TLDR INFORMATION SECURITY 2025-05-05

SECURITY ROLES →

Who is Coinbase [4]? Here's what they say:

* Staff Blockchain Security Architect →

* Director, Technology Risk →

* SEE ALL OPEN INFORMATION SECURITY ROLES →

WGET TO WIPEOUT: MALICIOUS GO MODULES FETCH DESTRUCTIVE PAYLOAD

Socket found three malicious Go modules with hidden code that can download payloads to wipe a Linux system's primary disk (/dev/sda), making it unbootable. Attackers exploited the decentralized nature of the Go ecosystem and confusion around namespace validity to disguise malicious modules as legitimate. The payloads executed commands that wiped disks, causing irreversible data loss and severe disruptions for affected organizations.

DATING APP RAW EXPOSED USERS' LOCATION DATA AND PERSONAL INFORMATION

Due to a security vulnerability, dating app Raw exposed users' personal data, including names and locations. Raw fixed the issue but hasn't committed to notifying affected users.

BRITISH GOVT AGENTS STEP IN AS HARRODS BECOMES THIRD MEGA RETAILER UNDER CYBERATTACK

Harrods is the third major UK retailer facing cybersecurity issues in two weeks, following M&S and Co-op. The luxury store restricted internet access after unauthorized access attempts but kept stores open. While no organization has confirmed ransomware involvement, experts suggest Scattered Spider might be behind the attacks.

VIBE CODING TOOLS & EDUCATIONAL CYBER GAMES

Daniel Card vibe-coded cybersecurity tools and educational games using AI (specifically GROK). These tools include a data visualization mapper for OSINT and attack surface mapping, SOC Chef (a collection of resources for security operations professionals), and an interactive timeline creation tool. He's also developed educational games like "Cyber Detective," "Attack the Net," and "Defend the Net" that demonstrate cybersecurity concepts from both attacker and defender perspectives, accomplishing in days what would have previously taken him weeks or months to develop.

WHY MFA IS GETTING EASIER TO BYPASS AND WHAT TO DO ABOUT IT

Phishing-as-a-service toolkits allow criminals to bypass common multifactor authentication (MFA) through adversary-in-the-middle attacks. These tools create proxy servers that intercept credentials and MFA codes between victims and legitimate sites. While traditional MFA (one-time codes or push notifications) is vulnerable, WebAuthn-based authentication (passkeys) remains resistant because credentials are cryptographically bound to specific URLs and devices.

SLOW PISCES TARGETS DEVELOPERS WITH CODING CHALLENGES AND INTRODUCES NEW CUSTOMIZED PYTHON MALWARE

Slow Pisces is a North Korean hacking group primarily focused on generating revenue for the DPRK by targeting cryptocurrency organizations. A new campaign associated with Slow Pisces involves reaching out to cryptocurrency developers and directing them to a coding challenge that involves a malicious repository that downloads and runs a malicious C2 server. If the victim opts for a Python interview, the malware is launched via YAML deserialization, whereas if they opt for a JavaScript interview, the malware is loaded via ejs templates.

Application Security

LAYERX SECURITY (PRODUCT LAUNCH)

LayerX provides AI-powered browser security to protect users from threats such as rogue extensions, gen-AI risks, data leakage, web threats and vulnerabilities, and more.

MCP FOR SECURITY

MCP for Security is a collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan, and more. Integrate security testing and penetration testing into AI workflows.

B3ACON

b3acon is an email-based C2 server that uses an in-memory, dynamically compiled C# IMAP client via PowerShell.

HOW I MADE $64K FROM DELETED FILES — A BUG BOUNTY STORY

The author found and reported leaked secrets by scanning thousands of public GitHub repos for deleted files containing sensitive information. Using automation, they restored deleted files, searched for exposed credentials, and analyzed the Git history to recover secrets. This approach uncovered common causes of secret leaks, such as a lack of Git knowledge and accidental commits of binary files containing sensitive data.

MICROSOFT GOES PASSWORDLESS BY DEFAULT ON NEW ACCOUNTS

Microsoft is replacing passwords with passwordless options like passkeys for new accounts by default. The initiative features a redesigned sign-in process optimized for passkeys. While existing accounts can keep passwords, Microsoft reports nearly one million daily passkey registrations with a 98% sign-in success rate versus 32% for passwords.

XAI DEV LEAKS API KEY FOR PRIVATE SPACEX, TESLA LLMS

An xAI employee leaked an API key on GitHub that allowed access to private AI models custom-built for Elon Musk's companies (SpaceX, Tesla, and X). The leak remained active for two months despite alerts. The exposed models included unreleased versions of Grok and specialized AI tools containing proprietary company data.

MICROSOFT ENDS AUTHENTICATOR PASSWORD AUTOFILL, MOVES USERS TO EDGE

Microsoft is phasing out password autofill in Authenticator and moving users to Edge by August 2025.

AMAZON, CROWDSTRIKE, GOOGLE, AND PALO ALTO NETWORKS CLAIM NO CHANGE TO THREAT INTEL SHARING UNDER TRUMP

Major security firms like Amazon, CrowdStrike, Google, and Palo Alto Networks report no disruptions in sharing threat intelligence with the federal government under President Trump.

IHEARTMEDIA SUFFERS BREACH THAT WENT UNNOTICED FOR MONTHS

iHeartMedia is offering credit monitoring and identity theft protection to individuals impacted by a data breach in December that exposed personal information such as Social Security numbers.