The Daily Index — Monday, October 27, 2025 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

Untitled entry

Summary unavailable

aws.amazon.com

TLDR InfoSec

SELF-SPREADING GLASSWORM MALWARE HITS OPENVSX, VA CODE REGISTRIES

Endpoint security firm Koi Security uncovered a new self-spreading malware targeting developers, embedded in VS Code and OpenVSX extensions. The malware was pushed via hidden code in compromised extensions, which downloaded an infostealer that stole cryptocurrency wallet data and credentials for GitHub, npm, and OpenVSX accounts. The malware also attempts to infect any extensions it gains access to to self-propagate.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW COPHISH ATTACK STEALS OAUTH TOKENS VIA COPILOT STUDIO AGENTS

DataDog Security Labs identified a new phishing method exploiting Microsoft's Copilot Studio chatbots. Attackers can tailor the Login topic to create convincing phishing pages hosted on copilotstudio.microsoft.com. The attack involves administrators approving permission requests from the application, which can be a “demo website” that does not need Microsoft's verification.

bleepingcomputer.com · 3 min

TLDR InfoSec

OPENAI ATLAS OMNIBOX PROMPT INJECTION: URLS THAT BECOME JAILBREAKS

Agentic browsers like OpenAI Atlas are vulnerable to exploitation if input boundaries are not strictly enforced. Attackers can create strings that look like URLs but contain natural-language commands, which the omnibox might interpret as user intent. This can allow malicious actors to override user commands, leading to unintended or harmful actions, such as opening phishing sites or executing destructive instructions.

neuraltrust.ai · 5 min

TLDR InfoSec

MAXIMIZING THE VALUE OF INDICATORS OF COMPROMISE AND REIMAGINING THEIR ROLE IN MODERN DETECTION

File hashes, IP addresses, and domains are usually seen as indicators of compromise (IoCs), but they have limited value in investigations because adversaries can easily alter them. These IoCs can be more insightful if supplemented with additional contextual data like fuzzy hashes, GeoIP information, and domain reputation. As AI enhances malware developers' abilities, IoCs will no longer serve as standalone alerts but will evolve into data points that help build a comprehensive understanding of a threat actor's behavior.

magonia.io · 7 min

TLDR InfoSec

USING LLMS AS A REVERSE ENGINEERING SIDEKICK

This post demonstrates how to use LLMs with Model Context Protocol (MCP) servers integrated into IDA Pro and Ghidra to accelerate malware reverse engineering through automated function analysis, code documentation, and variable renaming. Testing on IcedID malware compared cloud-based Claude Sonnet 3.7 ($2.91-$13.24 per analysis, 18-11 minutes) against local Ollama/Devstral models ($0 cost, 22-46 minutes), with cloud models providing more thorough analysis but at a higher expense. Key limitations include token costs escalating with file complexity, context window truncation causing local models to forget instructions mid-analysis, and security risks from prompt injection, tool poisoning, and potential data exfiltration when using untrusted MCP servers.

blog.talosintelligence.com · 10 min

TLDR InfoSec

WHEN YOUR AI BROWSER BECOMES YOUR ENEMY: THE COMET SECURITY DISASTER

AI-powered browsers promise convenience but can unintentionally follow dangerous instructions hidden in web content, risking user security. Comet's recent vulnerability exposed how easily AIs can be manipulated. They are like naive assistants who often cannot distinguish malicious commands from user input. A simple hidden command can hijack and send private data to a thief.

venturebeat.com · 4 min

TLDR InfoSec

NSO PERMANENTLY BARRED FROM TARGETING WHATSAPP USERS WITH PEGASUS SPYWARE

A federal judge issued a permanent injunction against NSO, banning it from using Pegasus spyware on WhatsApp users and requiring it to delete illegally obtained data. The ruling, from Meta's lawsuit, revealed that Pegasus infected activists', diplomats', and journalists' devices. Punitive damages were reduced, but the case sets a precedent that enhances privacy protections and makes attacks on encrypted platforms like WhatsApp riskier.

arstechnica.com · 4 min

TLDR InfoSec

HOW CLOUDFLARE'S CLIENT-SIDE SECURITY MADE THE NPM SUPPLY CHAIN ATTACK A NON-EVENT

Attackers used phishing to compromise npm maintainer accounts in September, injecting malicious code into 18 popular packages with over 2 billion weekly downloads to steal cryptocurrency and credentials from CI/CD pipelines. Cloudflare's Page Shield, using ML-based analysis of 3.5 billion scripts daily, detected all compromised packages with 98% precision and 90% recall by identifying obfuscated code and changes to wallet interfaces. Organizations should audit dependencies, rotate credentials, pin safe versions, and consider Cloudflare's Client-Side Risk Assessment for supply chain security.

blog.cloudflare.com · 4 min

TLDR InfoSec

SHUTDOWN SPARKS 85% INCREASE IN US GOV'T CYBERATTACKS

An 85% increase in cyberattacks on US government agencies since October has led to over 555 million projected attacks this month.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

REDDIT SUES PERPLEXITY AND OTHERS FOR ALLEGEDLY STEALING DATA VIA GOOGLE

Reddit sued AI startup Perplexity, Lithuanian firm Oxylabs, SerpApi, and Russian company AWMProxy for allegedly circumventing platform protections by scraping Reddit content from Google search results to train AI models and resell data to companies like OpenAI and Meta.

links.tldrnewsletter.com · 3 min