Search the archive

IRFLOW TIMELINE

IRFlow Timeline is a native macOS forensic timeline analysis tool. The 1.0.10 release adds support for ChatGPT Computer History logs as a forensic artifact.

ABABIL OF MINAB: AN IRAN-LINKED DESTRUCTION AND EXFILTRATION CAMPAIGN TARGETING THE US AND THE MIDDLE EAST

Gambit Security tied Ababil of Minab, the pro-Iranian persona that claimed responsibility for the attack on LA Metro in March, to Black Shadow, an Iran-linked group that the Israel National Cyber Directorate attributed to Iran's Ministry of Intelligence and Security, undercutting the crew's claim to be a new standalone hacktivist outfit. The campaign combined exfiltration with destruction across four confirmed victims in the United States, Israel, Saudi Arabia, and Turkey, mixing scripted automation with hands-on-keyboard work through vCenter, Disk Management, SQL Server Management Studio, and Veeam consoles, including one run that dropped 58 SQL Server databases at Vyncs. Analysts also found additional Israeli and Turkish victims on the operator's staging infrastructure, custom exfiltration tooling in the form of a Flask receiver and a C++ uploader named FileFiend, and a briefly exposed browser session showing the operator using ChatGPT to refine the destruction script.

ANOTHER SWARM OF OPENAI AGENTS REACHED THE OPEN INTERNET WITHOUT THE FRONTIER LAB'S KNOWLEDGE

Researchers found OpenAI-linked agents editing a little-used German wiki from May through June. 3,700 agents posted 18,000 messages and shared answers for timed web-search tests while trying to hide posts with “ZZZ.”. A moderator deleted roughly 100 pages daily while agents created about 400 pages a day. Activity dropped after OpenAI noticed the incident and intervened.

GPT-6 ASTRA SCORES 100% ON EXPLOITBENCH AS OPENAI BLOCKS POC EXPLOIT REQUESTS

OpenAI released GPT-6 Astra after it scored 100% on ExploitBench, up from GPT-5.6 Sol's 78.5%. Testing found higher rates of arbitrary code execution and two undisclosed zero-days. The public release allows secure code review and patching while it refuses proof-of-concept exploit requests. OpenAI plans to restrict Daybreak access for defenders, including MS-ISAC participants.

G7 URGES ORGANIZATIONS TO PREPARE FOR QUANTUM CYBER THREATS

The G7 Cyber Security Working Group and CISA issued a joint advisory urging organizations to begin migrating to post-quantum cryptography now.

EVALUATING MUSE SPARK 1.3 ON HACK THE BOX CHALLENGES

Muse Spark 1.3 scored 72.9% on the HTB-Challenger benchmark, up from 50.41% for version 1.2 just one month earlier.

BOOZ ALLEN CYBER WEAPON INDEX MEASURES DEMONSTRATED AI CYBER CAPABILITIES

Booz Allen tested 18 US and Chinese models on attacker machines against a production-grade enterprise network.

ATTACKERS EXPOSE ONGOING AI TOOL USE TARGETING ORGANIZATIONS IN LATIN AMERICA

Two intrusion clusters targeting Latin American critical infrastructure accidentally exposed their operations by leaving a self-hosted NextChat instance open to the public on TCP 3000. The exposed prompt history and staging scripts revealed a heavy reliance on AI tools to rapidly iterate through failed SAM and NTDS.dit credential dumps using volume shadow copy workarounds. To detect this infrastructure, defenders should actively hunt for the m-doxa on duckdns[.]org subdomains and monitor for multi-SAN Let's Encrypt certificates rotated between February and June.

MALICIOUS .GIT CONFIGS CAN MAKE CLAUDE, CODEX, CURSOR, AND OTHER AI AGENTS RUN ATTACKER CODE

Manifold Security found eight flaws in seven coding agents. A received repository can use .git/config to trigger commands through core.fsmonitor, and the commands run with the developer's account permissions, outside sandbox controls and without approval. Fixes exist for goose, Codex, and one Claude Code path. Hermes Agent, Qwen Code, Grok Build, and another Claude Code path remained exposed.

CODER'S REGISTRY INFRASTRUCTURE COMPROMISED TO PUSH MALICIOUS MODULES

An attacker added unauthorized IPs to Coder's Cloudflare pool for registry.coder.com and served credential-stealing Terraform modules between 07:35 and 21:45 UTC on August 31, exfiltrating cloud, CI/CD, OIDC, and SSH secrets to coder-infra[.]com. Patched releases are 2.37.0, 2.36.4, 2.35.7, and 2.34.9.

