The Daily Index — Monday, October 13, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

MICROSOFT WARNS OF NEW “PAYROLL PIRATE” SCAM STEALING EMPLOYEES' DIRECT DEPOSITS

A phishing campaign called Payroll Pirate targets university employees by tricking them into giving up credentials for HR platforms like Workday. Attackers use adversary-in-the-middle methods to bypass multi-factor authentication, alter payroll settings and divert paychecks, and hide their tracks by creating inbox rules and adding their recovery phone numbers.

arstechnica.com · 2 min

TLDR InfoSec

UK TECHIES' UNION WARNS MEMBERS AFTER BREACH EXPOSES SENSITIVE PERSONAL DETAILS

UK trade union Prospect has warned members that sensitive personal data, such as contact details, bank account numbers, and, in some cases, information on sexual orientation or disabilities, was exposed following a cyber incident in June. Members were notified months after the attack, and the union offers a year of credit monitoring.

theregister.com · 3 min

TLDR InfoSec

DDOS BOTNET AISURU BLANKETS US ISPS IN RECORD DDOS

Aisuru is the largest and most disruptive DDoS botnet ever recorded. It is powered mainly by infected IoT devices with weak security settings. Recent attacks have reached unprecedented data volumes, peaking at almost 30 trillion bits per second and causing significant disruptions, especially for online gaming ISPs like those serving Minecraft. The botnet evolved from earlier Mirai malware, exploits zero-day vulnerabilities, and can rent its network as residential proxies for cybercriminals. An international team manages it. Its rapid growth, boosted by the downfall of competing botnets, has highlighted significant gaps in how ISPs mitigate outbound DDoS traffic.

krebsonsecurity.com · 10 min

TLDR InfoSec

A SMALL NUMBER OF SAMPLES CAN POISON LLMS OF ANY SIZE

Anthropic has found that large language models (LLMs) like Claude can be compromised by injecting as few as 250 malicious files into their training data, regardless of the model's size or the total dataset volume. Attackers can create a “backdoor” in the model triggered by specific phrases, causing the model to behave unpredictably or output gibberish. This finding overturns the traditional belief that an attacker needs control of a percentage of training data: even a tiny, fixed number of documents might be enough.

anthropic.com · 7 min

TLDR InfoSec

NEW RUST MALWARE "CHAOSBOT" USES DISCORD FOR COMMAND AND CONTROL

ChaosBot is a sophisticated Rust-based backdoor that abuses legitimate Discord services for C2 operations. It primarily targets Vietnamese speakers through phishing campaigns with malicious Windows Shortcut files that sideload payloads via legitimate Microsoft Edge components. The malware supports reconnaissance commands (systeminfo, ipconfig, and screenshots), delivers secondary payloads like fast reverse proxy (frp) for persistent network access, and employs evasion techniques including ETW patching and VM detection to bypass security controls. Organizations should monitor for suspicious Discord API traffic, unusual PowerShell execution patterns with UTF-8 encoding prefixes, WMI-based lateral movement from over-privileged service accounts, and unauthorized DLL sideloading in Public user directories.

esentire.com · 10 min

TLDR InfoSec

by Dell and Intel

Summary unavailable

delltechnologies.com

TLDR InfoSec

SAFEHILL (PRODUCT LAUNCH)

SafeHill offers a continuous threat exposure management (CTEM) platform. It delivers continuous asset discovery, automated threat exposure assessments, and human-validated penetration testing – effectively continuous pentesting rather than point-in-time pentesting.

safehill.com

TLDR InfoSec

APPLE NOW OFFERS $2M FOR ZERO-CLICK RCE

Apple has updated its bug bounty program, doubling maximum payouts, adding new research categories, and introducing a more transparent pay structure. With bonuses for lockdown mode bypasses and finding vulnerabilities in beta releases, the maximum reward payout can exceed $5M. One-click remote code execution (RCE), wireless proximity attack, broad unauthorized iCloud access, and WebKit exploit chain leading to RCE all also have $1M payouts.

bleepingcomputer.com · 2 min

TLDR InfoSec

SPYWARE MAKER NSO GROUP CONFIRMS ACQUISITION BY US INVESTORS

NSO Group, infamous for its powerful spyware, has just been taken over by a group of American investors. Even though new faces are in charge, the company's roots and oversight will stay in Israel. NSO's tools have targeted journalists and officials worldwide, so this takeover is making plenty of people nervous about what comes next and how these technologies might be used.

techcrunch.com · 3 min

TLDR InfoSec

HACKERS TURN VELOCIRAPTOR DFIR TOOL INTO WEAPON IN LOCKBIT RANSOMWARE ATTACKS

Threat actors associated with Storm-2603 are weaponizing Velociraptor, a legitimate open-source digital forensics and incident response tool, to facilitate LockBit and Warlock ransomware attacks. The abuse of trusted security utilities allows attackers to evade detection while conducting reconnaissance and lateral movement within compromised networks. Security teams should monitor for unauthorized Velociraptor deployments, implement application whitelisting, and review legitimate DFIR tool usage to distinguish between authorized security operations and malicious activity.

thehackernews.com · 1 min

TLDR InfoSec

BREACHFORUMS SEIZED, BUT HACKERS SAY THEY WILL STILL LEAK SALESFORCE DATA

Despite law enforcement seizing the BreachForums cybercrime marketplace, threat actors have announced plans to proceed with leaking stolen Salesforce data through alternative channels, demonstrating that platform takedowns alone do not prevent data exposure and highlighting the need for organizations to assume breach, monitor dark web channels, and prepare incident response plans for potential data leaks.

bitdefender.com · 1 min

TLDR InfoSec

RUSSIAN SPYWARE CLAYRAT IS SPREADING, EVOLVING QUICKLY, ACCORDING TO ZIMPERIUM

ClayRat, an Android spyware with over 600 samples detected in three months, spreads via fake TikTok and YouTube apps through Telegram and phishing sites, exploiting Android's SMS handler to bypass permissions and steal messages, calls, and device data, with potential for global expansion as infected devices become attack vectors.

cyberscoop.com · 2 min