Subscribe now

🛡️Tactical Challenges

A little over a week ago, Microsoft published this report on Storm-2945, a Midnight Blizzard sub-cluster (the same SVR-linked crew behind SolarWinds), which has been hijacking hotel and conference Wi-Fi captive portals since May to run what they’re calling CaptiveCrunch. The initial attack vector is exploitation of the network gear serving the captive portal, followed by a redirect into device-code phishing against Entra ID or malware delivery via ClickFix. Once on the box, it’s a Go-based RAT (CornFlake) and PowerShell infostealer (ChocoShell) which target session cookies, saved passwords, and M365 SSO tokens.

This is what identity attacks look like in 2026: no exploit, no zero-day, nothing (necessarily) written to disk. And it’s a post-authentication attack, so phishing-resistant MFA doesn’t save you. We’ve researched these kinds of attacks a TON at my day job, and I posted a short video about this specific campaign on LinkedIn explaining how best to defend against them.

🤖 Emerging Threats

You Get a Passkey Attack, and YOU Get a Passkey Attack, and YOU Get a Passkey Attack!

Speaking of identity attacks, The Hacker News covered some interesting research last week around defeating passkey protections, which isn’t great news if you’re depending on passkeys to keep your users safe from phishing and other identity attacks. But not to worry; in every case, successful exploitation requires pre-existing access to/persistence on the endpoint, and/or an attack chain that has been disrupted by security updates released since disclosure.

At a high level, the attacks target how passkeys get synced/recovered/exposed by the underlying OS and cloud providers. So the implication is that if you’re using passkeys, but not hardening the surrounding infrastructure, you may still be at risk. One technique reused signed auth material exposed by Windows, another abused a cloud-synced passkey system via malware already resident on the victim’s machine (again, assumed access), and the third targeted the MFA flow itself.

This latter one is the most interesting to me. In a presentation at Black Hat on “Pass-the-Passkey,” SpectorOps researcher Michael Grafnetter shows that YubiKey signatures are stored in clear text and are readable by authenticated users. Microsoft is tracking this as CVE-2026-34348, which is technically a vuln in the Windows Event Logging Service. Exploiting it doesn’t require the attacker to extract the private key from a YubiKey - they just need to grab and reuse the generated signature retained by Windows.

No evidence of this one being exploited in the wild yet, but something to keep an eye out for - maybe also an opportunity to soften or rework language around passkeys “eliminating phishing risk” (which hopefully you aren’t using anyway). Also maybe ask your incident response team if device compromise is treated as a passkey-invalidating event.

You can check out the full rundown from The Hacker News here, which includes links to the research covered.

👤 People and Processes

AI and Security Decision Fatigue

Sam Sabin at Axios published a piece on executive decision fatigue despite expanding budgets and board support for “AI attacks”. While CISOs focus on defining AI governance strategies and figuring out which shiny new widgets they might need to identify risks posed by AI-enabled threats, frontier models continue to add new capabilities, and security debt in other areas continues to build. Some good insights here from people in the field, many of which boil down to “focus on the fundamentals” and tackling agent permissions, identity, logging, and accountability. Read the full piece here.

Templates for Cybersecurity Executive Briefings by Lenny Zeltser

Prepping for a briefing? Lenny Zeltser has published four super helpful templates: a Cyber Threat Intelligence brief for distilling a full CTI report or synthesizing vendor/government reporting on an emerging threat; a Vulnerability Investigation brief for evaluating a “celebrity” vulnerability against your organization’s exposure; an Incident Response brief for use during an incident, after containment, or for incidents too small to warrant a full report; and a Cybersecurity Assessment brief for distilling findings after a pen test or vulnerability assessment.

All of these are built on principles from Lenny’s SANS course Cybersecurity Writing - and you can have them for free!

Risk As the Language of Vulnerability Management

This piece by Todd Tucker at the FAIR Institute caught my eye, having just listened to last week’s episode of The CISO Series Podcast, “Why Don’t You Tell Me Which Risk Metrics Sound Most Impressive",” which covered (among other things) vanity metrics presented by CISOs. The article centers on a CISO who came up through vulnerability management and knows the discipline cold, but who is struggling to turn CVSS scores, exploitability ratings, and other signals into an actionable conversation for her CFO and Board; basically, she needs a language overhaul more than a technical one.

The article claims that security’s biggest value driver is risk reduction, not cost reduction. Tucket also advocates decoupling FAIR-the-mindset from FAIR-the-quantification-program. FAIR doesn’t necessarily require a large team, Monte Carlo simulations, and dedicated analysts; the most valuable part of the exercise is the structured way of thinking and shared language.

For vuln management specifically, Tucker names two payoffs:

1. Justifying investment: instead of walking into a budget conversation with thousands of critical findings, you frame the few that matter as a loss scenario the business already worries about - even directional framing (”high likelihood of serious loss because we run end-of-life systems”) is better than a severity count.

2. Aligning priorities: the scenario framing translates a technical finding into a breach scenario leadership already has in mind, and forces the one question only the business can answer: how large the harm would actually be.

The piece gets pretty deep into the weeds on FAIR, so it may not fully connect if you aren’t using the framework. But I like it as a companion to Lenny’s presentation templates and the Axios piece on analysis paralysis. Tucker is talking here about language: risk expressed as probable frequency and magnitude of loss, which should inform a CISO’s analysis in light of emerging threats (say, AI-enabled attacks) as well as briefings to the CFO and Board. It’s not about more tools and data; it’s about a common vocabulary for deciding what’s worth action and investment.

💡Connecting the Dots

CaptiveCrunch and the passkey research covered in the last week+ are two sides of the same coin. These are more identity attack surface problems than they are authentication or account problems, and they require a different lens than just “how to implement stronger auth?” (although you should do that too).

The Axios piece on decision fatigue and Tucker’s article on FAIR-as-language make the point that more tools and more metrics won’t help anyone if the CISO can’t turn technical signals into a decision someone with budget authority can actually act on. CaptiveCrunch and Pass-the-Passkey are interesting for sure, but are also exactly the kind of “emerging threat” that’s easy to over-index on and miss the actual point for leadership - treat every session as potentially compromised (or compromisable), treat every network as hostile, and get your IR team thinking about what invalidates a passkey the same way they think about what invalidates a password. Fundamentals, language, and identity, allllllll the way down.

Subscribe now

Google Cloud published a piece on applying Site Reliability Engineering to cybersecurity earlier this year, and Phil Venables (who shows up in this newsletter more than anyone else because he’s usually right before the rest of us catch up) just posted his own version, Control Reliability Engineering. These pieces don’t reference each other, but they are in conversation.

Anyone who’s spent time in security operations knows that defense has a scaling problem, and SRE tools and methods may help. I want to cover this from three angles: what this looks like in practice, what it means for leading a team, and where the analogy doesn’t really hold up (all models are wrong, but some are useful - right?). The leadership part is the one most relevant to this newsletter, so that’s where I’m spending the most words.

Subscribe now

🛡️Tactical Challenges

Google’s version boils down to four habits:

• Eliminate toil (repetitive actions that add no enduring value)

• Alert on symptoms instead of causes

• Run blameless postmortems

• Roll out changes gradually and reversibly

None of this is new to anyone who’s read the SRE book. Google basically says you can’t grow a security team linearly to match the expanding size and scope of operations, so a new approach is needed. The Google Cloud post also points out that security teams have historically alerted on system-level signals (a failed login, a specific hash - things at the bottom of the pyramid of pain) that are either too noisy or too brittle. The SRE solution is to alert on symptoms that measurably degrade confidentiality, integrity, or availability, and automate everything else. If a 3 a.m. alert doesn’t require a human response, well then, it probably shouldn’t be an alert.

Venables goes a little further with his concept of Control Reliability Engineering (CRE). He observes that most breaches result from a control everyone believed was working but quietly failed, rather than attributing to attacker brilliance. There’s a great analogy in his piece for this: a radiation detector that reads zero could mean the environment is safe, or it could mean the sensor is dead, which is why real detectors carry a small harmless source so they never actually read zero. His suggested approach for CRE is essentially a working checklist:

• control ontology and cataloging

• controls-as-code

• control-specific SLIs/SLOs

• continuous control monitoring

• synthetic event injection

• control readiness reviews (an adaptation of SRE’s production readiness review)

• safe/canaried changes

• control incident management

• error budgets for controls

If we’re worried about control failures as much as we are attacks (and we should be), we can treat “control incidents” the same way we would a security incident. Most organizations only do root-cause analysis on the thing that was exploited, but CRE says if the control was broken and got lucky, that’s still a finding.

On the ground, this is already showing up in detection engineering as detection-as-code: version-controlled, peer-reviewed, tested detection analytics over ad hoc alert tuning. I don’t know that the SRE-CRE-secops alignment is this clean everywhere - controls don’t necessarily have success rates the same way a service has an uptime (see: patching SLAs and proving a negative), so CRE in practice may take some tweaking and judgment.

🤖 Emerging Threats

Tailoring for SecOps, and Chaos Engineering

The source text for most of this is Building Secure and Reliable Systems, Google’s free 2020 book pairing SRE and security engineers to argue that reliability and security were never actually separate disciplines. If you haven’t read it, it’s aged pretty well, and it’s free. Anton Chuvakin’s writing on autonomic security operations is also required reading to see what common-sense alignment between secops and SRE might look like.

Another resource worth checking out is Kelly Shortridge’s Security Chaos Engineering, which is conceptually aligned with CRE: deliberately injecting failure to find out what happens - the security equivalent of chaos engineering’s fault injection in production. Where CRE is more about measurement and drift detection, SCE is about experimentation; they’re compatible, but they answer different concerns. CRE tells you whether your control is still working; SCE tells you whether your system degrades gracefully when it isn’t.

SRE was built to manage stochastic failure - disk failure, connectivity losses, load spikes, etc. Security failure is caused by an adversary actively probing the edges of whatever control set you’ve deployed. An error budget tells you how much unreliability you’re willing to tolerate before you stop shipping features (kind of like a risk tolerance). Applied to security, “error budget” starts to sound like an acceptable rate of successful attacks, which is probably not something your leadership wants to hear. So the approach and tools are sound, but the message might need a little…translation.

👤 People and Processes

Blameless postmortems only work if your team believes you mean it

The Google Cloud and Phil Venables posts lean on this staple of SRE, which means treating every incident, including a control incident, as a chance to improve the system rather than assign fault. I teach this in LDR551. The practice is easy to describe and difficult to actually run. “Blamelessness” depends entirely on psychological safety, which is earned over time. If your team suspects that blameless only applies until something gets bad enough, they’ll just stop telling you about the near-misses.

Toil elimination is a retention strategy

Pitch toil elimination as a retention strategy. About 70% of SOC analysts report burnout that bleeds into their home life, and nearly every organization is watching alert volume climb faster than headcount. SRE’s contribution here is that any manual, repetitive operational task gets treated as a bug in the system’s design. You don’t solve analyst burnout by hiring more analysts to do the same repetitive work faster; you solve it by treating the repetitive work itself as the defect to be controlled and reduced.

Error budgets are a negotiating tool

Tired of the eternal, exhausting fight with the business over how much risk is acceptable given operational velocity? An error budget lets you codify that number in advance and get buy-in instead of relitigating it every release cycle.

Changes to your staffing plan

Controls-as-code and detection-as-code require people who can write and review code, not just tune a console. If you’re building a security program around these ideas, your next few hires look more like engineers than analysts, and your career-pathing conversations with your current team should reflect that shift now, before it’s a surprise a year from now.

💡Connecting the Dots

SRE-for-security is a management philosophy expressed using engineering words: measure continuously, treat failure as information rather than a verdict on a person or solution, negotiate risk tolerance once rather than every release/sprint/operational cycle. Don't buy this from anyone selling it to you as a product in a booth at Black Hat. Focus on the concepts: controls-as-code, continuous monitoring, blameless learning, error budgets as a negotiating tool.

Subscribe now

This week: the industry’s rush to instrument AI agents with standing access - sometimes purposely, sometimes unknowingly - is basically repeating every identity and trust mistake enterprise IT teams spent the last decade fixing, only faster, with less visibility, and in many cases with no one assigned to own the solution.

Subscribe now

🛡️Tactical Challenges

AI agents don’t have the controls that govern other privileged identity classes

Enterprises are granting AI agents access to databases, APIs, file stores, and other data. Unfortunately, the OAuth token model used to grant this access has no way to express which human (if any) an agent is acting for, what scope it’s authorized to use, or whether one agent invoking another should inherit or narrow that authority.

According to CrowdStrike, the MCP spec’s recommendation to use OAuth 2.1 for agent tokens doesn’t account for who a token actually represents when agents act autonomously. We know this gap is exploitable; see the recently reported AWS Kiro flaw, which allows rewriting of the IDE config via hidden text on a webpage. There are plenty of other examples like this out there, and CrowdStrike’s prompt injection taxonomy update reflects the growing volume and evolution of these techniques.

If your organization has deployed or is piloting AI agents, ask who owns the identity architecture for those agents - not who owns “AI governance,” but who is accountable for scoping, audit trails, and revocation when an agent is compromised or acts unpredictably. Don’t let “we have an AI governance policy” substitute for verifying agents can’t rewrite their own config or execute code from untrusted input, which is what happened to Kiro.

(Note: We wrote about OAuth sprawl on the Push Security blog, which is where I borrowed the graphic above)

Human challenges in AI-enabled SOCs

Cynthia Brumfield's CSO Online feature posits that AI's biggest strain on the SOC may be human rather than technical. Futurum's Fernando Montenegro describes analysts drowning in machine-generated reports and alerts that still require human judgment for validation; we’ve brought down the cost of generating more signal without addressing the analysis bottleneck. My SANS colleagues (and secops experts) Chris Crowley and John Hubbard share some insights in the piece, which basically concludes that mature SOCs will absorb the load while understaffed ones burn out. In short: "Buy engineers, not tokens.”

🤖 Emerging Threats

What "no AI guardrails” looks like in practice

A governance policy that says “agents must operate within approved scopes” means absolutely nothing if the underlying system has no approval step capable of blocking an agent from acting on hidden instructions. The gap between AI governance documentation and enforcement is where some recent incidents have occurred, and we can’t keep papering over it with policy language alone.

CrowdStrike’s framing - “AI governance without guardrails is theater” - is catchy and maybe a bit trite, but it’s also true given what happened at AWS: its Kiro IDE could rewrite its own configuration and execute attacker code from a webpage summary request, with no approval gate to intervene. A research paper published last week on third-party mobile agents powered by Vision-Language Models (VLMs) makes the same point from a different angle: screen-reading agents trusted invisible text as legitimate instruction, because nothing in the architecture distinguished “content to summarize” from “commands to execute” (covered by The Hacker News here).

CISOs, BISOs, and security managers out there - in your next AI governance policy review, ask for a live demonstration that an agent in your environment cannot act on instructions embedded in content it’s asked to process (e.g., a webpage, a document, a calendar invite). If no one can produce that demonstration, the policy is aspirational, not operational, and your board-level AI risk reporting should say so explicitly rather than citing policy adoption as evidence of control.

👤 People and Processes

A must-read for SOC teams and managers: FinOps for SecOps

This post by Usman Chaudhary and Nikita Jagadeesh argues that agentic SOCs are now operationally necessary, but that blind AI adoption creates financial risk.

Their proposed solution is a “FinOps for SecOps” framework that starts by plotting each SOC workload on a value-versus-compute-cost matrix:

• High-value/low-compute work (Tier 1 triage, detection engineering, investigation summaries) should be automated

• High-value/high-compute work (open-ended threat hunting, multi-source correlation) deserves selective, async investment

• Low-value work already handled well by the SIEM (dedup, ticket routing, IOC matching) shouldn’t be handed to agents at all

• Low-value/high-compute work (i.e. agents re-normalizing raw data on every query instead of leaning on the SIEM) is the “token trap” to avoid entirely

The second half of the piece lays out a six-step rollout:

1. Aggregate telemetry efficiently, using MCP servers to query external data instead of migrating everything

2. Throttle agent autonomy by priority/telemetry source/target before enterprise-wide deployment

3. Run a 2-4 week parallel POV against manual ops to prove ROI

4. Require verifiable/auditable reasoning rather than black-box confidence scores

5. Shift success metrics beyond MTTD/MTTR toward toil reduction and junior-analyst enablement

6. Deliberately preserve manual triage skills in new hires (via CTF labs) to avoid “rubber stamping” and skill atrophy as agents absorb top-tier work

I really like the focus on ongoing skill development and cost justification in this framework. CISOs should make agents justify their token spend rather than chase easy automation, and we already know the AI token gravy train is coming to an end.

🌎Notable News and Research This Week:

CVE-2026-50522, a critical SharePoint deserialization RCE (CVSS 9.8), is being actively exploited following a public PoC; patch confirmation should be on this week’s agenda if you run on-prem SharePoint!

Arctic Wolf Labs observed Qilin ransomware affiliates using a patched PAN-OS authentication bypass (CVE-2026-0257) for initial access across multiple June intrusions; a reminder that “patched” doesn’t mean “remediated” if scanning lags (womp womp).

HollowGraph malware is using a compromised Microsoft 365 account’s calendar as a two-way C2 dead-drop, another entry in the growing list of SaaS-native LOTL techniques that blend into normal traffic.

Spain’s AEPD fined 23andMe nearly $3 million for cybersecurity failings tied to the 2023 breach.

💡Actions for this Week

1. Confirm CVE-2026-50522 (SharePoint RCE, CVSS 9.8) is patched on all internet-facing instances and check for indicators of prior exploitation, given active PoC-driven attacks.

2. Ask whoever owns your AI agent pilots whether any deployed agent can execute instructions embedded in content it processes (webpages, documents, emails) without a human approval gate.

3. (Next 30 days): Inventory every AI agent in production or pilot with access to sensitive systems and document who owns token scoping, audit logging, and revocation for each.

4. (Next 30 days): Re-scan environments for the patched PAN-OS auth bypass (CVE-2026-0257) even if the patch is confirmed applied; Arctic Wolf’s Qilin findings suggest exploitation windows persisted post-patch.

5. (Longer term) Add a standing agenda item to your next AI governance review that requires a technical demonstration of enforcement, not just a policy citation, before governance maturity is reported to the board or auditors.

Subscribe now

If you’re struggling to balance daily operational tasks and project work, chances are you aren’t getting less busy - but some structural improvements will be necessary to reduce operational load on people trying to reduce your attack surface, comply with Federal mandates, and respond to ransomware attacks.

Subscribe now

🛡️Tactical Challenges

The Browser Extension Attack Surface Keeps Growing

Two disclosures this week highlight the risks that browser extensions can pose to enterprise networks, and maybe also that AI branding has become the most reliable social-engineering lever for getting them installed at scale.

Microsoft removed 119 Edge extensions this week linked to a campaign impacting up to 2.6 million users. These extensions weren’t obviously suspicious tools: ad blockers, VPNs, translators, and video downloaders. The malicious payloads were hidden inside ordinary image and font files using steganography, stayed dormant through multi-day evasion checks, and only deployed after clearing fingerprint validation to evade security review. When they did activate, the damage wasn’t limited to ad fraud; retrieved payloads included an RCE backdoor, Google credential and 2FA code theft, WordPress admin credential harvesting, and bulk cookie exfiltration for session hijacking. Microsoft links the operation to DarkSpectre, a Chinese actor previously connected to other extension campaigns.

