Aisuru is the largest and most disruptive DDoS botnet ever recorded. It is powered mainly by infected IoT devices with weak security settings. Recent attacks have reached unprecedented data volumes, peaking at almost 30 trillion bits per second and causing significant disruptions, especially for online gaming ISPs like those serving Minecraft. The botnet evolved from earlier Mirai malware, exploits zero-day vulnerabilities, and can rent its network as residential proxies for cybercriminals. An international team manages it. Its rapid growth, boosted by the downfall of competing botnets, has highlighted significant gaps in how ISPs mitigate outbound DDoS traffic.
Anthropic has found that large language models (LLMs) like Claude can be compromised by injecting as few as 250 malicious files into their training data, regardless of the model's size or the total dataset volume. Attackers can create a “backdoor” in the model triggered by specific phrases, causing the model to behave unpredictably or output gibberish. This finding overturns the traditional belief that an attacker needs control of a percentage of training data: even a tiny, fixed number of documents might be enough.
ChaosBot is a sophisticated Rust-based backdoor that abuses legitimate Discord services for C2 operations. It primarily targets Vietnamese speakers through phishing campaigns with malicious Windows Shortcut files that sideload payloads via legitimate Microsoft Edge components. The malware supports reconnaissance commands (systeminfo, ipconfig, and screenshots), delivers secondary payloads like fast reverse proxy (frp) for persistent network access, and employs evasion techniques including ETW patching and VM detection to bypass security controls. Organizations should monitor for suspicious Discord API traffic, unusual PowerShell execution patterns with UTF-8 encoding prefixes, WMI-based lateral movement from over-privileged service accounts, and unauthorized DLL sideloading in Public user directories.
Sponsored
You can improve speed and flexibility by moving AI development to developers' PCs. But did you know you can bolster security as well? Learn how Dell and Intel commercial AI PCs keep you ahead with intelligent built-security and an adversarial mindset. Read the eBook
SafeHill offers a continuous threat exposure management (CTEM) platform. It delivers continuous asset discovery, automated threat exposure assessments, and human-validated penetration testing – effectively continuous pentesting rather than point-in-time pentesting.
Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.
jwt-cli is a Rust-based command line utility that goes beyond basic JWT decoding by enabling encoding of custom JWTs with flexible header values, arbitrary JSON claim bodies, and custom secrets. Built in Rust for speed and portability across Windows, macOS, and Linux, it offers more flexibility than standard JWT tools. This makes it a practical tool for security testing and development workflows involving JWT authentication.
Apple has updated its bug bounty program, doubling maximum payouts, adding new research categories, and introducing a more transparent pay structure. With bonuses for lockdown mode bypasses and finding vulnerabilities in beta releases, the maximum reward payout can exceed $5M. One-click remote code execution (RCE), wireless proximity attack, broad unauthorized iCloud access, and WebKit exploit chain leading to RCE all also have $1M payouts.
NSO Group, infamous for its powerful spyware, has just been taken over by a group of American investors. Even though new faces are in charge, the company's roots and oversight will stay in Israel. NSO's tools have targeted journalists and officials worldwide, so this takeover is making plenty of people nervous about what comes next and how these technologies might be used.
Threat actors associated with Storm-2603 are weaponizing Velociraptor, a legitimate open-source digital forensics and incident response tool, to facilitate LockBit and Warlock ransomware attacks. The abuse of trusted security utilities allows attackers to evade detection while conducting reconnaissance and lateral movement within compromised networks. Security teams should monitor for unauthorized Velociraptor deployments, implement application whitelisting, and review legitimate DFIR tool usage to distinguish between authorized security operations and malicious activity.
Sponsored
You have an easy way to collect & search it for litigation and investigations.
Despite law enforcement seizing the BreachForums cybercrime marketplace, threat actors have announced plans to proceed with leaking stolen Salesforce data through alternative channels, demonstrating that platform takedowns alone do not prevent data exposure and highlighting the need for organizations to assume breach, monitor dark web channels, and prepare incident response plans for potential data leaks.
ClayRat, an Android spyware with over 600 samples detected in three months, spreads via fake TikTok and YouTube apps through Telegram and phishing sites, exploiting Android's SMS handler to bypass permissions and steal messages, calls, and device data, with potential for global expansion as infected devices become attack vectors.
Sponsored
Independent reviewers confirm that using Semgrep can cut false positives by over 90% [4] compared to popular alternatives:
WordPress security firm, Wordfence, is warning users of the Service Finder premium WordPress theme of a critical (CVSS 9.8/10) vulnerability. The vulnerability is an authentication bypass vulnerability that allows attackers to bypass authentication and log in as administrators. Although a patch was released in July, Wordfence is reporting a sharp uptick in exploitation starting in September.
