TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 10 stories
  3. Page 3: TLDR AITLDR AI · 12 stories
  4. Page 4: TLDR DevTLDR Dev · 13 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 12 stories
  8. Page 8: TLDR FoundersTLDR Founders · 10 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 14 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 15 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

AUTHORITIES DISRUPT SOCKSESCORT PROXY BOTNET EXPLOITING 369,000 IPS ACROSS 163 COUNTRIES

Law enforcement shut down the SocksEscort proxy service, which sold traffic tunneled through 369,000 infected home and small-business routers in 163 countries since at least 2021. Operation Lightning seized 34 domains, 23 servers, and froze $3.5 million in crypto linked to more than €5 million in proxy sales. Criminals used the network for fraud, ransomware, DDoS, and CSAM, abusing RCE and command injection flaws in some 1,200 router models and, in some cases, flashing custom firmware that permanently disabled updates.

thehackernews.com · 4 min

TLDR InfoSec

MALWARE INSIGHTS: MACOS PHEXIA CAMPAIGN

The Phexia Campaign, likely linked to APT28, deploys a four-stage macOS attack chain initiated via a ClickFix prompt that tricks users into pasting a base64-obfuscated osascript payload into Terminal, establishing LaunchAgent persistence at ~/Library/LaunchAgents/com.components.campaign-id.plist and polling a Telegram bot for live C2 domain updates. The implant uses tccutil reset All to clear TCC permissions and resurface permission dialogs, masquerades a credential-harvesting dialog as System Preferences with 150 retry loops to capture the macOS user password, then, every 60 seconds, pulls and executes a Phexia Stealer osascript payload targeting all crypto wallets, browsers, Keychain, and Telegram auth data. Defenders should alert on launchctl load activity writing to ~/Library/LaunchAgents, monitor for tccutil reset All execution, block vdsina[.]com-hosted domains at the DNS layer, and treat any Terminal paste prompt from a website as an immediate IOC.

cookie.engineer · 6 min

TLDR InfoSec

THE RETURN OF PHANTOMRAVEN: DETECTING THREE NEW WAVES OF NPM SUPPLY CHAIN ATTACKS

Endor Labs identified 88 new malicious npm packages across three PhantomRaven waves (Waves 2–4) published between November 2025 and February 2026, with 81 packages still live and two C2 servers still active, both AWS EC2 instances running plaintext HTTP on port 80. The campaign abuses Remote Dynamic Dependencies (RDD) like HTTP URL entries in package.json that cause npm itself to fetch and execute a 259-line credential-harvesting payload from attacker infrastructure at install time, exfiltrating developer emails, CI/CD tokens, and full system fingerprints via triple-redundant GET/POST/WebSocket channels to PHP endpoints jpd.php and npm.php. Defenders should reject any npm package with non-registry URL dependencies, block outbound HTTP to domains matching the artifact-themed C2 pattern, and audit CI/CD pipelines for token exposure across the 50+ disposable npm accounts attributed to this operator.

endorlabs.com · 15 min

TLDR InfoSec

WE SCANNED 1,808 MCP SERVERS. 66% HAD SECURITY FINDINGS

MCP servers have rapidly become the default integration layer for AI agents, but large‑scale scanning of 1,808 servers shows that 66% expose security issues. The riskiest patterns are code execution, toxic cross‑server data flows, and tool‑description prompt injection, which enable data exfiltration, supply‑chain attacks, and even zero‑click RCE via clients like IDEs and desktop agents. Real incidents demonstrate that MCP01–MCP06‑style issues are already being exploited in production. Security‑minded teams should treat MCP as a live attack surface: check servers against the MCP Security Registry, tightly scope tokens, test system prompts, and rigorously review tool and config changes before granting autonomous access.

agentseal.org · 14 min

TLDR InfoSec

WHEN TRUSTED WEBSITES TURN MALICIOUS: WORDPRESS COMPROMISES ADVANCE GLOBAL STEALER OPERATION

Rapid7 Labs identified an active campaign compromising over 250 legitimate WordPress sites across 12 countries, injecting a fake Cloudflare CAPTCHA ClickFix lure that tricks Windows users into pasting a PowerShell command that downloads the DoubleDonut shellcode loader, ultimately delivering Vidar Stealer v2, a newly identified .NET stealer dubbed Impure Stealer, and a new campaign-specific C++ stealer named VodkaStealer. The attack chain runs almost entirely in memory, injecting payloads into svchost.exe via VirtualAllocEx and CreateRemoteThread to evade file-based detection, while the ClickFix JavaScript actively filters out WordPress admin cookies, known bot user agents, and wp-admin referrers to avoid tipping off site owners. WordPress administrators should restrict public access to wp-admin, enforce MFA, audit plugins for known-vulnerable versions, and review Rapid7's published YARA rules and IOCs to detect this campaign.

rapid7.com · 15 min

TLDR InfoSec

WIZ INVESTOR UNPACKS GOOGLE'S $32B ACQUISITION

Google closed its $32 billion acquisition of Wiz this week, marking the largest acquisition in Google's history and the largest ever of a venture-backed startup. Index Ventures' Shardul Shah, Wiz's largest shareholder, attributes the outcome to the founding team's track record and Wiz's position at the intersection of AI, cloud, and security — the three dominant enterprise spending categories. The deal signals growing consolidation in cloud security, with hyperscalers moving to acquire best-of-breed CSPM platforms rather than build them in-house.

techcrunch.com · 3 min

TLDR InfoSec

INTERPOL OPERATION SYNERGIA III SHUTS DOWN 45,000 MALICIOUS IPS, 94 ARRESTED

Operation Synergia III, a six-month INTERPOL-coordinated effort spanning 72 countries from July 2025 to January 2026, resulted in the seizure of 45,000 malicious IPs and servers, 94 arrests, 110 suspects under active investigation, and over 200 devices and servers confiscated—doubling the scope of 2024's Synergia II. The targeted infrastructure included phishing sites, ransomware networks, and social engineering operations, with notable actions in Macau (33,000 fraudulent websites identified), Bangladesh (40 arrests), and Togo (dismantling a romance scam and sextortion ring). A separate but concurrent operation by European and US authorities dismantled SocksEscort, a residential proxy network used to launder malicious traffic, seizing 34 domains, 23 servers, and approximately $3.5 million in cryptocurrency.

hackread.com · 2 min

TLDR IndexPage 5