Cyber Security Headlines – Detailed Summary

Podcast: Cyber Security Headlines
Host: CISO Series
Episode Title: GitHub repos exposed, HaveIBeenPwned adds 244M stolen passwords, Anagram gamifies cybersecurity training
Release Date: February 27, 2025

---

1. Microsoft Copilot's GitHub Repository Exposure

Timestamp: [00:07]

The episode opens with a critical revelation from Israeli cybersecurity firm Lasso. Security researchers at Lasso discovered that Microsoft's Copilot inadvertently retained access to thousands of GitHub repositories that were previously public but subsequently set to private. By leveraging Bing's cache, Lasso identified over 20,000 affected repositories, including those belonging to major corporations such as Google, IBM, and Microsoft.

Notable Quote:

"The exposure of sensitive data from such esteemed companies underscores the need for robust access control mechanisms." — Sarah Lane [00:20]

Despite the scale of the exposure, Microsoft has deemed the issue as low severity. However, the incident raises significant concerns about data privacy and the potential for sensitive information leakage even after repositories are privatized.

---

2. Cellebrite's Suspension in Serbia Following Amnesty International's Report

Timestamp: [00:42]

Cellebrite, a prominent provider of digital forensic tools, has ceased its product operations in Serbia. This decision follows a damning report released by Amnesty International in December 2024. The report accused Serbian authorities of misusing Cellebrite's tools to surveil and target activists and journalists. Specifically, Amnesty alleges that Serbian police unlawfully extracted data and installed spyware on individuals, infringing upon civil liberties and human rights.

Notable Quote:

"The misuse of digital forensic tools to suppress dissent is a grave violation of fundamental freedoms." — Amnesty International [01:05]

Amnesty International has called for a thorough investigation into these abuses, urging Serbia to hold the responsible parties accountable and to implement stringent safeguards. The report further highlights a broader crackdown on civil society within Serbia, amid ongoing antigovernment protests and raids on non-governmental organizations (NGOs).

---

3. Sentinel Labs Uncovers the Ghost Rider Cyber Campaign

Timestamp: [01:30]

Sentinel Labs has identified a new cyber espionage campaign dubbed Ghost Rider, targeting Belarusian opposition activists and Ukrainian entities. This campaign utilizes weaponized Excel documents embedded with variants of the Picasso Loader, a tool linked to the Belarusian state-sponsored group UNC 1151.

The attack methodology involves:

• Phishing Emails: Crafting deceptive emails to lure victims.
• Obfuscated VBA Macros: Embedding malicious code within Excel macros to evade detection.
• Advanced Evasion Techniques: Implementing strategies to bypass security measures and deliver second-stage malware effectively.

This campaign is strategically aligned with the Belarus 2025 elections, indicating an ongoing effort by Belarusian and Russian entities to conduct cyber espionage in support of their geopolitical interests.

Notable Quote:

"The sophistication of Ghost Rider reflects a persistent and targeted approach to cyber espionage aimed at destabilizing opposition forces." — Sentinel Labs Analyst [02:05]

---

4. Have I Been Pwned? Expands Its Database and Introduces New APIs

Timestamp: [02:45]

Have I Been Pwned? (HIBP), a renowned online database for compromised credentials, has significantly expanded its repository by adding 244 million stolen passwords and 284 million compromised email accounts. This influx of data stems from 1.5 terabytes of Infostealer logs that were disseminated on Telegram. The data is associated with a major distribution channel known as Alien Text Base, which disseminated the logs across 744 files.

In response to the growing threat landscape, HIBP has introduced two new APIs designed to enable domain owners to check for compromised credentials within their organizations proactively.

Notable Quote:

"The integration of new APIs empowers organizations to enhance their security posture by swiftly identifying and mitigating compromised credentials." — Sarah Lane [03:15]

Infostealers, which are increasingly prevalent in cyber attacks, propagate through vectors such as phishing, malicious advertisements, and pirated software. The stolen data serves as fodder for major breaches, exemplified by incidents affecting giants like Ticketmaster and AT&T.

---

5. Anagram's Gamified Approach to Cybersecurity Training

Timestamp: [04:20]

Anagram, previously known as Cypher, is revolutionizing employee cybersecurity training through a gamified model. Moving away from traditional annual, lengthy training sessions, Anagram now offers frequent, interactive sessions that include phishing simulations to engage employees more effectively.

This strategic pivot occurred in 2024 when Anagram recognized that non-security employees were often the weakest link in organizational security chains. By transforming training into an engaging and ongoing process, Anagram has successfully attracted prominent clients such as Disney and Thomson Reuters.

Notable Quote:

"Interactive and ongoing training not only educates employees but also fosters a culture of security awareness across the organization." — Anagram CEO [04:45]

---

6. Bybit Launches $140 Million Bounty to Recover Stolen Ethereum

Timestamp: [05:10]

Bybit, a leading cryptocurrency exchange, has initiated a $140 million bounty program aimed at recovering $1.5 billion in Ethereum that was illicitly siphoned by North Korea's Lazarus Group. The heist was executed through the compromise of a Safe Wallet developer machine, where attackers manipulated smart contract logic to divert funds.

Bybit's initiative includes a new hack bounty platform designed to unite the cybersecurity community in battling state-sponsored crypto theft. This move not only seeks to reclaim the stolen assets but also aims to bolster industry-wide defenses against evolving cyber threats.

