TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 10 stories
  3. Page 3: TLDR AITLDR AI · 9 stories
  4. Page 4: TLDR AI — continuedTLDR AI · 8 stories
  5. Page 5: TLDR DevTLDR Dev · 10 stories
  6. Page 6: TLDR InfoSecTLDR InfoSec · 13 stories
  7. Page 7: TLDR CryptoTLDR Crypto · 11 stories
  8. Page 8: TLDR ProductTLDR Product · 10 stories
  9. Page 9: TLDR DesignTLDR Design · 12 stories
  10. Page 10: TLDR FoundersTLDR Founders · 13 stories
  11. Page 11: TLDR MarketingTLDR Marketing · 12 stories
  12. Page 12: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 12 stories
  13. Page 13: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Product, TLDR Founders, TLDR Marketing · 14 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 6

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

BEATBANKER ANDROID TROJAN USES SILENT AUDIO LOOP TO STEAL CRYPTO

BeatBanker is a dual-mode Android Trojan distributed via a fake Google Play Store page that targets Brazilian users. Once active, it overlays fake screens on crypto apps like Binance and Trust Wallet to silently swap USDT destination wallet addresses, while also deploying the BTMOB RAT for full remote access, including camera, mic, GPS, and remote wipe. It plays an inaudible 5-second audio loop to prevent the OS from killing its background process. Treat unsolicited Accessibility permission requests as an immediate red flag and avoid sideloading APKs from third-party sites.

hackread.com · 2 min

TLDR InfoSec

POLYFILL SUPPLY CHAIN ATTACK IMPACTING 100K SITES LINKED TO NORTH KOREA

In 2024, Chinese CDN firm Funnull bought Polyfill[.]io and then used cdn.polyfill[.]io to push malicious JavaScript that redirected visitors to gambling and adult pages. Hudson Rock later linked Funnull to North Korean operators using LummaC2 infostealer data from a hacked North Korean hacker device, which exposed logins for Funnull DNS and the Polyfill Cloudflare tenant. The traffic went into Suncity Group gambling sites to launder large amounts of cryptocurrency back to North Korea and also exposed a separate North Korean agent inside crypto exchange Gate.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

OPERATION ROUNDISH: UNCOVERING AN APT28 ROUNDCUBE EXPLOITATION TOOLKIT TARGETING UKRAINE

Hunt.io uncovered an exposed open directory on 203.161.50[.]145 containing a complete APT28 Roundcube exploitation toolkit. This toolkit overlaps with 14 TTPs observed in Operation RoundPress, targeting Ukraine's State Migration Service using XSS payloads that simultaneously harvest credentials through hidden autofill forms, install persistent Sieve forwarding rules to advenwolf@proton[.]me, bulk exfiltrate emails via the viewsource API, extract TOTP secrets, steal address books, and deploy Chrome/Firefox credential stealers. New capabilities not previously linked to APT28 include a CSS selector side-channel attack for CSRF token extraction, a Go-based Linux backdoor with cron, systemd, and SELinux persistence mechanisms, along with container escape detection scripts. These scripts indicate regular targeting of Docker and Kubernetes environments. Defenders using Roundcube should immediately review all Sieve forwarding rules, implement a strict Content Security Policy that blocks eval() and external resource loading, monitor for bulk viewsource API requests and CSS @import chains with incrementing query parameters, and consider password resets insufficient without full 2FA re-enrollment and session invalidation.

hunt.io · 23 min

TLDR InfoSec

THE TENSOR IN THE HAYSTACK: WEIGHTSQUATTING AS A SUPPLY-CHAIN RISK

Weightsquatting is a supply-chain attack that manipulates token-space weights in open-weight LLMs to bias code-generation output toward attacker-chosen package names, surviving format conversion, 4-bit quantization, and GGUF export. Llama 3.2 and Qwen 2.5 accepted the poisoned edits cleanly while remaining coherent, whereas DeepSeek models either collapsed visibly or reasoned past the manipulation. Organizations deploying local coding assistants should implement routine behavioral validation of model artifacts against known-good dependency outputs before production use.

labs.itresit.es · 10 min

TLDR InfoSec

HOW I USE LLMS FOR SECURITY WORK

Many LLM users try to prompt an LLM the same way that they search Google: using keywords instead of rich prompts. The author of this post presents some tricks to more effectively prompt an LLM, such as role stacking, being explicit about the desired technology stack, requesting thoroughness, asking for validation, and thinking in terms of long-term systems vs. point-in-time solutions. They stress the importance of keeping humans in the loop to add judgment and intuition.

dispatch.thorcollective.com · 5 min

TLDR InfoSec

PROACTIVE PREPARATION AND HARDENING AGAINST DESTRUCTIVE ATTACKS: 2026 EDITION

Mandiant's 2026 hardening guide covers five core focus areas for defending against destructive cyberattacks: external-facing asset hardening, critical asset and backup protections, on-premises lateral movement controls, credential and account protections, and Kubernetes/CI/CD pipeline security. The guide provides prescriptive, actionable controls spanning MFA enforcement, virtualization enclave architecture, AD CS hardening, NTLM restriction, WDigest disablement, and LAPS deployment, each paired with MITRE ATT&CK-mapped detection opportunities. Organizations operating hybrid or cloud environments should treat this as a living reference, particularly given the guide's coverage of hypervisor-level disk swap attacks, immutable backup architecture, and CI/CD supply chain compromise scenarios.

cloud.google.com · 10 min

TLDR IndexPage 6