Separately, Microsoft’s Defender research team disclosed a Chrome extension impersonating Perplexity AI that collected every search query (and every other input to the address bar) through an attacker-controlled intermediary before redirecting users to legitimate results. The extension shipped with server-side Node.js code that explicitly logged incoming requests with full headers, IPs, and user agents. The AI branding was an effective lure, since users tend to install AI productivity tools at unusually high rates with less scrutiny than other software.

Most enterprise security programs treat browser extension installs as a user-responsibility problem rather than a managed control, and most corporate third-party software review processes do not include extensions. We’re well past the time to start treating browser extension inventory the same way mature programs treat shadow IT: audit what’s deployed across managed endpoints, define a policy for what requires review before install, and make sure someone owns that process.

Japanese telco exposes 14.2 million managed email credentials

Japanese telco KDDI disclosed that attackers exploited a vulnerability in third-party software powering a managed email platform it operates for itself and several other Japanese ISPs, exposing up to 14.2 million email addresses and passwords. KDDI detected the unauthorized access on June 17 and says it contained the intrusion the same day, but the window was enough for credentials to be at risk across the full customer base of the shared platform.

The blast radius in this case is really something. Because KDDI operates this email infrastructure as a managed service for ISPs, including STNet, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE, a single vulnerability in a shared third-party component compromised credentials across multiple providers and their respective customer bases simultaneously. It’s a good example of why third-party and managed service risk continues to punch above its weight in breach statistics: the attack surface isn’t just your own stack, it’s every customer of whoever manages your stack.

🤖 Emerging Threats

Ransomware Syndicates’ Continued Evolution

Intel 471’s Garrett Carstens draws on analysis of Black Basta’s leaked internal chat logs to document how modern ransomware operations have adopted fully corporate structures: scheduled call teams running social engineering from 6 p.m. to 2 a.m. Moscow time, outsourced contractors for malware, spamming, and initial access, internal performance reviews tied to ransom payment distribution, and tiered pricing models calibrated to victim revenue. Black Basta collected at least $107 million from 520 victims across 39 industries before shutting down in 2025, operating, in Carstens’ framing, less like a criminal gang and more like a professional services firm specializing in extortion.

It’s fascinating how attackers have turned the negotiation phase into a precision instrument. Ransomware groups now conduct data audits to assess the sensitivity and market value of what they’ve stolen, then use that valuation to set and manipulate deadlines - compressing them to force panic, or extending them when a longer runway improves payout probability. Cyber insurance policies, when discovered during reconnaissance, function as a pricing signal. Attackers use coverage details to infer the victim’s financial capacity and likely ransom ceiling. To me, the takeaway isn’t just to prepare for ransomware; it’s to treat negotiations as a scenario to be rehearsed in advance, with intelligence informing how the other side of the table actually operates. Really great read from Intel471 (with coverage via Cyberscoop).

Device Code Phishing Twofer!

Device code phishing attacks have risen sharply in 2026, largely due to the proliferation of new attack kits and the addition of this technique to existing kits. If you missed it, my Push Security colleague (and VP of Research) Luke Jennings did an awesome, in-depth breakdown of how device code phishing has exploded in scope and sophistication this year. Detailed timelines, TTPs, recordings of actual attacks, and mitigation strategies abound. You can see the recording here.

…AND, ⁠Selena Larson⁠, Staff Threat Researcher and Lead, Intelligence Analysis and Strategy at ⁠Proofpoint⁠, joins host ⁠⁠Caleb Tolin⁠ ⁠to detail the specific mechanics of device code phishing campaigns, revealing how adversaries exploit legitimate communication structures to capture administrative and enterprise access. You can check that one out here.

👤 People and Processes

Security Isn’t the Only Thing Saving the Company from Itself

New from Phil Venables: Security teams often carry an implicit sense that they’re uniquely burdened with having to be the adults in the room - the ones pushing back while the business wants to move fast and skip the guardrails. Venables pushes back on this by discussing other organizational functions that face the same pressure: financial controllers holding the line on revenue recognition, safety supervisors refusing to skip inspections, environmental compliance officers absorbing pressure to ignore runoff spikes, and HR directors asked to bury whistleblowers in restructurings. The point isn’t that security isn’t important; it’s that the tension between control functions (like security) and operational velocity is a feature of organizational life, not a sign that your company uniquely doesn’t “get” security. I am HUGE fan of tearing down the “security is saving the company from itself by being smarter than users” narrative, so this post really spoke to me.

The more useful half of the piece applies sociologist Stewart Clegg’s “circuits of power” framework to explain why security programs succeed or fail. Clegg identifies three circuits:

• Episodic (direct face-to-face power)

• Dispositional (cultural norms and policies)

• Facilitative (infrastructure and systems that enforce behavior automatically)

Venables’ argument is that security teams burn out because they fight Episodic battles (e.g., an executive demanding an MFA exception) using Dispositional arguments (pointing at policy). The sustainable answer is to invest in Facilitative circuits: make the secure path the easiest path through automation and technical controls, so the argument never has to happen in the first place. It’s a framework that maps cleanly onto the maturity difference between security programs that rely on enforcement and programs that rely on design.

What the post-quantum executive order demands of CISOs

The new post-quantum cryptography executive order sets two hard deadlines for federal systems: key establishment transitions to PQC by December 31, 2030, and digital signatures by December 31, 2031. Ellen Boehm’s piece in CyberScoop makes the case that CISOs outside the federal government shouldn’t treat these as someone else’s problem. The immediate concern she raises isn’t the deadline itself, but that “Harvest Now, Decrypt Later” attacks are already underway, with nation-state adversaries collecting encrypted data today to hold until quantum capabilities can break it. Long-lived sensitive data like IP, health records, financial transactions, government communications, etc. may already be compromised in ways that won’t become visible for years.

The practical challenge Boehm identifies is less about cryptography than about visibility and program management. Most organizations don’t have an inventory of where cryptography actually lives across their environment - which algorithms, which systems, which third-party dependencies, which certificates and keys. Without that, risk assessment is guesswork. She frames the end goal as crypto-agility: not a one-time algorithm swap, but a managed, living view of the organization’s trust infrastructure that adapts as standards evolve. Do you know where your cryptographic risk lives? Do you have a funded migration plan that maps to the EO deadlines?

💡Connecting the Dots

In my security leadership course, we discuss ways to strike the right balance between operational fire fighting and improvement initiatives/project work. This is super important when there will always be tension between the two, and maybe never more than now. The through-line this week is that the gap between where attackers operate and where most security programs focus keeps widening, and it’s widening in multiple dimensions. While the tactical picture is shifting, the organizational picture is too: ransomware groups are running structured negotiation playbooks while most IR teams are still improvising; security leaders are fighting policy battles while the leverage is actually in system design; and post-quantum migration is already inside current planning horizons while most cryptographic inventories don't exist yet.

If you’ve been in security a while, you know that these problems have been visible for a while, but they’re now becoming unavoidable. The question isn’t whether to address them, it's whether your program has the organizational structure, visibility, and funded roadmap to actually move in the right direction.

Subscribe now

Meanwhile, the Klue breach gave us a live case study in how OAuth integrations can become vectors for lateral movement, and new research is reframing shadow AI less as a data leakage problem and more as an access control gap. On the people side, Carl Froggett's dual CISO/CIO role at Deep Instinct makes one wonder what the CISO function might look like in the future, as security becomes inseparable from technology strategy and business operations.

Subscribe now

🛡️Tactical Challenges

Shadow AI Is An Access Control Problem

The “first generation” response to shadow AI - DLP rules, domain blocks, usage policies - was designed to prevent employees from pasting sensitive data into ChatGPT. But the risk has moved beyond that use case now that employees are connecting AI tools directly to corporate systems via OAuth integrations, granting those tools access to email, calendars, code repositories, and CRM data. The real exposure here is what permissions an unsanctioned AI application holds after that OAuth handshake completes.

The Hacker News ran a vendor-sponsored piece by Token Security framing AI agents as identity and governance problems, noting that agents “access data, trigger workflows, deploy code, and interact with critical business systems, often with little oversight.” Separately, The Hacker News published an analysis arguing that shadow AI’s primary risk has shifted from data leakage to access control, specifically pointing to the gap between what AI integrations are authorized to do and what security teams can actually observe. The takeaway is basically that an AI tool connected to your Salesforce via OAuth looks identical to the Klue integration that compromised Huntress this week (see below).

Your DLP-era shadow AI controls are not sufficient for these kinds of risks. The question to put to your security engineering team is whether your existing OAuth review and app governance processes cover AI-category applications, or were those processes designed for conventional SaaS integrations. If you’ve got a shadow IT discovery tool, verify it enumerates AI applications with active OAuth grants, not just browser-based AI usage or domain-based discovery.

Webinar: Device Code Phishing in 2026

My Push Security colleague and VP of R&D, Luke Jennings, is delivering a research-focused session that goes behind the scenes of device code phishing - including live demos, real examples from kits and campaigns in the wild, and a practical look at what security teams can do about it.

At the start of 2026, device code phishing was still a niche technique associated with Russian state-linked campaigns. Six months later, we’re tracking 18x kits in the wild, a 37x spike in detections, and it feels like every PhaaS vendor in the AiTM space has added device code phishing to their platform. Strong passwords, MFA, even passkeys: it sidesteps the standard login process altogether by targeting the authorization layer. Once an attacker has a valid token, a single phished session can quickly escalate into broad access across an organization’s connected apps and services.

The session is on June 30 at 10:00 AM BST. You can register here.

🤖 Emerging Threats

FortiBleed Mass Compromise Hits 86,000+ Devices

The “FortiBleed” campaign, attributed by CISA to Russian-speaking threat actors, systematically extracted credentials from roughly half of all internet-accessible Fortinet firewalls and VPNs - 86,000+ devices. So the attack surface is basically every organization that left a Fortinet appliance internet-exposed without rotating credentials after prior Fortinet vulnerabilities were disclosed over the last two years.

CISA issued an urgent advisory last week urging Fortinet customers to take immediate action against the ongoing campaign. The CISA advisory and SecurityWeek’s coverage both frame this as an ongoing campaign rather than a point-in-time breach, though the precise exploitation vector hasn’t been disclosed publicly.

If your organization runs Fortinet firewalls or VPN concentrators (or inherits them through an acquisition or managed service provider), treat the credentials on those devices as compromised until proven otherwise.

The Klue Breach: A Case Study in OAuth Attacks

The Klue incident, in which attackers abused OAuth tokens to exfiltrate data from the Salesforce instances of Klue’s customers (including security vendors Huntress and Recorded Future), is the latest public case study of OAuth token abuse. Third-party SaaS integrations that hold persistent OAuth tokens to your core platforms are effectively trusted insiders, and most security teams have no visibility into what those tokens can reach. The Salesforce-to-Klue connection wasn’t a misconfiguration, but an authorized integration that became a lateral movement vector when Klue itself was compromised.

Salesforce confirmed it disabled the Klue Battlecards app integration after the June 11 incident, noting that customers will be unable to reconnect until further notice. SecurityWeek reported that the exfiltrated data came from Klue customers’ Salesforce instances, meaning the attacker’s access to Klue translated directly into access to customer data on a separate platform via OAuth token abuse. That Huntress and Recorded Future appear in the affected customer list underscores that this isn’t a hygiene failure by unsophisticated teams - it’s a problem with how OAuth-based integrations are architected and monitored.

This week, ask your IAM or security engineering team to enumerate every third-party application with active OAuth tokens in your Salesforce, Microsoft 365, Google Workspace, and other core SaaS platforms. Then, ask which of those apps hold tokens with write or export permissions, and when those tokens were last reviewed.

Five Eyes Cyber Security Agencies Statement

The cybersecurity agencies of all five Five Eyes nations - the U.S. (NSA/CISA), U.K., Australia, Canada, and New Zealand - issued a joint statement this week calling AI-driven cyber risk an immediate leadership crisis. The agencies warn that frontier AI models are anticipated to fundamentally transform both offensive and defensive cyber capabilities on a timeline of months, not years, and that AI is already lowering barriers for malicious actors, increasing attack speed and complexity, and shrinking the window between vulnerability discovery and exploitation. The statement is notable for its tone: this isn’t an advisory aimed at security teams. It’s addressed explicitly at boards and executives.

The practical guidance is deliberately unglamorous and probably not groundbreaking for defenders out there: reduce your attack surface, accelerate patching, address legacy systems, strengthen identity and access controls, and test your incident response plans before you need them. The agencies acknowledge none of this is new, but frame it as newly urgent. Cyber resilience, they argue, is no longer an IT issue; it is central to operational continuity and market trust, and leaders who delay will face growing and avoidable risk. The full statement and accompanying guidance document are worth sharing up your chain if you’re still working to get executive attention on security fundamentals.

👤 People and Processes

CISO Perspectives with Carl Froggett, CISO & CIO, Deep Instinct

An interesting entry in SecurityWeekly’s CISO Perspectives series, as Carl Froggett holds both the CISO and CIO titles simultaneously. He makes a strong case that both roles ultimately serve the same purpose - supporting the business - creating natural overlap. Combining both roles would be unmanageable at a company like Citi with 200,000+ employees, but it works well at Deep Instinct with fewer than 200. The lesson isn’t that every company should merge the roles; it’s that the roles share more DNA than org charts typically reflect.

Froggett’s combined role is a live experiment on whether the CISO, as a standalone function, makes long-term sense as security becomes inseparable from technology strategy, risk management, and business operations more broadly (something I sometimes wonder). His experience suggests the roles are more complementary than competitive, and that the main cost of merging them is the loss of an independent check; something that’s manageable with the right culture, but harder to engineer at scale. Worth watching how this plays out across the industry over the next few years.

💡Connecting the Dots

The throughline across this week's stories is that the security perimeter has been replaced by the authorization layer, and most organizations are underinvesting in visibility there. The Klue breach shows what happens when a trusted OAuth integration becomes a supply chain vector; the shadow AI piece argues that unsanctioned AI tools present the same risk profile as the Klue-to-Salesforce connection; and the Five Eyes statement, while diplomatically restrained in its recommendations, is essentially telling boards that attackers are moving faster than defenders can patch or govern.

Device code phishing follows the same logic: bypass the credential layer entirely by targeting the token post-authentication. The FortiBleed campaign is the outlier in this kind of post-auth mechanism, but not in theme: credentials on internet-exposed appliances were treated as durable trust anchors loooong after they should have been rotated. The practical question to carry into next week is whether your identity and access governance processes - OAuth reviews, token enumeration, app governance -were designed for the threat model you had three years ago or the one you have now.

Subscribe now

The security industry has its own Maginot Lines. Backup infrastructure to restore encrypted systems, DLP tools that monitor managed endpoints, PAM scoped to human identities, etc. Each one is a genuine (and, in many cases, still very necessary) capability, built to stop a threat that has since changed tactics.

This week’s issue is largely about that gap. The Maginot Line wasn’t a failure of investment; it was a failure of adaptation. Which of your defenses are guarding a border that the attacker has already stopped crossing?

Subscribe now

🛡️Tactical Challenges

Backups Out as Ransomware Defense?

Encryptionless extortion (data theft without encryption) is now a primary attack pattern, according to BlackFog’s 2026 state-of-ransomware report. If your ransomware response plan is organized around “restore from backup,” it probably doesn’t cover the actual leverage the attacker’s got: the data they’ve already exfil’ed.

BlackFog’s report (vendor report, so treat as directional) documents the shift toward exfiltration-only attacks as a deliberate response to improved enterprise backup practices. This tracks with TechCrunch’s mid-year breach roundup, which independently documents ShinyHunters running simultaneous multi-target extortion campaigns against Canvas/Instructure (275M records), Charter/Spectrum (40M), and others, with 30–60 day breach-to-disclosure windows that the group uses to run parallel extortion tracks across victims before any single company can respond. We’ve written extensively about SH’s preference for identity attacks and highly automated attack chains at my day job.

The SharkStriker June 2026 breach roundup also confirms active extortion campaigns by Qilin, Play, Abyss, Akira, LockBit, and INC_RANSOM - a crowded market that creates competitive pressure to exfiltrate rather than encrypt, since speed to leverage matters more than operational disruption. And finally, the ODNI 2026 Annual Threat Assessment adds a layer: nation-states are increasingly using these criminal ransomware groups as proxies, meaning some “financially motivated” extortion is serving intelligence collection objectives, not just monetization. I wrote about this blurring of the lines between criminal groups and nation-states in the last issue of this newsletter.

So, what to do? Ask your IR lead and legal team what the playbook is when an attacker has already exfiltrated sensitive data before you detect them. It isn’t time to re-write your procedures around backup restoration, but do add an explicit exfiltration-only response track. Also, review your data classification and DLP coverage to understand what an exfiltration-only attack would likely target (or where it would be most damaging), and whether you’d detect it before the 30-day window closes.

AI Agents Are a Fast-Growing Identity Governance Problem

Agents that autonomously file tickets, execute scripts, provision resources, and interact with production environments have created an identity problem that existing PAM, UEBA, and IAM tooling are not built to handle. The sprawl is happening because, in many cases, AI agents are granted access rights under identity models designed for humans. Most enterprises don’t have an accurate inventory of agents currently in production, which means they can’t scope the problem, let alone govern it.

The Cisco/Splunk 2026 CISO report says agentic AI has moved from experimental to operational in most enterprise security programs, and flags AI agents with over-provisioned service accounts as an identity risk that PAM and UEBA programs won’t catch. Bessemer Venture Partners’ analysis found that 48% of cybersecurity professionals identify agentic AI as the single most dangerous attack vector, which would seem to support the assertion that most enterprises lack an agent inventory. Though I’m not aware of any real-world breaches achieved through compromised AI agent identities, this is probably something to revisit against other vulnerability management/threat modeling priorities.

A concrete starting point is to enumerate AI agents currently in production, identify the service accounts they operate under, and assess whether those accounts are in PAM scope - maybe check OAuth permission grants? The longer-term question to answer is whether your identity governance program covers non-human identities at all.

🤖 Emerging Threats

AI Eats the World by Benedict Evans

Via Phil Venables, you do not want to sleep on this excellent presentation (content-wise, but also, that design!) by independent analyst Benedict Evans, covering capital, deployment, institutional/operational change, and an analysis of AI as a transformative tech compared to previous generations.

CCCS Publishes Threat Bulletin on FIFA-themed Attacks

The Canadian Centre for Cyber Security (CCCS) issued a formal FIFA 2026 threat bulletin flagging phishing, fake streaming apps carrying banking malware, and AI-generated credential harvesting pages targeting employees. The CCCS assesses a high risk of targeting in the travel and hospitality, event management, infrastructure owners and operators, and services and sponsors tied to the tournament. It isn’t unusual to see topical lures and increased targeting around events like this, but given the expanding scale and sophistication of phishing and other social engineering attacks, it’s definitely worth looking out for.

👤 People and Processes

CIRCIA’s 72-hour Clock is Running

I wrote about CISA's final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in the last issue - the final rule is now enforceable, covering 300,000+ critical infrastructure entities across 16 sectors with a 72-hour reporting requirement for covered incidents and a 24-hour window for ransomware payments. What will probably bite most orgs is making a legally defensible “covered incident” determination before the investigation is complete, while the response team is still scoping the incident.

NIS2 requires a 24-hour initial notification to EU national authorities, so if you’re operating in both jurisdictions, a single incident could trigger three or four distinct reporting workflows with different deadlines and different content requirements.

