Week of January 27, 2025

2025-01-27 — 2025-02-02 · 2 PUBLIC EVENTS · GENERAL / NON-PERSONALIZED

In the week of January 27, 2025, ColdRecon logged 2 public endpoint-security events from open-source reporting — 2 research pocs. Vendors in the record this week: Google.

The Week's Public Record

Events

2025-02-02

research poc

Infostealers Bypass Chrome App-Bound Encryption Using Remote Debugging APIChrome App-Bound Encryption Bypass via Remote Debugging

Multiple infostealer families have bypassed Chrome's App-Bound Encryption, a feature designed to protect cookies on Windows, by leveraging Chrome's remote debugging API. This technique allows malware to exfiltrate unencrypted cookies without noisy process hollowing or memory scraping. The bypass was observed in the wild less than 45 days after the feature's release.

Google ↗ spycloud.com (2025-02-02)

2025-02-02

research poc

Universal Android Security Bypass Suite Released on GitHubUniversal Android Security Bypass Suite

A new Frida script called 'Universal Android Security Bypass Suite' was published on GitHub, providing out-of-the-box bypasses for root detection, SSL pinning, and memory protections on Android. It is designed for security research and penetration testing, working across Android versions 5.0 to 14.0+ without app-specific modifications. The tool highlights limitations against hardware-backed security and custom implementations.

↗ github.com (2025-02-02)

Every event in this brief is a record in ColdRecon's canonical set, drawn from public open-source reporting and linked to its source. This is the general, non-personalized signal — published 7 days after the fact. The live daily brief, written for your deals, is for cleared officers.

This is last week, public. Get this morning's, written for you.

The live ColdRecon brief lands at 0600 daily — the same signal, filtered to your competitors and framed for your deals. Request clearance and tomorrow's is yours.

Request Clearance →