The Daily Index — Thursday, May 29, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

PAKISTANIS URGED TO IMMEDIATELY CHANGE ALL PASSWORDS AFTER MASSIVE GLOBAL DATA BREACH

Pakistan's National Cyber Emergency Response Team (NCERT) issued a critical warning urging citizens to change their passwords following a massive global data breach that exposed 184M unique account credentials. NCERT has issued this warning regarding an infostealer database uncovered last week.

pakistantoday.com.pk · 2 min

TLDR InfoSec

TIFFANY CONFIRMS DATA BREACH IN SOUTH KOREA FOLLOWING DIOR INCIDENT

Tiffany & Co. confirmed a data breach affecting customers in South Korea after notifying affected customers via email. This attack involved unauthorized access to a vendor platform using customers' data. The exposed data includes names, addresses, phone numbers, email addresses, internal customer ID numbers, and purchase data.

chosun.com · 1 min

TLDR InfoSec

DATA BROKER GIANT LEXISNEXIS SAYS BREACH EXPOSED PERSONAL INFORMATION OF OVER 364,000 PEOPLE

LexisNexis Risk Solutions disclosed a data breach that affected over 364,000 people after a hacker accessed their GitHub account on December 25. Stolen data includes names, Social Security numbers, and driver's license information. The data broker, which profits from collecting consumer information for fraud detection and risk assessment, was notified of the breach on April 1.

techcrunch.com · 2 min

TLDR InfoSec

AWS HONEY TOKENS: THE GOOD, THE BAD, AND THE UGLY

AWS honey tokens are AWS Access Keys strategically placed across a system and used as a digital tripwire to determine when an attack has breached the system. The Canarytokens project by Thinkst is an open-source implementation that utilizes two Lambda functions to create a honey token system that notifies users via CloudWatch of any token usage. This project has two drawbacks: it uses an easily identifiable naming scheme for generating tokens, and it only appends a timestamp when the event is received by CloudWatch, which will have a delay that can hamper event correlation.

deceptiq.com · 10 min

TLDR InfoSec

WHY PROMPTS ARE THE NEW IOCS YOU DIDN'T SEE COMING!

As proven by the Anthropic report on the malicious uses of Claude, threat actors are increasingly using LLMs to aid in their activities. Prompts should be classified as IoCs, or LLM TTPs. Prompts can be used to construct NOVA threat hunting rules based on possible prompts for the scenarios identified in the Anthropic report.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

SECURITY LEADERS LOSE VISIBILITY AS CONSULTANTS DEPLOY SHADOW AI COPILOTS TO STAY EMPLOYED

This post dives into how consulting firms are changing and creating Shadow AI tools to keep up with demand. Consulting firms are experiencing AI-driven layoffs, cutting thousands of jobs, and fearful employees are creating unauthorized "shadow AI" apps using Python and various AI APIs to stay relevant. An estimated 74,500+ shadow AI tools now exist across consulting firms, creating security risks and governance challenges for IT departments.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

CERBY (PRODUCT LAUNCH)

Cerby automates identity workflows across over 2,000 applications and is used by organizations across sectors such as healthcare, manufacturing, online collaboration, retail, SaaS, streaming, telecommunications, and workplace training.

cerby.com

TLDR InfoSec

SOUTH KOREA WIDENS HACKING PROBE TO NAVER, KAKAO, COUPANG

Following the major breach on South Korea's SK Telecom, the South Korean government has investigated potential hacking attempts targeting major domestic platform service providers. The government had initially asked these companies to conduct voluntary self-assessments after news of the SK Telecom breach first surfaced. However, the Korea Internet & Security Agency will now take over the investigations.

chosun.com · 2 min

TLDR InfoSec

MICROSOFT ONEDRIVE FILE PICKER FLAW GRANTS APPS FULL CLOUD ACCESS — EVEN WHEN UPLOADING JUST ONE FILE

Cybersecurity researchers discovered a flaw in Microsoft's OneDrive File Picker that could allow websites to access users' entire cloud storage instead of just selected files. The issue affects apps like ChatGPT, Slack, and Trello due to overly broad OAuth permissions and vague consent screens. Microsoft acknowledged the problem but hasn't provided a fix yet.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

MICROSOFT ENTRA DESIGN LETS GUEST USERS GAIN AZURE CONTROL, RESEARCHERS SAY

BeyondTrust researchers found that guest users in Microsoft Azure can create and transfer Azure subscriptions, gaining "Owner" privileges without admin approval. Guests with billing authority can use Microsoft's transfer feature to move subscriptions, bypassing normal access controls. Microsoft states this supports multi-tenant scenarios, but enabling it by default poses significant security risks that organizations need to address with subscription policies and guest account audits.

hackread.com · 3 min

TLDR InfoSec

KAISER PERMANENTE SUFFERS NETWORK DISRUPTION, PATIENT SEVICES IMPACTED

US healthcare conglomerate Kaiser Permanente announced on Wednesday that its systems were experiencing intermittent outages that affected various patient services, including electronic health records.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

PAKISTAN ARRESTS 21 IN ‘HEARTSENDER' MALWARE SERVICE

Pakistan authorities arrested 21 people linked to “Heartsender,” a notorious spam and malware service that aided organized crime for over a decade.

krebsonsecurity.com · 3 min

TLDR InfoSec

BOTNET HACKS 9,000+ ASUS ROUTERS TO ADD PERSISTENT SSH BACKDOOR

A botnet named "AyySSHush" has compromised over 9,000 ASUS routers by exploiting CVE-2023-39780 to install persistent SSH backdoors that survive firmware updates, targeting multiple brands like Cisco, D-Link, and Linksys.

bleepingcomputer.com · 2 min