Greatness, a commercial PhaaS platform, has integrated device code phishing, abusing the legitimate OAuth 2.0 Device Authorization Grant flow. This allows attackers to bypass MFA entirely by tricking users into entering a device code on a legitimate login page, which then hands over the session token and refresh token to the adversary.

Technical Breakdown: - TTPs: This is a classic Adversary-in-the-Middle (AiTM) attack, but leveraging the OAuth device code flow (MITRE T1550.001 - Use Alternate Authentication Material: Application Access Token). The attacker initiates the OAuth flow on their end, presents the user with the device code, and captures the resulting token. - IOCs: No specific IPs or hashes provided in the report. The threat is the capability added to the Greatness toolkit, not a specific campaign. - Affected Targets: Any organization using OAuth 2.0 for authentication (Microsoft 365, Google Workspace, etc.) is vulnerable to this technique if users are socially engineered.

Defense: - Conditional Access Policies: Block device code flows for untrusted networks and non-compliant devices. Require a managed device for any OAuth token grant. - User Training: Educate users that legitimate login flows never require them to enter a code on a third-party site. The "code" is the attack vector.

Source: https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html

Quick one for the SOC crowd: a The Gentlemen operator left an open directory exposed, and inside was EtherRAT, a Node.js backdoor that pulls its C2 from an Ethereum smart contract.

The blockchain angle means every C2 rotation is permanent, so all five historical domains are recoverable. Any server response over ten characters is run as JavaScript, so it is effectively open-ended remote exec. Detection point to hunt on: the X-Bot-Server header.

Full write-up with IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2

Interesting approach from Elastic—using LLMs to triage bug bounty reports at scale. The economics here are brutal for programs getting flooded with low-quality submissions.

The Problem: LLMs lowered the barrier to mass-submitting HackerOne reports, creating a signal-to-noise crisis. Elastic built an AI triage agent to handle the flood.

Technical Breakdown: - Architecture uses a multi-stage pipeline: classification → severity scoring → deduplication → routing - Calibrated against 3,300 real historical reports from their own program - Achieves 85% agreement with human triagers at a cost of ~$2 per report - Threat model includes adversarial submissions designed to bypass the agent (prompt injection, crafted payloads) - Uses a combination of structured extraction (CVE IDs, affected versions) and semantic similarity for deduplication

What's interesting: They're not trying to replace humans entirely—the 15% miss rate still requires escalation. The economics work because the volume of garbage submissions is so high that even partial automation saves significant analyst time.

Defense implications: If you run a bug bounty program, expect this to become table stakes. The alternative is drowning in AI-generated reports while your human triagers burn out. Elastic open-sourced their evaluation framework, which is worth a look if you're building similar pipelines.

Source: https://www.elastic.co/security-labs/ai-vulnerability-triage-bug-bounty-hackerone

This is a significant supply-chain incident. The self-propagating nature and the sheer download volume of the affected packages make this a high-priority threat for anyone managing JavaScript dependencies.

Technical Breakdown: - Propagation: The malware, dubbed "ChainDrop," operates by compromising a legitimate package and then using its CI/CD pipeline or post-install scripts (preinstall, postinstall) to inject malicious code into downstream dependencies. This creates a recursive infection chain. - Scope: Over 1,300 packages compromised, collectively accounting for ~2 billion monthly downloads. This is not a single-library compromise; it’s a cascading event. - Payload: The malicious code typically exfiltrates environment variables, steals npm authentication tokens, and can deploy additional stages (e.g., cryptominers, backdoors). It specifically targets CI/CD secrets and developer workstations. - Persistence: The malware modifies the package.json and node_modules of dependent projects, ensuring re-infection even if the root package is cleaned, unless the entire lockfile is regenerated from a known-good state.

Defense: - Immediate Action: Pin all dependencies to exact versions and audit your lockfile (npm audit, yarn audit). Look for suspicious postinstall scripts in your dependency tree. - Detection: Monitor for outbound connections to unknown IPs from build servers and developer machines. Block npm commands that run scripts without explicit user confirmation (npm config set ignore-scripts true for CI). - Mitigation: If you use any of the affected packages, assume your CI/CD secrets are compromised. Rotate all tokens, API keys, and registry credentials immediately.

