Email: EvilTokens ring busted ⚖️, 474 GitHub keys leaked 🔑, INC ransomware intrusion 💀

Subject:
EvilTokens ring busted ⚖️, 474 GitHub keys leaked 🔑, INC ransomware intrusion 💀
Received:
9/24/2026, 1:10:21 PM
From:
"TLDR InfoSec" <dan@tldrnewsletter.com>
To:
silk.theater.56@fwdnl.com
&lt;!DOCTYPE html&gt;&lt;html lang="en"&gt;&lt;head&gt;&lt;meta http-equiv="Content-Type" content="text/html charset=UTF-8"&gt;&lt;meta charset="UTF-8"&gt;&lt;meta name="viewport" content="width=device-width"&gt;&lt;meta name="x-apple-disable-message-reformatting"&gt;&lt;title&gt;TLDR InfoSec&lt;/title&gt;&lt;meta name="color-scheme" content="light dark"&gt;&lt;meta name="supported-color-schemes" content="light dark"&gt;&lt;style type="text/css"&gt;
			:root {
				color-scheme: light dark; supported-color-schemes: light dark;
			}
			
			*,
			*:after,
			*:before {
				-webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box;
			}
			
			* {
				-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;
			}
			
			html,
			body,
			.document {
				width: 100% !important; height: 100% !important; margin: 0; padding: 0;
			}
			
			body {
				-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; text-rendering: optimizeLegibility;
			}
			
			div[style*="margin: 16px 0"] {
				margin: 0 !important;
			}
			
			table,
			td {
				mso-table-lspace: 0pt; mso-table-rspace: 0pt;
			}
			
			table {
				border-spacing: 0; border-collapse: collapse; table-layout: fixed; margin: 0 auto;
			}
			
			img {
				-ms-interpolation-mode: bicubic; max-width: 100%; border: 0;
			}
			
			*[x-apple-data-detectors] {
				color: inherit !important; text-decoration: none !important;
			}
			
			.x-gmail-data-detectors,
			.x-gmail-data-detectors *,
			.aBn {
				border-bottom: 0 !important; cursor: default !important;
			}
			
			.btn {
				-webkit-transition: all 200ms ease; transition: all 200ms ease;
			}
			
			.btn:hover {
				background-color: #f67575; border-color: #f67575;
			}
			
			* {
				font-family: Arial, Helvetica, sans-serif; font-size: 18px;
			}
			
			@media screen and (max-width: 600px) {
				.container {
					width: 100%; margin: auto;
				}
				.stack {
					display: block!important; width: 100%!important; max-width: 100%!important;
				}
				.btn {
					display: block; width: 100%; text-align: center;
				}
			}
			
			body,
			p,
			td,
			tr,
			.body,
			table,
			h1,
			h2,
			h3,
			h4,
			h5,
			h6,
			div,
			span {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			
			@media (prefers-color-scheme: dark) {
				body,
				p,
				td,
				tr,
				.body,
				table,
				h1,
				h2,
				h3,
				h4,
				h5,
				h6,
				div,
				span {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
			
			a {
				color: inherit !important; text-decoration: underline !important;
			}

		&lt;/style&gt;&lt;!--[if mso | ie]&gt;
		&lt;style type="text/css"&gt;
			a {
				background-color: #FEFEFE !important; color: #010101 !important;
			}
			@media (prefers-color-scheme: dark) {
				a {
					background-color: #27292D !important; color: #FEFEFE !important;
				}
			}
	 &lt;/style&gt;
			&lt;![endif]--&gt;&lt;/head&gt;&lt;body class=""&gt;



&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;EvilTokens, a Telegram-sold subscription service ($1,500 upfront, $500 monthly), abused Microsoft Entra device code authentication to&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;‌&nbsp;&lt;/div&gt;
&lt;div style="display: none; max-height: 0px; overflow: hidden;"&gt;
&lt;br&gt;
&lt;/div&gt;

&lt;table align="center" class="document"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" class="container" width="600"&gt;&lt;tbody&gt;&lt;tr class="inner-body"&gt;&lt;td&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr class="header"&gt;&lt;td bgcolor="" class="container"&gt;

