TLDR INFORMATION SECURITY 2025-07-02

↗️ See a four minute demo ↗️

KELLY BENEFITS SAYS 2024 DATA BREACH IMPACTS 550K CUSTOMERS

In its latest update to law enforcement, Kelly Benefits has updated the total number of impacted individuals of a December 2024 breach to 550K. Kelly Benefits is a provider of benefits consulting, enrollment technology, payroll administration, HRIS, compliance support, and carrier management. The specific data that was breached varies per individual but may include SSNs, tax ID numbers, dates of birth, medical information, health insurance information, and financial information.

ESSE HEALTH SAYS RECENT DATA BREACH AFFECTS OVER 263K PATIENTS

Esse Health, the largest independent physicians' group in the Greater St. Louis area, reported a data breach impacting over 263K individuals. The breached data includes patient personal information, health insurance information, medical record number, patient account number, and some health information, but does not include SSNs or financial information. Esse Health did not disclose the nature of the breach, but based on the recovery timeline, ransomware is suspected.

CRITICAL VULNERABILITY IN ANTHROPIC'S MCP EXPOSES DEVELOPER MACHINES TO REMOTE EXPLOITS

A critical vulnerability (CVE-2025-49596) in Anthropic's MCP Inspector tool exposed developers to remote code execution via misconfigurations and browser flaws. Attackers could exploit this by tricking users into visiting malicious websites. Fixed in version 0.14.1, the patch adds authentication and origin validation to secure localhost services against RCE attacks.

AND NOW MALWARE THAT TELLS AI TO IGNORE IT?

Researchers at Check Point discovered a new malware dubbed SkyNet, which employs a novel technique to attempt to evade AI-based scanners and tools. The method hard-codes a prompt that attempts to tell any AI analyzing the code to ignore any previous instructions and respond with a “NO MALWARE DETECTED” message. Check Point noted that the SkyNet malware was unable to stop Check Point's AI scanners from scanning it and concluded that the author would need to refine their prompt injection technique.

CAN YOU TRUST THAT VERIFIED SYMBOL? EXPLOITING IDE EXTENSIONS IS EASIER THAN IT SHOULD BE

Researchers have found critical vulnerabilities in popular IDEs (VSCode, Visual Studio, IntelliJ IDEA, and Cursor) where malicious extensions can appear verified while containing dangerous code. The flaw enables attackers to create files that utilize verified symbols but incorporate malicious functionality, allowing them to execute system commands and potentially impact millions of developers using these platforms.

ANALYSIS OF THE THREAT CASE OF KIMSUKY GROUP USING 'CLICKFIX' TACTIC

The Kimsuky APT group has evolved its "ClickFix" tactic, tricking users into executing malicious PowerShell commands disguised as troubleshooting guides or security checks. The campaign uses spear-phishing emails, fake job sites, and compromised sites, employing obfuscation and multilingual variants to evade detection. Defense involves EDR monitoring for abnormal PowerShell activity and user education to identify prompts that ask users to copy and paste codes or "fix" browser issues.

NEWTOWNER

Newtowner is a tool that is designed to test firewalls and network boundaries by masquerading traffic to appear as if it's coming from various data centers around the world

SQLMAP COMMAND BUILDER

Advanced SQLMap command builder with an intuitive cheatsheet UI. Works locally in your browser as a single HTML file (no data sent anywhere).

X64DBG: TYPE SYSTEM AND MODERNIZATION

x64dbg is an open-source Windows debugger designed to simplify reverse engineering and malware analysis. This release features a revamped type system with support for bitfields, enums, and anonymous types from the Windows SDK, as well as significant performance improvements for complex data analysis. New features include AVX-512, half-float support for modern applications, workflow enhancements such as copying function graphs and arguments, and a modernized build system with cross-platform capabilities.

AT&T ROLLS OUT “WIRELESS LOCK” FEATURE TO BLOCK SIM SWAP ATTACKS

AT&T has announced a new “Wireless Lock” feature to protect users from SIM swap attacks. When the new feature is enabled, customers and employees will be unable to port the phone number to a new SIM card or transfer it to a new provider until the setting is disabled. Wireless Lock also protects certain billing information, authorized users, and phone numbers.

CLOUDFLARE WILL NOW BLOCK AI CRAWLERS BY DEFAULT

US SHUTS DOWN A STRING OF NORTH KOREAN IT WORKER SCAMS

The U.S. disrupted North Korean IT scams involving fake remote workers at over 100 companies that stole data and $1.6M+ in crypto, with eleven suspects facing charges.

MICROSOFT OPEN-SOURCES VS CODE COPILOT CHAT EXTENSION ON GITHUB

Microsoft has made the GitHub Copilot Chat extension for VS Code open-source, allowing everyone to see and use its code.

AT&T DEPLOYS NEW ACCOUNT LOCK FEATURE TO COUNTER SIM SWAPPING

AT&T has introduced a Wireless Account Lock feature that enhances security by preventing unauthorized changes and alerting customers of account updates, with only main account holders able to manage it.