TLDR INFORMATION SECURITY 2025-06-18

forward without breaking everything. Register now.

VIRTUALMACOSX.COM USER DATA EXPOSED IN BREACH

Cybersecurity researchers at SafetyDetectives reported that they discovered a post selling a breached database from VirtualMacOSX.com. VirtualMacOSX.com offers cloud-based Mac server plans from their server farms in Canada. The breached data includes full names, financial data, contact info, and passwords.

HACKERS ARE USING GOOGLE.COM TO DELIVER MALWARE BY BYPASSING ANTIVIRUS SOFTWARE

Researchers from c/side are reporting on a new attack vector that abuses Google OAuth links to bypass detection. The attack begins in a compromised Magento e-commerce portal, which includes an OAuth logout with a callback parameter containing an obfuscated JavaScript payload. The code will only activate under certain conditions, such as if the URL includes the word “checkout.”

GOOGLE CHROME ZERO-DAY CVE-2025-2783 EXPLOITED BY TAXOFF TO DEPLOY TRINPER BACKDOOR

TaxOff threat actors exploited a Google Chrome zero-day vulnerability (CVE-2025-2783) in March to deploy the Trinper backdoor through phishing emails disguised as forum invitations. The backdoor, written in C++, uses multithreading to steal files, capture keystrokes, and maintain command-and-control communications with remote servers. Google patched the vulnerability after Kaspersky reported the exploitation. Researchers suspect TaxOff may be connected to another hacking group called Team46 based on similar attack patterns.

STARTING A SECURITY PROGRAM FROM SCRATCH (OR RE-STARTING)

This post provides a roadmap for growing a new or existing program through four phases of maturity. The first phase focuses on establishing the basics by appointing a Head of Security, establishing a governance process, conducting a breach assessment, and acting on the most critical results. The second phase focuses on comparing the organization's current state with established frameworks, developing a plan to close gaps, hiring MSSPs, and building a team. Phases 3 and 4 focus on furthering organizational maturity by establishing program management and aligning with business objectives, establishing continuous monitoring and guardrails, increasing resiliency, and training the team.

FUZZING DEFENDER'S SCANNING AND EMULATION ENGINE

SECURE ENCLAVES FOR OFFENSIVE OPERATIONS (PART II)

This post demonstrates how to exploit vulnerable Windows Secure Enclaves (VBS) by leveraging read-write primitives to achieve VTL1 code execution through ROP chaining and function table manipulation. It shows how CVE-2023-36880 and CVE-2024-21423 can be exploited in Microsoft Edge's preferences enclave to patch the VertValidTargetTable, enabling arbitrary function calls within the secure environment. The research resulted in practical sleep masking techniques for malware that hide implant memory from EDR detection by storing code in VTL1 while the implant sleeps, which has been integrated into the Outflank C2 and Beacon Booster tools.

AI RED TEAMING PLAYGROUND LABS

A collection of AI red teaming labs that were used in the BlackHat 2024 AI Red Teaming in Practice course.

CRADLE

CRADLE is a powerful tool for Cyber Threat Intelligence (CTI) analysts that combines collaborative note-taking, automated data linking, and dynamic visualizations for easy capture, analysis, and sharing of threat intelligence. It centralizes everything securely for incident investigation and report generation.

MICROSANDBOX

MICROSANDBOX is a self-hosted platform that securely runs untrusted user or AI-generated code using microVMs. It provides fast startup times (200ms) and strong isolation. It supports MCP and works with standard container images and OCI format containers.

META IS BRINGING ADS TO WHATSAPP. PRIVACY EXPERTS ARE SOUNDING THE ALARMS

Meta is adding targeted ads to WhatsApp's Updates feature. Despite the company reassuring users that the ads will only use data such as location and language and that messages remain end-to-end encrypted, many privacy experts expressed concern due to previous privacy issues with Meta's apps.

CYBER EXPERTS CALL FOR SUPERCHARGING VOLUNTEER NETWORK TO PROTECT COMMUNITY ORGANIZATIONS

Cyberattacks often target community groups like hospitals and schools that lack the resources to defend themselves. Experts say stronger support from the government, private companies, and volunteers is needed to protect them. A new report calls for expanding cyber volunteer networks and creating shared security services.

YES, WALLETS CAN BE HACKED TOO

Mobile wallets like Apple Pay are safer than cards, but they can still be hacked. Thieves can use features like Express Transit mode to steal money, even from locked phones. Users should turn off risky features and use strong security settings to stay safe.

HACKLINK MARKET LINKED TO SEO POISONING ATTACKS IN GOOGLE RESULTS

Hackers exploit a black market known as Hacklink to embed deceptive links in reputable websites, manipulating Google to elevate malicious or fraudulent sites in search rankings.

PADDLE SETTLES FOR $5 MILLION OVER FACILITATING TECH SUPPORT SCAMS

Paddle will pay $5 million to settle charges that it helped scammers trick people into buying fake tech support.