The Daily Index — Monday, December 15, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

DATA BREACH AT CREDIT CHECK GIANT 700CREDIT AFFECTS AT LEAST 5.6 MILLION

A hacker accessed 700Credit's systems and stole personal data, including names, addresses, dates of birth, and Social Security numbers for at least 5.6 million people whose details were collected by US auto dealerships between May and October. The company is notifying victims by mail. Michigan's attorney general has urged affected individuals to use credit freezes or monitoring to reduce their risk of fraud.

techcrunch.com · 2 min

TLDR InfoSec

HOW WE GOT HIT BY SHAI-HULUD: A COMPLETE POST-MORTEM

Shai-Hulud 2.0 is a malicious npm supply-chain worm that abuses install-time scripts to run hidden malware on developer machines, steal credentials with tools like TruffleHog, and then exfiltrate them to attacker-controlled GitHub repositories using obfuscation techniques such as multi-layer base64 encoding. With stolen tokens, it can mass-clone private code, attempt destructive git operations, and, if npm publish credentials exist, automatically republish trojanized versions of popular packages, rapidly propagating through the JavaScript ecosystem. Recommendations to prepare against it include disabling npm scripts by default, adopting pnpm's safer defaults and minimum package age, enforcing branch protection everywhere, and moving to short-lived CI-based publishing via OIDC to eliminate long-lived secrets on developer laptops.

trigger.dev · 18 min

TLDR InfoSec

A LOOK AT AN ANDROID ITW DNG EXPLOIT

Google Project Zero analyzed in-the-wild DNG image exploits targeting Samsung's Quram image parsing library (CVE-2025-21042), discovered through suspicious files uploaded to VirusTotal that were distributed via WhatsApp and exploited Samsung's com.samsung.ipservice process when images were automatically scanned. The vulnerability allowed out-of-bounds writes through malformed DNG opcode parameters, which attackers leveraged to corrupt heap metadata, bypass ASLR through crafted MapTable operations that leaked library addresses, construct JOP chains, and ultimately achieve system() command execution to deploy spyware—all without control flow integrity mitigations like PAC/BTI present in the Quram library. Samsung silently patched the vulnerability in April by adding bounds checks to prevent plane index overflows. The case demonstrates how image format specifications provide powerful exploitation primitives that enable single-bug exploits to achieve interactionless remote code execution and access to all media store contents, capabilities that would likely have been prevented by MTE deployment.

googleprojectzero.blogspot.com · 10 min

TLDR InfoSec

CAPABILITIES ARE THE ONLY WAY TO SECURE AGENT DELEGATION

Traditional IAM systems are inadequate for securing AI agent delegation because they verify identity rather than track authority derivation across dynamic task chains, creating the Confused Deputy problem where agents possess ambient permissions without understanding their origin or intended scope. Capability-based authorization systems address this by treating authority as cryptographically-signed tokens that are explicitly passed between agents, monotonically attenuated at each delegation hop, bound to holder keys for proof of possession, and automatically expire when tasks complete. This model prevents prompt injection attacks from escalating to data exfiltration by ensuring agents can only exercise the specific, constrained authority delegated to them rather than role-based permissions, making injection attempts succeed at the language layer but fail at the authorization layer.

niyikiza.com · 9 min

TLDR InfoSec

LUMIA SECURITY (PRODUCT LAUNCH)

Lumia Security provides a network-level security and governance platform that gives enterprises visibility and control over how employees and autonomous agents use AI tools. It understands AI interactions' intent and context, continuously evaluates risk, and enforces policies across thousands of AI applications.

lumia.security

TLDR InfoSec

KALI LINUX 2025.4 RELEASED WITH 3 NEW TOOLS, DESKTOP UPDATES

Kali Linux 2025.4 introduces three new penetration testing tools (bpf-linker, evil-winrm-py, and hexstrike-ai) alongside major desktop environment upgrades, including GNOME 49 with complete transition to Wayland and removal of X11 support. The release includes expanded Kali NetHunter support for Android 15/16 devices with Wifipumpkin3 preview for rogue access point attacks, enhanced VM guest utilities support for VirtualBox, VMware, and QEMU, and distribution changes requiring BitTorrent for Live image downloads due to increased file sizes. Users can upgrade existing installations via apt commands or download fresh ISO images. The update focuses on improving both security testing capabilities and user experience across desktop environments.

bleepingcomputer.com · 3 min

TLDR InfoSec

NEW REACT VULNS LEAK SECRETS, INVITE DOS ATTACKS

Summary unavailable

theregister.com · 2 min

TLDR InfoSec

THE US DIGITAL DOXXING OF H-1B APPLICANTS IS A MASSIVE PRIVACY MISSTEP

The US State Department mandated that H-1B visa applicants and their H-4 dependents set all social media profiles to public starting December 15, ostensibly to screen for national security threats through “online presence reviews” that assess hostility toward US institutions, effectively forcing digital exposure on over a million technology workers and their families. This policy creates severe security risks by providing foreign adversaries with free organizational intelligence on defense contractors, chip makers, and AI labs, exposing workers to spear-phishing, SIM swapping, recruitment exploitation, and extortion tactics while turning legitimate employees into attack vectors through publicly available personal data that can be scraped and weaponized for deepfake impersonations and social engineering. The mandatory public exposure normalizes government-mandated privacy erosion while ironically creating the intelligence security risks it aims to prevent, as sophisticated threat actors using fake accounts remain hidden while legitimate applicants become vulnerable targets with their professional affiliations, family connections, and personal vulnerabilities exposed to hostile nation-state surveillance operations.

malwarebytes.com · 3 min

TLDR InfoSec

KEY BARRIER TO ONLINE FRAUD CAN BE BYPASSED FOR PENNIES

Researchers from the University of Cambridge have determined that SMS numbers, which are commonly used by services to verify account activation and combat fraud, can be readily purchased, typically for less than 30 cents each. Costs varied by country, with the UK and Russia selling for 10 cents at the lower end, and Australia and Japan selling for $3-$5 at the higher end. The cost could also vary by service, with throwaway numbers for WhatsApp costing more than those for X.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

SMALL NUMBERS OF NOTEPAD++ USERS REPORTING SECURITY WOES

Three organizations reported security incidents in which Notepad++ processes initiated access, allowing threat actors to gain hands-on keyboard activity and potentially exploit the application's update mechanism.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

TRAINS CANCELLED OVER FAKE BRIDGE COLLAPSE IMAGE

Summary unavailable

bbc.com · 3 min

TLDR InfoSec

COUPANG DATA BREACH TRACED TO EX-EMPLOYEE WHO RETAINED SYSTEM ACCESS

South Korea's largest retailer, Coupang, traced a 33.7 million customer data breach to a former employee who retained system access after leaving in 2024.

bleepingcomputer.com · 2 min