AI Compliance Is Now a Browser Problem

AI regulations across the US, EU, and UK are converging on obligations related to how employees use AI tools. This blog post by Push Security’s Head of Legal, John Creaton, maps out five common obligation categories emerging across frameworks like the EU AI Act, DORA, NYDFS, and HIPAA:

• AI inventory and classification

• Employee literacy and guidance

• Data governance and exposure control

• AI-resistant authentication

• Third-party/supply chain risk

The common failure across all five obligation categories is basically the same: organizations have policies but can’t demonstrate enforcement, because their tooling operates at the wrong layer. Some key takeaways:

• Shadow AI is a compliance liability, not just a risk. You need a real-time inventory of AI apps, extensions, and OAuth integrations, not a spreadsheet.

• Policy isn’t enough; you need auditable evidence. Regulators want proof that employees received guidance at the point of AI interaction, not just in annual training.

• Browser-layer DLP closes a gap most platforms miss. Traditional DLP tools lack visibility into what users paste or upload directly into AI tools.

• Phishing-resistant MFA is becoming mandatory. Multiple frameworks now explicitly require it, and AI is making phishing attacks more convincing and harder to detect through traditional means.

Of course, the browser is an excellent place to gain this kind of visibility and evidence which happens to be where Push operates :). But if you’re concerned about regulatory responsibilities related to AI, this is a great summary by a true expert.

💡Connecting the Dots

Three of this week’s stories are about a control that works, deployed against a threat that has moved on. Backups don’t stop exfiltration-only ransomware, PAM and UEBA weren’t built for non-human identities, and browser-blind DLP misses what employees paste into AI tools. In each case, the investment was sound, but attackers are starting to change the route.

CIRCIA’s 72-hour clock, 30-day breach-to-disclosure windows, and AI agents operating at machine speed all compress the window between something happening and you needing to have already responded. Adaptation matters, but so does the speed at which you adapt.

Some questions for your next team discussion: Do you have an exfiltration-only response track? An agent identity inventory? Auditable evidence of AI policy enforcement — not just the policy itself? If the answer to any of those is no, you’re defending a border the attacker stopped crossing a while ago.

Subscribe now

Welcome to Issue #57 of Security Leadership Weekly! This week's content has less to do with CVEs, MITRE ATT&CK techniques, or attack campaigns (though there’s still some of that). Being a CISO right now means making consequential decisions in domains where process, policies, or frameworks may not yet exist - where nation-states borrow criminal playbooks to confuse attribution, regulatory deadlines arrive before compliance frameworks mature, and where the supply chain you're responsible for securing extends into code repositories you've never audited and/or don’t control. The technical problems are really hard. The leadership problems, such as governing in ambiguity, framing risk for audiences who want certainty, and building institutional readiness for scenarios that haven't happened yet, may be harder. This week, we’ve got a bit of both.

Subscribe now

🛡️Tactical Challenges

Nation-State Actors Are Blurring the Line Between Criminal and State Operations

Two threat intelligence reports this week describe how nation-states are increasingly using criminal ransomware and hacktivist groups as operational proxies, with similar goals: persistent access to critical infrastructure, intelligence collection, and disruption. If your threat model still differentiates between “financially motivated cybercrime” and“nation-state APT,” you’re using distinctions that are dissolving quickly.

Waterfall’s 2026 threat report tracks a drop in cyber incidents with physical consequences (25% in 2025), but a 100% increase in nation-state and hacktivist attacks, with MuddyWater’s use of the Qilin ransomware ecosystem as an example of state actors operating through criminal infrastructure. CYFIRMA’s weekly intelligence report flags China-linked group UAT-7290 targeting U.S. and allied telecom providers through edge device vulnerabilities - access that serves intelligence collection, not ransomware monetization. Both are vendor-produced/unverified reports, but the pattern is well-documented public reporting on Russian and Iranian proxies using similar structures.

For most security leaders, the practical implication isn’t that you need to change up your defensive controls, but rather to change how you frame risk to boards and triage incident investigations. A ransomware intrusion that doesn’t proceed to encryption, or that targets operational technology networks rather than data, should trigger an APT hypothesis alongside the criminal one. Ask your threat intelligence function (or your IR retainer) whether your current escalation criteria would detect a nation-state actor using criminal tooling.

The AI-Driven SOC Revisited, by Rob Van Os

If you’re an operations leader who isn’t familiar with Rob’s SOC-CMM model, it’s worth your time to get up to speed. Rob just dropped this article on LinkedIn describing a new operating model for an AI-driven SOC, with the following key principles:

• The operational relevance of zero-days is increasing due to faster exploitation cycles

• SOCs are still dealing with ever-increasing event flows

• The bottleneck for many SOCs is the number of alerts that can be processed

• AIs are being embedded in SOC tooling, but value realization is still uneven and often limited to efficiency gains

I value Rob’s practical approach to these models and, to that end, his basic assertion that SOC functions aren’t fundamentally changing. A great addition to the SOC-CMM library of resources, especially if you’re incorporating AI capabilities into your SOC functions.

🤖 Emerging Threats

Attackers Target Developer Credentials In CI/CD Pipelines (and other things we already knew)

Multiple independent supply chain campaigns landed this week, with a common goal of harvesting cloud credentials, GitHub tokens, and deployment secrets from build systems. Most security leaders are aware, on some level, that secrets are often scattered throughout developer environments; attackers know this too, and have realized that these environments are less well-defended than the identity perimeter that most security programs have invested in hardening.

According to Unit 42, the “Mini Shai-Hulud” campaign embedded malware in four SAP npm packages with roughly 570,000 weekly downloads, explicitly targeting enterprise CI/CD pipelines for cloud credentials and deployment secrets. Separately, TechCrunch reports that a single compromised developer account was used to push over 630 malicious package versions across 317 packages in approximately 20 minutes; a manual review process just isn’t going to work at this scale.

And the list goes on, including the TanStack compromise targeting OpenAI employees’ devices and the Laravel-Lang/PHP campaign, which added more than 700 compromised package versions.

This week, ask your AppSec or DevSecOps lead two questions:

1. Do you have integrity verification (checksums, signed packages, lockfile enforcement) on every package your CI/CD pipelines pull at build time (not just production dependencies, but dev and build tooling as well)?

2. Are the credentials your build systems use scoped to least privilege and rotated on a schedule shorter than your MTTD?

If either answer is unclear, prioritize clarity and filling the gaps. Also, be sure to check out this Wired piece on TeamPCP’s mass software supply chain exploitation by Andy Greenberg and Lily Hay Newman (behind a pay wall).

👤 People and Processes

Most Security Programs Aren’t Ready for CIRCIA

CISA's final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule - 72-hour incident reporting for about 300,000 entities across 16 critical infrastructure sectors, 24-hour reporting for ransomware payments - is expected to be finalized soon after the current lapse in Federal funding for CISA is resolved. The hard problem isn't the notification itself; it's making a confident, defensible determination within 72 hours that an incident is "covered" under CIRCIA's definition - most organizations still treat breach disclosure as an ad hoc task during incident response. Institutionalizing these disclosures will require documented triage criteria, logs sufficient to reconstruct a timeline, and pre-cleared legal counsel.

At the same time, the SEC is elevating cybersecurity above cryptocurrency on its 2026 examination priority list, which means the appetite for regulatory enforcement (read: fines) is increasing even as implementation timelines slip. The bottom line is that time is running short for organizations to build out these compliance programs.

Two things most IR teams don't have documented:

1. A sector-specific determination checklist defining what qualifies as a covered cyber incident under your CIRCIA designation

2. A logging architecture sufficient to establish the incident onset independently

If you're in critical infrastructure and haven't done a CIRCIA readiness gap assessment, assign it to your GRC function as a Q3 priority. The rule can be implemented at any time, and the ramp-up period will likely be short.

🎙️Media Roundup

AI-Driven Hunting in Browser Telemetry with Jacques Louw

James Wilson of the Risky Bulletin Podcast chats with Push Security Co-Founder and Chief Research Officer, Jacques Louw, about how we’ve integrated AI agents into our threat detection platform, our careful approach to introducing agentic capabilities over time, and how it has helped our threat research team scale analysis and detection engineering functions. Great conversation on striking the right balance between human expertise and automation, with examples!

Ethics in Cybersecurity with Ed Skoudis and Paul J. Maurer

⁠Paul J. Maurer⁠ and ⁠Ed Skoudis⁠ joined the ⁠Caveat⁠ podcast with ⁠Ben Yelin⁠ this week to talk about their new book, "The Code of Honor: Embracing Ethics in Cybersecurity." The book lays out a code of ethics for cybersecurity, providing a decision framework that transcends cyber law. This is immensely useful since technology trends move so quickly that policy just can’t keep up (Ed mentions AI as an example). Ed’s perspective, based on decades of experience as a practitioner and instructor, and Paul’s legal expertise, make for an interesting episode and a must-read; I will definitely be checking this one out. You can hear the N2K Cyberwire episode here.

Holding the Line: Episode One | Why the Hell Would Anyone Want to Be a CISO

Great first episode of a web series from Nagomi Security and Hacker Valley Media, featuring interviews with experienced CISOs. This one covers the evolution of the role (and what it looks like today), mental health and burnout, and primary motivations of a CISO.

💡Connecting the Dots

The CISO role has always required translating technical complexity into business decisions, but the complexity keeps expanding faster than the frameworks designed to contain it. This week's content, from Rob Van Os's AI-enabled SOC operating model to the CIRCIA readiness gap to Ed Skoudis and Paul Maurer's ethics framework, reflects efforts to build those frameworks in real time. If you're a security leader feeling the weight of that ambiguity, you're not alone, and the field is producing better tools, models, and conversations to help carry it.

Subscribe now

Subscribe now

🛡️Tactical Challenges

Device-code Phishing Is An Authentication Architecture Problem

Device-code phishing works not because users are fooled into clicking a malicious link, but because they are directed to a legitimate Microsoft login page and complete MFA successfully. The attack exploits an OAuth 2.0 flow that was designed for devices without browsers (like apps on your new smartTV), and it bypasses MFA precisely because MFA is working exactly as intended. Security leaders who think their MFA deployment closes this gap are wrong: they’ve hardened the IdP layer while leaving the authorization grant layer exposed.

The Tycoon2FA phishing kit was disrupted by an international law enforcement operation back in March, then rebuilt on new infrastructure, and was back at normal operational tempo within weeks - now with device-code phishing capability added. According to eSentire, the attack routes victims through a four-layer obfuscated delivery chain before completing the authorization flow.

Based on our research at Push Security, we’ve reported a 37x increase in device-code phishing this year across at least ten PhaaS platforms, and Proofpoint has independently documented a similar surge.

What to ask your identity team this week: Do our conditional access policies restrict or block the OAuth device authorization grant flow in our Microsoft 365 tenant? If not, what is the business justification for leaving it enabled?

Many orgs haven’t turned on conditional access controls to block or constrain device-code flows, because a lot of phishing training still focuses on credential harvesting or because they’re using business applications that leverage device code auth. If your tenant allows device code authorization, a technically average attacker can get a persistent foothold that survives a password reset.

Governing the Machines: How to Detect and Respond to Compromised Agent Identities in Microsoft Entra

In a May 2026 SANS Cloud Security presentation, my SANS colleague Maxim Deweerdt walked through the architecture underpinning Microsoft’s Agent Identity framework - where agents are now treated as first-class Entra identities with their own tokens, Conditional Access evaluation, and lifecycle governance - and what that means when things go wrong.

The framework introduces a four-layer hierarchy:

• An Agent Identity Blueprint (the factory that mints agents)

• A Blueprint Principal (the installer)

• The Agent Identity itself (the runtime credential that calls APIs)

• An optional Agent User (a linked user object for mailbox and Teams access).

The blueprint is basically the blast radius: a compromised or misconfigured blueprint instantly affects every agent identity it spawned. Microsoft’s Identity Protection now surfaces agent-specific detections like unfamiliar resource access, sign-in spikes, and failed access attempts, though these remain offline rather than real-time. Response options include confirming compromise via the Risky Agents report, applying a Conditional Access block, disabling the Agent User, or deprovisioning via Microsoft Graph, each with distinct tradeoffs between speed and business impact.

CA policies cannot yet target individual Agent Users or block them based on risk signals, leaving only a coarse all-or-nothing block option. Max’s seven-step SOC readiness checklist provides a concrete path to get ahead of this emerging identity attack surface before risky agent alerts start landing in their queues. Really great presentation worth checking out if you’re an Entra shop managing AI identities.

🤖 Emerging Threats

The CISA GitHub Leak Is a CI/CD Hygiene Story, and Your Organization Probably Has the Same Problem

A contractor for CISA (people I may or may not have worked with previously, but I digress) deliberately disabled GitHub’s built-in secret scanning, stored AWS GovCloud administrative credentials and plaintext passwords in a public repository, and used it as a personal sync scratchpad across environments. Plenty of room for criticism here, but from a governance standpoint, it’s the predictable result of giving developers and contractors the ability to opt out of secrets management controls. When secrets controls are bypassable, CI/CD tooling creates persistent credential sprawl, and the problem is exacerbated by contractor environments that sit outside the security controls applied to full-time staff. I thought CMMC was supposed to solve this? Jk. Kind of.

Krebs on Security reported that the public GitHub repository named “Private-CISA” contained AWS GovCloud administrative keys (in a file literally named “importantAWStokens”), a CSV of plaintext usernames and passwords for dozens of internal CISA systems, and internal deployment code for CISA’s DevSecOps environment. The researcher who discovered it, Guillaume Valadon of GitGuardian, noted that the account owner had explicitly disabled GitHub’s default secrets-detection feature; so this wasn’t an accidental misconfiguration, it was an active opt-out. We don’t yet know how long the credentials were exposed, whether anyone other than the researchers accessed them before discovery, and whether any GovCloud services were actually compromised or merely at risk.

The audit question for your team is: can your developers and contractors disable or bypass your secrets scanning controls, and does your organization know when that happens? GitHub’s push protection can be bypassed at the repository level if administrators allow it; the default is protective, but the override is usually easy. In the next 30 days, have your security engineering team verify that secrets scanning is enforced at the organization level across your GitHub (and GitLab, Bitbucket, Azure DevOps) estate, with contractor and third-party repositories explicitly in scope. The CISA incident also exposes a contractor oversight gap that belongs on a board risk agenda: do your third-party developers operate under the same credential and secrets management controls as internal staff, and how would you know if they didn’t?

“The Gentlemen” Ransomware Group Exposed: Inside a Major RaaS Operation

A detailed intelligence analysis published by Ransom-ISAC this week offers a look inside The Gentlemen, a Russian-speaking ransomware-as-a-service (RaaS) group that emerged in mid-2025 and has since claimed over 400 victims globally. The report is based on 3,366 internal chat messages leaked in early May 2026 after the group’s hosting provider was compromised, revealing the operation’s full attack lifecycle:

1. Initial access via Fortinet VPN exploitation (primarily CVE-2024-55591),

2. Lateral movement using NetExec and credential dumping tools

3. Data exfiltration via rclone

4. Double-extortion negotiations conducted through qTox.

Analysts identified nine core operators, a custom C2 framework called G-BOT, and the repurposing of the legitimate DFIR tool Velociraptor as a command-and-control platform (which we’ve seen before). Notably, the group actively integrated commercial LLMs like ChatGPT and Claude for negotiation drafting, while also experimenting with locally-hosted uncensored AI models for triage of stolen data. Strong infrastructure and personnel links to the defunct Black Basta group, including a shared Matrix server and recurring operator handles across multiple leak corpora, support a moderate-to-high level of confidence that The Gentlemen represent a direct successor lineage. Security leaders should prioritize patching internet-exposed Fortinet devices if you aren’t already, monitor for SOCKS5 proxy traffic on non-standard ports as a lateral movement indicator, and note that the group has actively tracked its own victim rankings.

👤 People and Processes

Your Board Deck Is Your Board Agenda, Whether You Like It or Not

Dave Kellogg published a post this week that’s required reading for any CISO who has ever walked out of a board meeting frustrated. His argument is simple and a little uncomfortable: the board deck isn’t a document you present, it’s the de facto agenda of the meeting. Whatever’s in the slides will get discussed. Whatever isn’t, won’t. As he puts it, the meeting flows where the slides take it, like a raft in a river. Which means that if you built a 40-slide operations review and wanted a strategic conversation, you’re not getting one - you’re getting the ops review you showed up with.

Most CISO board decks are built the same way every quarter: open last quarter’s deck, update the numbers, swap in the new incidents and the new threat intel, and add the initiative you want funded. The structure never changes because nobody explicitly decided what this meeting should actually be. Kellogg identifies at least seven different types of board segments - ops review, discussion, proposal, presentation, update, working session - each one requiring a different slide approach. A discussion segment should have almost nothing on the slides: a little context, a few well-framed questions, and then deliberate blank space that signals the value is in the conversation, not the deck. A proposal needs a clear situation-recommendation-ask structure and should not surprise anyone who got a pre-meeting call. The discipline isn’t complicated; it just requires deciding, segment by segment, what kind of conversation you’re actually trying to have. Most of us skip that step entirely and then wonder why the board keeps spending forty minutes on patch metrics when we wanted to talk about AI risk.

💡Connecting the Dots

The device code phishing story and the CISA GitHub leak look unrelated on the surface, but they’re the same problem at different layers. In both cases, an organization assumed a control was providing coverage that it wasn’t. This pattern has shown up in this newsletter more than any other: in #45 (”Your attack surface is working correctly”), in #48 (”Ambition Without Capacity Isn’t a Strategy”), in the Stryker MDM wipe in #49 where compromised admin credentials turned a patch management console into a mass-wipe tool.

The consistent lesson isn’t that the controls are bad, it’s that controls not scoped to actual adversary behavior create a false floor that’s worse than no floor at all. At least a missing control shows up as a gap in an audit.

The Entra Agent Identity piece is the same story in preview. Maxim’s presentation makes clear that Microsoft is building the governance architecture for AI agents in Entra in real time, but CA policies can’t yet target individual agents based on risk - meaning your coarsest control option is an all-or-nothing block. As I noted in issue #53 when covering CSA’s shadow AI research, 82% of organizations discovered an AI agent that security and IT didn’t know about; and that was before organizations started formally provisioning Entra identities for agents. The governance frameworks are arriving, but the attack surface is already here.

The Gentlemen leak deserves a second read for anyone who’s been tracking the AI-in-security-operations conversation. In my AI Commoditization essay, I argued that AI models are becoming interchangeable infrastructure - that the model isn’t the moat. The Gentlemen are running that thesis from the offensive side: ChatGPT and Claude for negotiation drafts, locally-hosted uncensored models for data triage, switching between them based on what each job requires. This also connects directly back to #27, where Velociraptor first appeared as an attacker tool. Bottom line: legitimate tools don’t stay legitimate tools when there’s an active criminal economy for them.

Subscribe now

Subscribe now

🛡️Tactical Challenges

Instructure/Canvas Breach: What We Know

Instructure, the edtech company behind the widely used Canvas learning management system, was breached by the ShinyHunters extortion group, which claimed to have stolen more than 3.6 TB of data (usernames, email addresses, course names, enrollment information, user messages). The attack affected over 30 million educators and students across more than 8,000 institutions worldwide - right in the middle of final exams.

ShinyHunters exploited cross-site scripting (XSS) vulnerabilities in Instructure’s Free-for-Teacher environment to obtain authenticated admin sessions and perform privileged actions. This was actually a return visit by SH; Instructure first detected unauthorized activity on April 29, and then on May 7, the attackers returned through the same unpatched vulnerability to deface Canvas login portals with extortion messages. A previous breach in September 2025, also claimed by ShinyHunters, had already compromised Instructure’s Salesforce instance, so it seems like the company has some questions to answer about their remediation practices and third-party risk posture.

