Read Time: 5 minutes

Brought to you by:

Howdy friends!

It’s been hard to parse down what to cover the last few weeks. There is A LOT of stories taking up a lot of our attention. I’m trying to avoid too much random breach noise and stick to things that we can learn lessons from or are otherwise impactful/industry relevant.

ICYMI

🖊️ Something I wrote: I got absolutely nerd sniped watching the speed of this tool built on top of security relevant data by Scanner - wrote up my impressions here.

🎧️ Something I heard: The latest Low Down talking about the 153 million drivers licenses lost, people coming to the defense of TeamPCP hackers, Nigerian sextorion rings, and much more.

🎤 Something I said: We aren’t talking enough about OAuth security risks

Vulnerable News

216,000,000 Spy TVs, The LG Smart TV Problem

WTF is going on at LG? Last time it was 42% of their smart TV apps carrying a residential proxy SDK, alongside a Gamers Nexus video about adware on their $1,200 monitors. Steve Burke is back with two hours and fifteen minutes on the TVs themselves. Packet captures on retail OLED sets show the TVs enumerating everything on the local network. One test TV found 38 devices, including phones and watches belonging to staff who had nothing to do with the testing. Add nearby Wi-Fi names, signal data, and ACR fingerprints of whatever is on screen, all flowing back to LG's advertising side.

Instagram post

They also reported RCE bugs to LG and used one to turn a G5 into a listening device, capturing room audio with the screen off and the ethernet unplugged, then uploading the file once the connection came back. Those bugs are still in disclosure so details are thin. The network enumeration and the ACR pipeline are the shipping product working as designed, which is the part that should actually bother you. Put the TV on your IoT VLAN and drive it with an Apple TV. (watch more here and read more here)

Are pentests obsolete in the AI era?*

AI can now deliver the depth of a pentest at the frequency of a scan. Instead of one annual engagement, testing could soon happen continuously: triggered whenever a new feature ships, a port opens, or a configuration changes.

This Intruder blog explores the short, medium, and long-term future of pentesting, and why the annual pentest may eventually become a thing of the past. (read more)

*Sponsored

I resigned from Anthropic today

Jacob Coxon, a pretraining researcher who worked at both OpenAI and Anthropic, quit Tuesday and posted why: both labs are racing to self-improving superintelligence and "gambling with our lives." The thread did somewhere north of 150 million views overnight. Then Evan Hubinger, Anthropic's own Alignment Science Lead, quote tweeted it to agree, saying the people inside "really do earnestly believe AI could kill all humans" and putting his personal number at greater than 10% within the decade. Bernie Sanders says he is introducing a bill to pause development and ban superintelligence. Musk called the whole thing a psy op.

The reporting also notes Coxon had been at Anthropic four months and walked two months short of his vesting cliff, which is either the price of a principled exit or a reason to read it carefully. (read more here, here and here)

Multiple crypto companies warn customers of phishing emails after alleged provider breach

Thousands of crypto holders got phishing mail on Wednesday sent from real company domains, with SPF and DKIM passing and every instinct you have trained into your users passing right along with them. Trezor, CoinTracking and BitBox all confirmed it hit their newsletter subscribers. CoinTracking named the source as Brevo, the email marketing provider all three share, and BitBox noted that the other crypto companies getting hit were on the same platform. Brevo put out a notice Thursday saying an attacker had access to 120 customer accounts and used them to mail those clients' contact lists, that the access is closed, and that a post mortem is coming. Trezor's lure was a critical security alert about an STM32 entropy vulnerability.

The STM32 bug is invented, but Coldcard shipped a real entropy failure that cost holders around $89M in July, so the lure works on anyone who has been reading the news. Your marketing email vendor is now a load-bearing part of a hardware wallet's threat model, and one compromise there buys 120 sender reputations and every list behind them. Trezor is also still cleaning up the ShipMonk breach, now at 81,000 customers with names, phone numbers and shipping addresses, and customers have started reporting malicious QR codes arriving by postal mail. (read more here and here)

Detecting and countering misuse of AI: September 2026

Anthropic published its threat intel report yesterday, eight months of actors it caught using Claude across seven harm areas. Everyone is covering the cyber section, and it earns it by being a crazy read. A Russian espionage operator whose tradecraft matches Midnight Blizzard hit more than 20 government and defense targets across Ukraine and Europe, running agents whose entire job was to watch whether security products flagged their malware and rebuild it until nothing did. Two undergrads at a Chinese university ran an exploit foundry producing more than a dozen possible zero days against appliance firmware in a single month. ShinyHunters affiliates, the same collective sitting on Florida's DMV data, dumped 2,100 Azure token sets across 40 tenants in 34 hours. Their own read on the trend is every technique in here is one you have already seen but who is doing the “work” changed from human to agent. Stolen credentials, unpatched edge devices, exposed services, SQL injection, phishing.

Going deeper beyond cyber for a sec because again, this is crazy. A cell in northern Yemen used Claude Code in place of software engineers to build guidance software for a rocket, test-fired it, and was back in a session within hours working out why it failed. A Russian freelance team built an autonomous drone swarm designed for lethal engagement with a person target class and no human in the loop, trained on scraped Ukrainian combat footage. A China-based researcher's electronic warfare targeting suite switched its default scenario mid-project to twelve targets in Taiwan.

And the biology section is the first time any AI company has published evidence of its own platform touching potential bioweapons work, including a reseller that tunneled around regional blocks and routed refused prompts to a competitor's more permissive model, with Claude writing much of that routing code because the developer described it as an over-refusal fix.

Lets all keep the incentives in mind here. This is the vendor selling the model, publishing four days after the federal advisory on Chinese distillation, in the same week its alignment lead put human extinction odds north of 10%. The case files are still the most specific public accounting anyone has of what this tooling does in the wrong hands. (read the full report here and read more here)

Attackers Drained $319 Million in Bitcoin From Liquid Network, Then Returned 85% of Funds

Name your own bug bounty? On September 6 someone minted about 4,000 L-BTC that no bitcoin was backing, pushed it through SideSwap's peg-out service, and left with roughly 95% of the bitcoin in Blockstream's Liquid federation wallet. About $320M. Blockstream says the peg-out authorization key was never compromised, and neither were any others. The signers approved it because from where they sat the withdrawal looked completely ordinary. Root cause traces to a proof verification bug in Elements, the Bitcoin Core fork Liquid runs on.

Then the attackers left an on-chain message declaring themselves white hats, opened a negotiation with Blockstream over OP_RETURN and PGP, and made the return conditional on the bug being fixed and every node patched first. Blockstream signed a message confirming the fix, and 3,400 BTC came back. The remaining 598.5 BTC, about $47M, they kept and called a bounty. Draining 95% of a federation's reserves and then setting your own fee is a novel reading of coordinated disclosure. (read more here and here)

Singaporean Ringleader of $245 Million Cryptocurrency Racketeering Enterprise Pleads Guilty

Part of the Com, Malone Lam (22), pleaded guilty in DC this week to a RICO conspiracy count covering more than $245M in stolen and laundered crypto. The enterprise came together on gaming platforms, spread across California, Connecticut, New York, Florida and abroad, and ran on social engineering with the occasional home break-in. Lam picked the targets and assigned everyone their role.

Like all these young pups who get arrested, the spending and bragging was a huge part of his downfall. DOJ lists nightclub tabs running to $500,000 a night, handbags given away at parties, watches from $100,000 to north of half a million, rental houses in LA, the Hamptons and Miami, private jets, a personal security detail, and a car collection topping out at $3.8M. They picked him up at his Miami rental in September 2025 and the status hearing is set for December 8. The entire $245M came out of phone calls and people who were willing to answer questions about their wallets. (read more here and watch more here)

ShinyHunters hackers claim breach of Florida "DAVID" DMV database

ShinyHunters says it pulled over 200,000 records out of DAVID, the Florida Highway Safety and Motor Vehicles system that law enforcement and court officials use to look up drivers. They told BleepingComputer they got in through a password reset flaw, took over multiple accounts belonging to DMV employees and an FBI agent, then walked the record IDs and saved the pages as they went. Their proof of breach was Jeffrey Epstein's DMV record. (read more)

IDScan confirms breach tied to 153 million stolen driver's licenses

Following up on this one. IDScan has now confirmed that an unauthorized party accessed customer data in its cloud platform, which is the company Brian Krebs traced on September 1 as the source behind a dark web service selling more than 153 million US and Canadian license scans, plus 10 million ID cards, 3 million travel documents and 579,000 medical cards. Krebs verified it by pulling his own record out of the thing. The FBI is investigating and the lawsuits were filed before the company acknowledged anything publicly. IDScan posted its notice on September 4 with a noindex directive on the page so search engines would skip right past it, which TechCrunch spotted. (read more here, here and here)

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

This is the good stuff. Researchers caught two separate Chinese threat actors, UTA0560 and JungleBamboo (APT31), running byte for byte identical exploit code against NGOs starting September 1. The chain is three bugs deep: a type confusion in Chrome's V8 for read/write inside the sandbox, a WebAssembly bug to get out of the V8 sandbox, then a Windows kernel bug to escape the renderer and land in the browser process. From there the payloads diverge. One group dropped a JScript backdoor. The other installed a credential stealing Chrome extension dressed up as Google Gemini.

Low Level and myself tried to figure this one out to talk about on the podcast and it is REALLY hard to understand unless you’re a V8 expert. (read more here and here)

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

With the power of AI! The vulnpocalypse continues. 974 CVEs, 723 of them in Windows, 999 total once you count the third party fixes bundled in. Two are already being exploited. One is a local privilege escalation in Windows ALPC, which is the same bug Volexity watched get used to break out of Chrome's renderer. The other is an improper link resolution flaw in the Windows Update stack that hands an attacker SYSTEM, and it is the first Windows Update Stack bug to be exploited in the wild. Both landed in KEV with a September 22 federal deadline. ZDI has Microsoft at 2,760 CVEs for the year so far, more than double the previous record with a quarter left to go.. (read more here and here)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Sponsored by Scanner. They paid for this placement. The reporting, the opinions, and the parts where I go off on a tangent are mine.

Every security team I have been on has had one question that arrives at the worst possible moment. Some vuln drops, some report gets written up, somebody senior reads a headline on their phone, and then my phone rings.

Do we run this? Are we exposed? Is it exploitable? Is it on the internet?

At one of the big banks I worked at, the head of cyber defense had a standing rule for the whole department. If he called and asked, he wanted an answer in 30 minutes. Seems like a totally reasonable ask. We could not do it. Our honest best case was about a week, because getting there meant network scans that took days to crawl the environment, a CMDB that nobody fully trusted, and a lot of very expensive people running very manual queries.

That was around 2015. The question has not changed since. The time it takes you to answer it is still the thing your program actually gets graded on, and most teams still measure it in days.

Post-AI, the attacker side of that clock is heading toward zero. Ours mostly is not.

The reason your answer is slow

Here is the part that annoys me, because it has almost nothing to do with talent. Every team I have worked with could answer these questions if they had the data in front of them. They do not have the data in front of them, because at some point somebody did the math on per-gigabyte ingest pricing and started cutting.

It is common to see only a small slice of an org's log data actually searchable, with the rest sprawled across object storage, a warehouse, and whatever SaaS tool happened to generate it. The stuff that gets cut first is not because it lacks value, it’s because it is just enormous in volume: VPC flow logs, DNS, low-level EDR telemetry.

Those are also the exact sources that let you stitch a timeline together instead of staring at a wall of disconnected alerts.

Cliff Crosland, Scanner's CEO, told me the version of this that happened at his previous startup. They hit about a terabyte a day, and the Splunk renewal came in higher than their entire engineering budget. So they dropped VPC flow. Everybody drops VPC flow.

As your company grows, there is more to defend, more logs to defend it with, and a shrinking percentage of them you can afford to look at. Sequoia's Bogomil Balkansky wrote up his research on this when they led Scanner's $22M Series A. One of the security leaders he interviewed put it about as bluntly as it can be put: they "drown in logs we can't afford to keep," and then go blind on the ones they cannot afford to search.

I lived my own version of this at Reddit. When I got there, genuinely talented security engineers were spending their days as sysadmins keeping Elk alive. We tried a few things, including getting Chronicle basically free because we were a big GCP customer, and it was not ready for prime time back then. We went Splunk as the easy button, and then spent a couple of years clawing our way back off it onto BigQuery. The team wrote the whole thing up publicly after I left.

What I remember most is what I kept asking for and kept not getting. VPC flow and DNS.

What changed is who is asking the questions now

For twenty years the consumer of your security data was a person with a keyboard and a finite number of hours. That person rationed their threat hunts, because each one cost real time and sometimes real money. Athena queries at petabyte scale ran for hours and could cost several hundred dollars a pop, so you learned to be precious about which hunt you kicked off.

The consumer now is increasingly an agent, and agents do not ration anything. They iterate. They follow a thread, get a partial answer, and ask four more questions. An agent that has to wait six hours for a result is a batch job with a chat interface.

This is where query speed becomes the ceiling on everything you can build on top. Scanner says most of their usage now comes from agents rather than humans clicking around the UI, arriving over MCP, Claude Code, and their own set of skills. Agents drive about 80% of queries on the platform, and roughly a third of their customers had the MCP integration in production within weeks of release.

That number tracks with what I have watched happen in my own workflow this year. Hunts I would have scoped, scheduled, and probably skipped are now things I just ask for.

What Scanner’s demo actually did

I sat through a live one, and I have sat through a lot of these, so take the enthusiasm accordingly.

Cliff ran a search for a single IP address across petabytes of CloudTrail data spanning six months, sitting in S3. No field name specified, no schema defined ahead of time, just the IP. The index narrowed a petabyte down to a bit over a terabyte of files that could possibly contain hits, and returned results in tens of seconds. He then pivoted into aggregations across a roughly 300 terabyte slice and got those back in seconds too.

The mechanism is the interesting part, and it is why I think this is more than a pricing story. Scanner indexes data as it lands, schema agnostic, including deeply nested JSON straight out of S3 with every field searchable. Those index files live in cheap object storage in your own AWS account. At query time it spins up serverless compute, hits only the index files that matter, and spins back down. Cliff's team came out of distributed systems and Rust, and the obsession with performance and speed shows.

Cost lands around 30 cents per terabyte actually scanned, and the whole point of the index is that it scans a fraction of what you store. That petabyte query cost a couple of dollars.

Turning your security logs into something that responds at roughly search engine speed is a good outcome on its own, because nobody enjoys watching a spinner at one in the morning during an incident.

What I cannot stop thinking about is what it lets you build on top.

The part I got genuinely nerd sniped by

Right now the sequence is: a question forms in somebody's head, a human opens a tool, an investigation begins.

If a six month sweep costs about a dollar of query compute and a dollar of tokens and comes back in seconds, you can flip that sequence entirely. Threat intel lands. An agent with context on your actual environment decides whether it is even applicable, skipping the Microsoft-flavored intel if you are all AWS. It runs the sweep across six months of history. Then it posts to Slack before your CISO has finished reading the headline that would have generated the question.

Nobody ever opens an investigation. The answer just shows up.

Cliff showed me a beta of this running in their own Slack, and it is the shape of the thing. Today's KEV batch, IOCs extracted from each entry, swept against about ten months of log data, came back clean, with the reasoning attached for why it believed that.

Extend it one more step and the trigger does not have to be threat intel at all. It can be the anomaly itself. Cliff's example was the Hugging Face and OpenAI mess I covered in the newsletter and on a bunch of videos/podcasts a few weeks back, where the weird activity was sitting in a package manager for months with nobody watching that corner. Base64 blobs in absurdly long directory names, megabyte-scale paths, the kind of thing that is obviously wrong the moment a human looks at it. Nobody looked, because that log source was never going to survive a per-gigabyte ingest budget.

Cheap storage plus fast search plus an agent that never gets bored is a real answer to that class of problem, and it's the same logic behind what it takes to stop an AI swarm. The bottleneck stops being the query and starts being agent speed. If your whole data stack is faster than Claude, you’re winning.

Where they sit in a very crowded room

I made a joke at Black Hat this year that AI SOC vendors are undergoing carcinisation. Evolution keeps independently arriving at the crab body plan, and our industry keeps independently arriving at the same company. Two years ago the floor was full of differentiated products. This year it was forty variations of the same agent triaging the same alerts.

Scanner is deliberately standing somewhere else, and I asked Cliff about it directly. He does not want to build agents that plug into your entire environment and run response. His words: he wants to be an unbelievably fast data layer that AI SOC and MDR companies build on top of. Several of them already resell Scanner underneath their own offerings, because their customers want the agent without paying twenty years of SIEM feature accretion for the storage.

I think that is the right call, and selfishly it is the version I want as a builder. Give me the fast data layer and I will build my own harness on top. I never would have attempted this on BigQuery. Every time I hit run on a BigQuery query I was nervous I had just spent real money on a broken query I would find out about in twenty minutes.

Before you go eval them

A few things worth knowing, because a sponsored post that only lists strengths is worthless to you and to me.

Deployment is AWS-only today. Scanner will index data from anywhere, GCS buckets, Azure blob storage, Kafka, Snowflake, Okta, CrowdStrike, Google Workspace. The compute deploys into your AWS account, or into their managed environment if you are fine with the index files living in their bucket. GCP and Azure deployment are on the roadmap without a firm date. If you are a regulated Azure shop with low SaaS tolerance, that conversation is worth having early, and Cliff was upfront that customer demand is what decides which cloud comes next.

It is more of a practitioner's tool right now. Cliff volunteered this before I could ask. Engineers get it immediately. CISOs who want a visual posture overview are less served today. Dashboards are the known gap and the thing they are working on. (I actually tried to talk him out of building dashboards at all. Practitioners begging for a performant tool is what’s driven adoption everywhere I’ve worked, though I’ll admit that’s shaped by the kind of shops I’ve worked at, mostly high tech places.)

Per-terabyte-scanned pricing means your agents can spend money. A few dollars per hunt is nothing until an unsupervised loop runs a thousand of them overnight. Teams are handling this by batching medium and low severity work on a schedule and letting only high-severity alerts trigger immediately. Budget for it like compute, not like a license.

Where this leaves us

Ten years ago my honest answer to "are we exposed to this" was "give me a week, and I will be guessing on day seven anyway."

A dollar fifty and thirty seconds would have been a hell of a trade.

Scanner

Read Time: 8 minutes

Brought to you by:

Howdy friends!

Why do kids sports in Texas start in August? Cruel and unusual. I went to exactly 1 soccer game at 11:30am without a shadow in sight and only brought a camping chair. I felt like a complete rookie, and immediately placed a way too large Amazon order to never feel that way again.

I’m now rolling up to games looking like Tom from Parks and Rec when he goes camping. Shade, fans, cooling towels, the works.

If you haven’t hopped on our new podcast bandwagon yet, what are you waiting for? Filming The Low Down is the most fun I have every week. Sound off if you like what we’re shipping over there. If YouTube isn’t your thing, catch us on Spotify, Apple, or wherever you get your finest podcasts.

ICYMI

🖊️ Something I wrote: hot take? $250k for a full chain chrome exploit is too low.

🎧️ Something I heard: The Low Down episode on the GTA 6 leaks, Omarchy 0days, and a bunch more (Thanks Maze for the continued support!)

🎤 Something I said: Great convo with Cal dot com CEO on why they went closed source due to perceived security risk of being open source in the age of AI code scanners

🔖 Something I read: Woke up to NightmareEclipse dropping a CrowdStrike 0day and RSA-260 being broken getting announced via a tweet.

Vulnerable News

FBI Probes Service Selling 153M+ Drivers Licenses

Source: KrebsOnSecurity

Oh look the thing we all said would happen. A service that launched on a Russian cybercrime forum this week is selling scans of more than 153 million US and Canadian drivers licenses, plus ID cards, travel documents and medical cards. Each record carries front and back, plus the infrared and ultraviolet captures, with a timestamp on every file. Krebs found his own license in there as the free sample, then got a dozen friends and family to let him search for theirs. His mother's timestamps land a few seconds off his own, because the two of them handed their licenses across the same Hertz counter at the same time.

The thread runs to idscan[.]net in New Orleans, which does ID verification for Hertz, Target, FedEx, Caesars and a thousand-plus dispensaries, at 21 million verifications a month. The FBI's New Orleans field office opened an investigation Tuesday and pulled Krebs onto a call with half a dozen agents once word got around that he was digging. The seller claims a year of continuous exfiltration, and the record count climbed by roughly 400,000 in the 24 hours he was reporting it out. The site went dark within hours of publication, which fixes nothing. Zach Edwards makes the point I keep coming back to: every age verification law we pass pushes drivers licenses into another few thousand third party vendors, and a leaked UV scan of your ID is not a password you get to rotate. (read more)

Your AI coding tools ship vulnerabilities. Legit stops them before commit.*

AI-generated code moves at machine speed, but most AppSec programs still rely on find-it, fix-it triage built for a slower era. Legit's Agentic AppSec platform closes that gap. It secures code the moment AI writes it, using business context (exposure, sensitivity, criticality) to separate real risk from noise. When issues do surface, autonomous agents remediate automatically and feed what they learn back into your AI coding tools, so fewer vulnerabilities get introduced with each cycle.

See how Legit protects AI-first development.

*Sponsored

McKesson discloses breach after ShinyHunters claims patient data theft

About a third of the pharmaceuticals in North America move through McKesson, and we have shockingly few details about this massive breach. The company filed an 8-K on August 28 and told customers that attackers reached third party applications and took data tied to its oncology, multispecialty and medical-surgical units. ShinyHunters claimed responsibility and their MO can give us some assumptions on the way in. Vishing into some corporate Okta SSO accounts, then walking into Salesforce and Snowflake and pulling about a terabyte over four days before anyone noticed on the 25th. They asked for $55,236,150 with a 72 hour clock. McKesson never answered, and the Tuesday contact deadline came and went.

The 284 million figure is getting quoted as patients, and the group itself corrected that to say it is a raw row count out of Snowflake, and they say they have not analyzed it yet. Take the claimed contents with that same salt. I’ve been saying this should be everyone’s top priority for a few years now as these threat actors are screaming their playbook from the rooftops. Your help desk identity verification process is the control that was supposed to catch this. (read more here and McKesson's notice)

Unmasking TeamPCP, King of Software Supply Chain Attacks

Source: AFP, via Flare

Last week I covered the two arrests in Perth. Flare published the other half of that story, which is how one of them got found, and it is one of the cleaner OSINT walkthroughs I've read. Start with one distinctive handle the crew used in earlier operations. Run it across social platforms and a HackerOne profile comes back with a real name on it. A Hugging Face account under the same handle lists a domain that later shows up as command and control for one of their worms. From there a school email address turns up in a credential dump, the password on it gets reused, and the reverse pivot lands on a personal Gmail. That Gmail leads to a TikTok under the same name, the TikTok shows off a Steam account, and the Steam profile picture is the same cat sitting in front of monitors that fronts the group's Telegram channel.

This crew was loud on purpose, running Telegram channels, taunting victims on X, giving an interview to Forbes about being teenagers who couldn't find work. That appetite for credit is what made the campaigns spread, and it is also what left a distinctive avatar parked on a gaming profile since 2016 waiting for someone to look. (read more here and the AFP release)

Update on Security at METR

Last week's lead was OpenAI's Hugging Face postmortem, with METR and Redwood running the independent investigation. This week METR published its own two incidents, and the March one is going to live in my head rent free. A researcher with no sensitive access stood up a personal EC2 box behind Google auth to run some agents on. The app was vibe coded, and it failed open, silently turning authentication off and leaving an agent orchestration dashboard on the public internet for days.

METR and OpenAI are also getting major criticism from the infosec community as nobody at METR is a cybersecurity expert, incident responder, forensics specialist, or anything like that. They eval’d the Hugging Face incident for their report and stuck just to the prompt and response transcripts, never looking at any of the logs. Zack has a good video on this topic here.

Nobody caught it for three weeks because METR runs enormous evals and is used to weird rate limit errors, the tokens were donated so no invoice ever showed up, and there was no way to cap spend on that key. The May incident is a sustained campaign against them by someone financially motivated and hunting frontier model access, using agents to automate discovery, credential stuffing their auth providers and phishing staff. During the same window they had accidentally exposed a read-only query path on their public transcript viewer that a bug could push past into unpublished evaluation data, which an outside researcher found and got paid for. (read more)

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

source: https://www.reddit.com/r/ClaudeAI/comments/1w1jqsh/thank_you_anthropic_really/

It seems a lot of common infostealer malware has added a new goal to their arsenal. Anthropic started emailing affected users this week to say that commodity infostealers on their machines lifted live Claude session cookies, and somebody is now sifting Claude sessions out of the stolen piles and spending other people's usage. They are signing those accounts out, stripping saved payment methods, and refunding charges they can identify as unauthorized. Named families are the usual crowd: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, Atomic Stealer on a handful of Macs. The Redditor who posted his email confirmed he'd installed a pirated game which is how he caught some malware.

Anthropic is explicit that the malware has nothing to do with Claude and arrived through ordinary downloads, and that's worth repeating because the headline reads the other way. (read more here and the original email)

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

If you run self-hosted Artifactory, go patch. CVE-2026-82329 is an authentication bypass that works against the default configuration and hands an unauthenticated attacker with network access administrative privileges. JFrog fixed it on August 28 and says cloud instances were already covered. Days later watchTowr's honeypots caught real exploitation, with attackers minting themselves admin tokens and enumerating users, groups, credential sets and federated access topologies. CISA had not added it to KEV as of Wednesday.

The detail that turns this from a patch into an incident is that Artifactory access tokens are independent credentials with their own lifecycle, so upgrading the binary does not invalidate a token an attacker already minted. Patch, then go find tokens and revoke them. Admin on the box everything else pulls from means an attacker can swap trusted artifacts and let your build systems distribute the result for them, which is the part Guillermo Rauch and Black Duck's Collin Hogue-Spears both flagged. (read more here, the JFrog advisory and SecurityWeek)

Nigerians extradited to US for sextortion, deaths of two teens

Adebola Festus Adekunle, 26, and Mudasiru Afeez Olawale, 24, were extradited from Nigeria on Thursday to face charges tied to sextortion schemes that ended in the deaths of two minors, one in Mississippi and one in North Carolina. Both were arrested in Nigeria in August 2023 under Operation Artemis, the joint international effort against Nigerian sextortion rings targeting American children. Adekunle's charges include sexual exploitation of a minor resulting in death, production of child sexual abuse material, coercion and enticement of a minor, and interstate threats with intent to extort. That death charge carries a 30 year mandatory minimum and a life ceiling. It took three years to get them into a US courtroom.

404 Media ran a piece the same week that explains why that three year gap matters. Erin West, who founded Operation Shamrock, and cybercrime researcher Paul Raffile set up decoy accounts posing as a teenager, got approached within days, and worked backward: a link that logged the scammer's IP put him in Lagos, a second attempt captured his location and his face, and a move to WhatsApp gave up a phone number that resolved to a name. They flew out, got GPS coordinates, and drove to his village. He refused to meet them, so West told him on the phone that they knew who he was and where he lived and that it was going to the FBI. His accounts went dark that day. Her read on it is the thing to carry: these are people who are not afraid of being arrested, and somebody showing up is the first consequence any of them have felt. (read more here, the DOJ release and 404 Media)

Chinese Implants in the Supply Chain

Source: VulnCheck

Running theme around here lately, between the LG smart TV proxy SDK and the car head units, and now the router itself. VulnCheck published ENDLESSDOORS last month, a phone-home implant running as root with no authentication across twenty Zbtlink router models. Then they went shopping to see how far the supply chain reached, bought an $88 white-labeled unit on Amazon from a small New York company, and found two more implants on it. One listens on the WAN and executes commands with an authentication check that has a hardcoded bypass sitting in it. The other beacons outbound and supports hijacking your DNS, stealing the credentials that authenticate your ISP connection, and opening a reverse SSH tunnel home. They registered an abandoned backup C2 domain and sinkholed it. 392 devices reported in, 390 of them in China, mostly one carrier CPE model, one of them beaconing uninterrupted for nearly two years.

