The Daily Index — Wednesday, July 23, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

HONG KONG INVESTIGATES LOUIS VUITTON DATA LEAK AFFECTING 419K CUSTOMERS

Hong Kong's privacy watchdog announced that it is investigating a data leak affecting 419,000 customers of the Hong Kong branch of Louis Vuitton. The leaked data may have included names, phone numbers, passport details, addresses, email addresses, shopping history, and product preferences, but did not include payment information.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

COYOTE TROJAN FIRST TO USE MICROSOFT UI AUTOMATION IN BANK ATTACKS

The Coyote banking Trojan is notable for being the first malware to utilize Microsoft's UI Automation (UIA) framework, transitioning from a proof-of-concept to actively targeting Brazilian banking and cryptocurrency users. It exploits UIA to steal credentials from browsers and can manipulate UI elements, such as address bars, to redirect victims to phishing sites, thereby complicating detection efforts. Akamai recommends monitoring for the presence of UIAutomationCore.dll in unknown processes and scanning for interactions with UIA named pipes as early indicators of infection.

hackread.com · 3 min

TLDR InfoSec

THE CYBER DECEPTION MATURITY MODEL: WHERE DOES YOUR ORGANIZATION STAND?

This post divides cyber deception into 5 levels: pre-deception, where an organization does not employ cyber deception; experimental, where an organization deploys simple deception that only succeeds at catching automated scanners; operational, where an organization can catch human threats; strategic, where an organization's deception resources mimic authentic resources and mimic high-value targets; and optimized, where deception goes beyond detection and shapes adversary behavior. Each level includes key metrics to track as well as steps to advance to the next level.

deceptiq.com · 19 min

TLDR InfoSec

CLOUD LOGGING FOR SECURITY AND BEYOND

This is a guide on cloud logging best practices for AWS, Azure, and Google Cloud. It emphasizes the importance of balancing security, compliance, and cost when selecting logging strategies. The guide distinguishes between control plane logging (default for management) and data plane logging (which requires manual activation for service activities), categorizing logs into audit, compute, network, secrets, storage, database, and Kubernetes types. Organizations should prioritize logging based on business, regulatory, and security needs, avoiding the costly "log everything" approach.

unit42.paloaltonetworks.com · 14 min

TLDR InfoSec

COMMON MISTAKES IN USING CVSS

Don't rely solely on CVSS scores for prioritizing vulnerabilities, as only 17% of critical ones are exploited, while attackers target lower scores. Organizations should implement Risk-Based Vulnerability Management (RBVM) that includes threat intelligence, asset importance, business context, and metrics like EPSS. Research shows EPSS prioritization targets 3% of vulnerabilities with 65% effectiveness, unlike CVSS, which requires 57% coverage for similar results, with only 4% effectiveness.

kaspersky.com · 6 min

TLDR InfoSec

control. Get an exclusive preview and join the waitlist.

Summary unavailable

hubs.la

TLDR InfoSec

FLOWABLE'S SUMMER 2025 UPDATE INTRODUCES GROUNDBREAKING AGENTIC AI CAPABILITIES

Flowable released version 2025.1 on July 22 with AI capabilities, including four agent types: Utility, Document, Knowledge, and Orchestrator. It now supports integrations with AWS Bedrock, Azure Foundry, and Salesforce Agentforce, and features dynamic autonomy for agents switching between AI help and deterministic workflows based on task complexity. The enterprise 'AI button' enables real-time summaries, automated customer communication, and autonomous task completion.

hackread.com · 3 min

TLDR InfoSec

RING DENIES BREACH AFTER USERS REPORT SUSPICIOUS LOGINS

Many Ring users reported suspicious login activity on their devices on May 28, raising concerns of a hack. Last week, Ring clarified on its Facebook page that a bug caused all previous logins to appear as if they occurred on May 28. However, some users remain doubtful, noting login attempts from unfamiliar countries and devices.

bleepingcomputer.com · 2 min

TLDR InfoSec

WINDOWS 11 GETS NEW BLACK SCREEN OF DEATH, AUTO RECOVERY TOOL

As part of Microsoft's Windows Resiliency Effort, it updated the Blue Screen of Death (BSOD) to a black screen showing only the stop code and fault info for easier troubleshooting. The company also announced a Quick Machine Recovery feature that checks Windows Update for fixes when a boot issue occurs.

bleepingcomputer.com · 2 min

TLDR InfoSec

CONTRACT LAPSE LEAVES CRITICAL INFRASTRUCTURE CYBERSECURITY SENSOR DATA UNANALYZED AT NATIONAL LAB

Critical infrastructure cybersecurity sensor data remains unanalyzed after the DHS contract with Lawrence Livermore National Laboratory ended this weekend, leaving the CyberSentry program unfunded. The program monitors threats in operational technology networks at power plants and factories, but the lab can't process the data without government funds. This occurs amid broader Trump administration budget cuts to CISA and expired threat hunting contracts.

cyberscoop.com · 2 min

TLDR InfoSec

MICROSOFT SHAREPOINT TOOLSHELL ATTACKS LINKED TO CHINESE HACKERS

Chinese government-linked hackers exploited a Microsoft SharePoint zero-day vulnerability chain dubbed "ToolShell" to breach at least 54 organizations worldwide, prompting Microsoft to release emergency patches and CISA to add the flaw to its Known Exploited Vulnerability catalog.

bleepingcomputer.com · 2 min

TLDR InfoSec

DELL SAYS DATA LEAKED BY HACKERS IS FAKE

Dell got hit by the WorldLeaks ransomware group and leaked 1.3TB of data, but it claims it's mostly fake demo data from an isolated testing environment, not real customer info.

securityweek.com · 2 min

TLDR InfoSec

CISCO: MAXIMUM-SEVERITY ISE RCE FLAWS NOW EXPLOITED IN ATTACKS

Three critical unauthenticated RCE vulnerabilities in Cisco ISE (CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337) are now being actively exploited in the wild, requiring immediate patching to ISE 3.3 Patch 7 or 3.4 Patch 2.

bleepingcomputer.com · 2 min