TLDR INFORMATION SECURITY 2025-11-17

CHINESE STATE HACKERS JAILBROKE CLAUDE AI CODE FOR AUTOMATED BREACHES

Chinese state-sponsored actors jailbroke Anthropic's Claude Code tool by disguising malicious tasks as legitimate defensive security work, achieving the first documented fully autonomous AI-driven cyber operation where the AI handled 80-90% of tactical work. The campaign targeted approximately 30 organizations globally across tech, finance, chemical manufacturing, and government sectors, achieving successful intrusions in roughly four cases before Anthropic banned the accounts. Security teams must now deploy AI-powered defensive capabilities to detect threats more quickly and counter the new paradigm of automated offensive operations.

DOORDASH HIT BY NEW DATA BREACH IN OCTOBER EXPOSING USER INFORMATION

DoorDash disclosed a data breach orchestrated by an unauthorized third party that accessed internal data through the social engineering of an employee. The breached data includes first and last names, physical and email addresses, and phone numbers. Some victims have expressed outrage over the wording of the notice and the delay in notification.

LOGITECH CONFIRMS DATA BREACH AFTER CLOP EXTORTION ATTACK

Logitech confirmed that it suffered a data breach due to a zero-day flaw after the Clop ransomware group added it to its list of victims. The company stated that the data may include limited information on employees, consumers, customers, and suppliers, but the databases did not contain financial information or IDs.

WHEN THE IMPERSONATION FUNCTION GETS USED TO IMPERSONATE USERS (FORTINET FORTIWEB AUTH. BYPASS CVE-2025-64446)

Fortinet FortiWeb appliances are being actively exploited via CVE-2025-64446, a pre-auth RCE chain combining path traversal and authentication bypass that allows attackers to reach privileged CGI functions and impersonate users by crafting a base64-encoded CGIINFO header containing admin credentials. The vulnerability was silently patched in version 8.0.2 and affects multiple FortiWeb versions. It enables complete appliance compromise through administrative account creation. WatchTowr released a detection tool on GitHub to identify vulnerable hosts.

WTF IS… - AI-NATIVE SAST

Leveraging AI as a complement to a traditional SAST can significantly improve results by using RAG to inject context on specific vulnerability classes. AI and SAST solutions can be leveraged using prompt-and-code, prompt-and-agent, or tailored-prompt-and-SAST-result methods. This post examines ZeroPath as an example of an agent, code graph, and SAST MCP.

MAKING SERIALIZATION GADGETS BY HAND - .NET

Creating deserialization gadgets for .NET by hand requires understanding the structure of .NET serialization streams, which are composed of sequential records that define objects and references. By breaking down these records, including headers, class information, member types, and values, it becomes possible to craft custom gadget chains directly in code, without relying on pre-generated payloads or Windows-only tools. The approach presented demonstrates how to reconstruct objects, assign values, and embed complex references, providing insight into the safe and dynamic generation of deserialization payloads.

Read the eBook

NOMORESTEALER

NoMoreStealer is a Windows kernel minifilter driver that intercepts file system operations and blocks untrusted processes from accessing specific protected paths.

SPYDITHREATINTEL

Spydi's ThreatIntel Feed is a comprehensive threat intelligence platform that aggregates, curates, and maintains high-quality blocklists for malicious IPs and domains. The system combines data from multiple OSINT sources, honeypot networks, and threat intelligence feeds to provide actionable security data.

DAYLIGHT (PRODUCT LAUNCH)

Daylight is an AI-powered Managed Detection and Response (MDR) platform that offers autonomous cyber threat hunting, analysis, and containment.

BE CAREFUL RESPONDING TO UNEXPECTED JOB INTERVIEWS

Attackers are impersonating legitimate recruiters via LinkedIn and email, luring victims with fake job interviews that redirect to malicious sites hosting RMM tools disguised as meeting software updates. The phishing campaign uses social engineering tactics, including spoofed recruiter names from real companies, Gmail sender addresses instead of corporate domains, and shortened URL redirects to phishing infrastructure. Security teams should alert users to verify unsolicited recruitment contacts independently, scrutinize sender domains and meeting URLs, and block known malicious RMM tool distributions through endpoint security controls.

BEHIND THE COMPLAINTS: OUR INVESTIGATION INTO THE SUSPICIOUS PRESSURE ON ARCHIVE.TODAY

AdGuard DNS received threatening demands from “Web Abuse Association Defense” (WAAD) to block Archive.today for allegedly hosting CSAM, but investigation revealed WAAD was registered in February 2025 with hidden ownership, minimal online presence, and suspicious bailiff reports created chiefly in August 2025 despite claims dating to 2023. Archive.today promptly removed flagged content and stated it never received prior notifications, suggesting a coordinated campaign of fraudulent complaints targeting the archival service through French LCEN law. AdGuard is filing criminal complaints with the French police for false reporting (punishable by up to 1 year in prison and a €15,000 fine), noting the suspicious timing of the FBI's investigation into Archive.today and potential impersonation of a real lawyer in similar complaints.

GOOGLE TO FLAG ANDROID APPS WITH EXCESSIVE BATTERY USAGE ON THE GOOGLE PLAY STORE

Google has announced that it will begin flagging apps on the Google Play Store that pass a defined bad behavior threshold. The Android vitals system will track partial wake locks, the cumulative time the app spends with background work while the screen is off, and prevent the device from entering sleep mode. Flagged apps will have a warning on their Play Store page and be excluded from prominent discovery surfaces such as recommendations.

HYUNDAI PAYWALLS BRAKE PAD CHANGES

Hyundai requires a $60/week NASTF subscription and $2,000 interface tool restricted to “service professionals” to retract electronic parking brakes for DIY brake pad replacement, forcing owners to use workarounds like Harbor Freight's T7 scan tool that trigger error codes.

POLICE TAKE DOWN THREE CYBERCRIME OPERATIONS IN LATEST ROUND OF 'WHACK-A-MOLE'

Authorities from nine countries coordinated by Europol dismantled three major cybercrime operations: Rhadamantys infostealer, Elysium botnet, and VenomRAT.

AKIRA RANSOMWARE GROUP MADE $244 MILLION IN RANSOM PROCEEDS

The Akira ransomware group has amassed over $244 million since March 2023 by targeting organizations worldwide, particularly those utilizing VMware ESXi servers.