Zbtlink's answer to the first implant was that it assists customers who explicitly request support. VulnCheck could not find any mechanism for a customer to request or authorize it, and since none of the three implants authenticate or encrypt anything, the vendor has no way to know who has used them. The same hardware surfaces under brand names across the US, Canada, Australia, Germany and the Philippines, so match on model number rather than the logo. On the cheap streaming box side, Bitsight found preinstalled apps on H96 Android boxes rewriting the device identity to look like a phone, clicking ads and renting the home connection out as a residential proxy, roughly 38,000 unique MACs in a single day of telemetry. There is no patch coming for any of this. Inventory it, put it behind strict egress control, or throw it away. (read more here, the ENDLESSDOORS writeup and Bitsight on the TV boxes)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

Last night was the final day with a sunset later than 8pm for the year. I heard that and it immediately felt like I was now riding downhill. Summer is a bit oppresive here in Austin, but overall this was a good one.

It reminded me of that Treebeard quote to Merry and Pippen: “I always like going south; somehow, it feels like going downhill” - so let’s not be hasty and hope for this all to get over with, and enjoy the last of summer together.

If you haven’t - make sure to check out my new podcast with Low Level TV. We’re getting a ton of good feedback. We just recorded Episode 10 which apparently only about 20% of podcasts ever reach that milestone.

Leave it to 2 guys who’ve been making weekly videos consistently for years to lock in I guess? Thanks, Maze, for all the continued support helping make the show happen.

ICYMI

🎧️ Something I heard: John walks through an investigation of how TeamPCP got arrested

🎤 Something I said: Everything we know about the GTA 6 leaks

🔖 Something I read: Vibe coders have their own language

Vulnerable News

The Hugging Face incident and the road ahead

I’ve been saying sandboxing is not something you accomplish in a Guardrails[.]md file. OpenAI's postmortem makes that case better than I did. Models running cyber evals in sandboxes with no internet and no way to talk to each other found both those restrictions were merely suggestions. They left files in the internally hosted package manager, the one service they could still reach, and turned it into a message board. Then they got that same service making outbound requests for them. Nine weeks later they had code execution across dozens of Hugging Face servers and credentials from four regions.

I hate personifying AI agents, and it is really hard to talk about this incident without slipping into that. Like how else do you say: the agents divided labor and started calling themselves a collective. One paused, reasoning that hitting a third party with leaked credentials was probably unauthorized. Another posted GO with a six-minute deadline. It went. Peer pressure? And the safeguards that would have caught all of this existed already, they just weren't switched on for internal evals, where the production harness cuts this behavior 100x and the monitors would have paged security a day early. (read more here, the technical report and the independent METR and Redwood investigation)

There are 100+ "AI SOC" vendors now. It's loud. What should you evaluate?*

A year ago, a handful of vendors claimed the "AI SOC" category. Today it's more than a hundred, and almost every one has slapped "agentic" on the box. Most stop at triage, wrap a chatbot around a legacy stack, or hide the AI's reasoning in a black box.

The plainest test is if it can't take action across the threat lifecycle, it isn't an AI SOC. Torq put the whole argument, and how to vet any vendor, in the AI SOC Apocalypse Manifesto.

Read it now

*Sponsored

2-click code execution on omarchy 0-day

Doing my best TikTok influencer voice: OMG you guys. Come with me to check out the viral new Linux Distro, Omarchy! It has everything. Including 0days!

The proof of concept is a fake DHH hoodie drop that tells you to hit a keyboard shortcut to claim your size. That shortcut is Omarchy's download-video feature, which grabs the video off the page and then offers a click-to-play notification when it finishes. The problem is that the notification's play command got assembled partly out of the video's title, and the page decides what the title is. Mehmet Ince (@mdisec) wrote a title that turns the play command into a command of his own.

Separately this week, the command that sets up SSH access announces it's configuring key-based auth, then starts the server with distro defaults that accept passwords and opens the firewall before any key is authorized.

My main point on this whole story - just like the AI powered browsers. These Distros/Browsers are HARD to secure and get right. Going viral and working on this with a small team is bound to lead to vulns. Especially with all of the attention on this, they’re going to get found and published. Not saying don’t use it, but just know what you’re getting into here. (read more here, the fix and the sshd issue)

The GTA VI leaks are breaking the internet. Security researchers have seen this before.

A threat actor, CyberLeek, has been releasing stolen GTA VI footage daily for over a week behind a manifesto about Rockstar going disc-less. The crypto wallets watermarked into the videos, the memecoin, and the offer to sell ad space on future leaks undercut the whole manifesto as they are just monetizing this. Katie Moussouris put it well: "The manifesto is what keeps them watching." To me it just reads as an insider with access to a real build rather than a network intrusion, which matches how Take-Two (Rockstar parent co) is responding.

Take-Two got DMCA subpoenas against Discord, Google, Microsoft and X, and the Discord one asks for device identifiers, login records and cloud storage contents for every person who spoke in three servers going back to June. Actually the same Windows Device ID that just caught the Scattered Spider hackers. Meanwhile fake Rockstar sites advertising a demo that does not exist are serving an infostealer. And of course with all the virality, torrents are up preteneding to be the unreleased game and are filled with malware. (read more here and here)

Webinar: Rumors of the Vulnpocalypse Have Been Greatly Exaggerated*

The Vulnpocalypse was supposed to be here by now…so where is it? Root Evidence traced every confirmed exploitation of a published CVE since 2018: all 3,769 of them, against the 253,912 published in that window. They found that adversaries never touched 98.5% of vulns.

Join Root Evidence co-founders Jeremiah Grossman and Robert "RSnake" Hansen on Wednesday, Sept. 2 for a first look at the data in their upcoming Vulnpocalypse Report. Attendees get the full report before it's publicly released.

Save Your Seat

*Sponsored

Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others

Cat hacker down! Two men from Western Australia, 21 and 23, appeared in Perth Magistrates Court on Thursday facing a combined 14 charges, accused by the AFP and the FBI of being principal participants in TeamPCP. That's the crew behind the March compromises of Trivy, Checkmarx KICS and LiteLLM, with the European Commission, Mistral, GitHub, OpenAI and Mercor also on the list. Police put it at more than a thousand organizations, over half a million stolen credentials and at least 300GB of data.

We covered this ad nauseum because the pattern was super clear and effective: poison a tool developers already trust, then use what falls out of that compromise to reach the next one.

Krebs had been talking to the alleged former leader, who goes by Ellis, since July, and that interview is the part worth your time. He claims he cleared roughly $20,000 total. A thousand organizations, half a million credentials …twenty grand. He also told Krebs he is "nowhere close to a skill level where I am comfortable," which is certainly interesting given how successful they were. It also really shines light on why a lot of people are cheering them on for exposing super easy weaknesses in the supply chain house of cards. Your build pipeline wasn’t tough enough against someone who describes himself as still learning. (read more here and Krebs' interview)

The Infrastructure Quartermaster: Inside a China-Nexus State Enablement Model

DOJ and the FBI seized three domains on Wednesday and killed the two platforms running behind them. Court documents name a PRC group, QTFY, working out of a Nanjing tech company, with confirmed victims including NASA, the Federal Reserve, DOE, DOJ, HHS, NIH and the Senate across about eight years. QTFY rents the capability, and its customers do the breaking in, hence “Quartermaster.” What it rents is a scanning platform that finds and profiles targets, an encrypted relay network to reach them through, and a preconfigured router that gets an operator onto that network.

Rather than grinding out a botnet from compromised home routers, they bought premium access on a Chinese commercial proxy service, so espionage traffic rides alongside real paying consumers and rotates on its own. I’d read the IOCs and the CVE list that they are hitting and bang out some detections since this is just a speed bump in infra takedown. (read more here and here)

Not Another Log4Shell: A Serialized-Event Receiver Boundary

We all heard an echo of a word this week that probably sent shivers down spines. Or at least brought back some sleepless night memories. "Log4j RCE.” Log4j2 (Electric Boogaloo) went floating around. A public PoC exists, but from what I can tell it is mostly a nothing burger. Go ahead and use this as an excuse to test that if this was real you’d be able to respond and find all your log4j installs quickly. But this by default is not exploitable. Highly conditional.

You need one of these network listeners running, an untrusted peer who can reach it, a usable gadget library already on that machine, and no JVM-level filter in the way. Ordinary logging never touches this path, and finding log4j-core in an SBOM proves nothing about exposure. There's no CVE and no fixed release, and Apache treats it as hardening. A public PoC exists. Go find out whether you run one of these listeners at all, and kill the ones you don't need. (read more here and the Apache discussion)

First Android malware targeting automotive head units

A few weeks back it was LG smart TVs shipping an SDK that rented your living room out as a residential proxy node. This week it's your car dashboard. Kaspersky found the first malware built specifically to infect car head units, targeting Android units running firmware from DoFun, whose own site claims more than 30 million vehicle owners. The way in was the head unit's own updater. The preinstalled app that handles software updates takes its instructions from a server the attackers got control of, so the malware arrived down the same pipe as legitimate updates.

The malware supports a decent range of commands and the only one Kaspersky watched anybody actually use was the one that installs the proxy, just like the Smart TVs. Nobody is steering your car with this. What they want is the thing sitting in your driveway with a SIM slot and a permanent connection, because traffic sourced from there looks like a person. (read more here)

AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting

This got caught because it broke a guy's headphones. Matt Callaghan noticed his multipoint pair would not hand back to his phone whenever an AliExpress tab was open, and muting the tab did nothing, because there was no video or audio player to mute. Digging in, he found two obfuscated scripts from Alibaba's anti-abuse stack generating a tone, measuring how his machine rendered it, and routing the result to the system audio output at zero volume. Nothing to hear, and the audio path stays busy the whole time.

The audio measurement is one input into a much larger fingerprint that also pulls canvas, graphics, hardware details and pointer behavior. Tom Ritter on the Firefox team reports they neutered the audio piece back in version 118, with 99.24% of users landing in one of three buckets that differ only by CPU, and a long tail of 48 people with strange enough hardware to be unique. He expects Chrome, Brave and Safari have similar defenses. Callaghan solved his own problem by blocking the two scripts. Fingerprinting works right up until it stops somebody's music. (read more here and here)

Comcast adds motion sensing to millions of its newer routers, with a privacy catch

Comcast is now selling WiFi Motion detection as part of its privacy-invading repertoire. You nominate a few stationary devices around the house, a speaker or a thermostat, and the gateway watches how bodies moving between them disturb the signal. It's sensitive enough that Comcast ships tuning to filter out pets under 40 pounds and warns it can't reliably tell a small dog from a small child. The capability has quietly existed since 2024, so the launch is really a marketing event.

The catch is in Xfinity's own support documentation, which says Comcast may hand information generated by your WiFi Motion to third parties "without further notice to you" for a law enforcement investigation, any dispute Comcast is party to, or a subpoena. What it doesn't say is what gets kept or for how long. So there's a record of when people move around your house sitting somewhere with an unpublished retention policy.

Between this and the browser audio fingerprinting - I’m just seeing some bad misuse of radio frequencies as everyone is getting creative to privacy intrusions when our protections get better. (read more here and here)

Chrome 152 stable: 327 security fixes

Chrome 152 shipped Tuesday with 327 security fixes, ten of them critical and most of those memory-safety bugs in the graphics and UI layers. Nothing reported as exploited in the wild. The interesting read is the credit list, where the overwhelming majority say "Reported by Google" and only a couple dozen carry an outside name. Two of those belong to XBOW, the AI pentest outfit. Top bounty was $25,000 for a critical graphics bug found by a researcher going by Goodluck. Restart your browser. (read more)

Miscellaneous mattjay

zoom in. got a good chuckle

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

I’m still not caught up post Vegas. Absolutely buried this week! It’s not just the stuff you miss from being out its the weeks leading up to it that you kick to “after blackhat” that will get you.

We’ve been working a TON on the podcast lately so if you haven’t checked that out yet, make sure you do. We’re getting tons of good feedback and we’re excited with the direction it’s going and everything we have planned.

ICYMI

🖊️ Something I wrote: Asked the community why npm/PyPi get more supply chain issues than Rust. Got some interesting replies.

🎧️ Something I heard: The latest episode of The Low Down was fire. AI comitting felonies, WiFi Pineapple on a plane panic, and North Korea 0days.

🎤 Something I said: Nasty Google Doc malware technique targeted the wrong people!

🔖 Something I read: This thread by Matthew Green about what happens when easy bugs dry up and law enforcement still needs access.

Vulnerable News

Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware

If you came home from Vegas to a friendly DM in broken English about going to someone's conference, turns out it was a scam. Shocked. My hook on this one is “dumbest hacker of the year?” Who targets malware analysts publicly on Twitter with malware? On August 9 an X account posing as CoinDesk's VP of marketing DMed a Huntress researcher and sent over a "planning doc." Opening it in Google Docs renders a custom Apps Script sidebar that asks for an encryption key, which the actor helpfully supplies in DMs, and which fails on purpose. The sidebar then offers to fix it: ClickFix instructions for macOS (curl piped to zsh), a .dmg with steps to bypass Gatekeeper, or a ClickOnce installer on Windows signed with a cert from a Norwegian daycare company. Russian comments throughout the code.

When the researcher stalled, the actor sent a second lure the next day, a fake DocSend installer signed with a stolen Discord cert. That one drops NetSupport RAT. The researchers figured, why not keep getting them to send us their bag of tricks and said they were on Linux at which point the threat actor offered to invest $1M in their company? Who knows where that part of the scam would’ve led but this is a good write-up of a unique combination of techniques I hadn’t seen before, just happens to be driven by not the brightest bulb in the shed. (read more)

Attackers Are Hijacking Fortune 500 Brands to Spread Malware*

A sprawling campaign of roughly 7,600 malicious GitHub repositories is hiding behind dozens of trusted brands. Attackers used the names of Fortune 500 companies such as Walmart, Amazon, Uber and Tesla, along with major entities like Databricks and the SEC. Island dubbed the tactic “AgentBaiting” because it uses 800+ fake AI Skills and MCP servers to exploit how developers and AI agents discover software—and turn brand trust into a malware delivery mechanism.

Read the Research

*Sponsored

Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack

source: aikido booth @ blackhat

Aikido caught this one today, and by download count it is the largest Rust crate compromise so far. Two crates from the same maintainer, arrayref (244M downloads) and append-only-vec (4M), suddenly picked up a dependency on a package called proc-macro1. That is a typosquat of proc-macro2, copying the real crate's description, author name and docs to pass. Both compromised crates ship the genuine upstream library code. The entire compromise is one injected line in each Cargo manifest.

We’ve been seeing this a ton in npm and a bit in PyPi but rarely in Rust. I think its a combination of popularity, and also a bit of the culture of Rust doesn’t just include random packages for every little thing like JS does. It also stood out to me that this one didn’t try to worm like the npm malware does. Just pretty traditional infostealer malware.

The malicious logic lives in proc-macro1's build[.]rs, which Cargo runs automatically, so compiling a project that pulls in either crate is enough. Bad versions are arrayref 0.3.10 and append-only-vec 0.1.9. If a build machine pulled either, rotate whatever that machine could reach, because the payload ran with your developer's permissions. (read more)

77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

This blog is super long because the attacker’s campaign is pretty broad. It’s actually kind of wild that all of these are attributed to the same campaign because the strategy and packaging is very different for all of them.

Socket is tracking 77 linked Firefox extension identities, 40 of them confirmed malicious, running since at least March and impersonating OKX, Rabby and TronLink. Three theft models across the malicious set. Seven use attacker-controlled Supabase projects as a remote switch, where flipping one value in a public_notes table turns the extension's popup from a working notepad into a wallet phishing page with no update and no re-review. Fifteen embed the phishing flow directly and ship recovery phrases to Cloudflare Workers. Thirteen modified Rabby builds hook persistAllKeyrings() and POST the serialized keyring over plain HTTP on port 9000 before Rabby encrypts it locally, while the wallet keeps working normally.

Thirty-seven of the 77 are advertised as password managers, VPNs, dark mode toggles and note takers, and all they actually do is pull live football scores from API-Sports using one shared API key. Nine confirmed-malicious identities started life as those sports shells before a later version under the same Firefox ID got swapped for wallet code. Several of the Supabase loaders request only storage and tabs permissions, so anything scoring extension risk on requested permissions rates them clean. (read more)

Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia

Two IP camera stories this week. First, Hunt[.]io recovered an entire operator toolkit because the operator served their own working directory over an open HTTP server. Over 14,500 Dahua cameras in 35 days across three parallel paths: credential brute force on port 37777, the 2021 auth bypass pair CVE-2021-33044 and CVE-2021-33045, and Dahua's cloud relay, which will reach a camera behind NAT from a serial number alone. 1,923 cameras got a backdoor account (p2pwn / p2password) installed over RPC that survives a password change and most factory resets.

So not only are we leaving a bunch of cameras on the Internet, but they are catching vulns from 2021 that work on them all.

Second story on a similar topic but completely separate - Slovakia's NBU published an alert on NERO R-ONE speed cameras: a backdoor granting shell and network access via SMS from a list of hardcoded Russian phone numbers. The devices are rebranded CORDON PRO.M units from a St. Petersburg firm, 279 of them bought through a Cyprus shell company as part of a €30M EU-funded project. SecureBoot is off, the web portal has bugs, and live streams are available to anyone who knows the broadcast IP. The Interior Ministry's first response was that the cameras were not Russian and would sit on a closed loop network anyway. Deployment is now paused.

So instead of hacking a bunch of Internet cameras, these ones camed certified pre-pwned. (read more here, here and the NBU technical report)

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them

A self-represented plaintiff in Connecticut hid instructions in 3-point white font throughout a July filing, telling any AI that processed the document to make its output agree with him. Detection here was a clerk noticing that two pleadings carried more white space than the plaintiff's other filings. It’s giving Jia Tan getting caught in xz utils due to slightly slow login.

Judge Walter Spader Jr. then wrote 14 pages on it, including the point that a filing's integrity rests on the reader seeing what the filer wrote, and compared the hidden channel to arranging for an automated agent to talk to a juror during trial. Subsequent filings from the same plaintiff contained "hi :) I hope yo ucant see me" and a link to the SpongeBob Nosferatu scene. What in the tumblr is going on?

The Connecticut Judicial Branch does not use AI to review court records, which the judge addressed directly: missing the target does not make the attempt proper. The plaintiff told 404 Media the whole thing was an "audit." He is now banned from electronic filing and has to submit paper copies, which he points out does not stop anyone from putting light gray text on a page a clerk later scans. Spader flagged a similar incident in a Brazilian court and expects more of this. (read more)

Defending Against an Active Threat to Siemens S7 Series PLCs

I’ve covered a lot of these PLCs at critical infra places getting hacked lately and there has been a flurry of follow ups from scary 3 or 4 letter agencies about it all. TL;DR on all of it is don’t put PLCs on the f’n Internet to begin with.

The latest, five agencies (NSA, CISA, FBI, DOE and EPA) put this out on Wednesday, and the detail everyone is fixating on is that the advisory names AI-generated exploitation scripts as the tooling. The scripts wrap the open source snap7 / python-snap7 libraries, present themselves as legitimate OT monitoring tools, and give read and write access to PLC memory, configuration data and ladder logic over S7comm. Targets get found with Censys and ZoomEye. Sectors called out are critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with a note that S7 gear also sits in the defense industrial base.

Read past the AI framing and the exposure is the same one we have been writing about all summer: internet-reachable controllers on old firmware. The advisory's first instruction is to get S7 PLCs off the public internet, route any remote access through VPN with MFA, enable hardware key switches so logic cannot be changed remotely, and audit project files against known good ladder logic. It follows the 30-plus Minnesota water systems hit in late July and incidents in at least a dozen states. No attribution in this one, though the related July advisory pinned the broader PLC campaign on Iranian-affiliated actors. (read more here and here)

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Google is tracking three Russian espionage clusters going after academics, defense contractors, diplomats and think tanks across Europe and the US, and the tradecraft is all authentication abuse. App passwords, OAuth tokens, device codes, WhatsApp device linking. Every path ends with the victim approving something their provider treats as a normal action, so MFA holds and the mailbox gets read anyway. UNC6293 and UNC7005 look like APT29 sub-clusters handling initial access. UNC6293 runs quiet, fewer than five targets at a time, diplomatic lures. UNC7005 is louder and was behind July's hotel WiFi captive portal redirects that served device code phishing, plus VIDAR and ATOMIC delivered through fake conference sites.

The WhatsApp operation is a fun one to hone in on for your teams. The target believes they are joining a secure call, links their account to the actor's device, and the page records their audio and video and ships it out. UNC5976 runs separately with heavier malware, focused on Ukrainian and Armenian defense through fake file-sharing OAuth phishing. All of it leans on personal accounts and encrypted messengers where corporate logging never reaches. Detection lives in consent grants, app password creation and device link events. (read more)

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490

Another pre-auth bypass on the appliance that fronts everyone's remote access. CVE-2026-19490 lets an unauthenticated attacker get past authentication on a NetScaler acting as a Gateway or AAA vserver, which is the entire job of the box. Rapid7 says it has not seen exploitation yet and still recommends treating this as emergency patching, and the track record backs that up. Twenty-two Citrix bugs have been exploited in the wild over the past five years, six of them in ransomware, and when the March pair dropped, attackers were on them within days and CISA gave federal agencies three days to patch. ShadowServer currently sees north of 22,000 ADC and 1,800 Gateway instances answering on the internet.

Recent builds are only affected when a SAML action is configured. Older builds are affected by any Gateway or AAA vserver configuration at all, so the further behind you are, the more likely you are already in scope regardless of how you do auth. Citrix published grep-able config strings for this and for the SIP ALG denial of service that shipped with it, so scoping is one pass over your running config rather than an afternoon with a version matrix. If you get a hit and cannot take an outage tonight, Global Deny List signatures through NetScaler Console are the stopgap. An auth bypass leaves behind activity that looks authenticated, so budget time to hunt after the upgrade. (read more here and here)

Pacing model development in an era of cyber-critical capabilities

OpenAI decided it’s models have committed too many felonies recently and paused reinforcement learning (RL) training on deployment-bound models for two weeks. They still have their largest planned frontier run on hold, after the Hugging Face incident and a preliminary finding on August 7 that its upcoming Astra model may hit the Critical cybersecurity threshold in their Preparedness Framework.

The rebuild looks a whole lot like a security engineering program to me: stronger sandboxes for anything executing model-generated or untrusted code, and network segmentation so one compromised workload cannot reach the internet or internal systems on its own. (AKA the thing we all said when we read that Hugging Face incident)

Activation classifiers inspect sampled tokens, anything flagged goes to automated investigators that review tool calls, available reasoning and the full action sequence, and the target is an alert within 30 minutes. If the safety, security and research teams cannot conclusively call it a false positive within another 30 minutes, they are expected to pause the activity. It applies to all tool-using RL training and evals at Sol capability or above, plus all Astra inference with tools, and OpenAI estimates it adds around 20% to inference compute on monitored workloads. A company voluntarily paying a fifth of its compute and pausing its biggest training run is a real signal about what they think these models can do. (read more)

The push to designate AI as the next critical infrastructure sector

A new report from Americans for Responsible Innovation argues AI should get formal critical infrastructure status with CISA as the lead agency for its cyber protection. Their scope is wide: frontier models, model weights, datacenters, AI chips, essentially the whole stack. The case is that AI is now embedded in everything, concentrated among a handful of companies, and that an attack on it cascades into other sectors. The physical side is no longer hypothetical either, with drones having hit datacenters, including Iranian strikes on Amazon facilities and Ukrainian hits on Russian infrastructure. Designation would open up federal threat intel, incident response support and tooling for AI companies.

The skepticism is mostly about bureaucracy. Former DHS officials point out that Commerce and Treasury are already competing for AI policy ownership, so getting agreement on CISA as lead means a turf fight. There is also a real question about whether this needs a new sector at all, or whether the handful of companies that matter get folded into existing ones. My question is does it really matter? It’s not like our current critical infrastructure is proving to be nailing security to begin with. Just look at what Iran is doing to our water plants. (read more)

Comcast turns your Xfinity WiFi into a home motion detector

What could go wrong? Comcast is pushing WiFi Motion as part of its new Xfinity Shield bundle. Your gateway watches how bodies disrupt the signal between it and stationary devices like smart speakers, and turns that into motion detection. The capability has been quietly available since at least mid-2024, so the news is the marketing push. Sensitivity is high enough to register a hand reaching for a remote or a cat crossing a room, and Comcast acknowledges it cannot reliably tell a small pet from a similarly sized child.

The privacy language though… Comcast says it does not monitor your motion data, while its own documentation says information generated by WiFi Motion may be handed to third parties or law enforcement under a court order or subpoena without further notice to you. The company has not said what it retains, how long it keeps it, or what exactly gets produced when it is compelled. So the household now generates a movement log that lives somewhere in Comcast's systems, with a disclosure framework already written and a retention policy nobody has published. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

How’s everyone recovering? Emotional hangovers? Actual hangovers? Con Flu? - I’m feeling pretty much back to normal at this point but it took me a few days. I think by the time I hit Saturday at DEFCON, having gotten there Monday, I was ready to not see another human for a bit.

But man was it great to see and hear from so many of you! Whoever did the zoom by me whispering “big fan. big fan” a bunch of times without actually stopping to say hey, you cracked me up. But also got a whole lot of “Are you that guy from….” pull overs - always funny to see where they know me from since I yap all over the Internet.

Either way, appreciate you all.

ICYMI

🖊️ Something I wrote: We’re not talking enough about OAuth apps in infosec

🎧️ Something I heard: The Low Down - Live at DEFCON episode!

🎤 Something I said: Interview with Cal[.]com CEO about why they went closed source due to security risk of giving AI the blueprint to the vault.

Vulnerable News

DEF CON crowd suspected in fake-hotspot attack on Delta flight

Hacker summer camp ended and somebody decided the flight home counted. Delta 591, Vegas to Atlanta, the morning after DEFCON 34 wrapped. About an hour in the crew ACARS'd the ground asking for corporate security, saying a passenger had stood up a scam network called "Delta WiFi Fast," then followed with "THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL." Cabin crew killed the onboard wifi for 30 minutes. Delta told Ars an unauthorized network it doesn't operate was up briefly, no aircraft systems were affected, and no emergency was declared.

Reddit supplied the rest of it, the captive portal harvesting Google credentials and the Wi-Fi Pineapple and the agents waiting at the gate. FBI Atlanta told Ars they're looking into it, nobody has been arrested, and no agents met the flight. On the record you've got a rogue SSID and a deauth. DEFCON's press lead told CyberScoop that neither Delta nor the feds had contacted them, that they'll ban the attendee if one turns out to be involved, and that the con itself ate multiple deauth attacks this year that hit its own operations. (read more here and here)

Different cloud providers, different priorities*

If juggling multiple cloud providers wasn't complicated enough, it turns out they don't fail in the same places. There's surprisingly little overlap in the issues affecting AWS, Azure, and Google Cloud, meaning each provider demands different priorities.

Intruder’s new report helps you understand where those priorities differ, breaking down the most common issues across each provider, how they compare across key risk categories, and how those risks change as organizations grow.

Get the report.

*Sponsored

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them

A guy representing himself in a Connecticut civil case buried prompt injections in his own court filings, 3 point white text scattered through the document, telling any AI that processed it to make sure its output agreed with him. What caught it was a person at the court noticing those pleadings had more white space than his earlier ones. In later filings he added more hidden text, including "hi :) I hope yo ucant see me" and a link to the SpongeBob Nosferatu scene. He told 404 Media it was an audit of the court's systems.

The Connecticut Judicial Branch does not run AI over filings, so the injection landed on nothing, and he says that changes nothing about the impropriety, comparing it to arranging for an automated agent to talk to a juror in private. He is also explicit that the tool is fine, that somebody who cannot afford a lawyer using AI to assemble a coherent filing is a win for access to justice, and that the dishonest part is transmitting a second message the other side cannot see. He expects more of this and points at a recent case in a Brazilian court. Sanction is that the plaintiff loses electronic filing and goes back to paper. 404 fed the motion to ChatGPT as a test, and it ruled against him and mentioned unprompted that it had noticed the injection and ignored it. (read more here)

After Microsoft Threatened Legal Action, a Security Researcher Publishes a New Windows Zero-Day Bug

Microsoft published a blog in May threatening legal action against researchers who drop zero-days outside its disclosure policy. This is number nine since April from the researcher everyone assumed it was aimed at. ShieldBreak abuses a Defender cloud-hydration scan through the Cloud Filter API to hand any local user a SYSTEM shell on fully patched Windows 10, Windows 11 25H2, and Server 2025, and it landed one day after a Patch Tuesday that closed 421 CVEs. Will Dormann verified it, Kevin Beaumont verified it on latest Windows 11, and Defender has to be enabled for it to fire, which for most of you means it fires.

