TLDR INFORMATION SECURITY 2025-11-12

QUANTUM ROUTE REDIRECT PHAAS TARGETS MICROSOFT 365 USERS WORLDWIDE

The Quantum Route Redirect phishing-as-a-service platform leverages ~1,000 pre-configured domains with automated bot filtering to steal Microsoft 365 credentials across 90 countries (76% US-targeted), using specific URL patterns matching "/([\w\d-]+.){2}[\w]{,3}/quantum.php/" and hosting on legitimate compromised domains to evade detection. The platform redirects humans to credential-harvesting pages while sending security scanning tools to benign sites. Security teams should implement URL filtering that targets the identified pattern, deploy account compromise monitoring, and recognize phishing lures that mimic DocuSign, payment notifications, and QR codes. Quantum Route Redirect represents an evolution in PhaaS sophistication similar to VoidProxy and Tycoon2FA campaigns.

HITACHI-OWNED GLOBALLOGIC ADMITS DATA STOLEN ON 10K CURRENT AND FORMER STAFF

GlobalLogic, owned by Hitachi, suffered a significant data breach that exposed the personal and financial data of over 10,000 current and former staff members. The attack, attributed to the Clop ransomware group, exploited vulnerabilities in the Oracle E-Business Suite. Clop focuses on stealing and leaking data while pressuring victims for payment. Oracle has issued emergency patches to counter these attacks.

HACKERS EXPLOIT TRIOFOX ZERO-DAY TO DEPLOY MALICIOUS PAYLOADS USING ANTI-VIRUS FEATURE

Researchers from Mandiant discovered a critical zero-day in Gladinet's Triofox file-sharing platform. The vulnerability allowed unauthenticated attackers to login to the platform by changing the HTTP host header to localhost. The attackers then configured the anti-virus scanner path to a malicious batch script.

HOW GLASSWORM WORMED ITS WAY BACK INTO DEVELOPERS' CODE — AND WHAT IT SAYS ABOUT OPEN SOURCE SECURITY

The GlassWorm self-propagating worm resurfaced two weeks after eradication, infecting three new OpenVSX VS Code extensions (with over 10,000 downloads) and GitHub repositories using invisible Unicode characters and a blockchain-based C2 infrastructure, with victims including global enterprises and Middle Eastern government entities. The Russia-based attack steals GitHub credentials, pushes malicious AI-generated commits appearing as legitimate code changes, and exploits OpenVSX's lack of manual code review resources. Security teams should whitelist only trusted extension publishers, disable auto-updates, monitor for credential harvesting and abnormal outbound connections, and treat developer toolchains with the same security rigor as production infrastructure, as automated scanning alone cannot reliably stop these supply chain attacks.

TIPS FOR RELIABLE SPLIT-SECOND DNS REBINDING IN CHROME AND SAFARI

DNS rebinding attacks occur when an attacker can trick a victim into leaking data by having the victim first communicate with the attacker's public server and then switching the DNS record to point to a private server. In Safari, a private IP address will be prioritized over a public IP address, but an attacker can circumvent this by delaying the DNS response with the private IP address. In Chrome, IPv6 will be prioritized over IPv4, allowing an attacker to send an IPv6 response with a public IP address and then an IPv4 response with a private IP address. In both cases, the attacker blocks the user from their server after connection, forcing the browser to rebind to the private IP.

NO PLACE LIKE LOCALHOST: UNAUTHENTICATED REMOTE ACCESS VIA TRIOFOX VULNERABILITY CVE-2025-12480

Mandiant has uncovered a significant security flaw in the Triofox file-sharing platform (tracked as CVE-2025-12480), which allows attackers to bypass authentication by manipulating the Host header to impersonate “localhost.” This gave unauthorized access to critical admin configuration pages, enabling the creation of privileged accounts. Attackers can exploit this to upload and execute arbitrary files, abusing Triofox's anti-virus feature to run malicious scripts with high privileges. The vulnerability is now patched, but organizations using Triofox should urgently update, check for rogue admin accounts, audit anti-virus configuration, and monitor for unusual administrator and SSH activity.

and more. Get a free demo

FLARE (PRODUCT LAUNCH)

Flare provides a threat exposure management platform that uses intelligence from the clear and dark web to help organizations prevent ransomware, data breaches, and other incidents, leveraging AI and machine learning for tailored cybersecurity insights and credential exposure detection.

UNIX-LIKE ARTIFACTS COLLECTOR

Unix-like Artifacts Collector (UAC) is a tool that automates the collection of forensics artifacts from a wide range of Unix-like systems.

AWESOME ANNUAL SECURITY REPORTS

A curated list of annual cybersecurity reports.

EUROPEAN COMMISSION MOVES TO LOOSEN GDPR FOR AI AND COOKIE TRACKING

The EU's leaked "Digital Omnibus" proposal would shift cookie tracking from opt-in to opt-out by moving regulation from ePrivacy Directive to GDPR, explicitly permit AI training on personal data under "legitimate interest" without consent, and narrow sensitive data protections to only data that directly reveals protected characteristics. Companies would no longer need consent management for most cookies, but must document legitimate interest justifications, while privacy advocates warn this fundamentally weakens GDPR's core protections. Security professionals should prepare for the November 19 formal unveiling by reviewing data processing practices, documenting AI training justifications, and reassessing compliance frameworks for the shift from explicit consent to legitimate interest models.

APT37 HACKERS ABUSE GOOGLE FIND HUB IN ANDROID DATA-WIPING ATTACKS

North Korean APT37/KONNI actors are targeting South Koreans via KakaoTalk spear-phishing with digitally-signed MSI files that deploy AutoIT scripts which establish persistence, deliver RemcosRAT/QuasarRAT/RftRAT, and steal Google/Naver credentials to access Find Hub for GPS tracking and remote Android device wiping. The attackers are exploiting stolen credentials to execute factory resets three times, preventing recovery, use GPS data to time attacks when victims are outside, then hijack compromised KakaoTalk PC sessions to spread malware laterally through contacts. Organizations should enforce MFA on Google accounts, verify messenger file senders via direct calls before opening attachments, and maintain accessible recovery accounts. This attack abuses legitimate Find Hub features rather than exploiting vulnerabilities.

OLLAMA, NVIDIA FLAWS PUT AI INFRASTRUCTURE AT RISK

Security researchers have uncovered critical vulnerabilities in Ollama and NVIDIA Triton Inference Server that could allow for remote code execution, exposing companies to significant risks in their AI infrastructure. These flaws, now fixed, reflect a shift in AI security research from attacking models to probing the underlying infrastructure.

THE "NOVEL TURING TEST" DETECTS AI WITH UP TO 80% ACCURACY

A computational Turing test achieves 70-80% accuracy in detecting AI-generated social media content by analyzing affective language patterns.

OWASP TOP 10

Updated list of the OWASP Top 10 that adds two new categories, consolidates SSRF into Broken Access Control, and expands supply chain scope.

SYNOLOGY FIXES BEESTATION ZERO-DAYS DEMOED AT PWN2OWN IRELAND

Synology urgently patched CVE-2025-12686, requiring immediate upgrade to BeeStation OS 1.3.2-65648, as no mitigations are available.