This week, within the deadline SH had originally given for negotiations, Instructure announced it had “reached an agreement” with ShinyHunters - which sounds an awful lot like “we paid the ransom”. As part of the agreement, Instructure said the stolen data was returned (???) and it received digital confirmation of destruction in the form of “shred logs,” with ShinyHunters stating that no Instructure customers would be further extorted. Of course, there is no reliable way to verify data has actually been deleted or that the exposure has been fully remediated.

Key unanswered questions remain: Instructure has not disclosed the terms or financial value of the agreement, has not confirmed the full scope of affected users, and has not explained why the same Free-for-Teacher vulnerability was re-exploited a week after the initial breach. Security teams should also be alerting their communities to the elevated risk of follow-on spear-phishing campaigns leveraging real institutional context, like course names, advisor relationships, and sensitive private messages, which were captured in Canvas and now may be in criminal hands.

AI-Generated Zero-Day Exploit Used in Active Criminal Campaign

Google’s Threat Intelligence Group (GTIG) has identified what it describes as the first confirmed case of a threat actor using an AI-generated zero-day exploit in an active attack. According to GTIG, the exploit was developed by a prominent cybercrime group and was specifically designed to bypass two-factor authentication. This finding comes from a combination of Mandiant incident response engagements and GTIG’s proactive research, and it turns AI-assisted exploit development from a popular AI talking point into observed tradecraft.

What strikes me about this story isn’t that AI suddenly makes exploit development trivial (it doesn’t), but that it lowers the barrier to producing working exploits for groups that previously lacked the technical depth to develop them in-house. Your detection and patch velocity timelines should account for an abbreviated adversarial development cycle. The specific 2FA bypass targeting also reinforces a consistent pattern in which attackers invest engineering effort in defeating or bypassing authentication controls because they know that’s where defenses have hardened.

This research backs up GTIG’s February report on AI augmenting adversarial workflows, which is worth revisiting in light of this disclosure.

🤖 Emerging Threats

Fake OpenAI Model Repository Delivered Rust-Based Infostealer to 244K+ Downloaders

A malicious Hugging Face repository impersonating OpenAI’s legitimate “Privacy Filter” model reached the platform’s trending list and accumulated over 244,000 downloads before being disabled. According to HiddenLayer’s research team, the fake repo (Open-OSS/privacy-filter) shipped a loader.py file that, when executed, silently fetched and executed a Rust-based infostealer that harvested Discord tokens, cryptocurrency wallets, browser credentials, and system metadata. Hugging Face has disabled the repository, but the timeline of how long it remained live and whether affected users were directly notified is not publicly confirmed.

The 244,000 download figure probably doesn’t mean that many infections; views, stars, and clones are often conflated in these reports, and the infostealer required deliberate execution of a batch or Python script. But the problem here is that these ML model repositories have no meaningful supply-chain vetting equivalent to what package managers like PyPI or npm have built over years.

If your developers or data science teams are pulling models from Hugging Face as part of their workflow, they are doing so in an environment where typosquatting a trending model is trivial, and detection is reactive if it exists at all. The question to ask your teams this week is whether Hugging Face model pulls go through any review gate, or whether they land directly on developer or training infrastructure. More coverage of this story on The Hacker News.

Shared Claude Chats weaponized to target macOS users

This BleepingComputer report documents an active malvertising campaign (discovered by Berk Albayrak, a security engineer at Trendyol Group) that’s essentially a new evolution of the InstallFix campaign my colleagues at Push Security discovered back in March. Where InstallFix cloned legitimate install pages and swapped out the curl command, this campaign takes a more insidious approach: attackers are hosting malicious instructions inside Claude's own shared chat feature, so the Google Ads pointing to those chats show claude.ai as the verified destination URL (a genuine domain, not a lookalike).

The weaponized shared chats present themselves as official "Claude Code on Mac" installation guides attributed to Apple Support, directing users to open Terminal and paste a command that triggers an infostealer infection - the same ClickFix-style terminal-paste social engineering at the core of InstallFix, but delivered through a trusted AI platform rather than a cloned website. One variant performs geographic profiling first, checking for Russian or CIS-region keyboard inputs before proceeding; the other, a MacSync infostealer, skips profiling and goes straight to harvesting browser credentials, session cookies, and macOS Keychain contents.

South Staffordshire Water Fined Following Ransomware Attack

South Staffordshire Water, a UK utility supplying drinking water to 1.6 million people, was fined £963,900 ($1.3 million) by the UK's Information Commissioner's Office after the Cl0p ransomware group spent nearly two years inside its network undetected. The group gained initial access in September 2020 via a malicious email attachment and wasn’t discovered until July 2022, when an IT performance slowdown triggered an internal investigation. By then, the attacker had escalated to full domain administrator privileges and exfiltrated data on 633,887 customers and employees, including bank account numbers, National Insurance numbers, and disability information, ultimately publishing it on the dark web.

The ICO's investigation found a cascade of basic security failures:

• As of December 2021, an outsourced SOC was monitoring just 5% of the company's IT environment

• No internal or external vulnerability scans were conducted during the entire period of compromise

• Some devices were still running Windows Server 2003

• Two domain controllers remained unpatched against ZeroLogon, a critical privilege escalation vulnerability published in August 2020 (which the attacker successfully exploited).

The regulator's message was blunt: "Waiting for performance issues or a ransom note to discover a breach is not acceptable - proactive security is a legal requirement, not an optional extra." The case lands as UK water suppliers face a record pace of cyberattacks and Parliament prepares to take up the Cyber Security and Resilience Bill, which would expand mandatory reporting requirements for critical infrastructure operators.

👤 People and Processes

Cloudflare’s AI-driven layoff of 1,100 employees

Cloudflare announced a 20% workforce reduction (approx. 1,100 employees) despite reporting its strongest quarter ever, with $639.8 million in revenue representing 34% year-over-year growth. CEO Matthew Prince framed the cuts not as cost-saving measures but as a structural response to AI-driven productivity gains, citing a 600% increase in internal AI usage over just three months and claiming some employees have become up to 100 times more productive. The company's entire R&D team is now using AI coding tools with autonomous agents reviewing all deployed code, and AI is being used across HR, finance, and marketing as well. Prince argued that this efficiency surge reduces the need for support roles, though he maintained that Cloudflare will continue hiring and expects to have more employees in 2027 than at any point in 2026 - a claim that reflects a broader and increasingly familiar pattern in tech, where AI productivity gains are being used to justify headcount reductions even amid strong financial performance.

A few interesting notes on this one, aside from the fact that it sucks when “healthy” companies do mass layoffs:

• The company’s stock took a pretty big hit following the earnings release and layoff announcement - 23% on Friday.

• A new Gartner study of 350 global business executives found that many companies have reduced their workforce regardless of whether AI was actually generating returns; Gartner analyst Helen Poitevin says, "Workforce reductions may create budget room, but they do not create return. Organizations that improve ROI are not those that eliminate the need for people, but those that amplify them.

• An Nvidia exec made the following point about dubious cost efficiencies: "For my team, the cost of compute is far beyond the costs of the employees," said Bryan Catanzaro, VP of applied deep learning at Nvidia. An AI and finance professor quoted in the same piece attributed this to hardware and energy raising operating costs for providers, creating a short-term mismatch, where AI use has remained less efficient than human labor.

💡Connecting the Dots

This week's incidents share a common theme: attackers aren't breaking down doors, they're walking through ones you've propped open. Shared Claude chats and Google Ads abuse the trust you extend to verified domains and AI platforms. The Hugging Face fake model repository exploits the absence of supply-chain vetting in ML tooling that your developers treat as routine infrastructure.

The perimeter isn't where the action is anymore; the action is in your delivery channels, your model repositories, your shared productivity tools, and the monitoring gaps you may be paying someone else to cover.

This week’s to-do list:

1. Ask your development and data science teams to identify any Hugging Face repositories they pull into development or training pipelines, and confirm whether those pulls go through any integrity verification step (hash check, organizational review, or allowlist).

2. The South Staffordshire Water ICO finding is a useful forcing function for a board conversation about detection coverage. Pull your current mean-time-to-detect metrics and compare them against a two-year dwell scenario: would you have found it?

Subscribe now

Subscribe now

🛡️Tactical Challenges

cPanel Ransomware Attack Via Authentication Bypass Exploit

CVE-2026-41940, a CVSS 9.8 authentication bypass in cPanel and WHM, has been under active exploitation since at least late February, and has now been weaponized at scale by the “Sorry” ransomware group. Shadowserver has tracked at least 44,000 compromised cPanel IP addresses; Rapid7 researchers have confirmed that successful exploitation grants full control over the host system, its configurations, databases, and all websites it manages. The Sorry ransomware deploys a Go-based Linux encryptor using ChaCha20 with RSA-2048 key protection, meaning no decryption path exists without the threat actor’s private key. Multiple major hosting providers, including Namecheap, InMotion, KnownHost, and HostPapa, have emergency-firewalled their own customers off cPanel interfaces to slow the bleeding.

cPanel sits at the base of an enormous amount of shared and managed hosting infrastructure, which means the blast radius isn’t just the organizations running cPanel; it extends to every tenant, customer, and downstream site on those servers (read: supply chain attack on the hosting side). If your organization relies on managed hosting providers or if you oversee web properties running on shared infrastructure, confirm patch status and check whether your provider has applied the vendor-supplied detection tool. The broader pattern is familiar and worth flagging for your teams: zero-day exploitation with a months-long head start before public disclosure, followed by commodity ransomware operators piling in once the flaw goes public.

Note: this mass-hosting compromise mirrors the Cordial/Snarky Spider SaaS extortion story below, though it uses different attack infrastructure. It’s basically the same dynamic of attackers moving faster than most organizations’ patch and detection cycles.

Also Worth Tracking:

Via The Hacker News: Cordial Spider and Snarky Spider are running SaaS-only extortion campaigns using vishing to direct targets to SSO-themed AiTM pages. Detection is hard in these SaaS-based LOTL attacks because there’s no endpoint to examine, and because the attackers suppress device-registration notifications via inbox rules before pivoting to high-privilege accounts. Tough to establish baselines when you don’t see what’s happening.

Via BleepingComputer: Microsoft Defender falsely flagged two DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, and removed them from the Windows trust store on affected systems. A fixed signature update is now available, but the incident intersects with a DigiCert breach in which attackers compromised a support analyst’s device and obtained initialization codes for a limited number of code-signing certificates, some of which were used to sign malware.

🤖 Emerging Threats

Linux Kernel “Copy Fail” Exploit Hits Cloud and Kubernetes at Scale

CVE-2026-31431, dubbed “Copy Fail,” is a logic flaw in the Linux kernel’s AF_ALG cryptographic subsystem that allows any unprivileged local user to achieve full root access. A working PoC was published by researchers at Theori and Xint, and Go and Rust versions have already appeared in open-source repositories. The exploit works by corrupting the kernel’s in-memory page cache of readable files, including setuid binaries like /usr/bin/su, without touching disk.

This is a good example of how various factors come together to bump up the urgency of remediation: a nine-year-old vuln, a working public exploit that doesn’t require race conditions or memory address guessing, in-memory-only execution that produces no disk artifacts, and default exposure in Kubernetes. Obviously patching is a priority, but a bigger question is whether you can detect in-memory privilege escalation that doesn’t touch disk, and whether your Kubernetes pod security policies restrict AF_ALG access. Microsoft notes that exploitation has so far been primarily PoC-stage, but with multiple reimplementations in the wild and a CISA KEV designation, the window before opportunistic threat actors operationalize this is narrowing. If you’re running multi-tenant cloud workloads or shared CI/CD pipelines, you should treat this as a priority this week.

MFA Still Won’t Save You: ConsentFix v3 Reduces Friction

Via Bill Toulas at BleepingComputer: ConsentFix v3 is the latest iteration of a post-authentication, in-browser attack. The original ConsentFix was discovered by my colleagues at Push Security back in December as a ClickFix-style OAuth phishing attack that tricks victims into completing a legitimate Microsoft login flow, then pasting a localhost URL containing an OAuth authorization code back into an attacker-controlled page - effectively handing over account access without requiring a password or MFA bypass. v2 smoothed out the copy-paste friction with drag-and-drop, and now, v3 removes the manual backend steps entirely. When the victim interacts with the phishing page, the captured authorization code is automatically shipped to a Pipedream webhook and immediately exchanged for tokens, with post-exploitation handled through Specter Portal.

If you read our research on ConsentFix v1, you already know that Azure CLI is implicitly trusted in Entra ID as a first-party Microsoft app. It can’t be blocked or deleted by tenant administrators, requires no admin approval for permission grants, and can request scopes that third-party apps can’t - so standard app consent controls don’t apply. Phishing-resistant MFA doesn’t apply either, because the victim is completing a real authentication flow. The attack produces some detectable patterns: OAuth authorization code exchanges from unexpected IPs, token usage inconsistent with normal user behavior, and serverless platform endpoints like Pipedream appearing in OAuth redirect flows. If you’re not already monitoring browser telemetry, this is a good week to start.

Push Security Threat Briefing: May 2026

Push Security's May 2026 threat briefing is out on LinkedIn! This month's edition covers the Vercel OAuth breach and shadow AI integrations in general, a 37.5x spike in device code phishing (!), the rise of fully automated vishing platforms like ATHR, the structural limits of extension risk scoring, and a detailed rundown of the ongoing ShinyHunters/SLH SSO-to-SaaS campaign - including fresh victims across ADT, McGraw-Hill, Rockstar Games, Medtronic, and the European Commission. If identity-based attacks and browser-native threats are on your radar (and they should be), give it a look.

👤 People and Processes

Five Eyes on Agentic AI

The NSA, CISA, Australia’s ASD ACSC, and their counterparts in Canada, New Zealand, and the UK jointly released guidance this week on the secure adoption of agentic AI systems. The document was published the same week as the CSA’s shadow AI agent research (covered in the last issue), and begs the question of whether private industry has any hope of keeping pace with AI deployment.

The guidance warns that strong governance, explicit accountability, rigorous monitoring, and human oversight are “not optional safeguards but essential prerequisites,” and recommends that organizations assume agentic AI systems may behave unexpectedly. They further recommend prioritizing resilience, reversibility, and risk containment over efficiency gains. Of the risk categories cited, privilege takes the top spot; specifically, privileges assigned to agents directly determine the level of risk they can introduce, and poor privilege management exposes organizations to scope creep, identity spoofing, and agent impersonation. Also flagged: LLM-based agents that may change their behavior when evaluations are underway and may even bypass system-level instructions to achieve their objectives - a risk that’s easy to underestimate when most governance focuses on what agents are authorized to do rather than whether they’ll actually stay within those lanes.

The takeaway is that agencies recommend never granting agentic AI broad or unrestricted access to sensitive data or critical systems, and limiting its use to low-risk, non-sensitive tasks until security practices and evaluation methods mature. That’s a conservative bar that most current deployments (especially in the private sector) don’t meet. If your organization is moving faster than that, this document is a useful checklist for identifying gaps in your governance model.

CTI Isn’t Intelligence, And That’s Fine

Joe Slowik, via his Stranded on Pylos blog, has written one of the more thought-provoking pieces on threat intelligence I’ve read in a while. The field of cyber threat intelligence has saddled itself with terms and definitions borrowed from formal intelligence community (IC) tradecraft; structured analytic techniques, analysis of competing hypotheses, multi-phase production cycles, etc., which are largely mismatched to the timescales of detection and response. The tension stems from the fact that the formal IC model optimizes for rigor, but the operational security environment optimizes for speed.

The alternative framing Slowik proposes is indications and warning (I&W): a military concept where the further along the intelligence refinement process you move, the greater the likelihood that the resulting product arrives after its moment of maximum efficacy - basically, a point of diminishing returns. Under an I&W model, file triage, log analysis, and infrastructure tracking become more critical than executing a well-structured ACH (for example), because the decision maker needs actionable input now - not a finished product next week.

We cover a lot of these concepts in LDR551, including structured analytic techniques and ACH, so this one really gave me pause. But Joe is on point as usual. Structured analysis remains useful for training and process alignment, but it may not always be applicable in time-sensitive detection and response. Ask yourself: who is your intelligence actually serving, at what timescale, and is the production model matched to those needs? If your analysts are executing structured reporting cycles optimized for strategic briefings while your detection engineering team is waiting on IOCs, something is misaligned.

IR Professionals Sentenced for Ransomware Attacks

Ryan Goldberg (Sygnia) and Kevin Martin (DigitalMint) each received four-year sentences this week after pleading guilty to conspiracy charges for deploying ALPHV/BlackCat ransomware against clients they were ostensibly helping. A third co-conspirator, Angelo Martino, also a ransomware negotiator at DigitalMint, went even further: he was simultaneously negotiating ransoms on behalf of five victims while feeding those victims’ insurance policy limits and confidential operational details to the ransomware gangs. Martino coordinated payouts reaching $26 million and faces sentencing in July. The group earned $1.2 million from one successfully extorted company; law enforcement seized roughly $10 million in assets from Martino and tracked Goldberg across ten countries before arrest.

DigitalMint’s post-incident controls - cloud-audited negotiation platforms, founder oversight of all negotiations, DHS registration of negotiators - are reasonable minimums, but they came after the fact. Time to check in with your external IR and negotiation partners on access controls, audit logging, and conflict-of-interest disclosures.

💡Connecting the Dots

We’re in the middle of another evolution that echoes what we saw most recently in the ransomware ecosystem, toward scale, speed, and the systematic removal of cost from the offensive side of the equation. ConsentFix v3 is a great example: each iteration has eliminated one more step requiring human effort. ATHR replaces human callers with AI voice agents so that vishing scales without headcount. And when cPanel and Copy Fail went public, commodity operators were at scale within days.

Takedowns impose costs and are worth doing, but they don’t necessarily change the underlying economics. Joe Slowik's piece on CTI essentially presents the defender’s side of this argument: formal analytic tradecraft adds friction and time costs to the process at exactly the moment attackers have eliminated friction from theirs. The organizations best positioned to respond to this environment aren't the ones with the most rigorous processes or the longest list of controls; they're the ones who have matched their operational tempo to the threat.

Subscribe now

Subscribe now

🛡️Tactical Challenges

You Can’t Govern What You Can’t See

The CSA’s new research puts a number to a problem that security leaders have been sensing for a while: 68% of organizations say they have high visibility into their AI agents and autonomous workflows, yet 82% discovered at least one AI agent or workflow in the past year that security or IT did not previously know about. The gap between these is where the risk lives, and it’s a particularly uncomfortable gap given how AI agents work: unlike static infrastructure, agents can evolve through updates or prompt changes, expand their scope through integrations, interact dynamically with other systems, and operate without continuous human oversight if not kept on a short leash.

What makes this harder to solve is that shadow AI agents aren’t emerging from rogue corners of the enterprise. The most common discovery locations were internal automation and scripting environments, LLM platforms including custom tools and plugins, SaaS tools with built-in automation, and developer-created workflows.

The CSA’s recommendation isn’t to lock these environments down - it’s to make them governable: treat agent creation as a governance event, extend lifecycle management expectations beyond traditional software procurement, and design control models that assume decentralization rather than relying on a single review board or approval process. I’d add real-time monitoring for OAuth consents to weed out overly permissive grants to AI agents (something we’re doing at my day job). Either way, the time to focus on this is now - not after the first incident where an agent has gone rogue.

