The Daily Index — Tuesday, April 8, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

EUROPCAR GITLAB BREACH EXPOSES DATA OF UP TO 200K CUSTOMERS

A hacker breached the GitLab repos of the Europcar car rental company and stole source code for the mobile apps and personal information belonging to up to 200K customers. The threat actor discovered 9,000 SQL files, which include customers' names and email addresses, and 269 .env files. Europcar has confirmed the breach but has not provided more information.

bleepingcomputer.com · 2 min

TLDR InfoSec

OUTLAW LINUX MALWARE: PERSISTENT, UNSOPHISTICATED, AND SURPRISINGLY EFFECTIVE

Outlaw infects systems through SSH brute-force attacks, establishes persistence via cron jobs and SSH key manipulation, and deploys a three-part payload consisting of XMRIG for cryptocurrency mining, STEALTH SHELLBOT for remote control, and BLITZ for further propagation. Despite its unsophisticated nature, Outlaw remains effective because it leverages stolen system resources for mining profit while simultaneously expanding its botnet through continuous SSH brute-forcing of nearby systems.

elastic.co · 33 min

TLDR InfoSec

THIS SNEAKY ANDROID SPYWARE NEEDS A PASSWORD TO UNINSTALL. HERE'S HOW TO REMOVE IT WITHOUT ONE

Techcrunch has identified a new stalkerware app that requires a password to uninstall it. The app works by requiring the person who installs it to enable a built-in Android feature that allows for overlaying content, which allows the app to display the password prompt, which requires a password set by the person who installs it to dismiss whenever the user tries to uninstall it. Users can uninstall the app without a password by booting into safe mode. The app masquerades in the installed app list as a default Android app and also installs a device admin profile.

techcrunch.com · 6 min

TLDR InfoSec

WINDOWS REMOTE DESKTOP PROTOCOL: REMOTE TO ROGUE

Summary unavailable

cloud.google.com · 18 min

TLDR InfoSec

HUNTING PANDAS

The post dives into Mustang Panda, which is targeting various organizations worldwide. By analyzing indicators of compromise, potential overlaps between Red Delta, APT41, and Mustang Panda were identified. The investigation led to uncovering additional infrastructure and operational connections between the threat actors.

intelinsights.substack.com · 3 min

TLDR InfoSec

have. Read more on the Prelude blog

Summary unavailable

preludesecurity.com

TLDR InfoSec

WHAT IS CODE TO CLOUD AND DOES IT MATTER?

Code to cloud promises to reduce the cognitive load of vulnerability management by providing the exact lines of code that need to change to remediate a finding. It can also aid security teams by helping them find the right person for a fix, understand how widespread a problem is, and aid in prioritization. Code to cloud can be achieved via customers manually linking source repos to container images, container tagging, or the provider ingesting all the data a customer provides and using data modeling to identify relationships.

pulse.latio.tech · 8 min

TLDR InfoSec

SPYCLOUD RESEARCH SHOWS THAT ENDPOINT DETECTION AND ANTIVIRUS SOLUTIONS MISS TWO-THIRDS (66%) OF MALWARE INFECTIONS

SpyCloud's research shows that 66% of malware infections happen on devices with endpoint security. Although EDR tools have advanced, modern malware evades detection. SpyCloud integrates with EDR products to close the detection gap and defend against cyber threats.

hackread.com · 3 min

TLDR InfoSec

XANTHOROX AI SURFACES ON DARK WEB AS FULL SPECTRUM HACKING ASSISTANT

Xanthorox AI is a new hacking tool circulating on the dark web that offers advanced capabilities for cyber operations. It uses custom-built language models and various modules for automated attacks. Experts recommend using AI-powered security solutions to detect and prevent such threats effectively.

hackread.com · 3 min

TLDR InfoSec

MALICIOUS VSCODE EXTENSIONS INFECT WINDOWS WITH CRYPTOMINERS

Nine harmful VSCode extensions in Microsoft's marketplace secretly installed cryptominers, amassing over 300,000 installs and misleading users since April 4.

bleepingcomputer.com · 2 min

TLDR InfoSec

BROTHERS BEHIND RYDOX DARK WEB MARKET EXTRADITED TO US

The US extradited fugitives from nine countries for crimes like running dark web markets and drug trafficking, including the Rydox marketplace brothers.

hackread.com · 3 min

TLDR InfoSec

A MEMBER OF THE SCATTERED SPIDER CYBERCRIME GROUP PLEADS GUILTY

Noah Urban, a 20-year-old man, pleaded guilty to cybercrime charges for stealing cryptocurrency and personal information as part of the Scattered Spider group, which hacked organizations like Twilio and LastPass.

securityaffairs.com · 2 min