The Daily Index — Monday, March 3, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NEARLY 12K API KEYS AND PASSWORDS FOUND IN AI TRAINING DATA

Researchers at Truffle Security scanned 400TB of data from the Common Crawl December 2024 archive. Common Crawl is a non-profit that regularly publishes massive crawled web data datasets frequently used to train LLMs. The researchers identified 219 distinct secret types, including valid AWS, MailChimp, and WalkScore API keys.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW TGTOXIC BANKING TROJAN VARIANT EVOLVES WITH ANTI-ANALYSIS UPGRADES

TgToxic is an Android malware first documented in early 2023 as a banking Trojan capable of stealing credentials and funds from crypto wallets and finance apps. Later analysis identified that it has evolved with new anti-analysis and C2 domain generation capabilities. Google has stated that it did not detect TgToxic in any apps in the Google Play store.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

WALLBLEED: A MEMORY DISCLOSURE VULNERABILITY IN THE GREAT FIREWALL OF CHINA (1 HOUR READ)

Wallbleed was a vulnerability in China's Great Firewall that leaked memory during DNS query censorship, revealing internal operations. It was partially patched in November 2023 and fully resolved by March 2024. This report outlines how researchers discovered the vulnerability and the ethics of exploiting and disclosing such vulnerabilities.

gfw.report

TLDR InfoSec

SUBSTACK DOMAIN TAKEOVER

Substack allows writers to use custom domains for their blogs by creating a CNAME record pointing to Substack's servers. However, Substack does not authenticate that a customer owns a domain at this step. Attackers can potentially hijack inactive custom domains previously connected to Substack blogs, even though Substack charges a $50 fee for the feature.

blog.nietaanraken.nl · 4 min

TLDR InfoSec

DREADNODE (PRODUCT LAUNCH)

Dreadnode's platform offers a simulated environment where AI agents can be trained and tested in realistic cybersecurity attack scenarios. It essentially serves as a practice sandbox for offensive security skills.

dreadnode.io

TLDR InfoSec

HOW HACKERS CAPTURE YOUR SOLAR PANELS AND CAUSE GRID HAVOC

German broadcaster DW reports that hackers could access millions of solar panels responsible for hundreds of GW of electricity output via remote cloud-based services. Although the vendors have denied detecting any malicious access, attackers exploiting such vulnerabilities could lead to widespread blackouts in the European power grid. The EU is introducing regulations to enhance cybersecurity and protect critical infrastructure from cyberattacks.

dw.com · 4 min

TLDR InfoSec

DISRUPTING A GLOBAL CYBERCRIME NETWORK ABUSING GENERATIVE AI

Microsoft has named four individuals against whom it is taking legal action for abusing Azure OpenAI services to create harmful content. Members of the Storm-2139 APT group exploited exposed customer credentials scraped from public sources to unlawfully access accounts with certain generative AI services. Upon publication of the report, the cybercriminals doxed Microsoft's counsel of record, and some suspected cybercriminals sent emails to the counsel.

blogs.microsoft.com · 4 min

TLDR InfoSec

THE RISE OF QR PHISHING: HOW SCAMMERS EXPLOIT QR CODES AND HOW TO STAY SAFE

QR Phishing, or "quishing," is rising as scammers use these to steal personal information, install malware, or redirect to malicious websites. Criminals trick unsuspecting users by placing fake QR codes over legitimate ones or sending malicious QR codes via email or text. To stay safe, users should verify QR codes in public places, preview URLs before scanning, and be cautious with unsolicited QR codes.

hackread.com · 3 min

TLDR InfoSec

META FIRED 20 EMPLOYEES FOR LEAKING INFORMATION, MORE FIRINGS EXPECTED

Meta fired 20 employees for leaking confidential information - more firings are expected as the company increases efforts to identify leakers.

securityaffairs.com · 1 min

TLDR InfoSec

SOLARWINDS CISO SAYS SECURITY EXECS ARE ‘NERVOUS' ABOUT INDIVIDUAL LIABILITY FOR DATA BREACHES

SolarWinds' CISO Tim Brown says CISOs are worried about being held personally responsible for data breaches.

cyberscoop.com · 4 min

TLDR InfoSec

U.S. SEIZED $31 MILLION STOLEN IN 2021 URANIUM FINANCE HACK

With the help of TRM Labs, US authorities recovered $31 million in cryptocurrency stolen from Uranium Finance DeFi protocol in 2021 cyberattacks.

bleepingcomputer.com · 2 min