* Banks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminals

* 'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attacks

* WhatsApp Introduces 'Private Processing' for Secure Cloud-Based AI Features

* Microsoft Warns Default Kubernetes Helm Charts Create Security Vulnerabilities

* Security Concerns Grow Over Electric Vehicles as Potential Surveillance Platforms

Banks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminals

https://www.abc.net.au/news/2025-05-01/bank-employee-data-stolen-with-malware-and-sold-online/105232872

Cyber criminals have stolen almost 100 staff logins from Australia's "Big Four" banks, potentially exposing these financial institutions to serious cyber threats including data theft and ransomware attacks, according to recent findings from cyber intelligence firm Hudson Rock.

The compromised credentials belong to current and former employees and contractors at ANZ, Commonwealth Bank, NAB, and Westpac, with ANZ and Commonwealth Bank experiencing the highest number of breaches. All stolen credentials included corporate email addresses with access to official bank domains.

"There are around 100 compromised employees that are related to those four banks," said Hudson Rock analyst Leonid Rozenberg. While this number is significantly smaller than the 31,000 customer banking passwords recently reported stolen, the security implications could be more severe.

"Technically, [attackers] need only one [login] to do a lot of damage," Rozenberg warned.

The credentials were stolen between 2021 and April 2025 using specialized "infostealer" malware designed to harvest sensitive data from infected devices. These stolen credentials have subsequently appeared on Telegram and dark web marketplaces.

Security experts explain that these breaches could potentially give hackers "initial access" to the banks' corporate networks. While banks employ additional security measures such as Multi-Factor Authentication (MFA), specialized cybercriminals known as "initial access brokers" focus on finding ways around these protections, often targeting employees working from home.

The investigation also uncovered a concerning number of compromised third-party service credentials connected to these banks, with ANZ having more than 100 such breaches and NAB more than 70. These compromised services could include critical communication and project management tools like Slack, JIRA, and Salesforce.

All four banks have responded by stating they have multiple safeguards in place to prevent unauthorized access. NAB reports actively scanning cybercrime forums to monitor threats, while CommBank noted investing over $800 million in cybersecurity and financial crime prevention last financial year.

The Australian Signals Directorate has already warned that infostealer infections have led to successful attacks on Australian businesses, highlighting that this threat extends beyond the banking sector to organizations across all industries.

'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attacks

https://www.oligo.security/blog/airborne

Security researchers at Oligo Security have uncovered a serious set of vulnerabilities in Apple's AirPlay protocol and software development kit (SDK) that could allow attackers to remotely execute code on affected devices without user interaction. These flaws, collectively dubbed "AirBorne," affect millions of Apple and third-party devices worldwide.

The security team discovered 23 distinct vulnerabilities that enable various attack vectors, including zero-click and one-click remote code execution, man-in-the-middle attacks, denial of service attacks, and unauthorized access to sensitive information. Perhaps most concerning are two specific flaws (CVE-2025-24252 and CVE-2025-24132) that researchers demonstrated could create "wormable" zero-click attacks, potentially spreading from device to device across networks.

Another critical vulnerability (CVE-2025-24206) enables attackers to bypass the "Accept" prompt normally required for AirPlay connections, creating a pathway for truly zero-interaction compromises when combined with other flaws.

"This means that an attacker can take over certain AirPlay-enabled devices and do things like deploy malware that spreads to devices on any local network the infected device connects to," warned Oligo. "This could lead to the delivery of other sophisticated attacks related to espionage, ransomware, supply-chain attacks, and more."

While exploitation is limited to attackers on the same network as vulnerable devices, the potential impact is extensive. Apple reports over 2.35 billion active devices worldwide, and Oligo estimates tens of millions of additional third-party AirPlay-compatible products like speakers, TVs, and car infotainment systems could be affected.

Apple released security updates on March 31 to address these vulnerabilities across their product line, including patches for iOS 18.4, iPadOS 18.4, macOS versions (Ventura 13.7.5, Sonoma 14.7.5, and Sequoia 15.4), and visionOS 2.4 for Apple Vision Pro. The company also updated the AirPlay audio and video SDKs and the CarPlay Communication Plug-in.

Security experts strongly advise all users to immediately update their Apple devices and any third-party AirPlay-enabled products. Additional protective measures include disabling AirPlay receivers when not in use, restricting AirPlay access to trusted devices via firewall rules, and limiting AirPlay permissions to the current user only.

WhatsApp Introduces 'Private Processing' for Secure Cloud-Based AI Features

https://engineering.fb.com/2025/04/29/security/whatsapp-private-processing-ai-tools/

Meta's WhatsApp has announced a new privacy-focused technology called 'Private Processing' that will allow users to access advanced artificial intelligence features while maintaining data security. The system is designed to enable AI functionalities like message summarization and writing suggestions that are too computationally intensive to run directly on users' devices.

The new feature, which will be rolled out gradually over the coming weeks, will be entirely opt-in and disabled by default, giving users complete control over when their data leaves their device for AI processing.

Private Processing employs several layers of security to protect user privacy. When activated, the system first performs anonymous authentication through the user's WhatsApp client. It then retrieves public encryption keys from a third-party content delivery network (CDN), ensuring Meta cannot trace requests back to specific individuals.

To further enhance privacy, users' devices connect to Meta's gateway through a third-party relay that masks their real IP addresses. The connection establishes a secure session between the user's device and Meta's Trusted Execution Environment (TEE), using remote attestation and TLS protocols.

