The Daily Index — Wednesday, May 28, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

ADIDAS CONFIRMS CRIMINALS STOLE DATA FROM CUSTOMER SERVICE PROVIDER

Adidas disclosed that an unauthorized person stole customer contact information from a third-party customer service provider. The data included names and email addresses of customers who previously contacted support, but excluded passwords and payment information. The company is notifying affected customers and authorities while investigating the breach.

theregister.com · 3 min

TLDR InfoSec

GITHUB MCP EXPLOITED: ACCESSING PRIVATE REPOSITORIES VIA MCP

A critical vulnerability in GitHub's MCP integration allows attackers to use prompt injection in public issues to trick coding agents (e.g., Claude) into leaking data from private repositories. This exploit, termed a "toxic agent flow," does not rely on compromised tools but exploits trusted agents' interactions with untrusted external content. The issue requires system-level mitigations—like runtime guardrails and continuous MCP traffic monitoring—since model-level alignment is insufficient to prevent such context-driven attacks.

invariantlabs.ai · 6 min

TLDR InfoSec

THREAT SPOTLIGHT: HIJACKED ROUTERS AND FAKE SEARCHES FUELING PAYROLL HEIST

ReliaQuest has discovered a campaign that uses SEO poisoning to target employee mobile devices for payroll fraud. Attackers create fake company login pages that appear in search results, steal credentials when employees access them, and then redirect paychecks to attacker-controlled accounts. This post dives into the campaign, the attacks, and how they keep evading detection.

reliaquest.com · 7 min

TLDR InfoSec

REDISRAIDER: WEAPONIZING MISCONFIGURED REDIS TO MINE CRYPTOCURRENCY AT SCALE

RedisRaider is a new Linux malware campaign that scans the internet for public Redis servers running on Linux and then abuses the Redis SET command to inject a cron job. The cron job downloads the RedisRaider binary to /tmp/mysql, makes it executable, and then executes it using nohup. The RedisRaider binary is a heavily obfuscated dropper for a modified version of the XMRig cryptominer that uses a custom packer to further complicate reversing and forensic analysis.

securitylabs.datadoghq.com · 10 min

TLDR InfoSec

MASTER TAILSCALE ACLS FOR YOUR ENTERPRISE ENVIRONMENT: A STEP-BY-STEP GUIDE

Tailscale can use ACLs to provide zero-trust network access to internal resources. This guide presents and walks through a sample Enterprise ACL and then deep-dives into how ACLs can be written and modified for some common use cases, such as RBAC, secure device access, hybrid infrastructure, and SSH auditing.

vulnerx.com · 7 min

TLDR InfoSec

TOP 5 TOOLS FOR ACTIVE DIRECTORY PENETRATION TESTING

The top five tools for hacking Active Directory domains are PingCastle, ldapdomaindump, BloodHound & PlumHound, Responder, and HashCat.

linkedin.com · 3 min

TLDR InfoSec

DUTCH INTELLIGENCE AGENCIES SAY RUSSIAN HACKERS STOLE POLICE DATA IN CYBERATTACK

"Laundry Bear," a Russian state-backed hacker group, breached Dutch police systems in September, accessing all officers' contact details. The group targets Western nations supporting Ukraine, seeking military equipment information.

securityweek.com · 3 min

TLDR InfoSec

FIREFOX SECURITY RESPONSE TO PWN2OWN 2025

Two new content-process exploits were demonstrated against Firefox at Pwn2Own 2025, but neither bypassed the browser's sandbox. Mozilla released patched versions the same day and urged users to update immediately. These results reflect recent architectural hardening and reinforce Firefox's security resilience.

blog.mozilla.org · 3 min

TLDR InfoSec

THREAT OF TCC BYPASSES ON MACOS

macOS's TCC framework blocks unauthorized access to sensitive data, even for malware with root access, but many third-party apps expose vulnerabilities that bypass these protections. A flaw in Cursor.app shows how malware can inherit TCC permissions and access protected files without user knowledge. Developers and vendors often ignore these issues, despite their real threat to user privacy and system integrity.

afine.com · 17 min

TLDR InfoSec

ZSCALER TO ACQUIRE MDR SPECIALIST RED CANARY

Zscaler announced its intention to acquire Red Canary, known for Managed Detection and Response (MDR) services, to enhance its integration of artificial intelligence, automation, and human expertise into security.

securityweek.com · 2 min

TLDR InfoSec

CLOUDFLARE BOSS SENDS STARK WARNING OVER LALIGA ANTI-PIRACY CAMPAIGN

Cloudflare CEO Matthew Prince warned that LaLiga's broad anti-piracy IP blocks, which target Cloudflare infrastructure, are causing significant collateral damage by disrupting access to critical and legitimate websites, including emergency services in Spain.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

IRANIAN PLEADS GUILTY TO ROBBINHOOD RANSOMWARE ATTACKS, FACES 30 YEARS

An Iranian man has confessed to his involvement in the Robbinhood ransomware attacks that targeted U.S. cities and organizations from 2019 to 2024, stealing data and demanding Bitcoin ransoms.

bleepingcomputer.com · 2 min