TLDR INFORMATION SECURITY 2025-04-21

Read the latest report to learn more

LEGENDS INTERNATIONAL NOTIFIES CUSTOMERS, EMPLOYEES OF DATA BREACH

Legends International disclosed a cyberattack in an April 15 letter. The November 2024 breach compromised sensitive data, including SSNs, payment information, and medical details. The company terminated the unauthorized activity, took its systems offline, hired security experts, and notified the relevant authorities. Details about the impact scale and perpetrators remain undisclosed.

AHOLD DELHAIZE CONFIRMS DATA STOLEN IN RANSOMWARE ATTACK

Ahold Delhaize disclosed a cyberattack in November 2024 that compromised data from its systems. The incident affected Giant Food pharmacies and Hannaford supermarkets, though stores remained operational. Although operations were quickly restored, the attackers had exfiltrated internal files—the INC Ransom group claims to have stolen 6TB of data and have threatened to publish it.

CHROME EXTENSIONS WITH 6 MILLION INSTALLS HAVE HIDDEN TRACKING CODE

57 Chrome extensions with hidden tracking capabilities used by 6 million people have been discovered. These risky extensions can monitor browsing behavior, access cookies, and execute remote scripts. Users are advised to remove these extensions immediately and reset passwords for online accounts.

THE TRUTH ABOUT VPNS: WHAT YOU NEED TO KNOW

VPNs create encrypted tunnels that protect your online activity from snooping ISPs and hackers. While they mask your location and bypass censorship, many services secretly log data or contain security flaws. Choose trusted providers like Mullvad, IVPN, or ProtonVPN, which offer verified no-logs policies and anonymous payment options.

WHAT IS DETECTION AS CODE? HOW TO IMPLEMENT DETECTION-AS-CODE

Detection as Code (DaC) applies software engineering principles to security detections, making them version-controlled, tested, and automated like regular code. This approach addresses problems like untraceable changes, silent detection failures, and alert floods that plague traditional SIEM-based detection workflows. DaC consists of five components: process management with agile methodologies, expressive languages for complex logic, reusable components, version control with Git as source of truth, and CI/CD pipelines with comprehensive testing.

HOW I USED AI TO CREATE A WORKING EXPLOIT FOR CVE-2025-32433 BEFORE PUBLIC POCS EXISTED

An AI-driven approach was used to create an exploit for CVE-2025-32433 before public PoCs were available. The AI tool not only identified the vulnerability but also generated a working proof of concept by analyzing code differentials. This demonstrates the potential of AI in automating and accelerating vulnerability research.

PROMPTARMOR (PRODUCT LAUNCH)

PromptArmor's platform aims to boost AI visibility by scanning vendors for new AI features and policy changes that can be difficult to track. The platform tests vendors for a newer large language model (LLM) security risk called indirect prompt injection.

PREL

prel(iminary) is an application that temporarily assigns Google Cloud IAM Roles. It includes an approval process.

SUZAKU

Suzaku is a tool for threat hunting and generating fast forensics timelines for cloud logs. It supports AWS CloudTrail logs and there are plans to include Azure and GCP logs. Suzaku helps investigators identify attacks quickly and provides a timeline of relevant events for forensic analysis. It is cross-platform and can be easily downloaded or compiled for Windows, Linux, and macOS systems.

HOUSE DEMOCRATS: DOGE IS BUILDING A ‘MASTER DATABASE' OF AMERICANS' SENSITIVE INFORMATION

House Democrats allege that DOGE is building a cross-agency database of sensitive personal information from the IRS, SSA, and state voting records. Rep. Connolly has requested an investigation, citing privacy violations, cybersecurity concerns, and potential illegal activity.

HACKING US CROSSWALKS TO TALK LIKE ZUCK IS AS EASY AS 1234

Crosswalk buttons in US cities were hacked to play AI-generated voices of tech billionaires making satirical comments. The pranks, likely accomplished through Polara's public Field Service app and default passwords (1234) on Bluetooth-connected crosswalk hardware, affected systems in Seattle and Silicon Valley.

YOUTUBER CHALLENGES VIEWERS TO DE-PIXELATE A VIDEO: CRACKED IN HOURS

A YouTuber challenged viewers to de-pixelate a video for $50, aiming to hide private folders. The video was quickly cracked, showing the weakness of blurring for privacy. Two developers successfully revealed hidden text behind the mosaic by analyzing moving pixelation patterns. One developer has shared their method on GitHub.

COZY BEAR'S WINE LURE DROPS WINELOADER MALWARE ON EU DIPLOMATS

Cozy Bear, a group of Russian hackers, used fake wine-tasting invitations to distribute GrapeLoader malware and WineLoader backdoor through phishing emails, compromising European diplomats' computer systems to steal sensitive information.

2025'S TOP OSINT TOOLS: A FRESH TAKE ON OPEN-SOURCE INTEL

This blog post introduces the top OSINT tools for 2025, providing an updated list of free and paid tools for cybersecurity professionals and enthusiasts.

FBI: SCAMMERS POSE AS FBI IC3 EMPLOYEES TO 'HELP' RECOVER LOST FUNDS

The FBI has cautioned against scammers impersonating IC3 employees who claim they can help recover lost money, urging people not to share personal information or send money.