Robinhood Abused for Phishing Delivery

Via Lawrence Adams at BleepingComputer: Attackers have exploited a flaw in Robinhood’s account creation process that allowed them to inject arbitrary HTML into the device metadata field of official onboarding emails - content that Robinhood didn’t sanitize before rendering, causing the injected phishing message to appear as a legitimate security alert inside an email sent from Robinhood’s own systems. Using in-app notifications as phishing delivery mechanisms isn’t new; it’s a great way to get phishing messages past SPF, DKIM, and DMARC authentication checks and to add legitimacy to the lures.

Robinhood confirmed that affected customers were notified, the campaign was taken down, and account creation flows were strengthened. They noted that no account takeover was possible through the email itself, but this is less about Robinhood specifically and more about a mass delivery vector.

The Grace Period Is Over

Via Derek B. Johnson at CyberScoop: For years, organizations watched comprehensive privacy laws pass and largely concluded they had time. But in 2025, U.S. states issued $3.45 billion in privacy-related fines - more than the previous five years combined. The increase was driven by stronger enforcement of laws such as California’s CCPA, new interstate partnerships, and a sharper focus on how AI and automated decision-making affect personal data.

Regulators have moved from guidance to enforcement, and many organizations that “weren’t paying attention” were caught having let their privacy programs atrophy during the gap between legislation and meaningful penalties. Ten states now coordinate enforcement across state lines through the Consortium of Privacy Regulators, and federal preemption legislation (which would override stronger state laws like California’s) remains politically contested enough that organizations would be unwise to bet on it as a compliance strategy.

The timing on this is pretty pointed. In the past two weeks alone, ShinyHunters has claimed responsibility for a wave of high-profile data exposures. Victims include Udemy, Carnival Cruises, and Pitney Bowes. McGraw-Hill (15 million rows), Amtrak (2.3 million rows), and Carnival (7.5 million rows) also appear in recently verified disclosures. In a $3.45 billion enforcement year, with ten states actively coordinating, the question isn’t whether a breach will attract scrutiny; it’s whether your privacy program was mature enough to demonstrate reasonable care before it happened.

🤖 Emerging Threats

AI Prompt Injections in the Wild

This post on prompt injection in the wild by the Google Threat Intelligence Team is a cool case study of a detection challenge at scale. The team swept the Common Crawl Foundation (2-3 billion public web pages per snapshot) for indirect prompt injection patterns. Most of what they found was low-sophistication stuff like pranks, SEO manipulation, and benign experiments. Scanning for content like “ignore previous instructions” or “if you are an AI” returned mostly false positives like blogs, research papers, etc. Their fix was a coarse-to-fine pipeline: pattern matching, then LLM classification for intent and context, then human review.

This maps almost exactly to how we approach detection engineering at my day job. Browser session data is incredibly noisy; credential reuse, OAuth grants, extension behavior...the benign and the malicious are often indistinguishable until you add context. What customers don’t always see is the amount of work that goes into getting this right - the iteration, the tuning, the deliberate tradeoffs our team makes to surface high-confidence detections instead of handing analysts a firehose of noise.

👤 People and Processes

ATT&CK v19: The Framework Gets Sharper Where It Matters Most

The headline change in ATT&CK v19 is one many of us have been waiting on for a while: the Defense Evasion tactic has been split in two. The new structure separates Stealth - covering things like living-off-the-land binaries and masquerading - from Defense Impairment, which covers adversaries actively breaking your defenses. Think killing EDRs, tampering with logging pipelines, and/or subverting trust controls. It’s an important distinction because the two require completely different defensive responses, and lumping them together was obscuring that nuance.

If your team maintains ATT&CK-mapped detection content, time to do some homework! T1562 and several sub-techniques have been revoked and restructured under new IDs, and MITRE has published crosswalk files in JSON and CSV to help teams remap existing content. Check those before assuming your current mappings still hold.

Beyond the structural changes, v19 reflects where the threat landscape is actually moving. New techniques cover AI-enabled adversary behavior, like how threat actors are querying public AI services for target research and using AI to generate written and audio-visual content for operations. It also consolidates Social Engineering parent techniques like impersonation and email spoofing under a single behavior category with unified detection logic. The CTI additions are equally notable: MITRE has documented a PRC state-directed cluster using Claude Code to autonomously execute most of a multi-stage espionage campaign, and added LAMEHUG, described as the first malware documented to query a large language model in live operations.

Two quick hits on team design and communication this week…

The Case Against Team Meetings

Ever joked about the “expense” of a meeting based on the cost of the attendees’ time? On his blog, Alexandre Dulaunoy argues that when a team depends on a weekly meeting to learn what everyone has been doing, the meeting itself is a symptom: it signals that communication is already failing. The format compounds the problem by turning information-sharing into performance; one person speaks while everyone else waits for their turn, mentally checked out. The author makes a point worth sitting with: a one-hour meeting with ten people isn’t a one-hour meeting, it’s a ten-hour cost for the team.

The alternative is structure: Dulaunoy’s team relies on a handful of chat channels: a global room, an informal one, and project-specific rooms, with the expectation that updates are shared in context when they happen, not batched up for a calendar slot. This is very similar to how we work at my day job (except for the part about eliminating meetings!), and it maps cleanly onto how high-performing SOC and incident response teams already operate - decisions and developments are surfaced asynchronously in writing, with meetings reserved for live coordination that genuinely can’t wait. The takeaway isn’t “eliminate all meetings,” but to stop treating the status call as a default and start treating it as a failure mode.

The Team That Runs Itself

And now a counter-argument, via Aytekin Tank at FastCompany: Tank, CEO of Jotform, argues that successful teams don’t need more management, but that leaders still have to build the communication patterns that make autonomy possible. His own model is instructive: 20-minute weekly check-ins with each team, focused on what they’re working on and where he can add input, with no micromanagement in between. Delegation works best when ownership is clearly defined - when accountability is built into the workflow, not added on top of it.

The piece also makes a case for visibility as a cultural practice rather than a management tool. Jotform holds weekly Demo Days where all 20-plus teams share successes, setbacks, and teachable moments with the whole company; a ritual the author frames not just as a sharing mechanism, but as a trust-building one. Thinking about this for security teams as an opportunity to discuss near-misses, incidents, and detection wins. The takeaway from this and Dulaunoy’s blog is that best-run teams aren’t the ones that report the most; they’re the ones that communicate the most purposefully.

💡Connecting the Dots

Most of the challenges we covered this week are more the result of management and operational drift than recklessness. The ATT&CK v19 update and the Google prompt injection research point in the same “cost of adequacy” direction from the practitioner side: the work of maintaining good detection isn't dramatic, it's iterative and ongoing. The team management pieces this week make the same point about communication. The best-run teams aren't the ones doing the most; they're the ones doing the most purposefully.

Subscribe now

In related news, a Microsoft Deputy CISO published a timely counterpoint on credential elimination and platform engineering as structural defenses against exactly this pattern. Insurance carriers, apparently reaching their own conclusions, are quietly repricing or excluding the AI-shaped version of the same problem.

But before we dive in, a brief announcement: as part of Push Security’s State of Browser Attacks Series, I’ll be appearing with Troy Hunt for a discussion of identity attacks, attack trends, and well, pretty much anything Troy wants to talk about. You can register here and watch it live on April 30th at 11:00 AM EST!

If you missed the first episode of the series with Luke Jennings and John Hammond, you missed out on a great discussion and a live walkthrough of some really cool attack techniques. The good news is that you can watch the full recording here.

Subscribe now

🛡️Tactical Challenges

Microsoft On Making Opportunistic Cyberattacks Harder by Design

Ilya Grebnov, Microsoft’s Deputy CISO for Dynamics 365 and Power Platform, published this blog post on an argument I’ve made plenty of times in this newsletter (and daily in my day job): most attackers don’t break into your network, they log in with stolen credentials, and the most reliable fix isn’t better password hygiene; it’s removing credentials from the system entirely. The practical playbook he lays out centers on managed identities and federated token patterns that authenticate workloads just-in-time without a stored secret that can be compromised and reused. Worth a read, since this is basically Microsoft’s own internal security team describing how they protect 450+ services across one of the largest Azure footprints in existence.

The second half of the piece essentially describes platform engineering as a security control. Opportunistic attackers thrive on inconsistency, and the prescription described here is paved paths, policy-as-code, and enforced defaults that make the secure choice the easy choice. The Vercel breach covered later in this issue underlines this point: that attack succeeded because an over-permissioned OAuth token in a third-party app served as a bridge into Vercel’s environment. The Entra Agent ID note - treating AI agents as first-class identities with a named human sponsor - may be a small but telling signal of where identity governance is heading. Lots of great info here, though in my experience these best practices tend to break down and/or achieve less than full coverage in complex, heterogenous environments - leaving exactly the attack surface Grebnov describes here.

Insurance Providers Back Away From AI Coverage

Via CSO Online: Insurance carriers appear to be pulling back on coverage for AI-related outputs due to their unpredictability. Dozens of carriers are now declining to write policies for AI-generated output claims in cybersecurity and errors and omissions coverage, while others are hiking premiums to account for the increased risk. This kind of makes sense, since carriers can’t trace the reasoning behind an agentic decision and therefore can’t underwrite it. CSO’s article points out that in November 2025, AIG, Great American, and W.R. Berkley filed regulatory requests to exclude AI liabilities, but the trend has ramped up to include active policy exclusions.

If you’re a CISO, expect more pointed questions from your underwriters: What AI policies do you have? What models are you running? How are you validating outputs? Don’t assume your existing E&O or cyber policies cover your AI deployment, as AI exclusions often extend beyond the insured’s own AI use to any third-party AI systems incorporated into their workflows (read: SaaS capabilities or third-party apps in your SaaS).

🤖 Emerging Threats

Vercel Breached via Third-Party App

Via Matt Kapko at CyberScoop: The Vercel breach is a clean case study in how infostealers become the opening move in something much bigger. It started in February, when a Context.ai employee searched for Roblox game exploits and downloaded Lumma Stealer - a textbook infostealer deployment vector. From there, the stolen credentials gave the attacker access to Context.ai’s AWS environment and OAuth tokens, including one tied to a Vercel employee’s Google Workspace account.

Annnd that was it - that token granted full access. The employee had authorized the AI Office Suite app and given it broad permissions. The attacker then used that foothold to access Vercel environments and harvest environment variables, ultimately reaching customer credentials. ShinyHunters, or a group claiming the name to inflate notoriety, is attempting to sell the haul, which they claim includes access keys, source code, and databases.

So just to recap: this wasn’t a Vercel vulnerability, it wasn’t a phishing email sent to a Vercel employee, and it wasn’t a misconfigured Vercel system; this was an over-permissioned OAuth token granted to a third-party SaaS app that got popped at a completely different company. Vercel noted the Context.ai OAuth app was the subject of a broader compromise, potentially affecting hundreds of users across many organizations.

The infostealer-to-OAuth-to-lateral-movement chain is the kind of attack that generates no endpoint alert, leaves no malware signature in your environment, and bypasses MFA, because the attacker is using a legitimately issued token. Vercel’s CEO described the attackers as “highly sophisticated” and suspected the operation was “significantly accelerated by AI.” Whether that is born out by the evidence or not, the velocity and depth of the pivot across three separate organizations in a matter of weeks is the real headline.

👤 People and Processes

A Leadership Framework for Cutting Through Complexity

Tanveer Naseer’s Leadership Newsletter covers a common leadership challenge, which is that the more complicated things become, the more pressure there is on leaders to just “do something” that indicates progress - whether it’s the right thing(s) or not. Naseer describes a three-part simplification framework that requires answering three questions:

1. What should we stop doing?

2. What should we keep doing?

3. What should we be doing differently?

The first question gets to something we cover in LDR551 (referencing Cal Newport’s book Deep Work and John Doerr’s Measure What Matters): reducing shallow work - tasks that can be performed in a distracted state that add no enduring value. Things like sitting in on meetings, drive-by assignments, PowerPoint presentations, etc., may be necessary, but they’re mostly shallow work. If we can cut down on this stuff, we can focus instead on deep work - tasks which we might not be able to knock out immediately, but by completing them, everything gets better and easier. Another way of thinking about it, as described in Doerr’s book, is to separate tasks that are urgent from tasks that are strategically important. Reducing false positives and devising more effective threat mitigations would be two examples of deep work that are of high strategic importance (but probably low urgency, in that they aren’t immediate).

Maritime Transportation Security Act (MTSA) Takes Effect

Via Robert Lemos at DarkReading: The Coast Guard’s new maritime cybersecurity rules, first introduced in 2002 but expanded in 2025, are now in effect. The policy requires appointing dedicated cybersecurity officers, conducting formal assessments, and submitting cybersecurity plans for Coast Guard approval, while mandating that anyone with access to IT or OT systems complete cybersecurity training. Specifically, every US-flagged vessel, facility, or outer continental shelf (OCS) facility must designate a cybersecurity officer (CySO) to take responsibility for the cybersecurity of IT and OT infrastructure. The approach should look familiar to anyone who has formalized a cybersecurity function at the corporate level: formalize the roles, document the posture, and make training non-optional.

Given the focus on maritime security, this seems like timely guidance - the Strait of Hormuz has been effectively blocked since late February 2026 (wait, now it isn’t; no, yeah it is), with the IRGC asserting control over one of the world’s most critical maritime chokepoints. And since March, Iranian-affiliated actors have disrupted PLCs across U.S. critical infrastructure sectors, including water, energy, and government services. All of this to say that the maritime sector, now operating under elevated geopolitical stress and newly formalized cyber obligations, is exactly the kind of environment where governance frameworks go from a paperwork exercise to operational necessity.

💡Connecting the Dots

The Vercel breach is the clearest illustration of a pattern running through this entire issue - the entire attack lived in the SaaS and identity layer. Grebnov’s Microsoft post is essentially a structural prescription for this exact problem: eliminate secrets, shrink public surfaces, enforce identity-scoped access (easier said than done!). The big hairy problem here is that those controls tend to degrade at the edges of complex, heterogeneous environments, and most enterprises aren’t running a unified platform they control. They’re running dozens of SaaS apps, connected by OAuth tokens and API keys, that no one has fully inventoried. That gap is precisely where the Vercel-style attack finds its footing.

The insurance story closes the loop from the risk management side. Carriers can’t underwrite what they can’t trace, and the same opacity problem that makes AI outputs uninsurable applies to the SaaS identity layer: who authorized that token, what did it have access to, when did it expire? Most organizations can’t answer those questions with confidence. The maritime piece earns its place for similar reasons: the MTSA governance framework isn’t novel, but with Iranian-affiliated actors actively disrupting U.S. critical infrastructure OT systems and the Strait of Hormuz in active crisis, the distance between compliance-as-paperwork and compliance-as-operational-readiness has collapsed.

Subscribe now

Subscribe now

🛡️Tactical Challenges

Axios Compromise Follow-Up: DPRK Attribution, Malware Details, and the Uncomfortable Post-Mortem

The Axios npm supply chain compromise that broke on March 31 now has both a named threat actor and an after-action report from the project’s lead maintainer. Google’s Threat Intelligence Group (GTIG) has attributed the attack to UNC1069, a North Korea-nexus financially motivated group active since at least 2018, and has detailed the malware chain:

• A long-term social engineering campaign to gain access to the lead developer’s PC

• A dropper called SILKBELL delivered WAVESHAPER.V2, which beacons to a C2 every 60 seconds and supports directory enumeration, arbitrary payload execution, and PE injection

• A cross-platform backdoor with variants for Windows (PowerShell), macOS (native binary), and Linux (Python)

The Axios post-mortem, written by lead maintainer Jason Saayman, is a great read if you’re responsible for securing CI/CD pipelines (and it has an even more detailed attack timeline). The attacker gained access through a targeted social engineering campaign and RAT malware deployed against the maintainer’s PC roughly two weeks before the malicious packages were published. Money quote: “Publishing directly from a personal account was a risk that could have been avoided.”

Detection relied entirely on community members noticing, rather than on an analytic or automated approach, and the attacker used the compromised account to delete early-warning comments before the community escalated to npm directly. The project is now moving toward OIDC-based publishing and immutable release pipelines, which probably should have been in place for a package with over 100 million weekly downloads.

Findings from The Drift Hack

It’s a DPRK two-for this week! The most expensive lesson from the $285M Drift hack might be that the attackers spent six months building the kind of professional credibility that would pass most corporate due diligence. The theft from the Solana-based decentralized exchange Drift on April 1 wasn’t opportunistic; it was the conclusion of a six-month operation attributed with medium confidence to UNC4736, the North Korea-nexus group also tracked as Citrine Sleet and Golden Chollima.

Starting in the fall of 2025, individuals posing as a quantitative trading firm approached Drift contributors at major international cryptocurrency conferences, built months of substantive professional rapport over Telegram, deposited over $1 million of their own funds into the protocol to establish operational credibility, and ultimately delivered malware through either a malicious code repository or a weaponized wallet app distributed via Apple TestFlight. Talk about a long game!

Two details make this story particularly relevant beyond crypto:

1. The initial infection vector is assessed to have involved a malicious VS Code project exploiting the “tasks.json” file to silently execute code when a workspace was opened, a technique North Korean actors have been using since December 2025, and one Microsoft only recently added controls for in VS Code versions 1.109 and 1.110 - think developer toolchains as a phishing lure.

2. A concurrent DomainTools analysis reveals that DPRK’s cyber apparatus has deliberately fragmented its malware ecosystem along mission lines, separating tooling, infrastructure, and operational patterns so that exposure in one mission area doesn’t cascade across the entire program, while also maximizing attribution ambiguity and slowing defender decision-making. The Axios npm compromise, the Drift hack, and the ongoing IT worker fraud campaigns aren’t separate problems; they’re divisions of the same well-resourced, state-directed organization running parallel revenue and access operations simultaneously.

US FY2027 Budget Takes Another Swing at CISA

Via Tim Starks at Cyberscoop: The Trump administration’s fiscal year 2027 budget proposal takes aim at CISA again, this time with cuts that could reach as high as $707 million. The budget language justifying the reductions appears to be copied verbatim from last year’s proposal, referencing programs CISA has already shuttered and making renewed calls to end misinformation work that the agency says it had already wound down. It reads less like a policy rationale and more like a budget document written before anyone checked what was still standing.

It’s really sad to see this trajectory, knowing the sweat equity CISA put into building its workforce and public/private partnerships over the years. These cuts erode threat information sharing, stakeholder engagement, and cross-sector coordination that most enterprises quietly rely on, even if they don’t realize it. Rep. Bennie Thompson, the ranking Democrat on the House Homeland Security Committee, put it plainly: there’s nothing that justifies a cut of this scale, particularly at a time of heightened tensions with Iran and an increasingly aggressive China.” Whether Congress pushes back, as appropriators did in 2026, remains to be seen, but security leaders shouldn’t plan their programs around federal partnerships that may not survive the budget cycle.

🤖 Emerging Threats

LinkedIn’s Extension Scanning Under Scrutiny

What started as a niche complaint from a competing extension developer has landed on BleepingComputer, and it’s now making the rounds across mainstream security media. LinkedIn’s site runs a JavaScript fingerprinting script, internally called “Spectroscopy,” that scans visitors’ Chromium-based browsers for over 6,236 specific installed extensions by attempting to access static file resources tied to each extension’s ID. The same script was scanning roughly 2,000 extensions in 2025 and 3,000 as recently as two months ago, so seems like the scope has expanded quite a bit. Beyond extensions, the script collects 48 distinct device characteristics, such as CPU core count, available memory, screen resolution, time zone, battery status, etc., then encrypts the resulting fingerprint and attaches it to every API request made during the session. None of this is disclosed in LinkedIn’s privacy policy, and there is no opt-out mechanism because LinkedIn doesn’t acknowledge the practice as data collection in the first place. Yikes.

