TLDR INFORMATION SECURITY 2025-05-26

Ditch the slog. Get compliant the smart way.

TLDR readers get $2000 off [4] AND a free custom Arc'teryx jacket.

CISA WARNS OF SUSPECTED BROADER SAAS ATTACKS EXPLOITING APP SECRETS AND CLOUD MISCONFIGS

Hackers broke into Commvault's cloud backup system and stole secret passwords that let them access customers' Microsoft 365 accounts. The attackers used a security flaw to sneak into the system. U.S. cybersecurity officials are helping investigate and have advised companies on how to protect themselves from similar attacks.

RANSOMWARE SCUM LEAKED NOVA SCOTIA POWER CUSTOMERS' INFO

Nova Scotia Power confirmed a ransomware attack that started in March affected 280,000 customers. Hackers stole personal data, including names, addresses, billing details, and some bank account numbers, then leaked it online. The power company refused to pay ransom and is offering free credit monitoring to affected customers.

DATA-STEALING CHROME EXTENSIONS IMPERSONATE FORTINET, YOUTUBE, VPNS

Researchers at DomainTools identified a malware campaign that uses a collection of over 100 malicious websites offering fake VPNs or masquerading as legitimate services to trick users into installing Chrome extensions. The extensions serve different malware variants, such as info stealers and backdoors. DomainTools reported the malicious extensions to Google Chrome, which removed some but not all of them.

BADUSB ATTACK EXPLAINED: FROM PRINCIPLES TO PRACTICE AND DEFENSE

This post dives into BadUSB, an attack method introduced in 2014 where hackers reprogram USB device firmware to disguise it as a keyboard. When plugged in, the fake USB device automatically types malicious commands into the computer. Antivirus software cannot detect these attacks since they appear as legitimate keyboard input.

DISSECTING THE MACOS 'APPLEPROCESSHUB' STEALER: TECHNICAL ANALYSIS OF A MULTI-STAGE ATTACK

This analysis looks at the macOS "AppleProcessHub" stealer, which was discovered on May 15. It appears as a dynamic library file (libsystd.dylib) but is actually an executable written in Objective-C. The malware employs AES-128 encryption to decrypt hardcoded strings that form the command and control server URL (appleprocesshub[.]com), then downloads and runs a bash script to steal sensitive data like keychain passwords, SSH keys, shell history, and cryptocurrency wallets. The stolen data is compressed and sent to the attacker's server. The malware can run any script on the C2 infrastructure, making it a versatile tool for data exfiltration targeted at macOS users.

ROOT IN PROD: THE MOST IMPORTANT SECURITY ANALYSIS YOU WILL NEVER DO ON YOUR AWS ACCOUNTS

This blog post explains how to identify all principals with root-level access in AWS production environments, which organizations rarely audit comprehensively. It provides code snippets to discover AWS accounts, map IAM roles/users with administrative privileges, analyze SSO permissions, and visualize trust relationships that allow privilege escalation through role assumption chains. The analysis reveals that production access often extends beyond intended administrators to include CI/CD pipelines, forgotten legacy roles, and external accounts through overly permissive trust policies, creating massive attack surfaces that most organizations don't realize exist.

missing link. Browse Oso's resources on LLM Access Control.

BREACHRX (PRODUCT LAUNCH)

The BreachRx platform is a browser-based workspace for every stakeholder in an organization. It is designed to coordinate and streamline cybersecurity incident response management.

NOVOPS

Novops is a cross-platform secret and config manager for development and CI environments.

CAN YOU BLOCK IT? (WEB APP)

This ad blocker test site offers three different levels with different categories of ads to test the effectiveness of a browser's ad-blocking protection.

OOPS: DANABOT MALWARE DEVS INFECTED THEIR OWN PCS

The U.S. government arrested 16 people who created and sold computer viruses called DanaBot. These viruses have stolen passwords and money from over 300,000 computers worldwide since 2018, causing $50 million in damage. The criminals charged $3,000-4,000 monthly for access to their virus software before being caught.

MYSTERIOUS HACKING GROUP CARETO WAS RUN BY THE SPANISH GOVERNMENT, SOURCES SAY

Researchers discovered an alleged Spanish government hacking group called "Careto" that has been secretly spying on other countries since 2007. The hackers mainly targeted Cuba, looking for information about terrorists hiding there. They used very advanced computer viruses to steal passwords, conversations, and government secrets from 31 countries worldwide.

UK PIONEERING GLOBAL MOVE AWAY FROM PASSWORDS

The UK Government announced that it plans to roll out passkey support for all its digital services this year as an alternative to the current SMS-based verification system. The UK's NCSC views passkeys as vital for transforming national cyber resilience.

FBI WARNS OF SILENT RANSOM GROUP TARGETING LAW FIRMS VIA SCAM CALLS

The FBI alerts that the Silent Ransom Group is attacking law firms with scam calls and phishing emails to steal sensitive information.

OPERATION ENDGAME DISRUPTED GLOBAL RANSOMWARE INFRASTRUCTURE

Operation ENDGAME shut down major ransomware systems worldwide, removing 300 servers and 650 domains.

BEIJING MAY HAVE BREACHED US GOVERNMENT SYSTEMS BEFORE CITYWORKS PLUGGED A CRITICAL FLAW

Chinese hackers took advantage of a critical vulnerability in Cityworks software used by U.S. local governments, allowing them to execute malicious code and remain undetected in affected systems.