The Daily Index — Friday, June 20, 2025 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

Management Summit 2025

Summary unavailable

gartner.com

TLDR InfoSec

NORTH KOREA TARGETING INDIAN CRYPTO JOB APPLICANTS WITH MALWARE

Cisco Talos is warning potential crypto job seekers in India of a malware campaign by the North Korean Famous Chollima group. Fake employers are approaching software engineers, marketing employees, and designers with skill-testing pages to apply for positions at cryptocurrency companies like Coinbase, Archblock, and Robinhood. These pages feature ClickFix attacks, which prompt victims to run malicious code to fix errors. The code eventually downloads infostealer malware to steal browser credentials and session tokens.

therecord.media · 2 min

TLDR InfoSec

CHINA-LINKED GROUP SALT TYPHOON BREACHED SATELLITE FIRM VIASAT

The China-linked hacking group Salt Typhoon breached the satellite company Viasat and other global telecom providers. They exploited security flaws in network devices to conduct espionage across multiple countries. Officials confirmed that customer data remained secure and the vulnerabilities were addressed.

securityaffairs.com · 4 min

TLDR InfoSec

DANGEROUS BY DEFAULT: INSECURE GITHUB ACTIONS FOUND IN MITRE, SPLUNK, AND OTHER OPEN SOURCE REPOSITORIES

The `pull_request_target` event is infamous because it opens up room for abuse by running in the context of the base repo with full secrets access and write permissions to the GITHUB_TOKEN. Sysdig found repositories belonging to MITRE, Splunk, and a popular open-source Spotify client that could be hijacked via `pull_request_target` abuse. Sysdig recommends using the `pull_request` event instead, along with workflow splitting and restricting GITHUB_TOKEN permissions to avoid these issues.

sysdig.com · 5 min

TLDR InfoSec

DIGGING TUNNELS: HUNTING ADVERSARIAL CLOUDFLARED INSTANCES

Cloudflared is a popular tunneling service offered by Cloudflare that legitimate organizations or adversaries can utilize to establish persistence. Cloudflared authenticates using tokens that contain the account ID, tunnel ID, and a secret. Ransomware groups often do not vary their Cloudflare accounts, so detecting anomalous tokens or renamed processes can be effective for threat hunting.

sudorem.dev · 10 min

TLDR InfoSec

FRIDA 17.2.0 RELEASED

Frida is a dynamic toolkit for reverse engineering, security research, and runtime analysis across various platforms and languages. Version 17.2.0 focuses on simplifying package discovery with the `frida-pm` CLI tool. The release features a streamlined package manager for easily searching and installing Frida-specific packages using `frida-pm search` and `frida-pm install`, even without Node.js.

frida.re · 3 min

TLDR InfoSec

5 LESSONS LEARNED AS INCIDENT COMMANDER OF THE BIGGEST SECURITY INCIDENT OF MY CAREER

Ryan Cox shares lessons from leading the incident response for a high-stakes incident that stretched about a month. Cox stresses the importance of proactively establishing interdepartmental relationships so that during an incident, you have SMEs that you can rely upon. Cox also reminds incident commanders to avoid diving too deeply into tasks and losing the big picture. Lastly, Cox stresses the importance of having scalable processes around documentation and other often forgotten topics and conducting post-mortem root-cause analysis.

cyberseccafe.com · 7 min

TLDR InfoSec

NO, THE 16 BILLION CREDENTIALS LEAK IS NOT A NEW DATA BREACH

A huge leak of 16 billion credentials was reported, but it is just a collection of old stolen data, not a new breach. These credentials were taken by malware or past hacks and have been shared online for years.

bleepingcomputer.com · 4 min

TLDR InfoSec

FACEBOOK ROLLS OUT PASSKEY SUPPORT TO FIGHT PHISHING ATTACKS

Meta has announced plans to roll out passkey support to its Facebook apps “soon” with Messenger and other apps to follow.

theverge.com · 2 min

TLDR InfoSec

PREDATORY SPARROW BURNS $90 MILLION ON IRANIAN CRYPTO EXCHANGE IN CYBER SHADOW WAR

Hackers linked to Israel's Predatory Sparrow group stole and destroyed over $90 million in cryptocurrency from Iran's largest exchange, Nobitex.

securityweek.com · 3 min

TLDR InfoSec

SCAMMERS INSERT FAKE SUPPORT NUMBERS ON REAL APPLE, NETFLIX, PAYPAL PAGES

Scammers are placing fraudulent customer support numbers on legitimate websites such as Apple, Netflix, and PayPal, using deceptive web addresses to make them look like they're part of the official help pages.

hackread.com · 2 min