LinkedIn’s defense (shared in the BleepingComputer story) is that the scanning is to identify violators of LinkedIn’s terms of service regarding scraping and other privacy issues. Also, it’s worth pointing out (and LinkedIn has) that the report was published by individuals connected to Teamfluence, a competing Chrome extension that LinkedIn restricted for ToS violations - a restriction that was subsequently upheld by a German court. In any case, none of this explains why Spectroscopy’s scan list includes grammar tools, tax professional utilities, and hundreds of categories with no obvious connection to LinkedIn’s platform, or why results are tied to real identities and employer data.

Terms of service aside, this feels icky to me, and something security leaders should consider when it comes to what employee browsers might be silently disclosing about your environment every time they log in. LinkedIn's Spectroscopy is kind of the inverse of the DPRK hacks like Axios and Drift; instead of an adversary building trust to gain access, it's an app exploiting the trust it already has to harvest intelligence.

Device Code Phishing Keeps Going Up

In last week’s issue, I covered Push Security’s research on the mechanics of device code phishing: a post-authentication attack that renders MFA irrelevant by hijacking Microsoft’s OAuth device authorization flow rather than stealing credentials. This week, Microsoft confirmed that the threat has moved from a research concern to an operational emergency. Since March 15, Microsoft has observed 10 to 15 distinct campaigns launching every 24 hours, each targeting hundreds of organizations with unique, AI-generated payloads designed to defeat pattern-based detection. The infrastructure behind it is closely linked to EvilTokens, a device-code-phishing-as-a-service kit sold since mid-February that handles the MFA bypass for buyers and is already expanding to support Gmail and Okta.

The campaign routes victims through compromised legitimate domains hosted on trusted serverless platforms like Railway, Cloudflare Workers, AWS Lambda, etc., so the phishing traffic blends seamlessly with normal enterprise cloud activity and defeats URL scanners, proxies, and other network-based controls. The final page shows a legitimate microsoft.com/devicelogin prompt, because it is legitimate; the victim authenticates to Microsoft directly, the device code is captured, and the attacker receives a live access token without ever touching the user’s credentials or triggering an MFA challenge.

Post-compromise, attackers move fast: in some cases registering new devices within 10 minutes to generate a Primary Refresh Token for long-term persistence, in others creating inbox forwarding rules targeting emails with “payroll” or “invoice” in the subject line. These are super dangerous because there is no malicious domain to block and no credentials to protect proactively (post-auth, remember?). Restricting device code flow is a viable remediation, although it’s used for plenty of legitimate functions, so it’s bound to be a management headache. This one isn’t going away anytime soon.

👤 People and Processes

Phil Venables on What Field CISOs Are Actually For

Phil Venables is here with another heater: a substantive take on the Field CISO role. Phil (can I call him Phil at this point?) frames the Field CISO’s purpose as building customer trust to win, grow, and sustain business by making customers successful, which sounds obvious until you watch how many people in the role default to being glorified sales engineers or, worse, logo drops on a vendor website. The piece covers sales support, post-sales onboarding, internal product advocacy, audit and regulatory support, incident response, and community convening. But the throughline is lived experience in actual security leadership roles, not just consulting.

Two points from this piece deserve more airtime in the security leadership conversation:

1. The Field CISO’s most strategically valuable function is serving as the “voice of the customer” internally, advocating for what customers actually need rather than what product teams say they want. Pushing for secure-by-default designs can sometimes conflict with the commercial interest of selling additional security products.]

2. Outcomes are hard to quantify, but net promoter scoring (NPS) and other toil-related metrics can be effective methods of capturing the Field CISO’s contributions.

As a first-time Field CTO, I found the post immensely helpful. Worth a read if you live in this world or aspire to.

💡Connecting the Dots

I’ve covered a lot of “trusted channel” attacks in this newsletter before, including ClickFix and its more creative variants. What's different in some of these threats is instead of exploiting a trusted channel, the attackers are building their own. UNC4736 constructed professional identities that survived six months of business due diligence. The Axios attacker compromised the human whose credibility was the trust anchor for a hundred-million-download package. EvilTokens routes victims through legitimate serverless infrastructure to a real Microsoft login page. Many of our mental models in information security are predicated on answering the question, “is this channel secure?”. But in many of these cases, the question should be: “How would you know if an entire channel was deceptive and invalid?” Unfortunately many organizations aren’t able to answer it until they’re responding to an incident.

Subscribe now

Subscribe now

🛡️Tactical Challenges

One Token, Five Ecosystems and Counting

If you haven’t been following the open source supply chain crisis unfolding right now, here’s the context: starting March 19, a threat actor group called TeamPCP compromised Aqua Security’s Trivy scanner - a tool baked into CI/CD pipelines everywhere - and used stolen credentials to cascade through five ecosystems: GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI. One stolen token became five compromised ecosystems, ultimately reaching LiteLLM - an LLM gateway present in 36% of cloud environments. And now, the campaign appears to have reached Axios, one of the most widely used JavaScript libraries on the planet, downloaded over 100 million times per week. The Axios compromise has been assessed by SANS faculty and others as a likely continuation of the TeamPCP campaign, raising the possibility that TeamPCP is operating as an Initial Access Broker. If that’s accurate, the supply chain compromises we’ve seen so far are more of an assembly line to build up inventory than the actual campaign.

So, even if your developers only pull from curated, verified registries using tools your security team approved, you’re still vulnerable to this kind of supply chain attack. The attacker pre-staged the malicious Axios dependency 18 hours before publishing the poisoned versions, built platform-specific payloads for Windows, macOS, and Linux, and targeted both the current and legacy release branches simultaneously. GitGuardian’s analysis of TeamPCP found that a single stolen credential produced a fan-out ratio exceeding 10,000:1, as in, one key in and thousands of secrets out.

Check out the mercifully concise summary my SANS colleague Josh Wright published here. In this case, I’d steer clear of indicator-based mitigations outside of rapid response, and focus instead on hardening supply chain and updating practices.

🤖 Emerging Threats

ShinyHunters Hits the European Commission

ShinyHunters is claiming another significant scalp: the European Commission, with SH claiming the theft of over 350 GB of data including mail server dumps, databases, confidential documents, and contracts. The Commission detected the initial attack on March 24, confirmed that it affected cloud infrastructure hosting its Europa.eu websites, and acknowledged that some data was likely taken. The attack vector is still unknown, and the full scope is still being investigated, so take the 350 GB figure with appropriate skepticism until more is confirmed.

We’ve spent a significant amount of time tracking ShinyHunters at my day job, so while I may be biased, I think the more interesting takeaway here is that the playbook continues to work. The group has built a track record of social engineering and voice phishing to steal credentials and gain access to SaaS platforms like Salesforce, Okta, and Microsoft 365, and that’s a consistent thread across their recent victim list. This isn’t sophisticated nation-state intrusion as we might have expected in the past; it’s credential abuse at scale. Recent victims include Odido, Figure, Canada Goose, and SoundCloud - no common thread except TTPs that just work.

Phishing Kits Shift to TikTok Business

Push Security’s threat research team identified a new wave of adversary-in-the-middle phishing pages specifically targeting TikTok for Business accounts (the accounts your marketing team uses to manage paid ad campaigns). TikTok feels like an odd target until you think about what those accounts are actually worth: a verified business account with ad spend attached is a ready-made launchpad for malvertising fraud, and most business users log into TikTok via Google SSO. This means a single-session theft grants attackers both accounts simultaneously, along with everything else reachable through that Google identity.

The mechanics of this campaign are becoming (Dr. Evil voice) pretty standard, really. Victims land on convincing TikTok or Google Careers lure pages that route them through a bot-filtering checkpoint before serving a reverse-proxy phishing kit, which intercepts the session token in real time rather than just stealing a password. MFA doesn’t stop this, since session theft occurs post-authentication! The phishing domains were bulk-registered within a nine-second window, hosted behind Cloudflare, and tied to a registrar commonly associated with high-volume phishing infrastructure - purpose-built to be spun up fast and rotated before IOC lists catch up.

👤 People and Processes

Adrian Sanabria: I watched all 11 main stage keynotes at RSAC 2026, and less of my time was wasted than you might guess

Well, I was at RSA this year too. It was a productive trip, but my experience as a vendor was very different than past attendance as a practitioner. I have found that insights from other, more experienced, and better-spoken individuals have been far more clarifying than reflecting on my own thoughts.

With that in mind, here’s one of my favorite recaps from Adrian Sanabria - partially because he breaks down some of the hype over “securing AI” and partially because his pop culture references are on point.

The Defender's Initiative

I watched all 11 main stage keynotes at RSAC 2026

A different vibe…

Read more

5 months ago · 1 comment · Adrian Sanabria

Time As a Threat Hunting Surface

This post by Albert Caballero makes the case for time as an organizing principle of threat hunting. Rather than bouncing between tools and rehydrating datasets, the argument is that analysts should pivot along a timeline, moving from near-real-time detections through short-term logs and into long-term archives as a single investigative motion rather than a series of separate workflows. By embedding Sigma rule tagging and threat intelligence lookups directly into the data pipeline itself, every event gets annotated before it lands, meaning the same detection logic that fires on a live alert can also surface the same pattern in firewall logs from six months ago, without anyone manually rehydrating the data (a fairly direct hit against another major SIEM vendor that advocates for organizing all data into hot/warm/cold, but I digress).

I am massively in favor of abstracting detection analytics from detection tools, and just as big a fan of enriching detections prior to triage. Indicators age out, feeds go stale, and adversaries rotate infrastructure, but a well-written behavioral detection continues to fire across hot telemetry, warm logs, and cold archives as long as the behavior persists. Most organizations doing hypothesis-based hunts with atomic indicators are acting on data with a short shelf life, and the TeamPCP campaign this week is a live illustration. If your detections are IOC-based and your data is siloed by retention tier, the activity that matters most is exactly what you’ll miss.

Assessing and Maturing OT SOCs With SOC-CMM

I have been a fan of SOC-CMM for a while as a tool for assessing and improving security operations. This white paper covers key considerations for assessing and maturing a SOC in an operational technology (OT) environment. OT SOCs share many organizing principles with IT SOCs, but are unique in many ways - from limited OT system visibility to the domain expertise and contextual knowledge required for incident response. This whitepaper provides practical guidance and best practices to optimize OT SOCs (or SOCs with dual responsibilities in IT and OT), and, like other SOC-CMM materials, draws on real-world incidents and complementary models. Well worth a read if OT is within your scope!

💡Connecting the Dots

The common thread running through this week's stories isn't a specific threat actor or attack technique; it's a gap between how most security programs are organized (based on outdated mental models) and how attacks are actually unfolding. TeamPCP pivots through ecosystems using credentials your tools already trust. ShinyHunters runs the same playbook based on social engineering, credential theft, and session attacks. The TikTok phishing campaign intercepts authentication after MFA has already passed.

None of these attacks is stopped by a firewall, a signature update, or an IOC feed, because none of them look like attacks until well after the damage is done. What Caballero's temporal hunting piece argues, and what this week's incidents demonstrate in practice, is that defenders organized around indicators and tool-centric workflows are hunting with data that expires faster than attackers rotate their infrastructure. It’s important to standardize on models and frameworks that evolve alongside real attacks, such as the SOC-CMM, and supplement them with domain expertise from the last decade.

Subscribe now

P.S. In case you haven’t been reminded by a flood of vendor “will you be at RSAC??” emails, it’s next week! If you’d like to chat about detection and response, security operations, or browser-based telemetry, or just enjoy some time away from the conference venue, I’ll be there too - book some time here and let’s meet up.

Subscribe now

🛡️Tactical Challenges

Insights From the Cloudflare Threat Report 2026

Some interesting takeaways from Cloudflare’s report, released a couple of weeks ago, chiefly that the 2026 landscape is defined by the industrialization of cyber threats (if you haven’t read Phil Venables’ “Artisanal to Industrial” blog post, go do that right now) and a fundamental shift toward the Measure of Effectiveness (MOE), where attackers leverage AI to achieve maximum disruption with minimal effort:

• Identity is the primary target as adversaries increasingly bypass standard multi-factor authentication (MFA) by harvesting session tokens (which I highlighted last week as the most dangerous technique used by malicious browser extensions) to “attack the session” rather than the network

• Threat actors are now routinely weaponizing legitimate cloud and SaaS ecosystems, a tactic referred to in the report as Living off the XaaS (LotX? I’ll allow it) to mask command-and-control communications within benign enterprise traffic, while simultaneously exploiting the connective tissue of third-party API integrations.

• Defenders are also facing unprecedented hyper-volumetric DDoS strikes, peaking at a record-breaking 31.4 Tbps, which autonomously exhaust local infrastructure capacity in seconds and effectively close the window for human intervention.

There’s some high-level prescriptive hand-waving about shifting towards an identity-first zero-trust resilience model, which sounds great but is less helpful as a “go do”. I prefer some of the specific initiatives offered up in the report, including:

1. Transitioning away from legacy MFA to phishing-resistant FIDO2 passkeys (not foolproof, but better), paired with continuous monitoring that can invalidate compromised sessions instantly.

2. Leaders overseeing daily operations must get their arms around SaaS-to-SaaS API permission grants to enforce least privilege and prevent attackers from pivoting across specialized cloud environments.

Lots of useful tidbits to mine here, given Cloudflare’s deployment footprint, but many signs seemingly point to better identity control and visibility.

Global Medtech Firm Stryker Targeted

Iran-linked hacktivist group Handala, tied to Iran's Ministry of Intelligence and Security, claimed responsibility this week for a devastating attack on global medtech firm Stryker, allegedly wiping data from over 200,000 devices across 79 countries and sending more than 5,000 employees home from Stryker's largest international hub in Ireland. While the initial attack vector is unclear, the attacker has proven administrative access to Microsoft Intune - reportedly commandeered after attackers obtained privileged credentials and used them to push a mass wipe command across the company's global fleet.

That's the detail security leaders need to sit with: the same console that manages patches and device policy is the console that erased everything. No exotic tooling required, just one compromised admin account and the organization's own infrastructure doing exactly what it was built to do. <conjecture> The attack was retaliatory rather than financially motivated, reportedly triggered by Stryker's U.S. defense ties and its acquisition of Israeli orthopedic company OrthoSpace </conjecture>. And the blast radius here extends well beyond Stryker: the company manufactures medical devices used in operating rooms and ICUs worldwide, meaning the downstream effects on hospitals and surgical centers are real and potentially life-safety relevant. The management plane is a high-value target, and if your MDM, RMM, or endpoint management platform is sitting on credentials that aren't robustly protected, monitored, and scoped, this is what the worst-case scenario looks like.

Phishing Continues to Be Dominant Smartphone Threat

Omdia's latest mobile device security research delivers a finding that shouldn't surprise anyone in this industry but is still worth naming plainly: no flagship smartphone - not Pixel, not iPhone, not Galaxy - scored full marks on anti-phishing protection, and custom phishing payloads from unknown senders went undetected across every device tested. AI-based scam detection is improving, and Google's on-device natural language checks are genuinely useful, but the most sophisticated attacks are still getting through.

What makes this relevant beyond the consumer audience is the behavioral data underneath it: 27% of consumers experienced phishing scams in the past year, English-speaking markets are disproportionately targeted (40% in the U.S.), and, critically, the rate of timely software updates dropped 9% year-over-year, with 14% of users waiting more than a month to patch and 2% never updating at all. For security leaders managing BYOD or hybrid device environments, that update-avoidance behavior is a real exposure, and it's driven less by apathy than by user perception that updates degrade performance and battery life. The broader takeaway is that the phishing problem is moving decisively toward mobile, AI is making attacker campaigns faster and more convincing, and the defensive tooling isn't there yet.

Starbucks Loses a Latte of Data (I’m so sorry)

Starbucks disclosed this week that attackers compromised 889 employee accounts on Partner Central (the company's internal HR portal for managing payroll, benefits, and employment data) between January 19 and February 11, exposing names, Social Security numbers, dates of birth, and bank account and routing numbers. The attack vector was pretty straightforward: phishing sites impersonating the Partner Central login page harvested valid credentials, which attackers then used to authenticate normally and walk right through the front door. No infrastructure breach, no exploit chain, just stolen credentials and legitimate access doing the rest.

The numbers are relatively small (889 out of 380,000+ employees), but the data quality is alarming: SSNs and financial account details don't expire, can't be reset like a password, and retain exploitation value for years - especially when combined with data from other breaches to fuel targeted fraud and social engineering down the line. The three-week dwell time before detection is also interesting. If your workforce is accessing HR, payroll, or benefits platforms with single-factor authentication and no anomaly detection on login behavior, this is the outcome you're accepting as a risk.

🤖 Emerging Threats

Microsoft's OAuth Redirect Abuse Warning

Microsoft researchers uncovered active phishing campaigns that exploit OAuth's by-design redirection mechanism - not a vulnerability, but a feature. The attack creates a malicious app in an attacker-controlled tenant, then distributes phishing links that trigger an intentional error flow, redirecting victims from a legitimate Entra ID or Google Workspace page to attacker-controlled infrastructure. The result is that victims inadvertently download malware delivered as ZIP archives, triggering PowerShell execution, DLL side-loading, and pre-ransomware activity - all without any credential theft or software exploit. Some of the nuances here are novel, and it’s a great TTP breakdown, but overall, it aligns with many attack campaigns over the last year that have abused authentication flows through social engineering.

It’s also worth noting that this campaign starts with an email, but in my day job, we’re increasingly seeing delivery via malicious ads, social media, app notifications, and other channels. We’re also seeing that OAuth permission grants are a user-driven wild west of apps and services. My advice is this: when consuming this kind of operational intel, view the delivery stage as a link that can be swapped out, and avoid tunnel vision on email, where most organizations already have decent visibility and control.

👤 People and Processes

As a longtime Thinkst fan and former founder, I really enjoyed this interview with Haroon Meer. In it, Haroon explains how he bootstrapped company growth by focusing on product, arguing that relying on customer revenue rather than venture capital keeps a team focused on product quality over marketing. Meer also gets into deception technology and how Canary Tokens can be deployed to elicit responses and/or “trap” attackers.

By focusing on simplicity and user experience, Thinkst has built a strong reputation for tools that are easy to deploy and highly effective. The conversation highlights how genuine problem-solving and a commitment to "customer love" can create a sustainable business in a crowded tech market.

💡Connecting the Dots

Pull back from the individual stories this week, and the pattern is almost uncomfortable in its consistency. Stryker's attackers didn't need a zero-day; they needed Intune credentials (?). The Starbucks breach didn't require touching corporate infrastructure; it required a convincing fake login page. The Microsoft OAuth campaign doesn't steal tokens at all; it abuses a legitimate redirect flow to deliver malware through trusted authentication infrastructure.

Cloudflare's data reinforces this at scale: session hijacking over credential theft, LotX (ok starting to hate this acronym) over custom malware, API pivots over network intrusion. The adversary playbook in 2026 is built on the premise that your own stack is the most reliable weapon available to them, and the data keeps proving them right. The implication for security leaders isn't novel, but it's increasingly urgent: visibility and control over the identity and management planes aren’t a priority on a roadmap; they’re the whole game.

Subscribe now

Shameless plug: speaking of attackers operating in the liminal space between strategy and governance, I’m doing a webinar on malicious browser extensions today! If you can’t make it live, go ahead and register here, and we’ll send you the recording.

