The Daily Index — Monday, July 7, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

RECRUITING SOFTWARE MAKER EXPOSES NEARLY 26M RESUMES

TalentHook, a cloud-based applicant tracking system, accidentally exposed the resumes of nearly 26M applicants. Cybernews found an open Azure Blob Storage container with files. The exposed data includes names, emails, addresses, education, and employment history.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

INGRAM MICRO OUTAGE CAUSED BY SAFEPAY RANSOMWARE ATTACK

Ingram Micro, a business-to-business technology distributor, has been suffering an outage since Thursday. The outage was caused by the SafePay ransomware. The threat actors breached the company through its GlobalProtect VPN.

bleepingcomputer.com · 2 min

TLDR InfoSec

YET ANOTHER ZIP TRICK WRITEUP

This write-up explains how to create a "schizophrenic ZIP file". This type of ZIP file appears differently depending on the parser used. The trick relies on how parsers locate the Central Directory, with some using the offset field and others calculating it from the size. As a result, each method points to different Central Directories containing different file content, allowing the same ZIP file to display different contents depending on which parser opens it. This enables malicious files to be opened without the user's knowledge.

husseinmuhaisen.com · 6 min

TLDR InfoSec

RULES FILES FOR SAFER VIBE CODING

Studies have shown that code generated by LLMs contains many security vulnerabilities. Developers should move security earlier in the development process by creating rules files for IDEs like Cursor, which include security guardrails and instructions. This post offers guidance on writing prompts for these rules files. Early research indicates that simply adding the word “secure” to a prompt can significantly reduce vulnerabilities.

wiz.io · 5 min

TLDR InfoSec

PROFILING TRADETRAITOR: TACTICS, HISTORY & DEFENSES

TradeTraitor, a North Korean threat actor, has stolen over $2.4 billion through social engineering and cloud attacks, compromising developer credentials to inject malicious code and reroute ETH. Its attacks involve harvesting AWS tokens, injecting JavaScript into cloud applications, with defenses including short-lived tokens, full CloudTrail logs, MFA, and credential monitoring.

invictus-ir.com · 5 min

TLDR InfoSec

COMPYL (PRODUCT LAUNCH)

Compyl provides solutions for compliance, asset management, contract management, policy management, user access reviews, and risk management (including vendor risk).

compyl.com

TLDR InfoSec

MASSIVE SPIKE IN USE OF .ES DOMAINS FOR PHISHING ABUSE

Cybersecurity experts report a 19-fold increase in malicious campaigns using Spain's .es domains, making it the third most abused after .com and .ru. Since January, 1,373 subdomains on 447 .es domains have hosted malicious content, with 99% of it focused on credential phishing, targeting Microsoft users via fake HR-themed emails.

theregister.com · 3 min

TLDR InfoSec

GOOGLE ORDERED TO PAY $314M FOR MISUSING ANDROID USERS' CELLULAR DATA WITHOUT PERMISSION

A California court has ordered Google to pay $314 million for illegally using Android users' cellular data without consent. The lawsuit revealed that Google transferred device information even when phones were idle, which used up users' data allowances. Google intends to appeal this ruling.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

INSTAGRAM USES EXPIRING CERTIFICATES AS SINGLE DAY TLS CERTIFICATES

While testing a personal tool, the author of this post noticed that certificates for instagram.com had unusual expiration times. The author set up a machine that attempted to pull the certificates for instagram.com and www.instagram.com every 5 minutes. They discovered that Instagram uses certificates with a lifetime of 8 days, replaces them daily, and uses unique certificates for instagram.com and www.instagram.com.

hereket.com · 4 min

TLDR InfoSec

CHINA-LINKED GROUP HOUKEN HIT FRENCH ORGANIZATIONS USING ZERO-DAYS

A China-linked hacking group called Houken exploited three zero-day vulnerabilities in Ivanti Cloud Service Appliance devices to breach French government, telecom, media, finance, and transport organizations starting in September 2024, using sophisticated tools and rootkits to steal credentials and maintain persistent access.

securityaffairs.com · 2 min

TLDR InfoSec

CALLERS POSING AS ATF AGENTS USE 'APPLE GIFT CARDS' SCAM

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) warns the public about scammers pretending to be federal agents demanding Apple gift cards of $500 or $1,000 to "clear red flags" from accounts, stressing that real federal agencies never ask for payments via gift cards, wire transfers, or cryptocurrency.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

IDEALAB CONFIRMS DATA STOLEN IN RANSOMWARE ATTACK LAST YEAR

IdeaLab, a California tech incubator, suffered a data breach in October 2024 when hackers stole sensitive information.

bleepingcomputer.com · 2 min