The Daily Index — Tuesday, September 16, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEW VOIDPROXY PHISHING SERVICE BYPASSES MFA ON MICROSOFT AND GOOGLE ACCOUNTS

VoidProxy is a new Phishing-as-a-Service platform that uses Adversary-in-the-Middle attacks to bypass multi-factor authentication on Microsoft and Google accounts by intercepting login credentials and session cookies in real-time. The platform leverages compromised email accounts from legitimate providers like Constant Contact to evade spam filters, then redirects victims to perfect clones of login pages where all authentication data is stolen. VoidProxy operates with a sophisticated two-part infrastructure that features disposable front-ends and resilient back-ends, along with anti-analysis features including Cloudflare CAPTCHA protection, making it difficult for security teams to detect and track.

hackread.com · 2 min

TLDR InfoSec

ETERNAL-TUX: CRAFTING A LINUX KERNEL KSMBD 0-CLICK RCE EXPLOIT FROM N-DAYS

A stable authenticated 0-click remote code execution exploit against Linux's kernel SMB3 daemon (ksmbd) chains two existing CVEs: CVE-2023-52440 for controlled heap overflow, and CVE-2023-4130 for memory leakage, targeting Linux 6.1.45 with full mitigations enabled. The exploit leverages NTLM authentication flaws to overflow a 512-byte SLUB allocation, then uses an arbitrary free primitive to corrupt a 1KB ksmbd_conn object and hijack a vtable pointer to achieve ROP-based code execution via call_usermodehelper. The technique demonstrates how N-day vulnerabilities can be chained together for reliable exploitation despite modern kernel protections, though it requires authenticated SMB access and is limited by the relative rarity of ksmbd deployments in production environments.

willsroot.io · 18 min

TLDR InfoSec

INSIDER BLAMED FOR FINWISE DATA BREACH AFFECTING NEARLY 700K

Nearly 700,000 FinWise Bank customers are being notified after a former employee may have accessed or taken personal data post-employment. The breach, detected over a year after it happened, involved customers from American First Finance. FinWise is offering affected individuals free credit monitoring. The case highlights ongoing risks posed by insider threats within financial and tech organizations.

theregister.com · 3 min

TLDR InfoSec

OLD BUT GOLD, DUMPING LSASS WITH WINDOWS ERROR REPORTING ON MODERN WINDOWS 11

A red team researcher demonstrated how to bypass LSASS memory protections on Windows 11 by exploiting a vulnerable version of WerFaultSecure.exe from Windows 8.1, which runs with the highest Protected Process Light (PPL) level and can access protected LSASS memory that normal processes cannot touch. The technique uses undocumented parameters to trigger unencrypted crash dumps of the LSASS process, then disguises the output file with PNG magic headers to evade antivirus detection. The attack requires deploying the older vulnerable WerFaultSecure.exe binary alongside a custom loader that launches the tool with proper PPL protections, demonstrating how legacy Windows components can be weaponized against modern security controls.

zerosalarium.com · 4 min

TLDR InfoSec

HACKING THE XBOX 360 HYPERVISOR PART 1: SYSTEM OVERVIEW

This is the first part of a three-part series on hacking the Xbox 360 hypervisor. It provides a comprehensive system overview of the console's security architecture, including the custom Xenon PowerPC CPU with on-die security features like 768 eFuses, 64KB secure RAM, hardware encryption, and protected memory pathways that use per-boot encryption keys and CRC checksums. The hypervisor operates as a 256KB protected process that manages all executable memory allocation and code authentication, with only one known exploit in its history - the "4548 system call handler bug," which was likely caused by a compiler optimization error rather than intentional code changes. In the console's robust security model, where Microsoft must sign all code, hypervisor memory is protected with both encryption and integrity checks. The system uses multiple privilege levels with strict validation to prevent software-only hacks.

