TLDR INFORMATION SECURITY 2025-08-21

See how Fastly supports detection-as-code

APACHE ACTIVEMQ FLAW EXPLOITED TO DEPLOY DRIPDROPPER MALWARE ON CLOUD LINUX SYSTEMS

Threat actors are exploiting a two-year-old critical Apache ActiveMQ vulnerability (CVE-2023-46604, CVSS 10.0) to deploy DripDropper malware on cloud Linux systems, then patching the flaw post-compromise to block other attackers and evade detection. The attackers use the PyInstaller-based DripDropper to establish persistence through modified SSH configurations and cron jobs, while leveraging legitimate services like Dropbox and Cloudflare Tunnels for command-and-control communications.

DON'T WANT DRIVE-BY OLLAMA ATTACKERS SNOOPING ON YOUR LOCAL CHATS? PATCH NOW

A vulnerability in Ollama Desktop v0.10.0 allowed drive-by attacks where malicious websites could bypass CORS controls to reconfigure victims' local AI settings remotely, intercept all chat messages, and even serve poisoned models. GitLab's Chris Moberly discovered the flaw by exploiting incomplete cross-origin controls—removing the Content-Type header to trick the app into treating malicious requests as "simple" and bypassing preflight checks. The vulnerability was patched within hours in v0.10.1 after Moberly disclosed it on July 31. Users are urged to update immediately as exploitation would be "trivial," according to the researcher.

HACKERS STEAL MICROSOFT LOGINS USING LEGITIMATE ADFS REDIRECTS

Push Security researchers found a new phishing attack using legit office.com links combined with ADFS to redirect users to a phishing page that steals Microsoft 365 logins. The attack starts when users click on malicious sponsored links in Google search results for Office 265 (likely typosquatting), which leads to Microsoft's office.com, then to a harmless-looking page that redirects to the phishing site. The attackers are using a custom Microsoft tenant with ADFS to receive authorization requests for the fake domain.

CRYPTOAGILITY: THE STRATEGIC PILLAR FOR DIGITAL RESILIENCE

Cryptoagility, defined as the ability to replace cryptographic algorithms, keys, and certificates quickly, has become vital for organizations managing critical infrastructure, as shown by Google's Chromecast failure that affected millions when a certificate expired. Organizations must shift from reactive to proactive certificate management, using modular infrastructure, centralized PKI/HSM, and automated rotation aligned with PCI DSS v4.0 and DORA. This forward-looking approach makes cryptographic flexibility a strategic advantage, ensuring operational continuity and compliance before vulnerabilities or expirations cause system failures.

HOW I HACKED MCDONALD'S (THEIR SECURITY CONTACT WAS HARDER TO FIND THAN THEIR SECRET SAUCE RECIPE)

The author of this post uncovered several vulnerabilities at McDonald's, like weak app and portal security, exposed API keys, and user data leaks. Despite attempts to report the issues, finding someone to listen was nearly impossible—the process required calling HQ and guessing employee names. Most bugs were fixed once reported, but communication and security practices at McDonald's were deeply flawed.

HIGH-PROFILE CLOUD PRIVESC

This post details an attack path from an Entra service principal with `Files.ReadWrite.All` permissions to admin. The attacker exploited OneDrive for Business's Known File Move feature to load a PowerShell profile with a beacon from OneDrive into admins' filesystems. It concludes with defender tips on detection and credential protection.

MICROSOFT ENTRA PRIVATE ACCESS BRINGS CONDITIONAL ACCESS TO ON-PREM ACTIVE DIRECTORY

Microsoft's Entra Private Access now allows organizations to apply cloud-based conditional access and MFA to on-premises Active Directory domain controllers, replacing legacy VPNs with Zero Trust Network Access. It requires networks to be NTLM-free and Kerberos-only, Windows 10+ devices that are Entra or hybrid joined, opening TCP port 1337 on domain controllers, and extensive NTLM auditing and removal. Organizations must audit NTLM usage via Group Policy, transition to NTLMv2 or Kerberos, and possibly retire legacy apps before implementing this security framework.

TURNT

TURN tunneler (TURNt) is a red-team tool designed to tunnel interactive C2 traffic, such as hidden VNC and SOCKS traffic, over legitimate meeting protocols used by Zoom and Teams.

YARA ABSTRACT SYNTAX TREE

YARAAST (YARA Abstract Syntax Tree) is a Python library and CLI tool for parsing, manipulating, and analyzing YARA rules through AST representation.

SINGAPORE ISSUES CRITICAL ALERT ON DIRE WOLF RANSOMWARE TARGETING GLOBAL TECH AND MANUFACTURING FIRMS

The Dire Wolf ransomware has affected 16 organizations across 11 countries since it emerged in May, using double-extortion tactics, such as encrypting data while threatening leaks. The Golang-based ransomware uses anti-forensics techniques and multi-stage attack chains to evade detection, mainly targeting manufacturing and technology sectors through phishing and credential stuffing attacks.

PYPI NOW BLOCKS DOMAIN RESURRECTION ATTACKS USED FOR HIJACKING ACCOUNTS

Accounts of project maintainers publishing software on PyPI are linked to email addresses, which in some cases may be tied to a custom domain name. Historically, attackers have been able to take over some projects by resurrecting an expired domain that was attached to a maintainer's email and resetting the account. PyPI has added new checks that will mark an email as unverified if a domain is expired or is about to expire.

NEW ZERO-DAY STARTUP OFFERS $20 MILLION FOR TOOLS THAT CAN HACK ANY SMARTPHONE

A UAE-based startup is offering huge bounties—up to $20 million—for hacking tools that exploit zero-day flaws in all major smartphone systems. The firm, which serves governments and intelligence agencies, is secretive about its clients. The offer reflects rising demand and prices for cyber-espionage tools.

👉Register now

ALLIANZ LIFE DATA BREACH AFFECTS 1.1 MILLION CUSTOMERS

A cyberattack at Allianz Life in July compromised the personal details of 1.1 million customers, including Social Security numbers, after hackers accessed a Salesforce database.

OREGON MAN CHARGED IN ‘RAPPER BOT' DDOS SERVICE

A 22-year-old Oregon man was arrested for operating the “Rapper Bot” botnet, which was used to launch massive DDoS attacks on global targets.

INTEL EMPLOYEE DATA EXPOSED BY VULNERABILITIES

Vulnerabilities in Intel's internal websites exposed personal details of 270,000 employees worldwide, but no sensitive data, such as Social Security numbers or salaries, was leaked.