&lt;table width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container"&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" style="margin-top: 0px;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div style="text-align: center;"&gt;
&lt;span style="margin-right: 0px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/-MFMp70fx70oosEkVlOp0yzrTmp0c6RIXmMiLtj2NWA=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Sign Up&lt;/span&gt;&lt;/a&gt;
|&lt;span style="margin-right: 2px; margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisetopnav/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/QmISk8omYWpmiGkWyBp4OM0SXEvDUA56jLgp7LXKOiM=452" rel="noopener noreferrer" target="_blank"&gt;&lt;span&gt;Advertise&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;|&lt;span style="margin-left: 2px;"&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Fweb-version%3Fep=1%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=c32358f0-b806-11f1-a602-f90dfad7d387%26pt=campaign%26t=1790255421%26s=a6b469600807591b509fe16cad5e1ea8cd7cf448ac959779bb1132ba46bc453d/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/zI4Crtau-of_T3UeQNOnZzND6wq3PgAvA6UYk-U7Smo=452"&gt;&lt;span&gt;View Online&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;
&lt;br&gt;
&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="text-align: center;"&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#3db3ff; color: rgb(51, 175, 255) !important; font-size: 30px;"&gt;T&lt;/span&gt;&lt;span style="font-size: 30px;"&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(232, 192, 96) !important; --darkreader-inline-color:#e8c163; font-size:30px;"&gt;L&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="color: rgb(101, 195, 173) !important; --darkreader-inline-color:#6ec7b2; font-size:30px;"&gt;D&lt;/span&gt;&lt;/span&gt;&lt;span data-darkreader-inline-color="" style="--darkreader-inline-color:#dd6e6e; color: rgb(220, 107, 107) !important; font-size: 30px;"&gt;R&lt;/span&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;br&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr id="together-with"&gt;&lt;td align="center" height="20" style="vertical-align:middle !important;" valign="middle" width="100%"&gt;&lt;strong style="vertical-align:middle !important; height: 100%;"&gt;Together With &lt;/strong&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F3sy0sq/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/kteOQzzgOzs64uHNWDwetOC-jKZP5MeGIJP5T-8IC_U=452"&gt;&lt;img src="https://images.tldr.tech/databricks.png" valign="middle" style="vertical-align: middle !important; height: 100%;" alt="Databricks"&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;TLDR Information Security &lt;span id="date"&gt;2026-09-24&lt;/span&gt;&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width:100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr id="sponsy-copy"&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F3sy0sq/2/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/BAUcxwv643-vNeljr4VAJRUXfZTC0VJ6I0yBpNW7uFc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Security is a data and AI problem. It can't be solved in a silo (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    You want to run securely, not translate vendor-specific schemas into usable formats, hunt down the IT and business context you need, or pay by the byte for the privilege.&nbsp;&lt;p&gt;&lt;/p&gt;&lt;p&gt;Security doesn't thrive in a SIEM silo. You need an open platform where you can use all your telemetry and enterprise context to tell real threats from false positives.&nbsp;&nbsp;&lt;/p&gt;&lt;p&gt;Lakewatch is an open, agentic SIEM built on the Databricks security lakehouse, so you can correlate 100% of your telemetry on one governed platform where agents handle triage, investigation and detection authoring at machine speed.&nbsp;&nbsp;&lt;/p&gt;&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2F3sy0sq/3/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/Xc5saQbthMcmUJfUeKViB5wX88DqZq-MiZlmtt2gPmo=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Dive into Lakewatch&nbsp;&lt;/span&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FqwVtpT/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/_yfUVMvG3D8YpC9VTfJWBUzc5E3ZI7IgjrTVJBzZaaM=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Learn the new AI Security Framework (DASF 3.0)&nbsp;&lt;/span&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FNUmtXT/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/j14WbUcc3zjk3aNK8c9xNKrUehkcWDorB2HTFNL3Foc=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Download the eBook: The Security Lakehouse — Outpacing AI Zero-Days&lt;/span&gt;&lt;/a&gt;


