TLDR Information Security 2025-12-04

Test your team's readiness against deepfake phishing for free (Sponsor)

Today's social engineering spans far beyond the email inbox. Bad actors use AI to phish, and are using SMS texts, voicemails, and even video chats to scam.

That's why Adaptive Security — the security awareness platform built for next-generation threats — is offering a free readiness check, giving you an interactive preview of how AI-powered phishing works across channels.

>> Start your free phishing test and experience phishing across email, SMS, voice, and more

>> Take a tour of the Adaptive Security platform

🔓

Attacks & Vulnerabilities

Everest Ransomware Claims ASUS Breach and 1TB Data Theft (2 minute read)

The Everest ransomware group claimed responsibility for breaching ASUS and exfiltrating over 1TB of data allegedly containing proprietary camera source code, firmware, and drivers for devices with built-in cameras. The group issued a 21-hour deadline for ASUS to respond via Qtox encrypted messaging, following recent claimed attacks on Under Armour, Petrobras, and Iberia airline. ASUS has neither confirmed nor denied the breach, which, if verified, would mark the second significant infrastructure compromise since the 2019 ShadowHammer supply chain attack.

Gmarket Suffers Unauthorized Payment Incident Affecting 60 Users Amid Hacking Woes (2 minute read)

Financial authorities have begun an emergency on-site inspection of the Korean e-commerce platform Gmarket after reports of unauthorized mobile payments. The attackers purchased mobile gift certificates using credit cards registered with Gmarket's simple payment service. Gmarket claims that the unauthorized payments resulted from account compromise, not a data breach.

K7 Antivirus Vulnerability Allows Attackers to Gain SYSTEM-Level Privileges (2 minute read)

A security researcher discovered a privilege escalation vulnerability in the K7 Ultimate Security antivirus while investigating an unrelated DoS vulnerability. The vulnerability exploited named pipes with overly permissive access control lists, allowing a non-admin user to execute arbitrary code as SYSTEM during fake updates. K7 worked with the researcher to issue three patches to provide interim fixes for the vulnerability pending full ACL enforcement in a future release.

🧠

Strategies & Tactics

From Zero to SYSTEM: Building PrintSpoofer from Scratch (11 minute read)

A Windows privilege escalation technique exploits named pipes and the Print Spooler's RPC interface to elevate accounts with SeImpersonatePrivilege, such as IIS app pool identities, to SYSTEM. It exploits its lack of SQOS protection and a path-validation bug that can be bypassed by crafting backslash/forward-slash-separated pipe paths to trigger SYSTEM connections to an attacker‑controlled pipe.

68% Of Phishing Websites Are Protected by CloudFlare (5 minute read)

Modern phishing operations increasingly rely on mainstream infrastructure like Cloudflare, major cloud providers, and popular developer-focused TLDs such as .dev and .app to appear legitimate and resist takedown. Attackers mix disposable direct-hosted servers with CDN-protected setups, often hiding behind services like Vercel, GitHub Pages, and other trusted platforms that organizations cannot simply block. Phishing-as-a-Service ecosystems now provide turnkey kits with MFA bypass, session cookie theft, and advanced evasion, heavily targeting brands like Meta, Amazon, and PayPal.

🧑‍💻

Launches & Tools

ZeroCrumb (GitHub Repo)

ZeroCrumb bypasses the Chrome Elevation Service by impersonating a Chrome instance to dump app bound protected credentials and cookies without privileges.

Cyber Startup Frenetik Launches with Patented Deception Technology That Bets Against the AI Arms Race (2 minute read)

Maryland-based Frenetik emerged from stealth with patented "Deception In-Use" technology (US Patent 12,463,981) that continuously rotates active identities and resources across Microsoft Entra, AWS, Google Cloud, and on-premises environments to invalidate attacker reconnaissance. The approach exploits information asymmetry by ensuring defenders receive real-time change notifications through out-of-band channels while attackers operate on stale intelligence, funneling them into honeypots and decoys. A free community version is available for organizations seeking to implement active deception without extensive tuning or analyst oversight.

Flowsint (GitHub Repo)

Flowsint is an open-source OSINT graph exploration tool designed for ethical investigation, transparency, and verification.

🎁

Miscellaneous

Researchers Capture Lazarus APT's Remote-Worker Scheme Live on Camera (4 minute read)

Researchers from BCA LTD, NorthScan, and ANY.RUN captured Lazarus Group's Famous Chollima division operating live by deploying sandbox VMs disguised as developer workstations to trap operators targeting Western companies in finance, crypto, healthcare, and engineering sectors. The investigation revealed a toolkit focused on identity takeover rather than malware. Organizations should implement enhanced vetting for remote hires as attackers request full identity documents and 24/7 laptop access to infiltrate companies without deploying traditional malicious payloads.

Security Researcher Fumes at Low macOS Bug Bounty Rewards (3 minute read)

The new Apple Security Bounty payouts devalue macOS. Full Transparency, Consent, and Control (TCC) bypasses are down from $30.5k to just $5k, while other TCC categories have been reduced from $5-$10k to just $1k. This shows an admission by Apple that it can't fix everything and is prioritizing iPhone users over Mac users.

Fraudulent gambling network may actually be something more nefarious (6 minute read)

A long‑running online gambling operation targeting Indonesian users is built on hundreds of thousands of owned and hijacked domains, compromised WordPress/PHP sites, and malicious Android apps. Its cost, scale, and advanced tradecraft point to an APT-style, possibly state-aligned group that uses the gambling infrastructure as both a revenue stream and cover for stealthy access to Western government and industry networks.

⚡

Quick Links

Codacy now enforces AI code security at scale (Sponsor)

Codacy's new AI Risk Hub enforces policies against GenAI-related code risks. Catch unapproved model calls, invisible unicode injections, secrets and insecure dependencies across the codebase, instantly. Learn how to get started

India Orders Messaging Apps to Work Only With Active SIM Cards to Prevent Fraud and Misuse (3 minute read)

India's Department of Telecommunications directed messaging apps, including WhatsApp, Telegram, and Signal, to require account linking to an active SIM card and implement mandatory 6-hour web session logouts within 90 days to combat cross-border fraud, phishing, and "digital arrest" scams that exploit anonymous or migrated accounts.

Google patches 107 Android flaws, including two being actively exploited (3 minute read)

Google's December 2025 Android Security Bulletin addressed 107 vulnerabilities, including two actively exploited high-severity framework flaws (CVE-2025-48633 and CVE-2025-48572) that enable local code execution via improper input validation on Android 13-16.

Here's your worst nightmare: E-tailer can only resume partial sales 45 days after ransomware attack (4 minute read)

Japanese e-tailer Askul restored B2B online sales and warehouse systems after a ransomware attack in October disrupted ordering, shipping, and logistics for its brands and partners, forcing temporary reliance on fax-based ordering for critical customers.

Love TLDR? Tell your friends and get rewards!

Share your referral link below with friends to get free TLDR swag!

https://refer.tldr.tech/03c142dc/8

Track your referrals here.

Want to advertise in TLDR? 📰

If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us.

Want to work at TLDR? 💼

Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them!

If you have any comments or feedback, just respond to this email!

Thanks for reading,
Prasanna Gautam, Eric Fernandez & Sammy Tbeile

Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.