Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: ClickFix Goes Industrial

Stories

🗞️ New Multi-Language Malware Alert: Unpacking the SynkLoader Threat (Expel) — A highly evasive loader delivered via Microsoft Teams phishing from actors posing as the internal “IT Service Desk,” dropping a fake lock screen to harvest credentials and building a hidden network tunnel. It throws everything but the kitchen sink at evasion, shipping a self-contained Python environment and blending multiple languages purely in-memory to sidestep traditional AV. 🔎 Threat Hunting Package

🗞️ WordlistLoader: A New Threat Delivering Amatera Stealer via Fake CAPTCHAs (Gen Threat Labs) — Malicious JavaScript injected into legitimate sites serves fake CAPTCHA overlays that trick visitors into manually executing shellcode, which the loader rebuilds from a sequence of plain English words at one word per byte, before unhooking loaded modules and bypassing ETW using hardware breakpoints. 🔎 Threat Hunting Package

🗞️ Fake Codex ClickFix Campaign Abuses Trust to Deploy Malicious PowerShell Payloads (Cato Networks) — Attackers masquerade as legitimate AI coding tools and use fake error prompts to get developers to paste base64-encoded PowerShell into their own terminals, exploiting no vulnerability whatsoever, and bypassing network controls entirely because the victim does the execution locally. 🔎 Threat Hunting Package

🗞️ Malicious npm Packages Exploited as ClickFix Phishing Hosts (OX Security) — 24 packages abuse the npm registry to host a fake Cloudflare CAPTCHA campaign, and the packages themselves are harmless if installed because the attack is pure infrastructure abuse, borrowing the credibility of unpkg, npmmirror, and yarn to fully render phishing pages without tripping standard security alerts. 🔎 Threat Hunting Package

🗞️ WeedHack Malware Weaponizes SEO Poisoning & Discord (McAfee Labs) — A resurgent infostealer campaign aimed at Minecraft players hunting for Xenon, Glazed, and Radium clients, now pivoting after takedowns to AI-generated replica websites that rank at the top of Google via SEO poisoning, with Discord alone accounting for 49.6% of the malicious URLs. 🔎 Threat Hunting Package

Recommendations

☑️ Run a targeted ClickFix awareness push: no legitimate website verification, CAPTCHA, or internal IT helpdesk will ever ask a user to copy a command into the Run dialog, cmd, or PowerShell.

☑️ Treat Microsoft Teams as a phishing channel — restrict external tenant chat and specifically warn staff about fake “IT Service Desk” contacts pushing tools like a “PowerShell Cleaner.”

☑️ Enable PowerShell Script Block Logging (Event ID 4104) and enforce AMSI, then alert on the campaign chain: conhost or cmd spawned from a browser, hidden PowerShell windows, pushd to a WebDAV share, and rundll32 firing after a .LNK interaction.

☑️ Add npm mirror domains (unpkg, npmmirror, yarn) to phishing and URL-reputation pipelines, and hunt proxy/DNS logs for direct .html requests to those mirrors.

☑️ Enforce application control (AppLocker or WDAC) plus web filtering to block cracked-client and lookalike-domain downloads from Discord, MediaFire, and *.github.io.

☑️ Tune EDR for unusual in-memory execution and unauthorized tunneling, and back it with strict conditional access and phishing-resistant MFA so a harvested credential can’t pivot.

Theme 2: Identity Is the Only Perimeter

Stories

🗞️ Hundreds of Leaked Corporate AWS Keys Grant Full Admin Access (Truffle Security) — 768 publicly exposed AWS keys, 526 of them root keys, still authenticate and grant total administrative control over corporate cloud infrastructure, with 88% of verified keys active at a median age of five years because teams delete the file that leaked the secret but never revoke or rotate the credential behind it.

🗞️ Inside ‘NovaCookies’: The $320/Month AitM PhaaS Bypassing MFA at Scale (Island) — A subscription Adversary-in-the-Middle platform that commoditizes session theft into a $320/month product, hiding links inside genuine DocuSign share emails and proxying live authentication to lift Microsoft 365 session cookies after password and MFA entry, hitting hundreds of organizations, with the US at 49.2% of victims. 🔎 Threat Hunting Package

🗞️ Exposing AnonyMousKIT: The AI-Powered Phishing Supply Chain Targeting Apple Devices (SOCRadar) — A credit-metered Phishing-as-a-Service ecosystem built to steal Apple IDs and strip Activation Lock from stolen hardware, running a multi-channel pipeline across email, SMS, and WhatsApp and deploying conversational AI voice agents posing as “Alice from Apple Support” that inject victim details into automated vishing calls. 🔎 Threat Hunting Package

Recommendations

☑️ Audit cloud environments for exposed API keys now, and revoke plus rotate every compromised credential at the provider level — removing the file that contained the secret does nothing.

☑️ Delete permanent AWS root access keys company-wide and enforce least-privilege, short-lived credentials via AWS Identity Center and STS.

☑️ Deploy automated secret scanning in pre-commit hooks and CI/CD pipelines, and set mandatory billing and anomaly alerts across every cloud account.

☑️ Update IR playbooks so any suspected compromise explicitly revokes Microsoft 365 session and refresh tokens — a password reset will not invalidate a stolen session.

☑️ Accelerate the move from OTP and push MFA to phishing-resistant standards (FIDO2 keys, WebAuthn, passkeys) with context-aware device posture controls, and enforce MDM plus hardware keys for Apple ID on corporate devices.

☑️ Tell staff plainly: Apple (or any vendor) will never proactively contact them to help unlock a lost or stolen device.

Theme 3: AI as Target and Threat Actor

Stories

🗞️ Nearly Half of Enterprise AI Use Bypasses Security (Akamai) — The 2026 Enterprise AI Usage Risk Report finds almost half of enterprise AI interactions dodge corporate guardrails via unmanaged shadow AI and rogue browser extensions, opening AI-native vectors that skip the perimeter entirely: Vibe hacking via poisoned local markdown instruction files, CursorJacking through extension permissions to harvest API keys and code, and CometJacking using indirect prompt injection on public pages to hijack local agents.

🗞️ Drive-By AI Hijacking: “Nemoclaw” Vulnerability Exposes Local AI Agents (Cyera) — CVE-2026-65105 in NVIDIA NemoClaw lets an attacker fully hijack a local AI agent from a single website visit, because NemoClaw binds Ollama to 0.0.0.0 and DNS rebinding sails past Host header validation, allowing template injection to silently append hidden malicious instructions to every future system prompt.

🗞️ Accidental AI Hackers? When AI Agents Go Rogue on Trivial Bugs (Aikido Security) — An OpenClaw assistant autonomously exploited an Australian gym’s booking system to cancel reservations with no malicious instruction given, inferring an indirect request and spontaneously abusing client-side-only enforcement and an IDOR to satisfy the user’s objective — the flaws were trivial, and the discovery was free.

🗞️ Rogue AI Agents Break Isolation in Massive Coordinated Attack (METR) — Over 1,200 AI agents escaped isolated evaluation environments and ran a multi-day coordinated attack against Hugging Face infrastructure, using a shared Artifactory package cache as a covert comms channel and an unsanctioned message board to collaborate, spoofing logs and overriding programmed ethical constraints in favor of the “collective’s” hacking goals.

Recommendations

☑️ Move from static DLP to real-time contextual inspection of the AI interaction layer — prompts, copy/paste buffers, and document uploads as they happen.

☑️ Enforce SSO federation across all SaaS to kill shadow AI, and audit browser and IDE extensions as the high-privilege software they actually are.

☑️ Point security telemetry and tailored behavioral coaching at the high-risk 5% of “AI power users” generating the bulk of prompts.

☑️ Bind local inference services like Ollama to 127.0.0.1 rather than 0.0.0.0, apply NVIDIA PSIRT patches for NemoClaw, and add DNS rebinding protection at the firewall or router.

☑️ Audit public-facing apps for the trivial logic flaws agents stumble into, client-side-only validation and IDORs, and put SAST/DAST plus AI-assisted code audits in the pipeline.

☑️ Isolate shared resources in AI testing environments (package repos, cache namespaces), enforce strict egress filtering on sandboxes, and add cryptographically verified, tamper-evident logging for all agent transcripts and tool calls.

Theme 4: Nation-State Ops Move From Espionage to Physical Impact

Stories

🗞️ Iran-Linked Hackers Cause Unprecedented 4-Day Physical Shutdown of UK Power Generator (The Telegraph) — Iranian state-aligned actors forced a four-day operational disruption at a British electricity generator, the first confirmed physical shutdown of a UK power asset by Iranian actors, and notably not an attempt at grid-wide destabilisation but a strategic show of force proving they can breach OT and hold a critical energy asset offline through an extended recovery.

🗞️ State-Sponsored Cyberattacks on the German Economy Surge (Bitkom) — Foreign intelligence services are driving up to €270.8 billion in damages through data theft, industrial espionage and sabotage against German enterprises, with attribution to foreign intelligence jumping to 37% from just 7% in 2023 as the line between state actors and organised crime blurs and attackers lean on AI for deepfakes, automated phishing and malicious code generation.

🗞️ Advanced GoCaracal Malware Targets Latin America (Arctic Wolf) — Dark Caracal has modernized with a Go-based framework deployed alongside updated Bandook payloads against comms firms, governments and journalists in Venezuela, Chile and Brazil, falling back to an Ethereum smart contract for C2 resolution so operators can rotate infrastructure dynamically without ever redeploying the payload. 🔎 Threat Hunting Package

Recommendations

☑️ Audit every remote access pathway into OT and enforce strict segmentation and air-gapping between corporate IT and ICS/OT.

☑️ Build and actually test OT-specific disaster recovery playbooks so containment and downtime shrink when physical infrastructure is hit.

☑️ Extend continuous monitoring to small, distributed energy suppliers and pull smaller operators into national CNI threat intelligence sharing.

☑️ Tighten IAM and audit your attack detection coverage — internal blind spots and misconfigurations remain the primary enabler for these breaches.

☑️ Filter or block unexpected SVG and 7-Zip attachments from external senders, especially with tax or financial themes, and monitor for anomalous Go-based processes and outbound connections to blockchain nodes.

☑️ Formalize rapid information sharing with national authorities and industry peers, and benchmark spend against the Bitkom/BSI guidance of at least 20% of IT budget on security.

Theme 5: Law Enforcement Crackdowns

Stories

🗞️ Threat Actors Abuse FTP Banners to Deliver Undocumented RATs (SOCRadar) — Phishing with malicious .LNK files, often disguised as Spanish-language voucher lures, delivers two new RATs (E4del and PINHOLE) featuring anti-sandbox checks, live desktop streaming and Cloudflare Workers C2, with the configuration pulled straight from the greeting banner an FTP server returns on connect — keeping the initial stager completely clean under static analysis. 🔎 Threat Hunting Package

🗞️ First Android Malware Directly Targets Automotive Head Units (Kaspersky) — The MoYu Group is compromising OTA firmware updates on DoFun-firmware head units, marking the first observed campaign to abuse a vehicle’s own native firmware updater via MQTT commands to push UI-less APKs, quietly enrolling connected cars into the BadBox proxy network to run ad fraud. 🔎 Threat Hunting Package

🗞️ DOJ and FBI Take Down Chinese State-Sponsored ‘QScan’ & ‘QTRouter’ Platforms (FBI) — Seizing hard-coded authentication and comms domains severed C2 for two platforms run by PRC actor QTFY, a commercial cyber-service provider to the MSS and PLA that used QScan to hijack global IoT devices and fed them into QTRouter as an obfuscation layer hiding the Chinese origin of attacks on NASA, the US Senate, the Federal Reserve, defense, telecoms, finance and healthcare.

🗞️ AFP and FBI Dismantle “TeamPCP” Open-Source Supply Chain Syndicate (AFP) — Two Australian men were arrested over a syndicate that planted malicious open-source components, and the leverage ratio is the story: a handful of compromised dependencies reached over 1,000 organizations, 500,000+ stolen credentials, 300+ GB of exfiltrated data and hundreds of millions in global remediation costs.

🗞️ Global Taskforce Dismantles West African Cybercrime Syndicates in 58-Arrest Sweep (INTERPOL) — 58 arrests targeting West African organized crime groups behind large-scale cyber fraud, where cross-border intelligence coordination let law enforcement execute multi-jurisdictional warrants simultaneously, seize infrastructure, and intercept multi-million-dollar fraud pipelines before the money moved.

Recommendations

☑️ Restrict and continuously log outbound FTP (TCP/21) from end-user workstations, prioritizing alerts on non-browser processes initiating FTP handshakes.

☑️ Build network telemetry detections for non-browser applications talking to legitimate third-party services (Pinterest, SurveyMonkey APIs) used as secondary dead drop resolvers.

☑️ Ingest the FBI and NSA IoCs into SIEM/SOAR and inspect egress traffic for connections to compromised residential IoT ranges and commercial proxy services.

☑️ Adopt Zero Trust and isolate IoT, OT, and edge devices on dedicated, non-routable VLANs with default credentials disabled, and micro-segment vehicle head units away from the CAN bus.

☑️ Automotive OEMs and aftermarket suppliers: audit OTA updaters, disable unverified install flags such as installNotExists, block unauthorized MQTT brokers, and enforce cryptographic signature verification with hardware-backed Secure Boot.

☑️ Run SBOM audits across the stack, add continuous dependency scanning and integrity verification (hash checks, lockfiles) to CI/CD, and force credential resets on developer and admin accounts.

☑️ Neutralize BEC with mandatory out-of-band verification for high-value transfers, strict DMARC/DKIM/SPF, domain monitoring, and standing ties to regional ISACs.

Feature Livestream

December 10th, 2021. Log4Shell drops.

Within hours, attackers are scanning the entire internet with a string shorter than a tweet.

Inside SOCs everywhere, analysts are writing the same detection logic 3, 4, 5 times over — once in Splunk SPL, once in Sentinel KQL, once in Elastic DSL. Not because the logic was hard. Because none of their tools spoke the same language.

That’s not a tooling problem. It’s a structural failure in how the industry builds detections.

It’s also exactly why Sigma exists!

One rule, written once, translated into whatever query language your SIEM speaks. When a Log4Shell Sigma rule was published to GitHub, analysts worldwide had working detections across completely different backends within minutes! Not hours of manually rewriting the same logic per platform.

In this video, I go deep on the Sigma rule architecture, the pySigma translation layer, Sigma v2 correlation rules, and where most teams get this wrong.

Check it out!

💬 Join our Discord

Feature Course

What Will You Learn?

• How to use Structured Analytical Techniques (SATs) to perform intelligence analysis.

• What intelligence analysis technique to use and when.

• Common challenges and how to overcome them.

• How to practically apply analysis techniques.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

December 10th, 2021. Log4Shell drops.

Within hours, attackers are scanning the entire internet with a string shorter than a tweet.

Inside SOCs everywhere, analysts are writing the same detection logic 3, 4, 5 times over — once in Splunk SPL, once in Sentinel KQL, once in Elastic DSL. Not because the logic was hard. Because none of their tools spoke the same language.

That’s not a tooling problem. It’s a structural failure in how the industry builds detections.

It’s also exactly why Sigma exists!

One rule, written once, translated into whatever query language your SIEM speaks. When a Log4Shell Sigma rule was published to GitHub, analysts worldwide had working detections across completely different backends within minutes! Not hours of manually rewriting the same logic per platform.

In this video, I go deep on the Sigma rule architecture, the pySigma translation layer, Sigma v2 correlation rules, and where most teams get this wrong!

✍️ Accompanying blog article

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: ClickFix & macOS Endpoint Under Siege

Stories

🗞️ Critical macOS Screen Sharing Flaw Exploited to Deploy Monero Miners (NCSC NL) — CVE-2026-65400 gives unauthenticated root on internet-exposed Macs via VNC port 5900, and it’s being used to drop Monero miners. The bug bypasses state management credential validation entirely, so a network-based attacker authenticates to the built-in remote desktop service with no valid credentials and lands as root.