&lt;/p&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr bgcolor=""&gt;&lt;td class="container"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding: 0px;"&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🔓&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Attacks &amp; Vulnerabilities&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F09%2Fcritical-bifrost-ai-gateway-flaw-lets.html%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/pjTAs1jGyDuOS2t0OqYljatjDi34b_jYG_j6Cel3Mdc=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Bifrost, an open-source AI gateway for 20+ LLM providers, ships with management auth disabled by default, so a single unauthenticated POST to /api/mcp/client can register a stdio MCP client and run arbitrary commands as the gateway user (CVE-2026-90898, CVSS 9.8). That exposes every stored provider API key. The official Docker image binds the management API to 0.0.0.0, and v2.0.0 only fixed a related plugin-loading flaw (CVE-2026-86242, CVSS 8.1). Upgrade to transports/v2.1.0 or set governance.auth_config.is_enabled to true, and treat any exposed unauthenticated instance as compromised by rotating virtual and provider API keys.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FLp1K2G/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/QojfjBYwcgRvgXjGK_sWvFBW_glTkrtLrWOAj6_hAw8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;BigCommerce Data Stolen via Ribon Apps Hack (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Attackers used compromised Ribon API credentials from a Fastr system breach to access BigCommerce merchant customer data from September 13 to 17. Exposed records included names, email addresses, phone numbers, and postal addresses. BigCommerce revoked the credentials, uninstalled affected Ribon apps, and notified merchants.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fblog.gitguardian.com%2Fgithub-app-private-keys-leaked%2F%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/pdshbQqYsz9JPCeHV5d9Bj_mxkJ4hmcJAD3aCqIzOkw=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;GitHub App Private Keys: 474 Leaked Keys Exposed (11 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    GitGuardian tested 4,802 leaked GitHub App private keys and found 474 that were still authenticated as 440 apps. Forty-four apps held organization-admin permissions. 207 could write repository content, and with the keys having no expiry, the leaked PEM files can remain usable for years. Cases included an Actions token app installed across roughly 300 organizations, BuildBuddy's internal app, Crusher.dev, and a CDC-related app.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧠&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Strategies &amp; Tactics&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.huntress.com%2Fblog%2Ftwo-inc-ransom-notes%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/0CYPD1YHqrbe_UGV-Puc4DDln7MiHRTmvxMFlDVqE0Q=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;The Tale of Two INC Ransom Notes (8 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    An INC ransomware intrusion across 175+ endpoints started in early August with randomly named scheduled tasks launching an obfuscated PowerShell implant and RDP lateral movement. After 17 quiet days, AnyDesk delivered netscan.exe and a BYOVD EDR killer (hwau.exe loading the HwAudio driver), and Impacket's atexec.py deployed the payload. Huntress onboarded after the incident, so initial access is unknown, and the gap points to an access broker handing off to an affiliate, who followed the standard note with a DATALEAK_PRESS_RELEASE.txt listing stolen files and threatening to contact clients within 48 hours. Defenders should alert on randomly named scheduled tasks, unexpected RMM installs, and new or unsigned driver services, and limit privileged accounts to the systems they actually need.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.csoonline.com%2Farticle%2F4223975%2Frevoking-the-token-didnt-kill-the-backdoor.html%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/i7dBaN4MLqm1odM0FwzWH9-9jSUaWsu6AFKsGCY6xPA=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Revoking the token didn't kill the backdoor (6 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    GraphWorm, an implant tied to the China-nexus group Webworm, uses a real OneDrive account over Microsoft Graph as a dead drop, and its "upgrade" task swaps all five hardcoded OAuth credentials for a spare account in one command, so token revocation only pauses it. It also identifies victims by hashing MAC, CPU, and disk serials, so renaming or re-addressing a host won't shake the operator. Isolate the host or block the app ID in your own tenant at the same moment you revoke, then hunt sign-in logs for that app ID, unfamiliar tenants, and non-browser user agents hitting OneDrive.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Flinks.tldrnewsletter.com%2FxMXmyI/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/9scD6TElIlhqNgEhHv90Xz9YJ70BINlnBEmzZe423RM=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Handle Redirect (17 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    EDR products typically register callbacks on handle creation to monitor when processes call OpenProcess so they can strip access rights before a handle to a sensitive process like lsass is delivered. This article demonstrates a technique in which an attacker calls OpenProcess on a benign process (like notepad.exe) and then redirects the received handle to the sensitive process to evade EDR detection. To detect this attack vector, a security product running at the kernel level can periodically scan all process handle tables and compare ObjectPointerBits decoded EPROCESS against the process that owns the table.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🧑‍💻&lt;/span&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Launches &amp; Tools&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fpages.awscloud.com%2Fawsmp-gim-i0v9-webinar-sec-grc-security-lab-grc-security-lab.html%3Ftrk=351a7c3a-1186-4574-a8eb-5f5b9837c220%26sc_channel=el%26sp=ZJfkIJq6qY20olSXnimOM5b0/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/EeVds9XzqIEteBGuFNlxPQOk_yGUy8vHRjK8ZE5l7-o=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Secure cloud AI with stronger GRC (Sponsor)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Watch this on-demand security demo from AWS and SANS Institute to see how governance, risk, and compliance strategies can help address risk across identity, data, APIs, and agentic workflows. Learn approaches for access control, data protection, and visibility. &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fpages.awscloud.com%2Fawsmp-gim-i0v9-webinar-sec-grc-security-lab-grc-security-lab.html%3Ftrk=351a7c3a-1186-4574-a8eb-5f5b9837c220%26sc_channel=el%26sp=ZJfkIJq6qY20olSXnimOM5b0/2/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/Qr6QifxfFub9963G4xXOUEShHykBsPUVLJ5WgRclpRY=452" rel="noopener noreferrer nofollow" target="_blank"&gt;&lt;span&gt;Watch now and explore AWS Partner solutions in AWS Marketplace.&lt;/span&gt;&lt;/a&gt;
&lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.outerlimit.com%2F%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/Co5CJsZ1JeqvW-7XV3hLAqHV_iV9md8gCgGYn-I6q80=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Outerlimit (Product Launch)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Outerlimit provides a decentralized authorization layer for autonomous software agents. It finds agents, monitors behavior, and enforces policies at execution time. The system restricts token use by scope, location, and conditions.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2FOrbitCurve%2Ffirmware-reverse-engineering%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/9cHsUPjvnhTZVlNP6qdgzAOs4Ux_Fo5JqUBPGMWjZhI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Firmware Reverse Engineering Skills (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    A collection of five agent skills for firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fgithub.com%2Fimmanuwell%2Fpktz%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/UlOSX9r8BK6WxBigtZwmNLptvpR7z8IUAJmquMziQv8=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;pktz (GitHub Repo)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    pktz is an eBPF-powered network traffic monitor with per-process and per-connection reporting.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;


