TLDR INFORMATION SECURITY 2025-07-07

That means you benefit from battle-tested end-to-end encryption

and security trusted by 100M+ users and 50,000+ businesses.

🎁 TLDR readers get 40% off! Claim your discount →

PROVIDER OF COVERT SURVEILLANCE APP SPILLS PASSWORDS FOR 62,000 USERS

Catwatchful, an Android spyware app marketed for "stealthy monitoring," leaked sensitive data from 62,000 users due to an SQL injection vulnerability. The breach exposed email addresses, plain-text passwords, and monitoring data.

RECRUITING SOFTWARE MAKER EXPOSES NEARLY 26M RESUMES

TalentHook, a cloud-based applicant tracking system, accidentally exposed the resumes of nearly 26M applicants. Cybernews found an open Azure Blob Storage container with files. The exposed data includes names, emails, addresses, education, and employment history.

INGRAM MICRO OUTAGE CAUSED BY SAFEPAY RANSOMWARE ATTACK

Ingram Micro, a business-to-business technology distributor, has been suffering an outage since Thursday. The outage was caused by the SafePay ransomware. The threat actors breached the company through its GlobalProtect VPN.

YET ANOTHER ZIP TRICK WRITEUP

This write-up explains how to create a "schizophrenic ZIP file". This type of ZIP file appears differently depending on the parser used. The trick relies on how parsers locate the Central Directory, with some using the offset field and others calculating it from the size. As a result, each method points to different Central Directories containing different file content, allowing the same ZIP file to display different contents depending on which parser opens it. This enables malicious files to be opened without the user's knowledge.

RULES FILES FOR SAFER VIBE CODING

Studies have shown that code generated by LLMs contains many security vulnerabilities. Developers should move security earlier in the development process by creating rules files for IDEs like Cursor, which include security guardrails and instructions. This post offers guidance on writing prompts for these rules files. Early research indicates that simply adding the word “secure” to a prompt can significantly reduce vulnerabilities.

PROFILING TRADETRAITOR: TACTICS, HISTORY & DEFENSES

TradeTraitor, a North Korean threat actor, has stolen over $2.4 billion through social engineering and cloud attacks, compromising developer credentials to inject malicious code and reroute ETH. Its attacks involve harvesting AWS tokens, injecting JavaScript into cloud applications, with defenses including short-lived tokens, full CloudTrail logs, MFA, and credential monitoring.

COMPYL (PRODUCT LAUNCH)

Compyl provides solutions for compliance, asset management, contract management, policy management, user access reviews, and risk management (including vendor risk).

GO-OVER

A tool to audit Erlang and Elixir dependencies to make sure your Gleam projects sparkle.

LITELLM

LiteLLM is a Python SDK, LLM gateway, and proxy server to call 100+ LLM APIs in OpenAPI format.

MASSIVE SPIKE IN USE OF .ES DOMAINS FOR PHISHING ABUSE

Cybersecurity experts report a 19-fold increase in malicious campaigns using Spain's .es domains, making it the third most abused after .com and .ru. Since January, 1,373 subdomains on 447 .es domains have hosted malicious content, with 99% of it focused on credential phishing, targeting Microsoft users via fake HR-themed emails.

GOOGLE ORDERED TO PAY $314M FOR MISUSING ANDROID USERS' CELLULAR DATA WITHOUT PERMISSION

A California court has ordered Google to pay $314 million for illegally using Android users' cellular data without consent. The lawsuit revealed that Google transferred device information even when phones were idle, which used up users' data allowances. Google intends to appeal this ruling.

INSTAGRAM USES EXPIRING CERTIFICATES AS SINGLE DAY TLS CERTIFICATES

While testing a personal tool, the author of this post noticed that certificates for instagram.com had unusual expiration times. The author set up a machine that attempted to pull the certificates for instagram.com and www.instagram.com every 5 minutes. They discovered that Instagram uses certificates with a lifetime of 8 days, replaces them daily, and uses unique certificates for instagram.com and www.instagram.com.

CHINA-LINKED GROUP HOUKEN HIT FRENCH ORGANIZATIONS USING ZERO-DAYS

A China-linked hacking group called Houken exploited three zero-day vulnerabilities in Ivanti Cloud Service Appliance devices to breach French government, telecom, media, finance, and transport organizations starting in September 2024, using sophisticated tools and rootkits to steal credentials and maintain persistent access.

CALLERS POSING AS ATF AGENTS USE 'APPLE GIFT CARDS' SCAM

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) warns the public about scammers pretending to be federal agents demanding Apple gift cards of $500 or $1,000 to "clear red flags" from accounts, stressing that real federal agencies never ask for payments via gift cards, wire transfers, or cryptocurrency.

IDEALAB CONFIRMS DATA STOLEN IN RANSOMWARE ATTACK LAST YEAR

IdeaLab, a California tech incubator, suffered a data breach in October 2024 when hackers stole sensitive information.