The Daily Index — Thursday, June 12, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

MIRAI BOTNETS EXPLOITING WAZUH SECURITY PLATFORM VULNERABILITY

Researchers from Akamai are warning of two Mirai botnet campaigns exploiting a remote code execution vulnerability in the open-source security platform Wazuh. The first campaign has been active since March and uses a malicious shell script to download the Mirai payload. The second campaign seems to be targeting Italian-speaking users.

securityweek.com · 2 min

TLDR InfoSec

ZERO-CLICK AI DATA LEAK FLAW UNCOVERED IN MICROSOFT 365 COPILOT

Researchers from AIM Labs discovered an attack against Microsoft 365 Copilot, an AI assistant built into Office apps, that allowed for the leaking of sensitive data. The attack involved embedding a hidden prompt in an email which bypasses Microsoft's cross-prompt injection attack classifier because it is phrased as text to a human. Later when the user requests Copilot's RAG engine to retrieve data from the email, the prompt is interpreted and injected into the LLM.

bleepingcomputer.com · 3 min

TLDR InfoSec

THE FIVE SECURITY PRINCIPLES DRIVING OPEN SOURCE SECURITY APPS AT SCALE

AI has revolutionized cybersecurity innovation, enabling startups to develop products and rapidly disrupt legacy providers. However, a paradox exists between fostering innovation and managing security vulnerabilities and compliance costs. Successful startups embed governance strategically, automate security with AI, contribute purpose-built tools, and prioritize community building for long-term advantage.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

A BIT MORE ON TWITTER/X'S NEW ENCRYPTED MESSAGING

X's XChat messaging protocol uses flawed end-to-end encryption. It lacks forward secrecy, and stores user private keys on X's servers using Juicebox protocol across three software-based servers (not HSMs). This allows X to potentially decrypt messages for internal purposes or legal compulsion, making XChat's encryption largely ineffective against surveillance.

blog.cryptographyengineering.com · 14 min

TLDR InfoSec

COMPLEX NPM ATTACK USES 7+ LAYERS OF OBFUSCATION TO SPREAD PULSAR RAT

Researchers from Veracode detected a malicious NPM package called “solders” which uses a post-install hook to run the malicious lib.js file without user interaction. The lib.js file obfuscates the first layer using JavaScript type coercion to build up the strings from Japanese Unicode. The decoded string then uses hex encoding, array shuffling, and binary array encoding to build a base64 encoded PowerShell script that downloads a batch script that utilizes string reordering, 3DES encryption, and steganography.

scworld.com · 4 min

TLDR InfoSec

MAZE (PRODUCT LAUNCH)

Maze is building technology that models the workflow of an experienced analyst, where each agent ingests telemetry from a customer's public cloud accounts, reproduces the steps an attacker would take to move laterally, and then either closes the gap automatically or flags a concise set of exploitable weaknesses.

mazehq.com

TLDR InfoSec

THE 18-POINT SECRETS MANAGEMENT CHECKLIST

A roadmap from Hashicorp on how an organization can mature in its secrets management process. The guide is broken up into the adopting stage, where secrets management is first integrated; the standardizing stage, where automatic secrets rotation and compliance are introduced; and the scaling stage, where operations are scaled up and more services like PKI are managed. Each stage is broken up into three categories with actionable checklist items.

hashicorp.com · 7 min

TLDR InfoSec

SMARTATTACK USES SMARTWATCHES TO STEAL DATA FROM AIR-GAPPED SYSTEMS

SmartAttack is a new method that uses smartwatches to steal data from air-gapped computers secretly using ultrasonic sound. The attack needs malware on the computer and a nearby smartwatch to receive hidden audio signals. Experts suggest banning smartwatches and removing computer speakers from secure areas to stop this.

bleepingcomputer.com · 3 min

TLDR InfoSec

THE EVOLUTION OF LINUX BINARIES IN TARGETED CLOUD OPERATIONS

Unit 42 researchers identified five actively evolving Linux ELF malware families (NoodleRAT, Winnti, SSHdInjector, Pygmy Goat, and AcidPour) that threat actors are adapting to target cloud infrastructure, with cloud-based security alerts increasing 388% in 2024. These malware strains use techniques like dynamic linker hijacking and SSH daemon injection to achieve persistence, command and control, and data exfiltration in Linux-based cloud environments that comprise 70-90% of cloud computing instances. Palo Alto Networks' new machine learning detection module successfully identified 92% of tested ELF malware samples, demonstrating the effectiveness of ML-based approaches for detecting these evolving cloud threats.

unit42.paloaltonetworks.com · 7 min

TLDR InfoSec

INTERPOL DISMANTLES 20,000+ MALICIOUS IPS LINKED TO 69 MALWARE VARIANTS IN OPERATION SECURE

INTERPOL conducted a global operation across 26 countries to shut down over 20,000 malicious IPs associated with 69 types of data-stealing malware, resulting in the arrest of 32 suspects and the seizure of servers and data.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKERS TARGET RECRUITERS, POSING AS JOB SEEKERS AND SENDING MALICIOUS RESUMES

Hackers are deceiving recruiters by masquerading as job seekers and submitting fake resumes that contain harmful files, which can compromise a company's system when opened.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

40,000 SECURITY CAMERAS EXPOSED TO REMOTE HACKING

Over 40,000 security cameras globally are accessible online, enabling hackers to potentially view or exploit live footage, particularly in homes and offices where security is often weak or non-existent.

securityweek.com · 2 min