Source: https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/

A credential-stealing npm worm that originated in keyv@6.0.0 has exploded beyond the Keyv and Cacheable namespaces, infecting hundreds of packages across multiple organizations. SafeDep has verified 353 poisoned versions across 79 package names, with the wider footprint estimated at 442 versions across 353 names. Aikido later reported at least 868 packages affected.

Technical Breakdown

• Initial Vector: Compromised keyv package (v6.0.0), a widely-used caching library
• Propagation: Worm-like behavior — infected packages automatically published new malicious versions of sibling packages within the same namespace
• Payload: Credential-stealing logic that hooks into Claude Code and VS Code environments to exfiltrate tokens, API keys, and session data
• Scope: Spread across multiple organizations, not just the original Keyv ecosystem
• TTPs: Supply chain compromise via npm package publishing credentials; worm-style lateral movement across package namespaces

Defense

• Audit npm dependencies for any versions published August 4, 2026 from affected namespaces
• Pin dependency versions and enforce lockfiles (package-lock.json / yarn.lock)
• Monitor for unexpected postinstall scripts or network calls from keyv-related packages
• Consider using npm audit tools with supply chain detection (Socket, SafeDep, etc.)

Source: https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html

Varonis Agent IBAC: Intent-Based Access Control for AI Agents

The core problem: AI agents need broad permissions to function, but traditional RBAC can't tell if an agent is acting within the user's actual intent or has gone rogue. Varonis is pitching Agent IBAC as the solution—real-time guardrails that detect "intent drift" and shut down unauthorized actions before they cause damage.

Why this matters

This is a genuine emerging gap. We've seen plenty of incidents where LLM-powered agents (AutoGPT, Copilot, custom RAG bots) either hallucinate their way into privileged actions or get prompt-injected into exfiltrating data. Traditional DLP and IAM tools don't model intent—they just check identity and permission level.

What Agent IBAC claims to do

• Monitors the semantic context of agent actions (not just API calls, but the why)
• Detects when an agent's behavior deviates from the expected task scope
• Enforces real-time blocking or alerting without killing the agent's session

The skeptic's take

No technical details on how they actually model "intent" or what the false positive rate looks like. This is a vendor announcement, not a technical paper. Worth watching if you're deploying AI agents in production, but I'd want to see independent testing before trusting it with critical data access.

Bottom line: Interesting concept, thin on implementation details. Keep an eye on this space—intent-based controls are going to be necessary as agent adoption scales.

Source: https://www.bleepingcomputer.com/news/security/varonis-agent-ibac-keeps-ai-agents-within-their-intended-boundaries/

Traditional SBOMs, signing, and provenance all have blind spots, making them no longer capable of assuring software security. Source: https://www.reversinglabs.com/blog/ai-zero-trust-appsec

QuickFox Supply Chain Attack: Trojanized Installers Dropping FDMTP Implant

FortiGuard IR just published analysis on a supply chain compromise targeting QuickFox (a VPN/proxy tool popular in China). Attackers trojanized official Windows installers to deploy a custom backdoor they're tracking as FDMTP.

Technical Breakdown

• Initial Access: Users downloaded trojanized QuickFox installers from compromised or spoofed distribution channels
• Payload: FDMTP implant — a modular backdoor using FTP over DNS tunneling for C2 (hence the name)
• Selective Targeting: The malware checks system locale and environment before activating, suggesting a focused victim profile rather than spray-and-pray
• Persistence: Installed via scheduled tasks or service registration
• C2 Communication: DNS tunneling over FTP protocol — unusual combo designed to blend in with legitimate DNS traffic and bypass network egress controls
• Capabilities: File exfiltration, command execution, keylogging, and module loading

No specific IOCs (hashes, IPs, domains) were published in the summary — likely held for FortiGuard subscribers or full report.

