The Daily Index — Wednesday, May 14, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

SECURITY FIRM ANDY FRAIN SAYS 100,000 PEOPLE IMPACTED BY RANSOMWARE ATTACK

Security company Andy Frain Services reported a data breach affecting over 100,000 people. Discovered in October 2024, the Black Basta ransomware group claimed responsibility, allegedly stealing 750GB of sensitive files. Impacted individuals are being offered credit monitoring and identity restoration services.

securityweek.com · 2 min

TLDR InfoSec

ATTACKERS PWN CHARTER AIRLINE HELPING TRUMP'S DEPORTATION CAMPAIGN

Charter airline GlobalX reported unauthorized network access on May 5, prompting incident response protocols and cybersecurity expert involvement. As a government deportation contractor, the breach potentially exposed flight records and passenger manifests.

theregister.com · 3 min

TLDR InfoSec

ANALYSIS OF APT37 ATTACK CASE DISGUISED AS A THINK TANK FOR NATIONAL SECURITY STRATEGY IN SOUTH KOREA

The APT37 threat actor from North Korea launched a March 2025 spear phishing campaign, posing as a South Korean national security think tank, which delivered malicious LNK files via Dropbox that ultimately installed the RoKRAT backdoor. Dubbed "Operation: ToyBox Story," the attack employed fileless malware techniques to evade detection, with the RoKRAT backdoor capturing screenshots and system info before encrypting and exfiltrating data to cloud-based command servers. The attackers utilized legitimate cloud services (Dropbox, pCloud, and Yandex) as C2 infrastructure and Russian Yandex email addresses, specifically targeting activists focused on North Korea.

genians.co.kr · 11 min

TLDR InfoSec

A PYTHON IN DISGUISE: UNPACKING PYINSTALLER MALWARE ON MACOS

Attackers use PyInstaller to package malicious Python code into standalone Mach-O executables for macOS, eliminating the need for Python installation. This attack involves bundling obfuscated infostealer code (string reversal, base85 encoding, XOR encryption, and zlib compression) that extracts credentials from password prompts, executes malicious AppleScript, steals from the keychain, and targets cryptocurrency wallets. Upon execution, these binaries create temporary directories with the extracted Python libraries and malicious code, which exist only during the malware's runtime.

jamf.com · 6 min

TLDR InfoSec

FAKE GIF LEVERAGED IN MULTI-STAGE REVERSE-PROXY CARD SKIMMING ATTACK

This blog post examines a sophisticated card-stealing malware that exploited a vulnerability in an outdated Magento eCommerce site. The first stage of the malware injects obfuscated JS onto every page that loads a PHP script, which masquerades as a GIF and sets up a reverse proxy to intercept all requests before modifying the responses to hide its activity and planting a trigger in the user's User Agent. A second tampered file, onestepcheckout[.]phtml, loads the payload out of the User Agent into sessionStorage, and if the trigger is detected, the onestepcheckout injection detonates on the checkout page.

blog.sucuri.net · 7 min

TLDR InfoSec

CYNOMI (PRODUCT LAUNCH)

Cynomi offers virtual CISO agents that can assess a network, plan a set of security policies, make remediation plans, track progress, run analytics to find vulnerabilities in a network, recommend system optimizations, and produce reports on the network's status and health.

cynomi.com

TLDR InfoSec

MARKS & SPENCER CONFIRMS CUSTOMERS' PERSONAL DATA WAS STOLEN IN HACK

During a recent cyberattack, Marks & Spencer confirmed that hackers stole customer data, including names, dates of birth, addresses, phone numbers, and order histories. The retailer is resetting passwords while experiencing ongoing store and online disruptions. DragonForce allegedly claimed responsibility for this and other UK retail hacks.

techcrunch.com · 3 min

TLDR InfoSec

AN OPEN LETTER TO THIRD-PARTY SUPPLIERS

Patrick Opet, CISO of JPMorgan Chase, penned an open letter addressing the increasing prevalence of SaaS as the preferred or exclusive method of distributing third-party software. Opet highlighted issues where third-party suppliers prioritize new features to compete with their competitors over security and where authentication and authorization are blurring together, leading to architectural vulnerabilities and hidden dependencies that the vendors themselves use. He calls on third parties to prioritize security and calls upon practitioners to push back against solutions that do not do so.

jpmorgan.com · 3 min

TLDR InfoSec

AMAZON COGNITO NOW SUPPORTS REFRESH TOKEN ROTATION

Amazon Cognito has announced the release of a new feature that allows customers on the Essentials or Plus tiers to configure automatic refresh token rotation for user pool clients. Before this feature, customers had to choose between long-lived tokens to reduce user friction at the cost of reduced security or short-lived tokens that were more secure but required users to reauthenticate more frequently.

aws.amazon.com · 2 min

TLDR InfoSec

SUSPECTED DOPPELPAYMER RANSOMWARE GROUP MEMBER ARRESTED

A member of the DoppelPaymer ransomware group was arrested in Moldova for ransomware attacks and money laundering targeting organizations in the Netherlands.

securityweek.com · 2 min

TLDR InfoSec

GOOGLE ADDS SUITE OF SECURITY FEATURES TO ANDROID 16

Android 16 enhances security with AI tools to combat scams, malware, and theft, blocking fake messages and warning users during risky calls.

cyberscoop.com · 3 min

TLDR InfoSec

NEW EU VULNERABILITY DATABASE WILL COMPLEMENT CVE PROGRAM, NOT COMPETE WITH IT, SAYS ENISA

The EU has introduced a vulnerability database (EUVD) to complement the U.S.-based CVE system by tracking security flaws pertinent to Europe and aiding new cybersecurity regulations.

csoonline.com · 3 min