The Daily Index — Wednesday, September 24, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

LASTPASS: FAKE PASSWORD MANAGERS INFECT MAC USERS WITH MALWARE

There is a malware campaign that uses GitHub repositories to deliver fraudulent password managers. The fake software delivers the Atomic (AMOS) InfoStealer to infected macOS devices. LastPass says that aside from its product, over 100 different softwares are being used, such as 1Password and Notion.

bleepingcomputer.com · 2 min

TLDR InfoSec

PATCH BYPASSED FOR SUPERMICRO VULNERABILITY ALLOWING BMC HACK

Binarly researchers found they could bypass Supermicro's patch for CVE-2024-10237, a firmware flaw allowing malicious updates, prompting a new CVE (CVE-2025-7937) and fix. They also discovered CVE-2025-6198, a flaw that bypasses the Root of Trust. Both enable attackers to control the BMC and OS. These flaws show firmware validation's fragility, risking persistent BMC code execution with major enterprise security implications.

securityweek.com · 2 min

TLDR InfoSec

A TAG TO RULE THEM ALL: USING AWS TAGS TO ENUMERATE CLOUD RESOURCES

AWS tags offer a way to attach metadata to a resource, either automatically (like the Name tag) or manually. Several services provide API calls such as ListTags or GetTags, enabling efficient enumeration of resources accessible by an identity. TagNabIt is a tool designed for tag-based brute-force enumeration.

blog.pepperclipp.com · 10 min

TLDR InfoSec

EXPLORING GRAPHENEOS SECURE ALLOCATOR: HARDENED MALLOC

GrapheneOS features a hardened malloc, a memory allocator that uses ARM Memory Tagging Extension (MTE) to assign tags to memory regions and detect corruption, effectively preventing heap overflows and use-after-free attacks. Its two-stage quarantine system, which involves randomized and FIFO queues, makes exploiting freed memory difficult by requiring attackers to perform thousands of free operations. Large allocations are secured through guard pages, address space randomization, and the separation of metadata from user data, all of which enhance security.

synacktiv.com · 22 min

TLDR InfoSec

EXTERNAL ATTACK SURFACE MANAGEMENT (EASM) BUYER'S GUIDE

External Attack Surface Management (EASM) tools automate the discovery and continuous monitoring of internet-facing assets, providing organizations with an attacker's perspective of their vulnerabilities across domains, IP addresses, and exposed services. The strategic value lies in combining automated asset discovery with risk prioritization—EASM products excel at identifying shadow IT, abandoned subdomains, and misconfigurations that traditional internal scanning misses. Organizations should select EASM solutions based on their specific needs: small businesses require clear remediation guidance, SMEs need robust subdomain discovery to prevent takeovers, and enterprises benefit from large-scale IP scanning with export capabilities for distributed security teams.

ncsc.gov.uk · 11 min

TLDR InfoSec

AMERICAN ARCHIVE OF PUBLIC BROADCASTING FIXES BUG EXPOSING RESTRICTED MEDIA

A vulnerability in the American Archive of Public Broadcasting website, which has been exploited since at least 2021, allowed unauthorized downloading of protected and private media through an insecure direct object reference (IDOR) flaw that bypassed access controls by manipulating media ID parameters. The exploit circulated in Discord preservation communities and "data hoarder" groups, leading to leaks of protected content, including a banned Sesame Street episode featuring the Wicked Witch of the West. AAPB fixed the vulnerability within 48 hours after being notified. The extent of accessed content during the years-long exploitation remains unknown.

bleepingcomputer.com · 2 min

TLDR InfoSec

U.S. SECRET SERVICE DISMANTLES IMMINENT TELECOMMUNICATIONS THREAT IN NEW YORK TRISTATE AREA

The US Secret Service (USSS) dismantled a network of over 300 co-located SIM servers and 100,000 SIM cards positioned within 35 miles of the UN General Assembly in New York that were used to conduct telecommunications-related threats against senior US government officials. The devices were capable of performing multiple attack vectors, including disabling cell phone towers, facilitating denial of service attacks, and enabling anonymous encrypted communications between nation-state threat actors and criminal enterprises. Early forensic analysis revealed cellular communications between nation-state threat actors and individuals known to federal law enforcement, representing an imminent threat to protective operations during the high-profile international gathering.

secretservice.gov · 2 min

TLDR InfoSec

WHEN LLMS AUTONOMOUSLY ATTACK

A researcher at Carnegie Mellon University demonstrated that an LLM can coordinate a system of agents to recreate real-world attacks. As part of his PhD, Brian Singer recreated the network environment of the 2017 Equifax data breach and observed that an LLM could replicate the attack. These capabilities allow smaller organizations to use LLMs as dedicated red teamers.

engineering.cmu.edu · 5 min

TLDR InfoSec

MICROSOFT LIFTS WINDOWS 11 UPDATE BLOCK AFTER FACE DETECTION FIX

Microsoft has removed a compatibility hold that prevented devices with integrated cameras from installing Windows 11 24H2 due to a face detection bug that caused app freezes when using the Camera app, Windows Hello facial recognition, and other camera-utilizing applications.

bleepingcomputer.com · 1 min

TLDR InfoSec

MI6 OPENS DARK WEB PORTAL "SILENT COURIER" FOR RUSSIANS TO SHARE SECRETS

MI6 launched a dark web portal called Silent Courier to allow potential agents worldwide, particularly Russians, to securely share sensitive information about terrorism and hostile intelligence activities.

hackread.com · 2 min

TLDR InfoSec

STEAM GAME REMOVED AFTER CRYPTOSTEALER TAKES OVER $150K

Steam removed the free-to-play game BlockBlasters after malware stole over $150,000 in cryptocurrency from players, including $32,000 from a Latvian streamer with stage 4 cancer raising funds.

theverge.com · 2 min