The Daily Index — Tuesday, September 9, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

GHOSTACTION ATTACK STEALS 3,325 SECRETS FROM GITHUB PROJECTS

The GhostAction supply chain attack compromised 817 GitHub repositories by injecting malicious workflow files that appeared to be routine automation scripts but actually exfiltrated CI/CD secrets to an external server. The campaign affected 327 developers across multiple programming languages, stealing 3,325 secrets, including npm, PyPI, DockerHub tokens, and AWS credentials that could enable further attacks on software supply chains. The attackers personalized each commit and analyzed legitimate workflows to identify which secrets to target. At least 24 projects (9 npm and 15 PyPI) remain at risk from compromised tokens despite no confirmed malicious package releases yet.

hackread.com · 3 min

TLDR InfoSec

OVER 6,700 PRIVATE REPOSITORIES MADE PUBLIC IN NX SUPPLY CHAIN ATTACK

Hackers used stolen secrets from Nx to expose over 6,700 private repositories in a major supply chain attack that targeted hundreds of organizations. The threat actors leveraged malicious Nx packages to steal API keys and credentials, and exploited the compromised accounts to publish sensitive data from private repositories to public GitHub repositories.

securityweek.com · 4 min

TLDR InfoSec

GPUGATE MALWARE: MALICIOUS GITHUB DESKTOP IMPLANTS USE HARDWARE-SPECIFIC DECRYPTION, ABUSE GOOGLE ADS TO TARGET WESTERN EUROPE

Russian-speaking threat actors deployed the "GPUGate" campaign using a sophisticated multi-stage attack combining Google Ads malvertising, GitHub commit manipulation, and hardware-specific GPU-gated decryption to target Western European IT professionals with fake GitHub Desktop installers. The attackers leveraged Google's paid search results, modified legitimate GitHub repository commits to include malicious download links, and created 128MB installers with OpenCL-based decryption that only executes on systems with real GPUs (device names >10 characters), effectively bypassing sandbox analysis. The campaign demonstrates advanced evasion tactics, including UAC bypass, Windows Defender exclusions, persistence through scheduled tasks, and modular payload delivery, with the ultimate goal of credential theft, lateral movement, and potential ransomware deployment targeting high-value IT sector victims.

arcticwolf.com · 30 min

TLDR InfoSec

REVERSE ENGINEERING OF APPLE'S IOS 0-CLICK CVE-2025-43300: 2 BYTES THAT MAKE SIZE MATTER

CVE-2025-43300 is a zero-click out-of-bounds write vulnerability in the ImageIO framework that occurs when processing DNG images with JPEG lossless compression. Exploited in the wild, the vulnerability stems from incorrect buffer allocation and loop bounds in the lossless JPEG decompression code, where the system assumes at least two components per pixel but processes images with only 1 component, causing writes beyond allocated memory. Apple's patch adds bounds checking to verify buffer size before each write operation and raises an exception when the buffer would be exceeded, fixing the mismatch between allocated buffer size (based on components per pixel) and actual write operations.

blog.quarkslab.com · 15 min

TLDR InfoSec

ESCAPING THE CONFINES OF PORT 445

Attackers are restricted to using port 445 when performing NTLM relay attacks on SMB in Active Directory environments. A common strategy to get around this limitation is by extracting the SAM and SYSTEM registry hives to dump NT hashes, but this often triggers alerts or is blocked by EDR. This article details a technique that uses Service Control Manager (SCM) to start the Webclient service, which offers more lateral movement options.

specterops.io · 10 min

TLDR InfoSec

Download the Report

Summary unavailable

content.dropzone.ai

TLDR InfoSec

FIRECOMPASS (PRODUCT LAUNCH)

FireCompass is a platform that integrates attack surface management, continuous threat exposure management, network and application penetration testing, penetration testing as a service, and red teaming.

firecompass.com

TLDR InfoSec

GERMANY CHARGES HACKER WITH ROSNEFT CYBERATTACK IN LATEST WAKE-UP CALL FOR CRITICAL INFRASTRUCTURE

German prosecutors charged a 30-year-old man with computer sabotage, data alteration, and espionage for attacking Rosneft Deutschland in March 2022, stealing and deleting 20 terabytes of data while leaving a "Glory to Ukraine" message, costing the company €12.36 million in damages. The attack, conducted in the aftermath of Russia's invasion of Ukraine, exposed sensitive internal communications and corporate documents, with the stolen data later distributed by the Anonymous hacktivist collective. The incident highlights the vulnerability of critical energy infrastructure to cyberattacks, particularly during geopolitical tensions, emphasizing the need for enhanced cybersecurity measures in essential services sectors.

exponential-e.com · 2 min

TLDR InfoSec

SEXTORTION WITH A TWIST: SPYWARE TAKES WEBCAM PICS OF USERS WATCHING PORN

A new variant of spyware called Stealerium can automatically take webcam photos of people while they watch porn, then send these to hackers for possible blackmail. Distributed as free, open-source code, it infects users via phishing emails. Researchers say this marks a move from large-scale ransom to more personal extortion, and warn it's hard to track individual victims.

arstechnica.com · 4 min

TLDR InfoSec

THE CRAZY, TRUE STORY BEHIND THE FIRST AI-POWERED RANSOMWARE

NYU researchers built an AI-powered ransomware as a proof-of-concept, showing how large language models can automate targeted ransomware attacks. Their project, initially intended for research purposes, was flagged by security experts as a real threat after it was uploaded to VirusTotal. The experiment highlights growing concerns that, soon, cybercriminals will be able to easily weaponize AI for sophisticated, undetectable attacks.

theregister.com · 3 min

TLDR InfoSec

MAX SEVERITY ARGO CD API FLAW LEAKS REPOSITORY CREDENTIALS

A maximum severity vulnerability (CVE-2025-55190, CVSS 10.0) in Argo CD allows API tokens with minimal project-level get permissions to bypass isolation mechanisms and retrieve all repository credentials, including usernames and passwords.

bleepingcomputer.com · 2 min

TLDR InfoSec

NPM DEBUG AND CHALK PACKAGES COMPROMISED

Attackers injected malware into npm packages like debug, chalk, supports-color, and strip-ansi, targeting crypto/web3 wallets in browsers.

aikido.dev · 3 min

TLDR InfoSec

GITHUB ACCOUNT COMPROMISE LED TO SALESLOFT DRIFT BREACH AFFECTING 22 COMPANIES

Hackers accessed Salesloft's GitHub account between March and June, stealing security tokens linked to 22 companies and prompting the company to disable Drift, reset credentials, and enhance security measures.

thehackernews.com · 2 min