TLDR INFORMATION SECURITY 2025-03-17

Register for the workshop

CLICKFIX: HOW TO INFECT YOUR PC IN THREE EASY STEPS

The "ClickFix" scheme tricks users into downloading password-stealing malware disguised as CAPTCHA verification. Users press Windows+R, CTRL+V, and Enter, which activates the download through mshta.exe. Organizations can prevent this by disabling the run command for the Windows+R shortcut.

A DOGE STAFFER BROKE TREASURY POLICY BY EMAILING UNENCRYPTED PERSONAL DATA

A 25-year-old DOGE staffer violated Treasury policy by sending an unencrypted spreadsheet with personal data to Trump officials. Marko Elez, who previously worked for Musk's companies, had been "mistakenly" granted access to Treasury systems before resigning in February due to racist posts. He was rehired at the Social Security Administration despite ongoing litigation.

GITHUB ACTION TJ-ACTIONS/CHANGED-FILES SUPPLY CHAIN ATTACK: EVERYTHING YOU NEED TO KNOW

The tj-actions/changed-files GitHub Action repository was compromised by an attacker posing as the Renovate bot. The attacker added a malicious payload that caused the CI runner to dump its memory into the Actions work log and redirected all tags to include this payload. Sensitive data in GitHub secrets for this action can be visible in public repos, but the impact on private repositories is more limited.

GUARD YOUR CODEBASE: PRACTICAL STEPS AND TOOLS TO PREVENT MALICIOUS CODE

Apiiro researchers found that targeting specific coding anti-patterns enabled them to detect malicious packages with a 94.3% success rate in Python and 88.4% in npm. They focused on obfuscated code and dynamic code execution and have released Semgrep rules for detection.

HIERARCHY OF NEEDS

Swannman's Hierarchy of Needs Pyramid model outlines 10 essential layers for establishing effective security functions, with threat hunting as a specialized function at the top. The Hierarchy of Needs aids organizations in planning and assessing incident response capabilities by identifying advanced metrics for complex questions. The Plateaus Model tracks organizational maturity throughout the hierarchy.

WHOAMI - GET PRINCIPAL NAME FROM KEYS

Attackers often use get-caller-identity to find IAM roles linked to keys, but this API call can be monitored. This post shares a tactic to bypass these detections by querying an API that returns caller identity on a failed call.

social media. Learn more about running your first campaign.

TUMERYK (PRODUCT LAUNCH)

Tumeryk's AI Trust Scores assesses risk using nine factors, offering CISOs objective security scores for gen AI models.

YAAK API CLIENT

Yaak is a desktop client for interacting with REST, GraphQL, WebSocket, and gRPC APIs.

NULLGATE

NullGate provides a modern approach to using NTAPI functions via indirect syscalls and the FreshyCalls method for dynamic syscall number retrieval. It includes a novel technique to bypass Windows Defender's memory scanning and features a classic PoC process injector.

UK'S SECRET ICLOUD BACKDOOR ORDER TRIGGERS CIVIL RIGHTS CHALLENGE

The UK government's order for Apple to backdoor iCloud encryption has faced legal challenges from Liberty and Privacy International, who deem it "unacceptable and disproportionate" with "global consequences" for non-UK users.

DEMS ASK FEDERAL AGENCIES FOR REASSURANCE DOGE ISN'T FEEDING DATA INTO AI WILLY-NILLY

House Democrats have questioned 24 federal agencies about Elon Musk's DOGE team possibly sharing sensitive government data with unauthorized AI systems. Rep. Gerald Connolly raised concerns about legal violations, data privacy, and handling of Americans' personal information, requesting responses on DOGE's AI activities by March 26.

FAKE "SECURITY ALERT" ISSUES ON GITHUB USE OAUTH APP TO HIJACK ACCOUNTS

A phishing campaign on GitHub uses fake "Security Alert" issues to trick users into granting access to a malicious OAuth app, giving attackers complete control over accounts and code. The alerts mention unusual activity from Reykjavik, Iceland, and the 53.253.117.8 IP address, urging users to allow risky permissions. Affected users must revoke access, inspect for suspicious apps, and change credentials immediately.

LOCKBIT DEVELOPER ROSTISLAV PANEV EXTRADITED FROM ISRAEL TO THE US

LockBit ransomware developer Rostislav Panev was extradited from Israel to the US on charges related to his role in the global LockBit ransomware cybercrime.

NEW MASSJACKER CLIPPER TARGETS PIRATED SOFTWARE SEEKERS

MassJacker is a new clipper malware that targets users seeking pirated software by replacing their cryptocurrency wallet addresses with those controlled by hackers, facilitating fund theft.

GOVERNMENTS WON'T LIKE THIS: ENCRYPTED MESSAGING BETWEEN ANDROID AND IOS DEVICES COMING, SAYS GSMA

The GSM Association's RCS Universal Profile version 3.0 has been released, promising to unlock interoperable encrypted messages between Android and iOS devices.