A vulnerability in GitHub Copilot Chat allowed attackers to combine Content Security Policy bypass with remote prompt injection to leak sensitive data from private repositories, including AWS keys and zero-day vulnerabilities. The attack exploited hidden HTML comments and GitHub's Camo proxy system by creating a dictionary of pre-generated Camo URLs for each alphabet character, allowing data to be exfiltrated when victims clicked on malicious URLs. GitHub addressed the issue on August 14 by preventing Camo from being used to leak sensitive user information.
UNC6040 is a financially motivated threat group that uses voice phishing (vishing) to trick employees into authorizing malicious Salesforce Data Loader applications, enabling large-scale data theft from corporate Salesforce instances. The attackers impersonate IT support personnel to manipulate victims into granting OAuth access to fake connected apps, then systematically exfiltrate sensitive data using legitimate Salesforce tools. Organizations should implement phishing-resistant MFA, restrict API access to approved applications only, enforce network-based login restrictions, and deploy real-time detection rules that monitor for suspicious OAuth authorizations followed by bulk data exports.
A threat actor linked to the CL0P group exploited a previously unknown vulnerability in Oracle E-Business Suite, stealing sensitive data from targeted organizations and launching a mass extortion email campaign. Attackers leverage sophisticated multi-stage Java payloads and compromised third-party accounts. Although Oracle issued critical emergency patches to mitigate the risk, this is still being actively exploited.
Amazon Elastic Container Registry (ECR) provides both repository and image-level usage and security scan information. This walkthrough provides sample code for generating centralized reports to aggregate this data across both images and repositories. The walkthrough also includes information for setting up Athena tables and queries to analyze the data.
Sponsored
Slack data is a ticking time bomb when litigation & investigations arise. Learn how one high-flying company avoids 7-figure legal bills with Onna's automated Slack collection and search tool.
Microsoft's Windows Backup for Organizations is an enterprise-grade backup tool that backs up Windows settings, preferences, and Microsoft Store apps to Exchange Online cloud storage, simplifying Windows 10 to Windows 11 migrations. The feature is opt-in and disabled by default, requiring IT administrator configuration through backup and restore policy settings on Entra-joined devices. Microsoft encrypts the backed-up data but retains access for troubleshooting and legal compliance purposes under strict management oversight.
Intruder's Autoswagger is a free open-source tool that automatically scans APIs for authorization vulnerabilities by parsing OpenAPI/Swagger documentation to identify endpoints lacking proper authentication checks. The tool discovered critical security flaws across major organizations during bug bounty testing, including exposed credentials, customer data, and database access at companies like Microsoft, multinational tech firms, and beverage corporations. Autoswagger highlights how self-documenting APIs increase attack surface by providing attackers with detailed endpoint information, making these simple authorization weaknesses easier to exploit at scale.
Artemis is a tool from CERT Polska, Poland's computer emergency response team. It is a modular vulnerability scanner with automatic report-generation capabilities.
Fly.io's CEO, Kurt Mackey, fell victim to a sophisticated phishing attack that compromised their company's Twitter account. Fly.io's core infrastructure remained safe due to robust, phishing-resistant authentication. The incident exploited generational gaps and social engineering rather than technical flaws.
Francesco Gaetano Caltagirone, a well-known Italian businessman, was notified by WhatsApp that his phone was targeted with Paragon spyware, extending the scandal in Italy beyond journalists and activists to business leaders. Caltagirone is the first businessman on the list of victims. The news comes after Paragon cut ties with the Italian government amid growing controversy.
California Governor Gavin Newsom signed a law requiring browsers to make it easier for Californians to opt out of allowing third-party data sharing. The California Consumer Privacy Act (CCPA) requires websites to allow Californians to opt out of data sharing, but it also mandates that browsers universally support this. Previously, this had to be done using third-party extensions.
Sponsored
The only security webinar serving strategy with a side of sunshine. Join the challenge [18]. Learn. Compete. Win a trip to the Bahamas.
A Microsoft Azure Front Door CDN outage caused widespread access issues to Microsoft 365 services and admin portals across Europe, Africa, and the Middle East for several hours.
ClayRat is an Android spyware targeting Russian users that spreads through fake popular apps on Telegram, stealing personal data, taking photos, making calls, and self-propagating by sending malicious messages.
Senator Gary Peters introduced the Protecting America from Cyber Threats (PACT) Act to replace the expired Cybersecurity and Information Sharing Act of 2015, renaming it to avoid confusion with the CISA agency amid Republican concerns about social media censorship.
Sponsored
Phishing isn't just emails anymore. It's AI-generated voices, videos, and deepfakes that sound and _look_ exactly like your executives. They can fool almost anyone - including you and your coworkers.
