New WhatsApp vulnerability, Microsoft patches 125 Windows Vulns, Fake Microsoft Office add-in tools push malware

Summary

Cyber Security Headlines – April 9, 2025

Hosted by the CISO Series

---

1. Meta Addresses Critical WhatsApp Desktop Vulnerability

Meta has recently patched a significant vulnerability in the WhatsApp desktop application for Windows. This flaw allowed attackers to deceive users into executing malicious code by manipulating MIME types, making harmful files appear as benign images or documents.

Key Details:

• Vulnerability Type: MIME type manipulation.
• Impact: Potential execution of malicious code through spoofed file types.
• Current Exploitation: No evidence of active exploitation in the wild.
• Mitigation: Users are strongly encouraged to update to WhatsApp version 2.24.50.6 to ensure protection against potential attacks.

Notable Quote:

B: "Meta has patched a serious vulnerability in the WhatsApp desktop app for Windows that could let attackers trick users into executing malicious code via spoofed file types." [00:07]

---

2. Criticism Mounts for German Defense Tech Firm Helsing

Helsing, a prominent German defense technology company, is under scrutiny due to the high costs and limited capabilities of its drone offerings. The company's drones, particularly those deployed in Ukraine, have been criticized for their rudimentary targeting systems, which have not met battlefield requirements effectively.

Key Points:

• Primary Criticism: High costs and subpar targeting capabilities.
• Partnership Challenges: Struggles include a failed collaboration with Rheinmetall AG.
• Current Partnerships: Maintains deals with Saab and contributes to Germany's Eurofighter program.
• Recent Contracts: Secured a €40 million contract with Lithuania, highlighting ongoing efforts to sustain business despite challenges.

Notable Quote:

B: "Despite claims of adapting to battlefield needs, the company has struggled with partnerships, including a failed collaboration with Rheinmetall AG." [00:20]

---

3. Microsoft Releases Urgent Patches for 125 Windows Vulnerabilities

Microsoft has rolled out a suite of urgent security updates addressing 125 Windows vulnerabilities. Among these, a zero-day flaw within the Windows Common Log file system is of particular concern, as it is actively being exploited by cybercriminals.

Key Details:

• Zero-Day Exploit: Targets the Windows Common Log file system, allowing local attackers to gain system-level access.
• Active Exploitation: Linked to ransomware group Storm 2460, utilizing the PipeMagic malware.
• Other Critical Fixes: Includes remote code execution vulnerabilities in Windows Hyper-V, Remote Desktop Services, Excel, and the Office Suite.

Notable Quote:

B: "Microsoft released urgent security updates addressing 125 Windows vulnerabilities, including a zero day flaw in the Windows Common Log file system that is being actively exploited." [00:37]

---

4. Adobe Mitigates 54 Critical Flaws Across Its Products

Adobe has issued major updates to patch 54 security vulnerabilities across various products, including ColdFusion and Photoshop. Several of these vulnerabilities pose serious remote code execution risks, emphasizing the need for immediate updates to safeguard against potential exploits.

Key Points:

• Affected Products: ColdFusion, Photoshop, and others within the Adobe suite.
• Vulnerability Types: Multiple vulnerabilities, with several enabling remote code execution.
• Recommendation: Users should promptly apply the latest Adobe updates to mitigate risks.

Notable Quote:

B: "Adobe also issued major updates, patching 54 flaws across ColdFusion, Photoshop and other products, with several posing serious remote code execution risks." [00:50]

---

5. Waymo's Privacy Concerns Over Robotaxi Data Usage

Waymo has announced plans to utilize video footage from its Robotaxi interior cameras to train generative AI models. This initiative, outlined in an unreleased privacy policy update, potentially links video data to writer identities.

Key Points:

• Optional Participation: Writers can opt out of having their data used.
• Privacy Implications: Raises concerns regarding the handling and potential misuse of personal data.
• Additional Uses: Data may also be employed for ad personalization, further complicating privacy issues.
• Company Updates: Waymo logs over 200,000 weekly paid rides and is expanding into new markets amidst financial challenges and substantial investments in R&D.