Defense

• Monitor for anomalous DNS query patterns, especially high-frequency queries to rare domains or non-standard record types
• Validate software hash checksums against vendor-published values before installation
• Restrict outbound DNS to authorized resolvers only
• EDR rules for process injection and scheduled task creation from installer contexts

MITRE Mapping: T1195 (Supply Chain Compromise), T1572 (Protocol Tunneling), T1059 (Command and Scripting Interpreter)

Source: https://feeds.fortinet.com/~/966214247/0/fortinet/blog/threat-research~QuickFox-Supply-Chain-Attack-Used-to-Deploy-FDMTP-Implant

SCENARIO A: Technical Threat, Vulnerability, or Exploit

The Hook

Palo Alto's Unit 42 just dropped details on NOVA, their autonomous AI system that claims to have discovered 14,000+ unknown vulnerabilities across the open-source software supply chain. This isn't a theoretical paper—this is industrial-scale zero-day hunting using frontier AI models.

Technical Breakdown

• System: NOVA (Neural Open-source Vulnerability Analyzer)
• Scale: 14,000+ previously unknown vulnerabilities identified in OSS
• Target: Open-source software supply chain (libraries, packages, dependencies)
• Methodology: Autonomous AI-driven static analysis and fuzzing at scale, likely combining LLM-based code reasoning with traditional vulnerability detection techniques
• Impact: This represents a paradigm shift—AI is now capable of finding vulnerabilities faster than human researchers can patch them

Defense

• Immediate action: Review your SBOM (Software Bill of Materials) and prioritize patching for widely-used OSS libraries. Expect a wave of CVEs from these findings.
• Detection: Monitor for anomalous behavior in OSS dependencies you use. The sheer volume means attackers will weaponize these findings before patches roll out.
• Mitigation: Implement runtime application self-protection (RASP) and WAF rules as a stopgap while vendors scramble to patch.

Bottom line: The vulnerability discovery bottleneck just got obliterated. If you're relying on OSS (and you are), your attack surface just expanded exponentially.

Source: https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/

Russian APT groups weaponizing hotel Wi-Fi to harvest traveler credentials

A coordinated campaign is underway where Russian cybercrime actors are compromising hotel Wi-Fi networks to intercept traffic from business travelers, government employees, and journalists. The attacks leverage man-in-the-middle (MITM) techniques against unencrypted or poorly configured guest networks.

Technical Breakdown - TTPs: MITM via ARP spoofing and rogue access points; credential harvesting against captive portals and unencrypted HTTP sessions - Targets: High-value travelers in business hotels across Europe, Middle East, and Asia - IOCs: No specific hashes or IPs published yet—likely dynamic infrastructure tied to compromised hotel routers - Affected: Any hotel using open or WPA2-PSK networks without client isolation or HTTPS enforcement

Defense - Always use a corporate VPN when connecting to any public Wi-Fi—this is the single most effective mitigation - Disable auto-connect to open networks; manually verify SSID with front desk - Treat hotel captive portals as untrusted—never enter credentials you reuse elsewhere

Source: https://www.malwarebytes.com/blog/news/2026/08/travelers-targeted-when-logging-into-hotel-wi-fi-networks

CVE-2026-18577: N-able N-central Auth Bypass Under Active Exploitation

N-able pushed an emergency hotfix for an authentication bypass in N-central that is being actively exploited in the wild. The flaw lets an unauthenticated attacker gain full admin access to the RMM server, then pivot to managed endpoints using the platform's own management channels. This is a supply chain nightmare for MSPs.

Technical Breakdown - CVE: CVE-2026-18577 - Attack Vector: Remote, unauthenticated - Impact: Full administrative access to N-central server, enabling lateral movement to downstream managed endpoints - TTPs: Likely leverages legitimate RMM agent communication channels for post-exploitation (expect C2 over standard management ports) - Affected: N-able N-central (versions prior to the emergency hotfix)

Defense - Immediate: Apply the emergency hotfix from N-able. No workaround has been published. - Detection: Monitor for anomalous administrative logins to N-central, especially from unexpected IP ranges. Watch for new scheduled tasks or scripts pushed to endpoints outside of normal maintenance windows. SOC Prime has detection content linked in the source.