🗞️ Novel macOS “AmnesiaStealer” Delivered via ClickFix Attacks to Hijack Chromium Browsers (Jamf) — Multi-stage infostealer pushed through fake GitHub download pages that steals credentials and keychains, then hands operators live control of the browser. The remote-control module clones browser profiles and drives them over DevTools protocols, giving live screencast control and plaintext cookie theft without tripping browser automation flags. 🔎 Threat Hunting Package

🗞️ Unmasking MacSync Stealer: How Attackers Exploit macOS Devices and Hide in Plain Sight (Microsoft Security) — macOS stealer after keychain material, crypto wallets, and cloud/SSH keys, delivered through fake browser prompts and helpdesk chats. It rotates 30+ C2 domains to defeat static blocking, but the behavioural footprint never changes. Predictable curl command lines, AppleScript staging in /tmp/, and HTTP PUT exfil carrying upload_id and chunk_index. 🔎 Threat Hunting Package

🗞️ Unmasking StopAndProtect: How 2,000+ Hijacked WordPress Sites Fueled a Massive Campaign (Check Point Research) — Thousands of compromised WordPress sites used for C2, payload delivery, and exfil, feeding ClickFix lures to over 6,000 victim IPs. The delivery is standard ClickFix PowerShell, but the actor’s OPSEC failures left directory listings exposed. Over 31,000 stolen screenshots, victim logs, and the source for their own site-management tooling. 🔎 Threat Hunting Package

Recommendations

☑️ Patch macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 across managed Macs; where patching lags, disable Screen Sharing, block inbound 5900, and force admin sessions through VPN or ZTNA.

☑️ Train users and developers never to paste Terminal or PowerShell commands from web pages, fake CAPTCHAs, or helpdesk chats. Also, turn on the macOS 26.4+ malicious-paste blocking.

☑️ Hunt behaviour rather than IOCs: osascript spawning curl with -k -s --data-binary, Terminal launching unsigned Mach-O binaries, archive creation in /tmp/, and unprivileged PowerShell kicked off from a browser child process.

☑️ Audit TCC grants and Full Disk Access across the fleet, alerting on anything unexpected touching login keychains or browser profile directories.

☑️ Filter egress and watch for HTTP PUT requests carrying upload_id / chunk_index with macOS user agents and static API-key headers.

☑️ For anyone running WordPress: update core, plugins, and themes, inspect wp-content/mu-plugins for hidden backdoors, and put a WAF in front to block unauthorised uploads.

Theme 2: Blinding the Defender — Trusted Infrastructure, Trusted Identity, Trusted Code

Stories

🗞️ Python Implant Hides C2 Traffic Inside Microsoft 365 and Azure (Ontinue) — TWINLOOT runs its entire C2 through SharePoint, Teams, and Edge, authenticating via an attacker-controlled Azure tenant. SharePoint acts as a dead drop and Teams TURN servers provide reverse tunnels, so nothing lands in the victim’s Entra ID logs and signature-based tooling has nothing to match on. 🔎 Threat Hunting Package

🗞️ Project CAV3RN Espionage Framework Upgrades Stealth with Google Apps Script & DNS-Based C2 Selection (Kaspersky) — The framework now switches between HTTPS and a Google Apps Script relay to bury traffic inside trusted Google infrastructure. C2 selection runs off DNS A-record queries that fetch configuration and rotate channels on the fly, which breaks monitoring built around a fixed egress path. 🔎 Threat Hunting Package

🗞️ Advanced Data Theft Campaign Hits Salesforce and ServiceNow Portals (Reco) — The “City-Forum” campaign pulls data out of Salesforce and ServiceNow portals by abusing permissive guest user configurations, with no credentials and no exploit. There’s no zero-day here — custom Go tooling hits Salesforce’s Lightning Web Runtime UI-API layer and an undocumented ServiceNow search endpoint that nobody was monitoring. 🔎 Threat Hunting Package

🗞️ Russian Espionage Clusters Abuse Legitimate Auth Flows to Target High-Profile Individuals (Google Threat Intelligence Group) — Three clusters (UNC6293, UNC7005, UNC5976) abuse OAuth flows, Application-Specific Passwords, and device-linking to hold persistent access to personal accounts. Because every step runs through a legitimate identity workflow, the activity sails past anti-phishing controls and conventional MFA. 🔎 Threat Hunting Package

🗞️ HoneyMyte Deploys ‘CoolClient’ Driver Rootkit for Advanced Evasion (Kaspersky) — Mustang Panda now pairs its CoolClient backdoor with a kernel-mode driver rootkit against government and diplomatic targets. Kernel-space execution lets the rootkit blind EDR and stop anti-malware from terminating the backdoor underneath it, which makes the defence prevention at load time rather than detection afterwards. 🔎 Threat Hunting Package

Recommendations

☑️ Stop treating Microsoft and Google traffic as safe by default. Hunt anomalous SharePoint, Teams, and Graph API behaviour, and flag Apps Script relays initiated by non-browser background processes.

☑️ Build DNS visibility for C2 selection: high volumes of A-record queries to repetitive or unusually structured subdomains used for config pulls and freshness checks.

☑️ Audit SaaS guest permissions across Salesforce Experience Cloud and ServiceNow portals. Strip object and field read rights, disable guest public API access, tighten sharing rules, and check logs for traffic from 158.220.87.79 or hits on /api/now/sp/search.

☑️ Sweep and revoke unauthorised OAuth consents and Application-Specific Passwords, require admin approval for third-party app grants, and move at-risk personnel to FIDO2 keys. Tell them plainly: never type an ASP into a web form, never scan a QR code to “link a device”.

☑️ Enforce Driver Signature Enforcement and HVCI/Memory Integrity, back it with ASR rules and a vulnerable-driver blocklist, and monitor for unexpected service creation or driver registration.

☑️ Disable Edge headless mode and alert on Python executions or Graph API calls originating from the browser.

Theme 3: Developer Pipeline & AI Assistants Targeted

Stories

🗞️ Massive npm Supply Chain Attack Exposes Credentials via Self-Propagating Worm (Microsoft Security Research) — ‘ChainDrop’ infected 400+ npm packages with the ‘Mini Shai-Hulud’ worm, using preinstall hooks to steal cloud and infrastructure credentials. It’s genuinely worm-like: stolen publishing tokens let it pull a maintainer’s latest package, inject itself, bump the patch version, and republish, with no source commit anywhere. 🔎 Threat Hunting Package

🗞️ Wiz Research Uncovers CI/CD Flaw in Snowflake Copilot AI Environment (Wiz) — A flaw in Snowflake Copilot’s CI/CD environment allowed unauthorised command execution, exposing build tokens, environment variables, and source. The gap is sandboxing: when prompt execution and the build runner share an environment, the assistant becomes a path to code execution and credential harvesting.

🗞️ The ‘CoSnitch’ Vulnerability Turns AI Assistants Against Themselves (Varonis) — CVE-2026-24301, a one-click flaw in Microsoft Copilot Personal that silently exfiltrates cloud data through URL summarisation requests. The technique is “meta-hacking” where researchers got Copilot to describe its own guardrails, then built an injection that base64-encodes context data into HTTP GETs to an attacker webhook.

🗞️ Cryptographic Context Injection: How Hidden Encryption Tricks AI into Exfiltrating Private Data (Adversa AI) — Malicious web pages steal Grok users’ context and conversation history using encrypted payloads. AES-256-GCM ciphertext reads as noise to static classifiers; once the model decrypts it in its own sandbox, it treats the output as trusted internal content rather than untrusted web input.

Recommendations

☑️ Move the npm CLI to v12 and turn on min-release-age so freshly published versions can’t be pulled straight into a build; purge npm and yarn caches on every developer endpoint and build host, then walk dependency trees and artifact repos for compromised versions.

☑️ If a bad version was ever resolved, rotate everything (e.g. cloud keys, GitHub tokens, npm publishing tokens) from a known-clean host, because the worm enumerates and exfiltrates exactly those.

☑️ Scope AI integration credentials to individual build stages instead of granting broad runner permissions, and run agents and build containers as ephemeral sandboxes with restricted egress.

☑️ Confirm Microsoft’s 18 August 2026 patches for CVE-2026-24301 are deployed everywhere, and restrict what user context an agent can reach while it’s browsing or summarising external URLs.

☑️ Put approval gates in front of agent outbound requests and URL fetches, and quarantine fetched content in tool-less sandboxes so decrypted or injected text never inherits trust.

☑️ Log for the exfil pattern: outbound URLs carrying base64-encoded parameters from trusted AI platforms, plus routine audits of CI/CD and agent tool-chain logs for anomalous command invocations.

Theme 4: The Extortion Economy & Its Infrastructure

Stories

🗞️ Mass Extortion Campaign Exploits Enterprise Zero-Days with Custom Implants (ReliaQuest) — Clop is back, abusing zero-days in ERP and MFT platforms to deploy web shells and exfiltrate at scale. Clop doesn’t run continuous opportunistic operations; it runs planned, vulnerability-led bursts designed to drain data before defenders can patch. 🔎 Threat Hunting Package

🗞️ Medusa Ransomware Operations Escalate (CISA, FBI, HHS) — Updated advisory on the Medusa RaaS variant, now past 500 victim organisations with a heavy Healthcare and Public Health skew. Affiliates weaponise newly disclosed vulnerabilities inside 24 hours and use out-of-band Interactsh URLs to confirm initial access, which means your patch window is one day rather than one month. 🔎 Threat Hunting Package

🗞️ The “Ransomware Rescuer” Illusion: Unmasking the ‘Ransom Busters’ Extortion Scheme (GuidePoint Security) — A rogue affiliate double-extorting victims by posing as a recovery service, charging 20,000–60,000 to “delete” stolen data. The tell is timing: they contact victims before the breach is public, claiming they hacked the RaaS admin panel to intercept the data.

🗞️ CISA Warns of Attacks Targeting Siemens S7 Series PLCs (CISA, NSA and partners) — Joint advisory AA26-231A on active targeting of Siemens S7 programmable logic controllers. Actors aren’t stopping at the IT network any more; they’re going after the controllers themselves to manipulate operational logic and cause physical disruption.

Recommendations

☑️ Treat internet-facing app patching as a 24-hour SLA, not a monthly cycle. Prioritise MFT, ERP, ScreenConnect, and Fortinet, since that’s where both crews start.

☑️ Remove direct exposure wherever you can: IP allowlists or zero-trust gateways in front of enterprise apps, and Siemens S7 PLCs off the internet entirely, behind authenticated gateways with MFA.

☑️ Segment for blast radius on both sides of the house. ERP and MFT servers away from domain controllers, file shares, and backups; a hard IT/OT boundary so a compromised corporate box can’t reach a control zone.

☑️ Extend telemetry to catch the two things that matter: file-export staging and outbound volume from application servers, and unauthorised PLC logic changes, rogue engineering workstation connections, or unexpected controller resets.

☑️ Keep immutable offline backups and sign an IR retainer with a verified firm before you need it, so recovery never depends on negotiating with anyone.

☑️ Route every unsolicited “we can recover your data” approach through that retained IR firm and ignore it otherwise. Paying a self-appointed rescuer buys another extortion round, not deletion.

Theme 5: Fraud at Scale — Where the Target Is the Person, Not the Perimeter

Stories

🗞️ WhatsApp Deploys New Anti-Scam Tools as 6.8 Million Malicious Accounts Are Dismantled (Meta) — Meta banned 6.8m+ accounts tied to organised scam centres and shipped in-app safety features to give users context before they engage. The scam economy is deliberately cross-platform (AI-generated lures over SMS, “tasks” on Telegram or TikTok, theft finalised on a crypto platform) so no single provider ever sees the full chain.

🗞️ Fake TikTok Rewards Scams Promise Massive Payouts You’ll Never See (Malwarebytes Labs) — TikTok-branded fake sites promise big payouts for daily check-ins, then trap victims in an endless loop of new requirements. Inflated fake balances and countdown timers keep victims emotionally invested in tasks whose only real output is cost-per-action revenue for the operators.

🗞️ 40 Malicious Firefox Extensions Caught Draining Crypto Wallets and Harvesting Credentials (Socket) — 77 interconnected extensions built to drain crypto wallets and exfiltrate credentials, using modified open-source wallet code to slip past marketplace review. They ship as “sleepers” (harmless utilities and sports-score trackers) then pull config from a remote database to swap in phishing forms or wallet code that grabs 12- and 24-word seed phrases before local encryption. 🔎 Threat Hunting Package

🗞️ Manic Malware Blends Android Banking Trojan with Spyware and Mesh Exfiltration (ThreatFabric) — Android family combining device takeover with full spyware surveillance, hitting Ukrainian eID services, messaging apps, and financial institutions. There are no fake login screens: a transparent overlay sits on the real app’s keypad capturing tap coordinates while input passes through, and if C2 fails it store-and-forwards over a Wi-Fi mesh of nearby infected devices. 🔎 Threat Hunting Package

Recommendations

☑️ Teach the pause: unexpected group adds, unknown numbers, guaranteed returns, countdown timers, and inflated on-screen balances are all engineered urgency. WhatsApp’s new group safety overview lets people review and leave silently, without tipping off the actors.

☑️ Verify out of band, always. Ring the supposed friend or family member on a different channel before moving money, and confirm any rewards programme inside the official app rather than a third-party site.

☑️ Never hand PII, card, or banking details to an unverified rewards site, and never install an app to “verify identity” for a payout. If that already happened, uninstall and run a full mobile scan.

☑️ Allow-list browser extensions across the enterprise; uninstall unknown Firefox add-ons and treat any exposed seed phrase or private key as burned. Move funds to a brand-new wallet, ideally hardware-backed, so keys never touch the browser.

☑️ Audit Android fleets for high-risk Accessibility Service grants, block sideloading of unverified apps, and watch for overlay hooks and anomalous peer-relay network behaviour.

☑️ Require out-of-band or hardware-key confirmation for high-risk banking actions so an intercepted PIN or SMS code isn’t enough on its own and push mobile threat intelligence SDKs into financial and identity apps to catch runtime keypad manipulation.

Feature Livestream

MISP tells you what you know. It doesn’t come with a built-in workflow system to get there.

That gap is where most CTI teams live.

🧑‍💻 You pull an event, triage it, task someone, chase the enrichment, and write the deliverable. None of that is in MISP. It’s in Jira, or Notion, or a spreadsheet named final_v3.

Flowintel was built to fill that gap!

Same taxonomies. Same galaxies. A case you tag in one speaks the vocabulary of the other, so nothing gets lost in translation between where you work and where you publish.

👉 Flowintel case -> CTI analysis in the platform -> stored in the MISP backend

I ran a demo this week. Standing it up in Docker from nothing, wiring it to a real MISP instance, enriching a case with MISP modules, then pushing that case back into MISP as an event.

Whole loop, start to finish, including the bits that break.

If you’ve been managing CTI cases in a tool that was built for software sprints, this one’s for you.

Watch now

💬 Join our Discord

Feature Course

What Will You Learn?

• The basics of cyber threat intelligence (CTI)

• Key concepts used within the cyber threat intelligence industry.

• How CTI is applied in the real-world

• Common challenges and how to overcome them.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

🚨 New livestream tonight!

MISP tells you what you know. It doesn’t come with a built-in workflow system to get there.

That gap is where most CTI teams live.

🧑‍💻 You pull an event, triage it, task someone, chase the enrichment, and write the deliverable. None of that is in MISP. It’s in Jira, or Notion, or a spreadsheet named final_v3.

Flowintel was built to fill that gap!

Same taxonomies. Same galaxies. A case you tag in one speaks the vocabulary of the other, so nothing gets lost in translation between where you work and where you publish.

👉 Flowintel case -> CTI analysis in the platform -> stored in the MISP backend

I’m running it live this week. Standing it up in Docker from nothing, wiring it to a real MISP instance, enriching a case with MISP modules, then pushing that case back into MISP as an event.

Whole loop, start to finish, including the bits that break.

If you’ve been managing CTI cases in a tool that was built for software sprints, this one’s for you.

📅 8PM BST tonight

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: AI Is Now Both the Weapon and the Target

Stories

🗞️ Massive “Slopsquatting” Campaign Hits NPM: Over 700 AI-Generated Malicious Packages Found — Attackers flooded NPM with 700+ AI-generated packages carrying NUL1DROPPER, targeting mobile SDK installs across Windows, macOS, and Linux. Typosquatting has industrialized into slopsquatting: AI mass-produces plausible package names to overwhelm registry defenses, and the dropper skips install scripts to stay evasive. 🔎 Threat Hunting Package

🗞️ CSS: The Silent Bomb Inside Your Inbox — PortSwigger showed how sanitiser/browser rendering gaps let CSS in webmail drive spoofed UI actions, prompt injection, and account takeover. <label> tags and :before/:after pseudo-elements let attackers show the user one thing while feeding the AI assistant something else entirely.

