The Daily Index — Thursday, June 19, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

'STARGAZERS' USE FAKE MINECRAFT MODS TO STEAL PLAYER PASSWORDS

Check Point Research discovered a campaign conducted by the Stargazers Ghost Network that leverages approximately 500 different GitHub repositories to target Minecraft players with trojanized and malicious mods. The mods contain a JAR loader which downloads the Java-based stealer from Pastebin. The stealer attempts to steal Minecraft account tokens, data from popular third-party launchers, and Discord and Telegram account tokens before acting as a loader for a traditional info stealer which attempts to steal information from web browsers, VPN account data, cryptocurrency wallets, etc.

bleepingcomputer.com · 2 min

TLDR InfoSec

AGENTSMITH FLAW IN LANGSMITH'S PROMPT HUB EXPOSED USER API KEYS, DATA

Noma Security researchers discovered the "AgentSmith" vulnerability (CVE score 8.8) in LangChain's LangSmith platform, allowing malicious AI agents in the public Prompt Hub to steal sensitive user data, including OpenAI API keys, through hidden proxy configurations. When users adopted and ran these compromised agents, all their communications and private data would be secretly intercepted through the attacker's server in a man-in-the-middle attack, potentially leading to unauthorized account access, data theft, and financial losses. LangChain fixed the vulnerability on November 6, 2024, after responsible disclosure and implemented new safety measures, including warning messages and banners for agents with custom proxy settings.

hackread.com · 2 min

TLDR InfoSec

IMPLEMENTING SIEM AND SOAR PLATFORMS

A 3-part guide to implementing SIEM and SOAR platforms for security professionals and executives. The first part is designed for executives and introduces the concept of SIEM and SOAR, explains how they function, provides guidance for choosing a SIEM, and cautions organizations on attempting to implement a SOAR before properly implementing and testing a SIEM. The second and third parts are for implementers.

cyber.gov.au · 15 min

TLDR InfoSec

GODFATHER ANDROID MALWARE RUNS REAL APPS IN A SANDBOX TO STEAL DATA

Researchers from Zimperium zLabs unveiled a new variant of the GodFather Android malware that uses on-device virtualization to deploy real banking and cryptocurrency apps in a controlled sandbox. This method allows attackers to monitor and steal user credentials stealthily, as the malware disguises itself by installing a hidden host app that redirects users to virtualized versions of these applications. Primarily targeting 12 Turkish financial institutions, the malware affects 484 applications globally and employs overlays and Android accessibility services to enhance control over devices.

hackread.com · 3 min

TLDR InfoSec

THE ROLE OF AI AND COMPLIANCE IN MODERN RISK MANAGEMENT: SHOWMECON 2025

At ShowMeCon 2025 in St. Charles, cybersecurity experts noted that while compliance frameworks like PCI DSS provide necessary structure, they are often treated as mere formalities rather than integral to operational security. They stressed the importance of human oversight in AI-driven policy creation and threat detection, acknowledging that adversaries also use AI for more sophisticated attacks. The key takeaway was that compliance should be a foundational step.

blog.gitguardian.com · 6 min

TLDR InfoSec

TURKEY BUSTS CHINESE SPYING RING USING FAKE CELL TOWERS

Turkish intelligence announced that it caught seven suspects who belonged to a Chinese espionage ring eavesdropping on Uyghurs and Turkish officials. The attackers used IMSI-catcher devices to mimic legitimate mobile phone tower signals to collect data, phone logs, conversations, and other information from nearby phones. The attackers funded their operations by hacking into and draining the bank accounts of Turkish civilians.

middleeasteye.net · 2 min

TLDR InfoSec

A PEEK INTO AN IN-GAME AD CLIENT

Jordan Whitehead delves into reversing the Anzu in-game ad client's usage in the Trackmania racing game. First, Whitehead built a DLL harness to enumerate the functions that Trackmania called from the anzu.dll and iterated on it to uncover further debug information and arguments. He then used mitmproxy to intercept network traffic and was able to utilize this to view the JavaScript functionality that managed targeted ads and replace ad campaigns with his own custom campaigns, serving images from localhost.

atredis.com · 8 min

TLDR InfoSec

GERRIT MISCONFIGURATION EXPOSED GOOGLE PROJECTS TO MALICIOUS CODE INJECTION

Tenable researchers discovered a misconfiguration in Google's Gerrit code collaboration platform that could have allowed attackers to inject malicious code into popular Google projects like ChromiumOS, Bazel, and Dart through supply chain attacks. The vulnerability, dubbed "GerriScary" (CVE-2025-1568), exploited improper permissions for the addPatchSet feature and a race condition in the automated merge process, allowing attackers to modify approved code changes without triggering new reviews. Google fixed the issue across all Chrome/ChromeOS-related projects after Tenable's October 2024 report, awarded a $5,000 bug bounty, and found no evidence of prior exploitation.

securityweek.com · 3 min

TLDR InfoSec

RANSOMWARE GANG BUSTED IN THAILAND HOTEL RAID

Thai police raided the Antai Holiday Hotel in Pattaya, arresting at least 20 foreigners, including six Chinese nationals involved in a ransomware operation targeting Chinese companies, and apprehending around 20 individuals running an illegal gambling ring while seizing laptops, mobile devices, and gambling equipment.

bitdefender.com · 1 min

TLDR InfoSec

LINUX SECURITY: NEW FLAWS ALLOW ROOT ACCESS, CISA WARNS OF OLD BUG EXPLOITATION

Qualys disclosed two new Linux vulnerabilities (CVE-2025-6018 and CVE-2025-6019) that can be chained together to allow unprivileged attackers to gain full root access, while CISA separately warned that an older Linux kernel flaw (CVE-2023-0386) is being actively exploited in the wild.

securityweek.com · 2 min