Parse notes
Sponsored
Developer tool sprawl is real. You've got one tab for logs, another for metrics, half a dozen for cloud services, and somewhere in there is the code you're actually trying to ship.
brings together everything you need to build and run software in a single workspace.
A new commercial mobile spyware toolkit, ZeroDayRAT, sold via Telegram and analyzed by iVerify, offers nation-state-level capabilities, including live camera and microphone feeds, keylogging, GPS tracking, bank credential theft, and crypto clipboard hijacking, for both Android and iOS devices. The self-hosted kit uses a builder model in which operators generate payloads for their own infrastructure, distributing them via phishing, smishing, or trojanized apps. The creators deliberately obscure attribution by advertising in five languages and mixing Chinese, Russian, and Indian targeting indicators. Takedown efforts have been complicated by the decentralized operator model and Telegram's slow enforcement, making this a persistent threat with few available IoCs beyond unusual battery drain and unexplained financial transactions.
Unknown threat actors exploited vulnerable SolarWinds Web Help Desk instances in December 2025 to gain initial access, with Microsoft unable to confirm whether the attacks leveraged CVE-2025-40551 (9.8 CVSS deserialization RCE), CVE-2025-40536 (8.1 CVSS auth bypass), or CVE-2025-26399 (9.8 CVSS command execution). Post-exploitation activity included BITS abuse for payload delivery, installation of Zoho ManageEngine RMM for persistence, LSASS credential dumping via DLL sideloading, and DCSync attacks to extract domain controller password data. Organizations should immediately patch WHD, remove public access to admin paths, scan for unauthorized RMM tools such as ToolsIQ.exe, and rotate service and admin account credentials accessible from WHD.
Koi Security's threat hunting agent analyzed skills being offered on OpenClaw's ClawHub marketplace and discovered that 341/2857 of them were malicious. Most malicious extensions follow a similar pattern: the prerequisites instruct the agent to download and execute a file containing a malicious payload that installs the AMOS stealer. The post also highlights a few unique skills that download other payloads or hide their stealers and backdoors within the code itself.
The collapses of Black Basta and LockBit have triggered a violent restructuring of the RaaS ecosystem, with new entrants like DragonForce operating as vertically integrated "cartels" that embed access broker marketplaces directly into affiliate panels, compressing the window between initial access and ransomware deployment to hours. A parallel commoditization of EDR evasion tools, including BYOVD-based killers exploiting a still-valid 2006 Microsoft-signed driver, has collapsed the barrier to entry so that even low-budget operators can defeat enterprise security stacks. Defenders should prioritize enabling Microsoft's opt-in Vulnerable Driver Blocklist, monitor access broker marketplaces for organizational exposure, and shift threat intelligence from tracking ransomware brands to tracking persistent infrastructure indicators like shared SSH fingerprints and certificate reuse.
VoidLink is a Zig-based Linux C2 implant that bears strong indicators of LLM-generated code — including structured "Phase X:" labels, verbose debug logging, and documentation patterns left in the production binary — demonstrating how AI coding agents are lowering the barrier to producing functional, multi-cloud malware. The implant fingerprints AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud environments, harvests credentials from environment variables and metadata APIs, performs container escape via Docker/Kubernetes plugins, and deploys an adaptive kernel-level rootkit that selects eBPF, LKM, or LD_PRELOAD stealth based on host kernel version. Defenders should monitor for unauthorized cloud metadata API queries from workloads, audit Kubernetes service account token access, and treat verbose or structured debug artifacts in captured malware as potential indicators of AI-assisted development requiring adjusted threat modeling.
Attackers have shifted from credential theft to stealing authentication tokens for initial access. In one incident that the author observed, an attacker successfully stole an authentication token via an attacker-in-the-middle (AitM) Microsoft 365 proxy, but couldn't achieve their goals due to rapid detection and response. In a second incident, the attacker was unable to steal a token because the organization utilized FIDO2 security keys, so the authentication attempt through the AitM proxy failed.
Sponsored
Every new monitoring tool, service, or "quick integration" adds another dashboard to the pile—and before you know it, you're spending more time switching between tools than actually building. With Microsoft Azure [12], your entire stack lives in one workspace: infrastructure, data, AI, and more. See how Azure brings it all
Skill Scanner is a security scanner for AI agent skills that detects prompt injection, data exfiltration, and malicious code patterns via a combination of pattern-based detections, LLM-as-a-judge, and behavioral data analysis.
JSAnalyzer is a Burp Suite extension for JavaScript static analysis.
BlackIce is a containerized toolkit designed for red teaming AI models.
Mandiant attributed an intrusion against a FinTech entity to UNC1069, a DPRK-nexus financially motivated threat actor that leveraged a compromised Telegram account, a spoofed Zoom meeting with a reported deepfake video, and a ClickFix attack to deploy seven malware families on a macOS device — including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH. The attack chain progressed from the WAVESHAPER backdoor through the HYPERCALL downloader to deploy HIDDENCALL for hands-on keyboard access, while DEEPBREATH bypassed macOS TCC protections to steal Keychain credentials, browser data, and Telegram sessions, and CHROMEPUSH installed a malicious Chrome extension for keylogging and cookie theft. The investigation highlights UNC1069's expanding use of GenAI tools like Gemini and GPT-4o for social engineering, alongside a significant tooling refresh targeting cryptocurrency startups, software developers, and venture capital firms.
The certificates that Microsoft uses for Secure Boot are set to expire in June 2026 after 15 years of use. Users who have automatic updates enabled will receive the new updates automatically. Admins can deploy the new certificates via registry keys, Group Policy, or Windows Configuration System (WinCS). Windows 10 users who are not enrolled in extended security updates will not receive the new certificates.
Reynolds ransomware bundles a vulnerable NsecSoft NSecKrnl driver (CVE-2025-68947, CVSS 5.7) directly in its payload to terminate EDR processes from CrowdStrike, Sophos, Symantec, Palo Alto Cortex XDR, and Avast before encrypting files, eliminating the need for a separate BYOVD deployment step. Symantec and Carbon Black researchers noted a suspicious side-loaded loader on the target network weeks before ransomware execution, followed by deployment of the GotoHTTP remote access tool for persistent access. The article also covers broader ransomware developments, including LockBit 5.0's shift to ChaCha20 encryption with wiper capabilities, Interlock's use of a gaming driver zero-day (CVE-2025-61155) for BYOVD attacks, and ransomware actors increasingly targeting misconfigured AWS S3 buckets.
A phishing campaign leveraging Pride Month and diversity themes has expanded from 504 to 4,768 targeted organisations across multiple countries.
"Barriers to Secure OT Communications: Why Johnny Can't Authenticate" is a guide that addresses the cost, complexity, latency, and interoperability barriers preventing critical infrastructure operators from adopting secure industrial protocols.
Exploitation of Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8) has reached 86 confirmed compromised instances.