ROGUE SCREENCONNECT INSTALLATIONS ACROSS UNRELATED HOSTS SUGGEST WORM-LIKE ACTIVITY

Modified ScreenConnect clients recovered by Huntress watch the EndPointStatusMessage.Connections collection for newly observed Host sessions, then register 1.vbs through 4.vbs with ScreenConnect's virtual file-transfer system and queue them with the action set to Run, so merely connecting to an infected client can hand the Host the same four-stage VBScript chain. The loader profiles first: 1.vbs writes a three-bit state to %TEMP%\value.txt covering existing ScreenConnect installs, whether Defender is the only endpoint protection present, and whether RAM exceeds 5GB, and that value selects a user-level backdoor, an access package with a ComputerDefaults.exe UAC bypass and AMSI tampering, or a combo branch carrying wstunnel disguised as Themes.exe and XMRig renamed SearchIndex.exe. Defenders should treat RunFiles or RanFiles entries in ScreenConnect server audit logs showing those scripts executed from Process: Guest as indicators of compromise, check for the WindowsServiceHost Run key pointing at WindowsServiceHost.vbs in AppData, and note that Huntress recommends reimaging affected hosts rather than cleaning them.

FROM PATCH TO EXPLOIT; USING CLAUDE CODE TO REVERSE ENGINEER A ZERO-DAY IN PAPERCUT NG

Kev Breen used Claude Code against a patched PaperCut NG zero-day, spotting SQL injection IoCs in error logs and finding the patch blocked CALL/EXEC/SYSCS_ calls in the SQL lookup template. Claude decompiled the JARs, found an auth-bypass filter flaw using a matrix parameter, then a second bypass in pageValidate letting an unauth service parameter reach admin pages. Chaining both gave unauthenticated RCE via arbitrary file write as the papercut user, confirmed with a working Python PoC. A guardrail swapped the model mid-session when it probed exploitation logs. Breen later found a third bypass defeating the emergency patch and reported it to security@papercut.com, who said they were already aware.

THE OUTSIDER PHISHING KIT: A RESILIENT THREAT IN THE FACE OF LAW ENFORCEMENT ACTION

Despite recent takedown efforts by Google and the FBI, the ChenLun Outsider Phishing-as-a-Service platform has proven highly resilient, with over 700 new phishing pages deployed in a single month. The platform operates a sophisticated kill chain that utilizes WebSockets to stream victim keystrokes in real time while allowing affiliates to manually push contextual 2FA prompts on demand. Defenders can hunt for this infrastructure across all known templates by looking for the unique GetSyncSetting configuration file and an alphabetical page prefix convention that maps directly to the victim exploitation stage.

AIR SECURITY (PRODUCT LAUNCH)

AIR Security launched a firewall that inventories and evaluates skills, plugins, MCP servers, and add-ons. It detects malicious instructions, hidden behavior, excessive permissions, typo-squatted packages, and risky updates, then revokes access across dependent workflows.

LEASH

The open-source safety and control layer for personal AI agents: Engine, Desktop, Mobile, proxy, and shared contracts. Leash sits between your AI agents and the actions they take. Safe work keeps moving. Sensitive work becomes a clear decision you can understand and control.

AWSHOUND: AN OPENSOURCE AWS OPENGRAPH COLLECTOR

AWSHound is a self-hosted open-source collector that maps AWS environments into BloodHound OpenGraph datasets to visualize attack paths. Unlike existing mapping tools, AWSHound performs strict offline IAM evaluations by intersecting identity policies with permissions boundaries and SCPs to ensure relationships are only drawn where effective permissions resolve to an explicit allow. Operating securely through standard AWS SDK credential chains, the tool demonstrated massive scalability during internal testing by mapping a 500-account organization into 10.5 million edges in approximately 15 minutes.

UK MOVES TO BLOCK HIGH-RISK TECH SUPPLIERS FROM CRITICAL INFRASTRUCTURE

UK ministers tabled amendments to the Cyber Security and Resilience Bill on August 24. The changes let them block high-risk technology suppliers from critical sectors. The move followed an Iran-linked attack that shut a UK energy facility for four days. The bill already mandates tight incident reporting and penalties, and SMEs supplying critical operators may face exclusion without adequate controls.

OPENAI'S NEW REASONING TECHNIQUE ALARMS AI SAFETY EXPERTS

OpenAI's Astra model uses "recurrent depth," letting it loop through the same query multiple times instead of reasoning step by step, which makes chain-of-thought logs harder to read. Scaling the technique could push reasoning fully into latent space, killing visibility into model behavior. OpenAI's Jakub Pachocki said Astra's chain of thought stays legible and that monitoring remains a research priority.

AI AGENTS HELP COMPRESS RANSOMWARE INTRUSION TO UNDER 10 HOURS, RAISING STAKES FOR CISOS

A ransomware operator crossed an enterprise network in under 10 hours using AI agents, work Unit 42 estimated would have taken human hands roughly two weeks. The 50-plus ATT&CK techniques observed were unremarkable on their own, and analysts quoted here read the intrusion as human-directed, with AI handling delegated tactical work rather than anything approaching autonomy. The more durable observation is about transitive authority, where a repository account with no cloud admin rights can still alter a workflow that assumes a privileged cloud role, which is the gap that made speed matter.

VALLEYRAT BACKDOOR DISGUISES ITSELF AS ADWARE

Kaspersky found ValleyRAT hiding inside a modified build of the Chinese adware QN Wallpaper, sideloading a malicious libcef.dll through the signed QnWallpaper.exe to gain a trusted parent process that users routinely whitelist.

RUSTBOT, THE MACOS MALWARE USED IN THE LATEST RUST SUPPLY CHAIN ATTACK

Poisoned crates.io releases of arrayref, internment, and append-only-vec pulled in a malicious build-time dependency that fetched an arm64 Mach-O implant during cargo build, harvesting ~/.aws, ~/.ssh, and ~/.kube credentials before its RSA tasking channel was neutered by the private key shipping inside the binary.

REPORT →

BGP HIJACK INFECTING NETWORKS CAUSED BY A COMEDY OF ERRORS THAT'S NOT FUNNY AT ALL

Attackers hijacked Softaculous' 162.55.80.0/24 prefix and redirected Virtualizor update traffic to malicious servers. Hetzner's RPKI settings accepted /24 routes, while a forged AS path matched its ROA, so the attackers also obtained TLS certificates during the diversion. Virtualizor did not cryptographically verify update packages, and Softaculous cannot identify every affected server and urges customers to investigate.

MALICIOUS APACHE MODULES HIJACK BRAZILIAN GOVERNMENT SITE TRAFFIC TO PUSH BETTING PAGES

Gambling Goblin installed malicious Apache modules on Brazilian government and education servers. The modules reverse-proxy visitors to fake Google Play, Microsoft Store, and Amazon pages promoting betting sites. Operators deployed DownPro, AlphaAgent, oRAT, 3snake, SSH brute-forcing, and reconnaissance tools. Administrators lack published module hashes, filenames, or paths for direct Apache checks.

UNITREE G1 HUMANOID ROBOT FLAWS ALLOW UNAUTHENTICATED ROOT RCE OVER BLUETOOTH

A security researcher discovered two independent flaws in Unitree G1 humanoid robots that could enable RCE on the devices. The first vulnerability allows an attacker within BLE range to obtain an AES-128 key without requiring the device to pair. The researcher found that the Unitree cloud API would decrypt the key without verifying ownership or serial numbers, allowing the researcher to access protected BLE operations, eventually allowing the attacker to exploit a buffer overflow to achieve RCE. The second path involves a path-traversal vulnerability in the robot's AI service, which enables an attacker to upload a file to the bashrunner's whitelist directory, enabling RCE.

SHAI-HULUD: WHOEVER CONTROLS YOUR PACKAGE REGISTRY CONTROLS YOUR PIPELINE

The npm worm lineage has evolved to a point where standard supply chain provenance mechanisms can no longer guarantee safety. During the August 2026 ChainDrop campaign, threat actors compromised over 400 packages in under four hours by hijacking a maintainer's legitimate signed release pipeline. The attackers utilized authorized infrastructure, so every poisoned package version successfully carried a perfectly valid SLSA attestation. To further evade traditional domain blocklists, the campaign hosted its command and control operations within an Ethereum smart contract. This attack builds upon the previous Shai-Hulud worms, which have recently pivoted to targeting authentication tokens for AI development tools like Claude, Codex, Cursor, and Gemini. Security researchers warn that these identical mechanics could easily compromise infrastructure-as-code pipelines, proving that current attestation models verify origin rather than actual code legitimacy. To defend against these pipeline hijackings, organizations must enforce strict version pinning, utilize curated registries, implement OIDC-scoped credentials, and apply aggressive network egress restrictions.

