This Week in Cybersecurity - July 11, 2025
- Jordan Santos
- 14 hours ago
- 3 min read
This week’s cybersecurity news highlights a critical theme: trust can be exploited. From malicious Chrome extensions disguised with verification badges to advanced malware campaigns targeting Windows users, attackers are finding new ways to bypass traditional defenses. For SMB leaders, these developments are a stark reminder that security requires constant vigilance—not just in tools, but in habits and awareness. Here’s what you need to know to stay protected.
Top News This Week
Cybersecurity in 2025: Why SMBs Must Rethink Their Defense Strategy Now
In today’s hyper-connected world, cybersecurity isn’t just an IT problem—it’s a business-critical priority. This week’s featured story offers a comprehensive look at how evolving threats, from AI-powered attacks to insecure IoT devices, are changing the game for small and midsize businesses (SMBs).
Cybercriminals are increasingly using AI to craft smarter phishing campaigns and malware, while ransomware attacks continue to rise across all industries. At the same time, the rapid growth of connected devices and digital transformation exposes businesses to new vulnerabilities—particularly in their supply chains and third-party vendor relationships.
To stay ahead, SMBs must adopt a layered, proactive approach to cybersecurity that includes:
Regular risk assessments and employee training
Strong cyber hygiene (MFA, password protocols, phishing awareness)
Integration of emerging technologies like AI, machine learning, and blockchain
A clear cybersecurity governance framework aligned with regulations like GDPR and CCPA
Plans for incident response and organizational resilience
Modern cybersecurity is also about mindset—embedding a culture of security awareness across every level of your business. Collaboration between leadership, IT teams, and employees is essential to creating a truly secure organization.
Takeaway: A future-ready cybersecurity strategy isn’t optional—it’s foundational to business resilience, reputation, and growth. SMB leaders must treat cybersecurity as an investment, not a cost, and take decisive steps today to protect tomorrow’s digital infrastructure.
(Forbes)
NordDragonScan Malware Targets Windows Users with Stealth Credential Theft
Researchers have uncovered a new malware campaign, NordDragonScan, targeting Windows users with advanced credential-stealing tactics. Delivered via shortened URLs and disguised as official Ukrainian documents, the malware uses legitimate Windows tools like mshta.exe and PowerShell to evade detection.
Once executed, NordDragonScan:
Steals saved browser credentials and sensitive documents
Takes screenshots and performs network scans
Establishes persistence and communicates with a command-and-control server to exfiltrate data
Its ability to blend in with system processes and conduct network-wide reconnaissance makes it especially dangerous for SMBs.
Takeaway: Train employees to avoid unknown downloads, strengthen email security, and use up-to-date endpoint protection to defend against stealthy threats like NordDragonScan.
Verified Chrome Extensions Infected 1.7 Million Users in Stealth Malware Campaign
Over 1.7 million Chrome users were compromised by a malware campaign dubbed “Malicious11,” which weaponized 11 Chrome extensions—all Google-verified and featured in the Chrome Web Store. The extensions appeared trustworthy, offering useful tools like VPNs, emoji keyboards, and video speed controllers.
What made the attack so dangerous: these extensions were legit for years before silently receiving malicious updates via automatic version bumps. No phishing or social engineering—just quiet hijacking from extensions users already trusted.
Once activated, the malware tracked browsing activity, captured URLs, and enabled man-in-the-middle attacks, allowing threat actors to redirect users to phishing pages that mimic trusted services like Zoom or online banking.
Cyber Tip of the Week
Audit Your Browser Extensions Regularly – Even verified or popular extensions can turn malicious through silent updates. Remove any that are unnecessary, and only install tools from publishers you trust—and even then, keep an eye on behavior changes after updates.
Stat of the Week
1.7 million Chrome users were silently infected by malicious browser extensions with verified badges—highlighting how trusted platforms can still be exploited.
Final Thoughts
This week’s stories all point to a hard truth: trust signals like verification badges, familiar tools, or even well-known brands are no longer enough to guarantee safety. Cybercriminals are exploiting what we rely on most—convenience, familiarity, and trust. For SMBs, that means it’s more important than ever to build a culture of caution alongside strong technical defenses. From browser extensions to email attachments, the smallest digital doorway can open into your entire business if left unguarded.
Until next week—stay sharp and stay secure.
Have questions about your cybersecurity posture? Let’s talk.