The Daily Index — Monday, June 9, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

'PATHWIPER' ATTACK HITS CRITICAL INFRASTRUCTURE IN UKRAINE

Cisco Talos discovered "PathWiper," a new Russian wiper malware targeting Ukrainian critical infrastructure through legitimate endpoint administration frameworks. Unlike previous wipers, PathWiper programmatically identifies all connected drives and network paths via APIs before overwriting data with random bytes, potentially more destructive than tools like HermeticWiper used in earlier attacks.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

LARGEST EVER DATA LEAK EXPOSES OVER 4B RECORDS

Researchers have discovered an open 613GB database containing over 4 billion records. The database contained numerous data collections, including an 805M record database of WeChat records, a 780M record database of addresses and geographic data, banking information, and MFA devices. However, the researchers could not analyze the dataset comprehensively as it was taken down soon after discovery.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

VIBE CODING IS HERE TO STAY. CAN IT EVER BE SECURE?

AI tools are making it easier and faster for people to write code, even with little experience. However, many experts worry that this “vibe coding” approach will pose serious security risks. While AI coding grows fast, it still struggles to make safe and reliable software.

cyberscoop.com · 7 min

TLDR InfoSec

BUSINESS EMAIL COMPROMISE CHECK LIST

A Business Email Compromise (BEC) incident response checklist for Office 365 outlines four phases: isolate the compromised account, contain the threat by resetting credentials and removing unauthorized configurations, eradicate traces of the attacker, and assess impact by reviewing sent emails and shared files. The response includes immediate actions like disabling accounts and changing passwords, followed by forensic analysis, stakeholder notification, and required regulatory reporting. Prevention through proper security measures is easier than incident response, but organizations must learn from incidents to strengthen defenses.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

THE COST OF A CALL: FROM VOICE PHISHING TO DATA EXTORTION

Google Threat Intelligence Group (GTIG) reports on threat activity from a group tracked as UNC6040. The group uses vishing to impersonate IT support personnel in convincing attacks targeting employees in multinational corporations into granting access or sharing credentials to their Salesforce platform. In many campaigns, the threat actors convince the victim to add a modified version of the bulk data import tool, Salesforce Data Loader, which is modified to send the data to an attacker-controlled infrastructure.

cloud.google.com · 7 min

TLDR InfoSec

MIND (PRODUCT LAUNCH)

Mind provides real-time detection capabilities, instantly blocking malicious and inadvertent attempts to exfiltrate sensitive information from an organization's environment.

mind.io

TLDR InfoSec

US OFFERING $10 MILLION REWARD FOR REDLINE MALWARE DEVELOPER

The US State Department is offering up to $10 million for information on Maxim Alexandrovich Rudometov, the alleged developer of RedLine malware that steals credentials and financial data. RedLine infrastructure was disrupted in October 2024, but the malware may remain active.

securityweek.com · 2 min

TLDR InfoSec

ITALIAN LAWMAKERS SAY ITALY USED SPYWARE TO TARGET PHONES OF IMMIGRATION ACTIVISTS, BUT NOT AGAINST JOURNALIST

Summary unavailable

techcrunch.com · 5 min

TLDR InfoSec

MANDIANT FLAGS FAKE AI VIDEO GENERATORS LACED WITH MALWARE

Mandiant has detected a new malware campaign that utilizes social media ads to distribute infostealers and backdoors. The campaign is spread by advertising free access to popular AI video generators such as Luma AI, Canva Dream Lab, and Kling AI. After the user inputs a prompt, they are served with one of the static malicious payloads that the site hosts.

cyberscoop.com · 2 min

TLDR InfoSec

OVER 20 MALICIOUS APPS ON GOOGLE PLAY TARGET USERS FOR SEED PHRASES

More than 20 fraudulent crypto wallet apps on Google Play were identified as stealing users' recovery phrases to access their cryptocurrency funds.

hackread.com · 3 min

TLDR InfoSec

POPULAR CHROME EXTENSIONS FOUND LEAKING DATA VIA UNENCRYPTED CONNECTIONS

Popular Chrome extensions were discovered to leak user data via unencrypted HTTP connections, exposing users to spying and cyber threats, particularly on public Wi-Fi.

hackread.com · 3 min