Notable Quote:

"Uniting the security community is crucial in our fight against sophisticated state-sponsored cyber theft." — Bybit Representative [05:30]

---

7. Crazy Evil's Deceptive Job Interviews to Disseminate Malware

Timestamp: [05:50]

A Russian-speaking cybercrime group known as Crazy Evil has been exploiting fake job interviews to distribute grasshole malware, which targets and steals cryptocurrency wallets. The modus operandi includes:

• Fraudulent Web3 Job Listings: Attracting victims by advertising non-existent Web3 positions.
• Fake Video Meeting Apps: Prompting victims to download counterfeit applications under the guise of facilitating job interviews.
• Malware Deployment: Installing Infostealers and Remote Access Trojans (RATs) on both Windows and Mac devices.

Once the malware is installed, stolen credentials are utilized to drain victims' cryptocurrency wallets, with attackers monetizing each successful theft. Security researchers are issuing warnings to Web3 job seekers to remain vigilant against such sophisticated social engineering scams.

Notable Quote:

"The sophistication of these scams highlights the critical need for heightened awareness and vigilance among job seekers in the Web3 space." — Cybersecurity Researcher [06:10]

---

Conclusion

The episode of Cyber Security Headlines by CISO Series provides a comprehensive overview of pressing cybersecurity issues as of February 27, 2025. From the inadvertent exposure of sensitive GitHub repositories by Microsoft Copilot to the innovative gamified training approaches by Anagram, the discussions underscore the dynamic and evolving nature of cybersecurity threats and defenses. Notably, the expansion of HIBP's database and the introduction of new APIs highlight the ongoing battle against credential theft, while Bybit's substantial bounty program demonstrates the increasing collaboration within the cybersecurity community to recover stolen assets and combat state-sponsored threats.

Closing Quote:

"Staying informed and proactive is essential in navigating the complex landscape of cybersecurity threats." — Sarah Lane [06:00]

For a deeper dive into these stories and more, listeners are encouraged to visit CISOseries.com.

---

End of Summary

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Thursday, February 27, 2025. I'm Sarah Lane. In today's cybersecurity news, security researchers at Israeli cybersecurity company Lasso found that Microsoft Copilot retains access to thousands of once public GitHub repositories even after they've been set to private. Using Bing's cache, Lasso identified over 20,000 affected repositories, exposing sensitive data from major companies like Google, IBM and Microsoft. Microsoft classified the issue as low severity. Cellebrite has halted product use in Serbia after Amnesty International's December 2024 report accused Serbian authorities of misusing its digital forensic tools to target activists and journalists. Amnesty says that Serbian police unlawfully extracted data and planted spyware. Amnesty urges Serbia to investigate, hold perpetrators accountable and implement safeguards before resuming exports of surveillance tech. The report highlights Serbia's broader crackdown on civil society amid antigovernment protests and NGO raids. Sentinel labs uncovered a new Ghost Rider cyber campaign targeting Belarusian opposition activists and Ukrainian entities using weaponized Excel documents to deploy a variant of Picasso Loader linked to Belarusian state sponsored group UNC 1151. The attack leveraged phishing emails, obfuscated VBA macros and advanced evasion techniques to deliver second stage malware. The campaign tied to Belarus 2025 elections highlights ghostwriters ongoing cyber espionage efforts aligned with Belarusian and Russian interests. Have I Been Pwned? Has added 244 million stolen passwords and 284 million compromised email accounts to its database, sourced from 1.5 terabytes of Infosteeler logs shared on Telegram. The data was linked to a major distribution channel called Alien Text Base, which published the logs in 744 files. Have I been pwned? Also introduced two new APIs allowing domain owners to check for compromised credentials. Info stealers, increasingly used in cyber attacks, spread through phishing, malicious ads and pirated software with stolen data, fueling major breaches like those affecting Ticketmaster and AT&T. Thank you to today's episode sponsor conveyor. It is 2025 and this is your second sign to get a trust center if you don't already have one. Reduce manual work by 80% when when you can share one link to your trust center and let customers download what they need on demand, trusted by the world's top B2B companies. Conveyor's enterprise grade trust center is specially designed to handle multiple products, complex works and with AI. First, you can even push your customers to self serve their own AI answers to questionnaires. Learn [e-mail] Anagram, formerly known as Cypher, is revamping employee cybersecurity training with a gamified approach. Instead of annual lengthy sessions, Anagram is offering more frequent interactive sessions, including phishing simulations. The startup pivoted in 2024 after realizing non security employees were the weakest link. It has since landed major clients like Disney and Thomson Reuters. Cryptocurrency exchange Bybit has launched a $140 million bounty program to recover $1.5 billion in Ethereum stolen by North Korea's Lazarus Group. The heist, executed via a compromised Safe Wallet developer machine, manipulated smart contract logic to divert funds. Bybit's initiative, including a new hack bounty platform, aims to unite the security community in combating the state sponsored crypto theft, reinforcing industry wide defenses against cyber threats. A Russian speaking cybercrime group, Crazy Evil, is using fake job interviews to spread grass call malware, which steals cryptocurrency wallets. Victims are lured via a fraudulent Web3 job listing and then prompted to download a fake video meeting app that installs infostealers and Remote access Trojans on Windows and Mac devices. The stolen credentials are exploited to drain wallets, with attackers profiting from each successful theft. Security researchers warn Web3 job seekers to stay vigilant against these kinds of social engineering scams. Are we headed for a mass CISO exodus? Organizations may have budgeted for cybersecurity, but without a commitment to process, will it leave CISOs in the lurch? That's what we're diving deep into on this week's episode of Defense In Depth. Look for our CISOs struggling to get respect. Wherever you get your podcast.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.

[B]

I'm Sarah Lane reporting for the CISO series. Thank you so much for listening.