Daily Security Briefing 017

September 21, 2025 | Read Online\n\nDPRK crypto job scams, Microsoft Entra ID tenant hijack flaw, European airport cyberattack disruption\n\n—\n\n## Executive Summary\n\nToday’s cybersecurity developments highlight the ongoing threat posed by nation-state actors using sophisticated social engineering and malware campaigns targeting cryptocurrency sectors. A critical vulnerability in Microsoft Entra ID could have exposed every company’s tenant to hijacking, underscoring risks in legacy infrastructure components. Additionally, a major cyberattack disrupting airport operations across Europe reveals the vulnerability of critical transportation systems to digital threats. Meanwhile, industry leader Cloudflare reflects on 15 years of internet evolution and innovation in its annual founders’ letter, signaling shifts in internet security and infrastructure.\n\n—\n\n## Top Articles\n\nDPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams \nNorth Korean-affiliated threat actors have been using ClickFix-style phishing lures to target marketing and trader roles within cryptocurrency and retail companies, deploying BeaverTail and InvisibleFerret malware. Unlike previous campaigns focusing on software developers, this strategic shift aims to exploit organizational roles tied to crypto. The campaign is an example of the DPRK’s evolving tactics to infiltrate high-value sectors. \nTheHackerNews\n\nMicrosoft Entra ID flaw allowed hijacking any company’s tenant \nA critical vulnerability involving legacy components in Microsoft Entra ID was recently uncovered, which could have enabled attackers to hijack any organization’s tenant globally. This security flaw posed an extreme risk, potentially granting full access to corporate cloud environments. Microsoft has since issued patches, but the incident highlights the importance of securing legacy systems within modern identity management frameworks. \nBleepingComputer\n\nAirport Cyberattack Disrupts More Flights Across Europe \nA cyberattack targeting Collins Aerospace software systems has caused widespread disruptions to flight operations across multiple European airports. The affected systems manage passenger check-in processes, baggage tagging, and luggage dispatch, demonstrating the critical impact of cyber threats on air transport infrastructure. The incident raises concerns over the cybersecurity posture of third-party vendors supporting airport operations. \nSecurityWeek\n\nCloudflare’s 2025 Annual Founders’ Letter \nCloudflare marks its 15th anniversary with a reflective letter discussing how the internet has transformed over the years and introducing new products designed to enhance security and user experience. The letter underscores Cloudflare’s commitment to giving back to the internet community while addressing emerging challenges in internet privacy and infrastructure resilience. \nBlog.Cloudflare

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.