TLDR INFORMATION SECURITY 2025-05-14

Request a free 30 day trial

UPDATE VMWARE TOOLS: HACKERS CAN TAMPER WITH VIRTUAL MACHINES

Hackers can exploit a vulnerability in VMware Tools to tamper with virtual machines. Broadcom has released patches to fix the issue, which affects Windows and Linux versions 12.x.x and 11.x.x. Users are urged to apply the fixed version 12.5.2 to secure their virtual machines.

SECURITY FIRM ANDY FRAIN SAYS 100,000 PEOPLE IMPACTED BY RANSOMWARE ATTACK

Security company Andy Frain Services reported a data breach affecting over 100,000 people. Discovered in October 2024, the Black Basta ransomware group claimed responsibility, allegedly stealing 750GB of sensitive files. Impacted individuals are being offered credit monitoring and identity restoration services.

ATTACKERS PWN CHARTER AIRLINE HELPING TRUMP'S DEPORTATION CAMPAIGN

Charter airline GlobalX reported unauthorized network access on May 5, prompting incident response protocols and cybersecurity expert involvement. As a government deportation contractor, the breach potentially exposed flight records and passenger manifests.

ANALYSIS OF APT37 ATTACK CASE DISGUISED AS A THINK TANK FOR NATIONAL SECURITY STRATEGY IN SOUTH KOREA

The APT37 threat actor from North Korea launched a March 2025 spear phishing campaign, posing as a South Korean national security think tank, which delivered malicious LNK files via Dropbox that ultimately installed the RoKRAT backdoor. Dubbed "Operation: ToyBox Story," the attack employed fileless malware techniques to evade detection, with the RoKRAT backdoor capturing screenshots and system info before encrypting and exfiltrating data to cloud-based command servers. The attackers utilized legitimate cloud services (Dropbox, pCloud, and Yandex) as C2 infrastructure and Russian Yandex email addresses, specifically targeting activists focused on North Korea.

A PYTHON IN DISGUISE: UNPACKING PYINSTALLER MALWARE ON MACOS

Attackers use PyInstaller to package malicious Python code into standalone Mach-O executables for macOS, eliminating the need for Python installation. This attack involves bundling obfuscated infostealer code (string reversal, base85 encoding, XOR encryption, and zlib compression) that extracts credentials from password prompts, executes malicious AppleScript, steals from the keychain, and targets cryptocurrency wallets. Upon execution, these binaries create temporary directories with the extracted Python libraries and malicious code, which exist only during the malware's runtime.

FAKE GIF LEVERAGED IN MULTI-STAGE REVERSE-PROXY CARD SKIMMING ATTACK

This blog post examines a sophisticated card-stealing malware that exploited a vulnerability in an outdated Magento eCommerce site. The first stage of the malware injects obfuscated JS onto every page that loads a PHP script, which masquerades as a GIF and sets up a reverse proxy to intercept all requests before modifying the responses to hide its activity and planting a trigger in the user's User Agent. A second tampered file, onestepcheckout[.]phtml, loads the payload out of the User Agent into sessionStorage, and if the trigger is detected, the onestepcheckout injection detonates on the checkout page.

POWERDODDER

PowerDodder is a post-exploitation persistence utility designed to stealthily embed execution commands into existing script files on the host. By leveraging frequently accessed but rarely modified files, it targets high-likelihood execution vectors with minimal detection risk.

MOTTAHUNTER

MottaHunter is an advanced email reconnaissance tool designed for security professionals. It allows users to search for emails on Google, Twitter, and LinkedIn, validate them through SMTP, and create intelligent permutations. Features include rate limiting, catch-all detection, and permutation splitting for discrete operations.

CYNOMI (PRODUCT LAUNCH)

Cynomi offers virtual CISO agents that can assess a network, plan a set of security policies, make remediation plans, track progress, run analytics to find vulnerabilities in a network, recommend system optimizations, and produce reports on the network's status and health.

MARKS & SPENCER CONFIRMS CUSTOMERS' PERSONAL DATA WAS STOLEN IN HACK

During a recent cyberattack, Marks & Spencer confirmed that hackers stole customer data, including names, dates of birth, addresses, phone numbers, and order histories. The retailer is resetting passwords while experiencing ongoing store and online disruptions. DragonForce allegedly claimed responsibility for this and other UK retail hacks.

AN OPEN LETTER TO THIRD-PARTY SUPPLIERS

Patrick Opet, CISO of JPMorgan Chase, penned an open letter addressing the increasing prevalence of SaaS as the preferred or exclusive method of distributing third-party software. Opet highlighted issues where third-party suppliers prioritize new features to compete with their competitors over security and where authentication and authorization are blurring together, leading to architectural vulnerabilities and hidden dependencies that the vendors themselves use. He calls on third parties to prioritize security and calls upon practitioners to push back against solutions that do not do so.

AMAZON COGNITO NOW SUPPORTS REFRESH TOKEN ROTATION

Amazon Cognito has announced the release of a new feature that allows customers on the Essentials or Plus tiers to configure automatic refresh token rotation for user pool clients. Before this feature, customers had to choose between long-lived tokens to reduce user friction at the cost of reduced security or short-lived tokens that were more secure but required users to reauthenticate more frequently.

SUSPECTED DOPPELPAYMER RANSOMWARE GROUP MEMBER ARRESTED

A member of the DoppelPaymer ransomware group was arrested in Moldova for ransomware attacks and money laundering targeting organizations in the Netherlands.

GOOGLE ADDS SUITE OF SECURITY FEATURES TO ANDROID 16

Android 16 enhances security with AI tools to combat scams, malware, and theft, blocking fake messages and warning users during risky calls.

NEW EU VULNERABILITY DATABASE WILL COMPLEMENT CVE PROGRAM, NOT COMPETE WITH IT, SAYS ENISA

The EU has introduced a vulnerability database (EUVD) to complement the U.S.-based CVE system by tracking security flaws pertinent to Europe and aiding new cybersecurity regulations.