icode4.coffee · 18 min

TLDR InfoSec

PLAYING WITH HTTP/2 CONNECT

HTTP/2 CONNECT is an upgrade over the original HTTP/1 CONNECT method, shifting from tunneling entire TCP connections to multiplexing multiple streams within a single connection. This evolution enables more efficient proxying and port scanning by allowing numerous tunnels without the overhead of opening many separate TCP sessions. The protocol's design incorporates features like HPACK header compression and support for modern proxy use cases—including WebSocket, UDP, and raw IP proxying—making it highly relevant for security research and next-generation proxy infrastructure.

blog.flomb.net · 6 min

TLDR InfoSec

private CTF

Summary unavailable

business.tryhackme.com

TLDR InfoSec

GEORDIE (PRODUCT LAUNCH)

Geordie provides enterprises with real-time visibility and alerts for AI agents, helping organizations track agent actions, detect unexpected behaviors, and securely manage AI agent adoption and risks.

geordie.ai

TLDR InfoSec

SCATTERED SPIDER RANSOMWARE GROUP ABRUPTLY DECIDES TO END OPERATIONS - FOR NOW, AT LEAST

Fifteen major ransomware gangs, including Scattered Spider, Lapsus, and Shiny Hunters, announced they are "going dark" after claiming they fulfilled their goals and will enjoy their earnings from recent attacks on companies like Jaguar Land Rover, Marks & Spencer, and Salesforce. They posted their farewell on BreachForums, saying they will stop attacking in their name. However, experts doubt this will be permanent, as some members have already been arrested, and the profits of cybercrime may lure them back. The announcement follows a summer campaign where the rebranded "Scattered Lapsus Hunters" targeted over 700 organizations worldwide, mainly through social engineering and data theft rather than ransomware.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

FBI WARNS OF UNC6040, UNC6395 HACKERS STEALING SALESFORCE DATA

The FBI issued a FLASH alert about cybercriminal groups UNC6040 and UNC6395, which target Salesforce to steal data and extort through methods like voice phishing and OAuth token exploitation. UNC6040 has used social engineering since late 2024 to trick call center staff into connecting malicious apps to Salesforce, while UNC6395 exploited OAuth tokens in August to access customer data and credentials. Major companies such as Google, Adidas, Qantas, Cisco, Louis Vuitton, and Tiffany & Co. have been impacted. The threat actors are linked to ShinyHunters and Scattered Spider, who recently announced they are "going dark."

bleepingcomputer.com · 3 min

TLDR InfoSec

PROTON MAIL TAKES ACTION: JOURNALIST ACCOUNTS SUSPENDED FOLLOWING CYBERSECURITY AGENCY REQUEST

Proton Mail suspended two journalists' accounts after they published research documenting an intrusion into several South Korean government institutions in Phrack. It contacted the researchers via the disclosure account a week after the print release, notifying them that their account was being suspended, citing a policy violation due to a government cybersecurity organization. The company reversed its decision and restored the accounts following a public outcry over privacy.

dualmedia.com · 5 min

TLDR InfoSec

SIDEWINDER APT LEVERAGES NEPAL PROTESTS TO PUSH MOBILE MALWARE

Hackers exploited Nepal protests by masquerading as emergency services and officials to trick people into downloading malware and stealing data.

strikeready.com · 2 min

TLDR InfoSec

FAIRMONT FEDERAL CREDIT UNION DATA BREACH HITS 187,000 IN WEST VIRGINIA

Fairmont Federal Credit Union has informed over 187,000 individuals about a security breach in 2023 that exposed sensitive information, including financial, medical, and personal data.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

GOOGLE CONFIRMS HACKERS GAINED ACCESS TO LAW ENFORCEMENT PORTAL

Google confirmed hackers from the "Scattered Lapsus$ Hunters" group created a fraudulent account in its Law Enforcement Request System (LERS), used worldwide by police to submit data requests, though no requests were made and no data accessed before the account was disabled.

bleepingcomputer.com · 2 min