TLDR INFORMATION SECURITY 2025-10-13

specific software

>> Execute approved software as a local admin without entering credentials

See the ThreatLocker difference

FAKE “INFLATION REFUND” TEXTS TARGET NEW YORKERS IN NEW SCAM

An ongoing smishing campaign impersonates the New York Department of Taxation and Finance to target New Yorkers. The texts prompt victims to enter information on a link or risk losing an “Inflation Refund.” The link requests information such as SSNs, names, and addresses.

MICROSOFT WARNS OF NEW “PAYROLL PIRATE” SCAM STEALING EMPLOYEES' DIRECT DEPOSITS

A phishing campaign called Payroll Pirate targets university employees by tricking them into giving up credentials for HR platforms like Workday. Attackers use adversary-in-the-middle methods to bypass multi-factor authentication, alter payroll settings and divert paychecks, and hide their tracks by creating inbox rules and adding their recovery phone numbers.

UK TECHIES' UNION WARNS MEMBERS AFTER BREACH EXPOSES SENSITIVE PERSONAL DETAILS

UK trade union Prospect has warned members that sensitive personal data, such as contact details, bank account numbers, and, in some cases, information on sexual orientation or disabilities, was exposed following a cyber incident in June. Members were notified months after the attack, and the union offers a year of credit monitoring.

DDOS BOTNET AISURU BLANKETS US ISPS IN RECORD DDOS

Aisuru is the largest and most disruptive DDoS botnet ever recorded. It is powered mainly by infected IoT devices with weak security settings. Recent attacks have reached unprecedented data volumes, peaking at almost 30 trillion bits per second and causing significant disruptions, especially for online gaming ISPs like those serving Minecraft. The botnet evolved from earlier Mirai malware, exploits zero-day vulnerabilities, and can rent its network as residential proxies for cybercriminals. An international team manages it. Its rapid growth, boosted by the downfall of competing botnets, has highlighted significant gaps in how ISPs mitigate outbound DDoS traffic.

A SMALL NUMBER OF SAMPLES CAN POISON LLMS OF ANY SIZE

Anthropic has found that large language models (LLMs) like Claude can be compromised by injecting as few as 250 malicious files into their training data, regardless of the model's size or the total dataset volume. Attackers can create a “backdoor” in the model triggered by specific phrases, causing the model to behave unpredictably or output gibberish. This finding overturns the traditional belief that an attacker needs control of a percentage of training data: even a tiny, fixed number of documents might be enough.

NEW RUST MALWARE "CHAOSBOT" USES DISCORD FOR COMMAND AND CONTROL

ChaosBot is a sophisticated Rust-based backdoor that abuses legitimate Discord services for C2 operations. It primarily targets Vietnamese speakers through phishing campaigns with malicious Windows Shortcut files that sideload payloads via legitimate Microsoft Edge components. The malware supports reconnaissance commands (systeminfo, ipconfig, and screenshots), delivers secondary payloads like fast reverse proxy (frp) for persistent network access, and employs evasion techniques including ETW patching and VM detection to bypass security controls. Organizations should monitor for suspicious Discord API traffic, unusual PowerShell execution patterns with UTF-8 encoding prefixes, WMI-based lateral movement from over-privileged service accounts, and unauthorized DLL sideloading in Public user directories.

by Dell and Intel

SAFEHILL (PRODUCT LAUNCH)

SafeHill offers a continuous threat exposure management (CTEM) platform. It delivers continuous asset discovery, automated threat exposure assessments, and human-validated penetration testing – effectively continuous pentesting rather than point-in-time pentesting.

EXTRACT_OTP_SECRETS

Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.

JWT-CLI

jwt-cli is a Rust-based command line utility that goes beyond basic JWT decoding by enabling encoding of custom JWTs with flexible header values, arbitrary JSON claim bodies, and custom secrets. Built in Rust for speed and portability across Windows, macOS, and Linux, it offers more flexibility than standard JWT tools. This makes it a practical tool for security testing and development workflows involving JWT authentication.

APPLE NOW OFFERS $2M FOR ZERO-CLICK RCE

Apple has updated its bug bounty program, doubling maximum payouts, adding new research categories, and introducing a more transparent pay structure. With bonuses for lockdown mode bypasses and finding vulnerabilities in beta releases, the maximum reward payout can exceed $5M. One-click remote code execution (RCE), wireless proximity attack, broad unauthorized iCloud access, and WebKit exploit chain leading to RCE all also have $1M payouts.

SPYWARE MAKER NSO GROUP CONFIRMS ACQUISITION BY US INVESTORS

NSO Group, infamous for its powerful spyware, has just been taken over by a group of American investors. Even though new faces are in charge, the company's roots and oversight will stay in Israel. NSO's tools have targeted journalists and officials worldwide, so this takeover is making plenty of people nervous about what comes next and how these technologies might be used.

HACKERS TURN VELOCIRAPTOR DFIR TOOL INTO WEAPON IN LOCKBIT RANSOMWARE ATTACKS

Threat actors associated with Storm-2603 are weaponizing Velociraptor, a legitimate open-source digital forensics and incident response tool, to facilitate LockBit and Warlock ransomware attacks. The abuse of trusted security utilities allows attackers to evade detection while conducting reconnaissance and lateral movement within compromised networks. Security teams should monitor for unauthorized Velociraptor deployments, implement application whitelisting, and review legitimate DFIR tool usage to distinguish between authorized security operations and malicious activity.

Learn how one company saves millions each year

BREACHFORUMS SEIZED, BUT HACKERS SAY THEY WILL STILL LEAK SALESFORCE DATA

Despite law enforcement seizing the BreachForums cybercrime marketplace, threat actors have announced plans to proceed with leaking stolen Salesforce data through alternative channels, demonstrating that platform takedowns alone do not prevent data exposure and highlighting the need for organizations to assume breach, monitor dark web channels, and prepare incident response plans for potential data leaks.

RUSSIAN SPYWARE CLAYRAT IS SPREADING, EVOLVING QUICKLY, ACCORDING TO ZIMPERIUM

ClayRat, an Android spyware with over 600 samples detected in three months, spreads via fake TikTok and YouTube apps through Telegram and phishing sites, exploiting Android's SMS handler to bypass permissions and steal messages, calls, and device data, with potential for global expansion as infected devices become attack vectors.