The Daily Index — Tuesday, December 16, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

FEATURED CHROME BROWSER EXTENSION CAUGHT INTERCEPTING MILLIONS OF USERS' AI CHATS

A widely trusted Chrome and Edge extension, Urban VPN Proxy, was updated in 2025 to inject JavaScript that hooks network APIs, silently captures all AI chatbot prompts and responses, plus metadata, and then sends them to Urban VPN's analytics servers. The data is shared with parent company BIScience for commercial insights, despite “AI protection” marketing and a privacy policy that downplays risks. Security teams should review browser extension permissions, monitor network traffic for unusual API calls, and enforce policies restricting the installation of unverified extensions to prevent data exfiltration by malicious extensions such as Urban VPN Proxy.

thehackernews.com · 3 min

TLDR InfoSec

NEW ADVANCED PHISHING KITS USE AI AND MFA BYPASS TACTICS TO STEAL CREDENTIALS AT SCALE

Four new phishing-as-a-service kits have emerged: BlackForce ($200-300, MFA bypass via Man-in-the-Browser attacks), GhostFrame (iframe-based evasion with 1M+ attacks), InboxPrime AI ($1,000 perpetual license with AI-generated emails mimicking Gmail behavior), and Spiderman (targeting European banks via Signal with OTP/PhotoTAN interception). These kits feature anti-analysis techniques, real-time credential exfiltration to Telegram, and spintax-based email variation to bypass signature detection. Organizations should implement phishing-resistant MFA, such as FIDO2, and monitor for the emerging Salty-Tycoon hybrid, which combines multiple kit techniques to evade detection rules.

thehackernews.com · 6 min

TLDR InfoSec

OPERATION MONEYMOUNT-ISO — DEPLOYING PHANTOM STEALER VIA ISO-MOUNTED EXECUTABLES

A new group is running a phishing campaign that impersonates payment confirmations to trick finance-related staff into opening a ZIP file containing a malicious ISO image. Once mounted and executed, the ISO drops a multi-stage payload chain that ultimately runs Phantom Stealer, which uses DLL injection, anti-analysis checks, and steganography to load and hide its code. The stealer targets browser credentials, cookies, credit cards, crypto wallets, Discord tokens, clipboard data, keystrokes, and selected files, then exfiltrates everything via Telegram bots, Discord webhooks, or FTP.

seqrite.com · 10 min

TLDR InfoSec

STILLEPOST- OR HOW TO PROXY YOUR C2'S HTTP TRAFFIC THROUGH CHROMIUM

Chrome DevTools Protocol (CDP) allows tools to inspect, debug, instrument, and profile Chrome and other Chromium browsers. CDP provides a tempting target for C2 communication because the traffic can blend in with existing traffic and because browsers are usually already configured with appropriate proxy and firewall information. This post demonstrates a C2 implant that uses CDP to run in a headless browser and communicate with the C2 server via XHR requests driven by CDP JavaScript.

x90x90.dev · 7 min

TLDR InfoSec

guarantee.

Summary unavailable

xbow.com

TLDR InfoSec

REGSCALE (PRODUCT LAUNCH)

RegScale provides an AI-powered Continuous Controls Monitoring platform that automates governance, risk, and compliance processes, replacing manual, document-based workflows with real-time, integrated, “compliance as code” across highly regulated environments.

regscale.com

TLDR InfoSec

VOLKLOCKER RANSOMWARE EXPOSED BY HARD-CODED MASTER KEY ALLOWING FREE DECRYPTION

Pro-Russian hacktivist group CyberVolk's new VolkLocker ransomware-as-a-service contains a critical implementation flaw that hard-codes AES-256 master keys in binaries and writes them to a plaintext file in the %TEMP% folder, enabling free decryption without paying the ransom. The Golang-based malware targets Windows and Linux systems, featuring privilege escalation, VM detection, shadow copy deletion, and a 48-hour enforcement timer that wipes user folders if payment isn't made. Victims should check for the system_backup.key file in their Temp directory before considering a ransom payment, as this oversight renders the $800-$2,200 RaaS offering ineffective for attackers.

thehackernews.com · 4 min

TLDR InfoSec

JLR: PAYROLL DATA STOLEN IN CYBERCRIME THAT SHOOK UK ECONOMY

Jaguar Land Rover confirms that a cyberattack in August not only halted factory production, it also exposed payroll data for current and former staff, including bank details and tax information. The incident has driven reported sales losses of £1.5 billion, plus £196 million in related losses, and is estimated to have cost the broader UK economy up to £2.1 billion, with the Scattered Lapsus Hunters group blamed.

theregister.com · 3 min

TLDR InfoSec

THIRD DRAFTKINGS HACKER PLEADS GUILTY

Nathan Austad, a 21-year-old from Minnesota known as “Snoopy,” admitted to helping run a credential stuffing scheme that compromised over 60,000 betting-site accounts, drained roughly $600,000 from about 1,600 victims, and sold access via online shops. He now faces up to five years in prison and is the third defendant tied to the DraftKings-related hacks.

securityweek.com · 2 min

TLDR InfoSec

PROCESSING 630 MILLION MORE PWNED PASSWORDS, COURTESY OF THE FBI

Have I Been Pwned has added 630 million passwords from FBI-seized devices, including 46 million previously unseen credentials originating from dark web marketplaces, Telegram channels, and infostealer malware, to its free password-checking service, which now handles over 18 billion monthly queries.

troyhunt.com · 2 min

TLDR InfoSec

GOOGLE WILL END DARK WEB REPORTS THAT ALERTED USERS TO LEAKED DATA

Google is shutting down its dark web reports feature, which notified people when their personal data appeared on criminal marketplaces.

arstechnica.com · 3 min

TLDR InfoSec

HAMAS LINKED HACKERS USING ASHTAG MALWARE AGAINST DIPLOMATIC OFFICES

Hamas-linked threat group Ashen Lepus (WIRTE) has expanded its espionage campaign to target diplomatic offices across the Middle East using new AshTag malware delivered via geopolitical-themed lure documents.

hackread.com · 2 min