Pearson Educational Giant Suffers Major Cyberattack Through Exposed GitLab Token
Malicious npm Packages Target Cursor Editor Users, Affecting Over 3,200 Developers
Cyber Scammers Deploy Fake AI Creation Tools to Spread Noodlophile Malware via Facebook
Google Deploys On-Device AI to Combat Scams Across Chrome, Search, and Android
New Investment Scams Employ Sophisticated Techniques to Target Victims
Pearson Educational Giant Suffers Major Cyberattack Through Exposed GitLab Token
https://plc.pearson.com/en-GB/news-and-insights/news/cyber-security-incident
Education publishing powerhouse Pearson has confirmed a significant cybersecurity breach that resulted in the theft of corporate data and customer information. The UK-based company, which provides academic publishing, digital learning tools, and standardised assessments to schools and universities in over 70 countries, acknowledged the incident in a statement.
"We recently discovered that an unauthorised actor gained access to a portion of our systems," a Pearson representative confirmed. "Once we identified the activity, we took steps to stop it and investigate what happened and what data was affected with forensics experts."
According to sources familiar with the breach, the attackers initially compromised Pearson's developer environment in January 2025 by exploiting an exposed GitLab Personal Access Token (PAT) discovered in a publicly accessible .git/config file. This configuration file, which should have been protected, contained embedded access tokens that granted the threat actors unauthorised entry to internal code repositories.
The security lapse had severe consequences. Over several months, attackers reportedly leveraged the initial access to obtain additional hard-coded credentials and authentication tokens for various cloud platforms including AWS, Google Cloud, Snowflake databases, and Salesforce CRM systems. Using these stolen credentials, the cybercriminals allegedly exfiltrated terabytes of data from both Pearson's internal network and cloud infrastructure.
The stolen information reportedly includes customer data, financial records, support tickets, and proprietary source code, potentially affecting millions of individuals. While Pearson has confirmed the breach and the data theft, the company characterised the stolen information as "largely legacy data" without providing specifics on exactly what was taken or how many customers were affected.
"We have taken steps to deploy additional safeguards onto our systems, including enhancing security monitoring and authentication," the company stated, adding that no employee information was included in the breach. Pearson declined to answer questions regarding possible ransom payments or whether affected customers would be notified.
Security experts note that this incident follows a concerning pattern of attacks targeting exposed Git configuration files. Last year, the Internet Archive suffered a similar breach when attackers discovered an authentication token in an exposed Git configuration file. Cybersecurity professionals emphasize that organizations must secure .git/config files by preventing public access and avoiding the practice of embedding credentials in remote URLs.
The Pearson breach may be connected to an earlier disclosed investigation from January involving the company's subsidiary PDRI, though the company has not confirmed this connection publicly.
Malicious npm Packages Target Cursor Editor Users, Affecting Over 3,200 Developers
https://socket.dev/blog/malicious-npm-packages-hijack-cursor-editor-on-macos
Security researchers have uncovered a sophisticated attack targeting users of Cursor, a popular AI-powered code editor for macOS. Three malicious npm packages, which remain available for download, have collectively infected more than 3,200 developers with a backdoor that steals credentials and maintains persistent access to compromised systems.
The packages, identified by Socket security researcher Kirill Boychenko, are disguised as developer tools offering discounted access to Cursor's API services. Named "sw-cur" (2,771 downloads), "sw-cur1" (307 downloads), and "aiide-cur" (163 downloads), these libraries employ an innovative technique that modifies legitimate software already installed on victim systems.
"Disguised as developer tools offering 'the cheapest Cursor API,' these packages steal user credentials, fetch an encrypted payload from threat actor-controlled infrastructure, overwrite Cursor's main.js file, and disable auto-updates to maintain persistence," Boychenko explained.
The malware operates in multiple stages. After installation, it harvests Cursor login credentials provided by users and connects to remote command servers at "t.sw2031.com" or "api.aiide.xyz" to download additional malicious code. This payload then replaces legitimate Cursor components and disables the editor's auto-update functionality to ensure persistence. Finally, the packages restart the application to activate their changes, giving attackers the ability to execute arbitrary code within the trusted editor environment.
What makes this attack particularly concerning is its persistence mechanism. According to Socket, "By operating inside a legitimate parent process—an IDE or shared library—the malicious logic inherits the application's trust, maintains persistence even after the offending package is removed, and automatically gains whatever privileges that software holds, from API tokens and signing keys to outbound network access."
The attackers appear to be exploiting developers' interest in artificial intelligence tools, specifically targeting those seeking more affordable access to AI coding capabilities. "The threat actor's use of the tagline 'the cheapest Cursor API' likely targets this group, luring users with the promise of discounted access while quietly deploying a backdoor," noted Boychenko.
It is recommended that development teams implement multiple protective measures against such supply chain threats, including flagging packages that run post-installation scripts, modify files outside the node_modules directory, or initiate unexpected network connections. They also suggest rigorous version pinning, real-time dependency scanning, and file integrity monitoring for critical dependencies.
This attack represents part of a broader trend. Socket researchers have discovered similar techniques being used in other malicious npm packages including "pumptoolforvolumeandcomment" and "debugdogs," which target cryptocurrency users. Additionally, Aikido security researchers recently reported a supply chain attack affecting the legitimate "rand-user-agent" npm package, which was compromised to distribute a remote access trojan across multiple versions.
Cyber Scammers Deploy Fake AI Creation Tools to Spread Noodlophile Malware via Facebook
https://www.morphisec.com/blog/new-noodlophile-stealer-fake-ai-video-generation-platforms/
Cybersecurity researchers have discovered a sophisticated malware campaign using fake artificial intelligence tools to distribute an information-stealing malware called Noodlophile. The operation, which has reached over 62,000 views on a single Facebook post, specifically targets users searching for AI-powered video and image editing applications.