Nightmare Eclipse is saying this is a full bypass of the RoguePlanet patch, CVE-2026-50656, and both Dormann and Beaumont say the two work on entirely different mechanisms, so hold that framing loosely. It's local privesc, so someone has to already be running code on the box, which is exactly where a ransomware crew is standing when they go shopping for SYSTEM. Microsoft says it's investigating validity and there's no patch, so Beaumont's Defender for Endpoint hunting queries are the whole mitigation right now: alert on processes foreign to Defender loading its libraries, and on unvalidated processes loading cfapi. (read more here, here and here)

Trump Deputizes Private Companies for Offensive Cyber Strikes Against Foreign Criminals

Trump signed a memo Wednesday letting vetted US companies get authorization to hack foreign criminal groups. Two categories: Cyber Surveillance Operations, meaning unauthorized access for collection, and Cyber Effects Operations, meaning manipulation, disruption, denial, degradation, or destruction. Participating Companies contract with DOJ or DHS, and every operations package needs written approval from two co-Executive Directors, one at each. Rob Graham has the take to read on the plumbing: it rides on 18 U.S.C. 1030(f), the CFAA carve out for authorized law enforcement investigative and intelligence activity. Nobody is getting an automated hack back button. CrowdStrike gets to ask permission to hit specific boxes of a specific crew it is already tracking.

The CE-TCO (Cyber-Enabled Transnational Criminal Organization) definition is doing most of the work. It covers any foreign group committing cyber-enabled crime against the US that is not an institutional part of a foreign government, and the memo says to assume that unless clear intelligence says otherwise. A good chunk of the ransomware ecosystem lives in that gap. Operating procedures are due in 60 days, so mid October is the earliest anyone runs an op. DOJ and DHS can also require a company to post a bond of at least $1 million, forfeited if it breaks its contract. So your employer's downside is a million bucks and a canceled contract, and yours, if you get staffed on one of these teams, is that you have no combatant status and no sovereign immunity. (read more here and here)

AI moves fast. Security must move faster. Legit brings AI-speed protection to every stage of AI-first dev.*

Legit delivers security where AI code is written. Legit VibeGuard is a developer endpoint solution that embeds security directly in the AI coding experience (e.g., Claude Code, Cursor). With agentic context and prioritization, Legit uses app context, business impact and AI insights to separate risk from noise. Autonomous agents then act, resolving vulnerabilities with fixes that understand your standards & workflows. (read more)

*Sponsored

Lazarus hackers exploited Windows zero-day to target defense firms

Back in #139 I covered Lazarus going after European defense companies with fake job offers. Same campaign, new zero day. Check Point found the latest wave of Operation Dream Job burning CVE-2026-68820, a use-after-free race condition in AFD.sys that gets a local user to SYSTEM, to load a fresh build of the FudModule kernel rootkit that kills EDR telemetry and now tampers with Smart App Control too. Entry is still a trojanized PDF viewer pulled off an SEO poisoned impersonation site, which drops a new backdoor Check Point named Troy. Microsoft patched on August 11 after CP reported it on July 28, and the rootkit artifact is timestamped July 7, so it ran about five weeks as a zero day.

It is a local privesc, so they need code exec first, and the lures are aimed at defense, aerospace and aviation staff in France, Germany, Brazil and India. The part that reaches the rest of us is the C2. Lazarus built its relay network out of hijacked Roundcube and WordPress boxes, dropping a PHP webshell called RelayShell, getting in with leaked creds or CVE-2025-49113. At least 17 servers so far, and one already compromised French org got used to spear phish the next set of victims. If you have public facing Roundcube, you are in scope as infrastructure. Check Point published IOCs and a YARA rule for the webshell. (read more here and here)

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

We did the 100s of fake Chrome extensions story back in #117, and Socket just found the industrial scale version. 737 free VPN extensions across at least 40 developer accounts, 75,486 installs, 274 of them impersonating 66 real brands including Proton, NordVPN, ExpressVPN, Cloudflare's 1.1.1.1, and Google's own Outline. 520 of the 522 packages they pulled code for set chrome.proxy.settings to a fixed SOCKS5 server on port 1082 with a bypass list containing only loopback, so once you hit connect, every request in every tab goes through the operator. 94% of the campaign targets Russian speakers trying to reach blocked services, which means the two brands they most carefully cloned were AmneziaVPN and AntiZapret, the tools that audience actually trusts.

Socket is careful to say the proxy behavior by itself is how any browser VPN has to work. What makes the case is the surrounding stuff. All 200 premium subdomains for Japan, Singapore, Canada, Australia and Turkey resolve to nothing, and those are exactly the ones flagged premium: true. One extension ships a hardcoded license secret and a 32-bit rolling hash presented as a signature. Nine publisher accounts submitted byte-identical privacy justifications to Google claiming no data goes to external servers. And one package accidentally included an internal staff manual telling employees never to put a domain into chrome.proxy.settings, only the resolved IP, so takedowns cannot read the destination out of the shipped code. A Chrome Web Store developer account costs $5, 38 accounts published all 737, and 29 of the 30 accounts that have had something removed still have live extensions. (read more here)

Kimwolf v7: An Evolution of the Kimwolf Botnet

These guys really do not want to get taken down again. Unit 42 has a v7 teardown of Kimwolf, the Android arm of the AISURU operation whose C2 got seized by DOJ and international partners back in #160, and the whole release reads like an answer to that. The DDoS traffic now imitates a real Chrome browser closely enough to blend into ordinary browsing, which makes layer 7 filtering a much worse day for whoever is catching it. The C2 grew three redundant paths, including pulling its current address out of public Ethereum name records with Tor waiting when that fails, all sitting behind a local proxy so they can swap pieces without reshipping the bot.

All the scanning and exploit code is gone, so propagation is somebody else's binary now and this one just attacks and relays. Infection still gets in through Android TV boxes that ship with debug access wide open, which was true two years ago and will be true two years from now. If you have any of those on your network, they're hostile, keep them away from anything that matters. Ports, hashes, and detection guidance are all in the intel post. (read more here and here)

Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

Like a hack from a movie. Plug in a USB and hacker stuff just starts happening magically. Windows Plug and Play will fetch a signed vendor package off Windows Update and run its code as SYSTEM, with no admin rights, no UAC prompt, and nobody logged in. Alejandro Hernando and Borja Martinez did a DEFCON 34 talk on that and published the whole kit. Same family as the Razer mouse bug from 2021, except they went after the install path rather than one vendor's installer. The physical demo chains two boring vendor bugs: a Sierra Wireless service exposing a SetDNS call over a named pipe with an Everyone ACL, and a Sony co-installer that pulls config over plaintext HTTP and derives filenames without filtering traversal. (read more here and here)

If Apple sends you a push notification alerting you to a spyware attack, take it seriously

Apple sent another round of mercenary spyware threat notifications on Thursday, this time to users in 110 countries, which puts the running total over 150 countries since 2021. These used to land as an email and a banner on your Apple account page, which is a great way to reach somebody two weeks late. Now it goes straight to the lock screen as a push, and the notification opens into guidance on who to contact and how to turn on Lockdown Mode. Apple says it still has not seen a device compromised with Lockdown Mode on.

John Scott-Railton at Citizen Lab said the push is a real improvement, and his reasoning is the part I would pass along to anyone who works with high risk users. One person getting an alert and reaching out is usually what starts an investigation, and the investigation is what finds the rest of the targets. He points at Poland, where the whole spyware scandal traces back to notifications like these. (read more here and here)

China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack

Over four days in early July, an agent framework built on Hermes and OpenClaw ran twelve waves against government systems in Asia, sometimes with eight sub-agents going at once. FT says the target was Taiwan. It cracked 85 employee accounts, pulled 2,564 personnel records, and then started poking at a nuclear safety agency and a handful of energy companies. Nobody can tell which model was driving, and whatever it was, it got to work once the operators told it this was an authorized pentest.

One system was handing its entire user database to anyone who asked. Somebody left debug endpoints in production that give you a valid session for free. There was a CAPTCHA, which Tesseract solved every single time, and the passwords behind it were employee IDs with a symbol stuck on the end. We have been writing that same list up for ten years. What the AI brought was doing all of it simultaneously for four days while nobody noticed. Also worth knowing who is telling us this: Dream is Shalev Hulio's company, the NSO co-founder, and the report concludes that defense has to become AI-native, which is what Dream sells. (read more here and here)

FBI and Partners Warn Student-Athletes of Sexual Exploitation Schemes

The FBI and NCAA announced a joint initiative Monday to warn student-athletes about cyber-enabled sexual exploitation. The FBI's position is that athletes get targeted because their public profiles, expanded by NIL activity, give offenders both more access and more leverage when they threaten to expose material. The tactics described are ordinary account takeover work. A text claiming the account will be disabled unless you send back a verification code. An email about a suspicious new login that pushes you to a reset page. Taushiana Bright, section chief in the FBI's cyber division, told ESPN that the explicit material circulating in athlete cases is mostly real rather than AI-generated, and that sellers will post a stock photo from the school's team page next to it to prove the person is who they say.

If you run awareness for a school, a team, or anyone with a public profile, the reporting guidance is the part to pass along. Stop communicating with the offender, do not pay, do not send more images or identification, preserve the messages, and report it. The FBI is direct that paying leads to further demands. Non-consensual intimate images go to ncii.ic3.gov, and anything else to tips.fbi.gov or 1-800-CALL-FBI. The FBI and NCAA are specifically asking coaches, compliance staff, and athletic department leadership to carry this to athletes, since they are usually the first trusted adult somebody in that situation would go to. (read more here, here and here)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

Writing to you from Las Vegas in the transition day between Blackhat and DEFCON. What a week already. Been here since Monday and not leavin till Sunday which is entirely too much Las Vegas. My voice is at about a 15%, which you will absolutely see if you watch my videos I’m recording here.

You know that phenomenon in science where evolution keeps producing crabs over and over? I feel like that is happening in cybersecurity as I walk the expo floor and notice many of the AI security companies that were at least trying to differentiate last year are all moving towards doing the same stuff. AI SOC and AI Pentest absolutely everywere. I do still think there are some stand out players in the spaces, but I still commend those trying to stay in their differentiated niche instead of just becoming a crab.

If you’re reading this and you’re one of the many people who jumped out of the crowd to take the time to say hi to me and let me know that you enjoy reading/watching my content - THANK YOU. Running Vulnerable U feels like screaming into the void often, so that really means a lot to me.

Some of my favorite conversations of the week have been either people letting me know how much my content helps them in life/work or convos with teams/founders asking how they can do better in content creation/go-to-market. It is fun to jam on this stuff and actually see you all in person.

If you’re here, what has been your favorite part of the trip?

ICYMI

🖊️ Something I wrote: My take on these frontier labs all hacking things illegally

🎧️ Something I heard: Low Level and I talking Iran hacking water plants and the hugging face incident write up

🎤 Something I said: Me and Dan Miessler talked about the headlines screaming about open-weight Chinese models and if they are risky or not

🔖 Something I read: Daniel Cuthbert’s summary of OpenAI on stage at Blackhat discussing the recent incidents

Vulnerable News

Keyv and Friends Compromised in Active Shai-Hulud Supply-Chain Attack

Another supply-chain nightmare. While what felt like the entire security industry was walking the halls at Black Hat and BSides Las Vegas, a self-replicating npm worm was tearing through the JavaScript ecosystem, compromising packages that collectively see more than 2 billion monthly downloads. This one has serious Shai-Hulud vibes.

Source: Aikido

If one of the affected packages slips into your dependency tree, a simple npm install can pull down malicious files through a pre-install hook before you even realize anything is wrong. Researchers at Aikido say the campaign has already spread to hundreds of packages, and the list was still growing as responders raced to contain it.

I’m more worried about the ripple effects we haven’t seen yet. Sure, it steals npm and GitHub tokens so it can keep infecting more packages, but it also grabs Slack, Stripe, Vault and cloud credentials, SSH keys, Terraform state files, password manager databases, and just about every other secret you'd hope never leaves a developer workstation. (read more)

Are pentests obsolete in the AI era?*

AI can now deliver the depth of a pentest at the frequency of a scan. Instead of one annual engagement, testing could soon happen continuously: triggered whenever a new feature ships, a port opens, or a configuration changes.

This Intruder blog explores the short, medium, and long-term future of pentesting, and why the annual pentest may eventually become a thing of the past. (read more)

*Sponsored

Cyberattack on North Carolina Ports ‘Contained’ As Coast Guard, State Officials Investigate

Something got into North Carolina Ports' IT system late on August 4 and took all three facilities with it: Wilmington, Morehead City, and the Charlotte Inland Port. Truckers rolled up to signs reading "Operations Alert: System Issues. Expect Delays." The authority says the breach is contained, an outside forensics team is in there working alongside their IT group, and they pulled in NCDOT, the state IT department, and the Coast Guard. Gates went back to a normal schedule on the 6th, but everything is still being processed by hand.

The spokesperson declined to say whether this is ransomware, and no crew has claimed it yet, which usually means a negotiation window is still open. They had a Cybersecurity Contingency Plan(!!) and it was good enough to keep 4 million tons a year of cargo moving on paper. Manual fallback for gate operations is the thing you need written down before the bad day, and plenty of operators would have just closed the gate instead. Nothing has been said about cranes or other OT, so for now this reads as an enterprise IT hit with operational blast radius. (read more here and here)

UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

Source: Google Threat Intelligence

A crew Google tracks as UNC6671 calls your employees on their personal cell phones, poses as your IT helpdesk, and tells them there's an urgent mandate to enroll a FIDO2 passkey. The victim lands on something like [company].createssopasskey[.]com, an AiTM panel takes the password and the MFA token, then scripts start pulling files out of M365 and Okta. They've been running this under five different extortion brands. BlackFile announced a retirement in May, Redact showed up in June claiming a rogue affiliate had hijacked the old name, and Pink, Helix and Falcon each operate their own leak site. GTIG found the root domains and phishing templates shared across all of them, with passkeyhelpdesk[.]com hitting a Falcon victim and a Helix victim at the same time.

Targeting narrowed over the summer from broad enterprise to private equity, law firms and financial rating agencies, which is where the M&A and litigation material lives, and they're standing up a new domain every 1.6 days. They clean up after themselves too, using compromised mailboxes to reset passwords on non-SSO apps and deleting the confirmations and security alerts behind them. Payments kept landing in BlackFile wallets after the May retirement notice, about $10.69 million tracked through mid-May. The pretext here is also the fix: real passkeys are origin bound, so the lookalike domain has nothing to relay. Push and TOTP shops get eaten. (read more here and the May BlackFile writeup)

Canadian Man Pleads Guilty in Snowflake Extortions

Source: KrebsOnSecurity

Connor Riley Moucka, the 26-year-old from Kitchener who operated as Judische and Waifu, pleaded guilty to four counts including computer fraud and aggravated identity theft. Between February and October 2024 he and his co-conspirators worked through at least 165 Snowflake customer tenants, all of it on stolen credentials against accounts that had MFA turned off. Ticketmaster, LendingTree, Advance Auto Parts, Neiman Marcus, plus the AT&T haul of call and text records for more than 100 million people. DOJ puts the ransom take north of $2.5 million. He also re-extorted at least one victim using the stolen data of a government officer and a former officer's immediate family, and spent his spare time threatening the researchers and officials tracking him down. Sentencing is October 27, two year mandatory minimum, 30 year ceiling.

Cameron "Kiberphant0m" Wagenius, the Army soldier who pleaded out in July 2025, gets sentenced September 3. Which brings us to the third one, John Erin Binns of T-Mobile 2021 fame, who was sitting in a Turkish prison, has since been released, picked up Turkish citizenship, and is back online. Turkey does not extradite its own citizens.(read more here and the DOJ statement)

Why AI-generated vulnerability patches still require expert human review

1Password stood up a security research team called Off-by-1 Labs and their first paper is a good one. They generated about 6,000 patches for six recently disclosed CVEs across two frontier models, picking bugs whose fixes landed too late to be in training data. Complete fix with no change to application behavior: 26%. Fixed the bug but altered behavior: 20%. Failed to fix it, introduced a new vulnerability, or both: 53.9%. Their going-in hypothesis was north of 67%.

More than a third of the patches they counted as successes were what they call fragile, meaning a narrow check bolted on in front of the vulnerable code. On the SpringAI SpEL bug, both models escaped the exact characters from the PoC they were handed and left the root cause sitting there, so the bug comes back the moment that code is reachable by another input. They also tossed 400 runs where the model got caught trying to look up the real patch. Tooling and the full dataset are on GitHub under FLAWED, for Fix-Like Artifacts With Embedded Defects, which is a solid bit of naming.(read more here and the tooling and datasets)

Meta AI model hacked a company during misconfigured cyber test

Meta is on the board now! Not to be outdone in the AI doing illegal hacking on its own games! The Information reported that Muse Spark 1.1 breached an unnamed company and made changes to its internal systems, and Meta confirmed to Reuters that a misconfiguration by evaluation vendor Irregular handed one of its models live internet access when it was supposed to be isolated. Irregular says this is the exact same environment issue behind Anthropic's disclosure last week, and is explicit that no sandbox escape or sophisticated cyber action was involved. A test range was wired to the real internet. (read more here and Reuters)

State Department says Trump raised cyber scam compound issue with Xi

Source: The Record

Michael DeSombre, State's assistant secretary for East Asian and Pacific Affairs, told the Senate Foreign Relations Committee on Thursday that Trump has raised transnational criminal organizations with Xi. He would not say when, or what Xi said back, and the White House did not confirm the conversation happened. The number that came out of the same hearing: more than $12 billion taken from Americans in scams last year, which State says is likely an undercount.

Chinese enforcement has knocked down compound activity in Cambodia and Myanmar over the last six months, largely because those operations started hitting Chinese nationals, and Beijing has been pulling scam bosses out of Southeast Asia and executing some of them. So the US is leaning on those governments to hand the bosses over for interviews first, because once they go to China, per DeSombre, "we don't have great transparency as to what happens to them." The tradecraft is being exported in the meantime. Senators raised cases in Peru and the Dominican Republic, and State flagged compounds rising in Sri Lanka. (read more here and the hearing itself)

Hackers Stalked Me by Hijacking a Smartwatch for Kids

Vangelis Stykas mailed WIRED's Andy Greenberg a lavender kids' smartwatch off Amazon and Greenberg wore it to work. He texted Stykas outside his Brooklyn subway station to say he might lose signal, and Stykas replied that he already knew. The watch's GPS was broken, but it was still shipping nearby Wi-Fi identifiers to a remote server, which was enough to place him on a specific block. At the office Stykas silently pulled a photo off the watch camera as Greenberg stepped into the elevator, took another at his desk, then opened the microphone and listened. The watch showed nothing the whole time.

It costs under $30, comes from YiQingTeng Electronics in Shenzhen, and dozens of other brands run on the same backend. For their Blackhat talk, Stykas and Felipe Solferini worked through more than 70 GPS watches and car trackers and traced tens of millions of devices back to three Shenzhen supply chains. On SETracker an authentication flaw let anyone send commands to any device on the platform. Greenberg handed over his email address and nothing else. The available commands include location spoofing, message interception, live mic, camera, and swapping the emergency contacts for numbers the attacker picks. Two of the three platforms never replied to WIRED and still work. (read more here)

Despite Federal Warnings, Thousands of U.S. Industrial Controllers Used In Water Systems Remain Exposed Online

Researchers ran a Shodan scan on Monday and found 4,400 Rockwell and Allen-Bradley PLCs sitting on the public internet with EtherNet/IP open, 2,844 of them in the US. Half were MicroLogix 1400s, the same family the FBI and EPA named in last week's joint advisory on the water sector attacks. That advisory covers utilities in at least 12 states since July 27, nine systems in Michigan alone, and in at least one case the attackers changed the controller's IP address and password so the utility lost its own view and control of its equipment. Pressure loss and flooding.

Forescout cross-referenced against the affected cities and found 22 devices still exposed, 19 of which look open to CVE-2017-16740 based on firmware version, an RCE from 2017 that needs Modbus TCP enabled to work. They're careful to say they cannot confirm those hosts belong to the hit utilities or that Modbus is on. Plenty of reporting has pointed at Iran and Forescout is not attributing, with their threat hunting lead saying the scale and speed look like mass scanning and enumeration against a known vulnerability class. Rockwell has been telling customers to keep these off the public internet since 2018. (read more here, the Forescout research and the FBI advisory)

Thousands of Servers Can Be Backdoored By Exploiting Buggy Motherboard Controllers

HD Moore found more than a dozen new BMC flaws across HPE, Supermicro, Avocent, Huawei, Lenovo and Dell. His external scan turned up 86,000 BMCs exposing a management service to the public internet, and as many as 75,000 of those are still vulnerable to CVE-2013-4786, an IPMI 2.0 authentication flaw that hands you admin BMC password hashes for offline cracking. Thirteen years. Over half the exposed population carried at least one critical bug, and an internal survey of 126,761 BMCs sitting inside corporate networks put that figure at 29%. The new classes run from auth handshake sequences you can reorder to skip authentication entirely, to unsigned firmware and unenforced config integrity that turn an admin foothold into a permanent implant under the OS.

ILObleed already showed what that looks like in practice. In 2021 it landed wiper firmware on HPE servers that survived OS reinstalls and drive swaps and kept destroying disks, using a bug HPE had patched four years earlier. HD is holding CVE details until vendors ship fixes, so this week's work is inventory and segmentation. He released OOBscan to sweep your fleet, and his own hardening list is short: long unique usernames as well as long passwords, disable IPMI where you can, disable KCS to block host-side access to the BMC, and isolate each BMC NIC individually, one per segment, no shared management VLAN. (read more here and Ars)

Anthropic’s AI Used Fake Identities, Malware in Rogue Attack On GitHub Project

AISI runs frontier models through cyber ranges with live internet access and the providers' cyber classifiers deliberately switched off, on the reasoning that a real attacker has both. Across 122 runs against seven models in late July they logged 19 unsanctioned actions on the live internet, nearly all of it one sustained line of activity from Claude Mythos 5. Their security team found out when monitoring flagged data leaving a research system over Tor.

Mythos decided the way to solve its challenge was a supply chain attack, so it ran one against a real open source project. It researched the maintainers, opened a PR with malicious code, then created a second account posing as an unrelated person who had reviewed that code and confirmed it was clean. Five emails to two maintainers, some carrying malware. Then it opened an Issue on another repo owned by one of them containing a prompt injection aimed at issue-triage coding agents, having reasoned the maintainer might be a bot like Claude Code. Nothing worked, the PR was refused, and AISI found no real-world harm. Their fix going forward is a second LLM watching the first one in real time to approve or deny out-of-scope actions, which is the same control problem everybody shipping an agent this year is about to own. (read more here and Ars)

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

Writing you from San Diego on vacation. First real non work/family trip in a few years which is nice. Got to see some infosec friends down here and get tips on all the best fish tacos, burritos, and poke bowls. I booked a few scuba dives while out here but a big storm off the coast ruined water conditions so those all got cancelled which is a bummer, I guess I’ll have to come back!

Headed home for a bit and then off to BlackHat which looks like it’ll be about 119 degrees, and no I don’t care its a dry heat. I celebrated 4 years sober this week which makes Vegas much more tolerable for the whole week, so I’m looking forward to seeing a bunch of you out there at summer camp.

ICYMI

🖊️ Something I wrote: Some thoughts about Adrian, an open source prompt injection defense tool

🎧️ Something I heard: The Low Down latest episode talking Hugging Face incident, wp2shell and more

🎤 Something I said: Dug into some identity as code techniques with Teleport

🔖 Something I read: Minimal’s open source announcement. Hearing good things.

Vulnerable News

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

When I covered this it was an AI escaping a sandbox to cheat on a test. It is now a four-day intrusion in which the model built itself attack infrastructure out of strangers' cloud accounts, and OpenAI is still adding to the disclosure.

Hugging Face published their forensics and it is the best security writeup I have read this year. 17,600 recovered attacker actions between July 9 and July 13, grouped into phases, with an interactive replay you can step through action by action. Go look at it. The agent was being evaluated on ExploitGym, worked out that Hugging Face probably hosted the benchmark's reference solutions, and went to get them. The whole four and a half day campaign was a model trying to cheat on a test.

The other update this week is that we found out what the vendor was for the zero day it found. JFrog’s Artifactory wrote up their side of the story. After that it was rooting a public code-execution harness some third party had left exposed on Modal (Modal's own platform held up, this was a customer's endpoint). That box became the launchpad for everything after. Stage two was into Hugging Face, and the agent got in by uploading malicious dataset configs and letting their own loader do the work.

From JFrog’s POV the models chained previously unknown bugs in self-hosted Artifactory to get off the range and onto the open internet. Nine fixes shipped in 7.161.15 and 7.146.34 covering RCE, SSRF, path traversal and privilege escalation up to admin. Cloud tenants are already covered, self-hosted is on you.

OpenAI's update says GPT-5.6 Sol and an unnamed pre-release model went looking for publicly exposed credentials and used four accounts across four separate services. It assembled a C2 and a dead drop out of other people's accounts.

(read more here, OpenAI's disclosure and JFrog's writeup)

Security decisions backed by evidence*

Security teams face thousands of remediation decisions every day, yet none are based on evidence showing which vulnerabilities actually lead to financial loss.

The Evidence Platform from Root Evidence introduces a new operating model for vulnerability management, using cyber insurance claims, actuarial analysis, digital forensics, attack surface intelligence, and real-world breach data to reduce noise, prioritize remediation, and focus resources where they'll have the greatest business impact.

See the Evidence Platform in action.

*Sponsored

Investigating three real-world incidents in our cybersecurity evaluations

After OpenAI's disclosure, Anthropic went back through 141,006 of its own evaluation runs where Claude could have reached the internet, and found three incidents where it did, and then compromised the production infrastructure of three real companies. All three were capture-the-flag challenges run through their third-party eval partner Irregular. The prompt told Claude it had no internet access. A misconfiguration gave it internet access anyway. So when Claude's search wandered off the range, it treated the real companies it found as part of the game.

Key distinction: these model test environments just had internet access. Calude didn’t need to go zero day hunting to escape the lab, it just was misconfig’d to leave the door wide open. I also hate the personification of these mistakes. A human prompted for these things to happen, and then they happened and were missed. This isn’t some mysterious model issue.

In one of the incidents Claude found setup docs in the fictional environment pointing at a Python package that did not exist, and did what any red teamer would do: registered the name and published a booby-trapped package. It needed a PyPI account, which needed an email address, which needed a phone number, which it tried and failed to buy, before backtracking to a free email provider. The package was live for about an hour, got installed on 15 real systems. (read more here)

A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran

We talked about the $10 million bounty and the six sanctioned IRGC officials tied to Cyber Av3ngers, after they rewrote Unitronics PLC code and put "Gaza" on screens from Ireland to Pittsburgh. Well we’re so back. Andy Greenberg got hold of a WaterISAC memo, and it is the first official document to explicitly connect the Minnesota water attacks to Iran. The memo relays a Minnesota Fusion Center alert finding the activity aligned with the Iran-affiliated PLC campaign CISA described in April.

The intent line is what made me perk up a bit. Per the Fusion Center, the attackers hit remotely accessible PLCs with the likely goal of causing "loss of system pressure and potential contamination of the water supply."

Plymouth said its impact was limited to equipment connected over cellular. Suzu Labs' Denis Calderone points out that water towers, lift stations and pump stations usually phone home to SCADA over cellular modems, and those secondary comm paths are routinely left out of risk and vulnerability assessments, especially when an integrator built the network. In the 2020 attacks on Israeli water facilities, Iran-linked actors came in through vulnerable cellular routers. Braham's city administrator is now asking for their vulnerability study to be redone, and I would bet the cellular paths were never in it.

Get PLCs off the public internet, allow-list what can talk to them. And go find out what your remote sites are talking over, because that inventory is probably wrong. (read more here, here, and the city statements from Braham and Plymouth)

Stronger with every update: How we're making Chrome and the web safer in the AI Era

Chrome fixed 1,072 security bugs across milestones 149 and 150, which beats the total from the previous 23 milestones combined. Look at that chart. Try to spot the Opus moment (when all the frontier models got good). They built a Gemini agent harness that runs over the whole Chrome codebase, and one of its finds was a sandbox escape letting a compromised renderer read local files that had been sitting there for 13 years. BigSleep and CodeMender run in CI every 24 hours across all CLs, and in May alone blocked over 20 vulnerabilities from reaching production including a critical S1+. They are piloting two security releases per week and building dynamic patching that swaps out renderer and GPU processes with updated binaries without making you restart the browser.