&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;🎁&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;strong&gt;&lt;h1&gt;Miscellaneous&lt;/h1&gt;&lt;/strong&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Farstechnica.com%2Fsecurity%2F2026%2F09%2Fmicrosoft-disrupts-ai-assisted-platform-that-compromised-12000%2F%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/CrI5KsSpqv79puaIJiodNBIbvMALhDR92D8mni1Arlk=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Microsoft disrupts AI-assisted platform that compromised 12,000 accounts (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    EvilTokens, a Telegram-sold subscription service ($1,500 upfront, $500 monthly), abused Microsoft Entra device code authentication to compromise 12,000 accounts across 10,000 organizations before a Microsoft-led operation seized 50 websites and 150 domains, and the UK's Met Police arrested two men. Its AI chatbot analyzed 5,000 compromised emails at a time to identify who could approve payments, who they reported to, and which impersonation ruses would send funds to attacker accounts. Microsoft described it as a shift where criminals can make sense of a compromised inbox in minutes rather than days.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fblog.synapticsystems.de%2Fnorth-koreas-hangro-revisited%2F%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/jsEczJrcLQJSeukZWFyT2WUmGKfr63l8QO6T6cfEe1o=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;North Korea's Hangro Revisited (20 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Hangro, North Korea's SoftEther-derived VPN and mail client for officials abroad, added a July 2026 management certificate whose SAN lists hosts in Pyongyang and Khabarovsk plus an internal CGNAT address, while its older 2024 chain fails every signature check, including the root against itself. Its Chinese callback traces to six Shenyang assignments under a single 2008 Silibank registry contact, though silibank[.]com lapsed and was re-registered in 2023. The researcher describes the DPRK "return leg" as layered rather than a single pipe, with dead-drop pickup during Chinese office hours, 10 GB ETRN-enabled mail relays for bulk transfer, and Hangro for interactive sessions, though no actual traffic was observed.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fthehackernews.com%2F2026%2F09%2Fanthropic-and-openai-models-still.html%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/ryRvKXbe1OSeSko2B5QtLT53xy8LUZY-OFjj4HAeKWk=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests (3 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Anthropic's Opus 5.5 escaped or tampered with its sandbox in 1.5% of unguarded tests. With package-registry credentials, it took harmful actions in roughly half of simulated exercises. OpenAI's GPT-6 Luna bypassed “access denied” controls in 42% of runs - Sol did so in 64%. OpenAI plans third-party reviews covering safeguards, capabilities, and misalignment incidents.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;&lt;span style="font-size: 36px;"&gt;⚡&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding-top: 0px; padding-bottom: 0px;"&gt;
&lt;div class="text-block"&gt;
&lt;div style="text-align: center;"&gt;

