← Cybersecurity Today
Cybersecurity Today
Shady Panda Hides For Years In Legitimate Browser Extensions: Cybersecurity Today
00:12:13
Loading summary
Transcript9 lines
- [00:01]
A
Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST A React flaw hits a perfect 10 CVSS score Microsoft patches an exploited link it left open for years, Evil Jinx bypasses MFA in schools and Univers, shadypanda hides malicious extensions for years and Google's agentic AI wipes a developer's hard drive. But it does say it's sorry, this is Cybersecurity Today. I'm your host, Jim Love.
- [00:48]
A maximum severity vulnerability has been disclosed in React Server components that could allow remote code execution. The Hacker News reports that the flaw has tracked as CVE2025 555182 and nicknamed React to Shell carries a CVS score of 10.0, the highest possible rating. It affects React Server side architecture and frameworks built on top of it, including Next js. Endor Labs said an attacker needs only network access to send a crafted HTTP request to to any server function endpoint. The vulnerability affects default framework configurations, meaning standard deployments are immediately exploitable without special conditions. Researchers from Oligo Security and Cato Networks discovered the underlying issues and reported them to Meta and Vercel. Meta supports React and Vercel supports Next js. React server components sit at the boundary between the server logic and and the client rendering. This flaw breaks that boundary under the right conditions. It allows an attacker to run code on the server, access sensitive data, or manipulate application behavior. Wiz, a cloud security Firm, said that 39% of cloud environments contain instances vulnerable to either CVE2025 555182 or related CVE2025 666478, which I believe was collapsed into 55182. Meta and Vercel have released patches, and both companies have issued security advisories recommending the developers update immediately until those patches can be applied. Endor Labs recommends deploying Web application firewall rules, monitoring HTTP traffic for suspicious or malformed requests, and, if possible, temporarily restricting network access to affected applications. But of course, that's just a stopgap. Developers using React server components or Next JS should update to the fixed versions as soon as humanly possible.
- [03:13]
Microsoft has quietly fixed a Windows shortcut vulnerability that it left unpatched for years, despite repeated warnings from security researchers. The flaw involves the way Windows processes link files, the small shortcut icons you see on the desktop or in folders. Malicious versions of these files can trigger code execution simply by being displayed in Windows Explorer for a long time. Microsoft classified the issue as low risk and declined to issue a security update. Researcher John page, known as HYP3R links or hyperlinks, has been flagging this problem for years, including publishing proof of concept attacks that showed how easily a crafted shortcut file could be weaponized. But this month, Microsoft quietly reversed its position. The company added this fix to its December cumulative update and confirmed that the vulnerability has been exploited in the wild. The patch was not included in the main patch Tuesday notes, and was documented only after researchers noticed the change. Shortcut based attacks have a long history. They were used in some early high profile campaigns, including Stuxnet, because the attack triggers without the user needing to open a file. Now that Microsoft acknowledges active exploitation, administrators should ensure that December's cumulative Windows updates are indeed applied.
- [04:51]
Evil Jinx it's an attacker in the middle phishing platform that steals session cookies, letting threat actors slip past multi factor authentication. And it's also been around for years. But malwarebytes is reporting a new wave of attacks using the toolkit against educational institutions. The attack works by sending victims to a page that looks exactly like malware, a regular website, bank, login, webshop, or a school sign on page in this case. In reality, it's a live proxy to the real site. When the victim enters their username, password and MFA code, Evil Jinx forwards everything to the legitimate service, which issues a session cookie. Evil Jinx captures that cookie, and the attacker can then impersonate the victim without seeing another MFA prompt.
- [05:50]
Once inside, attackers can browse email, change security settings, move money where systems allow it, or steal data until the session expires or is revoked. Some companies, especially in financial services, have seen this and added protections such as a second MFA challenge for high risk actions. But those measures only limit what an attacker can do. They don't prevent the cookie theft itself. Malwarebytes notes that these attacks are difficult to detect. The fake page uses valid TLS and real content from the legitimate site, making traditional look for the padlock advice ineffective. The phishing links also tend to disappear quickly, which makes block listing unreliable. Malwarebytes recommends being cautious with unexpected links using real time anti malware and web protection, choosing phishing resistant MFA such as hardware, hardware keys or pass keys. But if something seems off, revoke active sessions, sign back in with MFA and review your account settings.
- [07:00]
A threat actor known as shadypanda ran a stealth campaign over years using useful and popular browser extensions before quietly introducing malicious code through update dates. According to reporting from the Register and E Security Planet, these extensions were available in both the Chrome and Edge web stores and ultimately affected more than 4 million users. The extensions worked as advertised. The first ones loaded were legitimate, and that helped them stay under the radar for a long time. Only after enough users had installed them did shadypanda begin slipping in code that harvested browsing activity and other data and shipped it overseas, probably to Chinese servers. Because updates appeared routine and the extensions had already built trust, the malicious behavior went largely unnoticed. Google says it inspects extension updates, but it reports that it has not seen recent exploitation from this group. Microsoft, on the other hand, removed the extensions only after reporters asked about them. They'd remained active on Edge for years, and until they were recently detected. Neither company has provided a full timeline of when the malicious changes were detected and removed. This campaign shows how patient threat actors can be by starting with fully functional tools, they avoid scrutiny and gain a large base of victims before activating any harmful features. In this case, shadypanda appears to have waited years before turning these legitimate extensions into a data harvesting operation.
- [08:52]
Which brings us to a crucial point. We constantly advise to update software as a protective or defensive move. We also advise to thoroughly inspect new applications. We may have to add to that advice to say you have to be constantly vigilant about software, even software that you update. A developer using Google's new anti Gravity toolset asked the system to clear a cache file, and instead it irretrievably deleted his entire hard drive. Apparently, the tool misinterpreted the request and executed a command that recursively erased the system without any confirmation step. According to the reports in Tom's hardware, the developer had granted the agent elevated file system permissions so it could handle routine housekeeping tasks. When he issued the instructions to clear a cache, the agent interpreted it broadly and invoked this recursive delete command. When questioned, the AI responded with, I am deeply, deeply sorry. This is a critical failure on my part. The developer, in turn, acknowledged that his wording could have been vague. But the outcome highlights a deeper problem. The system had the authority to run destructive commands and did so automatically. We should note that these agentic tools are still early in their development, barely more than experimental, and they're built to take actions rather than provide suggestions. So without strict guardrails, scoped permissions, or mandatory confirmations, a simple misunderstanding can result in catastrophic data loss. This wasn't an attack. It was a failure of safety controls in what we have to regard as an application and to paraphrase the old Groucho Marx saying, with applications like this, who needs malware?
- [11:02]
And that's our show for today. We'd like to thank Meter for their support in bringing you the podcast. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter Designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments and even run support. It's a single integrated solution that scales from branch offices, warehouses, all the way to large campuses and data centers. Book a demo@meter.com CST that's M E T E R.com CST.
- [11:50]
And you can reach me@technewsday.com with your tips, comments or even constructive criticism. If you're watching this on YouTube, you can just leave a note under the video or as some of you do, track me down on LinkedIn. Love to hear from you. I'm your host, Jim Love. Thanks for listening.