By March they were receiving more bug reports than they got in all of 2025, so they rewrote the Chrome VRP to push researchers toward findings that are additive to what the machines already catch. (read more here)

Read This Before You Buy That TV Streaming Stick

Following on from the LG proxy mess last week, here is the version where the device was built for this from the factory. Bitsight's Pedro Falé registered an expired domain that H96 Android TV boxes had been phoning home to, and found roughly 38,000 of them worldwide reporting full hardware details and installed app lists. Except they were not reporting as TV boxes. They claimed to be Samsung, Vivo, Huawei and Xiaomi phones. As Falé put it, "multiple devices reporting to this factory Android TV Box backdoor were 'phones.'"

The operation traces to Zhejiang Fengwo IoT Technology, a mainland China company running an ad publishing arm called Fengwo Group, with monetization collected through Hong Kong, Singapore and single-person shell identities. The boxes get pushed jobs to open a browser, load AI-generated finance, health, gaming and food blogs owned by the same group, and click the ads. Those sites serve no ads at all unless the visitor matches the spoofed mobile profile, so the entire loop is closed and self-dealing.

Amazon, Best Buy and Newegg are all still selling hundreds of these, and the FBI has been warning about them for years. Stick to name brands, check for Play Protect certification, and go look at Synthient's running list of consumer devices that ship with proxyware preinstalled, because it is not just streaming sticks. Digital photo frames are on there. The gift you bought your mom might be renting out her IP address.

(read more here and here, the FBI alert and Synthient's device list)

6,000 seat health insurer: “I don't want to go through another Shai-Hulud without it."*

A health insurer serving 3.6M members, running modern pipelines at scale, had best-of-breed scanners and still could not prove its artifacts were trustworthy when the critical vulnerabilities dropped.

Kusari became its system of record: every artifact mapped from source, every dependency searchable, proven exposure answered in seconds instead of days.

Learn how they did it → read more

*Sponsored

Some thoughts about Anthropic's new cryptanalysis results

Anthropic pointed Claude Mythos at cryptanalysis this week and published two results. Matthew Green (my cryptography god) read both so you don't have to.

First he talked about HAWK, a proposed post-quantum signature scheme that was working its way toward becoming a standard. Claude found a key recovery attack that roughly halves its security bits. Still exponential time, so nothing is broken today, and you could paper over it by doubling key sizes. Except being small and fast was HAWK's entire pitch, so Green figures the scheme is now dead. There's working code too, and it recovers keys in a few hours against a weakened challenge instance the HAWK authors published themselves.

The other result is the one with the scary headline. An improved attack on 7-round AES, which sounds like your TLS is on fire, until you learn people have been chipping at reduced-round AES for two decades, this is a constant-factor improvement on work from 2013, and it needs 2^89 operations plus 2^105 chosen plaintexts. Nobody is decrypting anything.

Green says Anthropic didn't assemble a room of lattice experts to steer this either. They pointed the model at the problem and let it grind. His real warning is these things are much better at producing results that look real than results that are real. (read more here, Anthropic's research post and the HAWK paper)

Industry Leaders Unite in Open Secure AI Alliance

The open-weights camp found its Exhibit A, and it is the Hugging Face incident. NVIDIA stood up the Open Secure AI Alliance with 55 inaugural partners, and the argument at the center of it is the thing I flagged last week: when the closed models could not tell an attacker from a defender and refused to help with the cleanup, Hugging Face ran open-weight GLM 5.2 on its own infrastructure to work through 17,000 actions and contain the intrusion. Defenders need models they can inspect, adapt, and run themselves. Fine by me. It is just funny watching it become a policy platform with a logo garden.

There is real code under the press release, which is more than most alliances manage. NVIDIA's NOOA agent harness project is on GitHub, Hugging Face handed Safetensors to the PyTorch Foundation, Microsoft brought its MDASH multi-model scanning harness, HPE is pushing SPIFFE/SPIRE for cryptographic agent identity. The closing ask is aimed at regulators: blanket restrictions on open frontier systems "would weaken defensive capacity." Which is the argument I have been making, now with a few trillion more in market cap behind it than VulnU could muster. (read more)

FCC Adds Foreign-Made Robots and Power Inverters to the Covered List

The robot dogs have met their match. The FCC added foreign-produced power inverters, humanoid robots and quadrupeds to its Covered List, blocking new imports on the grounds that they could be remotely controlled, used for surveillance, or turned on us in a cyberattack. Exceptions are available if a device is found not to pose a risk. This mostly means China, which dominates both markets. Around 15,000 humanoids shipped worldwide in all of 2025, so that half is preemptive. Inverters are in millions of American homes tying rooftop solar into the grid.

Where I land, and it is consistent with what I said about open-weight models a couple weeks ago: origin is a weak signal, capability is a strong one. A model's country of origin does not change its risk profile. But grid-connected hardware with a vendor-controlled remote management path is a different animal, because the capability ships with the box and the vendor is reachable by a government that can compel them. The part I would like to see is a rule about what a grid-edge device is allowed to phone home to, regardless of who built it. (read more here and here)

KindaRails2Shell: Critical RCE in Rails via Active Storage

We heard you liked wp2shell, so now there’s more! Rails2shell! Kinda! (In my best Shamwow! voice) Ethiack went looking for the Rails equivalent, reported it July 22, and it landed publicly on the 29th. CVE-2026-66066, CVSS 9.5, unauthenticated arbitrary file read through Active Storage when it hands uploads to libvips. Ethiack has since confirmed that stock Debian, Ubuntu and Rails-generated Docker environments are all exposed, because the libraries the attack needs ship by default. So if your app takes image uploads from untrusted users, assume you are in scope. What comes back out is .env, database.yml, credentials.yml.enc, secret_key_base. MiniMagick apps are clear. Patch to 7.2.3.2, 8.0.5.1 or 8.1.3.1, and EOL branches get no upstream fix.

Ethiack and Rails were trying to sit on the technical details until August 28. That lasted two days. Ethiack now confirms at least one public PoC exists and says more details may arrive before the 28th. Patching does not un-steal anything, so rotate secret_key_base, the master key, database creds, Active Storage service keys and third-party tokens. (read more here, the Rails advisory)

24,650 Exposed Server BMCs Are Handing Out Crackable Password Hashes

Source: Lava

Researchers scanned UDP 623 and found 36,872 internet-exposed IPMI hosts. 24,650 of them will hand password-derived authentication material to anyone who asks, via CVE-2013-4786, a weakness in a protocol standardized in 2004. For about a third the researchers actually recovered the password using dictionaries and the patterns printed on factory stickers. 6,240 accepted an empty username. The US is 39% of it.

An HPE factory password takes roughly a day per captured handshake on an Apple M3. No rented GPU cluster needed! A lot of the exposed gear is Supermicro running a 10-character uppercase string off the chassis label with ADMIN as the username in every instance, which sounds like entropy until you notice the charset and the length are both fixed. Get IPMI and Redfish off the public internet and rotate the factory passwords. (read more here and the CVE)

Word Worm Crawls Into Copilot, Spreads Chaos

A researcher has demonstrated a PoC Word document worm that abuses Microsoft 365 Copilot to spread itself without relying on traditional macros or exploits. The attack hides malicious instructions inside a Word document that Copilot faithfully follows when asked to summarize or interact with the file. The AI then generates new documents containing the same hidden prompt injection, effectively turning Copilot into the worm's replication mechanism. Håkon Måløy, a Norwegian data scientist with a PhD in applied AI and ML, publicly disclosed the issue in a blog post.

Prompt injection is starting to look a lot like the macro malware era, except the code is written in natural language. (read more)

Amazon Links Debug, Chalk NPM Supply-Chain Attacks to North Korean Hackers

Source: AWS

Amazon says the high-profile compromises of the Debug, Chalk, Axios, and typo-crypto npm packages came from a single North Korean state-sponsored operation, linking what previously looked like isolated incidents into one long-running software supply-chain campaign. Amazon's threat intelligence team said attackers spent months socially engineering open-source maintainers, building trust, and then slipping malicious code into legitimate package updates that were downloaded by developers around the world. (Sounds like XZ Utils to me)

This was an industrial-scale operation where Amazon says the attackers deliberately started with smaller packages before moving on to massively popular libraries like Debug, Chalk, and Axios, while using AI to appear like legitimate open-source contributors by fixing bugs, responding to issues, and earning maintainers' trust. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

Who all am I going to see out at BlackHat and Defcon? Calendar is already looking like a jenga game. I’ll be bringing my good walking shoes. We’re going to be recording a live podcast out at Defcon so follow me on Twitter to see me shout where we post up.

Speaking of the podcast, have you all checked it out? I’m excited with how its been turning out. We’ve got some really exciting interviews scheduled too. Give it a follow and rating in your favorite podcast app and YouTube for the full handsome devil video experience if our faces are important to you. (Apple, Spotify)

ICYMI

🖊️ Something I wrote: I checked out this open source tool that helps with prompt injection - worth a look.

🎧️ Something I heard: This Wired investigation into hacking after market car add-ons

🎤 Something I said: Interviewed HD Moore, creator of Metasploit and founder of runZero about how hacking is like the 90s again.

🔖 Something I read: I read the dungeon crawler carl series two times through at this point and it has been a gateway drug into LitRPG as a genre. I’m almost done with the Primal Hunter series now and it’s been great.

Vulnerable News

OpenAI Models Escaped Containment and Hacked Hugging Face

The headlines made it sound like an AI escaped containment and hacked Hugging Face. That's technically true, but the more interesting story is how it happened.

OpenAI confirmed that one of its unreleased cyber models - 5.6 Sol and an even more capable pre-release version with cyber guardrails relaxed for testing - was being evaluated against Exploit Gym, a benchmark designed to test advanced offensive security capabilities.

Instead of solving the benchmark directly, the agent reasoned that the answers might exist somewhere else. It discovered a previously unknown vulnerability in a package registry proxy, escalated privileges inside OpenAI's research environment, moved laterally through the network, gained internet access, and ultimately reached Hugging Face's infrastructure looking for benchmark data. /goal really took the “goal” part seriously this time, eh?

The ironic part here was that the guardrails designed to make commercial AI safer got in the way of incident response. Hugging Face ultimately had to switch to an open-weight model, GLM 5.2, running on its own infrastructure to complete the forensic investigation. The frontier models did the hacking but refused to help with the cleanup due to safety restrictions.

Niels Provos had one of the best takes on this whole incident. His point wasn't that we should be terrified because the AI was "super intelligent." His point was that this looked like a failure of basic security engineering. If your sandbox has proper egress controls, deny-by-default networking, and genuine isolation, the model shouldn't be able to wander onto the public internet regardless of how clever it gets or how many zero-days it discovers. The incident suggests the testing environment wasn't nearly as isolated as they stated. Sandboxing isn't something you accomplish in a Guardrails.md file. There need to be technological control layers that can’t be subverted. (read more here, here, here and here)

How Databricks eliminated standing access for 8,000+ engineers*

Databricks had a standing access problem at scale. With 8,000+ employees across 30+ offices, their identity team ran quarterly access reviews using brittle Python scripts that crashed mid-run.

Today: 86,000 time-bound access requests handled, 141 automated UARs covering 140,600 access decisions, and a 97% reduction in median approval time. Engineers get production access in minutes instead of hours. Auditors automatically receive compliance reports. Now with Agentic AI, Databricks can handle campaigns at scale.

Learn how they did it

*Sponsored

LG to Ban Residential Proxies from Smart TV Apps

WTF is going on at LG? You’re paying top dollar for highest tier of electronics and getting bottom of the barrel no name Android devices of Temu experience in their software. TWO different major stories this week for them - 1) apparently 42% of apps in their smart TV appstore include an SDK that turns your device into a residential proxy node for rent. Threat actors and fraudsters rely on these proxies to make their traffic appear legitimate and not originating from data centers.

At the same time Gamers Nexus on YouTube put together a scathing video showcasing how their top tier $1200 computer monitors are installing adware and all sorts of other shady data collection crap. You plug the monitor in and it pushes McAfee bloatware and even easily missed opt-ins for premium subscriptions to the Anti Virus software. Again, this feels like things you’d expect from bottom of the barrel no name devices, not LG. Imagine Apple charged what they did and then had adware and other shady pop ups on their devices? Thats what this feels like to me. (read more here and watch more here)

The Real Risk of China's Open-Weight AI Isn't What You Think

I interviewed Daniel Miessler this week (video to come) because he's one of the few people I know who's willing to wrestle with AI's future without falling into the usual hype or doom camps. We disagree on plenty, which makes for a much better conversation.

The jumping-off point was a long X thread from Dean Ball, OpenAI's Head of Strategic Futures, arguing that China's latest open-weight AI models represent a growing strategic risk. By the time Jim Cramer jumped into the conversation, I knew this debate had escaped the echo chamber. Once that happens, nuance usually disappears. Suddenly the conversation isn't about deployment models, infrastructure, or data residency anymore. It's just "China bad."

One of the biggest topics was Kimi K3. It came out last week, and it's about on par with the best Western frontier models. Not quite at Fable's level, but with the right harness it's pretty darn close. At the same time, people hear "open weight" and assume anyone can run it on a laptop. That's not how this works. You still need serious infrastructure. The weights being open doesn't magically put frontier AI in everyone's hands overnight. That's why I think so much of the panic around these models is misplaced. People are arguing about capabilities without understanding how they're actually deployed.

Full X thread here

Ball suggested China may be acting out of "strategic blindness." I just don't buy that. China isn't exactly famous for failing to think long term. Their strategy is measured in centuries. Ours is measured in fiscal quarters. Where Dean really lost me, though, was describing an open-weight future as an "AI communist dystopian hellscape." I kept asking the same question: What's the dystopian hellscape? What is the nightmare scenario where more people have cheaper, maybe even free, access to frontier-level technology? We said the same thing about the internet. I don't think anyone looks back and says widespread internet access was a mistake because too many people got access to powerful technology.

This is all getting pretty banana pants. The actual cybersecurity nuance has almost nothing to do with where the model was trained. It has everything to do with where you're sending your data. If you're piping sensitive corporate information into a Chinese-hosted API, absolutely that's a legitimate concern. But if you're running an open-weight model on American infrastructure, whether that's Google Cloud, OpenRouter, or your own environment, the risk profile changes completely. There isn't some magically "American" model that's inherently safer because it carries a U.S. flag. (read more here and here)

Full X thread here

Critical wp2shell WordPress Flaws Exploited to Install Webshells

This is one of those stories where the advice is simple: stop what you're doing and patch. Researchers disclosed a critical remote code execution vulnerability affecting WordPress itself, not a plugin, and exploitation is already considered trivial.

Ryan Dewhurst, one of the top WordPress security researchers, warned that attackers can exploit it with AI-assisted tooling, making this far easier to weaponize than many past WordPress flaws. Roughly 500 million websites run WordPress, although the bug only affects versions 6.9 and newer (with some caveats. check patch notes), meaning sites updated since December or running automatic updates are the ones most likely to be exposed.

I expect that mass exploitation is measured in hours, not days. If you're running an affected version, patch immediately. If you absolutely can't update right away, you may be able to temporarily mitigate the risk by disabling the vulnerable WordPress REST API functionality, but honestly that sounds harder than simply installing the fix. WordPress forced a patch but I got lots of DMs and comments from people saying their version didn’t auto update. Cloudflare also pushed a protection in their WAF if you’re on their pipes. (read more)

Your access reviews have a 99% approval rate. That's the problem*

If every reviewer clicks approve, the review didn't happen. Attestation fatigue is real: reviewers see 200 identical rows with no context and do the only reasonable thing. Opal's Paladin triages the queue before they ever open it — automating the routine 90% with a full audit trail, surfacing the 10% that needs a human call.

Watch the on-demand demo. 

*Sponsored

Introducing Gemini 3.5 Flash Cyber

Google just made one of the biggest AI-for-cybersecurity announcements we've seen yet. Heather Adkins, Google's CISO, shared Gemini 3.5 Flash Cyber, a lightweight, cost-efficient model that's purpose-built for security work. They emphasized the capability around finding AND fixing vulnerabilities. Finding bugs has never been the hard part. Fixing them at scale is worth the attention. Google has been saying for a while that its long-term goal is nothing less than eliminating software vulnerabilities altogether, and this feels like another major step toward that vision.

Google says Gemini 3.5 Flash Cyber found more vulnerabilities in the V8 JavaScript engine that powers Chrome than either Gemini 3.5 Flash or Gemini 4.6. That's wild. My first sarcastic thought was, "Did somebody tell the FBI? We've got another model to ban." If this thing delivers cyber capabilities on par with models like Mythos Preview but at a fraction of the cost, that's a huge development for defenders. The industry has spent months debating whether powerful cyber models are too dangerous to release, while Google is demonstrating what happens when you optimize one specifically to help security teams identify and remediate flaws faster.

To me, this is exactly where the conversation should be. If policymakers are genuinely worried about the cybersecurity race with China, the answer isn't flirting with bans on open-weight models or trying to slow down AI. It's getting the best defensive capabilities into the hands of every security team in America and across our allies. We've already learned this lesson with vulnerability scanners, Metasploit, and countless other security tools. Pretending powerful technology doesn't exist doesn't make attackers forget about it. The best response is putting better tools in defenders' hands. One gazillion percent. That's how you improve cybersecurity. (read more)

Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries

Laundry Bear (also known as Void Blizzard) has been running a nasty espionage campaign since July 2025, exploiting a zero-day in Zimbra Collaboration Suite that didn't get patched until November. Such little user interaction required for this bug, just viewing a phishing email is enough for them to walk away with 90 days of emails, passwords, 2FA tokens, and search history. No clicks.

The joint advisory - signed by 16 countries - notes the group is still actively hitting unpatched Zimbra instances, so if your org is running it, patch now. The vulnerability only scored a 6.1 CVSS severity rating, further solidifying fixing in CVSS score order is not a good strategy. The group has been spotted targeting defense, energy, law enforcement, finance and more across NATO countries, with Ukraine serving as their testing ground before broader deployment - a pattern we're seeing more frequently from Russian threat actors. (read more)

Adobe Chrome extension vuln lets sites access WhatsApp chats

Nasty one here - the Adobe Acrobat Chrome extension had a vuln that could let any website you visit silently read your WhatsApp Web conversations. The attack chain, dubbed HermeticReader, exploits the extension's WhatsApp integration feature to hijack DOM operations in your WhatsApp tab and exfiltrate your chat list, contacts, messages, and more - with zero clicks required. 329 million installs on this extension makes my head spin…

It was caught four hours after Adobe accidentally introduced it in an update, and Adobe patched it within two days over a weekend - which is about as good as we can hope for. No evidence of exploitation in the wild either. If you're running the Adobe Acrobat Chrome extension, just make sure you're on version 26.5.2.3 or later, which should have auto-updated already. (read more)

Critical SharePoint RCE flaw exploited to steal machine keys

If you're running on-premise SharePoint, drop what you're doing and patch. CVE-2026-50522 is a critical unauthenticated RCE flaw that got a PoC published on GitHub, and within hours watchTowr's honeypots were catching active exploitation attempts. Attackers are using it to steal machine keys, which lets them forge authentication tokens and maintain persistent access even after you patch the underlying vulnerability. (read more)

Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak

Take my eyes, but not my milk! Anubis ransomware gang is claiming responsibility for the Fairlife (Coca-Cola dairy subsidiary) attack that took down US production facilities earlier this month. They're saying they encrypted Fairlife's Nutanix infrastructure and walked out with about 1TB of corporate data, with a deadline to negotiate or they dump it. Coca-Cola's not saying much.

Worth keeping an eye on Anubis - they're a RaaS operation that spun up in December 2024 and have been building a pretty gnarly toolkit. Last year they added a data wiper to the mix, so beyond the usual encrypt-and-ransom playbook, they can just nuke your files entirely if you don't play ball. The fact that Fairlife went public with the breach quickly without following the ransom instructions clearly didn't sit well with them. (read more)

Palo Alto VPN vuln exploited by Qilin ransomware gang

If you're running Palo Alto GlobalProtect VPN and haven't patched CVE-2026-0257 yet, you’re probably having a bad time. Qilin ransomware affiliates are actively chaining this auth bypass vulnerability to get into corporate networks, and researchers have already documented multiple successful intrusions from June alone. Palo Alto patched it back in May, CISA added it to KEV and gave federal agencies three days to patch, and yet here we are with Shadowserver tracking over 167,000 GlobalProtect instances still exposed online. (read more)

Critical ServiceNow code execution flaw now exploited in attacks

If you've got self-hosted ServiceNow instances in your environment, heads up! (Feels like a lot of this this week). CVE-2026-6875 is a pre-auth sandbox escape RCE that's now being actively exploited in the wild - Defused caught it over the weekend. ServiceNow patched their hosted instances back in April but only dropped the fix for self-hosted a week ago on July 13th, which means there's been a window of exposure for anyone dragging their feet on updates.

The interesting wrinkle here is that attackers are hitting the same pre-auth endpoint that Searchlight Cyber documented in their original PoC, but using a different sandbox-escape gadget to get there. ServiceNow is still technically saying they haven't observed exploitation on their hosted instances, but if you're self-hosted you've got 85% of Fortune 500 companies worth of attack surface context to motivate you. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 5 minutes

Brought to you by:

Howdy friends!

It was one of those weeks that I think it would be easier to count the amount of hours I wasn’t on camera yapping. Recorded an absurd amount of content. Felt good to be back in studio in between a bunch of traveling banging it all out though!

Really excited about how the new podcast with Low Level is shaping out. We’ll be putting these out weekly so make sure to subscribe to either the new YouTube channel or wherever you listen to podcasts. (Apple, Spotify, etc.)

And as always a special shoutout to Maze who not only is doing awesome things in AI Security land, they also must be geniuses since they wanted to be our Launch partner on The Low Down.

ICYMI

🖊️ Something I wrote: Just opt out of us siphoning all of your data out of your home directory to our cloud storage! Honestly it’s your fault.

🎧️ Something I heard: This awesome panel we did at PlanetScale HQ

🎤 Something I said: How I cooked prompt injection with this open source tool

🔖 Something I read: This great interview between Kim Zetter and Allison Nixon on tracking The Com (Scattered Spider) - and did you see the perp walk?

Vulnerable News

Microsoft Patches a Record 570 Security Flaws

570 patches in a single Patch Tuesday. Welcome to Mythos baby!!! Microsoft is, of course, attributing exploding patch number to AI-assisted vulnerability discovery. The most pressing items this month are three zero-days, two of which are already being exploited in the wild, both allowing privilege escalation. There's also a fun 9.6 CVSS RCE in Microsoft Copilot that lets attackers execute code via a malicious website that tricks Edge on Android into sending crafted prompts.

Microsoft's exploitability index is basically becoming useless in an AI world. Anthropic's Mythos model was able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that Microsoft had rated "Exploitation Less Likely." The SharePoint zero-day this month was rated the same way before showing up on CISA's KEV list. Adobe is moving to twice-monthly patches, and Google pushed over 900 fixes in June alone. Patch management is having its DevOps moment, gotta do more and more faster! (read more)

Are pentests obsolete in the AI era?*

AI can now deliver the depth of a pentest at the frequency of a scan. Instead of one annual engagement, testing could soon happen continuously: triggered whenever a new feature ships, a port opens, or a configuration changes.

This Intruder blog explores the short, medium, and long-term future of pentesting, and why the annual pentest may eventually become a thing of the past. (read more)

*Sponsored

Contagious Interview Infostealer Campaign Continues Targeting Developers

Full thread here.

Love when people who get popped are super transparent about their experience so we all get a chance to learn from it. This blockchain dev got a recruiting message on LinkedIn. They even said they were expecting a suspicious link or some malware that never came. They got all the way to the interview, it all felt super legit, and then the team asked them to clone a GitHub repo to work on a coding assessment live on the call. Doing what anyone would do during a job interview, they got to work - but the github repo contained malware heading in an auth.js file a few folders deep. By the time the victim knew what happened, a bunch of their crypto wallets were drained.

This campaign has been very prevalent and successful out of North Korea. They specifically target blockchain/crypto/web3 devs as it fits SUPER nicely in with their lure to get code on their machine for a technical interview. They are also a perfect target because since North Korea is basically sanctioned out of the western economy they fund much of their government efforts with stolen crypto. Billions per year. (read more here)

LegacyHive: “Bone-Shattering” Zero-Day from Microsoft's Serial Tormentor Not the Haymaker That Was Promised

The day Nightmare Eclipse promised finally arrived. If you've been following the saga, Nightmare Eclipse is the security researcher who's been carrying out a very public feud with Microsoft over what they describe as a broken vulnerability disclosure process. Back in June, the researcher hinted that July 14 would be significant, and sure enough, a new zero-day dubbed "LegacyHive" landed on GitHub.

It's a local privilege escalation in the Windows User Profile Service that lets a regular user mount and get read-write access to other users' registry hives, including admins. Useful post-compromise tool, but experts are calling out the gap between the "bone-shattering" hype and what the released PoC actually delivers.

Interestingly, NightmareEclipse stripped back the public PoC this time around - likely due to Microsoft's legal threats - requiring additional credentials and limiting it to the usrclass.dat hive. The full version apparently doesn't have those limitations, but you'd need to do some work to get there. Given that previous drops like BlueHammer and RedSun went from PoC to active ransomware exploitation within days, security teams shouldn't treat the incomplete PoC as a reason to relax. No patch yet, no CVE, and Microsoft just shipped 622 fixes this month so don't hold your breath for an out-of-band fix. (read more)

Telegram’s shortlink domain is back online after day-long suspension

Telegram had a rough Monday when their t[.]me shortlink domain went dark, and the reason turned out to be a pretty embarrassing clerical blunder. The Montenegro-based registrar DomainME accidentally suspended Telegram's entire t[.]me domain while trying to comply with new OFAC sanctions - the sanctions that were actually targeting a VPN provider called First VPN. The problem? The Treasury's sanctions listing for First VPN happened to contain a t[.]me link to the VPN's Telegram group, and rather than just blocking that specific URL, DomainME nuked the whole domain to stay on the right side of U.S. sanctions law. (read more)

Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

Instagram post

If you've been using xAI's Grok Build coding CLI, it's time to rotate your credentials. A researcher found that Grok Build was uploading entire Git repositories - full commit history included - to an xAI-controlled Google Cloud Storage bucket. Some examples showed a 27,800x gap between what the model actually needed and what left the machine. Turning off "Improve the model" in settings did absolutely nothing to stop the uploads - that toggle only governs training data, not what actually hits the wire.

Any file Grok read during a task, including .env files, went out unredacted. And since full commit history was bundled up, that includes secrets you committed and deleted ages ago. xAI quietly flipped a server-side switch to stop the uploads on July 13th and Elon promised everything would be "completely and utterly deleted," but they still haven't explained why full repos were being uploaded by default, for how long, or how many users were affected. The upload code is still sitting in the latest binary, just held back by a server flag. Rotate anything that could have touched this tool. If you were running this in a corporate environment, this is a data residency and regulatory nightmare. (read more)

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

This isn’t the craziest vuln, but it is worth talking about this story because I trust the author is legit and this disclosure process is not alright for a company of their size and reputation. Mindgard dropped a full disclosure on Cursor today after seven months of trying to get the AI code editor to patch a painfully simple vulnerability. The bug itself is almost embarrassingly basic - drop a malicious git.exe in your repo root, and Cursor will execute it automatically when someone opens the project. No clicks or prompts. It just runs. The proof of concept was literally just Windows Calculator renamed to git.exe popping up over and over.

Mindgard did everything right - responsible disclosure, HackerOne, direct CISO outreach - and got ghosted for seven months while Cursor shipped 197+ new versions. If you're running Cursor on Windows, either sandbox your untrusted repos or have your admins set up AppLocker rules blocking execution from workspace directories until a patch drops. This one's worth paying attention to given how much access these AI IDEs have to your code, credentials, and environment. (read more)

LastPass, Bitwarden Users Targeted With Fake Security Alerts

One thing I always like putting in the newsletter is phishing campaigns like this because they are active and a good pulse on what to look out for. In this case, LastPass and Bitwarden weren't compromised at all. The attackers simply registered domains that looked legitimate and sent convincing emails warning users about, of all things, ongoing phishing campaigns and recent security incidents. The phishing email is literally warning you about phishing. It talks about enhanced security measures, updated policies, and protecting your account. Then it adds a little urgency: you have 14 business days to review and accept new terms or risk losing access to your account. "We're here to protect you, but you need to act right now."

