Hello
Welcome to this week’s Threat Intelligence Roundup.
Each week, we cover the latest on emerging threats, trends, and top security practices, all tailored just for you. Threat Intel Thursdays are designed to give you a wider perspective and arm you with the knowledge you need to make smart security decisions.
August Month Giveaway for 5 businesses!
To celebrate freedom (and to protect it from hackers), we’re giving away Cybersecurity Awareness Training to 5 companies — on us.
It’s our way of helping businesses stay safe and smart online. companies — on us.
👉 Fill out the form to Get Started
Or forward this to a business friend who could use a little cyber love.
Let’s help your team click smarter, not harder.
Let’s help your team click smarter, not harder.
Or forward this to a business friend who could use a little cyber love.
Let’s help your team click smarter, not harder.
Let’s help your team click smarter, not harder.
Threat Intelligence Email Blast This Week:
IBM: Cost of a Data Breach Report 2025:
The 2025 Cost of a Data Breach Report by IBM highlights critical trends related to AI, cybersecurity, and breach management. For the first time in five years, the global average cost of a data breach declined to $4.44 million, driven by faster identification and containment primarily through AI-driven defenses.
This Week’s Roundup:
Browser Extensions Can Exploit ChatGPT, Gemini in ‘Man in the Prompt’ Attack:
Security researchers at LayerX have uncovered a novel attack method called “Man‑in‑the‑Prompt”, revealing that browser extensions—even those without special permissions—can intercept and manipulate AI chat interactions by accessing the prompt input field via the browser’s DOM. A malicious extension can inject hidden instructions into tools like ChatGPT, Gemini, Copilot, and Claude, causing them to inadvertently reveal sensitive data, exfiltrate it to attacker servers, and delete traces of the conversation.
US Tops Hit List as 396 SharePoint Systems Compromised Globally:
A recent report from Infosecurity Magazine reveals that 396 on-premises Microsoft SharePoint systems were successfully compromised across 145 organizations in 41 countries, exploiting two critical vulnerabilities (CVE-2025-53770/53771). These flaws allowed attackers to gain remote code execution without authentication.
Google Launches DBSC Open Beta in Chrome and Enhances Patch Transparency via Project Zero:
Google has officially launched Device Bound Session Credentials (DBSC) in open beta on Chrome for Windows, a security feature designed to prevent session cookie theft by binding authentication sessions to a specific device.
Spotlight: macOS Vulnerability Leaks Sensitive Information:
Microsoft Threat Intelligence disclosed a privacy‑bypassing logging flaw in macOS dubbed SploitLight (CVE‑2025‑31199) that abuses Spotlight importer plugins to circumvent Apple’s Transparency, Consent, and Control (TCC) protections and exfiltrate files from protected directories and Apple Intelligence caches, exposing sensitive information like geolocation, face recognition clusters, photo/video metadata, and user preferences.
SonicWall Urges Patch After 3 Major VPN Vulnerabilities Disclosed:
SonicWall has issued critical patches addressing three high-severity vulnerabilities in its Secure Mobile Access (SMA) 100 series VPN appliances: a heap-based buffer overflow (CVE-2025-40597, CVSS 7.5), a stack-based buffer overflow (CVE-2025-40596, CVSS 7.3), and a cross-site scripting flaw (CVE-2025-40598, CVSS 6.1).
This week’s incidents reveal several concerning trends in the cybersecurity landscape:
If you need help with any of the above, hit reply or book a call with Rick at https://capital-cyber.com/rick
Securing your business together,
Megan Bennett
