The Daily Index — Monday, August 25, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

OVER 300 ENTITIES HIT BY A VARIANT OF ATOMIC MACOS STEALER IN RECENT CAMPAIGN

Over 300 entities were infected by SHAMOS, a variant of the Atomic macOS Stealer (AMOS), through malvertising campaigns between June and August. The malware steals passwords stored in Keychain, browser data, cryptocurrency wallets, and other sensitive information from infected macOS systems. The campaign used malicious advertisements to distribute the stealer, targeting Mac users with fake software downloads.

securityaffairs.com · 1 min

TLDR InfoSec

90K EXPOSED AFTER SLEEP THERAPY PROVIDER DATA BREACH

CPAP Medical Supplies, a company that serves mainly military personnel, suffered a hack between December 13 and 21 that exposed over 90,000 individuals' sensitive data. The breach created risks of identity and medical fraud. Affected customers have been offered monitoring services. CPAP Medical Supplies has stressed that there has been no evidence of misuse so far.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

THE SILENT, FILELESS THREAT OF VSHELL

Attackers embed base64-encoded Bash commands in RAR filenames that run automatically during directory listing with unsafe patterns like eval "echo $f" or for f in *. The attack downloads loaders specific to architecture that fetch XOR-encrypted VShell backdoor payloads, decrypts them in memory, and executes as fake kernel threads such as [kworker/0:2] to evade detection. This method bypasses defenses because antivirus doesn't scan filenames, the malware doesn't touch disk after decryption, and execution happens via common shell operations without needing executable permissions.

trellix.com · 8 min

TLDR InfoSec

HOW TO CREATE A SECURE CI/CD PIPELINE USING OKTA TERRAFORM

This post walks through how to set up a CI/CD pipeline using Terraform and GitHub Actions to manage Okta resources. The pipeline is configured to use AWS for remote state storage and storing the secrets for accessing Okta.

developer.okta.com · 18 min

TLDR InfoSec

DO CLAUDE CODE SECURITY REVIEWS PASS THE VIBE CHECK?

Anthropic's Claude platform has introduced AI-powered code security reviews, which can make detecting common vulnerabilities easier and more integrated for developers. While these tools provide helpful automation for identifying issues like SQL injection and authentication flaws, they are not foolproof and miss complex bugs. Human expertise, comprehensive security practices, and additional testing are still necessary to achieve safe and secure application development in the fast-evolving landscape of AI-assisted coding.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

INTRODUCING UNIT 42'S ATTRIBUTION FRAMEWORK

Unit 42's three-tier attribution framework tracks threats from activity clusters to named threat actors, requiring rigorous evidence like Diamond Model mapping and Admiralty System scoring for source reliability (A-F) and credibility (1-6). It mandates six-month observation, multiple sources, and TTP analysis before tier promotion, preventing premature attribution and enabling focused tracking. Default scores apply to common artifacts, with analyst adjustments and review board validation.

unit42.paloaltonetworks.com · 16 min

TLDR InfoSec

TINY QUANTUM DOTS UNLOCK THE FUTURE OF UNBREAKABLE ENCRYPTION

Physicists from Hebrew University and Los Alamos Labs developed quantum encryption using imperfect quantum dot light sources, outperforming traditional laser-based systems by extending secure transmission distances by over 3 dB. The breakthrough employs a truncated decoy state and heralded purification protocols to filter multi-photon emissions in real time, removing the need for perfect single-photon sources for 40 years. Room-temperature tests showed the approach works with existing equipment, making quantum-secure communication more practical and affordable.

sciencedaily.com · 3 min

TLDR InfoSec

EX-DEVELOPER JAILED FOUR YEARS FOR SABOTAGING OHIO EMPLOYER WITH KILL-SWITCH MALWARE

A former developer for an Ohio company was sentenced to four years for deploying malicious code and a kill switch that caused global outages after he lost access. His actions cost the company hundreds of thousands, highlighting the threat of insider sabotage.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

HONEY, I SHRUNK THE IMAGE AND NOW I'M PWNED

Security researchers found that Google Gemini-powered tools can be deceived by hidden prompts embedded in images, exploiting image scaling for prompt injection. This trick can cause AI to leak data or act out of bounds. Google says it's not a default vulnerability, but experts urge stronger AI system defenses and user previews.

theregister.com · 4 min

TLDR InfoSec

KIDNEY DIALYSIS FIRM DAVITA CONFIRMS RANSOMWARE ATTACK COMPROMISED DATA OF 2.7M PEOPLE

DaVita, a kidney dialysis provider, confirmed that a ransomware attack exposed personal and health information of 2,689,826 individuals, as reported to the Department of Health's Office for Civil Rights.

securityaffairs.com · 3 min

TLDR InfoSec

AWS TRUSTED ADVISOR TRICKED INTO SHOWING UNPROTECTED S3 BUCKETS AS SECURE

Researchers found a way to trick AWS Trusted Advisor into not warning about unsecured S3 buckets by denying access to certain checks.

securityweek.com · 2 min

TLDR InfoSec

INTERPOL CYBERCRIME CRACKDOWN IN AFRICA LEADS TO THE ARREST OF OVER 1,200 SUSPECTS

Interpol's Operation Serengeti 2.0 led to 1,209 arrests across Africa, recovering $97.4 million and dismantling major cybercrime schemes.

abcnews.go.com · 2 min