The Daily Index — Wednesday, April 23, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

MANY MALWARE CAMPAIGNS LINKED TO PROTON66 NETWORK

Summary unavailable

securityweek.com · 3 min

TLDR InfoSec

MARKS & SPENCER CONFIRMS CYBERSECURITY INCIDENT AMID ONGOING DISRUPTION

Marks & Spencer has confirmed that it is managing a cyber incident that requires operational changes to protect its customers. The retailer's stores remain open, with the website and app functioning normally. However, customers have reported issues with payment terminals and disruptions to order pickup. The company has engaged cybersecurity experts and notified authorities, but has not disclosed the nature of the attack or whether customer data was affected.

techcrunch.com · 2 min

TLDR InfoSec

UEBA - A KEY DETECTION INGREDIENT

User and Entity Behavior Analytics (UEBA) can be leveraged to incorporate additional context in detections to reduce false positives. This post enhances a YARA-L rule by adding login counts and countries from the last 30 days to detect Azure command interpreter logins after multiple failures. Other example alerts that can be enriched with UEBA are also provided.

googlecloudcommunity.com · 6 min

TLDR InfoSec

ATTACKING MY LANDLORD'S BOILER

This blog explores how something as simple as heating can be a powerful motivator to investigate new ways to connect to devices. The author needed more control over their heating and decided to integrate the existing thermostat with Home Assistant for smarter climate control while leaving no trace.

blog.videah.net · 10 min

TLDR InfoSec

JUMPING THE LINE: HOW MCP SERVERS CAN ATTACK YOU BEFORE YOU EVER USE THEM

There is a critical vulnerability in the Model Context Protocol (MCP) known as "line jumping" where malicious servers can inject prompt instructions into tool descriptions before any tools are invoked. This bypasses security controls, allowing attackers to manipulate AI models to exfiltrate code, insert vulnerabilities, or suppress security alerts.

blog.trailofbits.com · 5 min

TLDR InfoSec

HOPPER SECURITY (PRODUCT LAUNCH)

Hopper provides function-level reachability, automated asset discovery, hidden vulnerability detection, and support for complex web frameworks without the need for agents or CI changes.

hopper.security

TLDR InfoSec

WHY DEI IS KEY FOR A CYBER SAFE FUTURE

Embracing diversity at a critical moment in cybersecurity enables us to utilize all available resources to address the cyber skills gap. Diverse teams are also better equipped to address complex threats with a broader viewpoint. Common arguments against DEI, which stem from a scarcity mindset, ignore the staffing shortages that many organizations face.

csoonline.com · 5 min

TLDR InfoSec

ANNOUNCING THE AGENT2AGENT PROTOCOL

Google's Agent2Agent (A2A) protocol complements MCP and defines a protocol for agents to communicate with each other. Agents advertise their capabilities in “Agent Cards,” which allows for the completion of “tasks” and the production of “artifacts.” Notably, A2A includes built-in authorization and authentication schemes that are not present in MCP.

developers.googleblog.com · 5 min

TLDR InfoSec

OUTSIDE EXPERTS PICK UP THE SLACK ON SAFETY TESTING ON OPENAI'S NEWEST MODEL RELEASE

SplxAI researchers found that GPT-4.1 is three times more likely to go off-topic and permit intentional misuse compared to GPT-4o, with higher error rates across most safety categories, despite using recommended prompting techniques. Creating effective safety guardrails for GPT-4.1 required experts to spend 4-5 hours developing entirely new prompts, highlighting challenges for organizations that might simply port over previous guidance. This safety testing gap coincides with OpenAI's revised policies, which prioritize only "severe" harms and exclude front-end testing for risks such as generating disinformation, drawing criticism that companies are cutting corners on safety.

cyberscoop.com · 5 min

TLDR InfoSec

FAKE ALPINE QUEST MAPPING APP SPOTTED SPYING ON RUSSIAN MILITARY

A fake Alpine Quest app was designed to target Russian military Android devices, stealing sensitive data and transmitting it to remote servers, thereby posing a risk to users.

hackread.com · 2 min

TLDR InfoSec

RIPPLE'S RECOMMENDED XRP LIBRARY XRPL.JS HACKED TO STEAL WALLETS

The xrpl.js library for Ripple's XRP was compromised, allowing for the theft of wallet information and funds, necessitating an upgrade to a secure version for users.

bleepingcomputer.com · 2 min

TLDR InfoSec

LEGACY GOOGLE SERVICE ABUSED IN PHISHING ATTACKS

Summary unavailable

securityweek.com · 2 min