Search the archive

🎁 TLDR readers get 40% off! Claim your discount →

That means you benefit from battle-tested end-to-end encryption

and security trusted by 100M+ users and 50,000+ businesses.

PROVIDER OF COVERT SURVEILLANCE APP SPILLS PASSWORDS FOR 62,000 USERS

Catwatchful, an Android spyware app marketed for "stealthy monitoring," leaked sensitive data from 62,000 users due to an SQL injection vulnerability. The breach exposed email addresses, plain-text passwords, and monitoring data.

RECRUITING SOFTWARE MAKER EXPOSES NEARLY 26M RESUMES

TalentHook, a cloud-based applicant tracking system, accidentally exposed the resumes of nearly 26M applicants. Cybernews found an open Azure Blob Storage container with files. The exposed data includes names, emails, addresses, education, and employment history.

INGRAM MICRO OUTAGE CAUSED BY SAFEPAY RANSOMWARE ATTACK

Ingram Micro, a business-to-business technology distributor, has been suffering an outage since Thursday. The outage was caused by the SafePay ransomware. The threat actors breached the company through its GlobalProtect VPN.

YET ANOTHER ZIP TRICK WRITEUP

This write-up explains how to create a "schizophrenic ZIP file". This type of ZIP file appears differently depending on the parser used. The trick relies on how parsers locate the Central Directory, with some using the offset field and others calculating it from the size. As a result, each method points to different Central Directories containing different file content, allowing the same ZIP file to display different contents depending on which parser opens it. This enables malicious files to be opened without the user's knowledge.

RULES FILES FOR SAFER VIBE CODING

Studies have shown that code generated by LLMs contains many security vulnerabilities. Developers should move security earlier in the development process by creating rules files for IDEs like Cursor, which include security guardrails and instructions. This post offers guidance on writing prompts for these rules files. Early research indicates that simply adding the word “secure” to a prompt can significantly reduce vulnerabilities.

PROFILING TRADETRAITOR: TACTICS, HISTORY & DEFENSES

TradeTraitor, a North Korean threat actor, has stolen over $2.4 billion through social engineering and cloud attacks, compromising developer credentials to inject malicious code and reroute ETH. Its attacks involve harvesting AWS tokens, injecting JavaScript into cloud applications, with defenses including short-lived tokens, full CloudTrail logs, MFA, and credential monitoring.

COMPYL (PRODUCT LAUNCH)

Compyl provides solutions for compliance, asset management, contract management, policy management, user access reviews, and risk management (including vendor risk).

GO-OVER

A tool to audit Erlang and Elixir dependencies to make sure your Gleam projects sparkle.

LITELLM

LiteLLM is a Python SDK, LLM gateway, and proxy server to call 100+ LLM APIs in OpenAPI format.

MASSIVE SPIKE IN USE OF .ES DOMAINS FOR PHISHING ABUSE

Cybersecurity experts report a 19-fold increase in malicious campaigns using Spain's .es domains, making it the third most abused after .com and .ru. Since January, 1,373 subdomains on 447 .es domains have hosted malicious content, with 99% of it focused on credential phishing, targeting Microsoft users via fake HR-themed emails.

GOOGLE ORDERED TO PAY $314M FOR MISUSING ANDROID USERS' CELLULAR DATA WITHOUT PERMISSION

A California court has ordered Google to pay $314 million for illegally using Android users' cellular data without consent. The lawsuit revealed that Google transferred device information even when phones were idle, which used up users' data allowances. Google intends to appeal this ruling.

INSTAGRAM USES EXPIRING CERTIFICATES AS SINGLE DAY TLS CERTIFICATES

While testing a personal tool, the author of this post noticed that certificates for instagram.com had unusual expiration times. The author set up a machine that attempted to pull the certificates for instagram.com and www.instagram.com every 5 minutes. They discovered that Instagram uses certificates with a lifetime of 8 days, replaces them daily, and uses unique certificates for instagram.com and www.instagram.com.

