When the Tools You Trust Become the Threat
A cluster of security incidents making headlines this week shares an uncomfortable thread: the systems compromised were the ones organizations and individuals were supposed to trust the most. Google has patched an actively exploited zero-click flaw in Pixel modems, attackers have turned the ScreenConnect remote management platform against managed service providers, WSO2 identity infrastructure is under active exploitation, and a cyberattack has struck an oil tanker. Taken together, these incidents illustrate a pattern security researchers keep warning about: trust itself has become the attack surface.
None of these events exist in isolation. A modem chip, a remote support tool, an identity platform, and a piece of critical maritime infrastructure are all designed to be dependable by default. That is exactly what makes them attractive targets.
The Pixel Zero-Click Flaw: No Clicks Needed
Google has issued a patch for a zero-click vulnerability in the modem firmware used in Pixel devices, and the flaw was found being actively exploited before the fix went out. A zero-click exploit is particularly dangerous because it requires no interaction from the victim at all. There is no phishing link to click, no malicious attachment to open, and no suspicious app to install. The vulnerability can be triggered simply by the device processing incoming data at the modem level, which means the phone owner has essentially no opportunity to avoid it through caution or awareness.
This is why modem-level and baseband vulnerabilities are treated as some of the most serious flaws in mobile security. They operate below the layer where most users, and even most antivirus tools, have visibility. The fact that this flaw was exploited in the wild before public disclosure underscores how valuable these low-level bugs are to sophisticated attackers.
ScreenConnect Abuse Targets the MSPs Businesses Rely On
Attackers are also turning ScreenConnect, a widely used remote access and support tool, against the managed service providers that use it. MSPs occupy a uniquely sensitive position: they are trusted with administrative access to dozens or hundreds of client networks at once. When a remote management tool used by an MSP is compromised or abused, the blast radius extends far beyond the provider itself and into every downstream client relying on that access.
This kind of supply chain style attack echoes other recent incidents where attackers exploited trust relationships rather than breaking through a hardened perimeter. The Megalodon attack that hit thousands of GitHub repositories in a matter of hours demonstrated a similar principle: automate the abuse of a trusted platform, and the damage compounds fast. MSPs and the businesses that depend on them should assume that any single point of privileged remote access is a high-value target.
WSO2 Identity Infrastructure Faces Active Exploitation
Identity infrastructure like WSO2 sits at the center of how organizations verify who is allowed to access what. When that layer is actively exploited, the consequences ripple outward into every application and service that relies on it for authentication. This mirrors a broader trend of attackers going after identity and access systems directly rather than trying to break individual applications one by one, a strategy also seen in recent actively exploited Netlogon vulnerabilities affecting enterprise authentication protocols. Once identity infrastructure is compromised, defenders often cannot trust their own logs or access controls, which makes recovery significantly harder.
A Cyberattack Reaches an Oil Tanker
The report of a cyberattack hitting an oil tanker is a reminder that digital compromise is no longer confined to servers and software. Maritime shipping increasingly depends on networked navigation, communication, and operational systems, and an attack on that infrastructure carries physical world consequences that extend beyond data loss.
What This Means For You
Most readers will not directly manage an oil tanker or an identity platform, but the underlying lesson applies broadly. The Pixel zero-click flaw affects everyday smartphone users, and it is a strong argument for keeping devices updated immediately rather than deferring patches. If you use an MSP for IT support, or if your organization relies on a third party remote access tool, ask what monitoring and access controls are in place. Supply chain trust, whether in a mobile modem, a remote support platform, or a software download, is only as strong as the weakest link in that chain, a lesson also visible in the JDownloader supply chain compromise that swapped legitimate installers for malicious ones.
Actionable Takeaways
Install the latest Pixel security update as soon as it is available, since the zero-click flaw requires no user error to be exploited. If your business uses ScreenConnect or a similar remote management tool, verify with your MSP that access logs are being reviewed and that multi-factor authentication is enforced on all administrative accounts. Organizations running WSO2 or similar identity infrastructure should apply available patches immediately and audit authentication logs for anomalies. And for anyone in industries touching critical infrastructure, this cluster of incidents is a signal to revisit incident response plans now, not after an attack occurs.
