TLDR INFORMATION SECURITY 2025-06-16

Time to switch to Proton Drive.

✅ Unlike Google and Microsoft, Proton uses END-TO-END ENCRYPTION, which means nobody—no tech company, no governments, not even Proton—can access your files. No scanning, no sharing, no AI training.

Get started for $7.99/user/month with 1 TB per user

PALO ALTO NETWORKS FIXED MULTIPLE PRIVILEGE ESCALATION FLAWS

Palo Alto Networks fixed seven privilege escalation vulnerabilities in its products, the most severe of which was CVE-2025-4232 (CVSS 7.1), which allows non-administrative macOS users to escalate privileges to root through a wildcard vulnerability in GlobalProtect's log collection feature. The company also patched two authenticated admin command injection flaws in PAN-OS (CVE-2025-4231 and CVE-2025-4230) that enabled authenticated administrators to execute commands as root users. Palo Alto also integrated 11 Chrome security patches and addressed a cache vulnerability in Prisma Access Browser. There were no known active exploits of these vulnerabilities.

DISCORD INVITE LINK HIJACKING DELIVERS ASYNCRAT AND SKULD STEALER TARGETING CRYPTO WALLETS

Attackers are exploiting Discord's invite system by hijacking expired vanity links to redirect users from trusted sources to malicious servers distributing AsyncRAT and Skuld Stealer malware targeting cryptocurrency wallets. The attack, designed to harvest credentials from Exodus and Atomic wallets via injection techniques, employs ClickFix social engineering to trick users into running PowerShell commands that download multi-stage payloads, followed by Skuld Stealer. The campaign targets users in the US, Vietnam, France, Germany, and other countries using trusted cloud services like GitHub, Bitbucket, and Pastebin to blend malicious traffic with legitimate communications.

PARAGUAY SUFFERED DATA BREACH: 7.4 MILLION CITIZEN RECORDS LEAKED ON DARK WEB

Hackers leaked the personal data of 7.4 million people in Paraguay on the dark web. A cybercriminal group called "Cyber PMC" demanded $7.4 million, blaming government corruption and poor security.

HUNTING THROUGH APIS

This blog compares three Microsoft security APIs for threat hunting: Azure Monitor API, which queries Sentinel data only; Graph API, which queries both Defender XDR and Sentinel data, and Defender ATP API, which is limited to Defender for Endpoint data. The Graph API is recommended as it offers unified access to both platforms and supports more data types, while the Defender ATP API has notable limitations, such as a 30-day query timeframe restriction. Each API needs specific permissions and has different rate limits, with the Graph API allowing over 45 calls per minute based on tenant size.

BUILDING UBER'S MULTI-CLOUD SECRETS MANAGEMENT PLATFORM TO ENHANCE SECURITY

Uber initially employed various secrets management practices and vaults for different teams and clouds, which it consolidated into six vaults under the purview of its Secrets team. The Secrets team created scanners to perform real-time scanning and scheduled scanning to identify secrets usage in chat apps and code, as well as built APIs for automated secrets rotation from the centralized secrets vaults. The team also developed a secrets exchange system to distribute secrets to third-party vendors.

WHY IS NO ONE TALKING ABOUT MAINTENANCE IN DETECTION ENGINEERING?

With the movement of detection engineering towards a detection-as-code model, detection engineers must also embrace software maintenance requirements. Maintenance can be broken down into four categories: corrective maintenance, which directly fixes an issue that is occurring; adaptive maintenance, which adapts the detection to changing requirements such as a new API; perfective maintenance, which focuses on improving the query, documentation, or adding new features; and preventative maintenance, which proactively seeks to address issues before clients identify them. Although all detection engineering teams must perform maintenance, there is a dearth of information and posts discussing it.

PRIVADO

Privado is an open-source static scanning tool that detects data flows in your code, identifies data security vulnerabilities, and generates Play Store Data Safety Reports. It identifies over 110 personal data elements and maps their flow from collection points to "sinks" like external third parties, databases, logs, and internal APIs.

CLOUDPEASS

The Cloud Privilege Escalation Awesome Script Suite (CloudPEASS) is a one-stop solution for enumerating permissions, sensitive data, and privilege escalation vectors across AWS, GCP, and Azure.

AWESOME CYBERSECURITY AGENTIC AI

Awesome Cybersecurity Agentic AI is a collection of resources and tools for learning and using agentic AI.

UNUSUAL TOOLSET USED IN RECENT FOG RANSOMWARE ATTACK

Fog ransomware operators attacked an Asian financial firm in May using Syteca monitoring and pentesting tools GC2, Adaptix, and Stowaway. They stayed in the network for two weeks before deploying ransomware. The attackers maintained persistence post-attack and utilized tools often linked to espionage, suggesting intelligence-gathering motives with ransomware as a secondary goal. Since May 2024, Fog ransomware has evolved from targeting US schools through compromised VPNs to exploiting Veeam vulnerabilities and shifted to email infections featuring provocative ransom notes mocking Elon Musk's DOGE agency.

COMING TO APPLE OSES: A SEAMLESS WAY TO IMPORT AND EXPORT PASSKEYS

Apple previewed a new import/export feature for passkeys at the most recent WWDC. The new mechanism will fundamentally differ from current credentials exports that utilize JSONs or CSVs, as it happens directly between participating credentials manager apps without creating insecure files. Data miners have discovered artifacts in newer releases of the Google Authenticator app, suggesting that Google is working on similar functionality for the Android ecosystem, but Google has not announced the feature yet.

MENSTRUAL TRACKING APP DATA IS A ‘GOLD MINE' FOR ADVERTISERS THAT RISKS WOMEN'S SAFETY

Researchers from the University of Cambridge highlight the risks associated with cycle tracking apps (CTAs) and broad data collection practices. CTAs regularly collect and sell sensitive data on women's cycles to advertisers and tech giants without user consent. The researchers are calling on governments to create non-profit, public CTAs or at least require CTAs to offer fine-grained data collection approvals.

WESTJET INVESTIGATES CYBERATTACK DISRUPTING INTERNAL SYSTEMS

WestJet is probing a cyberattack that temporarily hindered its internal systems and app, impacting user login, although access has since been restored.

DUTCH POLICE IDENTIFY USERS AS YOUNG AS 11-YEAR-OLD ON CRACKED.IO HACKING FORUM

Dutch police found children as young as 11 using a hacking forum called Cracked.io.

MICROSOFT CONFIRMS AUTH ISSUES AFFECTING MICROSOFT 365 USERS

Microsoft 365 users are experiencing sign-in and password reset issues due to recent multi-factor authentication (MFA) enhancements, but Microsoft is addressing the problem and has already implemented some improvements.