TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR DevOps, TLDR InfoSec, TLDR Crypto, TLDR AI, TLDR Marketing, TLDR Hardware, TLDR IT · 9 stories
  2. Page 2: TLDR DevOpsTLDR DevOps · 8 stories
  3. Page 3: TLDR InfoSecTLDR InfoSec · 11 stories
  4. Page 4: TLDR CryptoTLDR Crypto · 12 stories
  5. Page 5: TLDR AITLDR AI · 14 stories
  6. Page 6: TLDR HardwareTLDR Hardware · 12 stories
  7. Page 7: TLDR MarketingTLDR Marketing · 13 stories
  8. Page 8: TLDRTLDR · 14 stories
  9. Page 9: TLDR DevTLDR Dev · 12 stories
  10. Page 10: TLDR DesignTLDR Design · 12 stories
  11. Page 11: TLDR FoundersTLDR Founders · 10 stories
  12. Page 12: TLDR ITTLDR IT · 10 stories
  13. Page 13: Resources & ToolsTLDR AI, TLDR Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR DevOps · 12 stories
  14. Page 14: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR Crypto, TLDR Founders, TLDR Marketing, TLDR DevOps, TLDR IT · 13 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 3

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

RELIAQUEST CONFIRMS SHINYHUNTERS HACK

ShinyHunters ran a phishing campaign using "company.claims" domains, then called ReliaQuest staff posing as security employees to push them to a fake SSO page. One employee entered a password and approved a push notification, giving attackers a brief session on the identity dashboard. ReliaQuest says access was view-only, all further access attempts were blocked, no other identities or business apps were reached, no customer data was taken, and no ransomware was involved.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

HACKERS PLACE FAKE CODEX DOWNLOAD ABOVE LEGITIMATE OPENAI RESULT TO INFECT MAC USERS

Threat actors are leveraging sponsored Google Search ads to position fake OpenAI Codex download pages above legitimate results. The campaign utilizes a ClickFix-style social engineering trick to convince macOS users to paste a malicious Terminal command that decodes a Base64 URL, strips quarantine attributes using xattr -c, and drops a universal Mach-O payload linked to Atomic macOS Stealer (AMOS) infrastructure. Security teams should proactively block associated domains like brightlinks[.]com and configure SIEM alerts for any curl-to-zsh pipelines paired with xattr -c execution.

gbhackers.com · 3 min

TLDR InfoSec

TEXT TEMPLATE

T4 template files (.tt) run C# or VB code at build time through TextTransform.exe, TextTransformCore.exe, t4.exe, and MSBuild.exe. Attackers can plant malicious .tt files on developer machines or in build pipelines to trigger code execution, including supply chain scenarios. This post provides working PoC templates that spawn calc.exe or a MessageBox, and shows how tampering a .csproj with TextTemplatingFileGenerator entries lets MSBuild.exe compile and run arbitrary .tt code via the /t:Transform flag. Detection relies on Sysmon: process creation for the four binaries, image loads of three Microsoft.TextTemplating DLLs (only with MSBuild), and file creation in %Temp% during MSBuild transforms, since t4.exe also spawns dotnet.exe and csc.dll to compile the payload.

ipurple.team · 7 min

TLDR InfoSec

AUDITING MICROSOFT DEFENDER AND INTUNE CONFIGURATION CHANGES

Microsoft's unified Defender SecOps portal contains a critical logging gap: changes to security-critical settings, such as Tamper Protection and Intune device policies, do not generate default alerts. To maintain a reliable audit trail of configuration changes, security teams must manually engineer custom detections. This requires enabling Unified Audit Log integration, forwarding Purview audit data into the CloudAppEvents table via Defender for Cloud Apps, and actively routing Intune operational logs to Log Analytics for KQL-based hunting.

jeffreyappel.nl · 11 min

TLDR InfoSec

STAYING AHEAD OF ADVERSARIAL AI THROUGH AGENTIC SOURCE CODE REVIEW

Mandiant's Agentic Vulnerability Discovery Harness (AVDH) is a Gemini-powered multi-agent pipeline built on Google's Agent Development Kit. The tool conducts deep source code reviews by autonomously chaining threat modeling, entry-point discovery, and hypothesis generation before escalating confirmed findings for human validation. Mandiant positions the harness as a point-in-time, deep-dive complement to continuous scanning tools like CodeMender, establishing a robust two-layered defensive strategy.

cloud.google.com · 9 min

TLDR InfoSec

THREAT HUNTING USING PAIR PROBABILITIES

A KQL threat hunting technique built on Microsoft's pair_probabilities_fl() user-defined function calculates how statistically unusual a categorical pair (like a binary and its execution directory) is across a dataset, surfacing outliers such as cmd.exe launching from a user's Desktop instead of System32. The author extended the function to return top co-occurring values, per-device context, and occurrence counts alongside the core probability metrics (P_A|B, Lift, and Jaccard), making rare pairings easier to triage. The approach is explicitly framed as a statistical rarity detector rather than a maliciousness classifier, useful for narrowing investigation scope but unreliable on small datasets or environments where malicious activity has already been baked into the baseline.

detect.fyi · 7 min

TLDR InfoSec

THOUGHTS ON RESPONSIBLE DISCLOSURE

Security researchers at Mysk publicly disclosed three WebKit vulnerabilities that leak users' DNS traffic and real IP addresses, successfully bypassing privacy protections in iCloud Private Relay and proxy-based browsers like Tor. Frustrated by Apple's historically slow patch cycles, the team bypassed standard coordinated disclosure, opting to publicly release the details after privately securing mitigations for Psylo and the Onion Browser. While Apple patched iCloud Private Relay within two weeks of the announcement, the underlying WebKit proxy flaws remain active, forcing affected users to rely on full-device VPNs for comprehensive protection.

mysk.blog · 9 min

TLDR IndexPage 3