&lt;h1&gt;&lt;strong&gt;Quick Links&lt;/strong&gt;&lt;/h1&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table bgcolor="" style="table-layout: fixed; width: 100%;" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="padding:0;border-collapse:collapse;border-spacing:0;margin:0;" valign="top"&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F09%2F22%2Fuk-cops-arrest-2-eviltokens-suspects-microsoft-seizes-50-phishing-kit-websites%2F5298317%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/hz-HfK9k0tIxxdSKOlrO7CkXvRtmdqS6FZJ0w7X_Wjk=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    Microsoft and UK police disrupted EvilTokens, a Microsoft device-code phishing service.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block"&gt;
&lt;span&gt;
                                &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftechcrunch.com%2F2026%2F09%2F22%2Fstolen-passwords-are-exposing-americas-water-providers-to-hackers%2F%3Futm_source=tldrinfosec/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/4aVRhk2PiCfT7qchG5w2iLE19hLu0PGdethHj_l9svI=452"&gt;
                                    &lt;span&gt;
                                        &lt;strong&gt;Stolen passwords are exposing America's water providers to hackers (2 minute read)&lt;/strong&gt;
                                    &lt;/span&gt;
&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;span style="font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, Verdana, sans-serif;"&gt;
                                    SpyCloud found stolen credentials at 1,787 of 10,000 US water providers reviewed.
                                &lt;/span&gt;
&lt;/span&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Love TLDR? Tell your friends and get rewards!
&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td class="container" style="padding: 0px 10px 15px;"&gt;
&lt;div class="text-block"&gt;
Share your referral link below with friends to get free TLDR swag!
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding: 10px;"&gt;
&lt;div class="text-block"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Frefer.tldr.tech%2F78de0e20%2F8/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/IJFeNDwqvo91GJWhx9EMmeOMBnAYWPhlKHMu6Gbo00A=452" style="color: #464ba4; text-decoration: underline;"&gt;https://refer.tldr.tech/78de0e20/8&lt;/a&gt;
&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td align="left" style="padding:5px 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fhub.sparklp.co%2Fsub_d62447d5a74a%2F8/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/L9BDxz0gxueK-DR67DNDbuAMv0s5kbVOP-PsITeDkaI=452" style="font-size: 16px; line-height: 1.6;  padding: 10px 0; display: inline-block;  text-decoration: underline;"&gt;&lt;span style="mso-text-raise:13pt; text-decoration: underline;"&gt;Track your referrals here.&lt;/span&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;




&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td align="left" style="word-break: break-word; vertical-align: top; padding: 5px 10px;"&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to advertise in TLDR? 📰
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fadvertise.tldr.tech%2F%3Futm_source=tldrinfosec%26utm_medium=newsletter%26utm_campaign=advertisecta/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/xnDlfKTIQja5aHolLpMxo9VCtHmu4U8okW3YYYGukM8=452"&gt;&lt;strong&gt;&lt;span&gt;advertise with us&lt;/span&gt;&lt;/strong&gt;&lt;/a&gt;.
&lt;/div&gt;
&lt;br&gt;

&lt;!-- New "Want to work at TLDR?" section --&gt;