CHINA-LINKED GROUP HOUKEN HIT FRENCH ORGANIZATIONS USING ZERO-DAYS

A China-linked hacking group called Houken exploited three zero-day vulnerabilities in Ivanti Cloud Service Appliance devices to breach French government, telecom, media, finance, and transport organizations starting in September 2024, using sophisticated tools and rootkits to steal credentials and maintain persistent access.

CALLERS POSING AS ATF AGENTS USE 'APPLE GIFT CARDS' SCAM

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) warns the public about scammers pretending to be federal agents demanding Apple gift cards of $500 or $1,000 to "clear red flags" from accounts, stressing that real federal agencies never ask for payments via gift cards, wire transfers, or cryptocurrency.

IDEALAB CONFIRMS DATA STOLEN IN RANSOMWARE ATTACK LAST YEAR

IdeaLab, a California tech incubator, suffered a data breach in October 2024 when hackers stole sensitive information.

YOUNG CONSULTING FINDS EVEN MORE FOLKS AFFECTED IN BREACH MESS – NOW OVER 1 MILLION

Young Consulting (now Connexure) experienced a ransomware attack in April 2024 that impacted over 1 million individuals. The BlackSuit group claimed responsibility. The breached data included names, Social Security numbers, birth dates, and insurance details.

CISCO FIXES MAXIMUM-SEVERITY FLAW IN ENTERPRISE UNIFIED COMMS PLATFORM (CVE-2025-20309)

Cisco discovered CVE-2025-20309, a backdoor vulnerability, in its Unified Communications Manager with unchangeable default root credentials. It affects only Engineering Special releases (15.0.1.13010-1 through 15.0.1.13017-1), allowing remote attackers root access. The vulnerability was found during internal testing with no known exploitation.

GRAFANA RELEASES CRITICAL SECURITY UPDATE FOR IMAGE RENDERER PLUGIN

Grafana Labs has issued security updates for its Image Renderer plugin and Synthetic Monitoring Agent to fix four high-severity Chromium vulnerabilities (CVE-2025-5959, CVE-2025-6554, CVE-2025-6191, and CVE-2025-6192). These flaws could allow remote code execution, memory access, and heap corruption via crafted HTML pages. Affected versions are those prior to 3.12.9 for Image Renderer and 0.38.3 for Monitoring Agent, both of which include a headless Chromium browser for dashboard rendering. Users should update immediately. Cloud and Azure instances have already been patched.

OUTSOURCED TRUST: HOW COINBASE'S $400M PROBLEM STARTED IN AN INDIAN CALL CENTER

Coinbase suffered a data breach that affected 69,461 users when outsourced call center employees illegally accessed customer information. The attackers demanded a $20 million ransom, but Coinbase offered a $20 million bounty instead. The breach enabled social engineering scams, resulting in losses exceeding $ 65.7 million.

GUEST POST: HOW I SCANNED ALL OF GITHUB'S “OOPS COMMITS” FOR LEAKED SECRETS

A security researcher discovered that GitHub permanently stores "deleted" commits from force pushes as "zero-commit" PushEvents in the GitHub Archive, making supposedly removed secrets still accessible via commit hashes. By scanning all zero-commit force push events since 2020 using the GitHub Event API and GitHub Archive data, the researcher built automated tools to identify and analyze these hidden commits for leaked credentials, uncovering $ 25,000 worth of active secrets. Key security strategies include implementing pre-commit secret scanning, treating any committed secret as permanently compromised regardless of deletion attempts, immediately revoking exposed credentials, and protecting .env files, which were the most common source of leaked secrets.

REVERSE ENGINEERING CURSOR'S LLM CLIENT

In this post, the authors used TensorZero, an open-source framework for optimizing LLM applications with downstream feedback signals, to observe the API calls and tokens sent between Cursor and the LLM providers. They first ran into errors connecting to TensorZero running locally because Cursor first sends a request to Cursor's servers for additional processing, so the authors needed to set up a reverse proxy to expose a public endpoint that would forward requests back to the local machine. They then had to solve for CORS issues. Eventually, they managed to wire Cursor up properly and included sample system prompts and interactions between a user session and what Cursor generates.

