The Daily Index — Friday, June 13, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

PASSWORD-SPRAYING ATTACKS TARGET 80K MICROSOFT ENTRA ID ACCOUNTS

Researchers at Proofpoint are warning of a password-spraying attack targeting Microsoft Entra ID accounts by a threat actor called UNK_SneakyStrike. The researchers said the peak of the activity occurred on January 8, when 16.5K accounts were targeted in a single day, but the attacks have continued in short bursts since then. Proofpoint identified that the attackers were using the TeamFiltration pentesting framework based on a unique user agent that it uses and other artifacts.

bleepingcomputer.com · 2 min

TLDR InfoSec

'MAJOR COMPROMISE' AT NHS TEMPING ARM EXPOSED GAPING SECURITY HOLES

NHS Professionals, which provides temporary staff to NHS trusts, suffered a cyberattack in May 2024 when criminals stole its Active Directory database containing user credentials. Despite claiming no data was compromised, internal reports confirm the theft. The organization lacked proper security measures like multi-factor authentication and endpoint detection systems.

theregister.com · 5 min

TLDR InfoSec

THREAT MODELLING CLOUD SERVICE PROVIDERS IN 2025

This post examines the threats posed by government pressure on cloud service providers. The simplest attack vector is for the government to force a cloud provider to deplatform an organization, resulting in a denial of service. Another vector involves the government violating confidentiality by compelling the provider to release sensitive information. This risk can be mitigated by storing critical data on-premises or using confidential computing architecture.

chrisfarris.com · 4 min

TLDR InfoSec

MISBEHAVING MODALITIES: DETECTING TOOLS, NOT TECHNIQUES

Execution Modality is a detection engineering technique that describes how a malicious behavior is executed rather than what the malicious behavior does. Detecting Execution Modality shifts detection closer to the operating system source of truth to create a technique-agnostic detection while preserving necessary context. Given this, Kernel Event Tracing for Windows (ETW) should be considered superior to user-mode ntdll hooking.

elastic.co · 14 min

TLDR InfoSec

“LOCALHOST TRACKING” EXPLAINED. IT COULD COST META 32 BILLION

Meta developed "localhost tracking" to bypass Android's security protections and identify users despite VPNs, incognito mode, and deleted cookies. This post dives into how it works. Meta now faces potential record fines under GDPR, DSA, and DMA regulations totaling up to €32 billion (20% of its €164 billion revenue), as penalties can be applied cumulatively across different violated regulations.

zeropartydata.es · 9 min

TLDR InfoSec

HIRUNDO (PRODUCT LAUNCH)

Hirundo's Machine Unlearning platform, which also tackles jailbreaks, aims to address issues in the AI core without retraining the model while boosting the accuracy of non-generative applications.

hirundo.io

TLDR InfoSec

WITH RETAIL CYBERATTACKS ON THE RISE, CUSTOMERS FIND ORDERS BLOCKED AND SHELVES EMPTY

Recent cyberattacks on major retailers are disrupting shopping experiences. United Natural Foods' breach affected Whole Foods' supply chains, while UK retailers like Marks & Spencer and Co-op faced weeks-long outages and empty shelves. These attacks expose customer data and highlight rising ransomware threats targeting consumer-facing businesses for maximum impact.

securityweek.com · 6 min

TLDR InfoSec

ECHOLEAK ZERO-CLICK AI ATTACK IN MICROSOFT COPILOT EXPOSES COMPANY DATA

A new security vulnerability named EchoLeak enables hackers to extract company data from Microsoft 365 Copilot using just one email. This attack deceives the AI into violating its own protocols and divulging confidential information, all without requiring any action from the user. Experts caution that this highlights more significant risks associated with designing and using AI tools.

hackread.com · 3 min

TLDR InfoSec

GOOGLE CLOUD AND CLOUDFLARE HIT BY WIDESPREAD SERVICE OUTAGES

Google Cloud and Cloudflare experienced significant outages, disrupting access to various services, including websites and apps, while other platforms such as Spotify and Discord also faced connectivity problems.

bleepingcomputer.com · 2 min

TLDR InfoSec

K-POP TICKETING PLATFORM YES24 FORCED OFFLINE IN MAJOR RANSOMWARE ATTACK

Yes24, South Korea's K-pop ticketing platform with 20 million users, was attacked by ransomware on June 9th, taking the site offline for four days and disrupting the industry, causing canceled fan events and postponed ticket sales for major artists.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

PHISHING SITES POSING AS DEEPSEEK DOWNLOADS DROP A PROXY BACKDOOR

Hackers are deceiving individuals into downloading counterfeit DeepSeek software, which installs a virus named BrowserVenom that covertly alters browser settings to exfiltrate web data via a hacker-controlled proxy.

csoonline.com · 3 min