TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 8 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 12 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 12 stories
  7. Page 7: TLDR DesignTLDR Design · 14 stories
  8. Page 8: TLDR FoundersTLDR Founders · 8 stories
  9. Page 9: TLDR Founders — continuedTLDR Founders · 8 stories
  10. Page 10: TLDR MarketingTLDR Marketing · 12 stories
  11. Page 11: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design · 14 stories
  12. Page 12: SponsoredTLDR, TLDR AI · 3 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

PHISHCEPTION - SENDGRID IS ABUSED TO HOST PHISHING ATTACKS IMPERSONATING ITSELF

Netcraft has spotted a new phishing campaign that uses compromised SendGrid accounts to phish for new accounts by emailing users that their account had a payment error or other similar issues. The email is sent from a SendGrid account and uses SendGrid’s tracking links to mask the destination. Users are directed to a JsPen link that obfuscates a script tag which loads a JS file from Azure Front Door that is an obfuscated clone of the SendGrid login page.

netcraft.com · 7 min

TLDR InfoSec

CYCODE DISCOVERS A SUPPLY CHAIN VULNERABILITY IN BAZEL

A blog post from Cycode detailing a supply chain vulnerability that it discovered in Bazel. The post begins with an overview of GitHub Custom Actions and then details how Cycode leveraged a custom action in Bazel to achieve remote code execution. The Bazel project included a custom action that passed the user-controlled issue body directly to a bash shell in the GitHub runner which was vulnerable to command injection.

cycode.com · 9 min

TLDR InfoSec

HOW WE WERE ABLE TO INFILTRATE ATTACKER TELEGRAM BOTS

A post from Checkmarx on a technique that it discovered to intercept messages from malicious Telegram bots that attackers utilize for info-stealing operations. Checkmarx's team extracted the bot details from a malicious package. They then utilized the /getUpdates endpoint to retrieve details of a specific message or all messages by looping through message IDs. The post also details two methods for redirecting messages when an attacker utilizes a webhook.

checkmarx.com · 5 min

TLDR IndexPage 5