SHADOWCRYPT

Proactive ransomware defense and secure file hiding for Windows. Effortlessly protect, access, and recover sensitive files using encrypted mappings and smart shortcuts.

SECRETS NINJA

Secrets Ninja is a GUI-based tool that validates API keys and credentials found during penetration testing. It tests these secrets directly from your browser using frontend JavaScript, ensuring that no sensitive information is ever collected or logged.

TROLLRPC

TrollRPC is a library to bind RPC calls based on UUID and OPNUM. The goal of the library is to break specific RPC calls to an antivirus scanner for AMSI bypass.

RANSOMWARE GANG HUNTERS INTERNATIONAL SAYS IT'S SHUTTING DOWN

The Hunters International ransomware gang announced its shutdown on Thursday, offering free decryption keys to its victims. The group operated for two years, targeting organizations including a U.S. cancer center. Security experts suspect that this may be a rebranding effort, with the gang potentially transitioning to "World Leaks" to evade detection by law enforcement.

UNCOVERING NYTHEON AI - A NEW PLATFORM OF UNCENSORED LLMS

Threat researchers at Cato CTRL have released a report on an uncensored LLM platform known as Nytheon AI. The operators behind Nytheon trained a suite of gen AI tools by employing jailbreaks on open-source models from Meta and Deepseek. The Nytheon AI suite includes models for code generation, document summarization and translation, OCR, and a control model.

AWS CERTIFICATE MANAGER HAS ANNOUNCED EXPORTABLE TLS CERTIFICATES, AND I'M MOSTLY OKAY WITH IT

Recently, AWS Certificate Manager (ACM) added the ability to export certificates and private keys for use in EC2 or external applications. Currently, ACM does not implement ACME, so certificate renewals must be handled manually or via the AWS API. Organizations that want to ensure that private keys never leave ACM can disable exports at the AWS Organization level or on an account-by-account basis via SCPs.

NEW FAKE MARKETPLACE FROM CHINA MIMICS TOP RETAIL BRANDS FOR FRAUD

A scam originating from China has led to the creation of thousands of fake shopping websites that mimic real stores, stealing payment information from global shoppers, especially during major sales events in Mexico.

NORTH KOREAN HACKERS DROP NIMDOOR MACOS MALWARE VIA FAKE ZOOM UPDATES

North Korean hackers are deploying deceptive Zoom updates to distribute NimDoor malware on macOS and target cryptocurrency firms covertly to steal sensitive data.

POLICE DISMANTLE INVESTMENT FRAUD RING STEALING €10 MILLION

Spanish police dismantled a fake investment scam that defrauded over €10 million from hundreds of victims through false advertisements, fake websites, and call centers claiming to be investment experts.

QANTAS CONFIRMS MAJOR DATA BREACH LINKED TO THIRD-PARTY VENDOR

Qantas confirmed a data breach on July 1 after attackers accessed a third-party call center platform, potentially exposing records of up to 6 million customers, including names, email addresses, phone numbers, dates of birth, and frequent flyer numbers. The attack is linked to the hacking group Scattered Spider, which has targeted airlines like Hawaiian Airlines and WestJet using social engineering to trick staff into system access. While no financial data, passwords, or passports were compromised, the incident underscores airline vulnerability during peak travel and the rising threat of supply chain attacks on aviation.

FORMINATOR PLUGIN FLAW EXPOSES WORDPRESS SITES TO TAKEOVER ATTACKS

The WordPress Forminator plugin (versions up to 1.44.2) contains a critical vulnerability (CVE-2025-6463, CVSS 8.8) that affects 600,000+ sites. Attackers can exploit insufficient input validation to delete critical files like wp-config.php, forcing sites into setup mode for complete takeover. Version 1.44.3 patches this flaw—immediate updates are essential.

CYBERATTACK TARGETS INTERNATIONAL CRIMINAL COURT

The International Criminal Court (ICC) was hit by a "sophisticated and targeted cyber security incident" last week, marking the second major attack in two years. The intrusion was quickly detected and contained. The timing coincides with NATO leaders meeting in The Hague and ongoing high-profile cases involving arrest warrants for Putin, Netanyahu, and Hamas leaders.

