The Daily Index — Monday, September 8, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

DARK WEB VENDOR CLAIMS BREACH OF ANUVU AWS EMPLOYEE DATA

A dark web vendor claims to have breached Anuvu (formerly Global Eagle), a major satellite provider for airlines and cruise lines, allegedly obtaining over 70 admin credentials for internal services like AWS and Postgres databases. The stolen data includes sensitive employee info, customer databases, and Starlink contract details, potentially exposing users of in-flight connectivity. Researchers verified parts of the data appear legitimate and warned that the breach could enable targeted phishing and credential stuffing attacks against airline partners like Air France, Delta, Southwest, and British Airways.

leakd.com · 3 min

TLDR InfoSec

ICLOUD CALENDAR ABUSED TO SEND PHISHING EMAILS FROM APPLE'S SERVERS

A new phishing campaign that leverages iCloud Calendar invites was reported to BleepingComputer. The phishing email notifies the user that their PayPal account is being charged and requests the user to call a given phone number. The notable thing is that the email is sent from Apple's servers because the attackers add the user's email to an Office 365 group, which they invite to the event, and include the phishing text in the Notes field.

bleepingcomputer.com · 2 min

TLDR InfoSec

WHAT FRAMING SECURITY ALERTS AS A BINARY TRUE OR FALSE POSITIVE IS COSTING YOU

The true/false positive binaries only capture whether an alert accurately alerts on a signal, but not if it is impactful. The author proposes adding a layer of intent or disposition to alert metrics to measure whether the alert had an actual business impact. This leads to a refined classification with the steps: True Positive - Malicious, True Positive - Suspicious, True Positive - No Business Impact, and False Positive.

magonia.io · 6 min

TLDR InfoSec

SECURING MODEL CONTEXT PROTOCOL (MCP) WITH TELEPORT AND AWS

MCPs pose security issues like poor auditing, insecure credentials, and excessive privileges. Teleport offers a Unified Identity Framework, giving each MCP a unique cryptographic identity with dynamic credentials, fine-grained access, and thorough logging. This post covers deploying and securing MCP access to a database.

goteleport.com · 10 min

TLDR InfoSec

DETECTING ADCS PRIVILEGE ESCALATION

Active Directory Certificate Service (ADCS) is used in Active Directory environments to manage certificates for systems, users, applications, and more, and provides a variety of potential privilege escalation vectors. ADCS logging is not enabled by default and must be enabled via certsrv. This post demonstrates how to create and test KQL alerts for a common privilege escalation technique.

blackhillsinfosec.com · 4 min

TLDR InfoSec

VIRUSTOTAL FINDS HIDDEN MALWARE PHISHING CAMPAIGN IN SVG FILES

VirusTotal discovered a phishing campaign using SVG files with embedded JavaScript to impersonate Colombia's judicial system, delivering malware through fake government portals. The campaign used 44 unique SVG files that evaded all antivirus engines but were detected by VirusTotal's AI Code Insight feature, which also uncovered 523 additional samples dating back to August. The malicious SVGs create convincing fake judicial portals with progress bars and security tokens, while secretly downloading ZIP archives containing malware to victims' systems.

bleepingcomputer.com · 4 min

TLDR InfoSec

GOOGLE FINED $3.5 BILLION FOR BREACHING EU'S ANTITRUST LAWS

The EU fined Google €2.95 billion for abusing its dominant position in advertising tech by favoring its AdX exchange since 2014. This is Google's fourth major EU antitrust penalty, totaling nearly €10 billion over ten years. Google has 60 days to suggest compliance or risk divestment. It plans to appeal.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

CZECH CYBER AGENCY NUKIB FLAGS CHINESE ESPIONAGE RISKS TO CRITICAL INFRASTRUCTURE

Czech cybersecurity agency NUKIB warned of increasing risks from Chinese-linked technologies in vital sectors such as energy, healthcare, transport, and government, citing APT31's attacks on Czech ministries. The agency pointed out risks from Chinese devices like IP cameras, PV inverters, smart meters, phones, cars, and AI models that can send data to or be controlled remotely from China. NUKIB stressed that Chinese laws give authorities broad powers to access data and force private companies to cooperate in state-led spying, urging Czech organizations to implement proper protections against these cyber threats.

securityaffairs.com · 3 min

TLDR InfoSec

WAYMO SAYS IT WON'T SURRENDER CAMERA FOOTAGE WITHOUT A FIGHT

Waymo co-CEO Tekedra Mawakana announced the company will "challenge, limit, or reject" law enforcement requests for robotaxi camera footage that lack valid legal processes like warrants, as each vehicle's 29 cameras create privacy concerns about potential surveillance misuse.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

BRIDGESTONE CONFIRMS CYBERATTACK DISRUPTING NORTH AMERICAN PLANTS

Tire manufacturing giant Bridgestone confirmed a cyberattack disrupted operations at multiple North American facilities, including plants in South Carolina and Quebec.

hackread.com · 3 min

TLDR InfoSec

QANTAS CUTS EXECUTIVE BONUSES BY 15% AFTER A JULY DATA BREACH

Australian airline Qantas cut executive bonuses by 15% after a July cyberattack linked to Scattered Spider compromised the data of 5.7 million customers through a third-party call center platform.

securityaffairs.com · 3 min