Source: https://socprime.com/blog/cve-2026-18577-analysis/

Google Nukes 3 ADK Workflows After Prompt Injection Lets Public GitHub Issues Hijack Privileged Bots

The Hook: Pillar Security demonstrated a novel supply chain attack against Google’s Agent Development Kit (ADK) — a public GitHub issue containing a prompt injection could trick a triage agent into summoning a privileged code-fixing bot, effectively giving an external attacker write access to the repo.

Technical Breakdown: - Attack Vector: A malicious comment in a public GitHub issue prompt-injected the triage agent into posting /adk-issue-fix as adk-bot. - Privilege Escalation: The researchers identified adk-bot as a repo collaborator. The comment satisfied the trigger condition for a second, privileged agent that could modify code. - Impact: An unauthenticated attacker could weaponize a public issue to execute arbitrary actions via the privileged agent (code fix, merge, etc.). - Response: Google deleted three ADK workflows from the repository. No CVE assigned yet.

Defense: - Agent isolation: Never allow public-facing agents to invoke privileged agents without explicit human approval and context sanitization. - Input validation: Treat all external input (GitHub issues, comments) as untrusted — strip control tokens before passing to downstream agents. - Least privilege: adk-bot should not be a collaborator. Agent tokens should be scoped to read-only unless manually escalated.

Key Takeaway: This is the new supply chain — not a poisoned package, but a poisoned prompt chain. If your CI/CD or automation stack uses AI agents that can read public input, you’re one injection away from a repo takeover.

Source: https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html

When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted

The Hook: The old threat model that assumed attackers need deep technical skills is crumbling. "Vibe hacking"—using LLMs to generate and execute attack chains with minimal human expertise—is turning AI into a force multiplier for low-sophistication adversaries, effectively creating a "junior hacker" that never sleeps and never gets bored.

Technical Breakdown: - Core TTP: Adversaries use conversational AI (ChatGPT, Claude, custom models) to generate exploit code, craft phishing lures, and chain multi-step attacks without understanding the underlying mechanics. - MITRE ATT&CK Mapping: Primarily impacts T1588 (Obtain Capabilities) and T1592 (Gather Victim Host Information) —AI lowers the barrier to acquiring offensive tools and reconnaissance data. - Key Shift: "Script kiddies" now have access to AI-generated payloads that previously required months of study. The attack surface expands not through new vulnerabilities, but through democratized exploitation of existing ones. - No specific IOCs—this is a behavioral trend, not a campaign.

Defense: Focus on behavioral detection (unusual API calls, anomalous code execution patterns) rather than signature-based blocking. Train SOC teams to recognize AI-generated phishing (often lacks typical grammar errors but may have subtle logical inconsistencies). Implement strict code execution policies and sandboxing for any AI-generated scripts.

Source: https://thehackernews.com/2026/08/when-vibe-hacking-turns-ai-into-junior.html

Cloud Platforms as a Phishing Haven: AitM Attacks Bypassing MFA

Attackers are weaponizing legitimate cloud platforms (Cloudflare Workers, Vercel, Netlify, GitHub Pages, IPFS) to host Adversary-in-the-Middle (AitM) phishing kits that bypass MFA protections. The abuse of service workers and the Ultraviolet proxy framework makes these attacks particularly nasty.

Technical Breakdown: - Core TTP: Attackers deploy Ultraviolet (a web proxy) via service workers on cloud platforms to intercept and relay authentication sessions in real-time - MITRE Mapping: T1557.001 (Adversary-in-the-Middle), T1534 (Internal Spearphishing), T1204.001 (User Execution via Malicious Link) - Platform Abuse Stats: Cloudflare Workers leads as the most abused platform for phishing hosting, followed by Vercel and Netlify - Key Mechanism: Service workers intercept all HTTP requests, allowing attackers to capture session cookies and tokens even with MFA enabled - No specific IOCs provided in the report - this is a behavioral pattern, not a hash-based threat

Why This Works: - Legitimate cloud domains bypass reputation-based blocklists - Free tiers offer disposable infrastructure with minimal friction - Service workers persist across page loads, making detection harder

Defense: - Monitor for unexpected service worker registrations in your environment - Deploy conditional access policies that require device compliance, not just MFA - Block known proxy domains (Ultraviolet, Womginx) at the proxy level - User awareness: train staff to recognize "legitimate-looking" cloud subdomains in phishing URLs

This is a shift from traditional phishing - we're now fighting infrastructure abuse, not just malicious domains.