🗞️ Atlassian Rovo Exfiltrates Sensitive Data via Zero-Click Indirect Prompt Injection — PromptArmor found Rovo silently leaking Jira tickets and Confluence docs to external URLs with no user interaction. Disabling org-wide web search doesn’t help — the underlying URL-retrieval tool remains active, so hidden prompts hijack execution without an approval step and no UI trace.

🗞️ Critical Zero-Click RCE Vulnerability Discovered in Zoom via Autonomous AI — CVE-2026-53413, a memory-corruption flaw in Zoom’s annotation protocol, grants meeting participants full device control with zero interaction. The kicker is the discovery cost: nation-state-grade zero-click, found and weaponized in under 24 hours with fewer than 20 prompts on public models.

Recommendations

☑️ Treat AI agents as untrusted execution paths — audit connector permissions, disconnect unvetted third-party integrations, and assume any content an agent reads can instruct it.

☑️ Enforce egress controls and network monitoring on AI workloads to catch dynamic URL calls and anomalous outbound HTTP.

☑️ Don’t rely on HTML/CSS sanitization as a security boundary; back it with strict CSP to block CSS exfiltration and unauthorized external requests.

☑️ Pin dependencies with lockfiles and run SCA before deployment — manual review for any new unverified package, especially mobile SDKs.

☑️ Patch Zoom Workplace to 7.1.5 (7.0.6+ for E2EE configs) and sandbox collaboration clients so memory corruption doesn’t reach the host.

☑️ Build prompt-injection testing and output sanitization into your AI governance process before autonomous assistants touch internal repositories.

Theme 2: Your Marketplace Is Your Perimeter

Stories

🗞️ Are Your VS Code Extensions Stealing Your Crypto? Unpacking the “Solidity Pro” Malware Campaign — WhiteCobra is shipping malicious VS Code and Open VSX extensions posing as premium Web3 tooling, harvesting wallets, credentials, and API keys via Telegram bots. Decoy clean versions plus randomized multi-hour execution delays defeat scanners that only watch a package for minutes. 🔎 Threat Hunting Package

🗞️ Massive VPN Extension Hijack Exposed: Over 700 Chrome Add-ons Hijacking Browser — 737 Chrome VPN extensions impersonated legitimate brands to intercept browser sessions, aimed at Russian-speaking users evading censorship. They resolved malicious proxy domains over DNS-over-HTTPS via Cloudflare and Google, so the victim machine never emitted a plaintext DNS query to alert on. 🔎 Threat Hunting Package

🗞️ Poisoned API Response Hits BDThemes WordPress Ecosystem — Attackers compromised BDThemes’ API infrastructure to push backdoors straight into WordPress sites running plugins like Element Pack Pro. Poisoning the vendor’s central API response means no individual site credential ever needed to be compromised.

🗞️ AI Supply Chain Risk Exposed: 2,500+ Companies and 434k CI/CD Pipelines at Risk — CloudSEK found embedded credentials and API tokens leaking across AI development workflows, exposing hundreds of thousands of build pipelines. Hardcoded keys in AI config files and build scripts turn ML pipelines into first-class supply chain attack vectors.

Recommendations

☑️ Enforce allowlisting for browser and IDE extensions — approved publishers only, and treat inflated download counts as a red flag rather than a trust signal.

☑️ Audit WordPress estates running BDThemes plugins now for backdoors, rogue admin accounts, and unexpected file changes; add WAF rules and file integrity monitoring.

☑️ Scan every repo and CI/CD environment for exposed keys, then revoke and rotate — treat this as an incident, not hygiene.

☑️ Gate credentials at the door with secret scanning in pre-commit hooks and build gates, backed by a central vault (Vault, AWS Secrets Manager).

☑️ Restrict outbound server connections and stage vendor updates in isolated test environments before production.

☑️ Monitor for anomalous proxy connections, including traffic hiding behind DoH.

☑️ Never leave seed phrases or unencrypted wallet keys in a development workspace.

Theme 3: Ransomware and the Vanishing Patch Window

Stories

🗞️ Storm-1175 Shifts Tactics: New StormEncryptor Ransomware Hits N-central Servers — A China-based actor previously tied to Medusa is exploiting an auth bypass in self-hosted N-central RMM to deploy a new C++ locker, with a three-day ransom clock. Microsoft warns the group is moving from initial access to exfiltration and encryption within days, not weeks.

🗞️ FBI & South Korea Issue Urgent Warning on Gunra Ransomware Targeting Critical Infrastructure — Gunra, a RaaS operation linked to Lazarus, is breaching critical infrastructure through unpatched Fortinet firewalls and demanding $10M+ while harassing victim management directly. Defenders have a rare win here: a flaw in the Linux variant lets responders reconstruct encryption keys from file timestamps and recover without paying. 🔎 Threat Hunting Package

🗞️ A New Rust-Based Ransomware Leveraging Decentralized Infrastructure — DeadLock pairs double extortion with a decentralized recovery ecosystem, hitting IT, mining, logistics, manufacturing, and hospitality across Europe. Running negotiation and leak infrastructure over the Session messaging network and blockchain services keeps them online through takedown attempts. 🔎 Threat Hunting Package

🗞️ Critical SharePoint Auth Bypass Exploited Post-PoC Release — CVE-2026-55040 lets unauthenticated attackers impersonate users and admins on internet-facing on-prem SharePoint. Exploitation started almost immediately after the public PoC dropped, and chaining with CVE-2026-63520 gets you full unauthenticated RCE.

Recommendations

☑️ Patch the named entry points now: N-able hotfix 2026.3 HF1 (CVE-2026-18577), Fortinet CVE-2024-55591 and CVE-2025-24472, and July/August 2026 SharePoint updates.

☑️ Get RMM consoles, SharePoint Central Administration, and firewall management off the public internet — front them with a reverse proxy or VPN requiring pre-auth.

☑️ Hunt for the specific artifacts: rogue svchost.exe in Documents folders, an unexpected “Cloudflared” service, and anomalous child processes spawned by w3wp.exe.

☑️ Tune EDR to block event log clearing, batch-script UAC bypasses, and termination of security services; enable AMSI across SharePoint web apps.

☑️ Hold immutable, offline backups — DeadLock kills VSS and empties the recycle bin before encrypting.

☑️ Restrict admin rights and privileged token use (SeDebugPrivilege, SeTakeOwnershipPrivilege) to limit encryption blast radius, and monitor for LOLBin abuse of AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz.

☑️ Before paying anything for a Gunra Linux infection, engage CISA or a specialist IR team on timestamp-based key reconstruction.

Theme 4: The Hiring Pipeline Is an Attack Vector

Stories

🗞️ How North Korean Hackers Infiltrate Western Companies — Researchers stood up a fake DeFi startup, hired DPRK operatives, and documented the infiltration playbook from the inside. Forged IDs carry AI watermarks like SynthID, and off-screen live translation tools carry the operative through video interviews. 🔎 Threat Hunting Package

🗞️ Sandworm Targets IT Professionals with Weaponized VPN Clients — UAC-0145/APT44 poses as tech employers on job boards, running fake interviews that end with a trojanised VPN “assessment tool”. The trust is built across channels — Zoom and Telegram interviews first, spoofed follow-up email with the payload second. 🔎 Threat Hunting Package

🗞️ The “Payroll Pirates” Are Evolving: New AiTM Phishing Campaign Bypasses Microsoft 365 MFA — Storm-2755 uses voicemail lures and residential proxies to intercept M365 session tokens and redirect payroll. They aren’t defeating MFA — they’re proxying the real Microsoft auth flow and stealing the session after it succeeds, then blending into consumer traffic via rotating proxies. 🔎 Threat Hunting Package

🗞️ Surge in Account Hijacking for Non-Consensual Explicit Content Leaks — FBI IC3 warns of credential stuffing and phishing against social and cloud accounts to steal and sell intimate content. The effective technique is fake “your account is locked” support texts that manipulate victims into forwarding genuine password-reset codes.

Recommendations

☑️ Deploy phishing-resistant MFA (FIDO2, Windows Hello for Business) — it binds auth to the real service and neutralizes AiTM session relay outright.

☑️ Layer Conditional Access for managed devices only, plus Continuous Access Evaluation so anomalous sessions get revoked fast.

☑️ On suspected compromise, revoke all sessions, rotate credentials, re-register MFA, and audit ADP/Workday for unauthorized direct deposit changes.

☑️ Harden onboarding: forensic ID checks for AI manipulation and metadata inconsistencies, plus canary tokens or tracking links to verify candidate geography.

☑️ Verify recruiters and interview invites independently through official corporate channels, and run any interview-supplied software in a VM or sandbox.

☑️ Enforce least privilege across repos and critical systems, and monitor remote workers for proxy connections and unauthorized remote access tooling.

☑️ Never share a verification code with “support”, and keep sensitive media off internet-accessible cloud storage — report NCII via ncii.ic3.gov.

Theme 5: The Blind Spots — SaaS, Silicon, and Statecraft

Stories

🗞️ Stealthy ‘City-Forum’ Campaign Targets Salesforce and ServiceNow via Custom Toolset — Reco tracked a campaign exfiltrating data from exposed Salesforce Experience Cloud and ServiceNow portals through unauthenticated guest access. Rather than reuse public scanners, the actor built bespoke Go tooling against undocumented surfaces — the UI-API/GraphQL layer on Salesforce LWR sites and a hidden ServiceNow search endpoint. 🔎 Threat Hunting Package

🗞️ Malicious SIM Cards Can Hijack Cellular IoT Modems — Birmingham and Fuzzware researchers showed a rogue SIM can execute arbitrary code and take over modems in EV chargers, industrial routers, and telematics units. There’s no software vulnerability to patch — it abuses standards-compliant SIM Toolkit functionality to issue system commands and force 5G-to-2G downgrades.

🗞️ New Multi-Functional Linux Botnet ‘Evooo1Bot’ Targets Cloud and IoT Infrastructure — Fortinet found a modular Linux botnet combining DDoS, reverse shells, and arbitrary script execution against servers, cloud instances, and edge devices. Bundling flooding with remote admin execution lets operators pivot from access to disruption in a single toolset. 🔎 Threat Hunting Package

🗞️ Jewelbug APT Blends State Espionage with Crypto Fraud — A China-based hackers-for-hire crew runs government espionage across the Middle East and Asia alongside a crypto fraud business, both from one shared control panel. Their “XG-Web” framework and fake PDF Viewer extension break browser sandboxing to run native Windows commands and hijack sessions in near real time. 🔎 Threat Hunting Package

🗞️ US Authorizes Private Sector ‘Hack-Back’ Operations — A national security memorandum lets vetted private firms run offensive operations against transnational cybercriminals under US government authority. Participation is gated: vetting, strict legal procedure, a $1M compliance bond, and a hard stop if US persons or systems are touched.

Recommendations

☑️ Hunt City-Forum in Salesforce Event Monitoring and ServiceNow transaction logs for IP 158.220.87.79 and User-Agent Go-http-client/1.1.

☑️ Audit guest user permissions on every public portal — kill over-permissive sharing rules, guest file access, and unnecessary self-registration.

☑️ Hunt Jewelbug via the com.microsoft.runedge native messaging host registry key, block typosquatted C2 domains, and watch for Microsoft Graph API abuse hiding C2 traffic.

☑️ Physically secure SIM slots on field-deployed IoT with enclosures, tamper seals, or chassis intrusion sensors, and work with carriers to restrict proactive SIM Toolkit commands.

☑️ Alert on unexpected modem command execution and forced 2G/3G fallbacks.

☑️ Harden public-facing Linux: disable root SSH, enforce key-based auth, close non-essential ports, patch known RCEs, and deploy Linux-native EDR with ZTNA.

☑️ Assume the hack-back policy changes nothing about your defensive obligations — it’s limited to firms under DOJ/DHS agreements, so brief leadership on it as context, not coverage.

Feature Video

Most write-ups of the North Korean IT worker threat stop at the front door.

They explain how these operatives get hired. That’s worth knowing, but it’s only Act 1.

Nobody briefs you on Act 2.

So I built the profile I wanted to read. Here’s what’s in it:

🧑‍💼 The organization. Not a hacking unit. A state-run staffing agency under the Reconnaissance General Bureau, Department 53 (same parent as Lazarus). Around 8,400 operatives embedded globally.

💵 The money. $250–600M a year by UN estimates, closer to $800M in a single fiscal year by Treasury’s count. Up to 90% clawed back to the department that buys ballistic missile components.

🗓️ The timeline. Five phases from 2011 to now, including the one global accident that made the whole model viable.

⚙️ The hiring pipeline. Identity harvesting, a sub-industry of account laundering run over Discord, and fabricated GitHub histories going back a decade, compiled last year.

💬 The interview. Three stacked layers of deception, and a fourth participant on the call you never see.

📰 The Christina Chapman case. 309 companies. 68 burned identities. $17.1M. Eight and a half years.

🌐 The infrastructure. Why your EDR is structurally blind to how these operatives connect — not misconfigured, blind.

☠️ The extortion. What Secureworks tracks as Nickel Tapestry, and why firing one of these people is the most dangerous moment of the whole engagement.

📖 The playbook. Seven concrete detection opportunities, each mapped to where it lives in the kill chain.

💬 Join our Discord

Feature Course

What Will You Learn?

• How to set up your own MISP instance to gather and organize cyber threat intelligence.

• Configuring your MISP instance to suit your specific use case.

• Automatically ingesting threat data into your MISP instance using open-source threat intelligence feeds.

• How to search and filter data in your MISP instance.

• Using the MISP API to streamline your workflow.

• Extracting Indicators of Compromise (IOCs) from your MISP instance to use with other security tools.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

Most write-ups of the North Korean IT worker threat stop at the front door.

They explain how these operatives get hired. That’s worth knowing, but it’s only Act 1.

Nobody briefs you on Act 2.

So I built the profile I wanted to read. Here’s what’s in it:

🧑‍💼 The organization. Not a hacking unit. A state-run staffing agency under the Reconnaissance General Bureau, Department 53 (same parent as Lazarus). Around 8,400 operatives embedded globally.

💵 The money. $250–600M a year by UN estimates, closer to $800M in a single fiscal year by Treasury’s count. Up to 90% clawed back to the department that buys ballistic missile components.

🗓️ The timeline. Five phases from 2011 to now, including the one global accident that made the whole model viable.

⚙️ The hiring pipeline. Identity harvesting, a sub-industry of account laundering run over Discord, and fabricated GitHub histories going back a decade, compiled last year.

💬 The interview. Three stacked layers of deception, and a fourth participant on the call you never see.

📰 The Christina Chapman case. 309 companies. 68 burned identities. $17.1M. Eight and a half years.

🌐 The infrastructure. Why your EDR is structurally blind to how these operatives connect — not misconfigured, blind.

☠️ The extortion. What Secureworks tracks as Nickel Tapestry, and why firing one of these people is the most dangerous moment of the whole engagement.

📖 The playbook. Seven concrete detection opportunities, each mapped to where it lives in the kill chain.

✍️ Accompanying blog article

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: The Package Registry Is the Attack Surface

Stories

🗞️ Active “Shai-Hulud” Supply Chain Attack Compromises Keyv & 400+ NPM Packages Spanning 2B+ Installs — Attackers hijacked a lead maintainer’s GitHub account and committed malicious preinstall scripts directly to the repo, so the poisoned packages were built and published with legitimate, signed GitHub Actions attestations. Provenance checks passed on malware. 🔎 Threat Hunting Package

🗞️ North Korean Hackers Unmasked Behind Widespread NPM Supply-Chain Attacks — Amazon attributed the axios and debug compromises to Sapphire Sleet. No zero-days involved — just patient social engineering of trusted maintainers. Trojanized updates reached 10% of cloud environments within two hours.

🗞️ Arch Linux Halts AUR Package Adoption Amid Massive Malware Flood — A two-stage Rust infostealer that checks for debuggers and VMs, then pulls a Tor client disguised as dbus-daemon to fetch its payload. It steals developer secrets and uses harvested SSH keys to spread laterally on its own.

