TLDR INFORMATION SECURITY 2025-07-11

Inbound security reviews don't have to slow you down. SafeBase

helps you automate inbound requests, streamline questionnaires, and share your security posture proactively—all through a centralized Trust Center and AI Questionnaire Assistance.

🙋♀️ Get a guided tour with an expert

ATOMIC MACOS INFOSTEALER ADDS BACKDOOR FOR PERSISTENT ATTACKS

Malware analysts discovered a new version of the Atomic macOS (AMOS) infostealer, which includes a backdoor that offers attackers persistent access to compromised systems. The new version of the malware features an embedded backdoor, utilizes LackDaemons to survive reboots, implements ID-based victim tracking, and introduces new C2 infrastructure. The embedded backdoor allows threat actors to execute commands remotely, log keystrokes, introduce additional payloads, or probe for lateral movement opportunities.

MILLIONS OF CARS EXPOSED TO REMOTE HACKING VIA PERFEKTBLUE ATTACK

PCA Cyber Security discovered critical vulnerabilities in OpenSynergy's BlueSDK Bluetooth framework affecting millions of cars from Mercedes-Benz, Skoda, and Volkswagen. The "PerfektBlue" attack enables remote code execution through Bluetooth pairing, allowing attackers to track vehicles, record audio, access phonebook data, and potentially control steering/wipers.

CRITICAL MCP-REMOTE VULNERABILITY ENABLES REMOTE CODE EXECUTION, IMPACTING 437,000+ DOWNLOADS

CVE-2025-6514, a critical vulnerability in mcp-remote (CVSS 9.6), allows arbitrary OS command execution when connecting to untrusted MCP servers. The flaw affects versions 0.0.5-0.1.15 and has been patched in 0.1.16. Other MCP vulnerabilities allowing for remote code execution and sandbox escapes were also discovered in the Inspector tool and Anthropic's Filesystem MCP Server.

HOW I DISCOVERED A LIBPNG VULNERABILITY 11 YEARS AFTER IT WAS PATCHED

While practicing secure code review, the author of this article decided to review the libpng C library. They found that libpng calculated memory allocations based on user-controlled values, such as “depth.” The author was able to trigger a crash using a custom PNG file, but then discovered that the bug was fixed 11 years ago when it was first reported.

TAKING SHELLTER: A COMMERCIAL EVASION FRAMEWORK ABUSED IN- THE- WILD

Elastic Security Labs found threat actors using an illicit version of SHELLTER, a red team evasion framework, since April to deploy infostealers like LUMMA, RHADAMANTHYS, and ARECHCLIENT2. The malware uses advanced evasion techniques such as polymorphic code, API hooking bypasses, indirect syscalls, memory scan evasion, and AMSI bypass, resulting in low detection rates. Elastic issued a dynamic unpacker and YARA rules to help detect SHELLTER samples, which are spread via YouTube comments and phishing campaigns targeting content creators.

ABUSING CHROME REMOTE DESKTOP ON RED TEAM OPERATIONS: A PRACTICAL GUIDE

Red team operators can abuse Chrome Remote Desktop as a legitimate remote access tool by installing the MSI package with admin privileges and using an undocumented `--pin=111111` parameter to bypass GUI PIN setup requirements. The technique leverages Google's infrastructure and HTTPS/WebRTC protocols, making it more difficult to detect than traditional remote access tools, as it appears as legitimate Google traffic. Defenders should implement application allowlisting solutions, such as AppLocker, and monitor for "Chrome Remote Desktop Host" installations to prevent unauthorized remote access deployments.

Register now and discover how to safeguard every M&A stage.

THREAT DESIGNER

Threat Designer is an AI-driven agent designed to automate and streamline the threat modeling process for secure system design.

AIRMDR (PRODUCT LAUNCH)

AirMDR provides automated playbooks to investigate and respond to threats while constantly learning.

OPENCVE

OpenCVE is an open-source platform designed for efficient monitoring and management of CVEs. It consolidates vulnerability data from sources like MITRE, NVD, RedHat, and Vulnrichment, allowing users to filter, track, and organize based on various criteria such as vendor, product, and severity. Users can subscribe to product updates, receive alerts, analyze changes, and collaborate seamlessly through its user-friendly interface.

BROWSER EXTENSIONS TURN NEARLY 1M BROWSERS INTO WEBSITE-SCRAPING BOTS

Browser extensions that use the MellowTel-js library are being used to scrape websites using users' browsers. The library has close ties with Olostep, a company that bills itself as “the world's most reliable and cost-effective Web scraping API,” suggesting that Olostep is using its installed base of extension users to fulfill scraping requests. 245 extensions that implement this library have been discovered across Chrome, Firefox, and Edge, with a total of nearly 1M users.

JACK DORSEY SAYS HIS ‘SECURE' NEW BITCHAT APP HAS NOT BEEN TESTED FOR SECURITY

After launching his new security-focused, Bluetooth chat app, Bitchat, Jack Dorsey added a warning to its GitHub page that it has not received an external security review and should not be used in production. This disclaimer was prompted by a security researcher who discovered a vulnerability that allowed them to impersonate someone else by intercepting their “identity key” and “peer id pair.” Other security researchers have reported concerns over Dorsey's claims that Bitchat has forward secrecy, as well as reported a potential buffer overflow bug.

GMX HALTS TRADING, TOKEN MINTING FOLLOWING $40M EXPLOIT

The GMX protocol halted trading on GMX V1, the first version of the GMX perpetual exchange deployed on the Arbitrum network, after a liquidity pool suffered an exploit that resulted in $40 million in funds being stolen. The attacked pool is a liquidity provider for the GMX protocol with underlying assets that include Bitcoin, Ether, and stablecoins. Blockchain security company SlowMist attributed the exploit to a design flaw that allowed hackers to manipulate the GLP token price.

AMD WARNS OF NEW MELTDOWN, SPECTRE-LIKE BUGS AFFECTING CPUS

AMD has discovered Transient Scheduler Attack (TSA) vulnerabilities affecting EPYC, Ryzen, and other chips that could potentially enable information disclosure through side-channel attacks requiring local access.

SOUTH KOREAN GOVERNMENT IMPOSES PENALTIES ON SK TELECOM FOR BREACH

South Korea fined SK Telecom only $21,890 for a breach that exposed 27 million customer records, but imposed strict regulatory requirements, including quarterly security assessments, mandatory USIM replacements, and organizational changes that the company expects will cost $511 million in lost revenue.

FOUR ARRESTED IN CONNECTION WITH M&S AND CO-OP CYBER-ATTACKS

The National Crime Agency detained four teenagers aged 17-19 for launching cyberattacks involving ransomware and data theft against M&S, Co-op, and Harrods, with charges including computer misuse, blackmail, and organized crime.