The Daily Index — Monday, September 14, 2026

GENERAL

TLDR InfoSec

free

Summary unavailable

fingerprint.com

TLDR InfoSec

TREZOR SAYS 347,000 USERS RECEIVED PHISHING EMAILS AFTER BREVO HACK

Attackers abused a Brevo SAML SSO scoping flaw to access 138 accounts. They sent a fake Trezor security alert to 347,000 addresses linked to a site seeking wallet backups. About 2,500 recipients clicked before takedown, 20 minutes after detection. Brevo reported contact exfiltration from 43 accounts, and BitBox and CoinTracking were also affected.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

REVOLUT CONFIRMS CUSTOMER DATA BREACH THROUGH FAKE GOVERNMENT REQUESTS

Revolut disclosed customer data after fraudulent requests arrived from a legitimate government email domain. Exposed records included identity and contact details, passports or driving licenses, and possibly verification selfies, statements, and transaction histories. Revolut says a limited number of customers were affected, blocked the sender, notified victims, and alerted the agency, police, and regulators.

techcrunch.com · 2 min

TLDR InfoSec

THE SELF-EXPANDING STOLEN INFERENCE SUPPLY CHAIN: AN AI AGENT HARVESTING AND RE-SERVING LLM ACCESS

An attacker's coding agent picked a SANS ISC honeypot as a free LLM backend and leaked 43 KB of its own control plane, including its offensive playbook, harvested API keys, and the operator's unproxied egress IP. The playbook hunts exposed LLM resale gateways, farms accounts via open registration, default credentials, and group_id authorization flaws, then aggregates the working keys into a self-hosted New-API gateway that re-serves them as five model names. Gateway operators should audit for those same weaknesses, and anyone routing an agent through a cheap LLM proxy should assume that endpoint is reading their project instructions and source context.

isc.sans.edu · 5 min

TLDR InfoSec

BEHIND THE CAPTCHA: CLICKFIX, WALLSTEALER AND A HIDDEN MINER

A fake Cloudflare "verify you're human" page copies a hidden PowerShell command to the clipboard and tells the user to paste it into the Run box, which downloads malware into %TEMP%. The files on that server included two copies of WallStealer, which steals browser passwords, cookies, payment cards, and Telegram, Discord, Steam, and wallet data, and finds its C2 server by reading the display name off hardcoded Steam profiles instead of a fixed domain. A third file dropped an XMRig crypto miner into C:\ProgramData\NVDisplay, so watch for pasted commands running from Run, new executables in %TEMP%, and machines requesting Steam profile pages.

ctrlaltintel.com · 4 min

TLDR InfoSec

WHERE DO DETECTIONS COME FROM?

Detect.fyi detection engineers identify four information sources that can inform building detections: visibility, existing internal or external detections, environment, and threat intel. Detection engineers can choose any of these sources to start developing from and then use the other three as filters into what detections they should write. The authors also caution against focusing too much on trying to create detections for every piece of threat intel that comes out.

detect.fyi · 10 min

TLDR InfoSec

HUNDREDS OF AI AGENTS HELPED PAPERCUT ATTACKER HIT 395+ ORGS, AND SOME WENT OFF SCRIPT

An attacker exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 instances at 395 organizations in 48 countries. Education accounted for 204 victims. The US had 98 and the UK 59. One school reached domain-admin compromise within seven minutes. Updated PaperCut maintenance releases are available, so upgrade ASAP.

theregister.com · 3 min

TLDR InfoSec

‘WE MUST SLOW THE PACE': CEO OF ANTHROPIC CALLS FOR AN AI SLOWDOWN

Anthropic CEO Dario Amodei proposed independent evaluators with employee-level access to test safeguards, report incidents, and assess systems during training. OpenAI's Sam Altman said it would match that access. Amodei cited an incident where OpenAI agent swarms carried out unrequested attacks against Hugging Face targets, warning that stronger misaligned systems could cause far greater damage.

theguardian.com · 4 min

TLDR InfoSec

GRAND THEFT AUTO VI HYPE LEADS TO MALWARE

Fake "leaked GTA6" ISOs spread through SEO poisoning, gaming forums, and torrent sites deliver a Russian-language installer that pre-warns of a "License not found" error, giving victims a reason for the missing game while payloads drop into %TEMP%. Huntress found one sample bundling NJRAT, DCRAT, the Mercurial Grabber infostealer, and Chaos ransomware, which runs as a wiper that deletes shadow copies and destroys files. Everything in it is years old and detected by current Defender, so hunt for GTA6-branded executables in %TEMP% and hosts file entries sinkholing AV domains, then reimage affected hosts.

huntress.com · 5 min

TLDR InfoSec

THREAT ACTOR GENERATES 1M PERSONALIZED FRAUD EMAILS IN 3 DAYS

An unidentified actor sent more than one million invoice-fraud emails from August 3 to 5 impersonating ServiceNow, sought payments near $50,000, and targeted accounts-payable staff.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

THOROUGH REORGANIZATION AT NSA WILL CREATE FIVE 'MISSION CENTERS,' INCLUDING CYBER AND AI

NSA is being recast into five mission centers covering China, cybersecurity, AI, combat support, and global intelligence under a 30-day clock set by Gen.

therecord.media · 3 min

TLDR InfoSec

OVER 36,000 EXPOSED PLEX SERVERS VULNERABLE TO RECENT FLAWS

Shadowserver reports over 36,000 internet-exposed Plex Media Servers running v1.43.2 or earlier, with 16,000 in the US.

links.tldrnewsletter.com · 2 min