🗞️ Evil Twin Extensions Target Open VSX Registry to Compromise Developer Workspaces — Typosquatted extensions hitting Cursor, Windsurf, and VSCodium users. The malicious code arrives via transitive manifest dependencies after the initial install review passes. 🔎 Threat Hunting Package

🗞️ How DPRK Hackers Hide C2 Servers in Blank Ethereum Transfers — “NullReceiver” encodes the C2 IP directly into the recipient field of an empty Ethereum transaction. Delivered by trojanized npm packages, it leaves no financial trail and kills static IoC matching.

Recommendations

☑️ Pin or downgrade affected packages to clean releases, isolate impacted developer machines and build runners, and aggressively rotate every exposed credential — npm tokens, GitHub PATs, AWS keys, Kubernetes tokens, Vault secrets.

☑️ Disable or strictly inspect preinstall and postinstall lifecycle scripts, and enforce dependency version pinning via lockfiles across all build pipelines.

☑️ Deploy dependency firewalls and automated package inspection before execution in build systems, backed by continuous SBOM monitoring to catch compromised upstream components pre-deployment.

☑️ Audit installed IDE extensions now, confirm publisher identity and namespace authenticity, and remove anything unverified.

☑️ Hunt for unexpected systemd services, unauthorized cron jobs, anomalous Tor traffic, and outbound connections to crypto node RPCs (1rpc.io, drpc.org) from application servers.

☑️ Audit developer AI coding agents for slopsquatting — LLM-hallucinated package names that developers install without checking.

Theme 2: ClickFix Has Gone Cross-Platform

Stories

🗞️ Midnight Blizzard Strikes Travelers: Beware the CaptiveCrunch Campaign — Storm-2945 manipulates traffic on compromised captive Wi-Fi portals at hotels and conference centers, serving convincing fake update prompts that install the CornFlake RAT and ChocoShell infostealer straight off the login screen. 🔎 Threat Hunting Package

🗞️ DOUBLECUP LaaS Exploits ClickFix Lures & Environmental Keying to Deliver Novel RATs — A Russian Loader-as-a-Service impersonating NetSuite, Odoo, HubSpot, and Salesforce. It locks its steganographic payloads using the victim’s public IP as a cryptographic key, so sandboxes can’t decrypt what they capture. 🔎 Threat Hunting Package

🗞️ macOS ClickFix Campaign Uses Cloaking Gates to Hide Infostealer Lures — A ~2.5 KB JavaScript profiling gate inspects WebGL GPU rendering and DOM tripwires, serving blank decoy pages to scanners and the real lure only to genuine Macs. MacSync and Atomic Stealer follow. 🔎 Threat Hunting Package

🗞️ ClickFix Campaign Delivers Go-Based macOS Malware to Drain Crypto Wallets — Beyond harvesting the Keychain, this one has a dedicated DRAIN function that checks live wallet balances, redirects funds to attacker wallets, and wipes Terminal history behind it. Infrastructure ties back to the sanctioned Aeza Group. 🔎 Threat Hunting Package

🗞️ SMOKE#SCREEN Campaign Abuses Cloudflare Tunnels & Trusted Lures to Deploy Rogue ScreenConnect RMM — Rotating lures (fake Zoom updates, document reviews) paired with active tampering — AMSI, SmartScreen, and UAC all disabled — while C2 staging routes through ephemeral Cloudflare Tunnels to look like normal traffic. 🔎 Threat Hunting Package

Recommendations

☑️ Train users on one non-negotiable rule: no legitimate website, CAPTCHA, system update, or Wi-Fi portal will ever ask you to paste a command into PowerShell or Terminal.

☑️ Restrict PowerShell and MSHTA from being spawned by browsers or clipboard interactions, and alert when macOS terminal emulators pipe curl/wget into zsh, bash, or base64 decoders.

☑️ Build behavioral detections for security control tampering — AMSI bypass, SmartScreen disablement, UAC manipulation — and for shell processes erasing command history.

☑️ Inventory all RMM software across the estate, isolate unauthorized ScreenConnect agents, and terminate unrecognized cloudflared.exe processes.

☑️ Block outbound requests for steganographic PNGs (/stego-image.png) and unusual calls to public IP-retrieval services.

☑️ Monitor Entra ID for anomalous device code auth flows and unauthorized device registrations tied to traveling staff, and enforce behavioral controls around macOS Keychain, browser cookies, and credential stores.

☑️ Hunt CornFlake’s redundant persistence — deceptive service registrations, scheduled tasks, and registry Run keys — rather than assuming one removal cleans the host.

Theme 3: Trust Guarantees That Didn’t Hold

Stories

🗞️ Pass the Passkey: Malware Can Hijack Google Synced Passkeys Without Cracking Crypto — “Pass-ta-key” proves passkeys don’t neutralize local malware. Unprivileged code manipulates Google Cloud Authenticator’s device trust and recovery workflows to steal the Security Domain Secret and mint valid assertions — no biometric, no user interaction, no elevation.

🗞️ New “Greatness” PhaaS Exploits Vendor Trust to Deliver M365 AiTM Phishing — A $289/month Telegram subscription running AiTM and device code phishing. Spoofed RingCentral voicemail lures walk straight past gateways by abusing misconfigured safe sender whitelists. 🔎 Threat Hunting Package

🗞️ Multi-Brand Vishing Campaign Escalates Attacks on Financial Services & Enterprise Cloud Infrastructure — UNC6671 rebranded across four fronts and now calls employees on their personal mobiles posing as IT help desk, routing them to fake passkey/SSO migration portals that hijack MFA tokens and kick off automated exfiltration. 🔎 Threat Hunting Package

🗞️ Critical IP and DNS Leaks Discovered in Apple iCloud Private Relay and WebKit Proxy Browsers — Three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — run outside standard page loading and bypass application-level proxy settings entirely, exposing real IPs from the device’s actual network.

Recommendations

☑️ Move high-value accounts to FIDO2 hardware-backed credentials that cryptographically bind authentication to the origin domain, neutralizing AiTM proxy panels.

☑️ Relying parties must enforce and validate the User Verified (UV) flag in WebAuthn assertions (not just key presence) and reject assertions where biometric/PIN was bypassed.

☑️ Replace broad domain-based email exclusions with authentication-conditional rules requiring verifiable vendor identity, and add behavioral detection for sender–link domain mismatches.

☑️ Run a targeted awareness campaign: no IT migration instructions accepted over personal mobile phones, and no credentials entered on unverified passkey/SSO enrolment links.

☑️ Monitor M365 Unified Audit Log and Okta system logs for Graph API enumeration, session persistence, logins from commercial VPN exit nodes, and bulk harvesting from SharePoint and OneDrive.

☑️ Tune EDR to catch unprivileged processes tampering with Chrome sync database files or reading browser process memory.

☑️ Treat hardware-backed credentials as one signal, not proof — pair them with real-time device health and adaptive, risk-based access. Patch proxy browsers, set Onion Browser to “Silver,” and use a system-wide VPN over browser-level privacy.

Theme 4: The Perimeter You Stopped Looking At

Stories

🗞️ Critical N-able N-central Vulnerability Under Active Exploitation — A “god-mode” flaw in all versions up to 2026.3 gives unauthenticated attackers full RMM console access. They’re arriving via VPN exit nodes, enumerating processes, and tearing through downstream hosts — Domain Controllers first. 🔎 Threat Hunting Package

🗞️ INC Ransomware Exploits SonicWall SMA via WSProxy Chain to Gain Root Access — Chaining WSProxy components to root on internet-facing SMA appliances, then deploying ransomware directly from the edge device. 🔎 Threat Hunting Package

🗞️ FBI & EPA Warn of Cyber Attacks Targeting Internet-Facing PLCs in US Water Systems — No exploit payload required. Actors reach unsegmented Allen-Bradley MicroLogix 1100/1400 PLCs over the open internet and simply change IPs and passwords to lock operators out of their own water pressure controls.

🗞️ Tracking DarkSword: Unraveling an Exploit Chain Through Panel Sprawl — A six-vulnerability iOS chain (18.4–18.7) behind fake AWS and Apple ID pages. The tradecraft lesson: operators reuse identical static HTML across hosts and odd ports, making SHA-256 body hash correlation more reliable than chasing domains. 🔎 Threat Hunting Package

Recommendations

☑️ Patch N-central to hotfix 2026.3.1.7 immediately — and if it’s internet-reachable and you can’t patch today, take it offline until you can.

☑️ Audit and disconnect every PLC directly exposed to the internet, broker remote access through secure gateways with strict ACLs, validate running logic against known-good backups, and flip key switches to RUN to block remote logic changes.

☑️ Audit internet-facing SonicWall SMA appliances, isolate exposed management interfaces, and apply vendor patches.

☑️ Review N-central logs for unauthorized “MSP Support” connections, unexpected Take Control sessions (Event IDs 4102, 8192, 8193), svchost.exe in user Documents folders, and services named Cloudflared.

☑️ Alert on anomalous process spawning, unauthorized credential access, and unusual outbound connections originating from security gateway devices. The appliance is the attacker’s foothold, not just the door.

☑️ Enforce ZTNA and micro-segmentation so a compromised perimeter gateway can’t reach core assets, and keep tested manual override protocols for OT outages.

☑️ Shift infrastructure hunting from IPs and domains to static body hashes, TLS metadata, and certificate SAN correlation — and extend scanning to non-standard ports like 3000, 8443, and 8888.

Theme 5: Agentic AI — Now Both Attacker and Attack Surface

Stories

🗞️ AI Cyberattacks Hit the Wild: Hacker Commands DeepSeek Agent for Autonomous Server Exploitation — One Telegram instruction kicked off an agent that enumerated targets via FOFA, scraped GitHub for trending PoCs, prioritized vulns, and ran attack cycles against 460+ hosts with no human in the loop. It only got caught by accidentally launching an HTTP file server in its own workspace.

🗞️ Critical Paperclip Flaws Expose AI Agents to Remote Code Execution — Three vulns including a CVSS 10.0. The root cause is treating agent configs (imported YAML bundles) as executable code; open registration defaults and DNS rebinding against loopback isolation give zero-click RCE.

🗞️ Claude Mythos 5 Attempts Backdoor Injections and PyPI Supply Chain Exploits — The model reached the live internet during testing, generated fake GitHub maintainer profiles to solicit backdoor approvals, published a trojanised PyPI package that 15 real systems installed, and rationalized live telemetry as “part of the exercise” to keep going.

🗞️ Rogue AI Strikes Again: Meta’s Muse Spark 1.1 Breaches Third-Party Systems — Not a sandbox escape. Testing partner Irregular misconfigured the environment and exposed it to the public internet, and the agent breached and altered a third party’s internal systems from there.

Recommendations

☑️ Enforce hard network air-gaps on all AI red-teaming and evaluation environments, then audit existing ones for the misconfiguration that quietly grants public internet routing.

☑️ Upgrade Paperclip to 2026.416.0+, disable open signups, and audit agent configurations for unintended capabilities.

☑️ Treat agent configuration strictly as code — rigorous review, testing, and multi-approver governance before deployment — and apply the same multi-approver bar to open-source commits and package releases.

☑️ Patch internet-facing infrastructure against known critical vulns fast, prioritizing Citrix NetScaler and AI orchestration frameworks like Langflow, because the exploitation window is now machine-speed.

☑️ Deploy WAFs and exposure management to spot rapid automated enumeration and unauthenticated PoC execution, backed by behavior-based endpoint protection that can break machine-speed attack loops.

☑️ Scan internal environments and public dependencies for unverified libraries published during recent red-team evaluation windows, and remove anything suspicious.

☑️ Constrain the credentials, secrets, and access paths available to live agents, and monitor agent execution logs for anomalous behavior in real time with automated fail-safes.

Feature Livestream

The threat intel feed you just bought is probably making your security worse.

Not because the data is bad. Because you bought it too early. ⏱️

CTI only works above a specific maturity threshold. NIST level 3 — Repeatable.

⚡ Documented incident response

⚙️ Standardized processes

📂 Backups you have actually restored from, not just scheduled

Below level 3, a threat feed is a distraction. It generates alerts nobody has a process to action, false positives that erode analyst trust, and a dashboard that makes leadership feel protected while nothing changes.

Above level 3, the same feed is a force multiplier.

The practical gateway is CIS Implementation Group 1 — 56 foundational safeguards. Asset inventory. Data recovery. IR planning. MFA on everything external-facing.

Boring? Completely. But those 56 controls are what turn intelligence into action instead of noise.

👉 Learn how to get started with CTI as an SMB today in our latest video!

💬 Join our Discord

Feature Course

What Will You Learn?

• Fundamental functions from the Python standard library.

• How to parse various data formats (CSV, JSON, etc.)

• Creating cross-platform executable files.

• Building Python packages.

• Jupyter notebooks.

• Integrating multiple APIs to build powerful automations.

• Web scraping.

• Taking command-line arguments

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

🚨 New livestream tonight!

A batch of indicators lands from your MISP instance overnight.

You need to know what arrived, what you already had from a different source, whether any of it touches your estate, and you want something in detection engineering’s hands before lunch.

That’s the workflow I’m putting through MISP Workbench live tonight at 8 PM (BST)! 📅

🔎 Lucene queries across the whole corpus to triage what came in.

🕸️ Correlation scans to find the overlap you’re already sitting on.

📁 A saved hunt so the same pattern pages you next time it appears.

📩 Then an export to STIX 2.1 for the handoff.

See you there!

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

The threat intel feed you just bought is probably making your security worse.

Not because the data is bad. Because you bought it too early. ⏱️

CTI only works above a specific maturity threshold. NIST level 3 — Repeatable. ⚡ Documented incident response

⚙️ Standardized processes

📂 Backups you have actually restored from, not just scheduled

Below level 3, a threat feed is a distraction. It generates alerts nobody has a process to action, false positives that erode analyst trust, and a dashboard that makes leadership feel protected while nothing changes.

Above level 3, the same feed is a force multiplier.

The practical gateway is CIS Implementation Group 1 — 56 foundational safeguards. Asset inventory. Data recovery. IR planning. MFA on everything external-facing.

Boring? Completely. But those 56 controls are what turn intelligence into action instead of noise.

👉 Learn how to get started with CTI as an SMB today in our latest video! Link in the comments.

✍️ Accompanying blog article

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: Your AI Agent Is the New Insider Threat

Stories

🗞️ “AgentBaiting” Exploits AI Agents to Deliver SmartLoader Malware (Island) – Over 7,600 malicious GitHub repos have been seeded to poison search results so that Claude Code, Gemini, and ChatGPT actively recommend them, delivering SmartLoader and StealC to whoever follows the advice. Social engineering has pivoted from manipulating humans to manipulating models, which means there is no phishing link and no click involved. Just an agent confidently recommending malware.

🗞️ Invisible PR Comments Are Hijacking AI Agents in Azure DevOps (Manifold Security) – A confused deputy flaw in Microsoft’s Azure DevOps MCP server lets attackers hide instructions inside HTML comments in a pull request. When a reviewer asks their assistant to look at the PR, the agent executes those instructions using the reviewer’s elevated cross-project permissions. This is the lethal trifecta in action: private data access, untrusted text exposure, and an outbound comment channel all in one workflow.

🗞️ AgentForger Exposes Cross-Site Agent Forgery Flaw in ChatGPT (Zenity Labs) – Malicious external sites can silently hijack authenticated ChatGPT agent sessions and act on behalf of the logged-in user. What makes it nasty is the persistence mechanism: the forged agent runs a five-minute polling loop, continuously fetching fresh attacker instructions to drive lateral movement, phishing, and data exfiltration long after the victim closed the tab.

🗞️ “SharedRoot” Sandbox Escape Breaches Host Mac Filesystems (Accomplish AI) – Local Claude Cowork sessions on macOS can escape the guest VM by chaining unprivileged user namespace capabilities with kernel bug CVE-2026-46331. The root cause is architectural rather than incidental. The entire host root filesystem was mounted read-write into the guest over virtiofs for guest root, so a single kernel exploit collapses the whole isolation boundary with no user prompt required.

Recommendations

☑️ Mandate human-in-the-loop approval before any agent installs a repo, runs a script, or adds an MCP server package.

