The Daily Index — Thursday, August 28, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

FIRST AI-POWERED RANSOMWARE POC SPOTTED

PromptLock, the world's first known AI-powered ransomware, uses OpenAI's gpt-oss-20b model to generate malicious scripts. It is currently only a proof-of-concept and has not been seen in active attacks. PromptLock demonstrates how AI can simplify cybercriminal operations.

theregister.com · 2 min

TLDR InfoSec

NX COMPROMISED TO STEAL WALLETS AND CREDENTIALS

The popular NX build system was compromised with malicious versions published to npm that steal cryptocurrency wallets, API keys, and credentials from at least 1,400 affected users. The malware creates repositories prefixed with "s1ngularity-repository" in victims' GitHub accounts. It uniquely leverages the Claude Code CLI or Gemini CLI to execute file system searches for sensitive data through AI prompts, making detection more challenging for traditional security tools. Users should immediately check for unauthorized repositories, update to version 21.4.1, and rotate all potentially compromised credentials, including GitHub tokens, npm keys, and SSH keys.

semgrep.dev · 4 min

TLDR InfoSec

BEWARE THE FALSE FALSE-POSITIVE: HOW TO DISTINGUISH HTTP PIPELINING FROM REQUEST SMUGGLING

Sometimes, when people are hunting for HTTP request smuggling vulnerabilities, they actually run into false positives caused by connection reuse. Some scenarios where connection reuse may be necessary for finding vulnerabilities include situations where the frontend server only reuses the upstream connection if the client connection was reused, connection-state attacks, and client-side desync attacks. James Kettle created a Custom Action for Burp Suite called `Smuggling or pipelining?` to distinguish between a genuine HTTP smuggling attack and an HTTP pipelining false-positive.

portswigger.net · 6 min

TLDR InfoSec

BEHIND THE COINBASE BREACH: BRIBERY EMERGES AS ENTERPRISE THREAT

Threat actors like The Com and Scattered Spider bribed TaskUS workers in India with up to $2,500 to steal data from 70,000 Coinbase customers, resulting in a $20 million ransom demand that Coinbase refused, offering the same as a bounty. The breach revealed a shift from phishing to insider targeting through bribery, primarily targeting customer support staff with data access. Coinbase fired 226 workers, opened a US support hub, and enhanced controls. Experts advise red-team exercises to test employee responses to bribery attempts worldwide.

csoonline.com · 8 min

TLDR InfoSec

THE ONE WHERE WE JUST STEAL THE VULNERABILITIES (CRUSHFTP CVE-2025-54309)

A flaw (CVE-2025-54309) in CrushFTP servers allows attackers to gain administrative access if certain features are disabled. Researchers used a honeypot sensor network to catch hackers exploiting this race condition in real time and confirmed that two coordinated HTTP requests could add a rogue admin account. The vulnerability impacts thousands of vulnerable servers and is being exploited in the wild, highlighting the need for organisations to patch and monitor for unusual activity.

labs.watchtowr.com · 7 min

TLDR InfoSec

REACH SECURITY (PRODUCT LAUNCH)

Reach Security employs virtual assistants in exposure management to automate drift detection, policy enforcement, and remediation. Its new ConfigIQ Drift module empowers customers to set custom deviation rules and baselines, all of which are managed centrally.

reach.security

TLDR InfoSec

NEW SNI5GECT ATTACK CRASHES PHONES AND DOWNGRADES 5G TO 4G WITHOUT ROGUE BASE STATION

Sni5Gect is a framework that can downgrade 5G connections to vulnerable 4G, crash phone modems, and bypass authentication by passively sniffing unencrypted messages between base stations and phones during the initial connection phase before authentication. The attack achieves 80% sniffing accuracy and 70-90% message injection success rates from up to 20 meters away, exploiting the window before NAS security context establishment without requiring a rogue base station. Tests successfully targeted phones from OnePlus, Samsung, Google, and Huawei. The GSMA has acknowledged the vulnerability as

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ANTHROPIC'S AUTO-CLICKING AI CHROME EXTENSION RAISES BROWSER-HIJACKING CONCERNS

Anthropic's new Claude for Chrome AI extension, now in limited preview, allows AI to control browser actions but poses significant security risks. Researchers found these AI agents are vulnerable to hidden, malicious website instructions, with attacks succeeding up to 23.6% of the time. Although new safety measures cut success rates, experts warn browser-integrated AI may be fundamentally unsafe for now.

arstechnica.com · 5 min

TLDR InfoSec

‘VIBE-HACKING' IS NOW A TOP AI THREAT

Cybercriminals are misusing agentic AI systems, such as Claude, to power new types of cyberattacks. In one major case, a single actor utilized AI to extort data from 17 organizations by crafting targeted extortion demands and executing sophisticated attacks end-to-end, highlighting how AI enables complex threats with minimal resources.

theverge.com · 2 min

TLDR InfoSec

UNPACKING THE 2025 GARTNER MARKET GUIDE FOR CNAPP

Gartner's 2025 CNAPP Market Guide highlights the industry shift from fragmented security tools to unified cloud-native application protection platforms that consolidate vulnerability management, compliance, and threat detection into single solutions.

wiz.io · 5 min

TLDR InfoSec

CITRIX FIXES CRITICAL NETSCALER RCE FLAW EXPLOITED IN ZERO-DAY ATTACKS

Citrix urgently released a security update for a critical vulnerability in NetScaler ADC and Gateway, which hackers exploited as a zero-day to execute arbitrary code remotely, risking widespread network compromise.

bleepingcomputer.com · 1 min

TLDR InfoSec

TREASURY SANCTIONS NORTH KOREA IT WORKER SCHEME FACILITATORS AND FRONT ORGANIZATIONS

The U.S. Treasury sanctioned four entities for aiding North Korea's IT worker scheme, which places workers in U.S. jobs using fraudulent documents to evade sanctions and fund weapons programs.

cyberscoop.com · 2 min