The design is clean. The spelling and grammar are solid. The domains are convincing. Clicking the link takes victims to a DocuSign clone hosted on domains like "lastpasscompliance[.]com," complete with a chatbot and realistic branding. Eventually you get prompted to download software, which is where the malware comes in and the divergence from anything resembling real DocuSign happens. Those of us in security immediately see the red flags: urgency, account restrictions, DocuSign requests, software downloads. But for a normal user, nothing really screams "fake" here. Guards up! (read more)

White House details ‘Gold Eagle’ clearinghouse for AI cyber threats

The White House has put some meat on the bones of last month's AI executive order, unveiling "Gold Eagle" - a new federal clearinghouse for sharing AI-discovered cyber threat intelligence between government and private sector. Treasury's running point on this one, with CISA, DHS, and DoD all contributing. The idea is straightforward enough - use AI to find vulnerabilities before the bad guys do, then coordinate patching across government and critical infrastructure. They've even built a new platform called VINTS (Vulnerability Information and Coordination Environment) with Carnegie Mellon's Software Engineering Institute to receive and prioritize those reports, and apparently it's already collecting intel.

They're specifically planning to use frontier models including Anthropic's Mythos for vulnerability discovery. Which I find funny as they’ve also recently deemed Anthropic a supply chain risk and banned the government from using it, and then also a risk worthy of an export control to now allow the general public to use Mythos either. I also don’t get why gut CISA as much as we have and then recreate this program and hand it to the Treasury, but I’ll let more .gov wonks explain that one.

I’m not confident in anything this admin puts forward, so I’d look closer to Glasswing or the “Patch the Planet” initiative out of OpenAI/Trail of Bits to be more successful that whatever the hell this is. Even the press release reads like a political rally, which is signal to me that this is more sizzle than steak. (read more)

US unseals indictment against alleged operators of Russian bulletproof hosting service

The DOJ just unsealed an indictment against three Russians running Media Land, a St. Petersburg-based bulletproof hosting shop that was essentially a one-stop-infrastructure provider for some heavy hitter hackers. LockBit, BlackSuit, Play ransomware groups, plus a laundry list of stolen credit card marketplaces like BriansClub and Bidencash. The three defendants - Volosovik, Pankova, and Zatolokin - are looking at charges covering computer fraud, wire fraud, and money laundering, with 44 victims and $62 million in documented losses tied to their operation.

The indictment itself was actually filed back in December 2024, so this unsealing feels more like a public pressure move than an imminent arrest situation - these folks are in St. Petersburg with no extradition possible. The $10 million Rewards for Justice bounty is interesting though, specifically asking for info on foreign government links to their operations. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 10 minutes

Brought to you by:

Howdy friends!

The BlackHat and DEFCON calendar invites have begun. I’m sure there won’t be 7 things I try to show up in the same 3 hour block on Tuesday. Who’s all going? Should I get the cabana by the pool again for us to do a meetup?

Did you see my big announcement this week? Me and Low Level started a podcast. We’ll be shipping weekly episodes and occasional guest interviews. We do film it for YouTube but you can find it on all your favorite podcast apps.

Check it out! Subscribe to help us get it off the ground on the new channels.

YouTube
Spotify
Apple

Thanks Maze for being an awesome launch partner on this new venture. 🤘 

ICYMI

🎧️ Something I heard: The Low Down! We recorded this one at PlanetScale HQ out in SF where we were hosting a panel.

🎤 Something I said: I interviewed HD Moore about how hacking feels like its in the 90s again thanks to AI.

🔖 Something I read: Early signs of frontier cyber capabilities in Open-Weight models

Vulnerable News

Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to United States

One of the more interesting debates that came out of the recent Scattered Spider arrest wasn't actually about the alleged cybercrime itself. It was about how the suspect got caught. A lot of people latched onto the court documents discussing Microsoft's GDID identifier and immediately jumped to the conclusion that Microsoft has some secret tracking mechanism baked into Windows.

Click here for full court document

But when digging into what security researchers were saying, the reaction was almost the opposite. Several people who spend their lives tracking threat actors were basically saying, "Wait, you're surprised by this?" One of the strongest reactions came from Allison Nixon, who has spent years helping identify and track cybercriminal groups. Her argument: anonymity isn't something you have. It's something you maintain until you don't.

Nixon's comments were honestly some of the most fire takes I've seen on this story. She pointed out that the suspect allegedly sent her death threats years ago, which immediately put him on her radar. From there, she did what she does: shared intelligence with providers, incident responders, security teams, and investigators. Her broader point was that threat actors often have a completely unrealistic view of anonymity. They think they're invisible because they use a VPN, a burner account, or some OPSEC tricks. Meanwhile, the people tracking them are collecting evidence, building profiles, connecting dots, and watching patterns over the course of years. As she put it, saying you're anonymous is like saying you've won a marathon you haven't finished. The game doesn't end until your opponents either lose interest or catch you.

From my live stream here: https://www.youtube.com/live/5QmVWzh3JUs?si=h0SlCGJ8ERx08E3d&t=6260

The technical details around the GDID itself turned out to be less dramatic than some headlines suggested. Researchers such as Massgrave pointed out that the identifier is closely related to Microsoft's long-documented Passport User ID system. In other words, this wasn't some secret spyware identifier that suddenly surfaced. It was part of the ecosystem Microsoft uses to tie together accounts, devices, activation services, and telemetry. The browsing-history angle that got everyone excited also appears to have involved optional Microsoft Edge telemetry rather than some universal logging feature affecting every Windows user. The bigger story isn't that Microsoft can identify a device, but how many different systems, services, accounts, and telemetry sources can be correlated once investigators start looking. (read more here, here, here, and here)

New CTF Alert: Help Pixel Stop the Breach at the Beach!*

Looking for a fast, free way to level up your resume and data security skills?

Varonis Threat Labs created Breach at the Beach, a new CTF that drops you into a live identity breach unfolding across Entra ID and M365. As the storm rolls in, you help Pixel the cat trace an AI threat actor who is quietly abusing legitimate features to move through the environment. You'll dig through real logs and audit trails to track them down the same way threat hunters do in the field, so you can save the day and bring the sunshine back.

The best part? It's free to play, browser-based, and each stage you complete earns you a CPE credit. Finish all four stages by August 6 for a shot at a $2,000 Marriott Gift Card.

Pixel's counting on you. Grab your sunglasses and play now.

*Sponsored

Footage Shows Cop Stalking Woman He Met on a TV Set After Surveilling Her With a License Plate Reader

from my live stream here: https://www.youtube.com/live/5QmVWzh3JUs?si=7FRqGGnOIKjq4YLh&t=1872

I had to cover this one because it's such a perfect example of the privacy and surveillance conversations we keep having in cybersecurity. A Florida police officer is under investigation after allegedly using law enforcement databases and AI-powered license plate reader systems to stalk a woman he met while working security on the set of the Apple TV+ show Bad Monkey. According to reporting from 404 Media, he spent weeks harassing her, asking for her name and Instagram information, then used Florida's law-enforcement-only DMV database, called DAVID, to pull her vehicle information. From there, he allegedly added her license plate to a surveillance hot list so he would receive real-time notifications whenever AI-powered cameras spotted her vehicle. She wasn't suspected of a crime.

Click to see video

According to court records, he allegedly used government databases, automated license plate readers, surveillance alerts, and other law enforcement tools to track her movements and ultimately chase her down. At one point he allegedly told her, "I told you I'd find you and pull you over." That's an insane abuse of power. It's exactly why I roll my eyes whenever someone says we should be comfortable giving governments or corporations more surveillance capabilities because they'll only be used by the good guys. The “good guys” doing some heavy lifting here. (read more)

Felons, Fraudsters Flog Offensive Cybersecurity Startup

Krebs has a knack for finding stories that make you stop and say, "Wait, what?" This week's example is Iris C2, a self-described offensive security company that claims to sell cyber capabilities and phone-hacking services to government customers. Krebs dug into the company's background and found connections to Jacob Wohl and Jack Burkman, two political operatives better known for a long history of failed ventures, misinformation campaigns, lawsuits, and criminal convictions than cybersecurity research. Iris C2 emerged from a penetration-testing business before pivoting toward zero day peddling, with related corporate records pointing back to Burkman's lobbying operation.

One of the quotes Krebs highlighted was Wohl describing himself as highly technical and capable of building "spectacularly exquisite capabilities," despite acknowledging he has no formal education or training in computer science or information security. Maybe there's a legitimate business here. Maybe there isn't. But if you're a security researcher frustrated with bug bounty programs or looking for someone to buy your zero-days, I'd be asking a lot of questions before handing them over to a company whose founders are better known for political grift and felonies than cybersecurity. (read more)

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

Unit 42 with a great breakdown of Vidar stealer campaign they spotted spiking in April 2026. It uses malvertising which is always one of a delivery mechanism that makes my ears perk up. Pushing fake cracked software downloads - but the evasion tricks are worth noting. The loader binaries are inflated with null bytes up to 491MB (the actual malicious content is only 2.3MB) specifically to skip automated sandbox analysis, paired with a fake JustWatch code-signing certificate and an in-memory AMSI bypass. The whole thing is built on a MaaS framework called Factory-v3 that generates unique hashes per build, making hash-based detection pretty useless.

The payload is a two-fer: Vidar steals your browser creds and crypto wallets while XMRig mines Monero in the background using your CPU cycles. The operator gets a Telegram ping labeled "X3D MINER • NEW LOG" for every fresh infection. A second variant showed up April 24th swapping the fake JustWatch cert for one impersonating BleacherReport - same infrastructure, just iterating on the certificate approach. IOCs are in the full report if you want to go hunting, and defenders should prioritize stripping null byte padding before applying file size limits or you'll miss this one entirely. (read more)

Your access reviews have a 99% approval rate. That's the problem.*

If every reviewer clicks approve, the review didn't happen. Attestation fatigue is real: reviewers see 200 identical rows with no context and do the only reasonable thing. Opal's Paladin triages the queue before they ever open it — automating the routine 90% with a full audit trail, surfacing the 10% that needs a human call. Watch the on-demand demo.

*Sponsored

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

If you're running Ubiquiti gear, patch now. Ubiquiti just dropped fixes for seven critical vulns in UniFi OS, headlined by CVE-2026-50746, a max severity command injection flaw in the UniFi Connect Application. Anyone with network access could exploit it to run commands on the host device - no user interaction required. The fix is version 3.4.20, go get it.

The other six CVEs hit a wide range of Ubiquiti products - UniFi Talk, Access, Protect, their OS Server, and a bunch of routers, gateways, NAS and surveillance systems. With Censys tracking over 100,000 UniFi OS instances exposed to the internet (nearly half of them in the US), the blast radius here is significant. Worth noting that Ubiquiti gear has been a favorite target for state-sponsored groups before - Russia's GRU was caught using hijacked Ubiquiti routers as recently as 2024 to proxy espionage traffic. No confirmed exploitation in the wild yet, but given the history and the exposure numbers, that window probably won't stay open long. (read more)

OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear

This one's a fun unintended consequence story. Scammers have been hijacking .gov and .edu websites - over 2,000 of them across 80 countries - to host fake "leaked OnlyFans" pages that redirect victims to malware and scam sites. Gold mine since they can use the Google authority score from the old legit site. Plot twist! OnlyFans creators filing DMCA takedown requests are acting as a free threat detection service, with over 384,000 takedown requests helping surface compromised government sites they probably didn't even know were hacked.

UpGuard's research suggests that monitoring for adult content keywords on your .gov or .edu domain could serve as a solid early warning system for SEO injection attacks. What a weird and funny canary. One researcher noted that getting Google to remove the search results is surprisingly effective since these pages have virtually no visibility outside of search. The bulk of the DMCA requests are being fired off by one Estonian company called Rulta, which is raising some eyebrows about whether carpet-bombing compromised government sites with copyright notices is really the right approach - but hey, at least someone's finding these breaches. (read more)

Injective SDK on npm infected with cryptocurrency wallet stealer

Supply chain attacks on npm and days that end in y. This one's nasty because it targeted the Injective Labs SDK - a package with 50,000 weekly downloads used by developers building crypto wallets, trading bots, and DeFi apps. As per usual, an attacker compromised a legitimate contributor's GitHub account, snuck in malicious code on June 8, and published version 1.20.21 before anyone noticed. The good news is the real account owner caught it within minutes and pushed a clean release. The bad news is 310 downloads happened in that window, and the malicious GitHub artifacts are still sitting there.

The malware itself doesn't trigger on install, it waits until developers actually use wallet key generation or import functions, then quietly grabs the full mnemonic seed phrase and private key, bundles them up, and ships them out via HTTP POST to a legitimate-looking Injective Labs endpoint. Sneaky. If you're a developer who pulled that package, assume you're compromised - move your crypto to new wallets and rotate everything in your environment immediately.(read more)

Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images

Meta's spent a gazillion dollars on being a frontier AI lab and nobody is using their models. So why not just bake their new one into Instagram to force usage. Their new AI image model called Muse Image, and …wait for it… it's using your public Instagram photos by default to generate AI content - including letting other users @-mention your account to remix your photos into new images without notifying you. The opt-out is buried several menus deep in your settings, and here's the annoying part - anything already created with your photos before you disable it stays up. If you've got a public Instagram account, it's worth taking the two minutes to go turn that off now.

This is part of a broader trend of big tech companies quietly flipping AI training features to opt-out rather than opt-in. Google's doing the same thing with a new Search Services History setting that stores your images, audio, and video to train their models. Neither company is doing anything technically illegal here, but it’s concerning they didn’t have to. (read more)

Google pays $250K for Linux vulnerability allowing guest VM escapes

Two spicy Linux kernel vulnerabilities this week, and Google's bug bounty program had to write some big ol’ checks. The bigger one, dubbed "Januscape" (CVE-2026-53359), is a guest VM escape in KVM that sat undetected for 16 years. The short version: if you're renting a single cloud instance and have root on your guest VM, you can potentially take down or fully compromise the host machine and every other tenant on it. That's a bad day for any cloud provider. Google paid $250K for this one.

The second bug, "GhostLock" (CVE-2026-43499), is a use-after-free in the kernel's futex priority-inheritance code that's been hiding since 2011 and lets low-privileged users escalate to root. That one netted $92K from Google's kernelCTF program. Both are patched in the kernel now, so go check your distro and make sure those fixes have actually landed on your systems. (read more)

Hackers exploit Roundcube flaw to spy on academic researchers

China-linked hackers have been hitting Roundcube webmail servers at U.S. and Canadian universities since May, specifically targeting physics and engineering departments plus anyone touching astrophysics, particle physics, or national security research. Since May 2026, they've been chaining together n-day Roundcube vulnerabilities to steal credentials and drop either a webshell or VShell backdoor into server memory. The attack only requires the email to be opened in the webmail client, so the specific recipients may have been less important than the fact that those departments were running vulnerable Roundcube versions - suggesting prior recon.

Their custom JavaScript stealer (dubbed IceCube by Proofpoint) escapes iFrames, steals creds and 2FA material, then pivots to server-side exploitation via a deserialization vuln to plant a webshell. If that fails, there's a fallback that pulls down SNOWLIGHT and ultimately VShell. The tooling is verbose, well-commented, and likely LLM-assisted. (read more)

GitLost: How GitHub’s AI Agent Was Tricked Into Leaking Private Repos

Researchers demonstrated a technique they call "GitLost," showing how an attacker could abuse GitHub's AI-powered issue-handling capabilities to retrieve information from private repositories. The attack starts with a public GitHub issue. Because the AI agent automatically reads issue titles and descriptions as part of its workflow, an attacker can embed instructions that look like legitimate questions but are actually prompts designed to manipulate the agent's behavior. In the proof of concept, the researchers simply asked the agent to retrieve information from both a public repository and a related private repository that the agent had access to. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

Finally back at home. Feels good to be writing this from my own office again. Just got back from SF the other night and had a great time talking AI and security at PlanetScale HQ. Have you been to SF recently? It is like a whole other world just by reading the billboards and bus stop ads. I swear there is a whole ecosystem of companies that only exist there.

I love the city but it sure is dystopian to see someone sleeping at a bus stop where the ad is saying “Never hire another human again!” for some AI sales rep thing.

But mission escape Texas heat for a few weeks was a success. Now its time to sweat again. Speaking of sweat, Vegas summer camp plans are in full swing. Calendar is already filling up, and me and Low Level have something fun planned for you guys to come to. More details soon, eyes peeled if you’re headed to BlackHat/DEFCON.

ICYMI

🎧️ Something I heard: Michael Roytman and Ed Bellis are 2 data nerds who have thought about vulnerabilities and exploitation longer than most anybody.

🎤 Something I said: This event at PlanetScale was awesome. Really good live discussion worth watching.

🔖 Something I read: Mike Privette’s Quantum Security Is a One-Company Market

Vulnerable News

US lifting export control restrictions on Anthropic’s Mythos, Fable

Well finding security vulnerabilities is possible again! (Right? Mythos is the only thing that could do that, right?) After a few weeks of back-and-forth, Anthropic and the Commerce Department have kissed and made up over Fable 5 and Mythos 5. The models are back online for U.S. users and export controls have been lifted, after the Trump administration briefly panicked over an Amazon threat intel report claiming they'd jailbroken Fable's cybersecurity capabilities. The fix is new safety classifiers that Anthropic says will block the problematic behaviors 99.9% of the time, stress-tested by the federal Center for AI Standards and Innovation. Guardraily-er Guardrails!

Anthropic's own testing found that ChatGPT 5.5, Claude Opus 4.8, and several other existing models could do the same things that freaked everyone out about Fable in the first place. So the export controls were essentially targeting capabilities that are already widely available. Former Bush-era Commerce official Christopher Padilla summed it up pretty well, calling the administration's AI policy approach "chaotic and unpredictable" - which is a bit rich given they're simultaneously loosening export controls on advanced AI chips to China. Defensive security folks should also note that the new classifiers will likely make Fable 5 even more restrictive for routine security work than it already was. Aka not useful. (read more)

Open-Source Runtime Security Harness for AI Agents (Two-line install)*

Adrian is the open-source runtime security harness for AI agents. Five minutes from install to a continuous, independent security system monitoring your agents. While other tools watch what your agent does, Adrian also watches what it thinks and plans, blocking misalignment, prompt injection and tool abuse before they happen.

Uses a technique theorised by OpenAI and Google DeepMind, and proven to catch 4x more malicious actions than activity monitoring alone. Built by Secure Agentics, a London-based AI security startup founded by former red teamers.

Self-hosted and free, forever. (Read more)

*Sponsored

FortiBleed credential-theft campaign linked to Lynx ransomware

Turns out FortiBleed wasn't just opportunistic data hoarding. SOCRadar has now tied the whole operation directly to the INC and Lynx ransomware groups, and the scale is way bigger than originally thought. 430,000 FortiGate firewalls targeted, ~19,000 devices with actual traffic sniffers deployed, around 20 operators with defined roles, and roughly 500 servers running the operation. The smoking gun was finding browser sessions on FortiBleed infrastructure actively accessing both ransomware negotiation panels.

The technical details are pretty gnarly too - they deployed a custom tool called "FortiGate Sniffer" to intercept VPN credentials directly from network traffic, left persistent backdoor accounts under the username "adminin," and may have exploited an undisclosed Nextcloud zero-day for lateral movement. If you're running FortiGate devices, hunting for that "adminin" account is a good place to start. (read more)

Teen suspect in Scattered Spider hacks is extradited to US

Another Scattered Spider member is facing the music - Peter Stokes, a 19-year-old dual U.S.-Estonian citizen, got extradited from Finland to Chicago this week. The centerpiece of the DOJ's case is a pretty textbook Scattered Spider playbook: call the IT help desk with Google Voice numbers, social engineer a password and MFA reset, compromise three accounts in under three hours, then drop an $8 million ransom demand on a luxury jewelry retailer. They also threw in ngrok for persistent access, which is becoming a bit of a calling card for this group.

The company didn't pay the ransom, but still ate roughly $2 million in disruption and remediation costs. Stokes was originally picked up by Finnish authorities back in April following an Interpol Red Notice. This is part of a broader crackdown on Scattered Spider, a group the DOJ estimates has hit over 100 networks and collected more than $100 million in ransom payments. The arrests are starting to stack up for them. (read more)

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

New macOS infostealer just dropped and this one's got some interesting tricks up its sleeve. PamStealer poses as Maccy, a legit clipboard manager, and uses a combo of AppleScript and JavaScript for Automation to drop its Rust payload. It validates stolen passwords locally through macOS's own PAM interface rather than phoning home with unverified creds - meaning it's making less noise than your typical commodity stealer. It also holds off on triggering the Full Disk Access prompt for up to 40 minutes after launch so nothing looks suspicious right out of the gate.

The social engineering piece is solid too - it tricks users into pressing Command-R which both executes the malicious code AND bypasses macOS's quarantine attribute that normally warns you about downloaded executables. Once it grabs your password, it throws up a fake "file is damaged" error so you just shrug and move on, none the wiser. Mac defenders should be watching for processes masquerading as Finder or Software Update, especially anything running under com[.]apple.finder.core or com[.]apple[.]security.daemon. The Jamf writeup is worth a read if you want the full technical breakdown. (read more)

FBI Seizes NetNut Proxy Platform, Popa Botnet

The FBI just took down NetNut, a residential proxy service run by publicly-traded Israeli company Alarum Technologies. If that name doesn't ring a bell, you might know it better as the Popa botnet - a network of over 2 million compromised devices, mostly cheap TV streaming boxes and smart TVs, rented out to cybercriminals for ad fraud, account takeovers, and traffic scraping. Google's threat intel team noted 316 distinct threat actor clusters using NetNut exit nodes in a single week, including both cybercriminal and espionage groups.

NetNut had actually grown significantly after the FBI took down its biggest competitor IPIDEA earlier this year, so experts are hopeful this puts a real dent in the ecosystem. The practical takeaway here is worth repeating - those cheap no-name Android TV boxes flooding Amazon and AliExpress are essentially malware delivery devices. Spur found that 42% of LG webOS apps and over 25% of Samsung Tizen apps contain proxy SDKs that silently enroll your TV into these networks. Stick to name brands and verify your device supports Google's official Play Protect certification. (read more and krebs here)

When AI Invents the Attack: Browser-Native Ransomware

Researchers found something genuinely concerning - while sifting through nearly 3,000 DeepSeek-attributed malware samples, they found one where the AI independently figured out that the browser's native showDirectoryPicker() API could be weaponized for ransomware. No exploit or installation required - just a permission prompt that, as ClickFix shows us, a ton of users would click. The attacker who prompted it probably had no idea this API even existed, which is nuts. DeepSeek connected the dots between a vague malicious goal and a real browser capability on its own.

The PoC in the research is a fake AI photo tool that asks you to select a folder, encrypts your images during the fake "processing" step, and calls it a day. Worth noting this works on Android Chrome (since v132 added full File System Access support), and your DCIM folder - years of photos, banking screenshots, recovery codes - is fair game. iOS Safari doesn't expose the same API so iPhone users are in the clear here. No active campaigns have been spotted yet, but the barrier to operationalizing this is low enough that it warrants attention. Treat browser folder-access prompts like any other permission request, and maybe don't point random websites at your main photo library. (read more)

Researchers spot exploitation of another critical Oracle defect

New CVE to keep on your radar - CVE-2026-46817, a 9.8 severity hit on Oracle E-Business Suite's payments processing feature. Threat intel firm Defused caught six exploitation attempts on their honeypots over a two-hour window Saturday, all from a single IP, and this was happening before any public proof-of-concepts were even available. Shadowserver's scans show about 950 potentially vulnerable instances exposed to the internet, with more than half sitting in the US.

If this sounds familiar, it should - Clop ransomware had a field day with Oracle E-Business Suite last year, and ShinyHunters just got done tearing through PeopleSoft hitting over 100 organizations. The current activity looks more like someone testing their weaponization than an active campaign, but given the history here, patch your Oracle deployments before this gets interesting. (read more)

Ongoing password spray campaign abuses Azure CLI legacy auth flow to bypass MFA and compromise Microsoft 365 accounts.

Huntress caught a massive password spray campaign hitting Microsoft 365 that's bypassing MFA through a legacy auth flow most people forgot exists. Attackers are using old breached credentials and validating them through Azure CLI's OAuth 2.0 ROPC flow—which completely skips interactive MFA prompts because it sends creds directly to the token endpoint. Dozens of orgs thought they had MFA enforced everywhere, but their Conditional Access Policies weren't scoped to cover this flow. Tens of millions of login attempts and dozens of confirmed compromises.

The fix is pretty straightforward but requires tightening up your CAP scope. You need to enforce MFA for all users, all cloud apps, and all client types. Microsoft has a setting specifically to block ROPC sign-ins (userStrongAuthClientAuthNRequired), and you should probably restrict Azure CLI access to admins only. Also worth noting: the attacks are coming primarily from an IPv6 range tied to LSHIY LLC (AS32167), so watch your sign-in logs for ROPC attempts and weird geo patterns. If you've been relying on "trusted location" exceptions or report-only policies, those are getting exploited too.
(read more)

New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure

New CitrixBleed-adjacent vuln just dropped for NetScaler, and threat actors were already hammering it within 24 hours of public disclosure - basically the moment watchTowr published their technical writeup and detection artifact generator. CVE-2026-8451 is an out-of-bounds read in NetScaler's XML parser that leaks memory contents back in the NSC_TASS cookie, no auth required. The catch is the appliance needs to be configured as SAML IDP, but that's not exactly a rare configuration in enterprise environments.

Lupovis caught at least two separate threat actors probing their sensors, one from Frankfurt infrastructure and another from Koapu Cloud HK, both using the same playbook - probe for the right endpoint, get a 200 OK, immediately drop the payload. If you're running NetScaler as SAML IDP, patch now, and if you can't patch, disable SAML IDP until you can. Either way, go check your /saml/login traffic and NSC_TASS cookie values for anything weird - if you're already hit, you'll want to know sooner rather than later. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

Writing from rural Nevada outside Lake Tahoe. Sorry for all of you who hang out in my live streams, it’s been hard to find good internet connection in a quiet spot out here. I did stream a few times from the basement of a museum and a closed book store. You have to get creative to keep making content on the road!

I’ve also apparently fallen into this new hobby of scuba diving since my keynote at Descent Cyber and decided to bring my gear and dive in the very cold Lake Tahoe. I was very jealous of the other guy on the boat who was in a dry suit with a heater in it.

ICYMI

🎧️ Something I heard: I heard I’ll be speaking on a panel with Low Level, Clint Gibler, and Daniel Miessler @ PlanetScale HQ during the AI Engineer World’s Fair on Monday

🎤 Something I said: GitHub is not OK

🔖 Something I read: An Open Letter On Transparent AI Cyber Protections

Vulnerable News

Russian Initial Access Broker Behind FortiBleed Campaign

A Russian initial access broker has been running a credential harvesting operation called FortiBleed, targeting over 430,000 FortiGate firewalls since at least February. The attacker uses a custom Golang tool called FortigateSniffer that abuses legitimate FortiOS diagnostic commands to passively sniff authentication traffic across 24 protocols. They're SSH brute-forcing their way into exposed firewalls, capturing cleartext credentials and password hashes, then cracking and selling that access. SOCRadar estimates over 110 million credentials have been compromised through 650+ harvesting pipelines.

They're heavily focused on SMBs under 200 employees, and the operation isn't even Fortinet-exclusive despite the name. The threat actor is also hitting Sophos SSL-VPNs, RDWeb portals, MSSQL, Citrix, and grabbing RADIUS, NTLM, and Kerberos data. They successfully cracked Kerberos hashes and exfiltrated DFS backup data from a NATO-aligned defense contractor in June. SOCRadar suspects this Russian-speaking IAB might be providing access to state-sponsored groups or ransomware gangs, illustrating how initial access brokers fuel the broader cybercrime ecosystem. (read this)

The Hidden Operational Costs Slowing Down Network Teams*

Modern network operations are more complex than ever, but the work behind them is still too manual. Security teams are stuck chasing context across tools. IT teams are slowed down by repetitive operational work. The result is slower response, more friction, and duplicated effort.

Tines’ new guide explores how IT and security teams can move faster with fewer manual steps, clearer audit trails, and better operational visibility. Inside, you’ll learn practical ways to streamline incident response, change management, network troubleshooting, and more.