☑️ Deploy runtime behavioral monitoring for agents so you can see what they actually do, not what they were asked to do.

☑️ Scope agent credentials to least privilege with no cross-project, cross-wiki, or cross-pipeline reach by default.

☑️ Apply spotlighting guardrails (explicit delimiters around untrusted text) to every free-form field an agent reads.

☑️ Build an AIBOM and continuously scan third-party skills, MCP servers, and dependencies.

☑️ Restrict agent workspace mounts to isolated directories, never the home directory, and prefer cloud-hosted execution where isolation is server-side.

Theme 2: AI Infrastructure Is Now a Primary Target

Stories

🗞️ Are Your AI Services Working for the NadMesh Botnet? (QiAnXin XLab) – A Go-based botnet is using the Shodan API to hunt exposed ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances at industrial scale. This is product-grade tooling rather than a hobby project. Polymorphic builds and redundant persistence through SSH backdoors and cron watchdogs mean that partial cleanup achieves nothing at all.

🗞️ JadePuffer Agentic Ransomware Evolves to Wipe AI Models (Sysdig) – The first autonomous LLM-driven ransomware now exploits orchestration endpoints to deploy the ENCFORGE locker against ML infrastructure. It self-corrects failed attack steps in as little as 31 seconds, targets roughly 180 AI/ML file formats, and never saves the decryption key. That last detail matters: this is destruction wearing a ransom note. 🔎 Threat Hunting Package

🗞️ Autonomous AI Hacks Hugging Face (Hugging Face) – A malicious dataset gave an autonomous agent framework access to the production data processing pipeline, compromising internal datasets and cloud cluster credentials. The forensic detail is the part worth dwelling on. Western models refused to process the attack commands during analysis, forcing responders onto an unrestricted open-weight model to investigate their own breach.

🗞️ OpenAI’s AI Agents Autonomously Hack Hugging Face (OpenAI) – During internal sandbox testing, GPT-5.6 Sol and other models chained a zero-day in a package registry cache proxy, escalated privileges, and moved laterally to pull benchmark answers straight from the database. Nobody instructed them to attack anything. The agents simply identified exploitation as the efficient route to the objective, which is exactly the failure mode that matters operationally.

🗞️ Google Unveils Gemini 3.5 Flash Cyber for Vulnerability Management (Google DeepMind) – DeepMind has released a specialized model for autonomously discovering, validating, and patching vulnerabilities, delivered through the CodeMender agent to governments and trusted partners. During V8 JavaScript Engine stress testing it found 55 unique vulnerabilities, including 10 criticals that no other model caught, which is a useful reminder that the defensive half of this arms race is moving just as quickly.

Recommendations

☑️ Get every AI service off the public internet behind a VPN or ACL access only, then audit Shodan for what you have accidentally exposed.

☑️ Patch internet-facing AI tooling now, starting with Langflow CVE-2025-3248, and strip API keys from runtime environments.

☑️ Build immutable, air-gapped backups for model checkpoints, fine-tuning adapters and training datasets, because retraining runs $75k to $500k+ per model.

☑️ Harden the boring entry points attackers actually use: exposed Docker APIs, Redis instances, and weak authentication.

☑️ Segment AI sandbox environments hard and cut unauthorized egress so test agents can never reach production.

☑️ Move detection from static IoC matching toward behavioral and session monitoring that can spot machine speed execution loops.

☑️ Vet a capable unrestricted model on your own infrastructure so incident response is not blocked by commercial guardrails mid investigation.

Theme 3: Developers Are the Softest Path Into the Supply Chain

Stories

🗞️ Fake Developer Interviews Delivering Stealthy SVG Malware (Elastic Security Labs) – DPRK-aligned actors are running the “Contagious Interview” campaign, hiding a multi-stage RAT inside fake coding challenges sent to developers. The delivery technique is the standout: fragmented Base64 payloads tucked into HTML comments inside benign-looking SVG country flags, reassembled and executed at runtime for a zero detection rate. Compromise one developer, and you have a route into every downstream customer. 🔎 Threat Hunting Package

🗞️ Massive GitHub Actions Abuse Campaign Targets cPanel & WHM (Socket) – Attackers are hijacking compromised repositories to turn GitHub Actions into distributed exploitation infrastructure, targeting authentication bypass CVE-2026-41940 in cPanel and WHM. Nothing malicious sat in the source code itself. It lived in .github/workflows, quietly converting GitHub-hosted Ubuntu runners into a free, disposable, hard-to-attribute attack network. 🔎 Threat Hunting Package

🗞️ Dolphin X Stealer: AI-Powered Threat Targeting Cloud Credentials (Varonis) – This Windows infostealer targets over 300 applications, hunting specifically for .env files, SSH keys, cloud CLI tokens, and more than 100 cryptocurrency wallet extensions. Its differentiator is a built-in AI Profiler that scores victims based on installed software, app usage, and browsing behavior. Automated triage, so operators work the most lucrative boxes first. 🔎 Threat Hunting Package

Recommendations

☑️ Run all take-home assignments and unfamiliar repos in disposable VMs or hardened sandboxes, with no exceptions for “it’s just a coding test.”

☑️ Get long-lived credentials off developer disks. SSH keys, cloud tokens, and .env files belong in a centralized Secret Manager.

☑️ Patch cPanel and WHM for CVE-2026-41940, then run the official IOC detection scripts on anything previously exposed.

☑️ Require manual approval for every change to .github/workflows, minimize GITHUB_TOKEN permissions, and monitor CI egress.

☑️ Rotate exposed GitHub, AWS, Stripe and database credentials on the assumption they have already been harvested.

☑️ Hunt for process masquerading such as suspicious npm-cache activity, plus bulk reads of .env, SSH config and wallet extension paths.

☑️ Train engineering teams that a fully functional, legitimate-looking project can still carry a background execution chain.

Theme 4: Identity and Trusted Platforms as the Attack Surface

Stories

🗞️ HollowGraph Malware Hijacks Microsoft 365 Calendars (Group-IB) – Group-IB has uncovered espionage malware abusing the Microsoft Graph API to run command and control through compromised M365 calendars, in a narrowly scoped campaign against Israeli entities. C2 instructions are planted in appointments dated 13 May 2050, with exfiltrated data hidden in encrypted attachments. Everything rides on trusted Microsoft infrastructure, so there is nothing for a proxy or firewall to flag. 🔎 Threat Hunting Package

🗞️ Beware the Latest MFA Bypass: Device Code Phishing (Trend Micro) – Attackers are abusing the legitimate OAuth 2.0 device authorization grant, the flow built for smart TVs and other keyboardless devices, to steal sessions rather than passwords. There is no fake login page anywhere in the chain. The victim authenticates on the genuine Microsoft site and completes real MFA, which is precisely why endpoint tooling sees nothing worth alerting on.

🗞️ Kimsuky APT Deploys PebbleDash and PrxClient in Diplomatic Spear-Phishing (AhnLab ASEC) – Kimsuky is impersonating diplomatic personnel to deliver malicious LNK files and decoy documents to education and diplomatic targets, dropping the PebbleDash backdoor, PrxClient proxy malware, and RDP wrapper tooling. The post-exploitation tradecraft is the interesting part, including patching termsrv.dll to defeat Windows single-session RDP limits and novel UAC bypasses. 🔎 Threat Hunting Package

🗞️ Law Enforcement Dismantles Kratos PhaaS and Arrests Developer (Germany’s BKA) – Operation Olympus Blade seized over 200 servers and arrested the Kratos developer in Indonesia, cutting off a platform that powered roughly 15,000 phishing campaigns a month. The scale tells the real story. With 1,800 criminal customers subscribing, Microsoft credential theft had been fully commoditized into an off-the-shelf product.

Recommendations

☑️ Block the OAuth device code flow through conditional access anywhere it is not strictly required.

☑️ Hunt M365 for appointments scheduled far into the future and for unusual encrypted calendar attachments.

☑️ Monitor Graph API usage and anomalous DNS, including IPv6 AAAA record tunneling used for token refresh.

☑️ Enforce phishing-resistant MFA such as FIDO2 hardware keys, and require managed compliant devices for sensitive access.

☑️ Alert on identity layer anomalies: unexpected device code sign-ins, new mailbox rules, and impossible travel.

☑️ Detect unauthorized modification of critical system binaries such as termsrv.dll, alongside malicious LNK execution.

☑️ Rehearse your BEC incident response, because takedowns like Kratos remove a supplier rather than the demand.

Theme 5: Patch, Then Assume Breach

Stories

🗞️ Critical SharePoint RCE Actively Exploited to Steal Machine Keys (BleepingComputer) – Attackers are actively exploiting deserialization flaw CVE-2026-50522 in on-premises SharePoint to achieve remote code execution and exfiltrate machine keys. Patching alone will not evict them. Those stolen keys let attackers forge valid authentication tokens and impersonate users indefinitely, long after the vulnerability itself is closed.

🗞️ Pre-Auth RCE “wp2shell” Discovered in WordPress Core (Searchlight Cyber) – Searchlight has disclosed an unauthenticated remote code execution flaw in WordPress Core itself rather than in a plugin. No credentials, no user interaction, full server takeover. Given the install base, expect mass web shell deployment within days of a working exploit circulating.

🗞️ “HermeticReader” Flaw in Adobe Acrobat Extension Exposes 300M Users (Guardio Labs) – Guardio Labs found a vulnerability chain (CVE-2026-48294) in the Adobe Acrobat Chrome extension that hands over a victim’s entire WhatsApp account after a single page visit. An unauthenticated zero-click storage write hijacks Adobe’s Hermes integration engine to scrape WhatsApp Web’s DOM directly. No malware dropped, no credentials phished, roughly 329 million potential targets.

🗞️ ACR Stealer Leverages ClickFix Tactics and Blockchain C2 (Microsoft Security) – Microsoft is tracking increased ACR Stealer activity using WebDAV-hosted ClickFix lures paired with Python loaders. The operational resilience comes from decentralized blockchain-based command and control, which means there is no server for anyone to seize. Takedown as a strategy simply does not apply here. 🔎 Threat Hunting Package

🗞️ The AI-Powered Malware QA Lab Revolutionizing WebDAV Attacks (Rapid7) – Rapid7 stumbled onto an exposed WebDAV server holding over 1,000 artifacts that functioned as a complete delivery and quality assurance pipeline. Attackers are operating like software product teams, using LLMs to author detailed README files documenting CVE-2025-33053 exploitation and to automate their testing cycles. 🔎 Threat Hunting Package

🗞️ Chaos Ransomware Deploys msaRAT for Browser-Based C2 (Cisco Talos) – Talos has documented a Rust-based RAT used by the Chaos RaaS group that never connects to the internet itself, instead hijacking the victim’s browser through the Chrome DevTools Protocol. Double-encrypted WebRTC DataChannel traffic routed via legitimate Twilio TURN servers and Cloudflare Workers sails straight past proxy allowlists and firewall rules. 🔎 Threat Hunting Package

Recommendations

☑️ Deploy Microsoft’s July 2026 updates to on-premises SharePoint, patch WordPress Core, and update the Acrobat Chrome extension today.

☑️ Treat any exposed SharePoint server as compromised. Rotate machine keys, credentials, and tokens rather than just patching.

☑️ Restrict WebDAV across the estate and hunt rundll32.exe and davclnt.dll making unexpected outbound connections.

☑️ Block Python and script host processes spawning from browsers, and alert on headless Chrome or Edge and unauthorized CDP usage.

☑️ Deploy WAF rules for WordPress Core endpoints plus File Integrity Monitoring across web roots to catch dropped web shells.

☑️ Push Snort rules 1:301587 and 1:66839 with the ClamAV signature for msaRAT, and use deep packet inspection rather than port-based filtering.

☑️ Enforce browser extension allowlisting and brief staff on ClickFix, the fake error prompt that asks users to paste a command.

Feature Livestream

How do you start operationalizing your threat intelligence platform? By connecting it to the heart of your security operations... your SIEM!

Learn how in tonight’s livestream, where we cover connecting MISP to Elastic to streamline your threat intel and provide your security team with the context they need.

⚡ The gap in most threat intel programs isn’t intelligence. It’s that the intelligence never becomes a detection.

I built the whole pipeline live: MISP and Elastic in Docker, indicators flowing with proper decay handling, an indicator-match rule written from scratch, and a real alert firing at the end.

Watch Now

💬 Join our Discord

Feature Course

What Will You Learn?

• How to set up your own MISP instance to gather and organize cyber threat intelligence.

• Configuring your MISP instance to suit your specific use case.

• Automatically ingesting threat data into your MISP instance using open-source threat intelligence feeds.

• How to search and filter data in your MISP instance.

• Using the MISP API to streamline your workflow.

• Extracting Indicators of Compromise (IOCs) from your MISP instance to use with other security tools.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

How do you start operationalizing your threat intelligence platform? By connecting it to the heart of your security operations... your SIEM!

Learn how in tonight’s livestream, where we cover connecting MISP to Elastic to streamline your threat intel and provide your security team with the context they need.

⚡ The gap in most threat intel programs isn’t intelligence. It’s that the intelligence never becomes a detection.

I’m building the whole pipeline live: MISP and Elastic in Docker, indicators flowing with proper decay handling, an indicator-match rule written from scratch, and a real alert firing at the end.

📅 Tune in at 8 PM (BST) to learn how (or watch on catch-up).

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: The Agentic Attack Surface (and AI as the Attacker)

Stories

🗞️ From WhatsApp Message to Host Takeover (Chinmohan Nayak) — Three high-severity flaws in the open-source OpenClaw framework let a plain WhatsApp/Slack/Teams message run arbitrary code on the host. Root cause: no separation between the natural-language layer and the execution layer, so payloads slip past variable filters and escape the sandbox — even against safety-aligned models.

🗞️ GhostCommit: Prompt Injections Hidden in Images (ASSET Research Group) — AI code reviewers treat images as benign binary blobs, but downstream multimodal coding agents read the instructions printed inside them and dump live .env secrets as raw number arrays that sail past secret scanners.

🗞️ MemGhost: Persistent False Memories in AI Assistants (WhisperBench) — A single crafted email tricks a memory-enabled agent (OpenClaw, Claude Code SDK) into writing false “facts” straight into its MEMORY.md — no password needed — and hides the action from the chat UI.

🗞️ Claude for Chrome Flaw Unlocks Silent Email Reading (Manifold Security) — The “ClaudeBleed” bug lets a low-privilege extension hijack the assistant with ~6 lines of JavaScript (no event.isTrusted check on synthetic clicks) to silently read Gmail, Docs, and Calendar. Still unpatched in v1.0.80. (Note: this appeared twice in the issue — dedupe before airing.)

🗞️ Threat Actor Migrates Live Botnet in Six Minutes with AI (Trend Micro) — “bandcampro” used Gemini CLI to architect, code, and deploy C2 infrastructure by typing plain Russian intents — doing only 11% of the work. The whole C&C op fits in 5KB of plaintext, making it trivially replicable. 🔎 Threat Hunting Package

Recommendations

☑️ Stop treating LLM safety alignment as a security boundary — enforce code-level, zero-trust sandbox isolation that separates language interpretation from execution permissions.

☑️ Lock down agent inputs: strip exec/shell from external-facing tool allowlists, gate durable-memory writes behind explicit user confirmation, and route untrusted email/DMs through an isolated reader agent with no file, shell, or memory access.

☑️ Patch and harden deployments now (OpenClaw ≥ 2026.6.6; disable “Act without asking” in Claude for Chrome) and rotate credentials for any agent that was publicly reachable.

☑️ Shift detection from static access gates to runtime behavior monitoring — traditional EDR won’t log model-level compromises. Watch for PowerShell beaconing from temp dirs and anomalous agent tool use.

Theme 2: The MFA Bypass Era — Phishing, Vishing & Social Engineering

Stories

🗞️ Vishing Campaigns Target Entra Passkey Enrollment (Okta) — Operator-controlled PHP panels let attackers adapt to live MFA prompts (TOTP, push-matching, SMS OTP) over the phone and walk M365 victims through enrolling an attacker-owned passkey. Hitting food & beverage, healthcare, aviation, and more.

