TLDR INFORMATION SECURITY 2025-05-21

Read key insights

PROCOLORED PRINTER SOFTWARE CONTAINED MALWARE

After receiving a new direct-to-film printer from China-based Procolored, YouTuber Cameron Coward engaged with cybersecurity researcher Kirsten Hahn after his computer was infected by malware. Hahn discovered that 39 files for products on Procolored's Mega.nz account triggered malware detections for a cryptocurrency wallet stealer and an XRed backdoor for Windows PCs. Hahn suggested that the company may not have intentionally introduced the malicious files, as the C2 server for XRed backdoor is offline.

HAZY HAWK GANG EXPLOITS DNS MISCONFIGS TO HIJACK TRUSTED DOMAINS

A threat actor tracked as Hazy Hawk is hijacking abandoned DNS CNAME records pointing to abandoned cloud services to distribute scams, fake apps, and malicious apps. Hazy Hawk scans for domains with dangling CNAME records, then registers a new cloud resource with the same name as the abandoned CNAME, and finally creates hundreds of malicious URLS under it that redirect users to scam sites. It has hijacked subdomains from cdc[.]gov, ted[.]com, nyu[.]edu, and unicef[.]org among others.

VIRGIN MEDIA O2 PATCHES HOLE THAT LET CALLERS SNOOP ON YOUR COORDINATES

UK telecom Virgin Media O2 fixed a security flaw in its 4G calling that revealed users' location data to callers. Researcher Daniel Williams discovered that call signaling messages contained IMSI, IMEI, and cell ID data that could pinpoint recipients' locations within 100 square meters in urban areas.

MALWARE ATTACK AND COUNTERATTACK

Artist Antoine Schmitt describes a phishing attack that he was a victim of which led to installing the AMOS infostealer. Schmitt was contacted by a threat actor masquerading as a very professional journalist for a magazine called Artscope Magazine. The journalist had Schmitt download and install a trojanized video app that executed an AppleScript payload to download and run the infostealer.

RED TEAM GOLD: EXTRACTING CREDENTIALS FROM MDT SHARES

While SCCM gets security attention, Microsoft Deployment Toolkit (MDT) often exposes similar vulnerabilities. Misconfigured MDT deployment shares frequently allow unauthorized access to credentials stored in configuration files, task sequences, and scripts. These credentials can potentially grant domain admin access or control over deployed systems.

INSECURE CREDENTIAL STORAGE PLAGUES MCP

Many MCP environments rely upon long-lived credentials such as API keys, but they store them incorrectly in world-readable files or get leaked via chat logs. The community-provided MCP server for Figma even stores its credentials in a world-readable and world-writeable file that attackers can use for session fixation attacks. OAuth should be implemented in MCP servers for apps that support it, and other MCP servers should consider using OS native credentials stores such as macOS Keychain and Windows' Credentials Storage API.

See Drata in action

CLOUDSEK (PRODUCT LAUNCH)

CloudSEK scours the surface, dark, and deep web to identify cyber risks, data leaks, identity theft, and other threats and helps organizations assess their cybersecurity posture from the attacker's perspective.

PASSWORD-MONITOR

Ensure your password safety by scanning in real data breaches.

GHOSTLINE

GhostLine is an AI-powered vishing operative. When a user feeds it a phone number, GhostLine uses a cloned voice to build rapport, gather intel, and extract credentials.

NEW ATTACK CAN STEAL CRYPTOCURRENCY BY PLANTING FALSE MEMORIES IN AI CHATBOTS

Research reveals AI-powered crypto trading bots can be manipulated through prompt injection attacks on ElizaOS, an open-source framework. Attackers can plant false memories in the bot's database, causing it to redirect payments to their wallets.

AWS DEFAULT IAM ROLES FOUND TO ENABLE LATERAL MOVEMENT AND CROSS-SERVICE EXPLOITATION

Researchers discovered dangerous default IAM roles in AWS services that grant excessive permissions like full S3 access. These roles enable attackers to escalate privileges and move laterally across services, potentially compromising entire AWS accounts. AWS has modified the AmazonS3FullAccess policy in response.

KREBSONSECURITY HIT WITH NEAR-RECORD 6.3 TBPS DDOS

KrebsOnSecurity was hit by a huge 6.3 Tbps DDoS attack, likely as a test by a new botnet called Aisuru. The botnet uses hacked Internet of Things (IoT) devices and is linked to a person known as "Forky" who sells DDoS services online. Experts say releasing the botnet's code might weaken its power by creating more, smaller botnets.

POWERSCHOOL HACKER PLEADS GUILTY TO STUDENT DATA EXTORTION SCHEME

A 19-year-old student was convicted of hacking PowerSchool, stealing data on millions, and extorting a ransom while threatening to leak the information.

LOCKBIT LEAK SHOWS AFFILIATES USE PRESSURE TACTICS, RARELY GET PAID

The LockBit ransomware gang operates like a business by using affiliates for attacks, but most victims don't pay ransoms, and affiliates often fail to achieve results despite employing threats and pressure.