The Daily Index — Monday, April 14, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NATIONAL SOCIAL SECURITY FUND OF MOROCCO SUFFERS DATA BREACH

A threat actor, 'Jabaroot,' claims to have breached Morocco's National Social Security Fund (CNSS), compromising the data of nearly 2 million citizens. The leak includes personal and financial details like passports, emails, and banking information, posing significant identity theft and fraud risks for those affected.

securityaffairs.com · 2 min

TLDR InfoSec

FORTINET: SYMLINK TRICK GIVES ACCESS TO PATCHED FORTIGATE VPN DEVICES

Fortinet warns that threat actors can maintain access to FortiGate VPN devices after patching by creating symbolic links to the root file system via SSL-VPN, allowing read-only access. Users should upgrade to the latest FortiOS version to eliminate malicious files and check configurations for unauthorized changes.

bleepingcomputer.com · 3 min

TLDR InfoSec

UNCOVERING A 0-CLICK RCE IN THE SUPERNOTE NOMAD E-INK TABLET

There was a remote code execution vulnerability in the SuperNote A6 X2 Nomad tablet that let attackers on the same network compromise the device without user interaction. The exploit involved identifying an open port with a custom HTTP server, discovering a path traversal flaw for arbitrary file placement, and uploading a malicious firmware update to the EXPORT directory, which auto-installs using publicly available debug keys. The exploit was responsibly disclosed to Ratta Software in July - the company acknowledged it and made plans to fix it in its December 2024 update, but a patch has yet to appear.

prizmlabs.io · 8 min

TLDR InfoSec

TROX STEALER: A DEEP DIVE INTO A NEW MALWARE AS A SERVICE (MAAS) ATTACK CAMPAIGN

TROX Stealer, a Malware-as-a-Service first identified in December 2024, uses urgent debt collection phishing emails to entice victims into downloading malicious executables. It features a multi-stage execution chain with Python, Node.js, and WebAssembly to evade detection, stealing sensitive data like credit cards, browser credentials, cryptocurrency wallets, and Discord/Telegram session files. The attackers have a structured infrastructure, with domains registered nine months prior to the attack, indicating careful planning and marketing on hacking forums.

sublime.security · 10 min

TLDR InfoSec

STATIC ANALYSIS VIA LIFTED PHP (ZEND) BYTECODE

Eptalights Research analyzes PHP code at the bytecode level, providing a reliable method for understanding execution. Its technology converts Zend bytecode into a Pythonic model, simplifying the analysis of obfuscated PHP code that is hard to interpret at the source level. This is especially useful for obfuscated code with goto statements or encoded files using loaders, granting access to control flow, variables, and call sites even when the source is obscured.

eptalights.com · 7 min

TLDR InfoSec

SPEKTION (PRODUCT LAUNCH)

Spektion provides vulnerability analysis for an organization's entire software inventory, leveraging runtime behavior analysis to provide detailed information on real risks and enable customers to prioritize and mitigate flaws, even those without CVEs or patches.

spektion.com

TLDR InfoSec

LLMS CAN'T STOP MAKING UP SOFTWARE DEPENDENCIES AND SABOTAGING EVERYTHING

AI coding assistants often hallucinate non-existent software packages, creating a security vulnerability called "slopsquatting." Attackers exploit this by creating malicious packages using these hallucinated names, so it is recommended for developers to double-check the package they are installing is the correct one.

theregister.com · 5 min

TLDR InfoSec

10 BUGS FOUND IN PERPLEXITY AI'S CHATBOT ANDROID APP

Researchers have found ten critical security flaws in Perplexity AI's Android app, including hardcoded API keys, network vulnerabilities, and weak authentication. These issues could allow attackers to bypass security measures and access user data. Experts recommend that Android users immediately uninstall the app until these easily exploitable vulnerabilities are fixed.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

A NEXT-GENERATION CERTIFICATE TRANSPARENCY LOG BUILT ON CLOUDFLARE WORKERS

The new static CT API log design simplifies operations and improves integrity for Certificate Transparency systems, serving log data efficiently to reduce costs and enhance availability. Cloudflare's Azul implementation on Workers further streamlines the process for CT log operators.

blog.cloudflare.com · 16 min

TLDR InfoSec

CHINA ADMITTED ITS ROLE IN VOLT TYPHOON CYBERATTACKS ON U.S. INFRASTRUCTURE

China acknowledged its involvement in cyberattacks on US infrastructure, which were interpreted as a warning over US support for Taiwan, during a secret meeting with US officials.

securityaffairs.com · 2 min

TLDR InfoSec

MICROSOFT DEFENDER WILL ISOLATE UNDISCOVERED ENDPOINTS TO BLOCK ATTACKS

Microsoft Defender for Endpoint is trialing a feature that blocks traffic from unidentified endpoints to hinder lateral movement by attackers.

bleepingcomputer.com · 2 min