The Daily Index — Tuesday, September 2, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

GOOGLE WARNS THAT MASS DATA THEFT HITTING SALESLOFT AI AGENT HAS GROWN BIGGER

The data theft affecting Drift AI, a Salesloft tool, is more extensive than initially reported. Attackers used compromised credentials to access Google Workspace emails, and as a result, all Salesloft Drift integrations are now considered potentially compromised. Organizations must revoke and rotate all connected credentials and check for unauthorized access.

arstechnica.com · 3 min

TLDR InfoSec

FRAUDSTER STOLE OVER $1.5 MILLION FROM CITY OF BALTIMORE

A fraudster stole $1.5 million from Baltimore between February and March by pretending to be a vendor employee, hacking into the vendor's Workday account, and convincing AP staff to redirect bank details. The city recovered $721,000, but cannot recover $803,000 despite insurance claims and reissued payments. This is Baltimore's third instance of vendor fraud since 2019, highlighting ongoing weaknesses in financial controls following losses of $62,000 in 2019 and $376,000 in 2022.

securityaffairs.com · 2 min

TLDR InfoSec

RAGE AGAINST THE AUTHENTICATION STATE MACHINE

Researchers discovered an authentication bypass (CVE-2024-28080) in Gitblit's SSH service that allows attackers to log in without requiring a user's private key or password, only needing the username and public key. This post analyzes how the vulnerability arose, detailing the SSH login handshake and highlighting where the implementation deviates from secure best practices with Apache MINA SSHD.

blog.silentsignal.eu · 6 min

TLDR InfoSec

CVSS IS BUILT FOR CODE, NOT AI AGENTS. NOW AIVSS CLOSES THE GAP

Traditional CVSS scores fail to address the unique risks posed by autonomous AI agents. The new AIVSS framework extends CVSS by evaluating behavioral factors—such as autonomy, tool access, and memory use—enabling security teams to measure and manage the risks of agentic AI systems more effectively, aligning with modern security frameworks like NIST AI RMF.

checkmarx.com · 4 min

TLDR InfoSec

THE RESURGENCE OF IOT MALWARE: INSIDE THE MIRAI-BASED BOTNET CAMPAIGN

The Gayfemboy botnet exploits vulnerabilities in DrayTek, TP-Link, Raisecom, and Cisco devices to deploy a Mirai-variant that uses modified UPX packing, custom architecture naming schemes, and hardcoded process termination lists to eliminate competing malware infections. The malware implements sophisticated evasion techniques, including 50-nanosecond sandbox delays, utilizes public DNS servers (1.1.1.1, 8.8.8.8) to bypass local filtering, and scans 15 predefined ports for C2 communication with domains such as cross-compiling[.]org and i-kiss-boys[.]com. Organizations should implement network monitoring for unusual DNS queries to public resolvers, deploy IPS signatures for the listed CVEs, and monitor for processes attempting to bind to UDP port 47272 or exhibiting the malware's distinctive process termination behavior.

fortinet.com · 7 min

TLDR InfoSec

START ACCELERATING SECURE APPLICATION DEVELOPMENT

Cortex Cloud ASPM is a prevention-first application security module that integrates with AppSec tools, such as Snyk, GitLab, and Checkmarx, to block vulnerabilities before they reach production. The platform offers automated remediation, inline IDE fixes, and correlates findings across code, cloud, and runtime to prioritize risks over false alarms. In early access, with general availability in H2 2025, it claims to be 10 times faster and more cost-effective than traditional reactive security.

paloaltonetworks.com · 3 min

TLDR InfoSec

FBI CYBER COP: SALT TYPHOON PWNED 'NEARLY EVERY AMERICAN'

The Chinese hacking group Salt Typhoon has infiltrated U.S. telecoms, stealing personal data from nearly every American and millions globally since 2019. FBI officials say the scale and indiscriminate nature of the campaign are unprecedented, affecting at least 80 countries, 200 U.S. organizations, and high-profile political figures.

theregister.com · 4 min

TLDR InfoSec

SCARCRUFT USES ROKRAT MALWARE IN OPERATION HANKOOK PHANTOM TARGETING SOUTH KOREAN ACADEMICS

North Korean APT37 (ScarCruft) carried out Operation HanKook Phantom using spear-phishing emails with malicious LNK files disguised as PDFs to deliver RokRAT malware to South Korean research targets. The attack utilized fake newsletter lures from the National Intelligence Research Association, employing PowerShell scripts and fileless techniques to exfiltrate data via Dropbox, Google Cloud, and Yandex. This campaign shows APT37's focus on espionage against the South Korean government, research, and academic targets.

thehackernews.com · 4 min

TLDR InfoSec

WHISTLEBLOWER SAYS TRUMP OFFICIALS COPIED MILLIONS OF SOCIAL SECURITY NUMBERS

A whistleblower at the Social Security Administration (SSA) stated that a former senior DOGE official, now at the SSA, copied the Social Security Numbers (SSNs), names, and dates of birth of over 300 million Americans to a private section of the agency's AWS cloud environment. The complaint states that the cloud environment was set up for DOGE-affiliated Social Security staffers but lacks independent security, monitoring, and oversight. The complaint also alleges that cybersecurity officials within the SSA described the decision to copy the data as “very high risk” and discussed the possibility of having to reissue SSNs in the event of a breach.

npr.org · 3 min

TLDR InfoSec

OPENSSH 10.1 WILL WARN THE USER WHEN A NON POST-QUANTUM KEY AGREEMENT SCHEME IS SELECTED

OpenSSH 10.1 will warn users when connecting to servers that use non-post-quantum key agreement schemes, encouraging migration to quantum-resistant cryptography such as mlkem768x25519-sha256 and sntrup761x25519-sha512 to protect against future "store now, decrypt later" attacks.

openssh.com · 1 min

TLDR InfoSec

THE $69 BILLION DOMINO EFFECT: HOW VMWARE'S DEBT-FUELED ACQUISITION IS KILLING OPEN SOURCE, ONE REPOSITORY AT A TIME

Summary unavailable

fastcode.io · 10 min

TLDR InfoSec

HACKER SUSPECTED OF TRYING TO CHEAT HIS WAY INTO UNIVERSITY IS ARRESTED IN SPAIN

Spanish police arrested a 21-year-old suspected hacker in Seville for allegedly compromising at least 13 university professors' accounts on the Andalusia region's Séneca educational platform to alter his own and classmates' high school and university entrance exam grades.

bitdefender.com · 2 min