TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR InfoSec, TLDR, TLDR AI, TLDR IT, TLDR Fintech, TLDR Data, TLDR Crypto, TLDR Design · 9 stories
  2. Page 2: TLDR InfoSecTLDR InfoSec · 15 stories
  3. Page 3: TLDRTLDR · 15 stories
  4. Page 4: TLDR AITLDR AI · 8 stories
  5. Page 5: TLDR AI — continuedTLDR AI · 8 stories
  6. Page 6: TLDR ITTLDR IT · 12 stories
  7. Page 7: TLDR FintechTLDR Fintech · 15 stories
  8. Page 8: TLDR DataTLDR Data · 13 stories
  9. Page 9: TLDR CryptoTLDR Crypto · 11 stories
  10. Page 10: TLDR DesignTLDR Design · 9 stories
  11. Page 11: TLDR DevTLDR Dev · 13 stories
  12. Page 12: TLDR MarketingTLDR Marketing · 14 stories
  13. Page 13: Resources & ToolsTLDR Dev, TLDR InfoSec, TLDR Design, TLDR Data · 9 stories
  14. Page 14: SponsoredTLDR, TLDR AI, TLDR Dev, TLDR InfoSec, TLDR Marketing, TLDR Data, TLDR Fintech, TLDR IT · 16 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 2

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

GITHUB APP PRIVATE KEYS: 474 LEAKED KEYS EXPOSED

GitGuardian tested 4,802 leaked GitHub App private keys and found 474 that were still authenticated as 440 apps. Forty-four apps held organization-admin permissions. 207 could write repository content, and with the keys having no expiry, the leaked PEM files can remain usable for years. Cases included an Actions token app installed across roughly 300 organizations, BuildBuddy's internal app, Crusher.dev, and a CDC-related app.

blog.gitguardian.com · 11 min

TLDR InfoSec

THE TALE OF TWO INC RANSOM NOTES

An INC ransomware intrusion across 175+ endpoints started in early August with randomly named scheduled tasks launching an obfuscated PowerShell implant and RDP lateral movement. After 17 quiet days, AnyDesk delivered netscan.exe and a BYOVD EDR killer (hwau.exe loading the HwAudio driver), and Impacket's atexec.py deployed the payload. Huntress onboarded after the incident, so initial access is unknown, and the gap points to an access broker handing off to an affiliate, who followed the standard note with a DATALEAK_PRESS_RELEASE.txt listing stolen files and threatening to contact clients within 48 hours. Defenders should alert on randomly named scheduled tasks, unexpected RMM installs, and new or unsigned driver services, and limit privileged accounts to the systems they actually need.

huntress.com · 8 min

TLDR InfoSec

REVOKING THE TOKEN DIDN'T KILL THE BACKDOOR

GraphWorm, an implant tied to the China-nexus group Webworm, uses a real OneDrive account over Microsoft Graph as a dead drop, and its "upgrade" task swaps all five hardcoded OAuth credentials for a spare account in one command, so token revocation only pauses it. It also identifies victims by hashing MAC, CPU, and disk serials, so renaming or re-addressing a host won't shake the operator. Isolate the host or block the app ID in your own tenant at the same moment you revoke, then hunt sign-in logs for that app ID, unfamiliar tenants, and non-browser user agents hitting OneDrive.

csoonline.com · 6 min

TLDR InfoSec

HANDLE REDIRECT

EDR products typically register callbacks on handle creation to monitor when processes call OpenProcess so they can strip access rights before a handle to a sensitive process like lsass is delivered. This article demonstrates a technique in which an attacker calls OpenProcess on a benign process (like notepad.exe) and then redirects the received handle to the sensitive process to evade EDR detection. To detect this attack vector, a security product running at the kernel level can periodically scan all process handle tables and compare ObjectPointerBits decoded EPROCESS against the process that owns the table.

links.tldrnewsletter.com · 17 min

TLDR InfoSec

MICROSOFT DISRUPTS AI-ASSISTED PLATFORM THAT COMPROMISED 12,000 ACCOUNTS

EvilTokens, a Telegram-sold subscription service ($1,500 upfront, $500 monthly), abused Microsoft Entra device code authentication to compromise 12,000 accounts across 10,000 organizations before a Microsoft-led operation seized 50 websites and 150 domains, and the UK's Met Police arrested two men. Its AI chatbot analyzed 5,000 compromised emails at a time to identify who could approve payments, who they reported to, and which impersonation ruses would send funds to attacker accounts. Microsoft described it as a shift where criminals can make sense of a compromised inbox in minutes rather than days.

arstechnica.com · 3 min

TLDR InfoSec

NORTH KOREA'S HANGRO REVISITED

Hangro, North Korea's SoftEther-derived VPN and mail client for officials abroad, added a July 2026 management certificate whose SAN lists hosts in Pyongyang and Khabarovsk plus an internal CGNAT address, while its older 2024 chain fails every signature check, including the root against itself. Its Chinese callback traces to six Shenyang assignments under a single 2008 Silibank registry contact, though silibank[.]com lapsed and was re-registered in 2023. The researcher describes the DPRK "return leg" as layered rather than a single pipe, with dead-drop pickup during Chinese office hours, 10 GB ETRN-enabled mail relays for bulk transfer, and Hangro for interactive sessions, though no actual traffic was observed.

blog.synapticsystems.de · 20 min

TLDR IndexPage 2