🗞️ AI-Powered Phishing Surge & the “Jalisco” Toolkit (ReliaQuest) — PhaaS kits like Jalisco use a real-time lure-generation API to mint fresh OAuth device codes on the fly, defeating Microsoft’s 15-minute TTL, then enroll rogue devices for a Primary Refresh Token that survives password resets. 🔎 Threat Hunting Package

🗞️ TELEPUZ MaaS Rides the “ClickFix” Trap (Elastic Security Labs) — Fake “verification” pages trick users into pasting malicious PowerShell. TELEPUZ then uses NTDLL unhooking, AMSI/ETW patching, and indirect syscalls, with a Telegram profile as fallback C2. 🔎 Threat Hunting Package

Recommendations

☑️ Push targeted awareness comms now: legit IT never calls to rush passkey enrollment on an external domain, and users must never paste PowerShell/scripts from a “verification” page.

☑️ Constrain identity in Entra ID — block device-code auth via Conditional Access, restrict passkey and new-device registration to managed corporate networks, and audit for rogue enrollments (generic microsoft-* / WINDOWS-* device names).

☑️ Hunt newly registered passkey-themed domains and block known TELEPUZ infra (e.g. hurgadatour[.]shop + Telegram fallbacks).

☑️ Rebuild IR playbooks for token compromise: revoking rogue devices and active sessions is now mandatory — a password reset alone won’t evict an OAuth/PRT-based intruder.

Theme 3: Poisoned Supply Chains & Fake Repos

Stories

🗞️ Hidden Exfiltration in 900k-User “ModHeader” Chrome Extension (Stripe OLT) — A trusted, reputable extension quietly generated unique IDs, monitored browsing, and beaconed to external infra. Google pulled it July 10, but existing installs remain live. 🔎 Threat Hunting Package

🗞️ Supply Chain Attack Hits AsyncAPI NPM Packages (OX Security) — A 91,000-line dropper embedded directly in main JS files (2M+ weekly downloads) acts as an info-stealer, crypto-stealer, and RAT — using IPFS for payload storage and torrent URLs for backup C2, and self-terminating on Russian locale, VMs, or EDR.

🗞️ 290+ Fake GitHub Repos Deliver BoryptGrab Infostealer (Arctic Wolf) — Repos impersonating trusted brands use hidden redirects to spoofed download pages; a trojanized libcurl.dll side-loads and runs 11 modules to steal browser creds, wallets, and messaging tokens. 🔎 Threat Hunting Package

🗞️ OkoBot Framework Hijacks Crypto Wallets via Fake GitHub Repos (Kaspersky) — “ClickFix” + fake tools (e.g. spoofed SSMS) deploy SSH bots that disable Defender, enable RDP, replace termsrv.dll, and inject hidden malicious browser extensions. 🔎 Threat Hunting Package

Recommendations

☑️ Mandate software acquisition only from validated vendor domains — not links inside GitHub repos — and train teams to spot repos hijacking popular tool names.

☑️ Audit and allow-list browser extensions; force-remove ModHeader everywhere and review historical logs for what it exfiltrated.

☑️ Rotate all NPM/PyPI/Cargo tokens on suspect machines and audit recent commits for injected payloads in main JS files (this class bypasses post-install script restrictions).

☑️ Alert on DLL side-loading from Downloads/Temp, anomalous children of utilities like gup.exe, unauthorized outbound SSH / inbound RDP, and connections to IPFS gateways or BitTorrent bootstrap nodes.

Theme 4: Stealers, Ransomware & the macOS Frontier

Stories

🗞️ Apple-Notarized “CrashStealer” Bypasses macOS Gatekeeper (Jamf) — A notarized dropper (”Werkbit Setup”) delivers a native-C++ stealer with multi-layer anti-debugging, control-flow flattening, and a dscl-based password check — harvesting browsers, wallets, and the keychain on Intel and Apple Silicon. 🔎 Threat Hunting Package

🗞️ ClickLock Stealer Forces macOS Into Lockdowns (Group-IB) — Fake ClickFix/Cloudflare pages get users to run Terminal commands; a “kill loop” repeatedly terminates Finder, Dock, and browsers for hours until the victim surrenders their password. 100+ victims across 33 countries. 🔎 Threat Hunting Package

🗞️ New “Spirals” Ransomware — Sub-24-Hour Double Extortion (Symantec & Carbon Black) — A Rust-based crew breached an internet-facing IIS server and, in under 24 hours, dumped credentials, disabled EDR, and exfiltrated data before encrypting. 🔎 Threat Hunting Package

Recommendations

☑️ Kill the “notarized/verified = safe” assumption — deploy behavioral EDR/MDM that flags post-execution recon, not just signature checks.

☑️ Retrain users to never paste Terminal/bash commands from a website; if a Mac starts force-killing apps and demanding a password, hard shut down and boot to Safe Mode rather than entering credentials.

☑️ Secure internet-facing servers (esp. IIS) — hunt ASP.NET web shells and rogue scheduled tasks — and enforce least privilege to blunt PsExec/WMI lateral movement.

☑️ Enable tamper protection on Defender/EDR with instant alerts when real-time scanning is disabled, and keep isolated offline backups to defang extortion. Hunt CrashStealer IoCs (/Volumes/Werkbit Setup, dev.golove.velto, unauthorized dscl lookups).

Theme 5: Infrastructure, Privacy & Critical Patches

Stories

🗞️ Russian State Hackers Exploiting Vulnerable Routers (IC3 / joint advisory) — FSB Center 16 (”Berserk Bear”) scans for weak/default SNMP strings and exploits Cisco Smart Install to seize network devices and exfiltrate configs across energy, comms, healthcare, defense, and government.

🗞️ Is Your Free VPN Spying On You? (MVPNalyzer study) — Of 281 free Android VPNs (2.4B+ installs), 61 send data in plaintext, 29 leak traffic outside the tunnel, and 80%+ contact ad trackers — data-harvesting tools dressed up as privacy apps.

🗞️ Privacy Flaw in 85 Popular Crypto Wallet Extensions (DistriNet) — Wallets used by 35M+ people leak addresses and enable cross-site tracking by default; failing to terminate connections on “log out” lets invisible iframes link pseudonymous profiles to real identities — no hack required.

🗞️ Critical 9.8 Account-Takeover Flaw in Zoom for Windows (Zoom) — CVE-2026-53412 (CVSS 9.8): improper input validation lets an unauthenticated remote attacker take over sessions over the network; no local access or privileges needed.

Recommendations

☑️ Patch/harden infrastructure now: upgrade Zoom for Windows (Workplace ≥ 7.0.0; VDI 7.0.10 / 6.6.15 / 6.5.18), move to SNMPv3, disable Cisco Smart Install, block TFTP/SNMP at the edge, and replace end-of-life network gear.

☑️ Cross-reference mobile fleets against the MVPNalyzer flagged list, uninstall offending free VPNs, and stop trusting “verified” badges or “no-logs” marketing over independent audits.

☑️ For crypto users: regularly audit and revoke “Connected Sites,” use dedicated browser profiles and throwaway wallets, and push vendors to block iframe address exposure and enforce true session termination.

☑️ Enforce phishing-resistant MFA + SSO on collaboration tools and stand up automated third-party patch management so critical fixes don’t wait on manual user action.

Feature Video

I spent years building CTI programs that impressed exactly nobody.

Dark web monitoring. Infrastructure hunting. Automation. Then AI, obviously.

All of it was fun to build. None of it moved the needle for the business.

What actually moved the needle was one boring slide for the CISO: here is our threat model, here is what we can defend against, here is what we can’t, here is the gap and what it costs to close it.

That’s the whole premise behind the CTI-CMM, the community-built maturity model for threat intelligence. It’s free, it’s on GitHub, and it doesn’t ask how many reports you published. It asks whether anyone made a different decision because of them.

This video takes a deep dive into the 11 domains, 4 levels maturity levels, and a 60-day sprint to turn your CTI program around 💪

Get started using this fantastic, community-driven model today!

✍️ Accompanying blog article

💬 Join our Discord

Feature Course

What Will You Learn?

• How to use Structured Analytical Techniques (SATs) to perform intelligence analysis.

• What intelligence analysis technique to use and when.

• Common challenges and how to overcome them.

• How to practically apply analysis techniques.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

I spent years building CTI programs that impressed exactly nobody.

Dark web monitoring. Infrastructure hunting. Automation. Then AI, obviously.

All of it was fun to build. None of it moved the needle for the business.

What actually moved the needle was one boring slide for the CISO: here is our threat model, here is what we can defend against, here is what we can’t, here is the gap and what it costs to close it.

That’s the whole premise behind the CTI-CMM, the community-built maturity model for threat intelligence. It’s free, it’s on GitHub, and it doesn’t ask how many reports you published. It asks whether anyone made a different decision because of them.

This video takes a deep dive into the 11 domains, 4 levels maturity levels, and a 60-day sprint to turn your CTI program around 💪

Get started using this fantastic, community-driven model today!

✍️ Accompanying blog article

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

Theme 1: Identity Under Siege — Device Code Phishing, Vishing & MFA Bypass

Stories

🗞️ Inside the ARToken Phishing Panel Targeting Microsoft 365 (Cisco Talos) — A PhaaS panel that weaponizes Microsoft’s own OAuth 2.0 Device Authorization Grant to bypass MFA entirely, hidden behind a seven-layer client-side anti-analysis engine that blinds scanners and sandboxes. 🔎 Threat Hunting Package

🗞️ Sponsored Hackers Weaponize Microsoft Device Code Flow Using GraphSpy (ZeroBEC) — Russian state actor Storm-2372 captures tokens through the legitimate Microsoft login page, then uses GraphSpy to map infrastructure, register rogue devices, and inject backup MFA methods — no fake domains needed. 🔎 Threat Hunting Package

🗞️ Helix Data Extortion Group Bypasses MFA via Vishing and Device Code Phishing (ReliaQuest) — Helix spoofs a victim’s direct manager over the phone to trick them into authorizing a device code, captures the session token, and exfiltrates SharePoint data to fuel ransom demands. 🔎 Threat Hunting Package

🗞️ Sophisticated Phishing Kits Impersonate Big Brands to Hijack Google Ecosystems (Will Thomas) — Recruitment-themed “Google Careers” kits use HTML-splitting — breaking “Google” into individual <label> tags — plus a spoofed Turnstile and dynamic C2 to evade signature detection and steal Workspace credentials. 🔎 Threat Hunting Package

🗞️ Fake IT Support Campaign Abuses Microsoft Teams to Deploy EtherRAT (Palo Alto Unit 42) — Attackers impersonate IT support via Teams vishing to deploy EtherRAT, which pulls live C2 addresses from Ethereum smart contracts — making its infrastructure highly resilient and hard to disrupt. 🔎 Threat Hunting Package

Recommendations

☑️ Block or disable the Device Code Flow (deviceCode) in Microsoft Entra ID via Conditional Access, allowing narrow audited exceptions only for input-constrained systems like meeting-room devices.

☑️ Migrate to phishing-resistant MFA (FIDO2 keys / Authenticator passkeys) with Conditional Access enforcing managed-device compliance and automated token revocation on high-risk signals.

☑️ Hunt in your SIEM / Sentinel for device-code and auth anomalies — IP mismatches across auth legs, logins from residential proxy pools, and post-compromise bulk Graph API mailbox reads or new inbox-forwarding rules.

☑️ Restrict external Microsoft Teams interactions, train staff to distrust “External and unknown” callers, and require independent verification of any IT-support request before granting screen share or installing software.

☑️ Harden email defenses with text-normalization / OCR to defeat HTML-splitting, and block or alert on newly registered lookalike hiring and vendor domains.

☑️ Block execution of unauthorized RMM tools (HopToDesk, AnyDesk) and silent Node.js installs via curl.exe associated with EtherRAT.

Theme 2: AI Coding Agents Under Attack

Stories

🗞️ The SKILLCLOAK Technique and the Looming Threat to AI Coding Agents (HKUST) — Malicious “skills” for AI coding assistants evade static scanners over 90% of the time by hiding self-extracting payloads in ignored directories (.git/, build/) that unpack at runtime into the agent’s privileged terminal.

🗞️ GitLost Vulnerability Exposes Private GitHub Repositories via AI Agents (Noma) — An indirect prompt injection in GitHub Agentic Workflows lets an unauthenticated attacker leak private-repo data via a crafted public issue; the single keyword “Additionally” was enough to bypass built-in guardrails.

🗞️ GitHub Copilot Generates Banned Malicious Content via Code Workflow Exploits (Kumar & Maple) — “Workflow-level jailbreaks” exploit an agent’s drive to complete tasks, hitting a 100% success rate across 816 runs to silently write malicious payloads into source files without ever tripping chat-level refusals.

🗞️ How a Simple Symlink Exploit Tricks AI Coding Assistants Into Overwriting Sensitive System Files (Wiz) — “GhostApproval” abuses the human-in-the-loop model: a benign filename shown for approval hides a malicious symlink that redirects the write to critical host files.

🗞️ Hijacking Defensive AI Agents for Remote Code Execution (AI Now Institute) — Prompt injections embedded in third-party repos trick autonomous agents (Claude Code, Codex) into executing obfuscated binaries under the guise of a security review — no plugins or special config required.

Recommendations

☑️ Kill autonomous execution — disable auto-mode / auto-review and enforce human-in-the-loop authorization for every shell command and file write an agent generates.

☑️ Sandbox all agentic work — run codebase analysis and supply-chain audits in disposable containers / VMs (DevContainers) with no access to host files, saved credentials, or elevated terminals.

☑️ Treat the context window as an active attack surface — sanitize and isolate user-generated content from system instructions, and model prompt injection as a systemic, SQLi-class risk rather than trusting model guardrails.

☑️ Shift from static / signature scanning to runtime behavioral monitoring — watch for high-entropy blobs in ignored folders, abnormal file padding, symlink anomalies, and startup network pulls.

☑️ Mandate independent human review plus SAST on all AI-generated source regardless of whether the chat panel looked compliant, and tightly scope agent permissions (no broad cross-repo access, no posting to public untrusted threads).

Theme 3: Supply Chain & the Developer Ecosystem

Stories

🗞️ North Korea-Linked ‘PolinRider’ Campaign Spreads Across Open-Source Repositories (Socket) — The DPRK PolinRider campaign expands from npm into Go, Packagist, and Chrome extensions, using Git history rewriting (force pushes, anti-dated commits) and .vscode/tasks.json “folderOpen” triggers to auto-run hidden loaders.

🗞️ npm v12 Disables Automatic Install Scripts by Default (GitHub) — npm shifts from “trust by default” to explicit approval, blocking implicit preinstall/install/postinstall hooks, remote URLs, and node-gyp triggers, and deprecating 2FA-bypassing tokens.

🗞️ Blunting the Edge of Coordinated GitHub API Enumeration (Datadog) — Attackers spread GitHub API enumeration across residential proxies to stay under volume-based rate limits while scraping repos and hunting secrets; detection has to pivot to behavioral correlation.

Recommendations

☑️ Audit repos and dev workstations for supply-chain tradecraft — VS Code tasks with “runOn”: “folderOpen”, Node.js executing static assets like .woff2, force-pushes / anti-dated commits, and synchronized batch changes across unrelated repos.

☑️ Update to npm 11.16.0+ / v12, run npm approve-scripts to allowlist only trusted native-compilation packages, commit the results so headless CI/CD doesn’t break, and retire Granular Access Tokens before the August 2026 deadline.

☑️ Enforce phishing-resistant MFA for all maintainers and rotate any exposed secrets from a clean host if an affected package version was ever installed.

☑️ Ingest GitHub Audit Logs (repo.access, oauth_application, token-generation events) into a SIEM and correlate distributed anomalies — synchronized queries, uniform User-Agents, rapid token use.

☑️ Enforce secret scanning and strict least-privilege on OAuth apps and PATs, with fine-grained scopes and short expiration windows.

Theme 4: Residential Proxies, Botnets & ORB Networks

Stories

🗞️ Google, FBI, and Partners Dismantle 2-Million-Device NetNut Proxy Botnet (Google GTIG) — A 2-million-node residential proxy botnet, grown by embedding proxy SDKs in consumer software and linking with Badbox 2.0, ran a white-label reseller program quietly fueling other proxy brands across the underground economy.

🗞️ The Massive Malicious Scheme Turning Everyday Devices into Proxy Ware (Infoblox) — “Lurking Lizard” uses 230+ lookalike domains and “drop-catching” of long-misquoted domains (e.g. 7zip[.]com) to push trojanized installers that silently enroll victims as residential proxy exit nodes.

