The Daily Index — Friday, November 28, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

ASAHI SAYS CROOKS STOLE DATA OF APPROXIMATELY 2M CUSTOMERS AND EMPLOYEES

Ransomware operators hit the Asahi Group in late September, crippling Japanese operations and exposing data on around 2 million people, including customers, employees, and their families. Personal information such as names, addresses, phone numbers, emails, birth dates, and gender was accessed, but no credit card data was involved.

securityaffairs.com · 2 min

TLDR InfoSec

GAINSIGHT CEO DOWNPLAYS IMPACT OF ATTACK THAT SPREAD TO SALESFORCE ENVIRONMENTS

Gainsight is investigating a breach involving its Salesforce-connected app, working with Mandiant and relying heavily on Salesforce logs to understand which customers were affected and how attackers used compromised OAuth tokens. The company insists that only a small number of customers saw data impact. Google Threat Intelligence has flagged hundreds of potentially affected Salesforce instances.

cyberscoop.com · 4 min

TLDR InfoSec

THREAT HUNTING VS. THREAT INTELLIGENCE

Threat intelligence focuses on understanding the external threat landscape, while threat hunting proactively investigates internal systems for threats that have evaded automated defenses through hypothesis-driven analysis and behavioral anomaly detection. The two functions create a feedback loop: intelligence provides IOCs, TTPs, and focus areas to guide hunting hypotheses, while hunting discoveries enrich intelligence with validated internal findings. Security teams should integrate both by using threat intelligence to prioritize hunting efforts via MITRE ATT&CK TTP mapping, embedding intelligence feeds into SIEM/EDR for automated IOC correlation, and establishing workflows that link hunting results to strategic and tactical intelligence products.

recordedfuture.com · 7 min

TLDR InfoSec

THE MINEFIELD BETWEEN SYNTAXES: EXPLOITING SYNTAX CONFUSIONS IN THE WILD

Syntax confusion arises when different components, such as browsers, proxies, frameworks, or libraries, parse the same input in conflicting ways, letting attackers bypass filters or change behaviour. By abusing alternate syntaxes, an attacker can slip dangerous characters or paths past validation and turn limited issues like SSRF or cache quirks into powerful primitives such as stored XSS or arbitrary file access.

yeswehack.com · 12 min

TLDR InfoSec

discovered to date. Start your test.

Summary unavailable

xbow.com

TLDR InfoSec

DEVOPS PIPELINE ATTACK SURFACE (WEBAPP)

A fully searchable, client-side guide to 88+ tools across 15 categories for pentesters and red teamers.

arcanum-sec.github.io

TLDR InfoSec

INSIDE THE GITHUB INFRASTRUCTURE POWERING NORTH KOREA'S CONTAGIOUS INTERVIEW NPM ATTACKS

Socket Threat Research exposed North Korea's Contagious Interview operation, which added 197 malicious npm packages since October, using a GitHub-Vercel-npm delivery chain to distribute OtterCookie malware targeting blockchain and Web3 developers through fake job interviews. The malware performs comprehensive data theft. Security teams should treat npm installs as remote code execution, implement network egress controls on CI/CD systems, require code review for GitHub templates, and deploy real-time package scanning to detect behaviors like import-time loaders and eval on network responses before malware executes.

links.tldrnewsletter.com · 21 min

TLDR InfoSec

REPORT NAMES TEEN IN SCATTERED LAPSUS$ HUNTERS, GROUP DENIES

A 15-year-old in Jordan known as "Rey" was allegedly identified as a key administrator of Scattered LAPSUS$ Hunters after operational security failures. The group, which merged tactics from Scattered Spider, LAPSUS$, and ShinyHunters, conducted high-impact attacks against Jaguar Land Rover, Schneider Electric, Telefonica, and other major organizations using stolen Salesforce data, insider recruitment, and ALPHV/BlackCat ransomware variants. The group vigorously denied the allegations in a detailed Telegram response, offering 10 BTC to anyone who could prove Rey's identity with evidence. Rey himself claims he's been cooperating with law enforcement since June and is attempting to exit the cybercrime community.

hackread.com · 11 min

TLDR InfoSec

SCOTTISH COUNCIL STILL REBUILDING SYSTEMS TWO YEARS AFTER RANSOMWARE ATTACK

A 2023 ransomware attack on Comhairle nan Eilean Siar forced the Western Isles council to rebuild multiple core systems, leaving some finance and revenue platforms still not fully restored two years later. The incident has cost around £950,000, created large data gaps and backlogs, and left staff under intense, prolonged pressure.

theregister.com · 3 min

TLDR InfoSec

MICROSOFT TEAMS' GUEST CHAT FEATURE EXPOSES CROSS-TENANT BLIND SPOT

Microsoft Teams' cross-tenant guest chat feature (MC1182004) bypasses all Defender for Office 365 protections when users accept external tenant invitations.

csoonline.com · 3 min

TLDR InfoSec

MICROSOFT TO SECURE ENTRA ID SIGN-INS FROM SCRIPT INJECTION ATTACKS

Microsoft will implement a strengthened Content Security Policy for Entra ID by October 2026 that blocks external script injection and cross-site scripting attacks.

bleepingcomputer.com · 3 min

TLDR InfoSec

FAKE LINKEDIN JOBS TRICK MAC USERS INTO DOWNLOADING FLEXIBLE FERRET MALWARE

The Contagious Interview campaign targets Mac users through fake LinkedIn job postings that lure victims to fraudulent assessment websites.

malwarebytes.com · 2 min