The Daily Index — Wednesday, June 18, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKERS ARE USING GOOGLE.COM TO DELIVER MALWARE BY BYPASSING ANTIVIRUS SOFTWARE

Researchers from c/side are reporting on a new attack vector that abuses Google OAuth links to bypass detection. The attack begins in a compromised Magento e-commerce portal, which includes an OAuth logout with a callback parameter containing an obfuscated JavaScript payload. The code will only activate under certain conditions, such as if the URL includes the word “checkout.”

techradar.com · 3 min

TLDR InfoSec

GOOGLE CHROME ZERO-DAY CVE-2025-2783 EXPLOITED BY TAXOFF TO DEPLOY TRINPER BACKDOOR

TaxOff threat actors exploited a Google Chrome zero-day vulnerability (CVE-2025-2783) in March to deploy the Trinper backdoor through phishing emails disguised as forum invitations. The backdoor, written in C++, uses multithreading to steal files, capture keystrokes, and maintain command-and-control communications with remote servers. Google patched the vulnerability after Kaspersky reported the exploitation. Researchers suspect TaxOff may be connected to another hacking group called Team46 based on similar attack patterns.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

STARTING A SECURITY PROGRAM FROM SCRATCH (OR RE-STARTING)

This post provides a roadmap for growing a new or existing program through four phases of maturity. The first phase focuses on establishing the basics by appointing a Head of Security, establishing a governance process, conducting a breach assessment, and acting on the most critical results. The second phase focuses on comparing the organization's current state with established frameworks, developing a plan to close gaps, hiring MSSPs, and building a team. Phases 3 and 4 focus on furthering organizational maturity by establishing program management and aligning with business objectives, establishing continuous monitoring and guardrails, increasing resiliency, and training the team.

philvenables.com · 12 min

TLDR InfoSec

FUZZING DEFENDER'S SCANNING AND EMULATION ENGINE

Summary unavailable

labs.infoguard.ch · 10 min

TLDR InfoSec

SECURE ENCLAVES FOR OFFENSIVE OPERATIONS (PART II)

This post demonstrates how to exploit vulnerable Windows Secure Enclaves (VBS) by leveraging read-write primitives to achieve VTL1 code execution through ROP chaining and function table manipulation. It shows how CVE-2023-36880 and CVE-2024-21423 can be exploited in Microsoft Edge's preferences enclave to patch the VertValidTargetTable, enabling arbitrary function calls within the secure environment. The research resulted in practical sleep masking techniques for malware that hide implant memory from EDR detection by storing code in VTL1 while the implant sleeps, which has been integrated into the Outflank C2 and Beacon Booster tools.

outflank.nl · 15 min

TLDR InfoSec

META IS BRINGING ADS TO WHATSAPP. PRIVACY EXPERTS ARE SOUNDING THE ALARMS

Meta is adding targeted ads to WhatsApp's Updates feature. Despite the company reassuring users that the ads will only use data such as location and language and that messages remain end-to-end encrypted, many privacy experts expressed concern due to previous privacy issues with Meta's apps.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

CYBER EXPERTS CALL FOR SUPERCHARGING VOLUNTEER NETWORK TO PROTECT COMMUNITY ORGANIZATIONS

Cyberattacks often target community groups like hospitals and schools that lack the resources to defend themselves. Experts say stronger support from the government, private companies, and volunteers is needed to protect them. A new report calls for expanding cyber volunteer networks and creating shared security services.

cyberscoop.com · 4 min

TLDR InfoSec

YES, WALLETS CAN BE HACKED TOO

Mobile wallets like Apple Pay are safer than cards, but they can still be hacked. Thieves can use features like Express Transit mode to steal money, even from locked phones. Users should turn off risky features and use strong security settings to stay safe.

paymentvillage.substack.com · 2 min

TLDR InfoSec

HACKLINK MARKET LINKED TO SEO POISONING ATTACKS IN GOOGLE RESULTS

Hackers exploit a black market known as Hacklink to embed deceptive links in reputable websites, manipulating Google to elevate malicious or fraudulent sites in search rankings.

hackread.com · 3 min

TLDR InfoSec

PADDLE SETTLES FOR $5 MILLION OVER FACILITATING TECH SUPPORT SCAMS

Paddle will pay $5 million to settle charges that it helped scammers trick people into buying fake tech support.

bleepingcomputer.com · 3 min