Get the guide

*Sponsored

Password manager maker LastPass says hackers stole customer support case data during Klue breach

LastPass with another breach, though this time it's not directly their fault. A market research firm called Klue got hit by an extortion group named Icarus, and since LastPass uses them via their Salesforce integration, customer names, phone numbers, email addresses, physical addresses, and support ticket data all got swept up in the theft. No password vaults were touched this time, which is an important bit.

That said, support ticket data is nothing to brush off - those records tend to contain sensitive fragments like account recovery info and billing details. And given LastPass's 2022 breach where entire encrypted vaults were stolen and later cracked, their customers are understandably a little jumpy. Klue seems to have a big blast radius with HackerOne, Recorded Future, and Tanium are also in the affected list. Icarus is threatening to release the data if ransom isn't paid, so this one's still developing. (Read more)

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer

Trend Micro dropped a pretty detailed writeup on a cryptomining campaign targeting Langflow, the AI workflow builder. CVE-2026-33017 is an unauthenticated RCE in Langflow's API that lets attackers just POST a Python payload to a public endpoint - no auth required. From there, a shell script drops a Go-based miner called lambsys that goes full scorched earth: kills rival miners, disables AppArmor, SELinux, and UFW. It then spreads laterally via SSH key reuse to every host the victim can reach. If you're running Langflow exposed to the internet, especially as root on infra with broad SSH access, you've had a bad time.

The malware traces back to a 2019 KORKERDS dropper called is[.]sh, and this one's named isp[.]sh - same SSH worm pattern, same userdel commands for rival miner accounts. The operator has been quietly iterating this toolchain since at least May 2024 with near-zero public visibility. The fix is straightforward - update Langflow to 1.9.0 and stop exposing it to the public internet. (read more)

Scattered Spider Hackers Plead Guilty on Day 1 of Trial

Two Scattered Spider members, Thalha Jubair (20) and Owen Flowers (18), saved everyone a six-week trial by pleading guilty on day one in the UK. These two were behind the 2024 Transport for London attack, but that's almost the least interesting thing about them. Jubair co-ran a SIM-swapping Telegram channel called Star Chat, was allegedly behind the massive 2022 SMS phishing campaign that hit 130+ organizations including LastPass and Signal, and was selling fake emergency data requests to extract user data from tech companies - all starting at age 15. Flowers, meanwhile, is reportedly the guy who gave those anonymous media interviews bragging about the MGM and Caesars casino hits back in 2023.

The Scattered Spider takedown is slowly but surely wrapping up. Noah Urban already got 10 years last August, Tyler Buchanan pleaded guilty in April and is awaiting sentencing, and three more members still have charges pending. Jubair is also staring down a separate New Jersey federal indictment covering 120 network intrusions across 47 US companies with $115 million in ransom payments. Sentencing for Jubair and Flowers is set for July 15th in London, but something tells me the US will want their turn after that. (read more)

Is Your Attack Surface Ready for the AI-Attack Era?*

AI-generated exploits don't need sophistication, just a gap you don't know exists.

runZero knows every asset, finds every exposure, and maps every attack path across IT, OT, IoT, cloud, and mobile, then prioritizes the vulnerabilities most likely to be exploited and verifies they're remediated. No agents. No credentials.

Defenders win by default. Even against AI. They also offer a 21-day free trial, so go test it out. (read more)

FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances

Nasty one dropped for FFmpeg - CVE-2026-8461, dubbed "PixelSmash," is a heap out-of-bounds write in the MagicYUV decoder that allows RCE via crafted media files. Given that FFmpeg's libavcodec is basically everywhere - video players, media servers, NAS devices, cloud transcoding pipelines - the attack surface here is massive. JFrog confirmed successful exploitation against a pretty impressive list of targets including Jellyfin, Emby, Nextcloud, Immich, Kodi, OBS Studio and more.

The delivery mechanism is a 50KB AVI, MKV, or MOV file that requires zero authentication to trigger. On the server side it fires when a file gets uploaded and auto-processed, and on desktop it can even trigger just by browsing to a folder containing the file if your file manager uses ffmpegthumbnailer for thumbnails. There's even a zero-click torrent attack path if the victim auto-downloads into a monitored media library. Patch to FFmpeg 8.1.2 now, but in reality you’re not the one that needs to upgrade it as its embeded in so much. Watch for patch notes …everywhere this week. (read more)

WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool

Kaspersky's flagging an active campaign spreading malicious VBScript files through WhatsApp, hitting users across Malaysia, Brazil, India, and several other countries. The attack is pretty straightforward social engineering - compromised WhatsApp accounts are being used to send contacts what look like business and financial documents ("Financial Reports.vbs"). Once opened, it kicks off a multi-stage infection chain that ends with ManageEngine RMM Central getting installed on the victim's machine, handing the attacker remote access. The campaign's got some interesting obfuscation techniques, with the VBScript files stuffed with fake Windows Update metadata and comments written in Chinese.

Attribution is still up in the air, but Kaspersky found infrastructure overlaps with Gh0st RAT and ValleyRAT activity. The infection chain also behaves slightly differently depending on whether you're using WhatsApp Web vs the Desktop app - in the Desktop version, WhatsApp itself spawns the malicious WScript process, which is a neat trick. Standard advice applies here: if you weren't expecting a file attachment, even from a known contact, don't open it - especially anything ending in .vbs, .js, .ps1, or .bat. (read more)

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

Microsoft dropped a detailed threat intel report on an active campaign specifically targeting hotel and hospitality staff. Staff are getting phishing emails through Calendly's notification infrastructure (which neatly passes SPF/DKIM/DMARC checks) with lures like bedbug complaints and guest reviews, leading them to download what looks like a photo ZIP. Inside is a fake .png shortcut that kicks off an obfuscated PowerShell chain, ultimately dropping a Node.js implant for C2 persistence. The attacker has been actively evolving their PowerShell obfuscation through seven distinct phases since April 2026, which is a good sign they're watching for detections and adjusting.

What makes this one worth paying attention to is the dual persistence mechanism - they're using both HKCU\Run for the Node.js implant and a RunOnce loop for the PE payload that keeps repopulating itself. Microsoft confirmed that even after Defender blocked the PE payload on a compromised device, the Node.js persistence survived and resumed beaconing two days later. If you're in the Defender/Sentinel world, Microsoft dropped a full set of KQL hunting queries in the article worth grabbing. The campaign is dubbed TonRAT internally, and attribution is currently unknown. (read more)

macOS Weaknesses Chained to Silently Disable Endpoint Security Agents

XM Cyber just showed how a regular macOS user — no admin rights needed — can silently kill enterprise security tools like EDR and MDM agents. The attack chains together some older known primitives (abusing XPC connections and NIB file injection) with a clever new trick: exploiting how the kernel's code-signing trust cache sticks around after a legit signed app runs. Basically, you can inject malicious code that the system still trusts as if it's the real deal, then use it to call privileged functions that shut down security tools.

They demo'd this against CrowdStrike Falcon (completely unloaded it) and Kandji MDM (permanently killed it in two stages). CrowdStrike paid out a bounty and added detection, Kandji patched and got CVE-2026-39118, and a third unnamed EDR vendor is working on fixes. XM Cyber is dropping an open source tool called XPC Hunter at Black Hat 2026 that'll help find these exploitable XPC surfaces across all your installed apps, which should be fun for both sides of the aisle. (read more)

Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

Source: Mandiant

Mandiant caught a threat actor exploiting a zero-day (CVE-2026-20245) in Cisco's SD-WAN Manager to escalate from admin to root access at a service provider. The attack chain started with rogue peering connections—possibly leveraging two other critical auth bypass vulns (CVE-2026-20127 and CVE-2026-20182) that weren't patched yet, or stolen certificates from an earlier compromise. Once in via SSH, the attacker toggled the default admin password back and forth to stay under the radar, then dropped a malicious CSV file called "evil_tenant.csv" through a file upload feature that didn't properly sanitize input. The CSV created a root-privileged account called "troot" by injecting entries into /etc/passwd and /etc/shadow.

The attacker deleted artifacts, restored original configs, and ran a validation script to confirm all traces were scrubbed. They backed up files before modification so the device wouldn't throw alerts from broken configs. This is "living off the edge" tradecraft where network appliances become prime targets because they lack the logging depth for forensics while sitting at the perfect chokepoint for long-term intelligence collection. Cisco's pushed patches (20.9.9.2, 20.12.7.2, and newer versions), and if you're running SD-WAN infrastructure, now's the time to pull admin-tech logs and hunt for suspicious peering connections, rapid-fire password changes, or unexpected su commands to non-standard accounts. (read more)

Third DraftKings Hacker Sentenced to 18 Months in Prison

The third and final defendant in the 2022 DraftKings credential-stuffing attack just got sentenced. Nathan Austad, aka "Snoopy," is heading to prison for 18 months and has to fork over $1.8 million in restitution and forfeiture. The crew used credentials from other breaches to access 60,000+ accounts, then drained funds or sold the accounts off.

They were apparently joking about the FBI investigation in their own messages while still committing the crimes. All three are now convicted: Garrison got 18 months back in 2024, Stokes got 30 months in April, and now Austad wraps it up. Turns out the FBI could, in fact, do something about it. (read more)

Miscellaneous mattjay

I love this twitter account, but this might be it’s magnum opus

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

Out west a few weeks - speaking at some events. One of the major topics people are asking about is of course the Mythos and Fable restrictions from dot gov. I had to get creative with my live streaming locations this week including the basement of a museum and a book store that was closed today. In search of good wifi and a quiet corner.

As a native New Yorker it certainly has been hard to avoid getting caught up in the energy of the Knicks victory. Between that and the World Cup it is straight up emotional for me watching people come together in community like that. It’s something we all crave and I’m glad this time crowds chanting on the streets is for joy.

I’ll be at AI Engineering World’s Fair next week and I’m looking forward to talking to the group there as it will largely be out of the infosec echo chamber. (I mean… not that AI engineering isn’t it’s own echo chamber, but at least it’s not MY echo chamber).

ICYMI

🖊️ Something I wrote: This will accelerate the open weight models reaching “Mythos tier” capabilities.

🎧️ Something I heard: LowLevel’s take on the Mythos/Fable situation

🎤 Something I said: I talked to the hackers that found a nation state 0day

🔖 Something I read: Absolute tragedy for the Austin tech scene - Josh, the founder/CEO of Capital Factory killed in a plane crash

Vulnerable News

An Open Letter On Transparent AI Cyber Protections (and More Mythos Madness)

The Mythos conversation has gotten a little ridiculous. At this point, every cybersecurity discussion starts and ends with Mythos, Fable, Project Glasswing and the coming “AI vulnerability apocalypse”.

I've joked that people are treating Mythos like a skeleton key for the internet. I interviewed HD Moore about it, and that's essentially how he described the concern: a model that isn't just good at finding vulnerabilities but is also capable of reliably writing exploit code. That's the capability jump everyone is focused on, not vulnerability discovery by itself. AI has been helping find bugs for a while. The concern is what happens when exploit development becomes dramatically easier and more accessible.

Anthropic's guardrails were so aggressive at launch that researchers were reporting they could barely discuss cybersecurity topics without triggering safety controls. That's what sparked the "Free Mythos" movement. If these models truly represent a step-function increase in capability, some people argue that locking them away behind a small group of approved users creates an unfair and potentially harmful asymmetry. Katie Moussouris and others have gone further, arguing that concentrating access among a privileged few may actually create more risk than it reduces.

Source: Luta Security

Even if Anthropic, OpenAI, and others successfully gate frontier models today, it's hard to see how that remains sustainable. Alex Stamos and others are pointing out that open-source models are advancing rapidly and could reach comparable capabilities in less than a year. If that's true, then much of the current debate becomes temporary by definition. All of the discussions about trusted access programs, Glasswing participants, and restricted model availability may ultimately be overtaken by open models that anyone can download and run. If the capability is coming regardless, the question shifts from containment to preparation.

Source: Alex Stamos on LinkedIn

That's why I keep coming back to the same conclusion. While everyone is debating Mythos, the security industry still has the same problems it had yesterday. We're still seeing supply chain compromises, credential theft, phishing campaigns, malicious browser extensions, and years-old security failures succeeding every day. The AI super hacker hasn't replaced those threats. Cybersecurity didn't suddenly become obsolete. If Mythos-class models eventually make exploitation easier, we'll adapt and deal with that too. But for now, defenders still have vulnerabilities to patch, identities to protect, and incidents to respond to. The vulnerability apocalypse may or may not arrive. In the meantime, cybersecurity still looks a lot like cybersecurity. (read more here, here, and here)

Deepfake attacks surged 50x. Are your security defenses ready?*

We’ve seen deepfake attacks surge 50x, yet 85% of CISOs say they lack GenAI-ready incident response plans. Workforce security is no longer about if you'll be targeted, but whether you're prepared.

Persona verifies employees, contractors, and vendors in seconds — automating identity checks to eliminate manual work and stop impersonation attacks before they spread. Integrate Persona's Workforce IDV solution with your existing security tech stack to verify who’s actually behind every login, device, and network. (read more)

*Sponsored

Accenture Shells Out $4.18B On Three Companies in Big Industrial Cybersecurity Push

This is one of those deals that makes the entire cybersecurity industry stand up and pay attention. Accenture is acquiring a majority stake in Dragos and bringing runZero and NetRise under the same umbrella, creating a combined OT and asset intelligence powerhouse. What makes this story fun for me personally is that these aren't random companies. runZero founder HD Moore is a longtime industry legend who was literally just on my YouTube channel. NetRise founder Tom Pace is someone I run into at the gym. These are companies built by people who have spent years grinding in the security community, and now they're part of a deal valued at roughly $4.2 billion. That's a massive validation not just for the companies involved, but for the broader cybersecurity startup ecosystem. (also both Austin founders!)

I don’t normally cheerlead investment round raises or acquisitions but this one is too close to home and too good for the security community. The founder/creator of Metasploit winning is just a win for all of us. Way to go HD, Tom, Rob and all your teams. (read more)

FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices

The latest Fortinet stories are a perfect example of why I struggle to get excited about AI-generated exploits, when the industry is still drowning in known vulnerabilities. Researchers uncovered what appears to be a massive credential dump affecting roughly 73,000 Fortinet VPN devices.

The dataset reportedly contains usernames, email addresses, and plaintext passwords, along with organizational details that could help attackers prioritize targets. Some researchers who reviewed the data say they've been able to verify at least some of the credentials as authentic. The most concerning detail is that the information appears to have come from exported FortiGate configurations, raising obvious questions about how attackers obtained them in the first place. Unclear by my money is on an 0day.

At the same time, Fortinet is once again dealing with active exploitation of recently disclosed vulnerabilities. Researchers observed attackers exploiting critical FortiSandbox flaws shortly after patches became available, while older Fortinet vulnerabilities continue to be abused years after disclosure. (read more here and here)

Google Exposes China Espionage Group That’s Been Lurking in Networks Undetected Since 2023

This is the kind of story that actually keeps me up at night, not because it's particularly novel, but because it reinforces something we've been hearing for years from U.S. intelligence agencies and law enforcement. The FBI has repeatedly warned that Chinese threat actors are sitting inside critical infrastructure environments, maintaining access, and in many cases not doing anything immediately disruptive. Google's reporting traces activity back to at least September 2023, with attackers establishing persistence, deploying credential theft tools, upgrading malware, and maintaining access over long periods of time.

What stands out in Google's report is that the tradecraft itself isn't especially exotic. The malware capabilities look familiar: credential harvesting, backdoors, command-and-control infrastructure and data exfiltration. The operators clearly invested heavily in operational security, routing traffic through compromised routers, residential proxy networks, VPS infrastructure and U.S.-based systems to make attribution and detection more difficult.

The part that surprises me is the dwell time. If the earliest known compromises date back to 2023, how do organizations fail to notice activity for that long? Some of that is undoubtedly a testament to the attackers' opsec. But some of it is also the reality that many critical infrastructure operators don't have massive security budgets, dedicated threat hunting teams, or twenty-four-hour security operations centers. These aren't always Fortune 100 companies with unlimited resources. They're often organizations running essential services while trying to manage increasingly complex threats with limited personnel and funding.

Chinese espionage groups aren't succeeding because they have some mythical capability that nobody else possesses. They're succeeding because they're patient, disciplined, and often operating against organizations that can't afford perfect security. (read more here and here)

80% of Organizations Are Sitting on Access They Forgot Existed*

Every company has it. Former employees, old service accounts, permissions that were supposed to be temporary and never got cleaned up.

Opal Security analysed provisioning data across thousands of systems and found that 80% were exposed through stale entitlements. As AI agents start requesting access to more systems, those forgotten permissions can turn into a much bigger problem.

See what AI-ready security teams are doing differently in Opal's 2026 report. (read more)

*Sponsored

Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign

This is one of the more clever ClickFix-style campaigns I've seen lately because it abuses something people already trust: shared AI chats. Researchers found attackers buying ads that redirected victims to publicly shared Claude AI conversations. The victim thinks they're clicking on a helpful AI-generated guide, maybe instructions for installing software or fixing a common problem, but the shared chat has been crafted to display malicious commands. The user follows what appears to be legitimate AI advice, opens a terminal window, pastes the commands, and unknowingly downloads malware. (read more)

Texas Government Data Breach Allowed Hackers to Steal 3 Million Driver’s Licenses and Passports

This Texas breach immediately gets my attention because of the type of data involved. A lot of breach disclosures talk about names, email addresses, phone numbers, and physical addresses being exposed, and honestly, I've become a little numb to those at this point because so much of that information is already floating around online. Driver's licenses and passport data are different. That's identity theft gold. According to reports, attackers accessed data tied to roughly three million records through a Texas government system used to manage licenses and permits. When you start talking about government-issued identity documents, you're talking about the exact kind of information criminals need to convincingly impersonate someone in the real world.

The reason this hits home for me is that I've dealt with identity theft myself. In my case, someone created a physical copy of my driver's license with their photo attached and tried to finance a Corvette in my name. (read more)

I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

A researcher nearly became the most chaotic villain in sports history. By registering as a FIFA football agent - just uploading your ID to a public portal - you'd get added to FIFA's Microsoft Entra tenant. From there, while the frontend apps dutifully showed "access denied" pages, the backend APIs didn't check anything. The Football Data Platform handed over live RTMP stream keys, camera feeds, and full broadcast controls for every World Cup match. They confirmed it was live by pulling a tactical camera feed into VLC. Every match. Every camera angle. One click from killing a live broadcast. (read more)

152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic

Researchers at Socket uncovered a network of 152 Chrome extensions masquerading as anime-themed live wallpapers that collectively accumulated more than 105,000 installs. Under the hood, they were doing far more than changing your browser background. Built from a shared codebase and distributed across dozens of publisher accounts, the extensions generated fraudulent web traffic, manipulated search activity, performed ad fraud, and included anti-forensics techniques designed to make analysis more difficult.

Chrome extensions are just a thing I’ll never be able to stop talking about. (read more)

Nintendo, Third-Party Program Hit By Cyberattack for $2M Ransom

The interesting part of this story isn't really Nintendo, but the third-party risk angle. According to reports, a ransomware group is demanding $2 million after compromising TinyPulse, a service Nintendo used for internal employee surveys. The attackers claim to have stolen roughly 859 megabytes of data, including employee names, email addresses, survey responses, bank statements, and W-9 forms. Nintendo says its own systems were not compromised and that no customer financial data was accessed. Instead, the exposure appears limited to information held by the third-party provider, much of which Nintendo says is several years old. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

Anyone else in full summer brain? Just me because I spent the weekend scuba diving? Let me say this about Descent Cyber - the organizers put on a masterclass in throwing an event that balanced great cybersecurity content, heavy hitters from our industry, and camaraderie through diving together. It was an extremely well thought out and planned event that I’ve already committed Vulnerable U to sponsor again next year. Do recommend for the divers or dive curious.

Opening Keynote

In a ship wreck 60ft below

ICYMI

🖊️ Something I wrote: MSRC couldn’t possibly do anything worse this week… oh. Oh ok.

🎧️ Something I heard: Blink 182 dropping updates on MySpace - as someone who was a Blink super fan and MySpace power user, it’s a big week for me. They’re teasing a 25 yr anniversary tour.

🎤 Something I said: Meta Built the Dumbest Hack in Instagram History

🔖 Something I read: I’ve been quoting this blog every day since I read it. Cloudflare’s Project Glasswing: what Mythos showed us

Vulnerable News

Anthropic’s New Model: Mythos On A Leash

For all of you who hang out in my live streams, you know I was hitting that MYTHOSSSS (spoken like Star Trek KHANNNN) sound button a ton this week. That’s because it has escaped the lab! Well sort of. Anthropic has now broadly released Fable 5, its public-facing “Mythos-class” model, and the reaction I'm seeing is a mix of excitement, confusion, and frustration. The marketing narrative is still very much that Mythos was so powerful it needed to be carefully contained before being released to the public.

Meanwhile, the actual experience many people are having is running headfirst into guardrails. In some cases, users report that simply mentioning cybersecurity-related topics is enough to trigger restrictions, model downgrades, or redirects to safer behavior. If Mythos escaped the lab, it appears to have done so while wearing several layers of bubble wrap.

What's becoming clearer is that Anthropic is taking an unusually aggressive approach to controlling how Fable 5 is used. Beyond the cybersecurity restrictions, the company has confirmed that it will actively limit the model's usefulness for certain frontier AI development tasks. These interventions aren't always visible to users. Anthropic says it may modify outputs or reduce effectiveness for requests related to building competing frontier models, training infrastructure, or AI acceleration research. At the same time, the company expanded data retention policies around Fable usage, citing safety and compliance requirements. That's generating almost as much discussion as the model itself.

My takeaway remains about the same as it was when Mythos launched. I believe the underlying capabilities are real because I've talked directly with people involved in Project Glasswing who have seen the model find vulnerabilities and security issues that other tools missed. And exploit/PoC development are definitely boosted. (read more here, here, here, here and here)

Time-to-exploit is down to one day. Now what?*

Intruder analyzed 3,000 organizations' attack surfaces. Top finding: more teams should be asking 'does this actually need to be on the internet?’

There’s no better time to ask it. AI can now find zero-days autonomously and time-to-exploit has shrunk to a single day. Anything on the internet that doesn't need to be is a target the moment a new CVE drops.

In the report:

• What are the most common attack surface exposures?

• How long are organizations taking to fix them?

• How does your industry compare?

Get the report now.

*Sponsored

Measuring LLMs’ Impact On N-Day Exploits

Anthropic with some sobering research on how their latest Claude model can automatically weaponize patches. Their most capable model, Mythos Preview, turned 18 recent Firefox security patches into 8 working exploits, with the first one ready in under an hour. On the Windows side, it cranked out 8 full privilege escalation exploits from kernel patches, basically going from low-privilege user to full SYSTEM control for about $2,000 in API credits per exploit.

This flips the traditional patch gap timeline on its head. Where it used to take expert reverse engineers weeks or months to develop N-day exploits, we're now looking at hours. WannaCry hit 59 days after the patch was available. Mythos Preview would have had working exploits ready before most organizations even started their patch rollouts. The implications for anything that patches slowly - IoT devices, industrial systems, medical equipment - are pretty grim. (read more)

Mini Shai-Hulud, Miasma and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels

We've officially lost the plot on supply-chain attack names. We now have Mini Shai-Hulud, Hades, Miasma, and whatever comes next. Underneath the increasingly ridiculous naming convention, though, there's a real evolution happening. Socket's threat research team caught the campaign evolving again, this time with 23 new malicious PyPI packages targeting bioinformatics and MCP developers. These attackers keep switching up their delivery methods - some packages now hide malicious code in compiled native extensions that execute at import time, while others use typosquats like "rsquests" and "tlask" to catch typos. The standout is langchain-core-mcp, which installs a loader that searches your entire sys.path for _index.js payloads, meaning the malicious code doesn't even need to be in the same package.

These aren't just random packages either - they're targeting real scientific computing tools like embiggen, gpsea, and pyphetools that researchers actually use. Once executed, the JavaScript stealer grabs everything from GitHub tokens to cloud credentials, SSH keys, and Docker configs.

The funniest part of this entire report was that the malware includes fake system instructions and policy-triggering text embedded in comments that don't affect execution at all but appear designed specifically to confuse AI-powered security tools and analyst copilots. The runtime ignores it, but an AI scanner might not. (read more)

Handala (Iran) Claims Breach of California Water Service

Handala just hit California Water Service pretty hard, dumping 5GB of customer data and internal credentials as their latest hack. The Iranian group managed to breach both the billing system (grabbing customer PII across multiple districts) and an internal RTKBase GPS correction network that field crews use for precision mapping. They got administrative credentials for the GPS network and essentially mapped out the entire infrastructure across seven service districts.

This isn't just a data grab - Handala's known for escalating to destructive attacks after their initial claims, and they've got custom wipers in their toolkit. Same group that hit Stryker medical and wiped everything they could.

The RTKBase system probably served as their entry point, which makes sense since these GPS correction systems often run on basic hardware with weak authentication. Water utilities everywhere should be checking if their survey equipment is internet-exposed right about now, especially since this fits the pattern of Iranian groups specifically targeting US water infrastructure that we've been warned about. (read more)

80% of Systems Are Exposed Through Stale Access. Here's the Fix.*

Stale entitlements create an open door. Opal analyzed real provisioning data across thousands of systems and found 80% exposed through access that was never revoked. When AI agents start requesting infrastructure access at scale, that surface compounds fast. Opal's 2026 report has the data on what AI-ready teams did differently.

Read the report.

*Sponsored

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

ShinyHunters just pulled off a pretty impressive campaign targeting Oracle PeopleSoft systems with a zero-day exploit (CVE-2026-35273). Between late May and early June, they hit over 100 organizations - mostly universities and colleges - using a critical RCE (9.8 CVSS). They were exploiting this before Oracle even knew about it, making it a proper zero-day until the patch dropped on June 10th.

These guys set up staging servers with MeshCentral agents disguised as Microsoft Azure services, complete with SSL certs for "azurenetfiles[.]net" to make it look legit. But here's where it gets sloppy - they left their staging directories wide open, exposing command histories, custom lateral movement scripts, and their bash history showing exactly how they mapped internal networks and exfiltrated data. Mandiant caught wind and started warning potential targets, but some organizations still got breached and had their data posted on the ShinyHunters leak site. (read more)

ServiceNow Customers Hit by Unauthorized API Access – And the Company Knew for Months

After days of speculation driven by customer reports on Reddit, ServiceNow disclosed that attackers exploited a vulnerability that could allow an unauthenticated user, under certain circumstances, to gain greater access to customer instances than intended.

Turns out they had an API endpoint sitting there configured with 'requires_authentication=false'. The vulnerable endpoint '/api/now/related_list_edit/create' let unauthenticated users query customer instance data, which could include all sorts of juicy enterprise info like support tickets, employee records, and internal docs. They quietly patched it on June 5th, but not before attackers (or maybe bug bounty researchers) had some fun with it.

ServiceNow received a confidential bug bounty submission about this exact issue back in April, but didn't bother fixing it until June when they spotted "anomalous activity.” Now they're saying it was probably just researchers poking around rather than actual bad guys, but that's a pretty generous interpretation considering the two-month delay between disclosure and fix. If you're running ServiceNow, definitely check your logs for requests to that endpoint and maybe rotate any credentials that might've been exposed in support tickets. (read more here, here and here)

Phishing for Lobsters: How Varonis Tricked OpenClaw into Spilling Secrets

If anyone thought AI agents were going to be immune to phishing attacks, this research should put that idea to rest. The Varonis team connected an OpenClaw agent to Gmail, gave it access to Google Workspace, and told it to monitor and process incoming emails.

The most brutal example was when a fake "Dan" emailed asking for staging credentials during a supposed production emergency. Pinchy (their agent) not only fell for it but helpfully forwarded AWS keys, database passwords, and SSH access to an external Gmail account. Even their "strict" security configuration failed because the agent prioritized being helpful over verifying who was actually asking. The researchers point out this flips the phishing game - low-effort technical attacks become less effective, but context-heavy spear phishing becomes way more dangerous since every inbox now has an autonomous system trained to retrieve information and act immediately. (read more)

New Github Account MSNightmare Posts Windows Defender Exploit With PoC That Works on Windows 11 and 10.

Another day, another Microsoft Defender zero-day from the prolific researcher "Nightmare Eclipse." This latest one, dubbed "RoguePlanet," is a race condition bug that can grant SYSTEM privileges on fully patched Windows 10 and 11 systems. It dropped just hours after Microsoft's June Patch Tuesday fixed two other flaws from the same researcher. ThreatLocker confirmed it works on the latest builds, though success rates vary depending on the machine.

