The Daily Index — Thursday, February 26, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

CARGURUS DATA BREACH AFFECTS 12.5 MILLION ACCOUNTS

Automotive marketplace CarGurus has confirmed a security incident in which 12.5 million user accounts were exposed, including names, email addresses, phone numbers, physical addresses, financial prequalification data, and some dealer information. The researchers attributed the hack to the ShinyHunters group, known for high‑impact social engineering attacks against major enterprises and universities.

techcrunch.com · 2 min

TLDR InfoSec

WYNN RESORTS TAKES ATTACKER'S WORD FOR IT THAT STOLEN STAFF DATA WAS DELETED

Wynn Resorts confirms ShinyHunters stole extensive employee data, including personal and HR details, after exploiting Oracle PeopleSoft and valid credentials since 2025. The company says the crooks claim to have deleted the data and offers staff credit monitoring. Still, experts stress ransomware crews rarely erase stolen records and view such “deletion” promises as indicators of a completed extortion deal.

theregister.com · 2 min

TLDR InfoSec

NEW MALICIOUS NPM PACKAGE “AMBAR-SRC” TARGETS DEVELOPERS WITH OPEN SOURCE MALWARE

The malicious npm package “ambar-src” accumulated ~50,000 downloads in just three days by typosquatting the popular “ember-source” package and abusing npm's preinstall script hook to execute code without any explicit import. The package deployed OS-specific open-source malware payloads, including encrypted shellcode on Windows, a Golang-based reverse SSH shell on Linux, and the Apfell/MythicAgents payload on macOS, all communicating via Yandex Cloud functions for C2 evasion. Organizations should audit dependencies for this package, treat any system where it was installed as fully compromised, and rotate all secrets from a separate machine.

tenable.com · 9 min

TLDR InfoSec

LARGE-SCALE ONLINE DEANONYMIZATION WITH LLMS

Modern LLM agents can deanonymize users at scale by linking pseudonymous posts to real-world identities across platforms like Hacker News, Reddit, and LinkedIn. Using proxy tasks such as cross-platform account matching and splitting single accounts into multiple identities shows that search-plus-reasoning agents can re-identify users with high precision, and that performance degrades slowly even as candidate pools reach tens of thousands, implying platform-scale feasibility.

simonlermen.substack.com · 8 min

TLDR InfoSec

JA4 FINGERPRINTING AGAINST AI SCRAPERS: A PRACTICAL GUIDE

JA4 fingerprinting can be incredibly effective for detecting AI scrapers, as modifying the fingerprint requires recompiling the full TLS stack, unlike other methods, such as behavioral detection, that newer AI agents can mimic. JA4 fingerprints for the ClientHello and HTTP Headers (JA4H) can be combined with traditional systems to build a defense-in-depth detection system, which can then forward logs to a SIEM. This post includes code samples for the detection logic as well as fingerprints for several common libraries and tools.

webdecoy.com · 10 min

TLDR InfoSec

ASTELIA (PRODUCT LAUNCH)

Astelia is an AI-driven exposure management platform that maps enterprise environments, models attack paths, and prioritizes remediation of exploitable vulnerabilities.

astelia.io

TLDR InfoSec

DISCORD CUTS TIES WITH PETER THIEL-BACKED VERIFICATION SOFTWARE AFTER ITS CODE WAS FOUND TIED TO US SURVEILLANCE EFFORTS

Discord terminated its partnership with identity verification vendor Persona after researchers discovered nearly 2,500 accessible files on a FedRAMP government endpoint, revealing the software performs 269 distinct verification checks, including facial recognition against watchlists, politically exposed persons screening, and adverse media categorization across terrorism and espionage categories. Persona's CEO called the exposure publicly accessible front-end code rather than a vulnerability, but the discovery follows a 2025 breach at another Discord verification vendor that exposed government IDs of over 70,000 users. The incident underscores growing supply chain privacy risks in age verification systems, with Persona still serving OpenAI, Lime, and Roblox despite the controversy.

fortune.com · 5 min

TLDR InfoSec

CLAUDE CODE FLAWS ALLOW REMOTE CODE EXECUTION AND API KEY EXFILTRATION

Researchers have uncovered three Claude Code vulnerabilities that enable remote code execution and silent API key exfiltration when developers open malicious repositories, abusing hooks, MCP servers, and environment variables. Exploitation can leak Anthropic API keys, redirect authenticated traffic, and modify cloud data, shifting the threat model from just running untrusted code to merely opening untrusted AI-assisted projects.

thehackernews.com · 2 min

TLDR InfoSec

WHY ‘CALL THIS NUMBER' TOAD EMAILS BEAT GATEWAYS

Telephone-oriented attack delivery (TOAD) accounted for nearly 28% of all gateway-bypassing email detections across multiple enterprise environments between December 2025 and February 2026. These emails contain only a phone number as the payload, typically impersonating billing notifications from brands like PayPal or DocuSign, making them indistinguishable from legitimate business communications that secure email gateways filter out. The average detected attack combined more than four evasion techniques simultaneously, with over 1,400 unique evasion combinations tracked, representing a 130% increase over the previous study period.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

INDIE WEB BROWSER LADYBIRD FLUTTERS TOWARD RUST WITH A LITTLE HELP FROM AI

The Ladybird browser project abandoned Swift adoption and is now using LLM-assisted translation to port its C++ codebase to Rust, converting 25,000 lines of its JavaScript interpreter in two weeks with zero regressions.

theregister.com · 3 min

TLDR InfoSec

CLAUDE COLLABORATION TOOLS LEFT THE DOOR WIDE OPEN TO REMOTE CODE EXECUTION

Researchers have discovered three now-patched vulnerabilities in Claude Code (CVE-2025-59536, CVE-2026-21852) that allowed remote code execution via malicious Hooks and MCP configurations in cloned repositories, plus API key theft through endpoint redirection in project settings files.

theregister.com · 3 min

TLDR InfoSec

DISCORD PUTS GLOBAL AGE VERIFICATION POLICY ON HOLD AFTER BACKLASH

Discord has delayed its global age verification rollout to the second half of 2026 and plans to add credit card verification as an alternative to government IDs or video selfies.

therecord.media · 2 min