All requests for AI processing use end-to-end encryption with ephemeral keys, and the processing occurs inside a Confidential Virtual Machine (CVM) that remains isolated from Meta's main systems. According to Meta, the processing environment is stateless, with all messages deleted after processing, retaining only "non-sensitive" logs.

"The AI-generated response is encrypted with a unique key only known to the device and processing CVM and is sent back over the secure session for decryption on the user's device," the company explained.

To build trust in the system, WhatsApp has promised to share the CVM binary and portions of the source code for external validation. The company also plans to publish a detailed white paper explaining the secure design principles behind Private Processing.

Despite these security measures, privacy experts note that sending sensitive data to cloud servers always carries some inherent risk, even with robust encryption in place. Users concerned about data privacy can either keep the feature disabled or utilize WhatsApp's recently launched 'Advanced Chat Privacy' feature, which provides more granular control over when data can leave the device.

Microsoft Warns Default Kubernetes Helm Charts Create Security Vulnerabilities

https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/the-risk-of-default-configuration-how-out-of-the-box-helm-charts-can-breach-your/4409560

Microsoft security researchers have issued an urgent warning about significant security risks posed by default configurations in Kubernetes deployments, particularly when using out-of-the-box Helm charts. These configurations can inadvertently expose sensitive data to the public internet without proper authentication protections.

According to a new report from Michael Katchinskiy and Yossi Weizman of Microsoft Defender for Cloud Research, many popular Helm charts lack basic security measures, often leaving exploitable ports open and implementing weak or hardcoded passwords that are easy to compromise.

"Default configurations that lack proper security controls create a severe security threat," the Microsoft researchers warn. "Without carefully reviewing the YAML manifests and Helm charts, organizations may unknowingly deploy services lacking any form of protection, leaving them fully exposed to attackers."

Kubernetes has become a widely adopted open-source platform for automating containerized application deployment and management, with Helm serving as its package manager. Helm charts function as templates or blueprints that define resources needed to run applications through YAML files. While these charts offer convenience by simplifying complex deployments, their default settings often prioritize ease of use over security.

The report highlights three specific examples demonstrating this widespread issue. Apache Pinot's Helm chart exposes core services through Kubernetes LoadBalancer services with no authentication requirements. Meshery allows public sign-up from exposed IP addresses, potentially giving anyone registration access to cluster operations. Meanwhile, Selenium Grid exposes services across all nodes in a cluster through NodePort, relying solely on external firewall rules for protection.

The Selenium Grid vulnerability is particularly concerning as cybersecurity firms including Wiz have already observed attacks targeting misconfigured instances to deploy XMRig miners for cryptocurrency mining.

Organizations using Kubernetes are advised to implement several key mitigation strategies. Microsoft recommends thoroughly reviewing default configurations of Helm charts before deployment, ensuring they include proper authentication mechanisms and network isolation. Regular scans for misconfigurations that might publicly expose workload interfaces are crucial, as is continuous monitoring of containers for suspicious activity.

The findings underscore a critical tension in cloud deployment between convenience and security, with many users — particularly those inexperienced with cloud security — inadvertently creating vulnerabilities by deploying charts without customizing their security settings.

Security Concerns Grow Over Electric Vehicles as Potential Surveillance Platforms

https://www.theguardian.com/environment/2025/apr/29/source-of-data-are-electric-cars-vulnerable-to-cyber-spies-and-hackers

Cybersecurity experts are raising alarms about the potential for electric vehicles to be exploited as surveillance tools, particularly those manufactured in China, according to recent reports from the UK.

British defense firms working with the UK government have reportedly warned staff against connecting their phones to Chinese-made electric cars due to concerns that Beijing could extract sensitive information from their devices. The warning highlights growing security considerations around the increasingly sophisticated technology embedded in modern electric vehicles.

Security specialists interviewed by The Guardian note that electric vehicles are equipped with multiple data collection points, including microphones, cameras, and wireless connectivity features that could potentially be leveraged by malicious actors or hostile states.

"There are lots of opportunities to collect data and therefore lots of opportunities to compromise a vehicle like that," explains Rafe Pilling, director of threat intelligence at cybersecurity firm Secureworks. He points out that over-the-air update capabilities, which allow manufacturers to remotely update a car's operating software, could potentially be used to exfiltrate data.

The concerns are particularly focused on individuals in sensitive positions. "If you are an engineer who is working on a sixth-generation fighter jet and you have a work phone that you are connecting to your personal vehicle, you need to be aware that by connecting these devices you could be allowing access to data on your mobile," warns Joseph Jarnecki, a research fellow at the Royal United Services Institute.

Chinese electric vehicle manufacturers such as BYD and XPeng have drawn particular scrutiny due to China's National Intelligence Law of 2017, which requires organizations and citizens to cooperate with national intelligence efforts. However, experts also note there is currently no public evidence of Chinese vehicles being used for espionage.

Cybersecurity professionals suggest that concerned drivers can click "don't trust" when connecting devices to their vehicles, but this sacrifices many convenient features. They also caution against syncing personal devices with rental cars, as this can leave sensitive data in the vehicle's systems.

The UK government has acknowledged the issue, with Defence Minister Lord Coaker stating they are "working with other government departments to understand and mitigate any potential threats to national security from vehicles." He emphasized that their work applies to all types of vehicles, not just those manufactured in China.

While the Society of Motor Manufacturers and Traders (SMMT) maintains that all manufacturers selling cars in the UK must adhere to data privacy regulations, the growing integration of connected technologies in electric vehicles continues to raise new security considerations for both government officials and everyday consumers alike.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com