React Flaw Incites Supply Chain Risk

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, cyber defenders scrambled to patch a React framework flaw, Microsoft quietly fixed a long-abused Windows shortcut flaw, a watchdog said Defense Secretary Pete Hegseth endangered a military operation, North Korean actors expanded their npm “Contagious Interview” campaign. An Australian IT worker was jailed for airport Wi-Fi “evil twin” crimes. The U.S. Federal Trade Commission is reimbursing $15.3 million to Avast users and a London city council confirmed attackers stole data.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Developers behind one of the most commonly used web application frameworks patched a maximum severity vulnerability that allows unauthenticated remote code execution.

The vulnerability, tracked as CVE-2025-55182, affects all versions of the Meta-developed open-source React framework since version 19. That means web apps and cloud environments using the JavaScript front-end library have been vulnerable since November 2024. The vulnerability “stems from insecure deserialization in the [React Server Components] payload handling logic, allowing attacker-controlled data to influence server-side execution,” wrote cybersecurity company Wiz. Exploit code is available.

Wiz said scans show that 39% of cloud environments contain vulnerable React instances or use a similarly flawed version of Next.js, a related open-source web development framework that tracks its linked React vulnerability as CVE-2025-66478.

Wiz researchers said the vulnerability demonstrated a nearly “100% success rate” and that hackers could use it to gain full remote code execution. “The attack vector is unauthenticated and remote, requiring only a specially crafted HTTP request to the target server. It affects the default configuration of popular frameworks.”

“Upgrade immediately!” posted Ian Coldwater, a specialist in cloud native security, in advice echoed widely across the internet.

Because of React’s ubiquity, the flaw poses “significant enterprise and supply chain risk,” wrote security firm Flashpoint. Hackers will almost certainly exploit it in the coming days or weeks to deploy malware such as infostealers, ransomware or crypto jackers.

Microsoft appears to have quietly corrected a decade-old Windows flaw that security researchers say has helped nation-state hackers hide malicious code. The vulnerability, cataloged as CVE-2025-9491, stems from a quirk in how Windows processes .lnk files, which are desktop icons acting as a shortcut to another file or application (see: Unpatched Windows Flaw a Boon for Nation-State Hackers).

The do-it-yourself Windows maintainers at Acros Security said Tuesday that Microsoft appears to have published a patch for the issue – after more than a year of telling researchers that existing safeguards were sufficient to prevent exploitation, despite evidence to the contrary. Acros also said its own patch is better than Microsoft’s.

To exploit the flaw, hackers inserted malicious commands into the Target field of a .lnk file. The target field identifies the file the shortcut should open; hackers inserted whitespace padding to hide the actual malicious file that double-clicking on the shortcut file would open. Anyone examining the target field in a Properties dialogue box in Windows can only see the first 260 characters of the target field. Hackers would add whitespace so the malicious instruction so it wouldn’t appear on screen.

Acros said a November Microsoft patch appears to have dealt with the issue by modifying the entire target field to show all arguments. The problem, wrote Acros on its 0patch blog, is that the field can theoretically be up to 32,000 characters long “Okay, at least one can select all, copy and paste the string to a text editor,” the company wrote of the Microsoft fix.

The Acros approach was to treat any .lnk target field longer than 260 characters as a potentially suspicious file and to cut off the link file name at the 260 character limit. “Our patch would break the 1000+ malicious shortcuts identified by Trend Micro for all targeted users, while Microsoft’s patch would only allow the most cautious among these users – who would probably not launch such shortcuts anyway – to see the entire malicious command string,” it wrote.

The U.S. Department of Defense inspector general concluded that Defense Secretary Pete Hegseth violated Pentagon communication and security rules by using the encrypted messaging app Signal to share details of an imminent military strike in Yemen (see: Report: Top Trump Officials’ Private Data Leaked).

A redacted report on the March incident said Hegseth shouldn’t have used a personal device for official business or used a non-approved messaging app to share nonpublic information. Hegseth and senior Trump administration officials mistakenly included Atlantic Editor-In-Chief Jeffrey Goldberg in a Signal group chat containing precise details of an airstrike on Houthi positions in Yemen, including the timing, weapons loadouts and target coordinates.

Hegseth’s actions “created a risk to operational security that could have resulted in failed U.S. mission objectives and potential harm to U.S. pilots,” the report states. The former Fox-TV weekend host told investigators that when he texted the war plans, he was invoking his powers as secretary to declassify information.

Pentagon Spokesperson Sean Parnell told CNN, which on Wednesday obtained an early copy of the report, that the investigation constituted “a total exoneration” for Hegseth. Parnell called the matter “resolved” and “closed.”

