TLDR INFORMATION SECURITY 2025-03-18

100 CAR DEALERSHIPS HIT BY SUPPLY CHAIN ATTACK

100 dealerships have been compromised through ClickFix code displaying fake reCAPTCHA prompts. When clicked, these prompts copied commands to users' clipboards and instructed them to execute these in Windows Run, ultimately installing SectopRAT malware.

APACHE TOMCAT VULNERABILITY ACTIVELY EXPLOITED JUST 30 HOURS AFTER PUBLIC DISCLOSURE

CVE-2025-24813 in Apache Tomcat is under active exploitation 30 hours post-disclosure. The vulnerability enables remote code execution through malicious serialized Java uploads via PUT requests, no authentication is required. It is critical to update to versions 9.0.99, 10.1.35, and 11.0.3 ASAP.

MALICIOUS ADOBE, DOCUSIGN OAUTH APPS TARGET MICROSOFT 365 ACCOUNTS

Proofpoint researchers uncovered a malware campaign using malicious OAuth apps posing as Adobe Drive, Adobe Drive X, Adobe Acrobat, and DocuSign. These apps request minimal benign permissions but redirect users to phishing pages or malware downloads.

DETECTING HOTKEY-BASED KEYLOGGERS USING AN UNDOCUMENTED KERNEL DATA STRUCTURE

Hotkey-based keyloggers register alphanumeric hotkeys that, on keypress, record the keystroke, unregister the hotkey, resend the keypress, and reregister the hotkey. These keyloggers are stealthy since the RegisterHotKey and UnregisterHotKey APIs are not monitored by ETW. In this post, Elastic researchers detail their detection method for hotkey-based keyloggers using an undocumented kernel data structure listing all registered keyloggers' hotkeys.

THE CAT FLAP - HOW TO REALLY PURRSIST IN AWS ACCOUNTS

This post describes a method for obtaining backdoor persistence in AWS by modifying the AWSControlTowerExecution role to allow an attacker-controlled account to assume it. The attack is effective because many tools will not flag violations against this role, which contains AdministratorAccess by default. There are likely other AWS service roles that this attack could utilize.

ANALYSIS AT SCALE WITH X64DBG AUTOMATE

The post covers how to use x64dbg Automate to automate repetitive x64dbg tasks like finding malware entrypoints, annotating payloads, and bypassing anti-debug checks. A malware sample is included for experimentation.

ongoing CVE management. Read the blog

AICEBERG (PRODUCT LAUNCH)

Aiceberg is designed to prevent unsanctioned, unsuitable, or illegal content and automatically redacts personal and other sensitive information. It can detect common cyberattack vectors such as prompt injection, prompt leaking, and jailbreaking and is capable of performing a security analysis of agentic workflows.

NODE VERSION AUDIT

Node Version Audit is a convenient tool to easily check a given Node.js version against a regularly updated list of CVE exploits, new releases, and end-of-life dates.

ANNOUNCING OSV-SCANNER V2: VULNERABILITY SCANNER AND REMEDIATION TOOL FOR OPEN SOURCE

Google's OSV-Scanner V2.0.0 is an open-source vulnerability scanner that now integrates with OSV-SCALIBR. It offers improved dependency extraction, layer-aware container scanning for Debian, Ubuntu, and Alpine images, interactive HTML output, and guided remediation for Maven pom.xml files. Future plans for the project include enhanced integration with OSV-SCALIBR, increased ecosystem support, full filesystem accountability, reachability analysis, and VEX support.

TIKTOK ROLLS OUT A ‘SECURITY CHECKUP' TOOL TO HELP USERS SECURE THEIR ACCOUNTS

TikTok's new "Security Checkup" tool offers users a centralized screen to review security settings, enabling two-factor authentication, backup logins, device management, and biometric options.

ATTACKERS USE CSS TO CREATE EVASIVE PHISHING MESSAGES

Threat actors are using CSS to create evasive phishing messages by hiding text and tracking user behavior. Cisco Talos has observed attackers exploiting CSS to evade detection and raise security concerns. Experts recommend using advanced filtering and privacy proxies to mitigate these risks.

UPDATE: STOPPING CYBERCRIMINALS FROM ABUSING COBALT STRIKE

Microsoft, Fortra, and Health ISAC are working together to stop cybercriminals from misusing Cobalt Strike and compromised Microsoft software to deploy ransomware. They have made significant progress in reducing the availability of unauthorized copies and seizing malicious domains. Ongoing efforts include sending takedown notices and collaborating with law enforcement to combat illicit usage of cyber intrusion tools.

JAGUAR LAND ROVER BREACHED BY HELLCAT RANSOMWARE GROUP USING ITS INFOSTEALER PLAYBOOK—THEN A SECOND HACKER STRIKES

The HELLCAT ransomware group breached Jaguar Land Rover (JLR) by leaking sensitive data through stolen Jira credentials obtained via infostealer malware, which were later exploited by another actor, "APTS," to exfiltrate additional data from JLR.

EMAIL SECURITY NOW AVAILABLE FOR FREE FOR POLITICAL PARTIES AND CAMPAIGNS THROUGH CLOUDFLARE FOR CAMPAIGNS

Cloudflare is offering free Email Security to protect political campaigns from cyber attacks.

WHITE HOUSE EXEMPTS CYBER PROS FROM MASS LAYOFFS; JUDGE REINSTATES CISA FIRINGS

The White House has exempted cybersecurity professionals from layoffs, offering hope during CISA job cuts, and a judge has reinstated fired federal employees, underscoring management incompetence in the DOGE project.