Thecyberexpress

Amazon WorkSpaces Linux Flaw Allows Credential Theft

First seen 2 Dec 2025, 18:33 UTC • Thecyberexpress

•21.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A security flaw in the Amazon WorkSpaces client for Linux, identified as CVE-2025-12779, enables local attackers to extract valid authentication tokens, granting unauthorized access to other users' WorkSpace sessions. Organizations utilizing AWS's virtual desktop infrastructure are affected by this vulnerability. AWS issued a security bulletin on November 5, 2025, detailing the issue and recommending immediate remediation.

How this analysis works

Attack Flow

8 entities, 9 inferred relationships (STIX 2.1).

Technique (2)

Phishing
Zero-day Exploit

Organization (2)

Amazon
Amazon Web Services

Vulnerability (1)

CVE-2025-12779

Malware (1)

ClickFix

Affected Platform (2)

Amazon WorkSpaces
Linux

Relationships

ClickFix exploits CVE-2025-12779
CVE-2025-12779 targets Amazon WorkSpaces
CVE-2025-12779 targets Linux
ClickFix targets Amazon
ClickFix targets Amazon Web Services
Phishing targets Amazon WorkSpaces
Phishing targets Linux
Zero-day Exploit targets Amazon WorkSpaces
Zero-day Exploit targets Linux

Continue Reading

Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users Rapid7 Reports Surge in Vulnerability Exploitation Outpacing Patching Efforts ACSC Issues Critical Alert on Exploited CMS Vulnerabilities Cybercriminals Exploit BNB Chain for Malware via Fake CAPTCHAs

Amazon WorkSpaces Linux Flaw Allows Credential Theft

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading