TLDR INFORMATION SECURITY 2025-08-25

specific software

>> Execute approved software as a local admin without entering credentials

See the ThreatLocker difference

BOOKING.COM PHISHING CAMPAIGN USES SNEAKY 'ん' CHARACTER TO TRICK YOU

Attackers are using the Japanese hiragana character 'ん' (n) in phishing domains to impersonate Booking.com, creating URLs that appear legitimate but redirect victims to credential-stealing sites. The campaign exploits how the character renders similarly to the Latin 'n' in many fonts, making malicious domains harder to detect. Users should verify URLs carefully and avoid clicking links in unsolicited emails claiming to be from Booking.com.

OVER 300 ENTITIES HIT BY A VARIANT OF ATOMIC MACOS STEALER IN RECENT CAMPAIGN

Over 300 entities were infected by SHAMOS, a variant of the Atomic macOS Stealer (AMOS), through malvertising campaigns between June and August. The malware steals passwords stored in Keychain, browser data, cryptocurrency wallets, and other sensitive information from infected macOS systems. The campaign used malicious advertisements to distribute the stealer, targeting Mac users with fake software downloads.

90K EXPOSED AFTER SLEEP THERAPY PROVIDER DATA BREACH

CPAP Medical Supplies, a company that serves mainly military personnel, suffered a hack between December 13 and 21 that exposed over 90,000 individuals' sensitive data. The breach created risks of identity and medical fraud. Affected customers have been offered monitoring services. CPAP Medical Supplies has stressed that there has been no evidence of misuse so far.

THE SILENT, FILELESS THREAT OF VSHELL

Attackers embed base64-encoded Bash commands in RAR filenames that run automatically during directory listing with unsafe patterns like eval "echo $f" or for f in *. The attack downloads loaders specific to architecture that fetch XOR-encrypted VShell backdoor payloads, decrypts them in memory, and executes as fake kernel threads such as [kworker/0:2] to evade detection. This method bypasses defenses because antivirus doesn't scan filenames, the malware doesn't touch disk after decryption, and execution happens via common shell operations without needing executable permissions.

HOW TO CREATE A SECURE CI/CD PIPELINE USING OKTA TERRAFORM

This post walks through how to set up a CI/CD pipeline using Terraform and GitHub Actions to manage Okta resources. The pipeline is configured to use AWS for remote state storage and storing the secrets for accessing Okta.

DO CLAUDE CODE SECURITY REVIEWS PASS THE VIBE CHECK?

Anthropic's Claude platform has introduced AI-powered code security reviews, which can make detecting common vulnerabilities easier and more integrated for developers. While these tools provide helpful automation for identifying issues like SQL injection and authentication flaws, they are not foolproof and miss complex bugs. Human expertise, comprehensive security practices, and additional testing are still necessary to achieve safe and secure application development in the fast-evolving landscape of AI-assisted coding.

TryHackMe” Keith Manville, Google Security. Try free

RRE-BURP

The RRE Burp extension automates detecting Recursive Request Exploits by tracing API call chains from protected resources to find unauthenticated upstream APIs exploitable to bypass access controls. It uses Shannon entropy analysis (default threshold 3.0) to identify valuable backend tokens and parameters, then traces requests to find low-trust inputs that produce these high-value outputs. Demonstrated at DEF CON 33, it scales to find vulnerabilities across streaming services ("Streamageddon"), revealing how API chain flaws can bypass paywalls.

INTRODUCING UNIT 42'S ATTRIBUTION FRAMEWORK

Unit 42's three-tier attribution framework tracks threats from activity clusters to named threat actors, requiring rigorous evidence like Diamond Model mapping and Admiralty System scoring for source reliability (A-F) and credibility (1-6). It mandates six-month observation, multiple sources, and TTP analysis before tier promotion, preventing premature attribution and enabling focused tracking. Default scores apply to common artifacts, with analyst adjustments and review board validation.

RAVEN

Raven is a modern, efficient, lightweight subdomain enumeration tool for security researchers and penetration testers. Built in Go, it offers a robust and user-friendly experience for discovering subdomains of a target domain. Raven has advanced features to minimize false positives and optimize performance.

TINY QUANTUM DOTS UNLOCK THE FUTURE OF UNBREAKABLE ENCRYPTION

Physicists from Hebrew University and Los Alamos Labs developed quantum encryption using imperfect quantum dot light sources, outperforming traditional laser-based systems by extending secure transmission distances by over 3 dB. The breakthrough employs a truncated decoy state and heralded purification protocols to filter multi-photon emissions in real time, removing the need for perfect single-photon sources for 40 years. Room-temperature tests showed the approach works with existing equipment, making quantum-secure communication more practical and affordable.

EX-DEVELOPER JAILED FOUR YEARS FOR SABOTAGING OHIO EMPLOYER WITH KILL-SWITCH MALWARE

A former developer for an Ohio company was sentenced to four years for deploying malicious code and a kill switch that caused global outages after he lost access. His actions cost the company hundreds of thousands, highlighting the threat of insider sabotage.

HONEY, I SHRUNK THE IMAGE AND NOW I'M PWNED

Security researchers found that Google Gemini-powered tools can be deceived by hidden prompts embedded in images, exploiting image scaling for prompt injection. This trick can cause AI to leak data or act out of bounds. Google says it's not a default vulnerability, but experts urge stronger AI system defenses and user previews.

KIDNEY DIALYSIS FIRM DAVITA CONFIRMS RANSOMWARE ATTACK COMPROMISED DATA OF 2.7M PEOPLE

DaVita, a kidney dialysis provider, confirmed that a ransomware attack exposed personal and health information of 2,689,826 individuals, as reported to the Department of Health's Office for Civil Rights.

AWS TRUSTED ADVISOR TRICKED INTO SHOWING UNPROTECTED S3 BUCKETS AS SECURE

Researchers found a way to trick AWS Trusted Advisor into not warning about unsecured S3 buckets by denying access to certain checks.

INTERPOL CYBERCRIME CRACKDOWN IN AFRICA LEADS TO THE ARREST OF OVER 1,200 SUSPECTS

Interpol's Operation Serengeti 2.0 led to 1,209 arrests across Africa, recovering $97.4 million and dismantling major cybercrime schemes.