TLDR INFORMATION SECURITY 2025-04-22

Access the webinar on demand →

BEWARE OF THIS SNEAKY GOOGLE PHISHING SCAM

Phishing scammers are bypassing Google's DKIM authentication by using Google Sites to send fake "subpoena alerts" that appear to come from "no-reply@google.com." The scam creates authentic-looking emails by entering email text as an app name, which Google automatically sends and then links directly to sites.google.com instead of accounts.google.com to steal credentials.

WIDESPREAD MICROSOFT ENTRA LOCKOUTS TIED TO NEW SECURITY FEATURE ROLLOUT

On Saturday, Windows admins from numerous organizations reported widespread account lockouts triggered by false positives in the rollout of Microsoft Entra ID's new MACE leaked credentials detection app. Microsoft notified users that the alarms were not caused by actual breaches but rather the invalidation of user refresh tokens that were mistakenly logged into their systems.

NORTH KOREAN CRYPTOCURRENCY THIEVES CAUGHT HIJACKING ‘REMOTE CONTROL' FEATURE

The non-profit Security Alliance (SEAL) and Trail of Bits have both released advisories regarding a North Korean social engineering campaign that involves masquerading as VC investors. The threat actors send victims a Calendly link to schedule a Zoom call with a PR pitch to appear on a podcast run by Aureon Capital. If a victim accepts the meeting, the attackers ask the victim to share their screen to present their work and at some point will request ‘Remote Control' while changing their display name to Zoom to make the notification mimic a system notification. The attackers use this access to deploy either infostealers or full RATs.

IN DEPTH WITH WINDOWS 11 RECALL—AND WHAT MICROSOFT HAS (AND HASN'T) FIXED

Microsoft's revamped Recall feature for Windows 11 Copilot+ PCs addresses previous security concerns by making it opt-in, encrypting data, and adding automated filtering for sensitive information. Despite these improvements, the feature still has filtering limitations and lingering trust issues from its botched initial rollout.

IOT NETWORK SECURITY: ANALYZING DECRYPTED ZIGBEE TRAFFIC DATA

This study presents ZigBeeNet, a dataset of decrypted Zigbee IoT network traffic from a smart home with 15 devices. By extracting the network key, researchers could analyze device behavior, identify security vulnerabilities, and optimize network performance. The data addresses key challenges in analyzing encrypted Internet of Things (IoT) communications.

THE COMPLEXITY OF DETECTING AMAZON S3 AND KMS RANSOMWARE

S3 and KMS ransomware attacks are challenging to detect, as many techniques can only be detected in S3 Access Logs or CloudTrail data events, which can be costly and are not enabled by default. This post provides IoCs for 11 different indicators of cloud ransomware. It also includes an advanced event selector for CloudTrail, which can target a specific bucket to enable more fine-grained logging on sensitive buckets.

KENZO SECURITY (PRODUCT LAUNCH)

Kenzo leverages a security data mesh (alerts, context, and telemetry) to power AI agents that specialize in functions such as detection, risk, investigation, and normalization.

INSECURE KUBERNETES DEPLOYMENTS

A full insecure Kubernetes application for testing security tools. This tool will create an EKS cluster with some insecure application pods for testing.

PEEKO

peeko is a browser-based C2 framework that utilizes an injected XSS payload to establish a WebSocket for C2 communication.

MICROSOFT RATED THIS BUG AS LOW EXPLOITABILITY. MISCREANTS WEAPONIZED IT IN JUST 8 DAYS

A Microsoft Windows NTLM hash-leaking vulnerability (CVE-2025-24054) was weaponized just eight days after Patch Tuesday. Initially exploiting victims through Dropbox-hosted ZIP files, the attackers, which targeted Poland and Romania, evolved to sending standalone malicious files directly.

CISA WARNS THREAT HUNTING STAFF OF END TO GOOGLE, CENSYS CONTRACTS AS AGENCY CUTS SET IN

CISA staff members were notified that, as part of the agency's cost-cutting measures, the organization has discontinued its use of Censys and plans to cease using VirusTotal. Staff members were notified that an effort would be made to identify alternative tools to ensure minimal disruption, but no further details were provided. CISA is also investigating the termination of all threat-hunting contracts with the private sector.

RUNTIME CLOUD SECURITY IN 2025

CNAPP has grown to include many tools, but most application-related tools were added later and lack comprehensiveness. Modern attacks like MoveIT are hard to detect, yet Cloud Application Detection and Response (CADR) shows promise in using application context to block such attacks early. No current solution fully realizes CADR's potential, but ARMo, Sweet, Upwind, Oligo, Operant, and Raven are the closest.

MICROSOFT PURGES DORMANT AZURE TENANTS, ROTATES KEYS TO PREVENT REPEAT NATION-STATE HACK

Microsoft has enhanced security against key theft and nation-state hacks by securing key signing keys in hardware, implementing multi-factor authentication, and purging dormant Azure tenants.

WORDPRESS AD-FRAUD PLUGINS GENERATED 1.4 BILLION AD REQUESTS PER DAY

Fraud detection firm HUMAN has detected a large ad fraud operation called 'Scallywag,' which utilized WordPress plugins to generate 1.4 billion fake ad requests daily.

BOOKING.COM PHISHING SCAM USES FAKE CAPTCHA TO INSTALL ASYNCRAT

A phishing scam resembling Booking.com deceives hotel staff with fraudulent emails to install AsyncRAT malware via a fake CAPTCHA, endangering hotel networks and customer information.