The Daily Index — Thursday, December 4, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

GMARKET SUFFERS UNAUTHORIZED PAYMENT INCIDENT AFFECTING 60 USERS AMID HACKING WOES

Financial authorities have begun an emergency on-site inspection of the Korean e-commerce platform Gmarket after reports of unauthorized mobile payments. The attackers purchased mobile gift certificates using credit cards registered with Gmarket's simple payment service. Gmarket claims that the unauthorized payments resulted from account compromise, not a data breach.

koreatimes.co.kr · 2 min

TLDR InfoSec

K7 ANTIVIRUS VULNERABILITY ALLOWS ATTACKERS TO GAIN SYSTEM-LEVEL PRIVILEGES

A security researcher discovered a privilege escalation vulnerability in the K7 Ultimate Security antivirus while investigating an unrelated DoS vulnerability. The vulnerability exploited named pipes with overly permissive access control lists, allowing a non-admin user to execute arbitrary code as SYSTEM during fake updates. K7 worked with the researcher to issue three patches to provide interim fixes for the vulnerability pending full ACL enforcement in a future release.

cybersecuritynews.com · 2 min

TLDR InfoSec

FROM ZERO TO SYSTEM: BUILDING PRINTSPOOFER FROM SCRATCH

A Windows privilege escalation technique exploits named pipes and the Print Spooler's RPC interface to elevate accounts with SeImpersonatePrivilege, such as IIS app pool identities, to SYSTEM. It exploits its lack of SQOS protection and a path-validation bug that can be bypassed by crafting backslash/forward-slash-separated pipe paths to trigger SYSTEM connections to an attacker‑controlled pipe.

bl4ckarch.github.io · 11 min

TLDR InfoSec

68% OF PHISHING WEBSITES ARE PROTECTED BY CLOUDFLARE

Modern phishing operations increasingly rely on mainstream infrastructure like Cloudflare, major cloud providers, and popular developer-focused TLDs such as .dev and .app to appear legitimate and resist takedown. Attackers mix disposable direct-hosted servers with CDN-protected setups, often hiding behind services like Vercel, GitHub Pages, and other trusted platforms that organizations cannot simply block. Phishing-as-a-Service ecosystems now provide turnkey kits with MFA bypass, session cookie theft, and advanced evasion, heavily targeting brands like Meta, Amazon, and PayPal.

blog.sicuranext.com · 5 min

TLDR InfoSec

CYBER STARTUP FRENETIK LAUNCHES WITH PATENTED DECEPTION TECHNOLOGY THAT BETS AGAINST THE AI ARMS RACE

Maryland-based Frenetik emerged from stealth with patented "Deception In-Use" technology (US Patent 12,463,981) that continuously rotates active identities and resources across Microsoft Entra, AWS, Google Cloud, and on-premises environments to invalidate attacker reconnaissance. The approach exploits information asymmetry by ensuring defenders receive real-time change notifications through out-of-band channels while attackers operate on stale intelligence, funneling them into honeypots and decoys. A free community version is available for organizations seeking to implement active deception without extensive tuning or analyst oversight.

hackread.com · 2 min

TLDR InfoSec

RESEARCHERS CAPTURE LAZARUS APT'S REMOTE-WORKER SCHEME LIVE ON CAMERA

Researchers from BCA LTD, NorthScan, and ANY.RUN captured Lazarus Group's Famous Chollima division operating live by deploying sandbox VMs disguised as developer workstations to trap operators targeting Western companies in finance, crypto, healthcare, and engineering sectors. The investigation revealed a toolkit focused on identity takeover rather than malware. Organizations should implement enhanced vetting for remote hires as attackers request full identity documents and 24/7 laptop access to infiltrate companies without deploying traditional malicious payloads.

thehackernews.com · 4 min

TLDR InfoSec

SECURITY RESEARCHER FUMES AT LOW MACOS BUG BOUNTY REWARDS

The new Apple Security Bounty payouts devalue macOS. Full Transparency, Consent, and Control (TCC) bypasses are down from $30.5k to just $5k, while other TCC categories have been reduced from $5-$10k to just $1k. This shows an admission by Apple that it can't fix everything and is prioritizing iPhone users over Mac users.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

FRAUDULENT GAMBLING NETWORK MAY ACTUALLY BE SOMETHING MORE NEFARIOUS

A long‑running online gambling operation targeting Indonesian users is built on hundreds of thousands of owned and hijacked domains, compromised WordPress/PHP sites, and malicious Android apps. Its cost, scale, and advanced tradecraft point to an APT-style, possibly state-aligned group that uses the gambling infrastructure as both a revenue stream and cover for stealthy access to Western government and industry networks.

arstechnica.com · 6 min

TLDR InfoSec

INDIA ORDERS MESSAGING APPS TO WORK ONLY WITH ACTIVE SIM CARDS TO PREVENT FRAUD AND MISUSE

India's Department of Telecommunications directed messaging apps, including WhatsApp, Telegram, and Signal, to require account linking to an active SIM card and implement mandatory 6-hour web session logouts within 90 days to combat cross-border fraud, phishing, and "digital arrest" scams that exploit anonymous or migrated accounts.

thehackernews.com · 3 min

TLDR InfoSec

GOOGLE PATCHES 107 ANDROID FLAWS, INCLUDING TWO BEING ACTIVELY EXPLOITED

Google's December 2025 Android Security Bulletin addressed 107 vulnerabilities, including two actively exploited high-severity framework flaws (CVE-2025-48633 and CVE-2025-48572) that enable local code execution via improper input validation on Android 13-16.

malwarebytes.com · 3 min

TLDR InfoSec

HERE'S YOUR WORST NIGHTMARE: E-TAILER CAN ONLY RESUME PARTIAL SALES 45 DAYS AFTER RANSOMWARE ATTACK

Japanese e-tailer Askul restored B2B online sales and warehouse systems after a ransomware attack in October disrupted ordering, shipping, and logistics for its brands and partners, forcing temporary reliance on fax-based ordering for critical customers.

theregister.com · 4 min