TLDR INFORMATION SECURITY 2025-12-01

Register now

PUBLIC GITLAB REPOSITORIES EXPOSED MORE THAN 17,000 SECRETS

Security researcher Luke Marshall examined all 5.6 million public GitLab Cloud repositories with TruffleHog and found 17,430 verified active secrets across 2,804 distinct domains. This exposure is nearly three times that found in a similar scan of Bitbucket. The leaked credentials included over 5,200 Google Cloud Platform keys, MongoDB credentials, Telegram bot tokens, and OpenAI keys. Some secrets date back to 2009 and are still valid today. Although many organizations revoked their credentials after receiving automated alerts—earning the researcher $9,000 in bug bounties—some secrets continue to be exposed on GitLab repositories.

UPBIT ADMITS SECURITY FLAW THAT COULD HAVE ALLOWED ATTACKERS TO INFER PRIVATE KEYS AFTER $30M HACK

South Korean crypto exchange Upbit suffered a $30 million breach on November 27 when attackers drained assets from a Solana hot wallet. North Korea's Lazarus Group is suspected of being the threat actor. Post-incident analysis revealed a critical vulnerability that allowed inference of a private key from publicly disclosed blockchain wallet transactions, though Upbit's CEO did not explicitly confirm that this flaw enabled the breach. The exchange has suspended deposits and withdrawals for a complete wallet system overhaul and will cover all customer losses using company assets. $1.5 million of the stolen funds have already been frozen.

NEW ALBIRIOX MALWARE ATTACKING ANDROID USERS TO TAKE COMPLETE CONTROL OF THEIR DEVICE

A new Malware-as-a-Service called Albiriox has been observed providing customers with remote access to victim Android devices. Victims typically receive messages promising them discounts or prizes for an app. The links lead to fake versions of legitimate apps that request permissions to install applications, then fetch and install the malware. In addition to traditional infostealer capabilities, Albiriox includes a VNC module that streams the victim's device screen to the attacker.

INSIDE VALKYRIE STEALER: CAPABILITIES, EVASION TECHNIQUES, AND OPERATOR PROFILE

Valkyrie Stealer is a C++ infostealer developed by threat actor "Lawxsz" that employs Themida protection, ChaCha20-encrypted payload with reflective DLL loading, and comprehensive anti-VM defenses. The malware targets Chromium browsers by extracting AES master keys and parsing SQLite databases using an embedded engine, steals Discord and Telegram sessions, harvests credentials from 20+ gaming platforms, and exfiltrates cryptocurrency wallets from MetaMask, Exodus, Atomic Wallet, and Electrum. Stolen data is compressed using dual-method ZIP packaging, encrypted with AES-GCM using hardcoded keys, and exfiltrated to C2 servers resolved dynamically via Steam profile scraping. The operator maintains active distribution channels on Telegram, GitHub, YouTube, Discord, and Signal under the Prysmax Software brand.

CACHE POISONING CASE STUDIES PART 1: FOUNDATIONAL ATTACKS BEHIND A $100K+ VULNERABILITY CLASS

Cache poisoning is a web security vulnerability in which attackers trick caching systems, such as CDNs or proxies, into storing malicious responses, serving them to other users, and causing widespread harm. Early real-world examples from platforms such as HackerOne, GitHub, and Shopify show that unvalidated headers like X-Forwarded-Host or Content-Type can trigger global redirects, denial-of-service attacks, or stored XSS across multiple domains. These foundational cases, often yielding bounties of $2,500 to $6,300, highlight risks such as method overrides in cloud storage and social media amplification via Open Graph tags.

yourself.

LUMEN

LUMEN is a browser-based Windows Event Log analyzer built with React and WebAssembly that processes EVTX files entirely client-side without uploading logs to external servers. It supports files up to 500MB with both binary EVTX and XML exports. The tool features a curated SIGMA detection engine with platform-specific rule loading, automated event correlation that chains related activities into investigative storylines, IOC extraction with optional VirusTotal integration, and AI-powered analysis. Security teams can perform guided investigations while maintaining complete data privacy through local-only processing with session persistence via localStorage and no telemetry or data transmission.

PROXIMITY

Proximity scans MCP servers to discover tools, prompts, and resources. It provides a detailed analysis of server capabilities and optional security evaluation using NOVA rules.

GMSGADGET (WEBAPP)

Give Me a Security Gadget (GMSGadget) is a collection of JavaScript gadgets that can be used to bypass XSS mitigations like Content Security Policy (CSP) and HTML sanitizers like DOMPurify.

HASHJACK ATTACK USES URL '#' TO CONTROL AI BROWSER BEHAVIOR

HashJack is a novel indirect prompt injection technique that embeds malicious commands in URL fragments (after the # symbol) to manipulate AI browser assistants such as Google Gemini, Microsoft Copilot, and Perplexity Comet. The attack takes advantage of AI assistants' handling of full URLs, letting threat actors weaponize legitimate websites without compromising them and execute malicious instructions that bypass traditional security controls, enabling credential theft, data exfiltration, and more. Microsoft and Perplexity updated their products by October-November, but Google considered the Gemini vulnerability as expected behavior and chose not to fix it, leaving users vulnerable to this emerging AI security threat.

BRIT TELCO BRSK CONFIRMS BREACH AS BIDDING BEGINS FOR 230K+ CUSTOMER RECORDS

Brsk, a UK broadband provider, is investigating a cyberattack after criminals advertised more than 230,000 customer records for sale, allegedly including contact details, installation data, location information, phone numbers, and flags for vulnerable customers. It says only basic contact data was accessed. No passwords or payment details were taken. The company is offering affected users 12 months of credit monitoring while regulators and law enforcement investigate.

LEGACY PYTHON BOOTSTRAP SCRIPTS CREATE DOMAIN-TAKEOVER RISK IN MULTIPLE PYPI PACKAGES

Old Python bootstrap scripts in several PyPI packages still reference a long-abandoned domain used to fetch an installer for the legacy Distribute fork of Setuptools. The domain is now for sale. An attacker could buy it and serve malicious code to anyone running those scripts, exposing developers to supply-chain compromise and potential remote takeover via additional malware, such as RATs.

now to get your 3 FREE INFOSEC SKILLS SEATS.

PRESSURE RISING: EUROPEAN PARLIAMENT URGES TO BAN SOCIAL MEDIA FOR UNDER-16S

The European Parliament proposed a non-binding resolution for a harmonized EU minimum age of 16 for social media.

INFOSEC BLACK FRIDAY AND CYBER MONDAY DEALS

A collection of deals on InfoSec training, tools, gear, and more for Black Friday and Cyber Monday.

FRENCH SOCCER FEDERATION HIT BY CYBERATTACK, MEMBER DATA STOLEN

A cyberattack on the French soccer federation compromised the software used by clubs to manage registered members.