The Daily Index — Monday, October 6, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

HACKING GROUP CLAIMS THEFT OF 1 BILLION RECORDS FROM SALESFORCE CUSTOMER DATABASES

A hacking group known by several names, including Scattered Spider and ShinyHunters, claims to have stolen approximately a billion records from companies using Salesforce cloud databases. The group is extorting victims with threats to leak stolen data unless ransoms are paid. Multiple major companies are affected. Salesforce denies any breach of its platform or vulnerabilities in its systems.

techcrunch.com · 3 min

TLDR InfoSec

RESEARCHERS WARN OF SELF-SPREADING WHATSAPP MALWARE NAMED SORVEPOTEL

SORVEPOTEL is a self-propagating malware campaign targeting Brazilian users that spreads through WhatsApp by exploiting social trust and sending malicious ZIP file attachments disguised as receipts or health app files. The attack chain begins with phishing messages from compromised contacts, which leads victims to open Windows shortcut files that execute PowerShell scripts to download payloads from external servers and establish persistence via the Windows Startup folder. Once installed, the malware automatically detects active WhatsApp Web sessions and mass-distributes the malicious ZIP files to all contacts and groups, prioritizing rapid propagation over data theft and frequently resulting in account bans due to spam violations.

thehackernews.com · 2 min

TLDR InfoSec

POINTER LEAKS THROUGH POINTER-KEYED DATA STRUCTURES

Google Project Zero demonstrated a novel technique to remotely leak memory addresses without memory safety violations by exploiting pointer-keyed data structures in Apple's NSKeyedArchiver serialization. The attack works by crafting specific NSDictionary objects with carefully chosen NSNumber keys to control hash bucket placement, then using the serialized ordering of an NSNull singleton (whose hash is its memory address) to determine its location in the shared cache. While theoretical and requiring a deserialize-reserialize attack surface, this technique demonstrates how pointer-based hashing in keyed data structures can leak addresses even without timing attacks. Organizations should audit serialization endpoints and consider using keyed hash functions instead of raw pointer addresses for object hashing.

googleprojectzero.blogspot.com · 13 min

TLDR InfoSec

SIGNAL PROTOCOL AND POST-QUANTUM RATCHETS

Signal's Sparse Post Quantum Ratchet (SPQR) is part of a new "Triple Ratchet" protocol that combines its existing Double Ratchet with quantum-resistant ML-KEM cryptography to protect against future quantum computing threats while maintaining forward secrecy and post-compromise security. The implementation uses erasure coding and state machines to efficiently transmit large ML-KEM keys (over 1,000 bytes) in small chunks, includes a graceful downgrade mechanism for backward compatibility during rollout, and employs formal verification using ProVerif and F* to ensure protocol correctness. Security professionals should note that this represents a practical approach to post-quantum migration, which preserves existing security guarantees while introducing quantum resistance. The protocol automatically upgrades conversations without requiring user intervention.

signal.org · 23 min

TLDR InfoSec

VED 2026: AFTER CFI - DATA ONLY

Modern kernel privilege escalation attacks have shifted from traditional control flow methods like ROP to more stealthy, stable data-only attacks that bypass Control Flow Integrity (CFI), prompting the development of advanced defense systems like VED (Vault Exploit Defense). Novel techniques, such as DirtyPipe, cred-jar heap spray, and pipe primitives, exploit weaknesses in kernel memory handling to corrupt authentication data or page buffers, directly overwriting critical structures, including credential jars and pipe buffers, while evading detection by typical CFI solutions. VED counters these threats through multiple integrity measures, including shadow data tracking, hash monitoring, slab poisoning, and specialized protections for core patterns and pipe buffers, aiming to detect stealthy modifications and strengthen kernel security against increasingly sophisticated data-centric exploits while minimizing performance impact.

hardenedvault.net · 10 min

TLDR InfoSec

and Absolute

Summary unavailable

delltechnologies.com

TLDR InfoSec

SEND GMAIL END-TO-END ENCRYPTED EMAILS TO ANYONE

Summary unavailable

workspaceupdates.googleblog.com · 3 min

TLDR InfoSec

MOKN (PRODUCT LAUNCH)

MokN provides identity protection based on honeypots, with ultra-realistic decoy access points, including VPNs and email servers, that replicate the organization's environment. If an attacker attempts to log in to one of these honeypots using a stolen identity, the security team is alerted and can take appropriate action.

mokn.io

TLDR InfoSec

GREYNOISE DETECTS 500% SURGE IN SCANS TARGETING PALO ALTO NETWORKS PORTALS

GreyNoise detected a 500% surge in scanning activity targeting Palo Alto Networks login portals on October 3, with over 1,285 IP addresses (93% suspicious and 7% malicious) conducting coordinated reconnaissance that mirrors previous Cisco ASA scanning patterns and shares TLS fingerprints linked to Netherlands infrastructure, potentially signaling upcoming vulnerability disclosures since historical patterns show Palo Alto scan spikes often precede new flaw announcements within six weeks.

securityaffairs.com · 2 min

TLDR InfoSec

COMETJACKING: ONE CLICK CAN TURN PERPLEXITY'S COMET AI BROWSER INTO A DATA THIEF

CometJacking affects Perplexity's Comet AI browser by allowing attackers to use a malicious link to inject hidden prompts and steal sensitive user data, such as emails and calendars, by exploiting the browser's own access. Experts warn that this demonstrates the broader risks of AI-driven browsers and have urged stricter agent prompt security to prevent future data theft campaigns

thehackernews.com · 2 min

TLDR InfoSec

HOW WE'RE MAKING APPLICATION SECURITY SMARTER

Wealthsimple was faced with the common dilemma of having a small security team tasked with reviewing code written by a much larger engineering team in a highly regulated environment. It introduced Semgrep AI to create custom fixes for the specific code under review, augmenting its security team. Semgrep remembers previous decisions on findings and uses that information to auto-triage future findings

engineering.wealthsimple.com · 3 min

TLDR InfoSec

NEW STUDY WARNS SEVERAL FREE IOS AND ANDROID VPN APPS LEAK DATA

Nearly 800 free VPN apps have serious security flaws, including old Heartbleed bugs, excessive permissions for surveillance, and missing privacy info, posing risks for BYOD policies that should focus on app allowlisting and data protection over just VPN security.

hackread.com · 3 min

TLDR InfoSec

PARKMOBILE PAYS... $1 EACH FOR 2021 DATA BREACH THAT HIT 22 MILLION

ParkMobile settled a class action lawsuit over its 2021 data breach, which affected 22 million users, by offering victims a meager $1 in-app credit (dispensed as four 25-cent discounts) that must be manually claimed with a promo code and expires in October 2026.

bleepingcomputer.com · 3 min

TLDR InfoSec

SHINYHUNTERS LAUNCHES DATA LEAK SITE: TRINITY OF CHAOS ANNOUNCES NEW RANSOMWARE VICTIMS

The Trinity of Chaos ransomware group, associated with Lapsus$, Scattered Spider, and ShinyHunters, launched a TOR leak site exposing 39 major firms, including Google, Cisco, and Stellantis, after exploiting Salesforce vulnerabilities via vishing and stolen OAuth tokens, threatening to release over 1.5 billion records if ransoms aren't paid.

securityaffairs.com · 2 min