The Daily Index — Tuesday, April 22, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

WIDESPREAD MICROSOFT ENTRA LOCKOUTS TIED TO NEW SECURITY FEATURE ROLLOUT

On Saturday, Windows admins from numerous organizations reported widespread account lockouts triggered by false positives in the rollout of Microsoft Entra ID's new MACE leaked credentials detection app. Microsoft notified users that the alarms were not caused by actual breaches but rather the invalidation of user refresh tokens that were mistakenly logged into their systems.

bleepingcomputer.com · 2 min

TLDR InfoSec

NORTH KOREAN CRYPTOCURRENCY THIEVES CAUGHT HIJACKING ‘REMOTE CONTROL' FEATURE

The non-profit Security Alliance (SEAL) and Trail of Bits have both released advisories regarding a North Korean social engineering campaign that involves masquerading as VC investors. The threat actors send victims a Calendly link to schedule a Zoom call with a PR pitch to appear on a podcast run by Aureon Capital. If a victim accepts the meeting, the attackers ask the victim to share their screen to present their work and at some point will request ‘Remote Control' while changing their display name to Zoom to make the notification mimic a system notification. The attackers use this access to deploy either infostealers or full RATs.

securityweek.com · 3 min

TLDR InfoSec

IN DEPTH WITH WINDOWS 11 RECALL—AND WHAT MICROSOFT HAS (AND HASN'T) FIXED

Microsoft's revamped Recall feature for Windows 11 Copilot+ PCs addresses previous security concerns by making it opt-in, encrypting data, and adding automated filtering for sensitive information. Despite these improvements, the feature still has filtering limitations and lingering trust issues from its botched initial rollout.

arstechnica.com · 11 min

TLDR InfoSec

IOT NETWORK SECURITY: ANALYZING DECRYPTED ZIGBEE TRAFFIC DATA

This study presents ZigBeeNet, a dataset of decrypted Zigbee IoT network traffic from a smart home with 15 devices. By extracting the network key, researchers could analyze device behavior, identify security vulnerabilities, and optimize network performance. The data addresses key challenges in analyzing encrypted Internet of Things (IoT) communications.

rackenzik.com · 12 min

TLDR InfoSec

THE COMPLEXITY OF DETECTING AMAZON S3 AND KMS RANSOMWARE

S3 and KMS ransomware attacks are challenging to detect, as many techniques can only be detected in S3 Access Logs or CloudTrail data events, which can be costly and are not enabled by default. This post provides IoCs for 11 different indicators of cloud ransomware. It also includes an advanced event selector for CloudTrail, which can target a specific bucket to enable more fine-grained logging on sensitive buckets.

fogsecurity.io · 5 min

TLDR InfoSec

KENZO SECURITY (PRODUCT LAUNCH)

Kenzo leverages a security data mesh (alerts, context, and telemetry) to power AI agents that specialize in functions such as detection, risk, investigation, and normalization.

kenzo.security

TLDR InfoSec

MICROSOFT RATED THIS BUG AS LOW EXPLOITABILITY. MISCREANTS WEAPONIZED IT IN JUST 8 DAYS

A Microsoft Windows NTLM hash-leaking vulnerability (CVE-2025-24054) was weaponized just eight days after Patch Tuesday. Initially exploiting victims through Dropbox-hosted ZIP files, the attackers, which targeted Poland and Romania, evolved to sending standalone malicious files directly.

theregister.com · 3 min

TLDR InfoSec

CISA WARNS THREAT HUNTING STAFF OF END TO GOOGLE, CENSYS CONTRACTS AS AGENCY CUTS SET IN

CISA staff members were notified that, as part of the agency's cost-cutting measures, the organization has discontinued its use of Censys and plans to cease using VirusTotal. Staff members were notified that an effort would be made to identify alternative tools to ensure minimal disruption, but no further details were provided. CISA is also investigating the termination of all threat-hunting contracts with the private sector.

nextgov.com · 2 min

TLDR InfoSec

RUNTIME CLOUD SECURITY IN 2025

CNAPP has grown to include many tools, but most application-related tools were added later and lack comprehensiveness. Modern attacks like MoveIT are hard to detect, yet Cloud Application Detection and Response (CADR) shows promise in using application context to block such attacks early. No current solution fully realizes CADR's potential, but ARMo, Sweet, Upwind, Oligo, Operant, and Raven are the closest.

pulse.latio.tech · 7 min

TLDR InfoSec

MICROSOFT PURGES DORMANT AZURE TENANTS, ROTATES KEYS TO PREVENT REPEAT NATION-STATE HACK

Microsoft has enhanced security against key theft and nation-state hacks by securing key signing keys in hardware, implementing multi-factor authentication, and purging dormant Azure tenants.

securityweek.com · 2 min

TLDR InfoSec

WORDPRESS AD-FRAUD PLUGINS GENERATED 1.4 BILLION AD REQUESTS PER DAY

Fraud detection firm HUMAN has detected a large ad fraud operation called 'Scallywag,' which utilized WordPress plugins to generate 1.4 billion fake ad requests daily.

bleepingcomputer.com · 2 min

TLDR InfoSec

BOOKING.COM PHISHING SCAM USES FAKE CAPTCHA TO INSTALL ASYNCRAT

A phishing scam resembling Booking.com deceives hotel staff with fraudulent emails to install AsyncRAT malware via a fake CAPTCHA, endangering hotel networks and customer information.

hackread.com · 3 min