The Daily Index — Tuesday, March 10, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

RUSSIA-BACKED HACKERS BREACH SIGNAL AND WHATSAPP ACCOUNTS OF OFFICIAL JOURNALISTS

Dutch intelligence agencies are warning officials, military personnel, and journalists of a new social engineering campaign being carried out by Russia-backed attackers seeking to gain access to their Signal and WhatsApp accounts. The attacks are being carried out via crafted phishing messages that request users' security verification and pin codes. The attackers frequently masquerade as a Signal support chatbot or use the linked devices feature to trick users.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

EV CHARGER BIZ ELECQ ZAPPED BY RANSOMWARE CROOKS, CUSTOMER CONTACT DATA STOLEN

Ransomware actors compromised ELECQ's AWS environment, encrypting and exfiltrating databases containing customer names, emails, phone numbers, and home addresses, while leaving payment data and chargers unaffected. The firm shut down remote access services, engaged incident responders, and notified EU regulators, while warning users about heightened phishing and social-engineering risk arising from exposed contact details.

theregister.com · 2 min

TLDR InfoSec

HOW AI ASSISTANTS ARE MOVING THE SECURITY GOALPOSTS

Autonomous AI agents like OpenClaw, which require broad system access to be useful, introduce compounding risks: exposed admin interfaces leak full credential stores, prompt injection enables supply chain attacks that install rogue agents without user consent, and low-skilled attackers now leverage commercial AI to orchestrate campaigns at scale. Security researchers frame the core risk as the "lethal trifecta" — any agent combining access to private data, exposure to untrusted content, and external communication capability becomes a viable exfiltration vector. Organizations should isolate agents in VMs on segmented networks with strict egress controls, and treat agentic systems as a new attack surface requiring an explicit defense strategy alongside traditional controls.

krebsonsecurity.com · 5 min

TLDR InfoSec

INSTALLFIX: HOW ATTACKERS ARE WEAPONIZING MALVERTIZED INSTALL GUIDES

Attackers are cloning installation pages for popular developer tools like Claude Code and using Google Ads to place these lookalike sites above legitimate results, leading users to run malicious “curl | shell” one‑liners that pull Amatera Stealer and related payloads from attacker‑controlled infrastructure. The campaign abuses legitimate hosting and rapidly rotated domains to evade detection, while redirections back to real sites reduce victim suspicion. For defenders, what matters is reducing blind trust in install commands, hardening controls around malvertising-driven traffic, and detecting browser-based signals such as lookalike domains, copy-to-clipboard shell commands, and suspicious script execution chains in real time.

pushsecurity.com · 8 min

TLDR InfoSec

USING COOKIES TO HACK INTO A TECH COLLEGE'S ADMISSION SYSTEM

Sri Krishna College of Engineering and Technology's SparK admission system exposed 4,110 student records because its admission APIs lacked any authentication, allowing access via manually set login cookies. By crafting two cookies and then harvesting a valid admission officer GUID from a student search response, researchers could fully impersonate an officer and reach sensitive dashboards. The exposed data included IDs, medical details, religious and ethnic information, grades, income data, and private documents for both students and parents, all accessible with only a browser. After coordinated disclosure through India's CERT-IN, SKCET took the vulnerable site offline within a week and later restored it with the flaw fixed.

eaton-works.com · 4 min

TLDR InfoSec

HACKERS SPREAD FAKE RED ALERT ROCKET ALERT APP TO SPY ON ISRAELI USERS

Acronis TRU discovered a trojanized Red Alert rocket warning app distributed via SMS, impersonating Israel's Home Front Command, attributed to Arid Viper (APT-C-23). Detected on March 1, the malicious APK requests 20 permissions, including 6 sensitive ones, harvesting GPS location, SMS/OTP content, contact lists, installed apps, and registered accounts, while using certificate spoofing to masquerade as a legitimate Google Play install. The campaign fits a broader pattern of geopolitical lure-based mobile spyware operations previously linked to the region, including a near-identical Red Alert exploit documented by Cloudforce One in October 2023.

hackread.com · 2 min

TLDR InfoSec

TYCOON 2FA GOES BOOM AS EUROPOL, VENDORS BUST PHISHING PLATFORM

Europol and vendors, including Microsoft, Trend Micro, Cloudflare, and Proofpoint, have dismantled the Tycoon 2FA phishing‑as‑a‑service platform, which had powered a majority of Microsoft‑blocked phishing attempts and enabled large‑scale MFA‑bypass Business Email Compromise (BEC) campaigns. Its adversary‑in‑the‑middle token-theft attack highlighted the need to move to phishing‑resistant MFA, such as FIDO2 keys.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

SYSTEM76 ON AGE VERIFICATION LAWS

Colorado's SB 26-051, California's AB 1043, and New York's proposed S8102A impose age-verification requirements on operating systems that are both trivially bypassable and potentially damaging to open computing ecosystems. The laws rely on self-attestation, which children will simply lie to circumvent. New York's version goes further by requiring third-party identity verification just to use an internet-connected device, effectively eliminating privacy. Linux distributions that decline to emit an age-bracket signal risk delivering a degraded internet experience to their users. The only durable solution is digital literacy education rather than access controls.

blog.system76.com · 3 min

TLDR InfoSec

EU COURT ADVISER SAYS BANKS MUST IMMEDIATELY REFUND PHISHING VICTIMS

The CJEU Advocate General issued a formal opinion under PSD2 requiring banks to immediately refund unauthorized transaction victims unless fraud is suspected, while preserving the right to pursue recovery from customers who acted with gross negligence.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

AI'S IMPACT ON SOFTWARE AND BUG BOUNTY

AI coding agents are expected to double bug bounty submissions in 2026, but as companies deploy the same tools internally for continuous code review and black-box testing, external programs will likely see a sharp decline in viable findings within one to two years.

josephthacker.com · 1 min