⚡ Weekly Recap: Fortinet Exploits, RedLine Clipjack, NTLM Crack, Copilot Attack & More

The weekly recap spotlights a slate of high‑profile security disclosures, led by a Fortinet FortiSIEM flaw that is under active exploitation in the wild. According to The Hacker News, the vulnerability is tracked as CVE-2025-64155 (CVSS 9.4) and allows an unauthenticated attacker to execute code via crafted TCP requests, with Horizon3[.]ai describing an attack chain that includes an unauthenticated argument injection and a file overwrite privilege escalation impacting the phMonitor service.

The roundup also notes RedLine Clipjack, where a threat actor uses the RedLine brand to push a Python‑based clipboard hijacker called Pro.exe to steal cryptocurrency by swapping wallet addresses, distributed via Discord trust relationships. In other developments, Reprompt attacks were found to exfiltrate data from Microsoft Copilot through crafted links, though the incident does not affect Microsoft 365 Copilot enterprise customers.

Fortinet’s coverage also mentions a CodeBreach misconfiguration in AWS CodeBuild, which Wiz described as enabling potential platform‑wide compromise before AWS fixed the issue in September 2025. Elsewhere, new n8n vulnerabilities surface, including a CVSS 9.9 authenticated RCE and a CVSS 10.0 unauthenticated RCE.