Subscribe now

🛡️Tactical Challenges

Google’s 2025 Zero-Day Review: Enterprise Infrastructure Now the Primary Battlefield for Zero Days

Google’s Threat Intelligence Group released its annual zero-day review last week, which might recalibrate how security leaders think about attack-surface prioritization. Of the 90 zero-day vulnerabilities actively exploited in 2025 (up from 78 in 2024), a record 48% targeted enterprise technologies rather than consumer platforms. Security and networking devices bore the brunt of that shift, with Cisco, Fortinet, Ivanti, and VMware among the hardest-hit vendors. China-nexus espionage groups remained the most prolific state-sponsored exploiters, with at least 10 attributed zero-days (double their 2024 count) focused almost exclusively on edge infrastructure.

Two structural shifts in the threat landscape deserve particular attention from leadership:

1. Commercial surveillance vendors surpassed state-sponsored groups in zero-day exploitation volume for the first time on record

2. Browser-based exploitation continued its decline to historic lows, while operating system and mobile exploits rose sharply, signaling that attackers are moving away from the browser as an exploitation surface, precisely as defenders have hardened it, pivoting instead to the infrastructure and OS layers where detection remains weaker. This echoes what we’re seeing at Push Security, where the economics of attacks inside the browser are far more favorable to attacks than attacking the browser itself.

Google’s forward-looking warning is equally notable, if not surprising: AI-assisted vulnerability discovery and exploit development are expected to significantly compress the time between disclosure and weaponization in 2026, narrowing an already dangerously thin window for enterprise patching.

🤖 Emerging Threats

InstallFix: When the Install Command Is the Attack

Push Co-founder and CPO Jacques Louw just posted about a new social engineering technique called InstallFix, discovered by Push researchers. It’s a natural evolution of the *Fix family that strips away the need for manufactured pretexts like fake CAPTCHAs or error messages entirely.

The mechanic is elegantly simple (and infuriating to anyone who likes to copy and paste install commands from software docs): attackers clone the installation pages of popular developer tools with near-pixel-perfect fidelity, swap the legitimate install commands for malicious ones, and distribute the fake pages via Google Ads targeting users who are actively searching for that software. The victim does exactly what they intended to do - install a tool - and the attack succeeds before they have any reason to be suspicious. Any further interaction on the cloned page simply redirects back to the legitimate site, keeping the victim unaware.

The initial campaign documented by Push targeted Claude Code, with the malicious pages delivering Amatera Stealer, a credential-harvesting infostealer that exfiltrates saved browser passwords, cookies, and session tokens. But the technique could impact any popular software install pages. The underlying vulnerability being exploited is user trust: the “curl-to-bash” installation pattern has become the industry standard for developer tooling. InstallFix continues the trend of *Fix lures delivered via search engines rather than email, meaning this entire attack category operates entirely outside the reach of email security gateways and traditional phishing defenses.

Threat Actors Weaponize Salesforce Audit Tool for Mass Data Harvesting

Salesforce has issued a warning that a known threat actor group is actively mass-scanning publicly accessible Experience Cloud sites using a modified version of AuraInspector, an open-source audit tool originally released by Mandiant in January 2026 to help security teams identify Salesforce misconfigurations. The attacker’s customized version goes well beyond reconnaissance: where the original tool simply identifies vulnerable API endpoints, the weaponized variant actively extracts data by exploiting overly permissive guest user profile configurations.

Salesforce was clear that no platform vulnerability is involved; this is entirely a misconfiguration problem, requiring two conditions to be exploitable: the organization uses the Experience Cloud guest user profile, and has not followed Salesforce’s recommended hardening guidance. The company stopped short of naming the responsible group, though it noted attribution to a known threat actor, raising the possibility of ShinyHunters involvement given that group’s documented history of targeting Salesforce environments through third-party integrations.

For any organization running Salesforce Experience Cloud, this warrants an immediate review of your configuration. For everyone else, it’s a timely reminder that SaaS misconfiguration remains one of the most reliably exploited gaps in enterprise security posture.

Agentic AI: The Attack Surface Nobody Is Ready For

Brian Krebs documents how the rapid adoption of autonomous AI assistants is creating a new and largely unmanaged attack surface in enterprise environments. It’s a great overview of the risks associated with AI assistants that take initiative on the user’s behalf versus passive agents that respond to user prompts. Of course, the focal point is OpenClaw, an open-source AI agent designed to operate proactively on a user’s behalf with full access to a user’s digital environment.

The more significant concern for security leaders isn’t the misconfiguration risk (though that’s in here too) - it’s the structural one. A documented supply chain attack against the AI coding assistant Cline demonstrated how prompt injection through a GitHub issue title caused the tool’s own AI-powered workflow to install a rogue agent with full system access across thousands of devices as part of an official update. This is what researchers are calling the confused deputy problem at scale: developers authorize AI agents to act on their behalf, and once those agents are compromised, that authority is silently delegated to whatever the attacker chooses. The “lethal trifecta” framework coined by Django co-creator Simon Willison captures the core risk clearly: any system that combines access to private data, exposure to untrusted content, and the ability to communicate externally is a data exfiltration waiting to happen.

👤 People and Processes

National Cyber Strategy: Big Ambitions, Hollowed-Out Execution

On March 6, the White House released President Trump’s Cyber Strategy for America, a seven-page document (much shorter than its predecessors) built around six policy pillars: adversary deterrence, common-sense regulation, federal network modernization, critical infrastructure protection, emerging technology dominance, and workforce development. The tone is aggressive, framing cyberspace as a domain for offensive power projection, with the administration promising it “will not confine its responses to the cyber realm.” Familiar priorities appear, such as zero-trust, post-quantum cryptography, supply chain resilience, and public-private partnerships, but details are deferred to a forthcoming action plan that does not yet exist (not unusual for a strategic policy to lack specifics, though).

What the document cannot obscure is the widening gap between its ambitions and the institutional capacity to execute them. FBI Joint Terrorism Task Forces have been resource-stripped in favor of immigration enforcement, degrading the interagency coordination that the strategy promises. A mass exodus of career intelligence professionals has hollowed out the CIA and broader IC, stripping the attribution capabilities that offensive cyber operations depend on. CISA has lost at least a third of its workforce, its public-private partnership programs have been defunded, and its acting director was reassigned just days before the strategy dropped. And largely beneath the radar: DOGE’s sweeping data-gathering across federal civilian agencies has raised serious unresolved questions about access controls and the security of sensitive federal systems - an own-goal that no cyber strategy document addresses. Ambition without capacity isn’t strategy.

What Phil Venables Gets Right About Modern Security Leadership

In a post that deserves wider circulation among security leaders, Google board member and former Goldman Sachs CISO Phil Venables makes a deceptively simple argument: in a world where AI is accelerating both the pace of change and the pace of threats, speed is no longer a performance metric; it is a survival condition. Venables structures his thinking around Stewart Brand’s Pace Layers framework, observing that effective security programs must learn to operate across multiple time horizons simultaneously, moving fast at the technology and tooling layers while building durable control reliability at the slower, more stable layers below.

His practical recommendations span eleven areas, from streamlining software delivery pipelines and change approval processes to building autonomic security operations capable of self-correction without waiting for human direction. The throughline challenges the defeatism that pervades much of the security community: the organizations that claim they cannot move faster, Venables argues, confuse lack of will with lack of ability.

Two observations from the piece are particularly worth internalizing:

1. Venables reframes the classic “attackers don’t have change boards” argument, acknowledging its validity while pointing out that the most mature regulated organizations have already solved this problem by streamlining approvals and expanding the category of pre-authorized changes, moving fast without breaking things.

2. His concept of “shifting down” rather than just shifting left is perhaps the most actionable long-term idea in the piece.

For CISOs navigating board conversations about AI investment and program maturity, this post provides both a vocabulary and a practical framework for making the case that speed and rigor are not in tension.

💡Connecting the Dots

Phil Venables argues that organizations claiming they cannot move faster are confusing a lack of will with a lack of ability. I think he’s right, but this issue suggests the problem runs deeper than organizational inertia. The gap between intent and capability isn't just an execution failure; it’s an attack surface. Attackers aren't breaking through defenses so much as stepping into the space between what organizations believe their security posture to be and what it actually is. That gap shows up in federal institutions stripped of the talent required to operationalize an aggressive national strategy, in SaaS environments where published guidance goes unimplemented, in browser-delivered attacks that bypass every email-based and network-focused control an organization has invested in, and in AI systems granted authority that no governance framework or technical control has caught up to. The throughline isn't speed, and it isn't sophistication. It's the compounding cost of security theater.

Subscribe now

Subscribe now

🛡️Tactical Challenges

Crackdown On The Com Leads to 30 Arrests

A yearlong Europol-coordinated operation has delivered the first significant law enforcement action against The Com, the loosely organized English-speaking cybercrime collective that sits behind Scattered Spider and a range of financially motivated and violent attacks. Operation Project Compass, led by Europol’s European Counter Terrorism Centre and involving law enforcement from 28 countries, resulted in 30 arrests and the identification of 179 suspects. The Com is mostly composed of cybercriminals aged 16 to 25, and has been linked to attacks ranging from crippling British retailers’ IT systems to making bomb threats and coercing teenage girls into self-harm. Over time, The Com has developed connections to violent extremist groups and Russian cybercriminal gangs, with some offshoots refining extortion tactics by running sextortion campaigns targeting teenagers before escalating to attacks on corporations.

The Com is the upstream talent pool and social network that feeds groups like Scattered Spider - the same collective responsible for the MGM and Caesars intrusions. The decentralized, youth-driven structure makes it persistently difficult to fully disrupt, and law enforcement has been candid about that. The more operationally relevant signal is the attack profile: social engineering-first, identity-focused, and increasingly connected to physical threats and extortion. If your organization hasn’t stress-tested its defenses against this style of attack - vishing, SIM swapping, help desk manipulation - this is a good reminder that the threat is real, organized, and still active despite the arrests. We’ve researched The Com and their attack campaigns extensively at Push Security - you can read some of our coverage here and here.

Claude Code and ChatGPT Weaponized in Mexican Gov Attack

Israeli cybersecurity firm Gambit Security has published research detailing a case where threat actors weaponized Anthropic’s Claude Code to conduct a sustained attack against Mexican government systems, ultimately compromising 10 agencies and a financial institution and exfiltrating 150GB of data. The attackers posed as bug bounty testers to manipulate Claude into writing exploits, generating targeting recommendations, and automating credential harvesting, ultimately sending over 1,000 prompts over roughly a month of operations. When Claude resisted certain instructions, the attackers pivoted to ChatGPT to fill the gaps, treating multiple AI systems as interchangeable tools in the attack chain (I wrote about this commoditization of AI earlier this week). This follows Anthropic’s November 2025 disclosure that China-linked actors had also abused Claude Code in an espionage campaign targeting nearly 30 organizations worldwide.

The takeaway from this story isn’t that Claude is uniquely dangerous, of course; it’s that AI-assisted attacks are now a documented operational reality, not a theoretical concern. For defenders, this changes the threat model in a few meaningful ways. First, attack velocity is going up: AI dramatically compresses the time between initial access and lateral movement. Second, the sophistication floor is dropping. Attackers don’t need deep technical expertise when they can use prompts to guide an intrusion. If your SOC is still tuned to the pace of human attackers and a largely manual attack chain, AI-assisted intrusions may move faster than your playbooks expect. Check out SecurityWeek’s coverage of this story here.

🤖 Emerging Threats

Case Study: Weaponization of a Chrome Extension

Annex Security published research last week that’s a textbook illustration of the browser extension supply chain problem. A Chrome extension called QuickLens - a Google Lens wrapper that had grown to 7,000 users and earned a Featured badge from Google - was listed for sale on ExtensionHub, a marketplace where developers sell extensions complete with their user base and review history. On February 1st, 2026, ownership was transferred to an unverified entity operating under the domain supportdoodlebuggle.top, registered as LLC Quick Lens: a throwaway identity with no verifiable online presence. Two weeks later, version 5.8 quietly pushed a fully operational command-and-control platform to all 7,000 existing users. The update added two new permissions and embedded a C2 server that fingerprints users, registers a persistent UUID, and polls for JavaScript instructions to execute at runtime, so the malicious payload never appears in the extension’s source files.

The capability this gives attackers is significant: the injected code can read session tokens, capture form inputs, scrape page content, and send stolen data to external servers - all while the extension continues functioning normally as a Google Lens tool, leaving users with no reason to suspect anything is wrong. This is the extension supply chain attack in its most refined form, with no new installs required, no alarming new permissions, and no malicious code visible at rest.

Effective controls for this kind of thing include extension allowlisting, monitoring for ownership changes and unexpected new permissions (particularly declarativeNetRequest and webRequest), and runtime behavior analysis rather than static inspection. Shameless plug: we do a LOT of research into malicious browser extensions at Push Security, and offer these controls out of the box. I’ll also be hosting a webinar next week on malicious extensions!

Google Moves to Create a Quantum-Safe Web

Google announced last week that Chrome is moving toward a fundamentally new certificate architecture for quantum-resistant HTTPS, called Merkle Tree Certificates (MTCs). Rather than simply swapping post-quantum algorithms into existing X.509 certificates, which would create significant bandwidth problems, Google is redesigning how certificate chains work entirely, in partnership with Cloudflare and through the IETF (you can check out Cloudflare’s post on MTC from late last year here). A new Chrome Quantum-Resistant Root Store goes live in Q3 2027, running alongside the existing system to ensure a managed transition. This isn’t just a browser update; it’s a signal that the underlying plumbing of web PKI is being rebuilt, and organizations with internal CAs, certificate pinning, TLS inspection proxies, or manual certificate management processes will feel it.

The right move now is to start your cryptographic inventory: know where you depend on traditional X.509 certificates, especially anything involving internal PKI or long-lived certificates. Google is also explicitly pushing toward ACME-only certificate workflows in the new ecosystem, so if you’re still managing certificates manually, this is a good forcing function to automate. And if you’re thinking about the actual quantum threat, your real exposure isn’t browser HTTPS - it’s sensitive data in transit being harvested today by adversaries who plan to decrypt it later. Focus there first. What you shouldn’t do is treat this as an immediate crisis. Chrome is maintaining X.509 fallbacks throughout the experiment phase; the two root stores will coexist, and the standard is still being finalized. Organizations that build cryptographic agility into their infrastructure now will navigate this transition without drama. The ones who wait will scramble.

👤 People and Processes

Mapping Critical Infrastructure Dependencies with CLAIR

A guest diary on the SANS Internet Storm Center by Claire Perry introduced the CLAIR Model (Comprehensive Linkage and Architectural Infrastructure Resiliency), a new framework for mapping critical infrastructure interdependencies that’s worth understanding as IT/OT convergence risks accelerate. The model extends the familiar Purdue hierarchy from five levels to ten, with the most interesting additions at the extremes: Level -1, which accounts for the external utility grid and other primary infrastructure that organizations don’t control but entirely depend on, and Levels 6 and 7, which address cloud/edge computing and high-trust safety systems, respectively.

The core insight is that the old Purdue model treats the outside world as a simple input rather than a complex, bidirectional dependency - a blind spot that’s increasingly dangerous as data centers become massive electrical loads deeply entangled with regional power grids.

The model also calls out AI-OT convergence as an emerging dependency risk, noting that AI models deployed at operational layers can create hidden cyber linkages that effectively bypass the industrial DMZ when models need to be updated from cloud infrastructure. If you’re responsible for securing OT and using Perdue as a reference, consider CLAIR as an expanded maturity lens.

The Case for Better Breach Transparency

Security researchers Adam Shostack and Adrian Sanabria are making the case at RSAC 2026 for something the industry has long resisted: genuine breach transparency. Their argument is pretty straightforward: it has become standard practice for organizations to disclose the bare minimum about a data breach, or worse, not disclose the incident at all. Shostack and Sanabria draw a contrast with other safety-critical industries like aviation and medicine, where failures are heavily scrutinized and formalized feedback loops exist specifically to help others learn from them. Without better data and empirical evidence to inform breach prevention, the industry risks investing in what Sanabria calls “busywork generators” - tools and compliance activities that may not significantly reduce real-world risk.

This lands differently for security leaders than it does for the broader industry conversation. The argument isn’t just philosophical; it has a direct bearing on how security programs are evaluated and how budgets get justified. Without formalized transparency and governance, the industry will struggle to determine whether organizations are truly improving their response to and prevention of security incidents. The duo proposes anonymized reporting, delayed public disclosures, and regulatory safe harbors for good-faith transparency - mechanisms designed to lower the legal and reputational cost of honesty, which I think historically has been the biggest hurdle to clear.

💡Connecting the Dots

The key takeaway this week: defenders are operating with incomplete pictures, and adversaries are exploiting that gap with increasing precision.

• The Mexico AI attack and the QuickLens extension case both demonstrate how attacks can now unfold within trusted surfaces, without triggering the controls designed to catch them.

• The Com's persistence despite arrests reminds us that decentralized, identity-focused threat actors don't need sophisticated infrastructure when social engineering gets them through the front door.

• Google's MTC announcement and the CLAIR model both point to dependencies that most organizations haven’t mapped: cryptographic infrastructure and utility-layer dependencies that sit entirely outside the security perimeter.

• Shostack's RSAC breach-transparency argument ties it all together: the industry's reluctance to share failure data means we're collectively making the same mistakes in the dark.

The throughline is that the next phase of security maturity isn't about adding more tools; it's about closing the visibility gaps that let adversaries operate undetected inside systems we thought we understood.

Subscribe now

Yann LeCun goes further, arguing that current LLMs aren’t just commoditizing but are the wrong paradigm entirely. Whether you find his thesis convincing or not, the directional pressure is the same: the model itself is not where durable value lives.

When reasoning becomes infrastructure, value doesn’t evaporate; it migrates up to the application layer and down to the data layer. Palantir built its entire business on this thesis - the limiting factor in turning data into decisions wasn’t compute or model sophistication, it was the ontological work: modeling complex domains, encoding analyst workflows, building the data structures that make AI reasoning operationally meaningful. I recall running an early pilot of Palantir in a SOC and being confused about why it required multiple engineers camping out to build the data models! Competitors with superior model budgets have consistently failed to replicate it, because the moat isn’t algorithmic. It’s architectural and experiential. That’s a lesson worth applying to security decision support.

This is also something we should take into our evaluations of security products. A lot of vendor pitches right now lead with AI: the demo, the capability theater, the natural language interface.

This isn’t a critique of any one product; it’s a pattern that emerges naturally when a powerful capability becomes widely accessible. When everyone can call the same API, the interface is no longer the differentiator.

The question to ask any AI-forward security vendor (particularly one providing detection or analytic capabilities) isn’t “how good is your AI?” It’s “what is your AI actually looking at, and where did the detection logic come from?” The strongest vendors answer with something genuinely hard to replicate quickly. CrowdStrike’s detection edge, IMO, derives less from model sophistication than from a threat graph built across hundreds of millions of endpoints over many years. Mandiant’s value isn’t their ML pipeline; it’s institutional knowledge from being in the room at the world’s most significant breaches. Evaluating either platform on AI capability alone misses the point entirely.

I think about this in my work at Push Security, and I’ll acknowledge I’m not a neutral observer. We use AI not as the value proposition itself, but as infrastructure that lets our applied research scale. The insights - how identity-based attacks actually work in browser environments, detection logic built from real adversary behavior, where traditional frameworks show their seams - that’s the work that requires human expertise. AI helps us move it further and faster.

Consider the difference between a model running against standard network and endpoint telemetry and one with access to browser-session-level data, such as OAuth consent flows, extension behavior, and credential entry context. Attacks like ClickFix and ConsentFix exploit the browser session in ways that leave no trace in endpoint or network logs. If the AI doesn’t have the right telemetry, the detection logic simply doesn’t exist, no matter how capable the model is. Sensor placement determines what’s detectable; AI with the right telemetry determines how well. The detection primitive, not the inference call, is the intellectual property.

