Parse notes
Sponsored
AI is lowering the technical barrier for attackers, making phishing, scams, deepfakes, and prompt manipulation easier to launch at scale. Cato's AI in Cybersecurity certification [4] gives your team a clear, practical foundation on what is changing and how to respond.
PhantomRaven, an ongoing npm supply-chain campaign active since August 2025, has deployed 88 additional malicious packages across four attack waves, using slopsquatting to mimic projects like Babel and GraphQL Codegen with LLM-suggested package names. The campaign evades automated inspection via Remote Dynamic Dependencies (RDD), in which `package.json` points its dependencies to attacker-controlled external URLs, pulling and executing malware at `npm install` time rather than embedding it in the package itself. The payload harvests `.gitconfig`, `.npmrc`, environment variables, and CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI before exfiltrating to EC2-hosted C2 infrastructure, with 81 packages still live in the registry as of this writing.
BeatBanker is a dual-mode Android Trojan distributed via a fake Google Play Store page that targets Brazilian users. Once active, it overlays fake screens on crypto apps like Binance and Trust Wallet to silently swap USDT destination wallet addresses, while also deploying the BTMOB RAT for full remote access, including camera, mic, GPS, and remote wipe. It plays an inaudible 5-second audio loop to prevent the OS from killing its background process. Treat unsolicited Accessibility permission requests as an immediate red flag and avoid sideloading APKs from third-party sites.
In 2024, Chinese CDN firm Funnull bought Polyfill[.]io and then used cdn.polyfill[.]io to push malicious JavaScript that redirected visitors to gambling and adult pages. Hudson Rock later linked Funnull to North Korean operators using LummaC2 infostealer data from a hacked North Korean hacker device, which exposed logins for Funnull DNS and the Polyfill Cloudflare tenant. The traffic went into Suncity Group gambling sites to launder large amounts of cryptocurrency back to North Korea and also exposed a separate North Korean agent inside crypto exchange Gate.
Hunt.io uncovered an exposed open directory on 203.161.50[.]145 containing a complete APT28 Roundcube exploitation toolkit. This toolkit overlaps with 14 TTPs observed in Operation RoundPress, targeting Ukraine's State Migration Service using XSS payloads that simultaneously harvest credentials through hidden autofill forms, install persistent Sieve forwarding rules to advenwolf@proton[.]me, bulk exfiltrate emails via the viewsource API, extract TOTP secrets, steal address books, and deploy Chrome/Firefox credential stealers. New capabilities not previously linked to APT28 include a CSS selector side-channel attack for CSRF token extraction, a Go-based Linux backdoor with cron, systemd, and SELinux persistence mechanisms, along with container escape detection scripts. These scripts indicate regular targeting of Docker and Kubernetes environments. Defenders using Roundcube should immediately review all Sieve forwarding rules, implement a strict Content Security Policy that blocks eval() and external resource loading, monitor for bulk viewsource API requests and CSS @import chains with incrementing query parameters, and consider password resets insufficient without full 2FA re-enrollment and session invalidation.
Weightsquatting is a supply-chain attack that manipulates token-space weights in open-weight LLMs to bias code-generation output toward attacker-chosen package names, surviving format conversion, 4-bit quantization, and GGUF export. Llama 3.2 and Qwen 2.5 accepted the poisoned edits cleanly while remaining coherent, whereas DeepSeek models either collapsed visibly or reasoned past the manipulation. Organizations deploying local coding assistants should implement routine behavioral validation of model artifacts against known-good dependency outputs before production use.
Many LLM users try to prompt an LLM the same way that they search Google: using keywords instead of rich prompts. The author of this post presents some tricks to more effectively prompt an LLM, such as role stacking, being explicit about the desired technology stack, requesting thoroughness, asking for validation, and thinking in terms of long-term systems vs. point-in-time solutions. They stress the importance of keeping humans in the loop to add judgment and intuition.
Sponsored
Claude, Cursor, and Copilot use MCP, skills, and shell commands to access credentials and environments — all unmonitored and ungoverned. If your team can't inventory what's running, you can't secure it. MCPTotal [12] runs a complimentary Shadow AI Discovery Report that maps AI agents and tools on endpoints across your
n.eko is a self-hosted virtual browser that runs in Docker and streams a full desktop environment to multiple simultaneous users over WebRTC with built-in audio support. Security-relevant use cases include containerized throwaway browsing with Tor, a VPN-backed isolated session, a jump host for internal app access without VPN, and an automated browser for Playwright/Puppeteer workflows with live interception.
VM.Analyst is an AI agent that ingests and normalizes data from existing security tools, then provides contextual, prioritized vulnerability-risk insights and remediation recommendations.
A lightweight security threat scanner intended to make malware detection more accessible and efficient.
Mandiant's 2026 hardening guide covers five core focus areas for defending against destructive cyberattacks: external-facing asset hardening, critical asset and backup protections, on-premises lateral movement controls, credential and account protections, and Kubernetes/CI/CD pipeline security. The guide provides prescriptive, actionable controls spanning MFA enforcement, virtualization enclave architecture, AD CS hardening, NTLM restriction, WDigest disablement, and LAPS deployment, each paired with MITRE ATT&CK-mapped detection opportunities. Organizations operating hybrid or cloud environments should treat this as a living reference, particularly given the guide's coverage of hypervisor-level disk swap attacks, immutable backup architecture, and CI/CD supply chain compromise scenarios.
INC's affiliates have shifted from initial US/UK targeting into Australia, New Zealand, and Tonga, hitting hospitals, clinics, and ministries using purchased credentials, phishing, and known-vuln exploits. Australia logged at least 11 incidents since mid-2024. A Tongan MoH intrusion disrupted national health services, and a New Zealand provider had data stolen, encrypted, and leaked.
Researchers found nine cross-tenant issues in Google Looker Studio that allowed arbitrary SQL on connected data sources and broader GCP projects, including BigQuery, Spanner, PostgreSQL, MySQL, and Google Sheets. Attackers could hijack reports, reuse stored credentials, and trigger one-click data exfiltration via crafted reports and browser-side code.
Sponsored
Remote monitoring and management (RMM) abuse often starts with phishing. This allows attackers to exploit legitimate, pre-installed
ENISA framework secures dependency supply chains through curated package selection, integrity enforcement during integration, continuous vulnerability monitoring, and rapid mitigation to counter malicious injection and compromised dependencies.
Basel-Stadt's e-voting pilot failed to decrypt 2,048 online ballots from Swiss referendums after three USB sticks with the correct code all malfunctioned, even with IT help.
The AiLock ransomware gang claims to have stolen 129GB of data from England Hockey and threatens to publish it unless a ransom is paid, with the organization confirming an active investigation.