The Daily Index — Tuesday, September 23, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

GITHUB'S REPUTATION BEING EXPLOITED BY BAD ACTORS TO DISTRIBUTE MALWARE

A security researcher explains how they discovered a macOS malware campaign spreading through SEO and GitHub links disguised as a legitimate app. The GitHub page appears legit, featuring a demo and an install command for Terminal. This command downloads malware and clears all xattrs. The page also hosts a dmg with an obfuscated osascript that executes a second script to remove quarantine and run stackprep.

adam.kostarelas.com · 2 min

TLDR InfoSec

STELLANTIS DETECTS BREACH AT THIRD-PARTY PROVIDER FOR NORTH AMERICAN CUSTOMERS

Automaker Stellantis disclosed that a third-party service provider's platform that supports North American customers was breached. Stellantis stated that the exposed data included only basic contact information and not financial information.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

UNMASKING AKIRA: THE RANSOMWARE TACTICS YOU CAN'T AFFORD TO IGNORE

Based on ZenSec's analysis of over 30 Akira ransomware incidents from 2023 to 2025, the group primarily exploits SSL VPN vulnerabilities (Cisco ASA, SonicWall, and WatchGuard) through missing MFA and unpatched CVEs, then leverages Veeam backup system vulnerabilities for privilege escalation and credential harvesting. Akira operates as a double-extortion group, stealing data via tools like WinSCP and Rclone (often within 3 hours), then encrypting systems at the hypervisor level while using AnyDesk for persistent access. The group targets backup infrastructure for destruction, publishes stolen data via Tor-based leak sites using torrent links, and demonstrates a playbook-driven approach similar to the defunct Conti ransomware operation.

zensec.co.uk · 14 min

TLDR InfoSec

WHY CONTINUOUS PROFILING IS THE FOURTH PILLAR OF OBSERVABILITY

Early profilers focused mainly on CPU and needed manually compiled binaries, which caused high performance overhead. Today, profiling has a lower impact and offers diverse signals that can be automatically collected continuously. OpenTelemetry introduced a new category for continuous profiling and considers adding it as a fourth pillar.

datadoghq.com · 8 min

TLDR InfoSec

HOW TO AUTOMATICALLY DISABLE USERS IN AWS MANAGED MICROSOFT AD BASED ON GUARDDUTY FINDINGS

Automatically disabling compromised user accounts helps organizations reduce attack fallout. This tutorial demonstrates how to utilize GuardDuty for detecting suspicious activity, triggering an AWS Step Function to retrieve user information, and subsequently disabling the account in AWS Directory Service for Microsoft AD. The last step can also be done on a domain-joined EC2 instance if an organization doesn't use AWS Managed AD.

aws.amazon.com · 6 min

TLDR InfoSec

and best practices for your fleet. Read the ebook (PDF, ungated)

Summary unavailable

delltechnologies.com

TLDR InfoSec

MICROSOFT ENTRA ID FLAW ALLOWED HIJACKING ANY COMPANY'S TENANT

Security researcher Dirk-jan Mollema found a critical flaw that combined undocumented "actor tokens" from Microsoft's legacy Access Control Service with a bug in the deprecated Azure AD Graph API. This flaw allowed complete takeover of any Microsoft Entra ID tenant with Global Admin rights. The attack exploited unsigned actor tokens that bypass security, generate no audit logs, and stay valid for 24 hours without revocation, letting attackers impersonate users. Microsoft patched the vulnerability CVE-2025-55241 within nine days of disclosure in July. The flaw highlights ongoing risks from legacy authentication systems lacking modern security controls.

bleepingcomputer.com · 3 min

TLDR InfoSec

FBI WARNS BAD ACTORS ARE SPOOFING THE IC3 CYBERCRIME REPORTING WEBSITE

The FBI warns that cybercriminals are creating fake versions of its Internet Crime Complaint Center (IC3) website to steal personal information from victims attempting to report cyber crimes. The spoofed sites use misspelled URLs, alternative domains, and poor graphics to trick users into entering sensitive data, including names, addresses, phone numbers, and banking information. Users should verify they're on the official IC3 site by ensuring the URL is exactly "www.ic3.gov" with HTTPS and avoid clicking on sponsored search results that may redirect to fraudulent sites.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

TELECOM EXEC: SALT TYPHOON INSPIRING OTHER HACKERS TO USE UNCONVENTIONAL TECHNIQUES

AT&T's CISO states hackers use Salt Typhoon's tactics like targeting unprotected platforms, exploiting logging gaps, and using legitimate tools for "living off the land" attacks. The Chinese group's success has inspired threats to target weak spots beyond traditional security, with attackers chaining exploits due to stronger defenses, prompting innovation.

cyberscoop.com · 2 min

TLDR InfoSec

TEEN SUSPECT SURRENDERS IN 2023 LAS VEGAS CASINO CYBERATTACK CASE

A teenage suspect linked to 2023 cyberattacks on MGM Resorts and Caesars surrendered to Las Vegas police, facing six felony charges, including extortion and identity theft.

casino.org · 1 min

TLDR InfoSec

MOZILLA NOW LETS FIREFOX ADD-ON DEVS ROLL BACK BAD UPDATES

Mozilla has introduced a new rollback feature that allows Firefox extension developers to revert to previously approved versions when critical bugs occur, with users automatically receiving the rolled-back version within 24 hours through Firefox's update mechanism.

bleepingcomputer.com · 2 min

TLDR InfoSec

AI FORENSICS HELP EUROPOL TRACK 51 CHILDREN IN GLOBAL ONLINE ABUSE CASE

Europol led an international operation across 18 countries using AI-driven forensic tools to analyze over 5,000 pieces of child exploitation material, resulting in the identification of 51 child victims and 60 suspects facing criminal proceedings.

hackread.com · 1 min