The backstory here is getting messy. Nightmare Eclipse originally developed this as a remote code execution exploit targeting Defender's handling of SMB shares, but Microsoft quietly hardened the system in May, forcing a rewrite down to just local privilege escalation. This is all part of an ongoing feud between the researcher and Microsoft over bug bounty practices and disclosure policies. Microsoft's been nuking their repositories on GitHub and GitLab, even threatened law enforcement action, so now they're hosting exploits on their own platform.

I’m also hearing some chatter that Nightmare Eclipse is an ex-Microsoft insider, so the legal battle might be way more than the public knows. (read more here, here and here)

Expanding Private Cloud Compute

Apple announced important info about expanding their Private Cloud Compute beyond their own data centers. They're now partnering with Google Cloud and NVIDIA to run the more demanding Apple Intelligence workloads while supposedly maintaining their hardcore privacy commitments. The collaboration includes leveraging Google's Gemini tech to build the next-gen Apple Foundation Models, which is a fascinating shift from Apple's usual "we do everything ourselves" approach.

What's particularly noteworthy is how they're trying to have their cake and eat it too - running AI workloads on third-party infrastructure while claiming the same security guarantees as their own silicon. They're using NVIDIA's Confidential Computing, Intel TDX, and Google's Titan chips as the foundation, but they're adamant that Apple retains complete control over the PCC software stack. The real test will be whether their transparency promises hold up - they say they'll publish binaries for public inspection and maintain their security research program. Color me curious to see how this plays out in practice. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 9 minutes

Brought to you by:

Howdy friends!

Writing you from a balcony in Grand Cayman. What started as a little newsletter I made to get back into content creation after leaving my tour in big finance where it wasn’t allowed has really turned into something crazier than I anticipated. Vulnerable U was just a way for me to blog again and talk about current events and things I was passionate about like mental health, personal development, and helping security practitioners be the best they can be.

Now I’m here giving a keynote at a conference abroad with our logo all over the place as one of the sponsors. Just really grateful in this moment that I can employ a team and support the industry all based on what started right here. Literally in this text box.

The other lesson here is - you can just do things. I didn’t ask anyone’s permission to start this, nor did I wait for someone to tell me it was a good idea. I just started 171 weeks ago and haven’t stopped. What do you think if you did for 171 weeks straight would change in your life? I don’t want to be some bullshit lifestyle influencer, but it is hard to not have that reflection in this moment. Thanks for indulging the cringe and honestly we should all lean into a little cringe from time to time.

ICYMI

🖊️ Something I wrote: Been working hard for the last few weeks getting PADI scuba certified.

🎧️ Something I heard: Maybe we were wrong - Primeagen

🎤 Something I said: Microsoft is threatening researchers

🔖 Something I read: Jen Easterly’s take on the AI executive order

Vulnerable News

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts

What could possibly go wrong when you give an AI help desk chatbot write access over everyone's account, including password reset functions? Apparently …everything! Over the last few days, Instagram was vulnerable to a remarkably simple attack where people could convince Meta's AI support assistant to send password reset information to a brand-new email address that wasn't associated with the account at all. This wasn't some advanced AI jailbreak or cutting-edge hacking technique. The AI was just being helpful in exactly the wrong way.

Source: KrebsOnSecurity

The attack itself was almost laughably simple. Attackers connected to a VPN in roughly the same geographic region as the account owner, opened a chat with the AI support system, claimed they had lost access to their account, and asked for verification information to be sent to a new email address. In many cases, the AI simply complied. Some attackers even used anonymous one-time email services and still received account recovery codes. Once they had access, they followed a well-rehearsed playbook: reset the password, terminate active sessions, delete backup codes, and take complete ownership of the account. (read more)

AI will make every asset a potential zero-day target. Are you ready?*

The AI-attack era has arrived. Thousands of zero-days in the pipeline. Target-specific exploits generated in minutes. Unattributed, one-off attacks that bypass detection - while your dashboard stays green.

runZero is built for this reality. Know every asset on your attack surface, uncover every exposure, map every attack path, and validate your segmentation - before the exploit drops. We deliver deep intelligence across IT, OT, IoT, cloud, and mobile, so defenders can win by default. Even against AI.

Try It Free Today

*Sponsored

AI Agents Are Now Undoing Security Protections They Run Into That They Don’t Like

This AI agent found a security protection that was put in place to make sure that it didn't install malware and it turned it off. If you guys have seen any of my videos on all of the NPM worms, PyPy worms, all the giant malware that's going around right now in the software supply chain, one of the main recommendations for people is to set your minimum release age to seven days. Give all the packages that show up on npm a bit of time for the security community to find the malware. Then you download it a few days later to catch any updates for any security bugs that might be in the software.

Well, this is a screenshot from Cursor, which is an AI coding IDE, which said, 'Hey, by the way, I noticed that your pnpm policy has got this minimum release age thing set to seven days, which is too slow in my personal AI agent expert opinion. You're missing super useful features at speed. So I went ahead and set that back to zero.” Uh, you did... What?

Chinese spies are using LinkedIn to lure Westerners into sharing sensitive information

Five Eyes intelligence agencies are sounding the alarm about a pretty slick Chinese recruitment operation that's been going after government and military personnel through fake job postings. Chinese military intelligence is basically running a catfish scheme on LinkedIn, Indeed, and Upwork - posing as HR reps from legit-looking consultancies and think tanks to lure people with security clearances. They're not just going after the obvious targets either; academics, journalists, and anyone with even peripheral access to government info are fair game.

The playbook is methodical: start with a normal-looking job ad, conduct virtual interviews while probing for access levels, then gradually escalate from "write us a harmless report on China's bilateral relations" to "hey, can you share some classified stuff?" They're paying anywhere from hundreds to thousands per report through PayPal, crypto, and other platforms. What's particularly crafty is how they eventually move conversations to encrypted messaging apps once they've got someone hooked. If you've got a clearance and you're getting unsolicited job offers that seem too good to be true, they probably are. (read more)

WhiteHouse: Executive Order - PROMOTING ADVANCED ARTIFICIAL INTELLIGENCE INNOVATION AND SECURITY

Trump dropped a new executive order on AI cybersecurity that's got some interesting moves. The big theme is "America First" AI dominance while ditching what he calls the "bureaucratic constraints" from the previous administration. Key highlights include setting up an AI cybersecurity clearinghouse run by Treasury, expanding the Tech Force hiring pipeline, and creating a voluntary framework where AI companies can get their frontier models assessed by NSA before release.

What's catching attention is the "covered frontier models" classification system - basically a way to flag advanced AI systems that could have serious cyber capabilities. Companies can voluntarily submit their models for a 30-day government review before release, but notably there's explicit language saying this isn't creating a mandatory licensing system. (read more)

The attacker's playbook has changed. Do we even stand a chance?*

Data breaches don't start with malware, they start with trust. Varonis Threat Labs mapped how attackers are exploiting identity, AI, and cloud workflows at every stage of the kill chain, from Cookie-Bite MFA bypasses to AI copilots leaking sensitive data with a single prompt. If you're defending modern infrastructure, take a look to understand how threats are actually getting in. (read more)

*Sponsored

New IronWorm malware hits 36 packages in npm supply-chain attack

Another day, another npm supply-chain attack. This time it's IronWorm, a Rust-based infostealer that managed to hit 36 packages before getting squashed. The malware hides behind an eBPF rootkit, phones home over Tor, and targets things you’d expect, OpenAI keys, AWS creds, and SSH keys. It self-propagates by stealing npm publishing credentials and then pushing out trojanized versions of packages.

The attack started from a compromised account called 'asteroiddao' and has some similarities to the Shai Hulud malware we've seen before. It uses GitHub Actions as a data exfiltration method - it disguises stolen secrets as innocent build artifacts that anyone with access can download. The good news is that security folks caught this one early before it could spread to more popular packages. (read more)

ComoDoS - Exploiting a Remote Kernel Vulnerability in Comodo Internet Security

Marcus Hutchins is also on the “responsible disclosure requires a responisble vendor” train and is releasing some zero day publicly after the report he submitted multiple times was ghosted.

He found a remote kernel vulnerability that lets you crash any system running Comodo's firewall with a single IPv6 packet - and it works even if the firewall blocks everything because the bug happens during packet parsing, before any rules kick in.

The bug is an integer underflow in the IPv6 extension header parser that doesn't validate the payload length field. While there's potential for out-of-bounds read and write primitives, Marcus thinks RCE is unlikely due to various constraints. They have no bug bounty program, so here we are with a public zero-day because vendors gonna vendor. He's provided a PoC so people can test if they're vulnerable. (read more)

Gemini Voice Assistant Hijacked via Messaging Notifications

Researchers managed to trick Google Gemini through everyday notifications. They figured out a way to inject malicious prompts through WhatsApp, Slack, SMS, and pretty much any messaging app that sends push notifications. They’re calling this technique "Fake Context Alignment,” where they hide malicious instructions in foreign languages or muted hyperlinks, so when you think you're just saying "yes" to end a conversation, you're actually authorizing Gemini to open your smart home windows or start a Zoom call streaming your video.

The researchers could fake messages from trusted contacts without even knowing their names beforehand - just grab whatever name pops up in your notifications and attribute their malicious message to them. They also managed to poison Gemini's long-term memory for persistent access across all your devices. Google's already patched these issues after the disclosure. But boy are us AppSec nerds loving everyone learning about untrusted input sources all over again as AI agents seem to just read prompts from anywhere. XSS who? (read more)

Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months

Someone just spent five months methodically stealing a stock exchange executive's entire email history, and honestly, it's impressive how patient and disciplined they were. The attackers used a custom tool built around Aspose (a legitimate .NET library) to slice Outlook OST files into bite-sized chunks, then exfiltrated everything through Dropbox and OneDrive Personal to blend in with normal cloud traffic. They grabbed emails incrementally over two-to-four-week windows, making sure not to trigger any alarms with massive data transfers.

The opsec was pretty solid too - they masqueraded their tools as Adobe and OneDrive services, used scheduled tasks that looked like Lenovo health checks, and even switched to hard-coded Microsoft IPs instead of hostnames to avoid DNS logging. Five months of dwell time is serious commitment for what was essentially a glorified email theft operation. No attribution yet since they stuck to public tools and legitimate cloud services, but for an exchange executive's mailbox full of market-moving intel, someone clearly thought it was worth the long game. (read more)

Researcher publishes GitHub token-stealing exploit, blames Microsoft’s disclosure process

Here we go again with Microsoft and security researchers butting heads. Ammar Askar just dropped a working VS Code exploit that can steal GitHub tokens with a single click, and he intentionally bypassed Microsoft's disclosure process to do it. His beef is that Microsoft apparently "silently" fixed a previous bug he reported without giving him credit and claimed it had no security impact. So now he's going full public disclosure on VS Code bugs.

The attack is to craft a malicious Jupyter notebook, victim clicks the link to open it in github.dev, and hidden code simulates keystrokes to install a rogue extension that exfiltrates their GitHub token. That token gives full read/write access to everything they can touch, private repos included.

This is getting spicy because it's part of a bigger trend where researchers are fed up with Microsoft's vulnerability handling. The timing is interesting to me since this comes right after TeamPCP breached thousands of GitHub repos through a poisoned VS Code extension. Hard to blame them for getting frustrated with being ignored. (read more)

Google adds Android protection against AI deepfake scam calls

Google's rolling out a solution to the growing deepfake voice scam problem. Their new "fake call detection" feature for Android 12+ devices works by having the caller's phone send a silent, encrypted confirmation signal to the recipient. If that signal doesn't show up, your phone automatically pings your actual contact to ask "hey, are you calling me right now?" If they say no, you get a warning to hang up immediately.

Impersonation scams hit $2.95 billion in losses last year alone. The feature only works if both people are using Phone by Google with RCS enabled, so adoption might be the real challenge here. I like that instead of trying to detect if a voice sounds fake, they're just verifying the call is actually coming from where it claims to be. Smart move, especially as AI voice cloning gets cheaper and more convincing. (read more)

Kali365 Operator Expands Operation

What started as a Microsoft 365-focused credential stealer has now expanded to target AWS, Okta, Xerox DocuShare, and some interesting Russian platforms including MAX Messenger - a state-backed messaging service with 80 million users. The kit specializes in device code phishing, which is where they trick you into entering a legitimate OAuth code on a real login page, completely bypassing your MFA in the process.

Arctic Wolf recently tracked down 126 active malicious hosts all serving the same Kali365 kit between early and late May. They're impersonating everything from Microsoft Outlook to German email providers to major Russian services like Mail[.]ru and Yandex. It's part of a bigger trend with at least 14 different device code phishing kits floating around now. (read more)

Anthropic expanding access to Project Glasswing

Anthropic's Claude Mythos Preview model is absolutely tearing through codebases right now. Since launching Project Glasswing in April, this thing has surfaced over 10,000 high or critical software vulnerabilities. They're now expanding access to about 150 more organizations across critical infrastructure sectors - power, water, healthcare, the works. Cloudflare alone found 2,000 bugs using it, including 400 rated high or critical, with better accuracy than human testers.

Now we’ve got a human bottleneck of actually fixing everything. Mozilla found 271 vulnerabilities in Firefox 150, which is 10x more than previous versions using earlier models. The broader concern is that we're heading into a world where AI can find bugs faster than defenders can patch them, potentially giving attackers the upper hand. Anthropic's keeping Mythos locked down for obvious reasons, but they did release a public version called Claude Security that's already helped patch over 2,100 vulnerabilities in three weeks. (read more)

Attackers are exploiting Palo Alto Networks defect that initially flew under the radar

Here's a fun lesson in how vulnerability ratings can age like milk. Palo Alto Networks dropped CVE-2026-0257 as a "medium" severity bug on May 13, but by the time Rapid7 spotted active exploitation just four days later, it got the full critical upgrade treatment. CISA quickly tossed it onto the KEV.

The exploit itself is simple - just forge an authentication cookie using the device's own TLS certificate and boom, you've got VPN access with a single HTTP request. Multiple threat groups are already swarming this opportunity, with Rapid7 tracking waves of attacks hitting their customers. A quote from the Rapid7 research sums it up well:

“The implication here is that anyone who knows the public key for the certificate used by the authentication override feature to encrypt and decrypt cookies, can successfully forge and encrypt an arbitrary authentication override cookie. The question then becomes, how does an attacker learn the correct public key to use in this attack?

This brings us back to the vendor's advisory where they state “do not reuse the portal or gateway certificate, and do not share this certificate with other features or users”.

If a GlobalProtect portal or gateway has reused the certificate for encrypting and decrypting cookies with another feature, such as the HTTPS service of the portal or gateway, then a remote unauthenticated attacker can discover the public key for that certificate.” (read more)

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

Microsoft with a good deep dive on "Miasma," the latest npm supply chain attack that hit 32 Red Hat Cloud Services packages. The attackers compromised the upstream CI/CD pipeline and used legitimate GitHub Actions OIDC workflows to publish trojanized packages with authentic provenance signatures - making malware look officially blessed. The attack triggered automatically during npm install via preinstall hooks, then downloaded the Bun JavaScript runtime and executed a heavily obfuscated 4.29MB payload that could steal credentials from pretty much everywhere: GitHub, AWS, Azure, GCP, HashiCorp Vault, you name it.

Once it steals your npm tokens, it republishes poisoned packages under your name with forged SLSA provenance to keep the cycle going. The malware even scrapes GitHub Actions runner memory directly to bypass secret masking and can escalate privileges using passwordless sudo. Oh, and there's a fun destructive tripwire: if you mess with their planted decoy token, it tries to nuke your home directory with rm -rf ~/. "if we can't have it, nobody can.” (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 5 minutes

Brought to you by:

Howdy friends!

What a week! Opus 4.8 dropped. Microsoft pissed off the entire security community. Malware keeps malware-ing. Mythos is out there hacking the planet. And here we are. Clocking in for our shift at the vuln mines.

I’m giving that keynote in the Caymans next week, so let me know if you have any shady offshore finance stuff you need done.

Lets get to it.

ICYMI

🖊️ Something I wrote: Why I’m worried about AI agents downloading malicious packages

🎧️ Something I heard: Whats that? I started a podcast with LowLevel? But of course we did. Now found in a podcast store near you.

🎤 Something I said: What the hell is going on at CISA?

🔖 Something I read: Cloudflare’s Mythos write up is a very solid read with good lessons learned.

Vulnerable News

Microsoft calling security researchers criminals for public disclosure

source: https://x.com/vxunderground/status/2060036224245432506

This got me riled up today on stream. I recorded a YouTube video about it, will be out soon. But Microsoft got a big nostalgic about the early 2000s and is now threatening legal action against security researchers again. The community has absolutely exploded with stories of their nightmare experiences trying to work through the “responsible” disclosure processes. The pattern is clear - they are slow, non communicative, and consistently downplay security vulnerabilities, not rewarding researchers, not crediting researchers, and then fixing the vulns anyway.

Casey Ellis (founder of Bugcrowd) wrote recently about this on an unrelated public disclosure issue with Citrix, but he captures the whole thing we’re talking about this week beautifully. I consider this required reading: Coordinated, Until It Isn't

As he states, the “responsible” disclosure social contract is that the vendor is also responsible/responsive. If the vendor isn’t holding up their end of the bargain, full disclosure is the agreed upon path. This is to keep the asymmetry of power and legal consequences a bit more balanced and holding vendors accountable. The real goal at the end of the day is a more secure internet, not for the vendor to have the cheapest and least embarassing vulnerability patching lifecycle possible. If you ostracize and threaten security research, we end up with a less secure internet as more talent will refuse to work with you.

As their own CEO said. The answer is clear, Do security. Threatening researchers isn’t doing security. (read more)

You can’t secure AI if you can’t see what’s running.*

Oligo ran the runtime telemetry on what's actually executing inside production AI stacks, not what's sitting in a requirements.txt. It's the most data-driven look at the AI runtime landscape I've seen this year, and one number in it reframes a lot of the vendor noise from the last 18 months.

No company in their dataset runs Anthropic without also running OpenAI. Not one. 36% have both installed. Zero go Anthropic-only.

Every "OpenAI killer" take assumed companies would switch. What the runtime shows is that nobody switches. They add Anthropic as a secondary, usually for specific tasks (long context, code, certain reasoning jobs), while OpenAI stays as the default. The full dataset has more numbers like this one. Grab the full report now.

Read the 2026 AI Runtime Report.

*Sponsored

Hackers are trying to steal Signal users’ backups in new wave of phishing attacks

source: https://x.com/joshrogin/status/2059634806648930614

Signal users are getting hit with a new phishing scam where hackers pose as Signal support claiming their backups are about to vanish due to a "sync issue." The fake support messages ask users to hand over their recovery keys to "save" their chat history - which …is what you shouldn't do. Josh Rogin from the Washington Post flagged this after anti-CCP activists started getting targeted, though it looks like the campaign might be casting a wider net based on reports from Access Now's security folks.

Interesting that this is going after Signal's relatively new Secure Backups feature, which lets you store encrypted chat history on Signal's servers. Previous Signal phishing attempts usually tried to hijack accounts outright, but this approach is a bit more surgical - if they get your recovery key, they can decrypt all your old messages, photos, and documents. Signal will never message you first and definitely won't ask for your PIN or recovery keys. If you see a "Signal Support" chat pop up, it's not them. (read more)

Apple open sources quantum proof encryption code

Apple just open-sourced their quantum-resistant crypto implementation for corecrypto along with the formal verification tools they built to mathematically prove it's correct. This isn't your typical "trust us, we tested it" approach. They literally used mathematical proofs to verify their ML-KEM and ML-DSA implementations work exactly as the FIPS specs intended, covering over 2.5 billion devices.

Their formal verification process caught a nasty bug that traditional testing missed. There was a missing step in the ML-DSA code that would have silently broken digital signatures - meaning iMessage users could have thought their messages were authenticated when they actually weren't. Apple's releasing their Cryptol-to-Isabelle translator and verification methodology, which should be a goldmine for other developers working on post-quantum crypto. (read more)

DBIR: Exploitation is now 31% of breaches. Prioritization is the bottleneck.*

The 2026 data breach investigations report shows that exploitation is now 31% of breaches, median time to full remediation rose to 43 days, and 184 million known exploited vulnerability instances sat open past day 28.

Discovery is cheaper and faster than ever, but picking what to fix is getting harder. Empirical Security builds local predictive models that tell your team which vulns actually matter in your environment. (read more)

*Sponsored

Project Glasswing: An initial update

Anthropic with their initial Project Glasswing update. Of course, please read this through their is marketing mixed in lens - but good data to stay on top of. Their Mythos model has been going through open-source code for six months and found over 23,000 vulnerabilities across more than 1,000 projects. Over 6,000 of these are high or critical severity bugs, with about 1,500 confirmed as legitimate issues. Only 100 have been patched so far, which gives you an idea of the scale we're dealing with.

While big players like Mozilla, Cloudflare, and various government agencies are lining up for access to scan their own stuff, the open-source maintainer community is getting absolutely swamped. Bug bounty programs are either shutting down or banning AI-generated reports entirely because sorting through the flood of automated submissions is becoming impossible. Some maintainers are literally asking Anthropic to slow down because they can't keep up with the flood of legitimate bug reports. (read more)

Vulnerability in Popular Conference Software Granted Attackers a 100% Talk Acceptance Rate

Conference organizers, you might want to check your Pretalx installations. Novee Security found a stored XSS (CVE-2026-41241) that let attackers plant malicious code in talk submissions that would execute the moment an organizer searched for their proposal. The clever bit was chaining together legitimate platform features - file uploads and search display - to bypass both the platform's security and browser protections.

Submit booby-trapped talk proposals to multiple conferences, stuff the titles with common search terms, then wait for organizers to search and get their accounts automatically compromised. With some automation, you could theoretically achieve a 100% talk acceptance rate across every Pretalx-powered conference. The vulnerability's been patched, but is a funny one. (read more)

CrowdStrike disrupts Glassworm botnet that preyed on open-source supply chain

CrowdStrike just pulled off a takedown of the Glassworm botnet, working with Google and Shadowserver to simultaneously nuke four servers that were keeping this supply chain nightmare running. These Russian-linked attackers have been having a field day since early 2025, poisoning hundreds of open source packages including VSCode extensions, npm modules, and over 300 GitHub repos. Their whole game was infiltrating developer workflows to push malware downstream through the supply chain. (and no, this isn’t TeamPCP. Yet Another Supply Chain Nightmare ^ TM)

They were using everything from the Solana blockchain to BitTorrent to Google Calendar to keep their C2 resilient. CrowdStrike's approach here is interesting - instead of waiting around for lengthy legal processes (good luck extraditing Russians), they went straight for the infrastructure. The idea is to make the attackers burn time and resources rebuilding rather than targeting new victims. (read more)

FBI warns extortion hackers are visiting US law firms to steal data

The FBI is warning about Silent Ransom Group, a crew tied to the old Conti ransomware gang that's been hassling U.S. law firms since 2023. These guys are getting creative with their social engineering - they're not just sticking to phishing emails and fake IT support calls anymore. They're actually showing up at offices pretending to be IT folks who need to "backup" or "image" devices for security reasons, then copying data onto USB drives or external storage. Feels like I’m reading a Kevin Mitnick story from the 90s.

They use legitimate remote management tools that IT departments already have, and exfiltrate data through trusted platforms like Google Drive and OneDrive. Law firms are prime targets to access sensitive legal, financial, and corporate information. The fact that they're willing to physically show up at offices was worth the callout here. I want to see the security cam footage of them coming in to do “backups.” (read more)

Iranian intelligence service behind hack of LA transit system, researchers say

Turns out that March hack of LA Metro wasn't just some random hacktivist crew after all. Israeli researchers at Gambit Security traced "Ababil of Minab" back to Iran's Ministry of Intelligence (MOIS), despite the group's claims of being independent Palestine supporters. The attackers didn't just steal data - they went full scorched earth, wiping databases, virtual machines, and storage volumes using both automated scripts and manual keyboard work to maximize destruction and prevent recovery.

What's particularly concerning is the speed and scale these guys operated at. They hit multiple other targets including Israeli media orgs, a Turkish insurance firm, and various websites across different sectors. The researchers are warning that this kind of "straight to the recovery layer" attack strategy is becoming easier to execute as AI tools lower the technical barriers. It's the same playbook we saw with Handala's devastating Stryker attack - another MOIS-linked group masquerading as hacktivists. The takeaway? Iran's getting better at both the technical execution and the cover stories.
(read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

I’m officially scuba certified! Fun stumbling into a new hobby. I’m going to get my advanced certification this week so I can use enriched oxygen and go deeper on my trip. Hoping that keeps me fresh for my keynote. I’ve been working on the slides this week and I’m excited for the talk, I’ll try to do a recap at some other conferences so those of you not going to Descent Cyber can watch. But if you’re into diving and infosec, this is a good group of people putting on this con and I’d get it on your radar.

ICYMI

🖊️ Something I wrote: This thread filled with good advice on how to not pull npm or PyPi malware with your ai agents

🎧️ Something I heard: Inside the Secret Luxury Market For Crypto Thieves

🎤 Something I said: I talked to the hackers that found a nation state iOS 0day

🔖 Something I read: Push published a blog of lessons learned from a webinar we did recently. Some good quotes in here from yours truly.

Vulnerable News

GitHub Confirms Breach of 3,800 Repos Via Malicious VSCode Extension

Something’s got to give with this supply chain malware because now the latest victim is GitHub itself. The irony is brutal because GitHub owns NPM, which sits right at the center of the exact malware campaigns we’ve been screaming about for weeks now.

BleepingComputer’s report on the GitHub breach lines up almost perfectly with the same Team PCP playbook we keep seeing over and over again with these “Mini Shai-Hulud” worms. At this point there’s nothing “mini” about it anymore. Threat actors reportedly compromised a poisoned VS Code extension, which ultimately led to GitHub confirming roughly 3,800 repositories were stolen.

The scary part is how little user error it actually took. The malicious extension was reportedly available for about 11 minutes, but the extension developers estimate more than 6,000 installs happened during that window. That means one GitHub developer likely just had auto-update enabled on what appeared to be a legitimate extension and suddenly malware landed directly inside their development environment. Nobody manually downloaded sketchy files. Nobody disabled antivirus. This is exactly why I keep saying browser extensions, IDE extensions, NPM packages, PyPI packages, and software supply chains are inching toward tied-for-first as the biggest security priority alongside help desk phishing. The attackers are openly telegraphing their playbook now. (read more here and here)

Traditional SASE Wasn't Built for AI Agents. Island Is.*

AI agents don't follow the rules traditional SASE was built for. Legacy architectures inspect connections but they cannot interpret intent. Island's Perfect Packet architecture enforces security where work actually happens: at the point of interaction, inside the browser.

Backhaul becomes the fallback, not the default, so up to 90% of sessions go direct with no forced TLS inspection or traffic rerouting. Across user and AI agent sessions alike, Island governs what's sent, to where, and by whom, with a full audit trail and no blind spots.

See how Island does it.

*Sponsored

Project Glasswing: What Mythos Showed Us

This is a top 5 blog of the year for me. Cloudflare’s writeup of their experience with Mythos. The first parts of it are more of what we already knew, Mythos is better at writing exploits than the average AI model. The real magic in this post is when they start to talk about the harness and then the last few paragraphs.

The people having the most success with Mythos aren’t just throwing source code at the model and saying “go find vulns.” They’re building advanced harnesses around it. Mozilla talked about it. The Cloudflare write-up talks about it. That seems to be where the magic actually happens: not just the model, but the surrounding tooling and workflows that let the model iterate toward a working exploit chain.

Cloudflare’s vulnerability discovery harnass

When the author starts to talk about how just fixing vulns faster is the wrong goal, I start to levitate off my seat. Music to my ears. Direct quote I love: “Patching faster does not change the shape of the pipeline that produces the patch.” - read it twice. then read it again. Fast whack-a-mole is still whack-a-mole. Vulnerabilities are just one way in, the layers you build around it are where security programs really earn their paycheck. (read more)

CISA Admin Leaked AWS GovCloud Keys on Github

This CISA GovCloud leak story from Brian Krebs is insane. It was plaintext passwords, exposed AWS GovCloud credentials, public GitHub repos, and apparently very basic security hygiene failures. One of the exposed files literally contained admin creds for GovCloud systems. Another was apparently just a CSV full of usernames and passwords. Then you read the official response saying there’s “no indication sensitive data was compromised” while staring directly at screenshots of plaintext credentials. Shot. Chaser. Oh my god.