Hegseth faces separate scrutiny over a U.S. strike on a suspected drug-smuggling vessel in the Caribbean on Sept. 2 during which he may have committed a crime by ordering the killing of the boat’s occupants.

Security researchers at cybersecurity firm Socket identified a wave of malicious activity tied to the “Contagious Interview” operation, a campaign they attribute to North Korea threat actors. The group has been publishing harmful packages to the npm registry in an effort to compromise developers approached with fake job opportunities or coding assessments.

According to the company, North Korean hackers uploaded at least 197 additional npm packages in recent weeks, bringing the campaign’s total download count to more than 31,000. Socket said the packages are being distributed through scenarios where victims are asked to complete a technical test and install specific dependencies as part of the assignment.

One of the recently flagged packages, tailwind-magic, is presented as a legitimate development utility. Researchers said the package retrieves a secondary script from tetrismic.vercel.app and then downloads another payload from a GitHub account controlled by the attackers. That payload deploys a new version of the OtterCookie information-stealing malware.

The DPRK Research tracking site, which maintains a catalogue of malicious npm packages attributed to the same operators, has also listed more than 140 harmful packages published between late October and late November, indicating sustained activity.

The malware performs system checks to avoid sandbox environments, gathers device information and establishes a command-and-control connection. Once active, it can record keystrokes, access browser-stored data capture files and obtain cryptocurrency-related information from compromised systems.

An Australian man last Friday received a seven year, four month prison term for creating fake Wi-Fi networks at airports and domestic flights to harvest account credentials he used to later steal intimate photos and videos of passengers, Australian Federal Police announced.

Australian news outlets identified the man as Perth resident Michael Clapsis, 44. Police began an investigation into Clapsis after Qantas employees detected a suspicious onboard wireless network during an April 2024 flight.

The AFP found that Clapsis used a portable wireless access point often known as a WiFi Pineapple for more than six years to broadcast fake networks using the same service set identifier as a legitimate network. He captured and saved the credentials victims entered into a captive portal he transmitted to victims. Australian public broadcaster ABC reported that Clapsis used the credentials to steal or copy more than 700 photos and videos from accounts belonging to 17 women and girls, including a 17-year-old.

Fake wireless access points are known as an evil twin attack. Signs of an evil twin include duplicated Wi-Fi network names – one of them could be an evil twin – and unusual captive portal requests for credentials.

During the police investigation, Clapsis deleted nearly 1,800 items from his data storage app, data the police believe was stolen between 2017 and 2023. He attempted to remotely wipe his mobile phone, despite warnings that such efforts would be deemed a crime.

Clapsis, who had charges initially levied against him in June 2024, will be eligible for parole in 2030.

The U.S. Federal Trade Commission this week began distributing payments to more than 103,000 American customers affected by misleading privacy claims from antivirus-software firm Avast. The agency said the total payout will amount to nearly $15.3 million.

Avast marketed its antivirus tools and browser extensions as privacy shields, claiming they would block tracking cookies and stop websites from monitoring user activity. But as detailed in a February 2024 complaint, Avast and its analytics subsidiary Jumpshot were simultaneously harvesting full clickstream logs – URLs visited, search queries, background resource loads and third-party cookie values – and selling them in non-anonymous, non-aggregate form.

Jumpshot packaged the information into products such as “All Clicks Feed” and “Transaction Feed,” enabling buyers to follow users across websites, devices and sessions using persistent identifiers. Major ad-tech players purchased the data for audience-targeting and identity-matching purposes. By early 2020, Jumpshot had accumulated more than eight petabytes of historical browsing records. Avast shuttered Jumpshot in January 2020 after receiving an FTC investigative demand.

The FTC said the browsing data captured from users included visits to breast-cancer resources, political-campaign pages, religious beliefs, financial-aid applications and adult content.

The company in April 2024 paid the Czech data protection authority a 13.9 million euro fine – roughly $15 million – for violating the European data protection law. Avast transferred the data from 100 million devices to Jumpshot, the Czech agency said.

A London city council said Monday that hackers stole historical data that has been “copied and then taken away.” The Royal Borough of Kensington and Chelsea Social Council disclosed in late November that it and neighboring councils sharing IT services came under a hacker disruption Fulham (see: Multiple London Councils Responding to Cyberattack).

Stolen data “has not been published, but it is possible it could end up in the public domain. As a priority, we are checking if this contains any personal or financial details of residents, customers and service users – but this will take some time,” the council said.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey, David Perera in Northern Virginia and Akshaya Asokan in Southern England.