The Daily Index — Wednesday, July 9, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MASSIVE BROWSER HIJACKING CAMPAIGN INFECTS 2.3M CHROME, EDGE USERS

A popular Chrome color picker extension with 100,000+ downloads and Google's verified badge secretly hijacks browsers, tracks user activity, and creates backdoors. It's part of "RedDirection," a campaign involving 18 malicious extensions that infected 2.3 million users.

theregister.com · 3 min

TLDR InfoSec

ANATSA ANDROID BANKING TROJAN HITS 90,000 USERS WITH FAKE PDF APP ON GOOGLE PLAY

Anatsa banking malware targeted North American users through a malicious "Document Viewer" app on the Google Play Store that was downloaded 90,000 times. The Trojan, disguised as a PDF, updates displays with fake maintenance notices during banking app access while stealing credentials through overlays and keylogging.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ADVANCING PROTECTION IN CHROME ON ANDROID

Google's Android Advanced Protection now integrates with Chrome to enhance security for high-risk users, such as journalists and officials. It provides three key features: enforcing HTTPS everywhere, full site isolation on devices with 4GB+ RAM to prevent data leaks, and disabling JavaScript optimizations that are often exploited in V8 security bugs. These options, which have performance trade-offs, can be enabled by enterprises and users through Chrome's privacy settings and policies outside of Advanced Protection.

security.googleblog.com · 6 min

TLDR InfoSec

LEAN AND MEAN: HOW WE FINE-TUNED A MODEL FOR SECRET DETECTION IN CODE

Wiz developed a small language model based on Llama 3.2 1B to detect secrets in code. It utilized Claude Sonnet 3.7 to create a training dataset of secrets based on scans of public GitHub repositories. It then fine-tuned Llama 3.2 1B using Low-Rank Adaptation (LoRA) and quantization, achieving an 82% recall rate and an 85% precision rate on commercial CPUs.

wiz.io · 9 min

TLDR InfoSec

AI-Native Trust Management with Drata

Summary unavailable

try.drata.com

TLDR InfoSec

SATANLOCK RANSOMWARE ENDS OPERATIONS, SAYS STOLEN DATA WILL BE LEAKED

The SatanLock ransomware group, which was first identified in early April, has announced that it will shut down and leak all stolen data. In a report by Check Point in May, it was highlighted that more than 65% of SatanLock's victims had already appeared on leak sites run by other ransomware groups, suggesting that the group might be attempting to “reclaim” already compromised networks. SatanLock did not provide any reason for its sudden closure but has removed all victim listings from its .onion site.

hackread.com · 2 min

TLDR InfoSec

HACKERS ABUSE LEAKED SHELLTER RED TEAM TOOL TO DEPLOY INFOSTEALERS

Shellter, a commercial AV/EDR evasion loader for penetration testing, confirmed that hackers were using its Shellter Elite product in attacks after a customer leaked a copy of the software. Shellter has stated that it released updates that would not reach the “malicious customer” to combat the misuse. The leaked copy was first discovered by Elastic Security Labs, who discovered that multiple threat actors had been abusing Shellter Elite v11.0 to deploy infostealers.

bleepingcomputer.com · 2 min

TLDR InfoSec

EXPOSING SCATTERED SPIDER: NEW INDICATORS HIGHLIGHT GROWING THREAT TO ENTERPRISES AND AVIATION

Scattered Spider uses domains that mimic corporate portals and employs sophisticated social engineering and MFA fatigue to launch its attacks.

blog.checkpoint.com · 4 min

TLDR InfoSec

IMPOSTOR USES AI TO IMPERSONATE RUBIO AND CONTACT FOREIGN AND US OFFICIALS

The State Department issued a warning to all US embassies after discovering AI-powered impersonators posing as Secretary of State Marco Rubio contacted foreign ministers, a US senator, and a governor via text, Signal, and voicemail messages.

securityweek.com · 3 min

TLDR InfoSec

M&S CONFIRMS SOCIAL ENGINEERING LED TO MASSIVE RANSOMWARE ATTACK

M&S revealed that cybercriminals used advanced social engineering tactics to impersonate an employee and manipulate Tata Consultancy Services into resetting a password, resulting in a DragonForce ransomware attack that encrypted VMware ESXi servers and exfiltrated around 150GB of data, though the company declined to confirm if the ransom was paid.

bleepingcomputer.com · 3 min