TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 10 stories
  3. Page 3: TLDR AITLDR AI · 13 stories
  4. Page 4: TLDR DevTLDR Dev · 11 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 11 stories
  8. Page 8: TLDR FoundersTLDR Founders · 11 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 12 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 12 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 12 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKERS DELIVER GLOBAL GROUP RANSOMWARE OFFLINE VIA PHISHING EMAILS

Forcepoint X-Labs discovered the Phorpiex botnet delivering Global Group ransomware, a Mamona successor, via phishing emails containing .lnk files disguised as documents. It leverages living-off-the-land techniques using PowerShell and Command Prompt for payload delivery. The ransomware operates in a mute mode that generates encryption keys locally with ChaCha20-Poly1305 instead of contacting a C2 server, allowing it to encrypt files on offline machines and evade network-based detection. After encryption, the malware self-deletes, destroys Volume Shadow Copies, and appends a .reco extension to locked files, leaving minimal forensic artifacts.

hackread.com · 2 min

TLDR InfoSec

CLAUDE DESKTOP EXTENSIONS ZERO-CLICK RCE EXPOSES OVER 10K USERS TO SILENT ATTACKS

Researchers at the security firm LayerX uncovered a critical (CVSS 10/10) vulnerability in Claude Desktop Extensions (DXT) that could enable remote code execution (RCE) with no user interaction. In the proof-of-concept disclosed by LayerX, an attacker would send the victim a Google Calendar invite containing malicious instructions in the event description. The victim would then, at some point, ask Claude to manage their calendar or check events, and the malicious instructions would be executed. This vulnerability is enabled by the fact that Claude DXT intentionally runs without any isolation.

cyberpress.org · 2 min

TLDR InfoSec

RECREATING UNCENSORED EPSTEIN PDFS FROM RAW ENCODED ATTACHMENTS

A security researcher discovered that the DoJ's latest Epstein document dump inadvertently included unredacted email attachments as raw base64-encoded content — left uncensored because the assigned intern didn't recognize the significance of pages of encoded data embedded in printed-and-scanned emails. Reconstructing the original PDFs proved extremely difficult due to poor OCR quality on Courier New font rendering (where "1" and "l" are nearly indistinguishable), with multiple commercial and open-source OCR tools failing until a community-developed pixel-level template-matching approach achieved 99.96% line accuracy and successfully decompressed 39 of 40 FlateDecode streams. The incident highlights how encoding artifacts and document processing pipelines can inadvertently preserve sensitive content that redaction workflows miss, and serves as a cautionary tale for forensic document handling and redaction verification processes.

neosmart.net · 13 min

TLDR InfoSec

AI-ASSISTED CLOUD INTRUSION ACHIEVES ADMIN ACCESS IN 8 MINUTES

In November 2025, the Sysdig Threat Research Team (TRT) detected an account compromise that was notable for the attacker's 8-minute progression from initial access to administrative privileges, using LLM assistance. The attacker gained initial access through credentials discovered in a public S3 bucket. They then used these credentials to replace the Lambda function code to escalate privileges, move laterally across 19 different principals, and finally harvest sensitive data. They also used Bedrock to access cloud-hosted LLMs and launch GPU instances for model training. The article includes mitigation recommendations for each step in the attacker's exploit chain.

sysdig.com · 5 min

TLDR InfoSec

free.

Summary unavailable

depthfirst.com

TLDR InfoSec

INTRODUCING AUGUSTUS: OPEN SOURCE LLM PROMPT INJECTION TOOL

Augustus is an open-source Go-based LLM vulnerability scanner that tests models against 210+ adversarial attacks across 47 categories, including jailbreaks, prompt injection, encoding exploits, data extraction, and agent manipulation, shipping as a single binary with support for 28 LLM providers. Inspired by NVIDIA's garak but reimplemented in Go for faster execution and zero runtime dependencies, Augustus features a pipeline architecture with composable probes, buff transformations (encoding, paraphrase, poetry, and low-resource language translation), and 90+ detectors, including LLM-as-a-judge and HarmJudge. The tool is part of Praetorian's "The 12 Caesars" campaign.

praetorian.com · 10 min

TLDR InfoSec

HACKERS USE SIGNAL QR CODES TO SPY ON MILITARY AND POLITICAL LEADERS

Germany's BSI and BfV warned that state-backed hackers are targeting military leaders, diplomats, and journalists across Europe by abusing Signal's legitimate features — impersonating Signal Security Support to steal PINs and hijack accounts, or tricking targets into scanning QR codes that silently link attacker devices with access to 45 days of chat history. The campaigns rely entirely on social engineering rather than exploits, making them difficult to detect through traditional security tooling. Users should enable Registration Lock, audit linked devices regularly, and treat any unsolicited messages requesting verification codes as malicious.

hackread.com · 2 min

TLDR InfoSec

HACKTIVIST SCRAPES OVER 500K STALKERWARE CUSTOMERS' PAYMENT RECORDS

A hacktivist going by the name wikkid has scraped and released over 500K customer records from stalkerware services provided by a Ukrainian company called Struktura. The scraped data includes customer email addresses, which app or brand the customer paid for, how much they paid, the payment type, and the last four digits of credit card numbers. The hacktivist stated that they exploited a “trivial bug” in the service's website.

techcrunch.com · 2 min

TLDR InfoSec

DISCORD WILL SOON REQUIRE FACE SCANS OR ID FOR ALL USERS OR RESTRICT ACCESS

Discord has announced that beginning in early March, users will need to verify their age via a selfie or government ID. Users' accounts will be set to teen accounts by default until they perform the verification. Discord states that the selfie processing will happen locally on users' devices, that government IDs will be deleted by their third-party processors “quickly,” and that age verification status will not be visible on users' profiles.

9to5mac.com · 2 min

TLDR IndexPage 5