ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand & More

ThreatsDay this week highlights how quickly attackers pivot from cars to cloud services, noting that back in April 2025 AirPlay flaws could chain to CarPlay remote code execution via CVE-2025-24132, with patches published on 29 April 2025 but, as of the post, no car maker had applied them.

The bulletin also covers attackers scanning firewalls for critical flaws, open Microsoft SQL servers used to deploy XiebroC2, and UNC6040’s vishing campaigns aimed at Salesforce, spotlighting a broad attack surface from phones to clouds. Google is boosting protection with AI-powered ransomware detection in Drive for desktop, pausing file syncing to curb spread, while reports of iCloud data access pressure emerge in the UK, with the Financial Times noting a government backdoor demand in a broader data-access push.

Elsewhere, activity ranges from bots renting compromised routers for mining and DDoS to fake Chrome extensions hijacking searches, illustrating how threat actors blend social engineering, supply-chain style compromises, and evolving tooling. According to The Hacker News, the bulletin underscores that “humans shape the outcome,” urging vigilance across devices, services, and human–machine interfaces.