Notable Quote:

B: "Waymo plans to use video from its Robotaxi interior cameras potentially linked to writer identities to train generative AI models... the move raises privacy concerns." [01:20]

---

6. Surge in SourceForge-Based Malware Distribution via Fake Microsoft Office Add-Ins

Cyber threat actors are exploiting SourceForge to distribute counterfeit Microsoft Office add-ins that conceal malware. These malicious add-ins masquerade as legitimate developer tools, tricking users into downloading password-protected archives containing scripts and payloads designed to bypass antivirus detection.

Impact:

• Malware Functions: Establish persistence, run crypto miners, and employ clipboard hijackers.
• Affected Systems: Over 4,600 systems, predominantly in Russia.
• Security Advice: Users are urged to download software exclusively from trusted sources and meticulously verify file authenticity before execution.

Notable Quote:

B: "Threat actors are using SourceForge to distribute fake Microsoft Office add ins that install malware designed to steal and mine cryptocurrency." [03:10]

---

7. Legislative Push for Enhanced Privacy Protections under FISA

Members of the House Judiciary Committee are advocating for stronger privacy safeguards in the upcoming renewal of Section 702 of the Foreign Intelligence Surveillance Act (FISA). The current law permits warrantless searches of American data when communicating with foreign entities, a provision that has sparked significant debate.

Key Concerns:

• Lack of Oversight: Critics argue that Section 702 lacks sufficient mechanisms to oversee and regulate surveillance activities.
• Warrant Requirements: The absence of a requirement for warrants in searches of U.S. persons' data is a major point of contention.
• Government Data Access: Expanded access raises alarms about potential overreach and privacy infringements.
• Upcoming Deadlines: With the law set to expire in April 2026, intense legislative debates over surveillance and privacy rights are anticipated.

Notable Quote:

B: "Lawmakers on the House Judiciary Committee are pushing for stronger privacy protections in the next renewal of Section 702 of the Foreign Intelligence Surveillance Act..." [05:00]

---

8. Tintri Wins Data Storage Company of the Year at 2025 Data Breakthrough Awards

Tintri, a subsidiary of DDN, has been honored as the overall Data Storage Company of the Year at the 2025 Data Breakthrough Awards. The accolade recognizes Tintri's AI-powered Workload Aware Data Management Solutions, which have significantly streamlined operations, optimized performance, and reduced storage administration costs by up to 89% for enterprises.

Achievements:

• Technology Excellence: Offers granular visibility, automation, and real-time analytics.
• Market Impact: Facilitates efficient management of virtual workloads across hybrid environments.
• Industry Recognition: Stands out among peers for its innovative approach and effectiveness in data storage management.

Notable Quote:

B: "Tintri, a DDN subsidiary, has been named overall Data Storage Company of the year in the 2025 Data Breakthrough Awards for its AI-powered workload Aware Data Management Solutions." [05:45]

---

Conclusion

The cybersecurity landscape remains dynamic and fraught with evolving threats and regulatory challenges. From vulnerabilities in widely-used applications like WhatsApp and Microsoft Windows to sophisticated malware distribution tactics and legislative battles over privacy, organizations and individuals must stay vigilant. Additionally, advancements in data management and AI integration present both opportunities and ethical considerations. Staying informed through reliable sources like the CISO Series is essential for navigating these complexities.

Notable Closing Quote:

A: "Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines." [06:52]

---

For more detailed analyses and the latest updates in information security, visit CISOseries.com.