DraftKings disclosed a credential stuffing attack where threat actors used stolen username/password combinations from external breaches to gain unauthorized access to customer accounts, exposing names, addresses, phone numbers, email addresses, and partial payment card information. The company is requiring affected users to reset passwords and enable multi-factor authentication. This is DraftKings' second major credential stuffing incident since 2022, when attackers previously stole up to $300,000 from compromised accounts. The attack highlights the ongoing vulnerability of organizations to credential reuse attacks, where users' poor password hygiene across multiple platforms enables account takeovers even when the targeted company's own systems remain secure.
Rainwalk Pet Insurance exposed 158 GB of unprotected customer data containing 85,361 files, including pet insurance claims, veterinary bills, customer names, addresses, phone numbers, partial credit card numbers, and pet medical histories with microchip numbers. Security researcher Jeremiah Fowler discovered the misconfigured database and notified the company, but it remained publicly accessible for nearly a month before being secured. The breach creates significant fraud risks as criminals could exploit the combined pet and owner data to submit fraudulent insurance claims, intercept Venmo refunds, or conduct targeted scams using legitimate claim information and emotional manipulation tactics.
Salesforce has refused to pay a crime group calling itself Scattered LAPSUS$ Hunters, which claims to have stolen about 1 billion records from major clients. The hackers used social engineering to breach Salesforce portals and threatened to leak customer data unless paid.
LayerX research reveals AI has become the #1 corporate data exfiltration channel, with 45% of enterprise employees using generative AI tools and 67% accessing them through unmanaged personal accounts outside IT control. The primary threat vector is the use of copy/paste operations in AI platforms, with employees performing an average of 14 pastes per day via personal accounts, and at least three of these containing sensitive data, such as PII or PCI information. Traditional DLP tools miss this threat entirely since they're designed for file-based environments, while 40% of files uploaded to GenAI tools contain sensitive data, and 77% of employees paste corporate data directly into these platforms.
UNC6040 is a financially motivated threat group that utilizes voice phishing (vishing) to deceive employees into authorizing malicious Salesforce Data Loader applications, thereby enabling large-scale data theft from corporate Salesforce instances. The attackers impersonate IT support personnel to manipulate victims into granting OAuth access to fake connected apps, then systematically exfiltrate sensitive data using legitimate Salesforce tools. Organizations should implement phishing-resistant MFA, restrict API access to approved applications only, enforce network-based login restrictions, and deploy real-time detection rules that monitor for suspicious OAuth authorizations followed by bulk data exports.
Cybercriminals are now exploiting trusted collaboration platforms, such as Zoom, to execute highly convincing phishing attacks. By sending what appears to be legitimate HR documents via Zoom, attackers redirect recipients to a fake “bot protection” page and then to a Gmail login imitation designed to steal credentials. Credentials entered on this page are exfiltrated in real-time over a WebSocket connection, allowing attackers to validate and use them swiftly.
Sponsored
Last chance to join [12] Francis Odum, Sarah Armstrong-Smith, and top cyber leaders for insider threat intelligence and real-world defense tactics at N-able's Cyber Resilience Summit on October 16th. Learn how businesses of all sizes can apply AI-powered resilience strategies -
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
pipe-intercept is a tool to intercept Windows Named Pipes communication using Burp or similar HTTP proxy tools.
UNIX-like reverse engineering framework and command-line toolset.
The "Mic-E-Mouse" attack is where high-precision computer mice can function as unintended listening devices by detecting minute desk vibrations caused by sound waves through their sensitive optical sensors. The attack converts mouse movement data into audio signals using machine learning, achieving 42-61% speech recognition accuracy without requiring malware installation—only access to normal mouse data packets. This side-channel attack illustrates how increasingly sensitive hardware can create unexpected privacy vulnerabilities, particularly as high-DPI gaming mice become more widespread and affordable.
Germany's government has decided to block the EU's Chat Control regulation, which aimed to compel messaging services to scan all user chats—including those on encrypted platforms—for child abuse material. This stance creates a crucial blocking minority, likely ending the proposal, as it reflects the widespread concerns about privacy, democracy, and digital rights from major tech and privacy advocacy organizations.
OpenAI highlights recent efforts to block malicious use of AI, targeting scams, cybercrime, and manipulation by various threat actors. Most attackers use AI to accelerate existing tactics, rather than invent new attacks, so OpenAI has banned accounts that violate their safe usage policies.
2025.10.09·links.tldrnewsletter.com·20 min read·TLDR InfoSec Sponsored
Join Containment Island [19] and compete against other cyber pros in 12 fast-paced, expert-led sessions. Win weekly prizes and a chance to win a trip to paradise.