The Daily Index — Thursday, July 24, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

3.5M RECORDS EXPOSED IN AUSTRALIAN GLOBAL FASHION BRAND DATA BREACH

Jeremiah Fowler discovered an unprotected, unencrypted, and publicly exposed database containing over 3.5 million PDFs belonging to the Australian fashion brand SABO. The files contain PII, including names, physical addresses, email addresses, phone numbers, and other personal information corresponding to retail and corporate customers. Some of the PDFs contain multiple orders, suggesting that the number of affected individuals may be higher than 3.5 million.

vpnmentor.com · 4 min

TLDR InfoSec

US NUCLEAR WEAPONS AGENCY REPORTEDLY BREACHED IN MICROSOFT SHAREPOINT ATTACKS

Chinese government-affiliated hackers exploited a Microsoft SharePoint vulnerability affecting 50+ organizations, including the National Nuclear Security Administration. The zero-day flaw enables remote access to on-premises SharePoint versions, allowing attackers to steal documents and sensitive information.

theverge.com · 2 min

TLDR InfoSec

MYTHIC C2 WITH EARLYBIRD INJECTION AND DEFENDER EVASION

This post walks through a demo setup of the Mythic C2 framework that uses redirectors to disguise itself as legitimate WordPress traffic. The redirectors use a legitimately registered domain and certificates and use Nginx to offer WordPress as a front end, as well as an api subdomain that forwards traffic to the C2 server and a dl subdomain that disguises payloads as font files. The setup also utilizes the EarlyBird Injection technique, where the loader executes code before the target process is fully initialized, both in its loader and through string obfuscation to employ evasion during installation. The post concludes with a discussion of further enhancements, such as ensuring domain age before weaponizing it and detection mechanisms for this setup.

xbz0n.sh · 10 min

TLDR InfoSec

WHAT TO KNOW ABOUT TOOLSHELL, THE SHAREPOINT THREAT UNDER MASS EXPLOITATION

A critical SharePoint vulnerability (CVE-2025-53770), dubbed "ToolShell," is being mass-exploited by Chinese government groups, affecting over 400 systems, including the US National Nuclear Security Administration. The flaw allows unauthenticated remote code execution, credential theft, and data exfiltration. Microsoft patched it on Saturday, but it is being exploited on any company that has not updated their SharePoint.

arstechnica.com · 4 min

TLDR InfoSec

CHOOSING THE VPN THAT'S RIGHT FOR YOU

VPNs mainly serve two purposes: bypassing internet censorship and remote access to corporate networks, despite being marketed as security tools. They hide your IP and encrypt traffic, but don't ensure anonymity (Tor is better), don't fully secure public Wi-Fi (most traffic is HTTPS), and shift data from your ISP to the VPN provider. When choosing one, review the provider's business model, data practices, encryption protocols (prefer OpenVPN or WireGuard), and verify claims through third-party audits.

ssd.eff.org · 8 min

TLDR InfoSec

LUMO AI (PRODUCT LAUNCH)

Proton's Lumo AI uses open-source models, zero-access encryption, and doesn't train on user data, emphasizing privacy-focused development.

proton.me

TLDR InfoSec

CLOROX ACCUSES IT PROVIDER IN LAWSUIT OF GIVING HACKERS EMPLOYEE PASSWORDS

Clorox sued Cognizant over a 2023 cyberattack by Scattered Spider hackers, claiming that Cognizant staff had given away employee passwords when asked by phone without proper verification. The breach caused $380 million in damages. Cognizant disputes responsibility, saying it only provided limited help desk services, not cybersecurity management.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

UK TO BAN RANSOMWARE PAYMENTS BY PUBLIC SECTOR ORGANIZATIONS

The UK government proposes banning public sector organizations (NHS, councils, and schools) and critical infrastructure from paying ransomware criminals, aiming to make them less attractive targets. The Cyber Resilience Bill will impose daily fines of £100,000 for security failures. Private companies must still report their intentions to pay ransoms to authorities.

theregister.com · 3 min

TLDR InfoSec

CHINA INTRODUCES NATIONAL CYBER ID AMID PRIVACY CONCERNS

China has launched a voluntary national online ID service aimed at centralizing citizen identity verification and reducing the collection of private company data. While officials claim it enhances privacy, critics argue that it strengthens government surveillance capabilities, as authorities can revoke digital certificates and effectively erase users' entire online presence.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

GENEA IVF CONFIRMS SENSITIVE PATIENT HEALTH INFORMATION ON DARK WEB

Australian IVF giant Genea has confirmed that, following a February data breach, stolen patient health information was posted on the dark web.

abc.net.au · 2 min

TLDR InfoSec

BRAVE BLOCKS WINDOWS RECALL FROM SCREENSHOTTING YOUR BROWSING ACTIVITY

Brave Browser will block Windows Recall from screenshotting browsing activity by default using Microsoft's SetInputScope API with the IS_PRIVATE scope, joining Signal in proactively preventing the controversial feature from capturing sensitive user data.

bleepingcomputer.com · 2 min

TLDR InfoSec

TRUMP AI PLAN PUSHES CRITICAL INFRASTRUCTURE TO USE AI FOR CYBER DEFENSE

Trump's new AI Action Plan encourages critical infrastructure to adopt AI for cyber defense while acknowledging the vulnerabilities of AI systems, but offers no new funding and adopts a deregulatory approach that critics say prioritizes innovation over safety.

cyberscoop.com · 5 min