The Register: Microsoft admits GitHub used to store malware that infected almost a million devices

Mar 10, 2025

—

Source URL: https://www.theregister.com/2025/03/10/infosec_in_brief/
Source: The Register
Title: Microsoft admits GitHub used to store malware that infected almost a million devices

Feedly Summary: Also, phone cleaner apps are a data-sucking scam, Singapore considering the literal rod for scammers, and more
Infosec in Brief Microsoft has spotted a malvertising campaign that downloaded nastyware hosted on GitHub and exposed nearly a million devices to information thieves.…

AI Summary and Description: Yes

Summary: The text provides insight into various cybersecurity threats, vulnerabilities, and compliance measures observed and reported in recent weeks. It discusses significant malvertising campaigns, the exploitation of critical vulnerabilities, and legislative actions regarding cybersecurity standards, all of which highlight the evolving challenges in securing digital environments.

Detailed Description:
The content addresses multiple aspects of information security, particularly focusing on the following key points:

– **Malvertising Campaigns**: Microsoft discovered a campaign that resulted in the exposure of nearly a million devices to malware through redirectors embedded in illicit streaming sites, ultimately leading to malicious payloads hosted on GitHub.

– **Critical Vulnerabilities**:
– Increased scrutiny on vulnerabilities, such as CVE-2024-4885 and CVE-2022-43939, stressing the need for organizations to patch or replace vulnerable software and hardware.
– Cisco’s announcement concerning CVE-2023-20118 highlights the risks associated with using outdated hardware.

– **Data Privacy Concerns**: A report indicated that popular phone cleaning apps were found to be sharing extensive user data with third parties, further complicating privacy issues.

– **Legislative Developments**: The US House of Representatives passed a contractor security bill requiring federal contractors to have vulnerability disclosure policies, aiming to close gaps in national cybersecurity standards.

– **AI-generated Phishing**: The use of AI to create deceptive videos impersonating YouTube’s CEO reflects the corresponding rise in sophisticated phishing tactics targeting content creators.

– **Criminal Consequences**: Singapore is exploring stringent punishments, including potential caning, for scammers to deter growing cybercrime, particularly on platforms like Telegram.

This analysis underscores the necessity for security professionals to actively monitor for evolving threats, ensure compliance with emerging regulations, and address vulnerabilities promptly to safeguard their organizations. The interconnectedness of technology and regulatory frameworks in cybersecurity highlights the critical need for continued vigilance and proactive measures in information security.

– **Key Highlights**:
– Malvertising and its consequences on device security
– Critical vulnerabilities needing immediate attention
– Legislative advances in cybersecurity compliance
– Emerging threats from AI-generated phishing
– The importance of addressing user privacy through app behavior monitoring.

Overall, security and compliance professionals must stay informed of these developments to protect their infrastructures from current and future cyber threats.

01 1 2 2024 24 3 4 5 a Act actions ads AI analysis and art as Behavior behavior monitoring C campaigns CERN challenges CIA Cisco compliance compliance measures compliance professionals concerns content content creators contract core crime critical Current CVE cyber cyber threat cyber threats cybercrime cybersecurit Cybersecurity cybersecurity compliance cybersecurity standards cybersecurity threat cybersecurity threats D data data privacy de development device security digital digital environment digital environments disclosure disclosure policies e emerging regulations emerging threats environment evolving threats exp exploit Exploitation federal contractors for framework frameworks future g Gen generated GIS git GitHub H hardware high Highlight hosted HR http HTTPS in information information security infosec infrastructure infrastructures inter ite k Key l led legislative legislative action legislative actions legislative developments Li Lite lm low malvertising malware media Micro Microsoft Monitor monitoring multi N nation no o of on one OPM organization organizations ory out outdated hardware over Patch phi phishing phishing tactics platform point policies potential pre privacy privacy concerns privacy issue privacy issues proactive proactive measures professionals prompt R Ractors rate RCE red Regulation regulations regulatory regulatory framework regulatory frameworks report Risk risks Ro RoT s safe scam scammers sec security security and compliance security compliance security professionals security standards security threat security threats sequence SHA sharing side Sig Singapore SoC software source SSE standards Streaming structures T tactics tech technology Telegram text the third third parties threat threats to Tor TP UI US use user user data user privacy V video vigilance vulnerabilities vulnerability vulnerability disclosure Ware Wi x YouTube