TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-09-05

6 sections20 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

2.4X

Weak and reused passwords expose companies to critical risks. In fact, the majority of web application breaches stem from poor credential hygiene, costing organizations millions per incident.

bitwarden.comSponsor

Read the full research (ungated)

Nearly all of enterprise customers report that Bitwarden improved their security posture once fully deployed. Start a free enterprise

bitwarden.com

02ATTACKS & VULNERABILITIES

252M IDENTITIES DUMPED ONLINE IN MASSIVE LEAK AFFECTING 7 COUNTRIES

Over 252 million identity records from seven countries—Turkey, Egypt, Saudi Arabia, UAE, Mexico, South Africa, and Canada—were exposed through three misconfigured servers in Brazil and the UAE. These contained government-level profiles with ID numbers, birth dates, contact details, and addresses. The databases had similar structures, suggesting a single operator, but the source remains unknown. Turkey, Egypt, and South Africa were most affected. Cybernews contacted hosting providers, and the data is no longer publicly accessible as of June.

links.tldrnewsletter.com2 min read

CHESS.COM DISCLOSES RECENT DATA BREACH VIA FILE TRANSFER APP

Chess.com reported that it experienced a data breach after detecting unauthorized data stored in a third-party file transfer application. The incident only impacts an estimated 4.5K users and may have exposed names and other PII.

bleepingcomputer.com2 min read

NEW TP-LINK ZERO-DAY SURFACES AS CISA WARNS OTHER FLAWS ARE EXPLOITED

TP-Link has confirmed the existence of an unpatched zero-day vulnerability impacting multiple routers. The vulnerability was discovered by a security researcher who stated that it is caused by a stack buffer overflow in the CPE WAN Management Protocol (CWMP). An attacker could exploit it by redirecting vulnerable devices to a malicious CWMP server, which could deliver an oversized SOAP payload, leading to remote code execution.

bleepingcomputer.com2 min read

03STRATEGIES & TACTICS

MALICIOUS NPM PACKAGES USE ETHEREUM BLOCKCHAIN FOR MALWARE DELIVERY

Attackers deployed fake GitHub repositories and npm packages that stored malware download URLs in Ethereum smart contracts rather than directly in the code, making detection significantly harder for security tools. The campaign targeted cryptocurrency developers with fake automated trading bots, using packages like colortoolsv2 and mimelib2 that connected to blockchain addresses to retrieve second-stage payloads. The attackers automated thousands of fake commits daily to inflate repository legitimacy, demonstrating sophisticated supply chain attack techniques that combine social engineering with blockchain-based evasion.

csoonline.com3 min read

SUBVERTING CODE INTEGRITY CHECKS TO LOCALLY BACKDOOR SIGNAL, 1PASSWORD, SLACK, AND MORE

A new vulnerability in popular Electron-based apps like Signal, 1Password, and Slack allows attackers to get around code integrity checks by hiding backdoors in overlooked V8 heap snapshot files. Electron's integrity protections often miss these files, meaning backdoors can be inserted without failing code signatures or integrity checks, especially when apps are installed in user-writable folders. This post shows a proof of concept to demonstrate keylogging and privilege escalation with the exploit, showing that even patched applications may have missed attack surfaces.

blog.trailofbits.com4 min read

04LAUNCHES & TOOLS

Sponsored

KEEP YOUR SOC TEAM ATTACK-READY WITH THE THREAT HUNTING SIMULATOR

Most SOC teams focus on reactive work but aren't actively looking for threat actors that have bypassed their security controls. TryHackMe's THREAT HUNTING SIMULATOR gives analysts a safe, repeatable environment to practice spotting adversary behaviours [12]. Gamified hunts and instant feedback enable teams to sharpen detection rules and response playbooks, without the overhead of building internal labs. Start free

tryhackme.comSponsor

tryhackme.com

FRACTION LOADER: IN-MEMORY LOADER PROJECT

Fraction Loader is an educational malware project that creates a stealthy in-memory loader capable of downloading, reassembling, and executing payload fragments without touching disk. It uses Windows APIs like VirtualAlloc and WinHTTP to handle encrypted payload chunks, parse headers for order, and reassemble them into executable memory with suitable permissions. While meant for penetration testers and security researchers to learn evasion techniques, it functions as a weaponized dropper that can bypass file-based detection and pose a threat to InfoSec professionals monitoring for in-memory attacks.

github.comGitHub repository

TIDAL CYBER (PRODUCT LAUNCH)

Tidal Cyber maps tactics, techniques, procedures, and procedural-level insights to MITRE ATT&CK to tailor security strategies around adversary groups and their behavior for threat-led defenses.

tidalcyber.com

FLOW

Mixeway Flow is a DevSecOps platform that automatically performs four security scans (SAST, SCA, IaC, and secret detection) on Git repositories through webhook integration. It aggregates vulnerabilities from various open-source scanning tools such as Bearer, OWASP Dependency Track, KICS, and Gitleaks into a single dashboard for streamlined security management. The platform simplifies CI/CD pipeline setup and offers thorough application security testing across code, dependencies, infrastructure, and credential exposure.

github.comGitHub repository

05MISCELLANEOUS

POLICE DISRUPTS STREAMEAST, LARGEST PIRATED SPORTS STREAMING NETWORK

Egyptian authorities and the Alliance for Creativity and Entertainment (ACE) shut down Streameast, the world's largest illegal sports streaming platform that received 136 million monthly visits across 80 domains, arresting two suspects and seizing assets linked to $6.2 million in laundered advertising revenue.

bleepingcomputer.com3 min read

JURY ORDERS GOOGLE TO PAY $425 MILLION FOR VIOLATING USER PRIVACY

A California jury found Google liable for collecting user data even after tracking was disabled, resulting in a $425 million penalty. The class action lawsuit covered 98 million users and claimed Google continued to gather app activity despite settings meant to protect privacy.

theverge.com2 min read