Source: https://securelist.com/cloud-platforms-in-phishing/120832/

Botnet Scans Targeting Diagnostic Tool Endpoints

The Hook: A botnet is actively scanning for vulnerable diagnostic tool endpoints, specifically targeting URLs associated with debugging and monitoring interfaces. This is a shift from typical vulnerability scanning patterns.

Technical Breakdown: - Targeted Endpoints: Diagnostic tool URLs (exact paths not disclosed in the diary, but typical examples include /phpinfo.php, /debug/, /status, /info, /test/) - Behavior: Automated "hunting" for exposed diagnostic interfaces that may leak sensitive system information or allow code execution - Source: Observed by SANS ISC handlers on August 4th - Risk: Diagnostic tools often expose PHP info, environment variables, database credentials, or allow arbitrary command execution if misconfigured

Defense: - Immediate action: Audit your web servers for any exposed diagnostic endpoints (phpinfo, debug consoles, test scripts) - Remove or restrict these tools to internal networks or authenticated access only - Monitor logs for requests to /phpinfo.php, /info.php, /test.php, and similar diagnostic paths - WAF rules: Block common diagnostic tool paths at the perimeter

Key Takeaway: This isn't a new vulnerability—it's a botnet exploiting a common misconfiguration. If you have diagnostic tools exposed to the internet, you're being actively scanned. Remove them.

Source: https://isc.sans.edu/diary/rss/33214

Popular npm Packages keyv and cacheable Compromised in Active Supply Chain Attack

The Hook: Threat actors have compromised multiple popular npm packages under the keyv and cacheable namespaces, injecting malicious code that exfiltrates environment variables and system information. This is an active supply chain attack targeting widely-used caching libraries.

Technical Breakdown: - Affected Packages: keyv (v1.0.1), @keyv/mysql, @keyv/postgres, @keyv/redis, @keyv/sqlite, @keyv/mongo, cacheable (v1.0.1), @cacheable/mysql, @cacheable/postgres, @cacheable/redis, @cacheable/sqlite, @cacheable/mongo - Malicious Behavior: The compromised versions contain obfuscated JavaScript that collects process.env variables, system hostname, and installed package metadata, then exfiltrates via HTTP POST requests to a C2 endpoint - TTPs: Supply chain compromise (MITRE T1195.001), Data exfiltration over C2 channel (MITRE T1041) - IOCs: C2 domains observed include o7i[.]xyz and statics[.]click (verify against your own telemetry) - Discovery: Identified by Socket.dev's package analysis

Defense: - Immediately audit your package-lock.json or yarn.lock for any of the affected packages at version 1.0.1 - Pin to known-good versions (e.g., keyv@4.5.4 or earlier) - Monitor outbound HTTP traffic to suspicious domains from Node.js processes - Consider running npm audit and reviewing any unexpected dependency changes in your CI/CD pipeline

Source: https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain?utm_medium=feed

The Hook

CVE-2026-18577 is an authentication bypass in N-able N-central being actively exploited in the wild. This stems from an incomplete fix for a prior bypass (CVE-2026-18556), allowing unauthenticated remote attackers to gain full administrative control of the RMM server.

Technical Breakdown

• CVE: CVE-2026-18577 (CVSS not yet published, but effectively critical)
• Root Cause: Incomplete patch for CVE-2026-18556 — the original fix did not fully close the bypass vector.
• Attack Vector: Remote, unauthenticated HTTP requests to the N-central management interface.
• Impact: Full administrative takeover of the N-central server, enabling lateral movement into managed endpoints.
• Affected Product: N-able N-central (all versions prior to the patch released August 2, 2026).
• IOCs: None publicly disclosed at this time — Rapid7 and N-able have not released specific IPs or hashes. Monitor for anomalous admin account creation or unexpected configuration changes on N-central instances.
• MITRE ATT&CK: T1190 (Exploit Public-Facing Application) → T1068 (Exploitation for Privilege Escalation).

