The Daily Index — Tuesday, May 27, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

DOZENS OF MALICIOUS PACKAGES ON NPM COLLECT HOST AND NETWORK DATA

Socket's threat research team discovered 60 packages on NPM that collect sensitive information about a device and send it to Discord. The malicious packages contain a post-install script that collects hostnames, internal IPs, user home directories, current working directories, usernames, and system DNS servers. Socket did not detect any additional payloads, but reported the packages for removal.

bleepingcomputer.com · 2 min

TLDR InfoSec

RESEARCHERS DROP POC FOR FORTINET CVE-2025-32756, URGING QUICK PATCHING

A serious security flaw, CVE-2025-32756, is being used by hackers to attack Fortinet products like FortiMail and FortiCamera. This bug lets attackers run harmful code without logging in by tricking the system with special data.

hackread.com · 2 min

TLDR InfoSec

HOW TO AUTOMATE INCIDENT RESPONSE FOR AMAZON EKS ON AMAZON EC2

This AWS blog post explains how to automate incident response for Amazon EKS clusters, highlighting key differences from EC2 response procedures. It covers EKS-specific challenges like pod-to-process mapping, network isolation using cordoning and network policies, and presents a customized automated forensics solution that handles acquisition, isolation, investigation, and reporting for EKS security events.

aws.amazon.com · 13 min

TLDR InfoSec

HUMANS ARE INSECURE PASSWORD GENERATORS

Neural networks can crack human-chosen passwords by learning from password distributions, making traditional "strong" passwords vulnerable. The solution: abandon human-chosen passwords entirely and use password managers with randomly generated passwords to maintain security.

outsidetheasylum.blog · 4 min

TLDR InfoSec

LEVERAGING SYSMON TO COMPLEMENT EDR AND ADDRESS EVASION TECHNIQUES

Attackers can bypass EDR solutions using techniques such as kernel hooking, syscall injections, DLL unhooking, process hollowing, and APC injection to evade detection. Sysmon event IDs 1, 7, 8, 10, 11, and 12 detect these evasion methods by monitoring process creation, DLL loads, thread injection, memory access, file creation, and registry modifications. Combining Sysmon with traditional EDR forms a layered defense, capturing endpoint activities that standard EDRs miss, particularly low-level memory manipulation and kernel-level operations.

medium.com · 5 min

TLDR InfoSec

TELEMESSAGE EXPLORER: A NEW OPEN SOURCE RESEARCH TOOL

Micah Lee, a journalist, developed and shared an open-source tool named TeleMessage Explorer to assist journalists in examining leaked data from TeleMessage. This tool processes and visualizes messages, users, and attachments from the compromised dataset. Journalists require special access to the dataset to utilize the tool and reveal significant insights.

micahflee.com · 9 min

TLDR InfoSec

BANKS WANT SEC TO RESCIND CYBERATTACK DISCLOSURE REQUIREMENTS

American banking groups, led by the ABA, want the SEC to revoke cybersecurity incident disclosure requirements, arguing they conflict with confidential reporting and hinder law enforcement efforts. The groups claim the July 2023 rule creates market confusion and interferes with incident response.

pymnts.com · 2 min

TLDR InfoSec

BREAKING RSA ENCRYPTION JUST GOT 20X EASIER FOR QUANTUM COMPUTERS

New research from Google Quantum AI indicates that RSA-2048 encryption can be cracked by a quantum computer with one million qubits in one week, needing 20 times fewer qubits than Google's 2019 estimate due to algorithmic improvements. This advancement shortens the timeline for when the current RSA encryption schemes become vulnerable, with experts predicting that quantum computers will break asymmetric cryptography by 2029. Organizations must accelerate post-quantum cryptography adoption immediately, as the multi-year migration timeline means preparation cannot wait, even if quantum attacks are still years away.

csoonline.com · 3 min

TLDR InfoSec

OPEN MPIC PROJECT DEFENDS AGAINST BGP ATTACKS ON CERTIFICATE VALIDATION

Open MPIC is an open-source tool that helps stop BGP hijacking attacks during website certificate checks. It works by checking domain ownership from many places around the world instead of just one. This makes it harder for attackers to trick systems and helps keep internet traffic secure.

networkworld.com · 4 min

TLDR InfoSec

VIBE CODING COMPANY SAYS CLAUDE 4 REDUCED SYNTAX ERRORS BY 25%

Claude 4 helped the Vibe coding tool Lovable reduce syntax errors by 25% and speed up coding by 40%.

bleepingcomputer.com · 2 min

TLDR InfoSec

YOUTUBE HAS ALREADY PAID OUT $12 BILLION TO RIGHTSHOLDERS THROUGH CONTENT ID

YouTube's automated Content ID system has paid $12 billion to rightsholders, with over 90% of copyright claims in 2024 being monetized rather than removed.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

FAKE SOFTWARE ACTIVATION VIDEOS ON TIKTOK SPREAD VIDAR, STEALC

Cybercriminals are creating deceptive AI-generated TikTok videos that mislead viewers into executing harmful PowerShell commands, leading to the installation of Vidar or StealC malware instead of legitimate software activation tips.

securityaffairs.com · 2 min