TLDR INFORMATION SECURITY 2025-05-09

Discover how Black Duck delivers True Scale Application Security

COGUI PHISHING PLATFORM SENT 580M EMAILS TO STEAL CREDENTIALS

A new phishing kit called CoGUI was used to send over 580M emails to targets between January and April. The attack chain begins with an email impersonating a legitimate site with an urgent subject line. The email includes a link that checks if the victim's machine matches a series of criteria such as IP, browser language, OS, etc, and presents a fake login page if the criteria match or redirects the victim to the legitimate site if not. CoGUI is the largest volume phishing campaign Proofpoint is tracking.

KICKIDLER EMPLOYEE MONITORING SOFTWARE ABUSED IN RANSOMWARE ATTACKS

Kickidler is an employee monitoring tool that can capture keystrokes, take screenshots, and create videos of employees' screens. A new ransomware campaign operates by using Google Ads masquerading as ads for RVTools, a free Windows utility for managing VMware vSphere deployments. This leads users to download a trojanized version of the software that includes a PowerShell backdoor that deploys Kickidler on the device. The ransomware operator then monitors the victim's (likely an administrator) machine to collect credentials for sensitive systems and off-site cloud backups without detection.

SUPPLY CHAIN ATTACK HITS NPM PACKAGE WITH 45,000 WEEKLY DOWNLOADS

rand-user-agent, an npm package, was compromised in a supply chain attack that caused it to inject obfuscated code that activates a remote access trojan (RAT) on users' systems. Aikido detected the compromise on May 5, when its malware analysis flagged version 1.0.110. Researchers found obfuscated code hidden in 'dist/index.js', visible only by scrolling horizontally in the npm site's source view.

DOCUMENT MY PENTEST: YOU HACK, THE AI WRITES IT UP!

The PortSwigger research team developed a Burp AI extension that automatically documents a pentest based on the request history. The initial implementation was good at spotting Path Traversal vulnerabilities, but struggled with more complex vulnerabilities like XSS until the team added a regex translator to transform inputs. The team found that the AI could be directly asked to explain why it reported that a false positive was a vulnerability and how to improve its prompt to classify vulnerabilities better.

THE MASSIVE, HIDDEN INFRASTRUCTURE ENABLING BIG GAME HUNTING AT SCALE

Advertisers use Traffic Distribution Systems (TDSs) to direct potential customers to highly targeted ads. Insikt Group has been tracking how cybercriminals utilize malicious TDSs to direct victims to the malware with the highest likelihood of success against the target. Insikt Group has identified a TDS known as TAG-124 that is used by multiple threat actors, such as the Rhysida Ransomware-as-a-Service operation, Iterlock Ransomware, and TA866/ Asylum Ambuscade, but notes that TDSs are hard to defend against because they occur so early in the cyberattack life cycle.

THE PATH TO MEMORY SAFETY IS INEVITABLE

This article discusses memory safety approaches beyond language choice, emphasizing comprehensive solutions including sanitizers, fuzzers, and compiler-based mitigations. The practices include selecting robust distributions like Debian, using tools like Fil-C for C/C++ safety, and implementing runtime protections.

RULEHOUND

Rulehound is an index of publicly available and open-source threat detection rulesets.

CODEANT AI (PRODUCT LAUNCH)

CodeAnt automatically reviews pull requests, flags issues, and proposes fixes. It continuously scans and monitors code and dependencies for a wide range of quality and security issues.

NOSEYPARKER

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.

OPEN SOURCE PROJECT CURL IS SICK OF USERS SUBMITTING “AI SLOP” VULNERABILITIES

Daniel Stenberg, the original author of the curl project, posted on LinkedIn about an increasing issue of AI-generated bug reports being submitted to the program on HackerOne. Stenberg has said that maintainers on the project are getting bogged down by “AI slop” reports that include hallucinated vulnerabilities such as one that he cites in the article in which the reported claimed to have found a “novel exploit leveraging stream dependency cycles in the HTTP/3 protocol stack” but the reporter continuously gave nonsensical responses to follow-up questions. Stenberg announced that any reporters of “AI slop” vulnerabilities will be banned from the project.

GOOGLE ROLLS OUT AI TOOLS TO PROTECT CHROME USERS AGAINST SCAMS

Google is enhancing Chrome security with Gemini Nano, an on-device AI model, to protect desktop users against scams through Enhanced Protection mode. New AI warnings on Android will also help users identify malicious notifications. Google claims these AI systems have already reduced airline customer service scams by 80% and blocked millions of scammy pages.

ADOPTING SUDO-RS BY DEFAULT IN UBUNTU 25.10

Ubuntu 25.10 will be the first major Linux distribution to adopt sudo-rs, a Rust reimplementation of sudo developed by the Trifecta Tech Foundation. This memory-safe alternative aims to enhance security at the privilege boundary while maintaining compatibility. The transition should be transparent for most users, though some niche features may not be included.

DELTA AIR LINES CLASS ACTION CLEARED FOR TAKEOFF OVER CROWDSTRIKE CHAOS

A federal judge has advanced a class action lawsuit against Delta Air Lines by passengers affected by the July 2024 CrowdStrike software outage.

FAKE CRYPTO EXCHANGE ADS ON FACEBOOK SPREAD MALWARE

Fake crypto exchange ads on Facebook are spreading malware through deceptive tactics like using celebrity names and trusted cryptocurrency exchange logos to lure users into downloading malicious software.

EUROPOL ANNOUNCES MORE DDOS SERVICE TAKEDOWNS, ARRESTS

Europol has shut down six DDoS attack websites and arrested four individuals in Poland for running a network of platforms used for attacks.