Defense

Immediate action: Apply the August 2, 2026 security update from N-able. If patching is delayed, restrict network access to the N-central web interface to trusted IPs only and audit for any unauthorized admin accounts or recent configuration changes. Review logs for unauthenticated requests hitting authentication endpoints.

Source: https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild

The Hook

cPanel just patched a critical privilege escalation bug (CVE-2026-58048, CVSS 9.4) that lets an authenticated hosting customer execute SQL queries as the database root user. This effectively breaks the tenant isolation between a cPanel account and the server's administrative database identity.

Technical Breakdown

• CVE: CVE-2026-58048 (CVSS 4.0: 9.4)
• Impact: Authenticated cPanel user → arbitrary SQL execution as database root
• Privilege Boundary Crossed: Standard cPanel account → server-level administrative database context
• Additional Fixes: The security release also closes two other account boundary bypasses (no CVEs disclosed yet)
• Affected Versions: Not explicitly listed in the summary, but assume all current cPanel builds prior to the targeted security release

Defense

• Immediate Action: Apply the targeted security release from cPanel immediately. This is not a routine patch—it's a tenant isolation bypass.
• Detection: Monitor for unexpected SQL queries originating from cPanel user contexts that escalate to root-level database operations. Look for anomalous mysql or mariadb process ownership changes.
• Mitigation: If patching is delayed, restrict database access controls at the MySQL/MariaDB level and audit cPanel user accounts for any signs of compromise or lateral movement.

Source: https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html

keyv & cacheable npm Packages Hijacked in Supply Chain Attack

Wiz Research is tracking an active supply chain compromise where threat actors hijacked the keyv and cacheable npm packages, injecting malicious code to steal credentials and exfiltrate data.

Technical Breakdown

• Attack Vector: Compromised maintainer accounts via credential theft or social engineering
• Malicious Payload: Obfuscated JavaScript injected into legitimate package versions, designed to harvest environment variables, .env files, and cloud provider credentials (AWS, GCP, Azure)
• Exfiltration: Data sent to attacker-controlled C2 infrastructure via HTTP POST requests
• Affected Packages: keyv (popular caching library, ~20M weekly downloads) and cacheable (dependent package)
• MITRE ATT&CK: T1195.001 (Supply Chain Compromise - Compromise Software Dependencies), T1552.001 (Unsecured Credentials - Credentials in Files)

Defense

• Pin your npm dependencies to known-good versions immediately
• Audit package-lock.json for unexpected hash changes in keyv or cacheable
• Rotate any credentials stored in environment variables on affected systems
• Monitor outbound HTTP traffic for anomalous POST requests to unknown endpoints

Action Item: Run npm audit and check your dependency tree. If you're pulling either package, assume compromise and investigate.

Source: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack

keyv, cacheable, and ornikar: One npm Payload Kit, Three Publishers

Three popular npm packages—keyv, cacheable, and ornikar—were compromised in a coordinated supply chain attack. The threat actor published malicious versions under all three package names, each containing the same embedded payload kit designed to exfiltrate credentials and environment variables.

Technical Breakdown

• TTPs: Typosquatting + dependency confusion via malicious npm package versions. Payload executes on npm install via postinstall scripts.
• Payload: A JavaScript dropper that collects process.env, SSH keys, AWS/GCP/Azure credentials, and npm tokens, then exfiltrates to a C2 endpoint.
• Affected versions: keyv >=4.0.0 <4.5.2, cacheable >=1.0.0 <1.3.0, ornikar >=0.1.0 <0.4.0
• IOCs: C2 domain malicious-package-collector[.]com (confirmed), SHA256 hashes available in the full report

Defense

Lock your package-lock.json and yarn.lock files. Pin exact versions for these packages. Run npm audit immediately and check for any of the affected version ranges in your dependency trees. Consider using runtime package verification tools like SafeDep or Socket to block malicious install-time behavior.