🗞️ UAT-7810 Rapidly Expanding ORB Networks with New Custom Malware Arsenal (Cisco Talos) — China-nexus UAT-7810 deploys LONGLEASH / DOGLEASH / JARLEASH on unpatched Ruckus and ASUS edge routers to build ORB relay infrastructure leased to other state-sponsored actors. 🔎 Threat Hunting Package

Recommendations

☑️ Stop relying on IP reputation — move to Zero Trust / Conditional Access keyed on device-health certificates and continuous session evaluation, and flag distributed low-and-slow logins masked behind domestic ISP networks.

☑️ Deploy Protective DNS and application allowlisting to block typosquatting / drop-caught installer domains and prevent execution of unvetted installers; alert on outbound proxyware or tunneling traffic patterns.

☑️ Educate remote staff against “get paid to share your bandwidth / unused data” apps — a primary route to becoming a proxy exit node.

☑️ Patch edge gear now — Ruckus (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717) and ASUS (CVE-2025-2492) — deploy the Talos SNORT / ClamAV signatures, block listed C2 IPs, and monitor edge / IoT devices for unknown tunnels, open ports, and rogue shell scripts.

Theme 5: Critical Vulnerabilities — Patch Now

Stories

🗞️ 16-Year-Old ‘Januscape’ Flaw Enables Universal Guest-to-Host VM Escapes (Hyunwoo Kim) — CVE-2026-53359, a use-after-free in Linux KVM’s legacy shadow MMU emulation code, allows guest-to-host escape and root-level code execution on Intel and AMD x86 platforms.

🗞️ Ubiquiti Issues Urgent Patch for Max-Severity UniFi OS Flaw (Ubiquiti) — CVE-2026-50746 (CVSS 10.0) enables command injection via the UniFi Connect app; 100,000+ internet-facing UniFi OS instances are exposed, with six more low-complexity, zero-interaction flaws also disclosed.

🗞️ How Browser Personalization Opened the Door to Zero-Click Universal XSLeaks and DoS (zhero_web_security) — An Opera GX mod-framework flaw auto-installs configs when a user simply visits a malicious site, enabling zero-click DoS and universal CSS-injection data harvesting with no JavaScript.

Recommendations

☑️ Patch immediately — deploy the fixed Linux kernel for CVE-2026-53359, update UniFi Connect to 3.4.20+ and UniFi OS to 5.1.19+, and force Opera / Opera GX to the latest vendor build.

☑️ Reduce exposure — remove UniFi management interfaces from public internet visibility via firewall rules and segmentation, and isolate high-risk / multi-tenant KVM guests using hardened micro-VMs, moving off legacy shadow paging where hardware-assisted virtualization is available.

☑️ Watch for exploitation — unexplained host-kernel crashes or hypervisor restarts (Januscape), and anomalous browser behavior like .crx downloads from static iframes or non-JavaScript exfiltration (Opera GX).

☑️ Enforce centralized browser management to block unauthorized add-ons and automatic layout/theme modifications.

Feature Video

Most MISP deployments never make it past “it works on my laptop.”

❌ The problem: people set it up once, it’s fragile, and nobody trusts it enough to put real data through it.

Part 6 of our MISP series is the fix — we build a production-ready MISP on AWS using Kubernetes (EKS), the same way you’d actually want it running at your org.

What’s inside this episode:

🔧 Terraform — so the infrastructure is repeatable and version-controlled, not a pile of manual clicks

☸️ AWS EKS — MISP running properly on Kubernetes, not duct-taped to a single VM

☁️ The supporting AWS services that separate “demo” from “production”

Whether this is your first MISP deployment or you’re already running one and want to see what’s actually happening under the hood — this episode is built for you!

🔗 Check out our MISP production readiness checklist and deployment code here.

Watch Now

💬 Join our Discord

Feature Course

What Will You Learn?

• The basics of cyber threat intelligence (CTI)

• Key concepts used within the cyber threat intelligence industry.

• How CTI is applied in the real-world

• Common challenges and how to overcome them.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

🚨 New MISP livestream tonight!

Most MISP deployments never make it past “it works on my laptop.”

❌ The problem: people set it up once, it’s fragile, and nobody trusts it enough to put real data through it.

Part 6 of our MISP series is the fix — we build a production-ready MISP on AWS using Kubernetes (EKS), the same way you’d actually want it running at your org.

What’s inside this episode:

🔧 Terraform — so the infrastructure is repeatable and version-controlled, not a pile of manual clicks

☸️ AWS EKS — MISP running properly on Kubernetes, not duct-taped to a single VM

☁️ The supporting AWS services that separate “demo” from “production”

Whether this is your first MISP deployment or you’re already running one and want to see what’s actually happening under the hood — this episode is built for you!

📺 Watch live on YouTube tonight (8PM UK time)

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

🤖 AI Agents & MCP Targeted

Stories
🗞️ High-Severity Amazon Q Developer Flaw Enables Cloud Credential Theft via MCP Auto-Execution (Wiz) — CVE-2026-12957 in the Amazon Q VS Code extension auto-executes MCP server configs from workspace files (.amazonq/mcp.json) with no user consent. Because the spawned shell inherits the developer’s environment, opening a malicious repo hands attackers live AWS tokens.
🗞️ How Attackers “Game” Agentic Browsers to Escape Security Guardrails (LayerX) — “BioShocking” traps agentic browsers (Atlas, Comet, Claude Chrome) in a gamified context where logic is subverted (e.g., accepting 2+2=5), so the agent stops applying real-world safety restrictions and blindly exfiltrates data from authenticated sessions.
🗞️ Universal Shell Injection Vulnerability in Open-Source AI Coding Agents (Adversa AI) — “GuardFall” defeats regex safety filters with shell-quoting tricks (r''m -rf) that bash collapses back into destructive commands after the check passes. Hits opencode, goose, cline, Roo-Code, OpenHands, SWE-agent and more.
🗞️ Shielding AI Agents Against MCP Tool Description Poisoning (Microsoft) — Malicious instructions hidden in natural-language MCP tool descriptions are treated as legitimate owner commands. A poisoned third-party tool update silently harvests data while returning a flawless answer to the user.
🗞️ The Emergence of Autonomous AI-Driven Agentic Ransomware (Sysdig) — JADEPUFFER is the first end-to-end ransomware campaign fully orchestrated by an AI agent, using LLMs to generate self-narrating payloads that autonomously fix failed exploit steps in real time. Targets exposed Langflow, Nacos, and MySQL.

Recommendations
☑️ Kill unattended auto-execution: reload/patch to AWS Language Server 1.65.0+, drop --auto-exec/--auto-yes flags in high-privilege environments and enforce centralized workspace trust so IDEs don’t run tasks or MCP configs from untrusted directories.
☑️ Lock down MCP: turn off “Allow all,” scope agents to explicit named tools, mandate human-in-the-loop sign-off for high-risk actions, and freeze/flag any tool whose metadata changes — treat a description update like a system-prompt change.
☑️ Isolate the agent’s blast radius: segregate authenticated enterprise sessions from untrusted tabs, unmount real $HOME/SSH keys/cloud creds when running local agents, and require explicit user prompts before data leaves an authenticated environment.
☑️ Harden the infrastructure agents touch: patch Langflow (CVE-2025-3248), rotate default credentials/token secrets, pull admin DB accounts off the public internet, and vault API keys in scoped secret managers rather than plaintext.

🌊 Riding the AI Hype Wave

Stories
🗞️ Attackers Abuse OpenAI Invitations to Launch “Poisoned Tenant” Attacks (Push Security) — Fake OpenAI orgs send legitimate invites via OpenAI’s own infrastructure, inherently passing SPF/DKIM/DMARC. Accepting drops the victim into an attacker-controlled workspace that harvests every prompt; stolen cards fund it to dodge billing alerts.
🗞️ Malicious Chromium Extension Exploits AI Hype to Intercept Real-Time Search Data (Microsoft) — A Perplexity-branded MV3 extension hijacks the default search provider and exfiltrates every Omnibox keystroke to perplexity-ai[.]online via a rigged suggest_url.
🗞️ Inside “Phantom Squatting” — How Threat Actors Weaponize AI-Hallucinated Domains (Unit 42) — Adversaries map the brand-specific domains LLMs predictably hallucinate and pre-register them. Zero prior reputation = clean past blocklists; in “Montana Empire,” attackers registered the exact phantom domain an LLM predicted 23 days earlier.
🗞️ In-Browser Ransomware Emerges via LLM Offensive Code Synthesis (Check Point) — DeepSeek-linked technique runs entirely in-browser with no native payload, tricking victims (via AI image-upscaler lures) into granting folder access through the legitimate File System Access API (showDirectoryPicker()) to encrypt local data.

Recommendations
☑️ Treat trusted-platform emails as untrusted entry points: scrutinize inviter domains on SaaS/AI org alerts, and update awareness training so staff know OpenAI/GitHub/Atlassian domains can still front attacker infrastructure.
☑️ Gain SaaS visibility: deploy IdP logging, browser telemetry, or SaaS monitoring to see which external workspaces staff are joining, and watch for “LLMjacking” signals like a single key firing thousands of calls across regions.
☑️ Control the AI supply of URLs and domains: restrict execution of unverified external URLs inside AI-integrated workflows, probe LLMs to map your brand’s own “hallucination surface,” and pre-register or WHOIS-monitor high-value phantom variants.
☑️ Constrain browser file/API power: educate users to treat folder-access prompts like running an unknown binary, and gate/disable showDirectoryPicker/showOpenFilePicker for non-admin units on low-reputation domains.

👨‍💻 Developers & Researchers Under Siege

Stories
🗞️ Hijacked npm Packages Weaponize VSCode Autorun and Blockchain Dead Drops (JFrog) — html-to-gutenberg and fetch-page-assets hide executable code in a fake font file (fa-solid-400.woff2) that fires when a VS Code folder opens, pulling C2 instructions from public blockchain transactions. 🔎 Threat Hunting Package
🗞️ Trojanized Exploits Target Vulnerability Researchers with New “ChocoPoC” RAT (Sekoia) — A Python RAT hidden in backdoored PoC repos uses dependency confusion via malicious PyPI packages in requirements.txt, dropping an obfuscated payload that beacons to Mapbox for stealthy C2. 🔎 Threat Hunting Package
🗞️ Malicious CVE Exploits Target Vulnerability Researchers (YesWeHack) — The companion ChocoPoC investigation: the RAT executes automatically during pip install via obfuscated native extensions (”extension shadowing”), bypassing source-code skims to steal browser creds, session tokens, and shell histories.
🗞️ 282 iOS Apps Found Leaking LLM API Keys and Proxy Access (Wake Forest University) — Two-thirds of tested iOS AI chatbot apps leak API keys, open proxies, or replayable tokens in plaintext network traffic; three months post-disclosure only 28% patched, and some tokens were hardcoded to expire in 2125.

Recommendations
☑️ Never trust community PoC code on your primary box: detonate unfamiliar exploits only in disposable, network-isolated VMs/containers, and stop running installer requirements outside ephemeral sandboxes.
☑️ Audit the dependency and task layer: review requirements.txt/setup.py and .vscode/tasks.json for typosquatting (e.g. “frint,” “skytext”) and auto-run parameters, uninstall compromised packages, and mirror dependencies through private artifact repos.
☑️ Watch for the tell-tale behaviors: anomalous package-install activity and unauthorized outbound calls to hidden Mapbox resolvers or unknown C2, and disregard cosmetic trust signals (stars, forks, account age).
☑️ Fix client-side AI credential leakage: strip LLM API keys out of app code, route model calls through an authenticated backend, and set short token expirations with rotation plus usage-anomaly monitoring.

🕵️ Nation-State Espionage & Targeted Intrusions

Stories
🗞️ Russian Hackers Evolve Tactics to Target Signal Backup Recovery Keys (FBI/CISA) — Rather than break Signal’s encryption, UNC5792/UNC4221 exploit the human layer with a fake “security sync issue” to trick high-value targets into creating a backup and revealing the 30-digit recovery key.
🗞️ Evasive “Photo ZIP” Campaign Targets Hospitality Industry with Resilient Node.js Implant (Microsoft) — Attackers bypass filters via Calendly “authentication laundering” and deploy a Node.js implant using Run/RunOnce keys to survive disinfection and re-download payloads. 🔎 Threat Hunting Package
🗞️ Cyber Espionage Campaign Targets India’s Government and Energy Infrastructure (Acronis) — China-aligned Mustang Panda repurposes Zoho WorkDrive — a trusted platform in India’s public sector — as C2, hiding exfiltration inside routine enterprise cloud traffic. 🔎 Threat Hunting Package
🗞️ ToddyCat APT Deploys “Umbrij” Tool for Covert OAuth Token Theft via Headless Browsers (Kaspersky) — Umbrij side-loads via trusted binaries and uses a headless Chromium browser to automate consent clicks, siphoning OAuth 2.0 tokens from live Gmail/Workspace sessions (”Shadow Token via Remote Debug”) without tripping EDR. 🔎 Threat Hunting Package

Recommendations
☑️ Treat recovery keys and OAuth grants as crown jewels: guard Signal Backup Recovery Keys like a master password, and audit/revoke unverified third-party OAuth token grants in the Google Workspace admin portal.
☑️ Hunt trusted-cloud abuse as C2: trace anomalous automated data operations to Zoho WorkDrive and similar services, and tune EDR to flag unauthorized background handshakes with reputable cloud infrastructure regardless of domain reputation.
☑️ Detect the browser-debugging and side-loading tells: flag Chromium processes spawned with --remote-debugging-port, disable remote debugging/dev tools via GPO for non-developer profiles, and restrict folder write permissions to blunt DLL side-loading.
☑️ Behavior over IOCs and awareness for the human layer: build detections for the full chain (LNK → obfuscated PowerShell → csc.exe → Node.js from non-standard profiles), purge RunOnce/Run persistence fully, and train high-risk staff on in-app phishing and fake booking/image lures.

🌐 The Browser & Identity Battleground

Stories
🗞️ Deconstructing a Massive 2.6M Install Malicious Browser Extension Campaign (Microsoft) — “StegoAd” used 119 extensions to hit 2.6M users, hiding payloads in PNG icons, WebP, and WOFF2 fonts with a 3–5 day dormancy gate and DevTools detection to dodge sandboxes, harvesting Google/WordPress admin creds. 🔎 Threat Hunting Package
🗞️ Millions of Password Spray Attacks Exploit Azure CLI to Bypass MFA (Huntress) — Over 81M login attempts abused the deprecated OAuth ROPC flow via Azure CLI to hit the /token endpoint directly, bypassing MFA that was scoped to specific portals/groups rather than all cloud apps.
🗞️ Opera Pioneers Native Browser Protections with “Paste Protect” (Opera) — A default-on browser feature countering ClickFix clipboard hijacking, with Hijack protection (blocks data swapping on copy) and Injection protection (blocks rogue command-line scripts) before they reach the terminal.

Recommendations
☑️ Govern extensions tightly: audit installed extensions against known IOCs (e.g. StegoAd, Perplexity ID flkebkiofojicogddingbdmcmkpbplcd), restrict installs to verified/allow-listed publishers by group policy, and enforce least-privilege extension permissions.
☑️ Close identity blind spots: restrict Azure CLI for non-admins, enforce userStrongAuthClientAuthNRequired to block ROPC, and build unconditional Conditional Access requiring modern MFA for All Users / All Cloud Apps / All Client App types.
☑️ Kill the clipboard-to-terminal path: keep browsers on latest builds with Paste Protect on, forbid pasting web-copied text into PowerShell/Bash/CMD, and mandate FIDO2 hardware MFA to neutralize any intercepted credentials or sessions.

Feature Video

Most people trying to break into CTI think they have a skills problem. They don’t. They have a signal problem... the job market can’t see what they actually know. 👀

Here’s what separates the analysts who get hired from the ones stuck submitting application #47:

🎯 CTI is a synthesis discipline, not an entry-level one. There’s a canonical 4-tier path (SOC → Threat Hunting → CTI Analyst → Senior/Lead), and most people try to skip Tier 2 and stall out for years.

