Dark Reading Weekly -- March 16, 2023

Microsoft Zero-Day Bugs Allow Security Feature Bypass

Security vendors urge organizations to fix the actively exploited bugs, in Microsoft Outlook and the Mark of the Web feature, immediately.

ChatGPT Browser Extension Hijacks Facebook Business Accounts

Between March 3 and March 9, at least 2,000 people a day downloaded the malicious "Quick access to ChatGPT" Chrome extension from the Google Play app store.

Access Control Gap in Microsoft Active Directory Widens Enterprise Attack Surface

One researcher thinks trust is broken in AD. Microsoft disagrees that there's a security vulnerability. But enterprise IT environments should be aware of an authentication gap either way.

Cyberattackers Continue Assault Against Fortinet Devices

Patched earlier this month, a code-execution vulnerability is the latest FortiOS weakness to be exploited by attackers, who see the devices as well-placed targets for initial access operations.

US Lawmakers Face Cyberattacks, Potential Physical Harm After DC Health Link Breach

The threat actor who posted the data for sale has claimed credit for multiple other breaches, including one at grocery platform Weee! that exposed data on more than 1.1 million customers.

Analysts Spot a Wave of SVB-Related Cyber Fraud Striking the Business Sector

Over the weekend, cybercriminals laid the groundwork for Silicon Valley Bank-related fraud attacks that they're now starting to cash in on. Businesses are the targets and, sometimes, the enablers.

AI-Created YouTube Videos Spread Around Malware

AI-generated videos pose as tutorials on how to get cracked versions of Photoshop, Premiere Pro, and more.

Hackers Lure Cybersecurity Researchers With Fake LinkedIn Recruiter Profiles

Campaign demonstrates the DPRK-backed cyberattackers are gaining tools to avoid EDR tools.

5 Lessons Learned From Hundreds of Penetration Tests

Developers must balance creativity with security frameworks to keep applications safe. Correlating business logic with security logic will pay in safety dividends.

How Businesses Can Get Ready for AI-Powered Security Threats

Organizations need to take steps now to strengthen their cyber defenses.

How to Jump-Start Your Cybersecurity Career

With more than 700,000 cybersecurity jobs available, now is a good time to consider a career change.

5 Critical Components of Effective ICS/OT Security

These agile controls and processes can help critical infrastructure organizations build an ICS security program tailored to their own risk profile.

The Promise and Reality of Cloud Security