TLDR INFORMATION SECURITY 2025-07-09

actors access to your entire network. ThreatLocker Network Control

takes a different approach with direct client-to-server connections.

BALLAD: THIRD PARTY VENDOR EXPERIENCED DATA BREACH

Ballad Health issued a notice that its electronic print and mailing provider, Renkim, detected suspicious data on its networks. Renkim believes that data, which includes full names, contact information, client name, client account number, dates of service, and in some cases, Social Security Numbers, may have been stolen.

MASSIVE BROWSER HIJACKING CAMPAIGN INFECTS 2.3M CHROME, EDGE USERS

A popular Chrome color picker extension with 100,000+ downloads and Google's verified badge secretly hijacks browsers, tracks user activity, and creates backdoors. It's part of "RedDirection," a campaign involving 18 malicious extensions that infected 2.3 million users.

ANATSA ANDROID BANKING TROJAN HITS 90,000 USERS WITH FAKE PDF APP ON GOOGLE PLAY

Anatsa banking malware targeted North American users through a malicious "Document Viewer" app on the Google Play Store that was downloaded 90,000 times. The Trojan, disguised as a PDF, updates displays with fake maintenance notices during banking app access while stealing credentials through overlays and keylogging.

SUPABASE MCP CAN LEAK YOUR ENTIRE SQL DATABASE

Attackers can exploit Supabase's Model Context Protocol (MCP) to leak SQL databases by embedding malicious commands in support messages. Developers using AI assistants like Cursor to review tickets can unintentionally execute SQL queries with elevated privileges, bypassing security. LLMs can't distinguish between user data and instructions, enabling crafted messages to trigger unauthorized database access and data exfiltration through the support interface.

ADVANCING PROTECTION IN CHROME ON ANDROID

Google's Android Advanced Protection now integrates with Chrome to enhance security for high-risk users, such as journalists and officials. It provides three key features: enforcing HTTPS everywhere, full site isolation on devices with 4GB+ RAM to prevent data leaks, and disabling JavaScript optimizations that are often exploited in V8 security bugs. These options, which have performance trade-offs, can be enabled by enterprises and users through Chrome's privacy settings and policies outside of Advanced Protection.

LEAN AND MEAN: HOW WE FINE-TUNED A MODEL FOR SECRET DETECTION IN CODE

Wiz developed a small language model based on Llama 3.2 1B to detect secrets in code. It utilized Claude Sonnet 3.7 to create a training dataset of secrets based on scans of public GitHub repositories. It then fine-tuned Llama 3.2 1B using Low-Rank Adaptation (LoRA) and quantization, achieving an 82% recall rate and an 85% precision rate on commercial CPUs.

AI-Native Trust Management with Drata

COMMANDER

COMmander is a .NET tool to enrich defensive telemetry around RPC and COM. It uses a simple configuration file with rules to filter events and sends alerts when matches are found.

PASTORALIST

Pastoralist is a CLI tool for managing Node Package Manager (NPM) package.json overrides (or resolutions) with ease. It keeps track of which dependency overrides are needed and removes ones that are no longer used. With Pastoralist, you only need to run a simple command to keep your project's dependencies clean and up-to-date.

CURSOR SECURITY RULES

A repository with Cursor Security Rules that improve security in development workflows and AI agent interactions by enforcing safe coding practices, limiting sensitive operations, and reducing risks in AI-assisted software development.

OPENAI TIGHTENS THE SCREWS ON SECURITY TO KEEP AWAY PRYING EYES

OpenAI has implemented stricter security measures to prevent information leaks and poaching. The new measures include “information tenting” policies that limit access to sensitive algorithms and new products, isolating proprietary technology in offline computers, implementing biometric access controls for office areas, and a “deny-by-default” internet policy where explicit approval is required for external connections. OpenAI reportedly also increased physical security at data centers and expanded its cybersecurity personnel.

SATANLOCK RANSOMWARE ENDS OPERATIONS, SAYS STOLEN DATA WILL BE LEAKED

The SatanLock ransomware group, which was first identified in early April, has announced that it will shut down and leak all stolen data. In a report by Check Point in May, it was highlighted that more than 65% of SatanLock's victims had already appeared on leak sites run by other ransomware groups, suggesting that the group might be attempting to “reclaim” already compromised networks. SatanLock did not provide any reason for its sudden closure but has removed all victim listings from its .onion site.

HACKERS ABUSE LEAKED SHELLTER RED TEAM TOOL TO DEPLOY INFOSTEALERS

Shellter, a commercial AV/EDR evasion loader for penetration testing, confirmed that hackers were using its Shellter Elite product in attacks after a customer leaked a copy of the software. Shellter has stated that it released updates that would not reach the “malicious customer” to combat the misuse. The leaked copy was first discovered by Elastic Security Labs, who discovered that multiple threat actors had been abusing Shellter Elite v11.0 to deploy infostealers.

EXPOSING SCATTERED SPIDER: NEW INDICATORS HIGHLIGHT GROWING THREAT TO ENTERPRISES AND AVIATION

Scattered Spider uses domains that mimic corporate portals and employs sophisticated social engineering and MFA fatigue to launch its attacks.

IMPOSTOR USES AI TO IMPERSONATE RUBIO AND CONTACT FOREIGN AND US OFFICIALS

The State Department issued a warning to all US embassies after discovering AI-powered impersonators posing as Secretary of State Marco Rubio contacted foreign ministers, a US senator, and a governor via text, Signal, and voicemail messages.

M&S CONFIRMS SOCIAL ENGINEERING LED TO MASSIVE RANSOMWARE ATTACK

M&S revealed that cybercriminals used advanced social engineering tactics to impersonate an employee and manipulate Tata Consultancy Services into resetting a password, resulting in a DragonForce ransomware attack that encrypted VMware ESXi servers and exfiltrated around 150GB of data, though the company declined to confirm if the ransom was paid.