Microsoft Secure Boot Flaw👢, Claude Memory Heist🧠, Suno YouTube Scraping 🎵

Sign Up |Advertise|View Online TLDR Together With TLDR Information Security 2026-07-16 Advance your DFIR career with hands-on expertise from SANS. NSA and DoD Approved (Sponsor) AI-powered threats have put cybersecurity front-and-center for executives and government leaders alike. Organizations are looking for cyber experts who can collect, preserve, and analyze digital evidence. Break into the next tier of incident response with the NEW Digital Forensics graduate certificate from SANS Technology Institute. NSA and DoD 8140-approved, it is designed for working professionals looking to advance their cyber careers.

Join SANS DFIR curriculum lead Heather Barnhart on July 22 for an exclusive look at the new graduate program. You'll get a firsthand look from the experts who built it, plus a live Q&A. ➡️ Explore Program 🔓 Attacks & Vulnerabilities Microsoft's Secure Boot has been broken for a decade and no one noticed until now (4 minute read) Researchers at ESET found 11 old UEFI shims, some dating back to 2013, that Microsoft never revoked, allowing attackers to bypass Secure Boot on Windows and Linux with signed but vulnerable boot components. Attackers can install persistent bootkits that survive reinstalls, and only recent revocation updates and proper key management can now close these specific gaps. Chrome Sync Increasingly Abused to Stalk Unsuspecting Victims (2 minute read) Security firm Certo reported on a growing attack targeting Google Chrome users in which attackers with physical access to a victim's device sign in to the victim's account and enable Chrome Sync.

This syncs browsing history and any saved passwords to the attacker's device without notifying the victim. The firm highlights the risk of this being abused for stalking. Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail and Calendar (2 minute read) Security firm Manifold identified two flaws that could allow a malicious browser extension to take actions on a user's behalf when using the Claude in Chrome browser extension. The core issue stems from the ClaudeBleed mitigation, which restricted the extension to a set of pre-approved tasks. The researchers found that the mechanism that triggers the tasks doesn't verify whether a triggering click came from a user or an extension.

The researchers also uncovered a flaw they were unable to exploit that could allow the extension to auto-launch in “Act without asking” mode. 🧠 Strategies & Tactics The Memory Heist (9 minute read) Claude's memory and web tools can be chained to leak a user's name, employer, and hometown to a hostile site without any visible warning. A researcher built an alphabet “keyboard” on a controlled domain so the model spells out personal data letter by letter in URLs whenever it browses there. A coffee shop façade plus user‑agent routing hid the attack from humans while targeting Claude specifically. After disclosure, Anthropic restricted link‑following in web_fetch, but similar memory‑driven exfiltration risks remain for other connected data sources.

Apps Can Now Impersonate Human Access to AWS via IAM Identity Center (4 minute read) AWS IAM Identity Center launched the ability for server-side applications to assume roles on behalf of users. However, the feature is still somewhat immature and has very limited CloudTrail logging. Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer (5 minute read) Since June 26, a likely Russian-speaking actor has operated 292+ GitHub repositories impersonating brands, including a fake Arctic Wolf page. Victims are redirected via *. github.

io to a controlled domain like targetroyena[. ]com, where a spoofed secure download page serves a ZIP with a legitimate WinGUP updater that DLL side-loads a trojanized libcurl. dll. It decodes and reflectively executes an in-memory BoryptGrab infostealer, targeting browsers, messaging apps, crypto wallets, and Windows Credential Manager, then exfiltrates data via raw Winsock POST to a C2 server (Proton66, Russia). BinDiff shows 94% function overlap with BoryptGrab, suggesting the same operator.

Defenders should enforce verified downloads, block egress to 193. 143/24, hunt for unsigned libcurl. dll, monitor browser/Steam process injection, and treat uncleaned staging folders as indicators for credential and wallet rotation. 🧑‍💻 Launches & Tools These skills will define the next generation of DFIR (Sponsor) Heather Barnhart is the DFIR expert that analyzed bin Laden's seized digital media. Join her on July 22 for a discussion on emerging digital forensics trends, the skills employers increasingly seek in DFIR professionals, and how you can prepare for what's next.

➡️ Register for Free Oak (Product Launch) Oak provides a unified identity control plane for enterprises that manages humans, machines, and agents across apps. It maps access to actual usage and automatically removes unused permissions in real time. AppVerifierBG (GitHub Repo) This fork builds upon the original AppVerifier, retaining all of its core functionality while introducing additional features. It enables the verification of installed applications against shared signature hashes, an internal database, or a user-created database. Sighthound (GitHub Repo) Sighthound is a tree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis.

🎁 Miscellaneous Hack suggests AI music generator Suno scraped YouTube for training data (2 minute read) A hacker used a supply chain attack in November to access a Suno employee's credentials and Suno's source code, and found that Suno scraped large volumes of audio from YouTube Music, Deezer, Genius, stock libraries, and podcast feeds for model training.