TLDR INFORMATION SECURITY 2025-10-20

Register here →

💡 WHILE YOU WAIT FOR WEDNESDAY'S WEBINAR, check out RIPPLING IT'S

TWO NEW WINDOWS ZERO-DAYS EXPLOITED IN THE WILD - ONE AFFECTS EVERY VERSION EVER SHIPPED

Microsoft fixed three actively exploited vulnerabilities as part of the final Patch Tuesday for Windows 10. One of the vulnerabilities is a secure boot bypass, whereas the other two are privilege escalation vulnerabilities. Notably, a vulnerable legacy modem driver could allow for privilege escalation in every version of Windows.

GOOGLE ADS FOR FAKE HOMEBREW, LOGMEIN SITES PUSH INFOSTEALERS

Researchers at threat hunting company Hunt.io have uncovered a new malware campaign that uses ClickFix tactics and impersonates popular software to distribute malware. The campaign uses Google Ads to impersonate software like Homebrew, LogMeIn, and TradingView and requests users to copy commands they run in Terminal. The malware then downloads either Odyssey or AMOS infostealers to harvest credentials.

PROSPER DATA BREACH IMPACTS 17.6 MILLION ACCOUNTS

HACKING A BANNED CHINESE SECURITY CAMERA

A security researcher successfully conducted man-in-the-middle attacks against a banned Chinese security camera, demonstrating that the device fails to verify certificate signing chains properly and transmits unencrypted video data over UDP. While these vulnerabilities are concerning, the real security issue driving the US ban is the camera's automatic firmware update capability, which could allow manufacturers to push malicious software updates in the future. The analysis highlights how even devices with multiple security flaws may pose their most significant risk through remote update mechanisms that users cannot control or audit.

DEFENDERWRITE: ABUSING WHITELISTED PROGRAMS FOR ARBITRARY WRITES

Antivirus folders typically block file writes to prevent attacks, but some whitelisted Windows programs can bypass these restrictions. DefenderWrite is a tool that identifies which executables can write files into protected antivirus folders without elevated privileges or exploits. By scanning all .exe files and testing their capabilities, the tool reveals weak points in Windows Defender and other major AVs, showing that even protected folders can be compromised for stealthy persistence.

REVISITING BROWSER CACHE SMUGGLING

Browser cache smuggling is a technique that abuses how web browsers store files to sneak malicious code onto victims' systems. The method leverages browser caching to download files, then uses COM Hijacking (a way of loading malicious DLLs via Windows registry settings) to achieve persistent code execution each time the browser starts. Steganography is also used to hide additional payloads within cached images, making detection harder. By combining these approaches, attackers can reliably trigger their code from the browser cache without external downloads or easily detectable file changes, bypassing many modern endpoint protections and leaving few obvious traces.

SEMGREP'S AI ISN'T JUST AN API CALL TO AN LLM - IT CONFIDENTLY HANDLES AROUND 60% OF SAST TRIAGE FOR CUSTOMERS, WITH A 96% HUMAN-AGREE RATE. THIS MEANS SECURITY TEAMS CAN SPEND ALL OF THEIR TIME ON THE ISSUES THAT MATTER, WITHOUT WORRYING THAT THEY'VE MISSED OUT ON ANY REAL ISSUES. See how Semgrep compares to competitors.

KIEMPOSSIBLE

KIEMPossible is a Kubernetes Infrastructure Entitlement Management tool from Palo Alto Networks that provides visibility into permissions and their actual usage across clusters by analyzing RBAC configurations and audit logs from AWS EKS, Azure AKS, GCP GKE, and local Kubernetes environments. The tool flattens complex permission structures into granular entries, correlates them with audit logs to identify last usage timestamps, and stores the results in a MySQL database to help security teams enforce least privilege by identifying unused or risky permissions. It supports workload identity mapping and group inheritance tracking and generates reports on entities with dangerous unused permissions, making reducing attack surface without breaking legitimate access easier.

KNIGHTER

KNighter is an automated static analysis tool from UIUC that uses Large Language Models to synthesize custom code checkers by learning from historical patch commits in C/C++ codebases like the Linux kernel. The tool employs a three-stage pipeline of generation, refinement, and triage to create LLVM-based checkers that identify bug patterns, focusing on finding real-world vulnerabilities in large-scale systems. It integrates with OpenAI, Claude, Google, and DeepSeek models to automatically generate static analysis rules from git commit history, enabling security teams to discover previously unknown bugs based on patterns from past fixes.

FUZZFORGE AI

AI-powered workflow automation and AI Agents platform for AppSec, Fuzzing, and Offensive Security. Automate vulnerability discovery with intelligent fuzzing, AI-driven analysis, and a marketplace of security tools.

EUROPOL DISMANTLES SIM FARM NETWORK POWERING 49 MILLION FAKE ACCOUNTS WORLDWIDE

Europol's Operation SIMCARTEL dismantled a sophisticated cybercrime-as-a-service platform that operated SIM farms with 40,000 active SIM cards, enabling the creation of over 49 million fake online accounts used for phishing, investment fraud, and other criminal activities. The operation resulted in seven arrests, seizure of 1,200 SIM box devices, takedown of two websites, and freezing of nearly €700,000 in assets across multiple countries. Security professionals should monitor for SIM farm indicators in their threat detection systems and implement stronger verification processes that go beyond SMS-based authentication, as these operations demonstrate how easily criminals can bypass phone number verification on a massive scale.

NORTH KOREAN HACKERS COMBINE BEAVERTAIL AND OTTERCOOKIE INTO ADVANCED JS MALWARE

North Korean threat actors behind the Contagious Interview campaign have merged functionality from their BeaverTail and OtterCookie malware families, creating a more sophisticated JavaScript-based information stealer with enhanced keylogging, screenshot capture, and cryptocurrency wallet theft capabilities. The evolved malware uses legitimate npm packages and supply chain compromises to distribute through fake job interview processes, with new variants like OtterCandy combining remote access trojan functionality and utilizing blockchain-based command-and-control infrastructure via Ethereum and BNB Smart Chain. Security professionals should monitor for suspicious npm packages, implement stronger validation for job applicant technical assessments, and watch for the specific malware indicators, including the "node-nvm-ssh" package and associated file patterns used in these supply chain attacks.

VANILLA TEMPEST'S RHYSIDA RANSOMWARE ATTACKS FOILED

Microsoft dismantled an attack campaign by Vanilla Tempest (also called Vice Society), which used fake Microsoft Teams installers and over 200 fraudulent certificates to spread the Rhysida ransomware. The attackers used malicious ads and SEO techniques to lure users, delivering malware that enabled data theft and additional payload delivery.

BEIJING ALLEGES “IRREFUTABLE EVIDENCE” LINKING US TO MAJOR CYBERATTACK ON CHINESE AGENCY

China's State Security Ministry claims the NSA has been exploiting vulnerabilities in employees' mobile devices to gain unauthorized access to the National Time Service Center since 2022, using stolen credentials and 42 types of cyberattack tools to target the facility's timing systems and internal networks.

COLLINS AEROSPACE ATTACK CLAIMED BY EVEREST, LINKING RANSOMWARE GROUP TO LAST MONTH'S EUROPEAN AIRPORT CHAOS

The Everest ransomware group claims responsibility for breaching Collins Aerospace's MUSE check-in software in September, allegedly exfiltrating 50GB of data and causing days of disruption at major European airports, including Heathrow, Brussels, Berlin, and Dublin, by forcing manual check-in operations.