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Wednesday, April 9, 2025. I'm Sarah Lane. Meta has patched a serious vulnerability in the WhatsApp desktop app for Windows that could let attackers trick users into executing malicious code via spoofed file types. The flaw involves Mime type manipulation, sometimes known as mime, making harmful files appear safe, like images or documents. While there's no evidence that it has been exploited in the wild, users are urged to update to version 2.24.50.6 to stay protected. German defense tech firm Helsing is facing criticism over the high cost and limited capabilities of its drones, particularly their primitive targeting systems used in Ukraine. Despite claims of adapting to battlefield needs, the company has struggled with partnerships, including a failed collaboration with Rheinmetall ag. Still, Helsing maintains deals with Saab, works on Germany's Eurofighter program, and recently landed a 40 million euro contract with Lithuania. Microsoft released urgent security updates addressing 125 Windows vulnerabilities, including a zero day flaw in the Windows Common Log file system that is being actively exploited. The bug allows local attackers to gain system level access and has been linked to ransomware group Storm 2460 using the pipemagic malware. Other critical fixes include remote code execution vulnerability vulnerabilities in Windows Hyper V, Remote Desktop Services, Excel and the Office Suite. Adobe also issued major updates, patching 54 flaws across ColdFusion, Photoshop and other products, with several posing serious remote code execution risks. Waymo plans to use video from its Robotaxi interior cameras potentially linked to writer identities to train generative AI models, according to an unreleased privacy policy update. While writers will have the option to opt out of this, the move raises privacy concerns, especially since the data may also be used for ad personalization. Waymo now logs over 200,000 weekly paid rides and is expanding into new markets and exploring additional revenue streams amid ongoing financial losses and heavy R and D investment. Huge thanks today to our sponsor Nudge Security, Identity based attacks targeting Okta, Microsoft 365 and Google Workspace on the rise do you have the visibility you need to identify security risks? Nudge Security provides advanced security posture management for these critical platforms, surfacing risks like weak or missing mfa, inactive admin accounts, risky integrations and more. And you can automate remediation tasks and ongoing identity governance. Start a 14 day trial [e-mail] identity. A new report from Biometric Update and Google Intelligence forecasts that the UK's biometric age assurance market will exceed 202 million euros by 2027. Driven by regulations under the UK Online Safety act, the law mandates robust age verification to protect minors from inappropriate content online. The report highlights 18 leading vendors, offers a buyer's guide, and provides forecasts and market insights aimed at helping organizations deploy effective biometric age assurance solutions in a fast, evolving landscape. Threat actors are using sourceforge to distribute fake Microsoft Office add ins that install malware designed to steal and mine cryptocurrency. Masquerading as legitimate developer tools, the malicious files trick users into downloading a large password protected archive containing scripts and payloads that evade antivirus detection, establish persistence and run a crypto miner and clipboard Hijacker More than 4,600 systems, mostly in Russia, have been affected. Security experts urge users to download software only from trusted sources and verify files before execution. Lawmakers on the House Judiciary Committee are pushing for stronger privacy protections in the next renewal of section 702 of the Foreign Intelligence Surveillance act, which allows warrantless searches of Americans data when communicating with foreign targets. Critics argue that the current law, or rsiaa, lacks adequate oversight and fails to require warrants for US Person searches. Concerns also center on expanded government access to private data and weakened audit mechanisms under the current U.S. administration. With the law set to expire In April of 2026, major legislative battles over surveillance and privacy is looming. Tintri, a DDN subsidiary, has been named overall Data Storage Company of the year in the 2025 Data Breakthrough Awards for its AI powered workload Aware Data Management Solutions. The company was recognized for helping enterprises streamline operations, optimize performance and reduce storage admin costs by up to 89%. Tintree's tech offers granular visibility, automation and real time analytics, making it a standout in managing virtual workloads across hybrid environments. Remember to subscribe to the ciso series on YouTube. We host our weekend review show there every week at 3:30pm Eastern time, giving you some CISO perspective on the news of the week. We also post original content, demos and clips from our other podcasts. Just search for ciso series on YouTube to subscribe or look for the [e-mail].

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.

[B]

I'm Sarah Lane reporting for the CISO series. Thank you so much for listening and we'll talk to you next time.