WHY EVERY COMPANY NEEDS A TRAVEL SECURITY PROGRAM

ESCAPEROUTE: BREAKING THE SCOPE OF ANTHROPIC'S FILESYSTEM MCP SERVER (CVE-2025-53109 & CVE-2025-53110)

Cymulate Research Labs discovered critical vulnerabilities in Anthropic's Model Context Protocol (MCP) Filesystem Server. Two high-severity flaws (CVE-2025-53110 and CVE-2025-53109) allow attackers to escape sandboxes, access any host files, and execute arbitrary code through directory containment bypass and symlink exploitation.

AUTHENTICATION METHODS: CHOOSING THE RIGHT TYPE

Password-based authentication is vulnerable to various common attacks, including password reuse, weak passwords, and phishing. To combat these threats, this guide from the NCSC guides on “going beyond passwords” with MFA, federated Single Sign-On (SSO), FIDO 2 security keys, or magic links and one-time passwords (OTPs). Each section includes an introduction to the method, its pros and cons, and a chart to help determine when you may want to use it and when you may want to consider a different method.

JS & CLIENT-SIDE RESOURCES

This GitHub repository offers resources on client-side web security, focusing on JavaScript, XSS, CSP bypasses, CORS, CSRF, and other attack vectors. It includes tutorials, challenges, case studies, and security blogs for practical learning.

FRAIM

A flexible framework for security teams to build and deploy AI-powered workflows that complement their existing security operations.

GITPHISH

GitPhish is a comprehensive security research tool designed to perform GitHub's device code authentication flow. The platform operates through three primary modes: an authentication server, automated landing page deployment, and an administrative management interface.

TOP FBI CYBER OFFICIAL: SALT TYPHOON ‘LARGELY CONTAINED' IN TELECOM NETWORKS

According to the FBI's top cyber official, Brett Leatherman, the Chinese hacking group Salt Typhoon is "largely contained" and "dormant" in telecommunications networks, with nine U.S. telecom companies having been victimized. However, the hackers still pose a threat, as they could pivot from espionage to destructive action. Leatherman noted that Salt Typhoon and Volt Typhoon are more similar than some think, as both have access to critical infrastructure that could support destructive operations.

U.S. SANCTIONS RUSSIA'S AEZA GROUP FOR AIDING CROOKS WITH BULLETPROOF HOSTING

The U.S. sanctioned Russia-based Aeza Group and its leaders for providing "bulletproof" hosting services that enable cybercriminals to operate illegal websites and evade law enforcement. The sanctions target multiple companies and individuals associated with the Aeza Group. This effort was coordinated with the UK.

VERCEL'S V0 AI TOOL WEAPONIZED BY CYBERCRIMINALS TO RAPIDLY CREATE FAKE LOGIN PAGES AT SCALE

Threat actors are weaponizing Vercel's v0 AI tool to create convincing phishing sites through simple text prompts, targeting multiple brands, including Okta customers. This represents a significant evolution in AI-powered cybercrime, enabling low-skilled attackers to rapidly generate high-quality fake login pages at scale without coding knowledge.

MICROSOFT FIXES ‘PRINT TO PDF' FEATURE BROKEN BY WINDOWS UPDATE

Microsoft fixed a bug that broke the "Print to PDF" feature in Windows 11 after a recent update.

BLIND EAGLE LINKED TO RUSSIAN HOST PROTON66 IN LATIN AMERICA ATTACKS

Blind Eagle, a cybercrime group, is using Proton66's Russian hosting services to launch malware attacks on Latin American banks via fake banking websites.

UBUNTU DISABLES INTEL GPU SECURITY MITIGATIONS, PROMISES 20% PERFORMANCE BOOST

Ubuntu plans to disable certain Intel GPU security features to boost performance by about 20%, a change deemed low-risk for most users given the rarity and difficulty of potential attacks.