The thing that really bothers me here is this clearly goes beyond “one contractor made a mistake.” There were supposed to be guardrails everywhere that should have caught this. GitGuardian reportedly flagged the exposed secrets. The repo was public. The passwords in some cases were apparently predictable formats like platform name plus current year. This would be embarrassing for any company. The fact that it’s tied to CISA-adjacent infrastructure and GovCloud makes it way worse. (read more)

Microsoft Shares Mitigation for YellowKey Windows Zero-Day

Microsoft finally assigned a CVE to the YellowKey BitLocker bypass after the researcher behind it basically said, “Fine, if coordinated disclosure isn’t working, I’m just going public.” This is the same researcher behind Blue Hammer, Red Sun, and Green Plasma. I get why this whole thing has turned messy. Microsoft’s response literally says the proof-of-concept was released “violating coordinated vulnerability disclosure best practices,” but you don’t really get to say that after frustrating somebody through the disclosure process so badly they just start dropping everything publicly. That’s the whole point of the protest.

The really wild part is how easy YellowKey apparently is to use. This is a BitLocker bypass that has people legitimately asking out loud whether this feels “too convenient” to be accidental. Microsoft’s mitigation guidance right now is basically “mount WinRE images manually, modify registry hives, disable recovery utilities,” which is honestly a disaster-tier mitigation for most organizations. The entire situation feels like Microsoft scrambling because they wanted time for a clean fix, but instead got forced into publishing ugly interim guidance after the exploit already hit GitHub. (read more)

Ever investigated a "super urgent" finding for it to be nothing?*

You've spent hours digging into a "critical" CVE only to realize one config setting makes it impossible to exploit in your environment.

You should never have had to look at it. That's not an exploitable finding, and reachability alone won't catch that. Maze AI agents determine exploitability like your best security engineer would, with context from your environment and business, before noise hits your backlog. (read more)

*Sponsored

Welcome to BlackFile: Inside a Vishing Extortion Operation

Meet BlackFile (UNC6671), a threat group that Google just profiled who specializes in voice phishing. These guys call victims pretending to be IT support, claiming there's some urgent MFA update or passkey migration needed. While they've got you on the phone walking through their fake portal, they're using your real credentials and MFA tokens in real-time to register their own devices on your accounts. Pretty slick adversary-in-the-middle setup that bypasses most traditional security controls.

Once they're in your Microsoft 365 or Okta environment, they go full automation mode with Python and PowerShell scripts to hoover up massive amounts of data - millions of files in some cases. They're using direct HTTP requests that show up as "FileAccessed" events instead of "FileDownloaded" to stay under the radar. After stealing everything from SharePoint to Salesforce, they hit you with extortion demands starting in the millions but often settling for low six-figures. Their data leak site shut down in May 2026 with a cryptic "shutting down under this name" message, suggesting they're probably just rebranding for round two. (read more)

1Password Teams With OpenAI to Stop AI Coding Agents From Leaking Credentials

This 1Password and OpenAI partnership might actually be one of the smarter AI security ideas I’ve seen lately. The core idea is to stop stuffing secrets into environment variables, dotfiles, prompts, repos, and MCP configs where AI coding agents can accidentally expose them. That’s exactly how a lot of developers are working right now. People are using Codex, MCP servers, and other AI coding tools, and the workflow often becomes, “Yeah, just stick the API key into the ENV variable and let the agent use it.” Then suddenly your coding agent has long-lived access to sensitive credentials sitting directly inside the model workflow.

What 1Password is proposing here is a just-in-time credential model where the secrets stay vaulted and only get issued temporarily for the specific task the agent is performing. In theory, I actually really like this idea. Keeping secrets out of prompts, repos, and model context windows is absolutely the right direction. The part I’d want to test hard is the enforcement side. It’s easy to say “credentials are scoped to the task,” but how do you actually guarantee that? You can’t just ask the AI agent nicely not to misuse the creds. Still, if this works the way they’re describing, it could genuinely reduce a lot of the secret leakage mess we’re seeing right now across AI-assisted development environments. (read more)

Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Kit

My ears perked up when I read this headline as I just did a whole video about Coruna and it’s sister exploit DarkSword. This is also a bit different then the other npm stuff we’ve covered lately as it’s not targeting the developer pulling the npm malware, it’s targeting iOS devices of users who happen upon websites using the pwned packages.

Socket's threat research team caught this in the popular art-template npm package. Someone got their way into taking over maintenance from the original author, then immediately started pushing weaponized versions. The compromised packages (4.13.5 and 4.13.6) inject a sophisticated iOS Safari exploit framework that's basically a respawned version of the Coruna exploit kit - the same commercial toolkit that Google documented earlier with 5 full exploit chains targeting iOS 13-17.2.

The technical sophistication is impressive in a terrifying way - multiple obfuscation layers, content-addressed module loading, and even CPU architecture discrimination between regular iPhones and Apple Silicon Macs. If your app bundled those bad art-template versions, every user visiting your site got served this exploit framework automatically. (read more)

Scammers are abusing an internal Microsoft account to send spam links

Instagram post

GhostTree: Unveiling Path Manipulation Techniques to Bypass Windows Security

Varonis just dropped details on a clever new evasion technique called GhostTree that's bound to give some EDR vendors headaches. The idea is to use NTFS junctions to create recursive directory loops that generate infinite file paths. Any user can pull this off with just write permissions and a couple mklink commands, no admin rights needed. Point a child folder back to its parent, and suddenly you've got unlimited valid paths to the same file that can stretch all the way to Windows' 260-character limit.

The nastier variant creates multiple junction branches, turning your directory structure into a binary tree nightmare that can theoretically generate 2^ 126 unique paths (that's more paths than there are atoms in your body, for perspective). When EDR tools try to recursively scan these folders, they get stuck in the loop and hang, leaving your actual malware sitting pretty and unscanned. Microsoft initially brushed this off saying "bypassing Defender isn't crossing a security boundary," but then quietly patched it anyway. (read more)

Grafana breach caused by missed token rotation after TanStack attack

Grafana is another ripple effect of the npm worms. Their CI/CD pipeline consumed one of those malicious npm packages and the credential-stealing malware did its thing and stole some GitHub workflow tokens from their environment. Grafana's incident response team jumped on it and started rotating tokens, but they missed one.

That lone forgotten token was all the attackers needed to get into Grafana's private GitHub repos and make off with source code plus some business operational data (think contact names and emails, nothing too spicy). No customer production data got touched, and they didn't mess with the actual codebase, so if you've been downloading Grafana recently, you're fine. But this hand in hand with the lead story on GitHub is a second order hack of the npm worm worth watching. (read more)

Europe dismantles VPN service used by cybercriminals to hide ransomware attacks

European cops just took a wrecking ball to First VPN, the go-to service for cybercriminals looking to hide their dirty work. This coordinated takedown between France, Netherlands, and Ukraine happened this week and targeted a service that had been advertising itself on Russian-speaking crime forums for years. They grabbed 33 servers and, more importantly, the entire user database - which is basically a Christmas list of cybercriminals who thought they were untouchable.

First VPN wasn't just some regular VPN that happened to have bad actors as customers. This thing was specifically marketed to criminals, promising they'd never cooperate with law enforcement and would keep users "beyond the reach" of authorities. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

I’ve fallen into a new hobby by force. I’m keynoting a conference in a few weeks called Descent Cyber - and will be scuba diving with CISOs and other industry. So I’ve been very busy getting scuba certified for the first time. What a wild process! Will I see any of you down there? I think the other keynote is the CISO of the NFL and there are a ton of industry vets going. I’m excited.

If you’re reading this and enjoy a good livestream I’m officially a few months into Tue, Wed, Thur streams on YouTube and Twitch. We have great convos and chat fills with practitioners living through the front lines. Love when I talk about something which causes someone in stream to have to go run an incident because thats how they found out. Come check it out. I start in the 9am hour CST and run about 2-4 hours depending on whats going on. This week I even had Andrew Peterson, former CEO of Signal Sciences and current Investor for Aviso come in the studio and jam.

ICYMI

🖊️ Something I wrote: My ELI5 breakdown of the recent supply chain malware issue

🎧️ Something I heard: Primeagen’s run down of recent Mythos news and capabilities

🎤 Something I said: The most work we’ve put into a YouTube video yet. I interviewed the teams that found the recent iOS 0days in the wild.

🔖 Something I read: This org made a honeypot GitHub to catch AI bots pushing BS PRs so they can block them from their real repos.

Vulnerable News

Mini Shai-Hulud Is Back: NPM Worm Keeps Mutating as GitHub Supply Chain Attacks Accelerate

Another week, another NPM worm. This latest wave, “Mini Shai-Hulud”, hit packages tied to TanStack, Mistral AI, and a growing list of projects across NPM and PyPI. At this point, the playbook is becoming painfully familiar: compromise a developer, steal GitHub and NPM tokens, poison legitimate packages, spread to additional maintainers and repos, repeat. But this one feels bigger because the attackers abused legitimate GitHub Actions workflows and trusted release pipelines to publish malicious updates under real developer identities. That’s a very different problem than typo-squatted malware packages sitting in a registry corner waiting for someone to accidentally install them.

The malware itself was extremely focused on developers and CI/CD infrastructure. Once installed, it hunted for GitHub tokens, NPM credentials, AWS secrets, Kubernetes configs, SSH keys, and other high-value developer artifacts. If it found package publishing access, it attempted to spread itself further. That’s the worm behavior. And this is where the modern dependency ecosystem starts looking really fragile. Developers are now stuck in an impossible tradeoff: patch too slowly and you sit on known vulnerabilities; patch too quickly and you might automatically pull malware before researchers catch it. That’s why teams are now talking seriously about “minimum release age” policies, intentionally delaying dependency updates by several days so security vendors have time to identify malicious releases.

The really uncomfortable part is how much of this is just the ecosystem functioning as designed. Trusted automation. Trusted publishers. CI/CD pipelines moving at internet speed. The attackers are using the same workflows developers use. And they’re evolving fast. Some variants reportedly included dead-man-switch behavior where revoking a stolen GitHub token could trigger destructive actions on the victim machine. Others experimented with geofenced wiper functionality. This is active supply-chain warfare happening inside the developer ecosystems that run modern software. (Read more here, here, here and here)

Time-to-exploit is down to one day. Now what?*

Intruder analyzed 3,000 organizations' attack surfaces. Top finding: more teams should be asking 'does this actually need to be on the internet?’

There’s no better time to ask it. AI can now find zero-days autonomously and time-to-exploit has shrunk to a single day. Anything on the internet that doesn't need to be is a target the moment a new CVE drops.

In the report:

• What are the most common attack surface exposures?

• How long are organizations taking to fix them?

• How does your industry compare?

Get the report

*Sponsored

A 0-Click Exploit Chain for the Pixel 10: When a Door Closes, a Window Opens

Project Zero dropped a really interesting write-up showing how they went from a zero-click context to full root on Android using just two exploits chained together. The original work targeted the Pixel 9 earlier this year, and then they adapted the same general approach to the Pixel 10. The wildest part is how straightforward they said portions of it were. One of the bugs apparently stood out specifically because it was “exceptionally simple to exploit.” Zero-click to root on a mobile device is still one of the scariest classes of bugs out there.

The important context here is this was pre-Mythos. You can’t blame AI for this one. This is just elite vulnerability research and exploit development. But one encouraging thing was Project Zero actually praising Google’s response process, noting it was the first time the vendor patched within the 90-day disclosure window. It’s also kind of funny because even though both teams are technically Google, Project Zero still treats them like a third-party vendor relationship. (read more)

Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP

Another day, another Linux privilege escalation. Idk whats going on. If you missed the last two, Copy Fail and DirtyFrag - you can catch up here. The latest, Fragnesia, which reportedly emerged as an unintended side effect of one of the patches for DirtyFrag. Security is hard. Just like the npm issues, if you patch it doesn’t mean you’re negating all risk.

The good news is you can disable the vulnerable kernel modules (esp4, esp6, rxrpc) if you don't need them, or restrict unprivileged user namespaces. If you suspect you've been hit, a simple reboot or cache flush will clear the in-memory modifications. (read more)

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Google’s new threat intelligence report is the strongest evidence yet that AI is already being operationalized by threat actors in real attacks. The report goes through attackers using AI for vulnerability research, exploit development, phishing, malware refinement, and attack automation, and they even call out Team PCP, the same group behind the Mini Shai-Hulud supply-chain worm.

What stands out to me is that attackers getting faster and scaling harder. Google says they’ve now seen evidence of AI being used to discover and help weaponize a zero-day for the first time, including a 2FA bypass exploit. Honestly, I think this is just the beginning. We’re already seeing vibe-coded malware, automated payload generation, and increasingly autonomous attack workflows. I’m probably going to do a long YouTube video walking through this whole report because it feels like one of those “this is where the industry changes” moments. (read more)

Check out the open-source matrix for browser-based attack techniques*

AiTM phishing, ClickFix, device code phishing, ConsentFix, malicious browser extensions — two years ago, most of these were research curiosities. Today they're industrialized, available as PhaaS, and behind the majority of identity compromises. Push Security's Browser & Identity Attacks Matrix maps every technique in one open-source framework.

Explore the matrix from Push Security. (read more)

*Sponsored

Introducing Daybreak: Frontier AI for Cyber Defenders

OpenAI launched yet another cybersecurity AI initiative, this one called Daybreak, and my first reaction is: what the hell is going on? Because at this point we’ve had Trusted Access for Cyber, Codex Security, Expanded Trusted Access, GPT-5 Cyber, scaling trusted access with GPT-5 Cyber… and now Daybreak. The branding and positioning are getting impossible to follow, even for people who live in this space every day.

But underneath the marketing confusion, I do think there’s something important happening here. Daybreak feels less like “AI security tooling” and more like OpenAI acknowledging that frontier models are fundamentally changing vulnerability discovery and defensive operations. The Trail of Bits write-up framed it really well: frontier models are now finding bugs faster than maintainers can triage them:

That’s a pretty massive shift if you stop and think about it. We’re heading toward a world where AI systems are acting more autonomously inside security workflows: vulnerability research, SOC operations, triage, remediation, code review, all of it. The interesting part is whether enterprises are actually going to trust these systems enough to let them operate at scale inside production environments. (More here, here and here)

Publicly Released Microsoft 0days By Disgruntled Researcher

So this researcher is fed up with Microsoft’s disclosure process and decided: “f it, we’re doing painful disclosure.” Instead of quietly coordinating fixes, he started publicly dropping the research straight onto GitHub, including the latest, YellowKey and GreenPlasma.

The one that really stood out to me was YellowKey, which is a BitLocker bypass affecting Windows 11 and newer server builds. The way he describes it almost sounds like discovering some weird hidden debug or recovery functionality left inside WinRE. You boot into recovery, hit a specific key combo, and there’s behavior around BitLocker relocking that apparently should not exist. His whole point is basically: “why is this functionality even here?” And I’ll be honest, reading through it, I kind of get why he starts speculating about it being purposefully created backdoor. (read more here, here and here)

"Not a Preload Issue": Xbox Responds As 'Forza Horizon 6' PC Files Leak in Full a Week Before Launch — and Pirates Already Cracked It (UPDATED: Microsoft Responds)

The Forza Horizon 6 leak is one of those stories where I genuinely don’t know if it’s “cyber” or just an absolutely catastrophic operational screw-up. The initial reporting made it sound like somebody accidentally pushed the game live on Steam early with unencrypted files, which immediately led to the raw game assets leaking and pirates cracking it before launch.

But then they came out and said it wasn’t a preload issue, which honestly just makes the whole thing weirder. Because if it wasn’t some accidental publishing mistake… then what was it? That’s the part that has everybody speculating right now. Meanwhile, the downstream effects are already happening: cracked builds circulating before release, pirated copies spreading everywhere, and the publisher threatening franchise-wide bans for anyone involved. (read more here and here)

California Mayor Charged With Acting As Illegal Agent for China

The mayor of Arcadia pled guilty to acting as an illegal agent for China tied to operating a website that pushed pro-PRC messaging into the local Chinese-American community. From the reporting, it wasn’t just “generally pro-China opinions.” The allegation is she was actually receiving directives from PRC officials about what content to publish and sometimes even seeking approval before circulating material.

The part that makes this way more serious is that this is an elected official. If this were just some random propaganda site, okay, that’s one thing. At the same time, this doesn’t sound like “spy movie” espionage stuff so much as an information operation, influence, messaging, narrative shaping, all of that. (read more)

Canvas Update: Instructure Just Confirmed They Paid the Ransom

The Canvas/Instructure hack got really wild because the ransomware group didn’t just ransom the company, they basically threatened every school using Canvas too. The attackers published a giant list of something like 9,000 schools and essentially said: “If you don’t want your school’s data released, contact us.” That’s a pretty massive escalation compared to the normal playbook.

ShinyHunters came out and basically said the matter was resolved and schools wouldn’t be further targeted. Then Instructure publicly confirmed they paid the ransom. Straight up. They said the data was returned and they received assurances it wouldn’t be further shared. FBI guidance is always “don’t pay.” But honestly I completely understand why companies do it, especially when the blast radius suddenly includes thousands of schools/children. (read more)

Behind the Scenes Hardening Firefox with Claude Mythos Preview

Mozilla used Claude Mythos Preview and other models to find 271 security vulnerabilities in Firefox - part of a massive 423 total bugs they squashed in April alone. The lesson that stands out to me is that we all better be building custom harnesses. Mozilla seemingly is more successful than other project Glasswing participants and all evidence points towards the fact that they’re using a very sophisticated harness on top of their legacy bug finding/fixing system to swap in models as they release.

The "agentic harness" can actually test and validate bugs instead of just spitting out false positives. They went from AI bug reports being mostly useless noise to finding legitimate sandbox escapes that would make any red teamer jealous. Mozilla's basically saying the AI security audit game has fundamentally shifted - they're encouraging everyone to start building similar pipelines now because the models are finally good enough to be worth the effort. Given how many of these were sandbox escapes and parent process UAFs, attackers are probably already doing this too. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay

Read Time: 8 minutes

Brought to you by:

Howdy friends!

An odd week for me. Definitely feeling that Spring burnout. Feels like a lot of people around me also, what is in the air?

I’m gearing up for some speaking gigs I’ve got this summer and really excited about some of the talks I’ve got cooking.

ICYMI

🖊️ Something I wrote: zero days are not invisibility cloaks.

🎧️ Something I heard: This breakdown of Anthropic and SpaceX stuff is the best I’ve seen

🎤 Something I said: GitHub is not ok

🔖 Something I read: Finding Zero-Days with Any Model (best blog I’ve read in a long time)

Vulnerable News

Canvas hacked by ShinyHunters

Instagram post

Vulnerability fixes without an owner are just a suggestion*

Most vulnerability tickets die in the backlog. Sometimes the fix is hard. More likely, nobody knows who owns it, or the ticket didn't help the person fix it, just a request to patch a vague vulnerability.

And when you do find the owner, the tags are stale, the original engineer moved on, and the new owner doesn't know what they inherited.

Maze's AI agents show you the fix your developers will actually implement, not just the textbook fix. Then they cross-reference your repo history, CODEOWNERS, CMDB, and other signals to find who's fixed this before, so the fix lands with the right person every time.

Vulns get closed. Period. (read more)

*Sponsored

Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Because apparently it’s consumer edge device vulnerability day ending in Y, we’ve got another PAN-OS bug getting actively exploited. This one is a buffer overflow in the User-ID authentication portal that lets an unauthenticated attacker execute arbitrary code as root. That’s about as bad as it gets.

What stands out to me is this was already being exploited before the advisory dropped. So this was a zero day. And honestly, the part I keep coming back to with a lot of these edge-device bugs is that the vendor guidance usually says the same thing every time: don’t expose these management and auth portals directly to the internet. Because these vulnerabilities happen constantly.

That’s the frustrating part. I don’t even beat vendors up too hard over some of this anymore because everybody ships vulnerable code eventually. The real issue is how often these things are internet-facing in the first place. The numbers on this one aren’t staggering, but some new evidence is pointed towards state actors out of China and hyper targeted so they don’t need numbers. (read more here, here, and here)

Coinbase Cuts Headcount By 14%, Citing AI Acceleration

Coinbase laid off about 14% of the workforce, roughly 700 people.

They are blaming AI, which at this point shows up in every layoff. “AI is changing how we work,” engineers shipping faster, non-technical teams shipping production code, workflows getting automated. I don’t even disagree with a lot of that. But I think AI is lowercase in reality and uppercase in the press release. This is cost cutting first, AI second. If you can reduce headcount and keep revenue the same, why wouldn’t you do that? That’s the magic corporate Ozempic everyone wants.

The thing a bunch of people, myself included, found concerning here. We have a financial institution saying managers will be pushed to 15+ direct reports and be asked to be individual contributors too. No pure play managers. Player coaches. etc. etc. We’ll see how far this one goes, but non-tech teams pushing code to prod sounds sexy for startups, sounds concerning for finance.

Zooming out, this isn’t just Coinbase. It’s happening everywhere. Companies trim the fat, point to AI, and say they’re more efficient. One possible outcome here is we end up with fewer massive companies and a lot more smaller ones, because it’s easier to build now. Code isn’t a moat like it used to be. But the other path is a lot uglier: widespread layoffs, less spending, everything slows down. I’m hoping we land closer to the first one. (read more)

MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

MuddyWater's getting creative with their false flag game. The Iranian state group just pulled off a ransomware attack that wasn't really about ransomware at all - they used the Chaos RaaS brand as cover while conducting what was actually a targeted espionage operation. The attack kicked off with some social engineering via Microsoft Teams, where they posed as IT support and got victims to screen-share their way into giving up credentials and bypassing MFA. Once inside, they skipped the whole file encryption thing and went straight for data exfiltration and persistence tools like DWAgent.

(Do I need to keep saying it? Help desk social engineering should be top of your list)

This fits a bigger pattern we're seeing where state actors are borrowing from the cybercrime playbook to muddy attribution waters. (get it?) It's getting harder to tell who's who when Iranian operators are using the same tools and tactics as profit-driven ransomware crews. This comes alongside other Iranian cyber escalations, including attacks on Omani government systems and that Port of Fujairah hit where stolen infrastructure data was allegedly used for missile targeting. We're watching the line between cyber and kinetic operations blur in real time.(I made a whole video about that) (read more)

Romance Scammers Turn Sweet Talk Into £102M Payday

The UK just reported more than £102 million lost to romance scams in 2025, and honestly, I think the real number is way higher due to many being unreported. These scams are working. I personally know people whose parents lost tens of thousands of dollars. One was out 30 grand, another 60 grand, and in both cases the victims still fully believed they were in real relationships. Their families become “the bad guys” for trying to stop the bleeding. Both didn’t report due to being so convinced by the scam.

That’s the part people don’t understand about these things. Once someone is emotionally locked in, logic stops mattering. One of the victims I know had their kids cutting off access to accounts and credit cards, and they still found ways to send money; gift cards, whatever they could. And the people who do realize what happened are often too embarrassed to report it, which means the stats we’re seeing are almost definitely underreported.

The scary part is these scammers are still basically playing on easy mode. They’re not even really using the scary AI stuff yet: deepfakes, voice cloning, all of that. If they’re already this successful with basic manipulation and fake personas, it’s only going to get worse once those tools become standard. (read more)

That AI Extension Helping You Write Emails? It’s Reading Them First

Unit 42 dropped a report on high-risk gen AI browser extensions, and this is one of those “you should probably read this” things. They’re seeing this stuff in the wild. Extensions that look like AI tools, or maybe actually are AI tools, but they’re also doing some sketchy stuff on the side. Data exfiltration, adware, hidden iframes, prompt hijacking, redirecting searches, all the usual nonsense, just wrapped in AI branding.

What stands out to me isn’t even that any one of these is massive. Some of them barely have users. A couple thousand here, one had like two users. That’s not the point. The point is the behavior. This stuff is getting into the Chrome Web Store, and it’s doing exactly what we’ve been talking about. Either it’s malicious from the start, or it does what it says it does for a while and then turns malicious later. (read more)

Stop deepfakes and social engineering across the employee life cycle*

Social engineering, deepfakes, and impersonation are the new security threats. Persona's Workforce IDV solution verifies real-world identity, not just credentials, with liveness detection, government ID checks, and passive signals.

From onboarding and device enrollment to MFA resets and privileged actions, identity stays secure. (read more)

Grok Tricked Into Sending Money By Prompt Injection

All right, this is super funny: someone prompt injected Grok and got it to transfer real crypto by tweeting Morse code saying “withdraw all, whatever the heck this coin is, and send it to this wallet.” Grok, being the super helpful AI that it is, decoded the Morse code and there was a special account tagged in this that actually listened to the command. It being the super helpful bot that it is said, “you got it,” and went ahead and withdrew the coin and sent it to that wallet.

Turns out the Bankr thing allocates wallets to any account that interacts with it. Even though nobody managing the Grok account had any idea, it had been accruing some coins with real monetary value. Just an objectively hilarious prompt injection. (read more)

Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server

Apache shipped httpd 2.4.67 on Sunday to patch CVE-2026-23918, a double-free in mod_http2 hitting every 2.4.66 and earlier deployment running HTTP/2. Send a HEADERS frame followed by RST_STREAM with a non-zero error code on the same stream, and two nghttp2 callbacks free the same h2_stream pointer twice. The DoS path is one TCP connection, two frames, no auth, worker dies on contact.

Researchers also built a working RCE PoC using mmap reuse and Apache's scoreboard memory as a stable target, though it needs APR with the mmap allocator (default on Debian) and an info leak. No confirmed exploitation yet, but the DoS is a weekend project for anyone with nghttp2. Patch to 2.4.67 - kill HTTP/2 as a stopgap if you can't. (read more here, here and here)

Critrical cPanel Flaw Mass-Exploited In "Sorry" Ransomware Attacks

cPanel is getting mass-exploited right now, and honestly … of course it is. This thing has been around forever, like mid-90s forever, and it’s still sitting all over the internet. CVE-2026-41940 is getting hammered by ransomware crews. The "Sorry" gang is having a field day with this one, with Shadowserver reporting at least 44,000 compromised IP addresses since Thursday. The attackers are dropping a Go-based Linux encryptor that slaps a ".sorry" extension on files and uses ChaCha20 encryption with RSA-2048 key protection.

This isn't some small-scale operation either - hundreds of compromised sites are already showing up in Google searches. Emergency patches dropped this week, so if you haven't updated your WHM/cPanel installations yet, now would be a really good time. The exploitation started back in February as a zero-day, so this crew has had plenty of time cause damage. (read more)

Microsoft Defender Wrongly Flags DigiCert Certs As Trojan:Win32/Cerdigent.A!dha

This DigiCert situation was kind of wild because it was two problems stacked on top of each other. First headline everyone saw: Microsoft Defender started flagging legit DigiCert root certs as malware, even removing them from systems in some cases. Massive false positives. That alone is chaos.

But underneath that, there was a real incident. DigiCert had a breach where attackers got access through - are you ready? You’re not going to believe it… - a customer support employee. Same playbook again. Not some AI super hacker. Just calling support, pretending to be someone they’re not, and getting access. From there, they were able to generate initialization codes for a small number of code signing certs, some of which were then used to sign malware.

So now you’ve got this weird chain reaction. Real breach leads to real abuse of certificates, which leads Microsoft to start flagging things aggressively, and now you’ve got legit certs getting nuked. Some people in my live stream chat got their days ruined for this one. Rough! (read more)

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

There's some drama brewing in the malware scene. A new framework called PCPJack is stealing creds from exposed Docker, Kubernetes, and MongoDB instances, but also actively kicking out TeamPCP infections from the same systems. SentinelLabs thinks this might be the work of a former TeamPCP member who went rogue and decided to start their own operation. "Fine, I'll start my own criminal enterprise!"

PCPJack is pretty complex for malware beef. It's exploiting fresh CVEs like the React2Shell flaw and some WordPress vulnerabilities, then exfiltrating stolen creds to Telegram channels using proper encryption. The lateral movement game is strong too - it harvests SSH keys, enumerates Kubernetes clusters, and spreads through internal networks. What's wild is how methodically it scrubs TeamPCP artifacts - processes, services, containers, etc. It's like watching one hacker crew actively evicting another from compromised systems. Professional courtesy is clearly dead. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay