TLDR INFORMATION SECURITY 2025-09-01

Play with the interactive demo (no sales call required)

WHATSAPP ISSUES EMERGENCY UPDATE FOR ZERO-CLICK EXPLOIT TARGETING IOS AND MACOS DEVICES

WhatsApp has released an emergency security update to patch a critical zero-click exploit that allows attackers to remotely compromise iOS and macOS devices without any user interaction. The vulnerability affects WhatsApp's voice calling feature, allowing attackers to execute malicious code by simply initiating a call, even if the target doesn't answer. Users are strongly urged to update their WhatsApp applications immediately to protect against potential attacks exploiting this serious security flaw.

ATTACKERS ABUSE VELOCIRAPTOR FORENSIC TOOL TO DEPLOY VISUAL STUDIO CODE FOR C2 TUNNELING

Threat actors are using the Velociraptor forensic tool to deploy Visual Studio Code for command and control tunneling. The attackers are exploiting Velociraptor's endpoint monitoring to download and run Visual Studio Code, likely to establish persistent backdoor access. This follows the trend of cybercriminals exploiting trusted tools to evade detection and maintain covert channels.

BROKEWELL ANDROID MALWARE DELIVERED THROUGH FAKE TRADINGVIEW ADS

There is a malware campaign that uses Meta ads offering a free version of the TradingView Premium app to spread the Brokewell malware for Android. The malicious ads direct users to a webpage that mimics TradingView's site and prompts users to download an APK file, which installs the Brokewell malware. The malware scans for crypto wallets and bank accounts, steals 2FA codes, steals accounts by overlaying fake login screens, records screens and keystrokes, steals cookies, activates the camera and microphone, tracks the device location, hijacks the default SMS apps, and provides remote control capability.

TAMPEREDCHEF INFOSTEALER DELIVERED THROUGH FRAUDULENT PDF EDITOR

The TamperedChef infostealer malware is being distributed through fake PDF editing applications promoted via Google ads across multiple malicious websites. The fraudulent PDF editor appears legitimate but secretly installs the TamperedChef malware designed to steal sensitive information from infected systems. This campaign demonstrates how cybercriminals continue to exploit trusted advertising platforms and standard software to deliver malware to unsuspecting users.

MACOS SECURITY AND TYPICAL ATTACKS

This post analyzes how attackers bypass macOS' built-in security mechanisms, including Keychain, SIP, TCC, File Quarantine, and Gatekeeper, through techniques such as TCC Clickjacking, quarantine attribute removal, and social engineering attacks that require context menu execution. The analysis provides detection rules in Sigma format to identify malicious activities, such as keychain dumping, SIP status discovery, quarantine removal, and Gatekeeper disabling, through command-line utilities. Organizations should implement third-party EDR solutions in conjunction with native macOS protections, as attackers continue to adapt and circumvent Apple's security frameworks through techniques such as privilege escalation and user manipulation.

HUNTING MALICIOUS SHORTCUT (.LNK) FILES USING THE VIRUSTOTAL API

Attackers frequently utilize shortcut files as an initial access vector, as they can obscure malicious commands from a user. In this post, the author compiled a corpus of 614 malicious LNK files using the VirusTotal API and employed frequency analysis to extract common command-line arguments from malicious shortcuts that execute PowerShell or CMD. The author then utilized KQL to construct threat hunting queries that search for malicious LNK files using this corpus of data.

can mitigate risk with compliance automation. Download →

FOUNDING

Founding is a tool that processes shellcode in .bin, .exe, or .dll formats, applying advanced obfuscation or encryption techniques to generate stealthy binaries with sophisticated execution methods.

JAMFHOUND

JamfHound is a Python 3 project designed to collect and identify attack paths in Jamf Pro and import them as JSON object files into BloodHound.

FT3: FRAUD TOOLS, TACTICS, AND TECHNIQUES

FT3 is Stripe's adaptation of ATT&CK-style security frameworks designed explicitly for fraudulent activities.

LAB DOOKHTEGAN HACKING GROUP DISRUPTS COMMUNICATIONS ON DOZENS OF IRANIAN SHIPS

The Lab Dookhtegan hacking group allegedly disrupted communications systems on 60 Iranian ships, including 39 tankers and 25 cargo vessels operated by sanctioned companies National Iranian Oil Tanker Company (NITC) and Iran Shipping Lines (IRISL). The cyberattack targeted the maritime communication infrastructure of these state-linked shipping firms, potentially impacting their ability to coordinate operations and maintain contact with shore-based facilities. This incident demonstrates the growing trend of hacktivists targeting critical maritime infrastructure as part of geopolitical cyber operations.

APPLICATION SECURITY ENGINEER ARCHETYPES

The author of this post reflects on his time as an AppSec engineer in various organizations and divides AppSec roles into three buckets: AppSec Engineer in a Centralized Organization, Dedicated AppSec Engineer, and Security Partner Engineer. The author also classifies AppSec Engineers as either orchestrators, builders, specialists, or rapid responders. The post concludes with a mapping of the roles each archetype excels in and the prime traits essential for each archetype to succeed.

WHY RELYING ON LLMS FOR CODE CAN BE A SECURITY NIGHTMARE

A security researcher demonstrates how LLM-generated code can contain serious security flaws, such as exposing an email API with hardcoded parameters in client-side JavaScript. This allows attackers to spam recipients with simple curl commands. LLMs learn from insecure internet examples and replicate these patterns, often prioritizing functionality over security. Organizations require human oversight for security reviews and threat modeling when utilizing AI-generated code, as LLMs lack an understanding of security risks and potential for abuse.

FEDS SEIZE VERIFTOOLS.NET, OPERATORS RELAUNCH WITH VERIFTOOLS.COM

US and Dutch authorities have seized the VerifTools marketplace, which sold counterfeit identity documents for as little as $9 to facilitate cybercrime.

AMAZON BLOCKS APT29 CAMPAIGN TARGETING MICROSOFT DEVICE CODE AUTHENTICATION

Amazon disrupted a Russian APT29 watering hole campaign that injected malicious JavaScript into compromised websites, redirecting visitors to fake Microsoft device authentication pages designed to harvest credentials from academics and Russian critics.

META ACCUSED OF CREATING FLIRTY AI CHATBOTS OF CELEBRITIES WITHOUT PERMISSION

Meta developed flirtatious AI chatbots impersonating celebrities such as Taylor Swift, Scarlett Johansson, Anne Hathaway, and Selena Gomez without their permission.