The Daily Index — Friday, May 23, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SENSITIVE DATA STOLEN IN WEST LOTHIAN CYBER ATTACK

West Lothian Council's education network suffered a ransomware attack by group "Interlock," affecting 143 schools and nurseries. Less than 10% of data was stolen, including personal information from lesson planning and potentially medical/social work records. The schools remain open with contingency plans.

bbc.com · 3 min

TLDR InfoSec

RESEARCHERS DUMP 2B SCRAPED DISCORD MESSAGES

Brazilian researchers scraped over 2 billion public Discord messages and published the anonymized data online. They anonymized the data by replacing usernames with pseudonyms, hashing user identifiers, and removing identifying features, yet some are concerned about its efficacy. The researchers intended to offer a message corpus for other studies. However, a Discord spokesperson noted that scraping violates the platform's terms of service.

gizmodo.com · 2 min

TLDR InfoSec

REMOTE PROMPT INJECTION IN GITLAB DUO LEADS TO SOURCE CODE THEFT

GitLab's AI assistant "Duo" contained an indirect prompt injection vulnerability that allows attackers to manipulate it through hidden prompts in code. This could enable source code theft, phishing attacks, malware distribution, and data exfiltration. Duo's deep DevSecOps integration and browser-rendered Markdown responses create an unusually wide attack surface compared to typical AI coding assistants.

legitsecurity.com · 8 min

TLDR InfoSec

UNIT 42 DEVELOPS AGENTIC AI ATTACK FRAMEWORK

Agentic AI has changed how threat actors approach systems, enabling more customized, patient, and persistent campaigns. This post identifies ways that threat actors use AI agents across every stage of the attack chain from reconnaissance and initial access to pivoting, persistence, and exfiltration. It highlights the need for defensive tooling to adopt more agentic workflows to combat this threat.

paloaltonetworks.com · 11 min

TLDR InfoSec

HOW TO USE AWS TRANSFER FAMILY AND AMAZON GUARDDUTY FOR MALWARE PROTECTION

A solution post from AWS on utilizing AWS Transfer Family and GuardDuty to scan files uploaded to an SFTP server. The workflow utilizes Lambda functions with Step Functions to move uploaded files to an S3 bucket, scan them with GuardDuty, clean infected files, and then notify the user via SNS. Terraform files are provided to deploy the solution.

aws.amazon.com · 5 min

TLDR InfoSec

“MICROSOFT HAS SIMPLY GIVEN US NO OTHER OPTION,” SIGNAL SAYS AS IT BLOCKS WINDOWS RECALL

Signal is blocking Windows 11's Recall AI feature from screenshotting its app by default, using a DRM API intended for copyrighted content. Recall captures screenshots every three seconds, potentially exposing private conversations. Signal took this step because Microsoft does not provide proper developer tools to prevent apps from being indexed by Recall.

arstechnica.com · 3 min

TLDR InfoSec

IRISH PRIVACY WATCHDOG OKS META TO TRAIN AI ON EU FOLKS' POSTS

Ireland's Data Protection Commission approved Meta's plan to use European users' public social media posts for AI training starting May 27, despite ongoing legal challenges. Privacy group noyb and German courts are fighting the decision, arguing Meta's "legitimate interest" justification violates GDPR requirements for explicit user consent.

theregister.com · 3 min

TLDR InfoSec

HACKING MY CAR, AND PROBABLY YOURS - SECURITY FLAWS IN VOLKSWAGEN'S APP

After a security researcher purchased a new Volkswagen and found that they were locked out of connecting to the app, they decided to attempt to brute-force the app and discovered further vulnerabilities after succeeding. The researcher discovered that the app leaked credentials for other services, such as Salesforce and the owner's personal details and vehicle service history, which could be accessed with only a VIN. The researcher coordinated with Volkswagen, and as of May 6, they were able to verify the fix.

loopsec.medium.com · 8 min

TLDR InfoSec

MICROSOFT SAYS LUMMA PASSWORD STEALER MALWARE FOUND ON 394,000 WINDOWS PCS

Microsoft and law enforcement seized 2,305 domains operating Lumma info-stealer malware found on 394,000 Windows PCs globally, stealing passwords and cryptocurrency wallets from infected systems.

techcrunch.com · 1 min

TLDR InfoSec

THREAT ACTOR SELLING 1.2 BILLION FACEBOOK RECORDS, BUT DETAILS DON'T ADD UP

A hacker known as ByteBreaker has purportedly offered for sale 1.2 billion Facebook user records obtained via an API, though experts have noted discrepancies in the figures and sample data, leading to skepticism.

hackread.com · 2 min

TLDR InfoSec

THIRTEEN NEW MCP SERVERS FROM CLOUDFLARE YOU CAN USE TODAY

Cloudflare has launched 13 new MCP servers that let users access tools, data, and features through natural language.

blog.cloudflare.com · 9 min