At a glance.
- CitrixBleed 2 vulnerability is being exploited.
- Hawaiian Airlines discloses cyberattack.
- Phishing campaign abuses Microsoft 365's Direct Send to spoof internal users.
CitrixBleed 2 vulnerability is being exploited.
A critical Citrix vulnerability (CVE-2025-5777) that was patched last week is now being exploited in the wild, according to researchers at ReliaQuest. The vulnerability, which has been compared to 2023's CitrixBleed flaw, can allow attackers to bypass authentication measures and hijack user sessions.
ReliaQuest explains, "Citrix Bleed 2 mirrors the original in its ability to bypass authentication and facilitate session hijacking, but it introduces new risks by targeting session tokens instead of session cookies. Unlike session cookies, which are often tied to short-lived browser sessions, session tokens are typically used in broader authentication frameworks, such as API calls or persistent application sessions. This means that attackers could potentially maintain access longer and operate across multiple systems without detection, even after the user has terminated the browser session."
Users of NetScaler ADC and NetScaler Gateway should apply the patches as soon as possible.
Hawaiian Airlines discloses cyberattack.
Hawaiian Airlines yesterday disclosed a "cybersecurity event" that disrupted some of its IT systems, Infosecurity Magazine reports. The airline said in a statement, "We continue to safely operate our full flight schedule, and guest travel is not impacted. As we navigate the ongoing event, we remain in contact with the appropriate experts and federal authorities."
The airline hasn't shared details on the nature of the incident, but Reuters notes that the impact and response suggest that ransomware may have been involved. The Federal Aviation Administration (FAA) told Reuters that its safety office is in touch with Hawaiian Airlines, and reaffirmed that "[t]here has been no impact on safety, and the airline continues to operate safely."
Phishing campaign abuses Microsoft 365's Direct Send to spoof internal users.
Varonis warns that attackers are abusing Microsoft 365's Direct Send feature to send phishing emails that impersonate internal users. Direct Send is designed to allow devices such as printers to send emails within a Microsoft 365 tenant without authentication. Varonis explains, "This setup is intended for internal use only. But here’s the catch: no authentication is required. That means attackers don’t need credentials, tokens, or access to the tenant — just a few publicly available details. Identifying vulnerable organizations is trivial. Smart host addresses follow a predictable format...and internal email formats (like first.last@company[.]com) are often easy to guess or scrape from public sources, social media, or previous breaches. Once a threat actor has the domain and a valid recipient, they can send spoofed emails that appear to originate from inside the organization, without ever logging in or touching the tenant."