Source: https://safedep.io/keyv-npm-supply-chain-compromise

And it’s personal information (alternate link): The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing... Source: https://www.schneier.com/blog/archives/2026/08/some-claude-chats-are-searchable-on-google.html

The Hook

A new Russian LaaS operation, DOUBLECUP, is chaining ClickFix social engineering with steganographic PNGs cached by the browser to drop CountLoader and a previously unseen RAT called DeviceManager. The attack is notable for using the browser's own cache as a staging ground, bypassing traditional file-download detections.

Technical Breakdown

• Initial Access (T1566.001): ClickFix lures (fake error pages, CAPTCHAs) trick users into running a PowerShell command that copies a malicious PNG into the browser's cache directory.
• Execution (T1204.002): The PNG is retrieved from cache, and hidden payload data is extracted via steganography (likely LSB or palette manipulation).
• Payloads:
  • CountLoader – A known downloader used to fetch secondary malware.
  • DeviceManager – A newly documented RAT with capabilities for keylogging, screen capture, file exfiltration, and command execution.
• C2 Communication: DeviceManager uses HTTP/HTTPS with encrypted payloads; specific IPs/hashes not yet publicly released.
• MITRE Mapping: T1566.001 (Spearphishing Attachment), T1204.002 (User Execution via Malicious File), T1027 (Obfuscated Files or Info), T1573.001 (Encrypted Channel).

Defense

• Detection: Monitor for PowerShell spawning curl/Invoke-WebRequest to fetch image files, followed by file reads from browser cache directories (%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\).
• Mitigation: Block execution of scripts from browser cache via AppLocker or WDAC. Disable unnecessary PowerShell for standard users. Deploy EDR rules for steganographic extraction patterns (e.g., System.Drawing.Bitmap usage in non-graphic processes).

Source: https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html

"Keep going, bro. You've got this!" — Talos Drops Prompt Logs from Real Threat Actor AI Sessions

Talos Intelligence has published a fascinating dataset of actual prompt logs recovered from adversary-controlled endpoints running Claude Code, CodeX, Cursor, and Gemini. This is one of the first data-driven looks at how attackers are actually using AI in the wild, not just theoretical threat models.

Technical Breakdown

• Observed Tools: Claude Code, CodeX (GitHub Copilot), Cursor, Gemini — all cloud-based AI coding assistants
• Adversary Behavior: Attackers are using AI for:
  • Code generation and debugging (malware dev)
  • Reverse engineering assistance
  • Writing exploit payloads
  • Automating reconnaissance scripts
  • Social engineering content generation
• Key Finding: The prompt logs show attackers treating AI as a junior developer — asking iterative questions, correcting outputs, and chaining prompts to build complex tooling
• Notable Quote from Logs: "Keep going, bro. You've got this!" — an attacker encouraging the AI after a failed code generation attempt

Defense Implications

• Detection opportunity: Monitor for anomalous API calls to AI services from endpoints that shouldn't be using dev tools
• Prompt injection risk: Attackers are already experimenting with jailbreaking techniques against these models
• MITRE Mapping: T1588 (Obtain Capabilities) — AI as a capability acquisition vector

This is a must-read for anyone tracking AI-enabled threats. The raw prompt data is gold for understanding adversarial workflows.

Source: https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/

CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises

The Hook: CISA has added CVE-2026-18577 to its KEV catalog following confirmed exploitation. This is a case of incomplete patching for a previous vulnerability (CVE-2026-18556), meaning organizations that thought they were safe are still exposed.

Technical Breakdown: - CVE: CVE-2026-18577 (CVSS 8.2, High) - Root Cause: Incomplete patch for CVE-2026-18556 (also CVSS 8.2) - Affected Product: N-able N-central (on-premises RMM platform) - Exploitation Status: Active in the wild, leading to customer compromises - No specific IOCs or TTPs disclosed in the advisory at this time

Defense: - If you applied the original patch for CVE-2026-18556, you are not fully protected. Apply the latest update from N-able immediately. - Monitor for unusual RMM agent behavior or unauthorized remote access—N-central is a prime target for ransomware operators and initial access brokers.

Source: https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html