The Daily Index — Thursday, November 27, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

HARVARD UNIVERSITY REVEALS DATA BREACH HITTING ALUMNI AND DONORS

Harvard University suffered a data breach after a voice phishing attack compromised its Alumni Affairs and Development systems. Personal data like addresses, emails, and phone numbers of alumni, donors, and students were exposed, though financial details and passwords were not affected. Harvard is working with law enforcement. It has warned affected individuals to watch out for phishing attempts.

techradar.com · 3 min

TLDR InfoSec

CHROME EXTENSION CAUGHT INJECTING HIDDEN SOLANA TRANSFER FEES INTO RAYDIUM SWAPS

A malicious Chrome extension called "Crypto Copilot" (still available, with 12 installs) silently injects hidden SystemProgram.transfer instructions into Raydium DEX swaps, siphoning 0.0013 SOL minimum or 0.05% of trades over 2.6 SOL to a hardcoded attacker wallet before users sign transactions. The extension uses obfuscation via minification and variable renaming, communicates with a fake backend at crypto-coplilot-dashboard.vercel[.]app, and leverages legitimate services like DexScreener and Helius RPC to appear trustworthy while bypassing Chrome Web Store review. Crypto users should audit all transaction instructions before signing and avoid installing browser extensions that request wallet access. Security teams should monitor for wallet-draining extensions targeting DeFi platforms.

thehackernews.com · 2 min

TLDR InfoSec

A COMPLETE GUIDE TO TRANSPORT LAYER SECURITY (TLS) AUTHENTICATION

This comprehensive guide covers TLS authentication fundamentals, including the handshake process, certificate validation chain, and the distinction between server-only authentication and mutual TLS (mTLS) for high-security environments. Key recommendations include enforcing TLS 1.3 (or 1.2 minimum), using forward secrecy cipher suites with ECDHE, storing private keys in HSMs/KMS, and automating certificate lifecycle management via the ACME protocol. For modern architectures, the article emphasizes layering TLS with OAuth 2.0/OIDC for combined machine and user authentication and leveraging service meshes such as Istio for automated mTLS across microservices.

blog.gitguardian.com · 19 min

TLDR InfoSec

DESKTOP APPLICATION SECURITY STANDARD: INTRODUCING DASVS

The Desktop Application Security Verification Standard (DASVS) is a comprehensive framework for addressing the unique security challenges of desktop applications across Windows, macOS, and Linux. Unlike web or mobile apps, desktop applications operate with significant system access, which demands specialized security controls. DASVS aims to provide clear, actionable verification rules and is being extended with guides and automated assessment tools to help organizations strengthen desktop application protection.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

ANDROID QUICK SHARE SUPPORT FOR AIRDROP: A SECURE APPROACH TO CROSS-PLATFORM FILE SHARING

Google enabled Quick Share interoperability with AirDrop starting with Pixel 10, using Rust for the core communication layer to eliminate memory-safety vulnerabilities in wireless protocol data parsing—a historically common attack surface. The implementation uses direct peer-to-peer connections without server routing. It underwent internal threat modeling plus independent penetration testing by NetSPI, and was validated as "notably stronger" than other industry implementations with no information leakage. For cross-platform development, Rust's compile-time memory safety guarantees make it ideal for parsing untrusted data from external sources, and Google's approach demonstrates how memory-safe languages can secure interoperability layers between disparate platforms without sacrificing performance.

security.googleblog.com · 5 min

TLDR InfoSec

VIJIL (PRODUCT LAUNCH)

Vijil helps organizations develop secure, reliable AI agents by providing a platform for testing, hardening, and monitoring agents against risks such as prompt injection. It offers modular agent templates, compliance, and runtime protection for confidential deployments.

vijil.ai

TLDR InfoSec

FBI: CYBERCRIMINALS STOLE $262M BY IMPERSONATING BANK SUPPORT TEAMS

The FBI reported over 5,100 account takeover complaints since January, with attackers impersonating bank staff via calls, texts, and emails to harvest credentials and MFA/OTP codes, then wiring funds to cryptocurrency wallets. Attackers employed SEO poisoning to push phishing sites mimicking financial institutions to the top of search results. Some used dual-impersonation tactics to claim fraudulent transactions and direct victims to fake law enforcement. Defenders should train users to access banking sites via bookmarks rather than search results, and organizations should monitor for brand impersonation in search ads.

bleepingcomputer.com · 2 min

TLDR InfoSec

LIFETIME ACCESS TO AI-FOR-EVIL WORMGPT 4 COSTS JUST $220

Malicious AI tools like WormGPT 4 and the free KawaiiGPT are making it easier for cybercriminals to generate malware and phishing messages and to automate parts of attacks. While the code requires some human adjustment to evade detection, these "Dark LLMs" significantly lower the barriers to entry for cyberattacks and social engineering.

theregister.com · 4 min

TLDR InfoSec

CISA: SPYWARE AND RATS USED TO TARGET WHATSAPP AND SIGNAL USERS

Threat actors are using commercial spyware and remote access trojans to target WhatsApp and Signal users. Attacks involve phishing, malicious QR codes, and impersonated apps. They are focusing on high-value individuals worldwide.

securityaffairs.com · 2 min

TLDR InfoSec

TOR SWITCHES TO NEW COUNTER GALOIS ONION RELAY ENCRYPTION ALGORITHM

Tor has replaced its old encryption algorithm with a new, stronger one called Counter Galois Onion (CGO) to improve user security and privacy.

bleepingcomputer.com · 3 min

TLDR InfoSec

MULTIPLE LONDON COUNCILS REPORT DISRUPTION AMID ONGOING CYBERATTACK

A cyberattack has forced three London councils, Kensington and Chelsea, Westminster, and Hammersmith & Fulham, to shut down networks and activate emergency plans.

techcrunch.com · 2 min

TLDR InfoSec

POPULAR FORGE LIBRARY GETS FIX FOR SIGNATURE VERIFICATION BYPASS FLAW

CVE-2025-12816 is a high-severity ASN.1 validation flaw in node-forge versions 1.3.1 and earlier (26M weekly NPM downloads) that allows attackers to craft malformed data.

bleepingcomputer.com · 2 min