&lt;p style="padding: 0; margin: 0; font-size: 22px; color: #000000; line-height: 1.6; font-weight: bold;"&gt;
Want to work at TLDR? 💼
&lt;/p&gt;
&lt;div class="text-block" style="margin-top: 10px;"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/LWuQ9lZGBBppBf2D5olXf6PRTUIU213ZyTGBib4IMf0=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Apply here&lt;/strong&gt;&lt;/a&gt;,
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fjobs.ashbyhq.com%2Ftldr.tech%2Fc227b917-a6a4-40ce-8950-d3e165357871/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/nq9uY79JPqXhcnjCemHZ4IvN3NYG7ygcI92mHaVk990=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;create your own role&lt;/strong&gt;&lt;/a&gt; or send a friend's resume to &lt;a href="mailto:jobs@tldr.tech" style="color: #0000EE; text-decoration: underline;"&gt;jobs@tldr.tech&lt;/a&gt; and get $1k if we hire them! TLDR is one of &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Ffeed%2Fupdate%2Furn:li:activity:7401699691039830016%2F/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/gsZhxgR4qxHDXw34CuaCzztordclPrl9qVHutcz0qRQ=452" rel="noopener noreferrer" style="color: #0000EE; text-decoration: underline;" target="_blank"&gt;&lt;strong&gt;Inc.'s Best Bootstrapped businesses&lt;/strong&gt;&lt;/a&gt; of 2025.
&lt;/div&gt;
&lt;br&gt;

&lt;div class="text-block"&gt;
If you have any comments or feedback, just respond to this email!
&lt;br&gt;
&lt;br&gt; Thanks for reading,
&lt;br&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fprasannagautam%2F/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/4KO8NKzz3z97gJ8q2a8vrEYyTFRhWvcDJVpmgrgU2Js=452"&gt;&lt;span&gt;Prasanna Gautam&lt;/span&gt;&lt;/a&gt;, &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fericfernandezdelcampo%2F/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/wN3umrfzqUNNv19_yikMzBoJ4GdUGkygGv0Du-ZuiUQ=452"&gt;&lt;span&gt;Eric Fernandez&lt;/span&gt;&lt;/a&gt; &amp; &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fwww.linkedin.com%2Fin%2Fsammy-tbeile%2F/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/0AnF3pn0FUHfsPBFnexDvUczgAAQ8aLNaK8Q7GVKpzc=452"&gt;&lt;span&gt;Sammy Tbeile&lt;/span&gt;&lt;/a&gt;
&lt;br&gt;
&lt;br&gt;
&lt;/div&gt;
&lt;br&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;table align="center" bgcolor="" border="0" cellpadding="0" cellspacing="0" width="100%"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td class="container" style="padding: 15px 15px;"&gt;
&lt;div class="text-block" id="testing-id"&gt;
&lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Ftldr.tech%2Finfosec%2Fmanage%3Femail=silk.theater.56%2540fwdnl.com/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/jDro6YxzsrH8qFKCEY9SIvnV1pQv-fP7f5VIBANnBZE=452"&gt;Manage your subscriptions&lt;/a&gt; to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please &lt;a href="https://tracking.tldrnewsletter.com/CL0/https:%2F%2Fa.tldrnewsletter.com%2Funsubscribe%3Fep=1%26l=8d9cea11-3e94-11ed-9a32-0241b9615763%26lc=156924ca-84b7-11f0-8d58-47c5c04ad337%26p=c32358f0-b806-11f1-a602-f90dfad7d387%26pt=campaign%26pv=5%26spa=1790254903%26t=1790255421%26s=176d37fd0773c1f683cd083fa4a20cf508fd57c21b8bca0ded8f901ab2a05390/1/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/rLFJ-VFbcBpRBqEnr2eWLGWLkbK7NqHov4MJBeK3Ml4=452"&gt;unsubscribe&lt;/a&gt;.
&lt;br&gt;

&lt;/div&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;



&lt;img alt="" src="http://tracking.tldrnewsletter.com/CI0/010001a0d389d9fc-849a2cb9-d6f8-4381-af15-614efbbca3a0-000000/skBo1jkFttOQfO3ig_m43HcjrHZuZ8bXp_jl-382yk4=452" style="display: none; width: 1px; height: 1px;"&gt;
&lt;/body&gt;&lt;/html&gt;
Email Content