"Instead of relying on traditional phishing or cracked software sites, they build convincing AI-themed platforms – often advertised via legitimate-looking Facebook groups and viral social media campaigns," explained Morphisec researcher Shmuel Uzan in a report published last week.
The threat actors have created multiple deceptive social media pages, including "Luma Dreammachine Al," "Luma Dreammachine," and "gratistuslibros," which advertise AI-powered content creation services for videos, logos, images, and websites. One particularly convincing fraudulent site impersonates CapCut AI, claiming to offer an "all-in-one video editor with new AI features."
The infection process begins when victims upload their images or videos to these fake AI tools. Rather than receiving the AI-generated content they expect, users are prompted to download what turns out to be a malicious ZIP archive named "VideoDreamAI.zip." Inside this archive is a disguised executable file ("Video Dream MachineAI.mp4.exe") that launches a legitimate ByteDance video editor application ("CapCut.exe") to avoid suspicion while simultaneously executing malicious code.
This initial executable triggers a multi-stage infection chain involving a .NET-based loader called CapCutLoader, which ultimately downloads and executes a Python payload ("srchost.exe") from a remote server. The final payload deploys the Noodlophile Stealer, designed to harvest browser credentials, cryptocurrency wallet information, and other sensitive data from infected systems. Some instances have been found bundled with XWorm, a remote access trojan that provides attackers with persistent access to compromised devices.
Researchers believe the developer of Noodlophile is likely based in Vietnam. The attacker's GitHub profile, created on March 16, 2025, explicitly identifies them as a "passionate Malware Developer from Vietnam." Security experts note that Vietnam has become a hub for cybercriminal operations specializing in stealer malware that frequently targets Facebook users.
This campaign represents part of a growing trend of cybercriminals exploiting public enthusiasm for AI technologies. Meta previously reported removing more than 1,000 malicious URLs from its platforms that used OpenAI's ChatGPT as bait to distribute various malware families since March 2023.
The discovery coincides with CYFIRMA's recent report on another emerging threat called PupkinStealer, a .NET-based malware that exfiltrates stolen data through Telegram bots, highlighting the continued evolution of information-stealing malware leveraging popular platforms for data exfiltration.
Google Deploys On-Device AI to Combat Scams Across Chrome, Search, and Android
https://blog.google/technology/safety-security/how-were-using-ai-to-combat-the-latest-scams/
Google has unveiled a new suite of artificial intelligence-powered security features designed to protect users from evolving online scams across its Chrome browser, Search platform, and Android devices. These enhancements leverage on-device machine learning to detect and block fraudulent content more effectively.
Central to this security upgrade is the integration of Gemini Nano, Google's on-device large language model (LLM), into Chrome's Safe Browsing feature starting with version 137 on desktop computers. This implementation allows for real-time analysis of websites to identify potential scams, even those that haven't been previously cataloged in threat databases.
"The on-device approach provides instant insight on risky websites and allows us to offer protection, even against scams that haven't been seen before," Google stated in its announcement. "Gemini Nano's LLM is perfect for this use because of its ability to distill the varied, complex nature of websites, helping us adapt to new scam tactics more quickly."
The technology is already being deployed to combat remote tech support scams, which typically attempt to trick users into revealing personal or financial information by fabricating computer problems. When users visit a website, the LLM analyzes the page for suspicious elements, such as the use of the keyboard lock API, which is commonly employed in tech support scams. These security signals are then processed by Safe Browsing to determine if the site is fraudulent.
Google Chrome Security engineers explained that they've designed the system to be resource-efficient: "We carefully manage resource consumption by considering the number of tokens used, running the process asynchronously to avoid interrupting browser activity, and implementing throttling and quota enforcement mechanisms to limit GPU usage."
Google plans to expand this capability to detect additional scam types, including package tracking and unpaid toll frauds, with Android support for Chrome scheduled for later this year.
New Investment Scams Employ Sophisticated Techniques to Target Victims
Cybersecurity researchers have uncovered two threat actor groups, codenamed Reckless Rabbit and Ruthless Rabbit, orchestrating elaborate investment scams through fake celebrity endorsements and sophisticated traffic filtering systems.
According to DNS threat intelligence firm Infoblox, these scammers create fraudulent investment platforms, particularly cryptocurrency exchanges, which they promote through targeted social media advertising. The scam operation begins with Facebook ads that direct users to fake news articles featuring celebrity endorsements of investment opportunities.
The threat actors employ several technical measures to ensure they're targeting suitable victims. They perform validation checks using legitimate IP validation tools to filter out traffic from countries they're not interested in and verify the authenticity of submitted contact information. Once a victim passes these verification steps, they're routed through a traffic distribution system (TDS) to either the scam platform directly or to a page instructing them to await contact from a "representative."
Reckless Rabbit, operating since at least April 2024, primarily targets users in Russia, Romania, and Poland while specifically excluding traffic from countries like Afghanistan, Somalia, and Liberia. The group uses registered domain generation algorithms (RDGAs) to create domain names for their fraudulent platforms and employs deceptive tactics in their Facebook ads—displaying unrelated images and decoy domains that differ from the actual destination URLs.
Ruthless Rabbit, active since November 2022, focuses on Eastern European users and runs its own cloaking service for validation checks. Once victims clear these verifications, they're directed to investment platforms requesting financial information.
As these investment scams continue to evolve in sophistication, security researchers warn they will "continue to grow rapidly—both in number and sophistication" due to their profitability.
Share this post