The Daily Index — Wednesday, May 21, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HAZY HAWK GANG EXPLOITS DNS MISCONFIGS TO HIJACK TRUSTED DOMAINS

A threat actor tracked as Hazy Hawk is hijacking abandoned DNS CNAME records pointing to abandoned cloud services to distribute scams, fake apps, and malicious apps. Hazy Hawk scans for domains with dangling CNAME records, then registers a new cloud resource with the same name as the abandoned CNAME, and finally creates hundreds of malicious URLS under it that redirect users to scam sites. It has hijacked subdomains from cdc[.]gov, ted[.]com, nyu[.]edu, and unicef[.]org among others.

bleepingcomputer.com · 2 min

TLDR InfoSec

VIRGIN MEDIA O2 PATCHES HOLE THAT LET CALLERS SNOOP ON YOUR COORDINATES

UK telecom Virgin Media O2 fixed a security flaw in its 4G calling that revealed users' location data to callers. Researcher Daniel Williams discovered that call signaling messages contained IMSI, IMEI, and cell ID data that could pinpoint recipients' locations within 100 square meters in urban areas.

theregister.com · 4 min

TLDR InfoSec

MALWARE ATTACK AND COUNTERATTACK

Artist Antoine Schmitt describes a phishing attack that he was a victim of which led to installing the AMOS infostealer. Schmitt was contacted by a threat actor masquerading as a very professional journalist for a magazine called Artscope Magazine. The journalist had Schmitt download and install a trojanized video app that executed an AppleScript payload to download and run the infostealer.

antoineschmitt.com · 5 min

TLDR InfoSec

RED TEAM GOLD: EXTRACTING CREDENTIALS FROM MDT SHARES

While SCCM gets security attention, Microsoft Deployment Toolkit (MDT) often exposes similar vulnerabilities. Misconfigured MDT deployment shares frequently allow unauthorized access to credentials stored in configuration files, task sequences, and scripts. These credentials can potentially grant domain admin access or control over deployed systems.

trustedsec.com · 7 min

TLDR InfoSec

INSECURE CREDENTIAL STORAGE PLAGUES MCP

Many MCP environments rely upon long-lived credentials such as API keys, but they store them incorrectly in world-readable files or get leaked via chat logs. The community-provided MCP server for Figma even stores its credentials in a world-readable and world-writeable file that attackers can use for session fixation attacks. OAuth should be implemented in MCP servers for apps that support it, and other MCP servers should consider using OS native credentials stores such as macOS Keychain and Windows' Credentials Storage API.

blog.trailofbits.com · 5 min

TLDR InfoSec

CLOUDSEK (PRODUCT LAUNCH)

CloudSEK scours the surface, dark, and deep web to identify cyber risks, data leaks, identity theft, and other threats and helps organizations assess their cybersecurity posture from the attacker's perspective.

cloudsek.com

TLDR InfoSec

NEW ATTACK CAN STEAL CRYPTOCURRENCY BY PLANTING FALSE MEMORIES IN AI CHATBOTS

Research reveals AI-powered crypto trading bots can be manipulated through prompt injection attacks on ElizaOS, an open-source framework. Attackers can plant false memories in the bot's database, causing it to redirect payments to their wallets.

arstechnica.com · 5 min

TLDR InfoSec

AWS DEFAULT IAM ROLES FOUND TO ENABLE LATERAL MOVEMENT AND CROSS-SERVICE EXPLOITATION

Researchers discovered dangerous default IAM roles in AWS services that grant excessive permissions like full S3 access. These roles enable attackers to escalate privileges and move laterally across services, potentially compromising entire AWS accounts. AWS has modified the AmazonS3FullAccess policy in response.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

KREBSONSECURITY HIT WITH NEAR-RECORD 6.3 TBPS DDOS

KrebsOnSecurity was hit by a huge 6.3 Tbps DDoS attack, likely as a test by a new botnet called Aisuru. The botnet uses hacked Internet of Things (IoT) devices and is linked to a person known as "Forky" who sells DDoS services online. Experts say releasing the botnet's code might weaken its power by creating more, smaller botnets.

krebsonsecurity.com · 7 min

TLDR InfoSec

POWERSCHOOL HACKER PLEADS GUILTY TO STUDENT DATA EXTORTION SCHEME

A 19-year-old student was convicted of hacking PowerSchool, stealing data on millions, and extorting a ransom while threatening to leak the information.

bleepingcomputer.com · 3 min

TLDR InfoSec

LOCKBIT LEAK SHOWS AFFILIATES USE PRESSURE TACTICS, RARELY GET PAID

The LockBit ransomware gang operates like a business by using affiliates for attacks, but most victims don't pay ransoms, and affiliates often fail to achieve results despite employing threats and pressure.

hackread.com · 4 min