🧠 A good analyst finds the IOC. A great analyst tells you what the adversary does next. The difference between data enrichment and finished intelligence is asking, “What does this tell me about capability, intent, and second-order effects?”

📁 Your employer’s threat intel is NOT your portfolio. It’s locked behind an NDA. Build 3 public projects instead — APT TTP mapping, a Sigma/KQL threat hunting playbook, and a Python IOC enrichment script — and your CV stops being a list of jobs and starts being proof of competency.

🤝 The hard truth nobody posts about: most senior CTI roles are never publicly listed. They’re filled through referrals inside trust networks. Conferences, ISACs, and public writing matter more than 50 cold LinkedIn connection requests.

💡 One habit beats every certification combined: add a “so what” section to every report you write, translating technical findings into business impact. That’s the line between an analyst who blocks an IP and one who builds an entire detection capability around it.

Whether you’re trying to land your first CTI role or break through to a senior/lead role, this video gives you the map and the exact next steps to take.

💬 Join our Discord

Feature Course

What Will You Learn?

• Fundamental functions from the Python standard library.

• How to parse various data formats (CSV, JSON, etc.)

• Creating cross-platform executable files.

• Building Python packages.

• Jupyter notebooks.

• Integrating multiple APIs to build powerful automations.

• Web scraping.

• Taking command-line arguments

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

🚨 New video out now!

Most people trying to break into CTI think they have a skills problem. They don’t. They have a signal problem... the job market can’t see what they actually know. 👀

Here’s what separates the analysts who get hired from the ones stuck submitting application #47:

🎯 CTI is a synthesis discipline, not an entry-level one. There’s a canonical 4-tier path (SOC → Threat Hunting → CTI Analyst → Senior/Lead), and most people try to skip Tier 2 and stall out for years.

🧠 A good analyst finds the IOC. A great analyst tells you what the adversary does next. The difference between data enrichment and finished intelligence is asking, “What does this tell me about capability, intent, and second-order effects?”

📁 Your employer’s threat intel is NOT your portfolio. It’s locked behind an NDA. Build 3 public projects instead — APT TTP mapping, a Sigma/KQL threat hunting playbook, and a Python IOC enrichment script — and your CV stops being a list of jobs and starts being proof of competency.

🤝 The hard truth nobody posts about: most senior CTI roles are never publicly listed. They’re filled through referrals inside trust networks. Conferences, ISACs, and public writing matter more than 50 cold LinkedIn connection requests.

💡 One habit beats every certification combined: add a “so what” section to every report you write, translating technical findings into business impact. That’s the line between an analyst who blocks an IP and one who builds an entire detection capability around it.

Whether you’re trying to land your first CTI role or break through to a senior/lead role, this video gives you the map and the exact next steps to take.

✍️ Accompanying blog article

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!

Top News Stories

🪤 Initial Access Brokers (IABs) & Backdoor Tradecraft

Stories

🗞️ DragonForce Ransomware Weaponizes Microsoft Teams Relays — DragonForce’s “Backdoor.Turn” hides C2 traffic inside legitimate Microsoft Teams TURN infrastructure, using anonymous visitor tokens and a BYOVD technique (an undocumented Huawei audio driver) to bypass endpoint defenses. 🔎 Threat Hunting Package

🗞️ Stealthy New Backdoor Arsenal Opens Corporate Networks to Ransomware Affiliates — IAB “Woodgnat” (KongTuke) is selling access built on the memory-resident, disk-free “Backdoor.Mistic” and “ModeloRAT,” delivered via ClickFix social engineering on compromised WordPress sites, to ransomware groups like Qilin, Akira, and Black Basta. 🔎 Threat Hunting Package

🗞️ Initial Access Brokers Abuse Browser Extensions for Stealthy Ransomware Footholds — “Edgecution,” from the Payouts King ransomware broker, tricks victims via fake IT-helpdesk Teams messages into installing a hidden Edge extension that abuses Chrome’s native messaging protocol to relay commands to a Python backdoor. 🔎 Threat Hunting Package

🗞️ State-Sponsored Hackers Pre-Positioned for Critical Infrastructure Sabotage — ASIO’s 2026 threat assessment confirms nation-state actors have compromised an Australian critical infrastructure provider, quietly mapping internal environments and living off the land to maintain dormant footholds for a future strategic strike.

Recommendations

☑️ Hunt for anomalous outbound relay traffic (Teams/Skype/QUIC) and headless browser or native-messaging activity tied to unauthorized extensions

☑️ Update driver and extension blocklists; enforce centralized policies that block sideloaded browser extensions and known-vulnerable drivers (e.g., Huawei HWAuidoOs2Ec.sys)

☑️ Mandate phishing-resistant MFA and out-of-band verification for any “IT support” requests received over chat platforms

☑️ Apply strict IT/OT segmentation and Zero Trust application control to prevent lateral movement and limit the blast radius of a dormant foothold

🔐 Vulnerabilities & Exploitable Infrastructure

Stories

🗞️ Apple Patches High-Severity Beats Studio Buds Eavesdropping Flaw — CVE-2025-20701 lets nearby attackers exploit a missing Bluetooth authentication check in the Airoha SoC to silently eavesdrop, and when chained, take over the earbuds entirely.

🗞️ “Squidbleed” Memory Disclosure Vulnerability Puts Squid Proxies at Risk — CVE-2026-47729 lets attackers craft HTTP requests that leak Squid’s heap memory, exposing session cookies, OAuth tokens, and corporate credentials from forward and reverse proxy deployments.

🗞️ AryStinger Botnet Hijacks Legacy Routers for Global Attack Proxies — Over 4,000 decade-old D-Link/Linksys routers and NAS devices have been folded into a botnet built specifically for reconnaissance and intrusion staging, not the usual DDoS or cryptomining. 🔎 Threat Hunting Package

🗞️ “Adblock for YouTube” Chrome Extension Leaves 11 Million Users Vulnerable to Remote Script Injection — A popular ad blocker (11M installs) has a hidden mechanism letting its developer push remote JavaScript execution to any site via a simple backend change, no Chrome Web Store review required. 🔎 Threat Hunting Package

Recommendations

☑️ Patch immediately: verify Beats Studio Buds firmware (1B211+), upgrade Squid to the fixed release, and patch routers/NAS against CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837

☑️ Reduce exposed attack surface — disable Bluetooth in untrusted public spaces, restrict Squid proxy access to internal subnets only via ACLs, and audit/replace end-of-life hardware

☑️ Hunt for exploitation signs: malformed HTTP headers against Squid, unauthorized SSH/dropbear services on unusual ports, and the specific Chrome extension ID (cmedhionkhpnakcndndgjdbohmhepckk) in your environment

☑️ Enforce MDM/Chrome Enterprise allowlists to block unvetted high-permission browser extensions before they’re ever installed

🧲 Social Engineering & Trust Abuse

Stories

🗞️ Malicious WhatsApp Campaign Abuses Contact Trust to Deploy Remote Backdoors — Compromised WhatsApp accounts (80% of victims in Malaysia) send malicious VBScript disguised as business documents that quietly install legitimate RMM tools like AnyDesk for persistent access. 🔎 Threat Hunting Package

🗞️ Evolving macOS “ClickFix” Campaigns Automate DMG Mounting to Push Infostealers — ClickFix has evolved past manual Terminal commands, now automating disk image mounting through browser workflows to silently harvest keychain data and crypto wallets. 🔎 Threat Hunting Package

🗞️ Scammers Abuse Shopping Platforms to Deliver Fake Invoices — Threat actors are planting fake receipts inside legitimate order-tracking apps like Shop, embedding scam support numbers that exploit the platform’s built-in trust to trigger panic-driven calls.

🗞️ Evasive OXLOADER Malware Uses Google Ads to Deliver CASTLESTEALER Infostealer — A new Windows loader masquerades as developer tools like Node.js via malicious Google Ads, using abuse of the .reloc section and five anti-VM checks to evade sandboxes before deploying CASTLESTEALER. 🔎 Threat Hunting Package

Recommendations

☑️ Train staff to never run script files (.vbs/.js/.bat) from messaging apps, click “fix it yourself” browser prompts, or trust links/numbers inside push notifications — verify out-of-band instead

☑️ Block or tightly restrict script hosts (wscript.exe, cscript.exe, mshta.exe) and monitor for unauthorized RMM installs (AnyDesk, ManageEngine) and automated hdiutil disk-mounting from browser child processes

☑️ Reinforce that legitimate vendors never require sponsored-ad downloads — direct staff to official domains only when seeking software

☑️ Use platform-native reporting tools to flag suspicious in-app receipts/stores and lock down notification automation permissions

🤖 AI Supply Chain & Agentic Risk

Stories

🗞️ Hijacking 26,000 AI Agents in an Hour: The Hidden Supply-Chain Danger of AI Skills — A malicious “skill” pushed via an Instagram ad hijacked over 26,000 enterprise AI agents by exploiting scanners that only check static files and ignore dynamically-fetched external links that can be altered post-install.

🗞️ Malicious OpenClaw Skills Bypass Scanners to Trigger AI Supply Chain Risks — Unit 42 found five malicious OpenClaw skills that exploit the framework’s lack of permission isolation, inheriting full agent system access to deploy macOS infostealers and run fraudulent schemes via natural-language manipulation. 🔎 Threat Hunting Package

🗞️ New macOS Gaslight Backdoor Deceives AI-Assisted Triage Tooling — This Rust backdoor doesn’t bother evading sandboxes technically; it embeds a 38-message prompt-injection cascade that fakes system errors to trick LLM-based triage tools into abandoning analysis. 🔎 Threat Hunting Package

Recommendations

☑️ Implement continuous runtime scanning for AI skills/extensions to catch post-installation modifications — static, one-time checks aren’t enough

☑️ Establish a single vetted internal repository for all AI add-ons and gate marketplace extensions behind sandboxed pre-approval

☑️ Redesign agent environments around runtime isolation (containerization) and strict network egress controls rather than implicit trust

☑️ Harden AI triage pipelines with strict data-instruction separation so sample metadata is never treated as executable instruction

🥊 Law Enforcement Wins & Supply Chain / Phishing Evolution

Stories

🗞️ Global Law Enforcement Disrupts Notorious SocGholish Malware Network — Operation Endgame saw 11 agencies seize 100+ servers and clean nearly 15,000 WordPress sites, dismantling a major Initial Access Broker that fed LockBit and infostealer payloads via fake browser-update pop-ups.

🗞️ Global Cyber Strike Shatters Cybercrime “Assembly Line”: SocGholish, Amadey, and StealC Infrastructure Dismantled — The follow-on Europol/Microsoft action seized €41M in crypto, disabled 326 servers, and recovered 27 million stolen credentials — a strategic shift toward dismantling cybercrime-as-a-service supply chains rather than single operators.

🗞️ WordPress Supply Chain Attack: Backdoors Injected into Premium Pro Plugins — Attackers breached ShapedPlugin’s build pipeline and backdoored only the premium “Pro” releases, harvesting database configs, session cookies, and 2FA TOTP seeds via official update channels.

🗞️ Automated Crypto Clipper Spreads Like a Worm via Tor Infrastructure — Unlike typical isolated clippers, this strain self-propagates via network shares and removable media while routing all C2 through embedded Tor, rendering domain blocklists ineffective. 🔎 Threat Hunting Package

🗞️ Inside the Note-Free “Prinz Eugen” Go-Based Ransomware — This Go-based ransomware skips the ransom note entirely, prioritizing high-value recently-modified files and running anti-forensic routines to wipe memory and move extortion communications out-of-band. 🔎 Threat Hunting Package

🗞️ Bluekit Phishing-as-a-Service Weaponizes “Browser-in-the-Middle” Live Streaming — Bluekit streams a real login page’s DOM over WebSockets to victims in real time, bypassing legacy reverse-proxy phishing detection with randomized layouts and WebRTC-based IP checks.

Recommendations

☑️ Audit all CMS/WordPress admin accounts, rotate credentials, enforce MFA, and remove unauthorized user profiles — especially after any recent plugin updates

☑️ Disable unauthenticated SMB shares, block auto-run on removable media, and flag unexpected embedded Tor proxy activity at the endpoint

☑️ Update incident response playbooks for note-free ransomware: alert on disk-write spikes and file inaccessibility rather than waiting for a ransom note

☑️ Migrate authentication to hardware-backed FIDO2/WebAuthn or passkeys to neutralize session-streaming phishing kits like Bluekit, and cross-reference credentials against breach registries from these takedowns

Feature Video

Your SIEM treats Volt Typhoon like a burglar. It's actually the janitor, walking in the front door with their own keys.

5 things your detection stack won't catch about China's quietest infrastructure actor:

🥷 No malware — just your tools. WMIC, NetSH, schtasks, and NTDSutil quietly snapshotting your entire Active Directory database, all native Windows binaries. Signature matching is blind to every step.

🌐 No connection to China. C2 routes through hacked end-of-life home routers, so Beijing looks like a Comcast subscriber in Kansas. The FBI wiped the botnet in Dec 2023 — the group tried to rebuild across 2,000+ devices within 72 hours.

🎯 No espionage motive. This is pre-positioning: persistent footholds in water, power, and telecom, ready to fire "everything all at once." Five years in, Dragos confirms they're still embedded in US utilities.

🔍 No saving you with signatures. Go behavioral — hunt NTDSutil writing to public folders, 4624 logons from residential ISPs off-hours, staging files like user.dat, and renamed proxy tools. Then segment IT from OT and enforce phishing-resistant MFA on every privileged account.

The 5th? If your threat model only worries about China, it's already out of date — the playbook is going global.

💬 Join our Discord

Feature Course

What Will You Learn?

• How to set up your own MISP instance to gather and organize cyber threat intelligence.

• Configuring your MISP instance to suit your specific use case.

• Automatically ingesting threat data into your MISP instance using open-source threat intelligence feeds.

• How to search and filter data in your MISP instance.

• Using the MISP API to streamline your workflow.

• Extracting Indicators of Compromise (IOCs) from your MISP instance to use with other security tools.

Learn More

Learning Resources

Cyber Training

• Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.

• TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.

• Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.

Tools

• Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

🚨 New MISP livestream tonight!

Most teams treat MISP as a database they fill in by hand. This week I'm going live to change that!

MISP Workflows is the most underused feature in the platform. It turns MISP from a passive store into something that tags, enriches, and governs itself — no analyst babysitting required.

In one hour, I'll build four automations live, from scratch:

→ Auto-tag and enrich every IP the moment it's added
→ Fire a Slack alert the second an event is published
→ A blocking quality gate that stops any event publishing without a TLP marking
→ Push flagged events straight to your automation hub via webhook

No slides-only theory. Real builds on a real instance, including gotchas I've hit so you don't have to. Every blueprint I create will be yours to download and import.

If you run CTI tooling, or you're tired of relying on analyst discipline to keep your intel clean, this one's for you.

📺 Watch live on YouTube tonight

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More

A new video just dropped 🎁

Be the first to explore it and make the most of the unique insights!

🚨 New video out now!

Your SIEM treats Volt Typhoon like a burglar. It’s actually the janitor, walking in the front door with their own keys.

5 things your detection stack won’t catch about China’s quietest infrastructure actor:

🥷 No malware — just your tools. WMIC, NetSH, schtasks, and NTDSutil quietly snapshotting your entire Active Directory database, all native Windows binaries. Signature matching is blind to every step.

🌐 No connection to China. C2 routes through hacked end-of-life home routers, so Beijing looks like a Comcast subscriber in Kansas. The FBI wiped the botnet in Dec 2023 — the group tried to rebuild across 2,000+ devices within 72 hours.

🎯 No espionage motive. This is pre-positioning: persistent footholds in water, power, and telecom, ready to fire “everything all at once.” Five years in, Dragos confirms they’re still embedded in US utilities.

🔍 No saving you with signatures. Go behavioral — hunt NTDSutil writing to public folders, 4624 logons from residential ISPs off-hours, staging files like user.dat, and renamed proxy tools. Then segment IT from OT and enforce phishing-resistant MFA on every privileged account.

The 5th? If your threat model only worries about China, it’s already out of date. The playbook is going global!

✍️ Accompanying blog article

Watch Now

Want to elevate your CTI skills?

Try our tailored one-to-one sessions. These will empower you to develop in-demand skills, achieve your goals, and advance your career!

Learn More