The Daily Index — Monday, October 20, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

GOOGLE ADS FOR FAKE HOMEBREW, LOGMEIN SITES PUSH INFOSTEALERS

Researchers at threat hunting company Hunt.io have uncovered a new malware campaign that uses ClickFix tactics and impersonates popular software to distribute malware. The campaign uses Google Ads to impersonate software like Homebrew, LogMeIn, and TradingView and requests users to copy commands they run in Terminal. The malware then downloads either Odyssey or AMOS infostealers to harvest credentials.

bleepingcomputer.com · 2 min

TLDR InfoSec

PROSPER DATA BREACH IMPACTS 17.6 MILLION ACCOUNTS

Summary unavailable

securityweek.com · 2 min

TLDR InfoSec

HACKING A BANNED CHINESE SECURITY CAMERA

A security researcher successfully conducted man-in-the-middle attacks against a banned Chinese security camera, demonstrating that the device fails to verify certificate signing chains properly and transmits unencrypted video data over UDP. While these vulnerabilities are concerning, the real security issue driving the US ban is the camera's automatic firmware update capability, which could allow manufacturers to push malicious software updates in the future. The analysis highlights how even devices with multiple security flaws may pose their most significant risk through remote update mechanisms that users cannot control or audit.

hackaday.com · 1 min

TLDR InfoSec

DEFENDERWRITE: ABUSING WHITELISTED PROGRAMS FOR ARBITRARY WRITES

Antivirus folders typically block file writes to prevent attacks, but some whitelisted Windows programs can bypass these restrictions. DefenderWrite is a tool that identifies which executables can write files into protected antivirus folders without elevated privileges or exploits. By scanning all .exe files and testing their capabilities, the tool reveals weak points in Windows Defender and other major AVs, showing that even protected folders can be compromised for stealthy persistence.

zerosalarium.com · 4 min

TLDR InfoSec

REVISITING BROWSER CACHE SMUGGLING

Browser cache smuggling is a technique that abuses how web browsers store files to sneak malicious code onto victims' systems. The method leverages browser caching to download files, then uses COM Hijacking (a way of loading malicious DLLs via Windows registry settings) to achieve persistent code execution each time the browser starts. Steganography is also used to hide additional payloads within cached images, making detection harder. By combining these approaches, attackers can reliably trigger their code from the browser cache without external downloads or easily detectable file changes, bypassing many modern endpoint protections and leaving few obvious traces.

medium.com · 3 min

TLDR InfoSec

EUROPOL DISMANTLES SIM FARM NETWORK POWERING 49 MILLION FAKE ACCOUNTS WORLDWIDE

Europol's Operation SIMCARTEL dismantled a sophisticated cybercrime-as-a-service platform that operated SIM farms with 40,000 active SIM cards, enabling the creation of over 49 million fake online accounts used for phishing, investment fraud, and other criminal activities. The operation resulted in seven arrests, seizure of 1,200 SIM box devices, takedown of two websites, and freezing of nearly €700,000 in assets across multiple countries. Security professionals should monitor for SIM farm indicators in their threat detection systems and implement stronger verification processes that go beyond SMS-based authentication, as these operations demonstrate how easily criminals can bypass phone number verification on a massive scale.

thehackernews.com · 3 min

TLDR InfoSec

NORTH KOREAN HACKERS COMBINE BEAVERTAIL AND OTTERCOOKIE INTO ADVANCED JS MALWARE

North Korean threat actors behind the Contagious Interview campaign have merged functionality from their BeaverTail and OtterCookie malware families, creating a more sophisticated JavaScript-based information stealer with enhanced keylogging, screenshot capture, and cryptocurrency wallet theft capabilities. The evolved malware uses legitimate npm packages and supply chain compromises to distribute through fake job interview processes, with new variants like OtterCandy combining remote access trojan functionality and utilizing blockchain-based command-and-control infrastructure via Ethereum and BNB Smart Chain. Security professionals should monitor for suspicious npm packages, implement stronger validation for job applicant technical assessments, and watch for the specific malware indicators, including the "node-nvm-ssh" package and associated file patterns used in these supply chain attacks.

thehackernews.com · 5 min

TLDR InfoSec

VANILLA TEMPEST'S RHYSIDA RANSOMWARE ATTACKS FOILED

Microsoft dismantled an attack campaign by Vanilla Tempest (also called Vice Society), which used fake Microsoft Teams installers and over 200 fraudulent certificates to spread the Rhysida ransomware. The attackers used malicious ads and SEO techniques to lure users, delivering malware that enabled data theft and additional payload delivery.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

BEIJING ALLEGES “IRREFUTABLE EVIDENCE” LINKING US TO MAJOR CYBERATTACK ON CHINESE AGENCY

China's State Security Ministry claims the NSA has been exploiting vulnerabilities in employees' mobile devices to gain unauthorized access to the National Time Service Center since 2022, using stolen credentials and 42 types of cyberattack tools to target the facility's timing systems and internal networks.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

COLLINS AEROSPACE ATTACK CLAIMED BY EVEREST, LINKING RANSOMWARE GROUP TO LAST MONTH'S EUROPEAN AIRPORT CHAOS

The Everest ransomware group claims responsibility for breaching Collins Aerospace's MUSE check-in software in September, allegedly exfiltrating 50GB of data and causing days of disruption at major European airports, including Heathrow, Brussels, Berlin, and Dublin, by forcing manual check-in operations.

links.tldrnewsletter.com · 3 min