My plea to security leaders is this: stop treating AI adoption as a question of which model you’re running, and apply the same discipline to vendor evaluation. Skip the demo reel. Ask what’s underneath it. What telemetry does the AI actually see? What research produced the detection logic? What would remain if you swapped out the model entirely? Fortunately, many of the people we heard from in last week’s forum focused on these questions. But I’ll be interested to see how AI is positioned in solutions presented at RSAC at the end of the month.

The model isn’t the moat. The context is the moat. The detection logic is the moat. The hard-earned research and judgment baked into your detection architecture is the moat. Everything else is infrastructure!

Subscribe now

🛡️Tactical Challenges

Short-Term Pessimist, Long-Term Optimist

This week, we’re highlighting a few interesting developments in AI and security, so I thought it might be best to open with some perspective from Phil Venables - former Goldman Sachs CISO, former Google Cloud CISO, and about as credible a voice as you’ll find in this industry, whose insights I often share here.

Phil published a sharp piece this week describing a meaningful shift in his threat outlook: he has moved from an incrementalist to a genuinely alarmed stance. His argument rests on four compounding forces that are bad individually and catastrophic in combination.

1. A tidal wave of vulnerabilities is coming: AI-augmented engineering means more software will be written, AI dramatically improves vulnerability discovery, and even as model code quality improves, it remains imperfect, meaning the net volume of exploitable flaws will increase substantially.

2. Attackers are industrializing in ways that eliminate the economic friction that historically kept the volume of actual exploitation below the volume of what was theoretically exploitable, and AI is helping to close that gap.

3. Synthetic authenticity collapses: fake candidates, fake workers, fake companies, fake content at scale make it structurally harder to establish trust in any interaction - business, personal, or civic.

4. Maybe most underappreciated out of these is the emergence of trillions of AI agents with imperfect guardrails, which creates a collective behavioral risk that individual agent-level controls can’t address - a kind of enterprise control plane problem that no one has fully solved yet.

The optimism rests on a structural asymmetry that often gets lost in the doom: defenders control their environment, and attackers (mostly? hopefully?) don’t. Specificity is a home-field advantage. The prescription is familiar in principle but now urgent in execution: relentless baseline hygiene universally applied (strong authentication, segmentation, fast patching, identity and privilege management, software supply chain controls), continuous control monitoring that roots out recurrence rather than just detecting failures, and aggressive adoption of AI on the defensive side before attackers fully operationalize it. His bottom line is stark: the only fundamental defense is speed, and the window to institutionalize that speed advantage is now.

2026 Dragos OT Cybersecurity Year in Review

Dragos released its 9th Annual OT Cybersecurity Year in Review this week, and the headline finding is a visibility crisis that makes everything else worse: only 30% of OT networks have sufficient visibility, 56% cannot see below the IT/OT boundary, and 88% struggle with detection and response - meaning most organizations only discover a compromise after something in the physical process behaves abnormally, long after adversaries have done their work.

The threat landscape accelerated in 2025 on every dimension: Dragos now tracks 26 OT-focused threat groups, three of which are newly identified, and established groups expanded their geographic reach while progressing further through the ICS Cyber Kill Chain. Ransomware hit 3,300 industrial organizations during the year, driving operational disruptions across critical sectors, and only 4% of disclosed vulnerabilities were actively exploited; a number that sounds reassuring until you consider that exploitation is happening faster than patching cycles can accommodate. For security leaders with OT responsibility, the report is a useful annual benchmark and available for download at dragos.com.

🤖 Emerging Threats

GitLab's threat intelligence team published a detailed exposé of North Korean “Contagious Interview” and IT worker operations that used GitLab.com as infrastructure in 2025, and what makes it unusually valuable is the visibility GitLab had into the actual private repositories these threat actors created.

• The malware side: GitLab banned 131 accounts in 2025, distributing JavaScript-based malware (primarily BeaverTail and OtterCookie) disguised as legitimate developer interview projects, targeting developers in crypto, finance, and real estate.

• The IT worker side is where it gets really cinematic: GitLab found financial records for a named North Korean national managing an eight-person cell operating out of Beijing under academic cover, documenting $1.64 million in earnings between 2022 and 2025 against a target of $1.88 million, with quarterly performance reviews, personnel dossiers on each member including passport copies, and even notes on who did the laundry

Other case studies detail a synthetic identity pipeline that generated at least 135 fake personas with automated account creation and professional network building; an operator running 21 personas with Photoshopped U.S. identity documents, including driver's licenses and passports; and a North Korean worker operating from central Moscow. The full report includes 600+ IOCs and is required reading for any organization that hires software contractors or runs a developer platform.

Nation-State Hackers Are Using Your AI Tools Against You

Google’s Threat Intelligence Group just published their Q4 2025 AI threat tracker, which confirms what most of us might guess: APT actors from China, Iran, North Korea, and Russia have fully operationalized commercial AI tools - including Gemini -across every stage of the attack lifecycle. APT42 is using Gemini to craft hyper-personalized phishing lures and build rapport with targets through believable multi-turn conversations. APT31 is prompting Gemini, using a security researcher persona, to automate vulnerability analysis against specific U.S. targets. North Korea’s UNC2970 is using it to profile defense-sector targets and to generate high-fidelity recruiter impersonation campaigns.

The report also details two interesting new malware families: HONESTCUE, a downloader that calls the Gemini API in real-time to generate and execute its second-stage payload entirely in memory (leaving no artifacts on disk), and COINBAIT, an AI-generated phishing kit targeting crypto exchange credentials that was almost certainly built with tools like Lovable AI.

The important thing here isn’t the sophistication, it’s the democratization - no net-new capabilities here, but faster scaling. The floor for executing a credible, personalized, multi-stage attack has dropped significantly. It’s going to be increasingly hard to train your way out of spotting these campaigns moving forward.

Anthropic Launches Claude Code

Anthropic launched Claude Code Security last Friday - an AI-powered vulnerability scanner built into Claude Code that scans codebases, identifies security flaws traditional static analysis tools miss, and suggests targeted patches for human review. The capability is currently in limited research preview for Enterprise and Team customers, with free expedited access extended to open-source maintainers. A multi-stage verification process filters false positives, severity ratings help teams prioritize, and the system is explicitly human-in-the-loop: Claude identifies and recommends, but a developer approves every patch before anything changes.

The market reaction was immediate: CrowdStrike fell roughly 8-12%, Zscaler dropped 11%, Okta shed 9%, JFrog cratered 25%, and the Global X Cybersecurity ETF hit its lowest close since November 2023. Analysts at Wedbush, Barclays, and Jefferies all pushed back on the panic, calling it an overreaction driven by “AI ghost trade” fears rather than competitive reality - pointing out that Claude Code Security targets static analysis and AppSec tooling, not endpoint detection, identity management, or the runtime security capabilities that underpin CrowdStrike’s or Zscaler’s core businesses.

This is nothing more than a signal that AI-native security tooling is becoming a standard layer in the software development lifecycle, rather than a wholesale replacement for the security platform market. That said, the structural threat to pure-play code-scanning vendors is real, the competitive pressure on AppSec budgets is real, and the broader question of whether AI platform providers will continue to bundle security capabilities into developer products is one every security leader and their CIO/CTO should be thinking about right now.

👤 People and Processes

The False Measurement of Puzzle Questions in Interviews

Fast Company ran a piece this week surfacing decades of industrial-organizational psychology research that proves tricky, brainteaser-style interview questions have low predictive validity. Questions like “how many tennis balls fit in a Boeing 747?” or abstract scenario puzzles don’t reliably measure problem-solving ability, cultural fit, or performance under pressure - ostensibly the things interviewers believe they’re measuring (I personally once got “how many gas stations are there in the US?”). At best, they measure comfort with improvisation and prior exposure to similar puzzles. At worst, they measure how similar the candidate is to the interviewer. Research on who chooses to use brainteaser questions in the first place found that those interviewers were more likely to be socially inept, narcissistic, and overconfident in their intuitive judgment (ouch!).

I was happy to see this research highlighted, as we’ve included it in LDR551 for years. If your interview process is built around war stories, hypothetical puzzles, or “what would you do if...” scenarios that aren’t grounded in actual job requirements, you’re likely filtering out great candidates who don’t perform well under artificial pressure and selecting for candidates who are good at interviews, not the job. The research-backed alternative is structured behavioral interviewing: consistent, job-relevant questions asked the same way across all candidates, scored against defined criteria. It’s less exciting than asking someone how they’d defend against a nation-state attacker with a whiteboard, but it’s measurably better at predicting who will actually perform.

💡Connecting the Dots

Venables wrote his piece as a framework, but this week's news reads like Exhibit A through D. Google's GTIG report is the "attackers industrializing" pillar made concrete; nation-states running commercial AI across the full kill chain, collapsing the cost of credible, personalized attacks to near zero.

The GitLab North Korea exposé is the "everything can be faked" pillar, with receipts: 135 synthetic identities, 21 Photoshopped passports, and a full-time employee inside a U.S. tech agency whose real location was central Moscow.

The Dragos OT report illustrates what happens when the tidal wave of exploitable exposure meets organizations that can't see below their own IT/OT boundary. And Claude Code Security, regardless of what the market thought it meant for incumbent vendors, is a data point for the defensive side of Venables' argument: AI finding vulnerabilities at scale before attackers do.

Operating tempo is everything here. Defenders who move now - on speed, on baseline hygiene, on AI adoption - will have a structural advantage that compounds. Time to revisit team capacity and efficiency!

Subscribe now

Subscribe now

🛡️Tactical Challenges

The Browser Extension Crisis Hits Critical Mass

Security researcher Q Continuum has uncovered 287 Chrome extensions with over 37.4 million users that are actively transmitting browsing history and search engine results pages (SERP) to external servers. The research, which analyzed network traffic generated by Chrome extensions, found that roughly 27.2 million users had installed 153 extensions confirmed to leak browser history immediately upon installation - meaning the data exposure begins the moment someone clicks “Add to Chrome.”

Some extensions leak this data by exposing it to unsecured networks, while others deliberately transmit it to collection servers, either due to intended functionality, monetization strategies, or explicitly malicious intent. Q Continuum flagged over 200 additional extensions as suspicious due to shared author details with confirmed data-leaking extensions and observed four scrapers connecting to a honeypot set up for the research, demonstrating active reconnaissance by threat actors targeting these compromised user bases. The scale of this campaign positions browser extensions alongside supply chain compromises and identity attacks as a tier-one threat vector.

If you’re a defender who isn’t actively focused on curbing malicious extensions, you’re behind the power curve. Browsers are now the primary workspace, and extension governance is an identity and data protection problem masquerading as a user productivity issue. The 27.2 million users affected by confirmed-malicious extensions represent a conservative floor; Q Continuum’s identification of 200+ additional suspicious extensions with shared infrastructure suggests the actual exposure is significantly larger.

Google Maps the Defense Industrial Base Threat Landscape

Google Threat Intelligence Group published a comprehensive analysis of threats targeting the defense industrial base, revealing that China-nexus cyber espionage actors represent the highest volume of activity against defense and aerospace entities over the past two years - more than any other state-sponsored threat. The analysis documents China-nexus groups exploiting more than two dozen zero-day vulnerabilities in edge devices (VPNs, routers, firewalls, security appliances) since 2020 across ten vendors, with groups such as UNC3886 and UNC5221 demonstrating extensive efforts to obfuscate activity and maintain long-term access in environments that lack EDR monitoring. The BRICKSTORM campaign attributed to UNC5221 achieved an average dwell time of 393 days across aerospace, defense, and MSP targets by compromising perimeter devices to bypass traditional endpoint detection entirely. Meanwhile, Russian operations targeting Ukraine have shifted from network-centric intrusions to individual-focused campaigns exploiting Signal, Telegram, and battlefield management apps like Delta and Kropyva - often through physical device access, mobile malware, or social engineering that happens completely outside enterprise visibility.

The most significant finding is the wholesale migration of initial access from traditional attack surfaces to areas where enterprise security has limited or no visibility. North Korean IT workers successfully infiltrated over 100 US companies, including defense contractors developing AI technology, using laptop farms and stolen identities to gain employment and exfiltrate sensitive data while appearing as legitimate remote workers. Iranian groups UNC1549 and UNC6446 created fake job portals and resume-builder applications for aerospace firms, while China-nexus APT5 meticulously crafted spearphishing campaigns against defense contractor employees’ personal email addresses using hyper-localized lures referencing specific universities, Boy Scout troops, and community events near their homes.

In short, your enterprise security stack is defending yesterday’s attack surface while adversaries are compromising personal devices and identity, exploiting hiring processes, and persisting in edge and cloud infrastructure that your EDR can’t see.

Palo Alto Global Incident Response Report 2026

Unit 42 just published its Global Incident Response Report, based on its incident response work on more than 500 major cases across 38 countries. Lots to unpack here! The report identifies five dominant trends reshaping the threat landscape:

1. The evolution of extortion into intentional operational disruption (86% of incidents involved some form of business disruption),

2. Growing cloud and software supply chain attacks (29% of cases involved cloud environments, with attackers scanning over 230 million unique targets in a single campaign),

3. Dramatically accelerating attack timelines (in 19% of cases, data was exfiltrated within one hour of compromise, three times faster than 2021)

4. A tripling of North Korean IT worker insider threat cases as state-sponsored operatives embed in contract technical roles using KVM-over-IP hardware to evade endpoint monitoring

5. The early emergence of AI-assisted attacks, as Unit 42’s simulations show, is compressing the time from compromise to exfiltration from a two-day median to 25 minutes.

Three enablers allow attackers to succeed repeatedly:

• Security complexity (in 75% of incidents, evidence of the initial intrusion was present in logs but not operationalized),

• Gaps in visibility (organizations spin up 300 new cloud services per month on average, and security tool issues contributed to nearly 40% of cases)

• Excessive trust (41% of incidents had at least one identity and access management contributing factor, with IAM issues appearing in nearly half of cloud-related incidents).

Browser-based activity accounted for 44% of all incidents. The human layer, the browser, and identity remain the most consistently exploited attack surfaces across every sector, and defenders are losing the race between attacker speed and detection capability.

🤖 Emerging Threats

Claude Artifacts Weaponized for Mac Infostealer Delivery

Via Bill Toulas at BleepingComputer: Threat actors are exploiting Claude’s public artifact feature and Google Ads to deliver MacSync infostealer to macOS users via ClickFix campaigns targeting common search queries such as “online DNS resolver,” “macOS CLI disk space analyzer,” and “HomeBrew.” In a lengthy X thread, researchers at Moonlock Lab and AdGuard described at least two attack variants, with one malicious Claude artifact accumulating more than 15,600 views before being flagged.

The attacks use either public Claude artifacts or fake Medium articles impersonating Apple Support, both instructing victims to paste shell commands into Terminal that execute base64-encoded payloads or run curl commands to fetch malware loaders from the attacker’s infrastructure. Once executed, MacSync deploys with root-level privileges, exfiltrating cryptocurrency wallets, browser credentials, Keychain data, and filesystem contents through encrypted connections to command-and-control servers that spoof legitimate macOS browser traffic. The campaign specifically targets domain-joined systems, indicating deliberate focus on enterprise environments rather than home users.

This is the third major LLM platform to be weaponized in ClickFix campaigns, following similar attacks using ChatGPT and Grok’s shared conversation features in December 2025 that delivered AMOS infostealer to Mac users. The pattern is fairly consistent: attackers engineer prompts that force LLMs to generate malicious instructions, publish them through legitimate platform sharing features, then use SEO poisoning and paid ads to surface these conversations as top search results for troubleshooting queries. Users implicitly trust Google search results, AI platform domains (claude.ai, chatgpt.com, grok.com), AI-generated technical guidance, and routinely copy-paste Terminal commands from trusted sources like Stack Overflow and Reddit. Every layer of this attack abuses behaviors that security teams have actively encouraged: using official documentation, consulting AI assistants for technical problems, and following step-by-step troubleshooting guides.

ClickFix Evolves Again

Microsoft disclosed a new ClickFix variant that weaponizes DNS lookups to stage malware, moving beyond web-based delivery by instructing victims to execute nslookup commands through the Windows Run dialog that query attacker-controlled DNS servers for next-stage payloads. The technique filters DNS response output to extract and execute embedded commands, using DNS as a “lightweight staging or signaling channel” that blends malicious activity into normal network traffic while adding a validation layer before payload execution. The attack chain downloads a Python script that conducts reconnaissance and deploys ModeloRAT, a Python-based remote access trojan previously distributed through the CrashFix browser extension campaign, with persistence established via Windows Startup folder LNK files.

Bitdefender separately reported a surge in Lumma Stealer activity, driven by ClickFix-style fake CAPTCHA campaigns that deploy CastleLoader, an AutoIt-based loader that checks for virtualization software and security products before decrypting the stealer in memory. Infections were concentrated in India, France, the US, Spain, and Germany.

The DNS-based staging variant represents the continued industrialization of ClickFix as a delivery mechanism that now spans multiple protocols and platforms, from traditional PowerShell execution to browser crashes, fake software updates, AI chatbot instructions on Claude and ChatGPT, and now DNS lookups that security monitoring treats as benign infrastructure traffic.

The broader ecosystem shows ClickFix enabling delivery of at least seven major stealer families (Lumma, AMOS/Odyssey, MacSync, StealC, Stealerium, and others) through campaigns targeting cryptocurrency wallets, browser credentials, and authentication tokens, with macOS increasingly targeted despite the persistent “Macs don’t get viruses” assumption that remains actively dangerous in enterprise environments.

👤 People and Processes

UK Cyber Essentials Closes the MFA Gap

Via the Push Security blog: The UK’s Cyber Essentials scheme is implementing significant changes in April 2026 that redefine the scope of cloud services and mandate MFA enforcement across all business accounts, fundamentally changing how organizations validate compliance. The updated requirements from NCSC and IASME expand “cloud services” to mean any service accessed via a business email or account - regardless of subscription tier or cost - and require MFA to be enabled for all users on every service that offers it, including apps that only provide MFA as a paid add-on or higher tier feature.

If a service lacks native MFA but supports authentication via a provider that offers MFA (e.g., “Sign in with Microsoft”), organizations must use only that federated method. This means shadow apps discovered during audits constitute automatic compliance failures, with auditors now interviewing employees and asking them to demonstrate logging into various apps to validate MFA status and overall authentication posture.

The regulatory shift addresses a gap between assumed and actual security coverage, which has enabled recent high-impact breaches targeting accounts without MFA. The 2024 Snowflake incident compromised 165+ tenants and billions of records, leveraging credentials leaked online as early as 2020, with over 80% of breached accounts lacking MFA. Organizations that assume all apps are accessed via SSO discover that apps are routinely self-adopted by users, vendor support for centrally enforced MFA is inconsistent, and apps that require paid upgrades for security features are prevalent, creating an authentication landscape in which many accounts lack MFA despite policy requirements to the contrary. Nice to see regulations catching up to reality.

💡Connecting the Dots

The throughline this week is that your vendor's feature roadmap is also your attack surface, and traditional security controls built to detect exploitation of broken things provide almost no signal when adversaries are exploiting things that work. Unit 42 found that in 75% of incidents, evidence of compromise was sitting in logs that nobody operationalized. The question worth asking in your next architecture review isn't "what are we missing that's broken?" but "which of our vendors' intended features would we never detect being abused?"

Subscribe now