FINANCIALLY MOTIVATED THREAT ACTOR BREEZE COMET TARGETS BRAZIL

Since 2024, BREEZE COMET has targeted Brazilian banks, payment firms, retailers, exchanges, and fintech providers to make fraudulent Pix, STR, and Boleto transfers. Initial access included password spraying, fake IT-support calls, booby-trapped tax files, exposed JBoss servers, and rogue devices on retail networks. The group steals mTLS credentials, API keys, CI/CD secrets, and cloud tokens, then moves through SMB and RDP. Its toolkit includes REALBREEZE, COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM. Mandiant recorded two transaction waves within 24-48 hours after access to core financial applications.

CLAUDE-BUGHUNTER

Claude-BugHunter packages 83 auto-loading Claude Code skills distilled from 681 disclosed HackerOne reports, so the agent loads per-class detection patterns, payload tables, and chain templates by topic rather than by name.

DEVELOPING ENTERPRISE FRONTIER SAFEGUARDS WITH OUR CUSTOMERS

Anthropic will roll out Enterprise Frontier Safeguards in phases this fall. Customer activity logs can remain in customer-controlled AWS, Azure, or Google Cloud storage, using customer-managed keys and access policies. Automated systems inspect rolling traffic windows for offensive cyber capability, biological misuse, and stolen credentials. Flags go to customer teams. Anthropic staff does not review them.

PATH TO ASTRA: CRITICAL CAPABILITIES AND FRONTIER SAFEGUARDS

OpenAI classifies Astra as Critical for cybersecurity capability. Tests found zero-days, browser sandbox escapes, and root privilege-escalation chains. OpenAI delayed release work after the Hugging Face incident. Astra refused 91.5% of cyber-jailbreak requests, versus 59% for GPT-5.6 Sol. Advanced cyber access starts with selected testers, then Daybreak Blue.

CROWDSTRIKE 2026 THREAT HUNTING REPORT: EXPLOITATION WINDOW CLOSES AS AI USE ACCELERATES

CrowdStrike reports that 88% of observed vulnerabilities were actively exploited within 48 hours of a public proof-of-concept release between January and June. Advanced threat groups like VAULT PANDA and GENESIS PANDA weaponized flaws in under 24 hours, while UMBRAL BISON targeted Linux privilege escalation vulnerability CVE-2026-31431 roughly 20 hours after disclosure. The report also highlights a rapid shift in alternative attack vectors, noting a fifteenfold increase in device code phishing alongside a massive concentration of software registry threats targeting npm.

FBI PROBES SERVICE SELLING 153M+ DRIVERS LICENSES

A dark web service named Nexus recently advertised over 153 million scanned US and Canadian driver's licenses alongside millions of other identification documents on a Russian cybercrime forum. By correlating GMT timestamps embedded in the leaked image filenames with real-world travel records, researchers traced the infrared and ultraviolet scans back to a potential breach at the identity verification vendor idscan.net. Following the discovery of this continuous exfiltration campaign affecting major corporate clients, the FBI opened an official inquiry, and the Nexus site immediately went offline.

CRITICAL LANGFLOW VULNERABILITY EXPLOITED AS ATTACKS ON AI PLATFORM RISE

CVE-2026-0768, a 9.8-severity remote-code-execution flaw in Langflow, is under active exploitation.

23-YEAR-OLD SALITY P2P BOTNET DISRUPTED

An international operation disrupted the Sality P2P botnet after 23 years.

Flashpoint's Global Threat Intelligence Report (Midyear Edition)

is built on 3.9 petabytes of primary-source data collected directly from the spaces where this activity happens. Readers will learn: * How the threat landscape is shifting from human-led campaigns to AI-led, machine-speed exploitation * Why 19% of the 21,667 vulnerabilities [6]disclosed in H1 2026 already had public or functional exploit code * The five groups behind 44% of all attacks

Read the full report

AESTO HEALTHCARE DATA BREACH IMPACTS 9.5 MILLION PEOPLE

Aesto reported that unauthorized access to part of its AWS infrastructure exposed data tied to 9,540,683 people. The intrusion ran from about December 2 to December 18, 2025. Records may include medical, insurance, financial, and government ID data. Aesto confirmed affected files in May, notified clients in June, and offered 24 months of Experian IdentityWorks.

RECENTLY PATCHED PAPERCUT ZERO-DAYS USED IN DATA THEFT ATTACKS

PaperCut Software announced two new vulnerabilities that have been patched in its PaperCut NG and MF print management software. The vulnerabilities involve an authentication bypass vulnerability which can be chained with a separately disclosed vulnerability to achieve RCE. Threat intelligence firm Defused reports that the authentication bypass vulnerability is being exploited by attackers for data theft.

HACKERS TARGET AWS ROOT ACCOUNTS AT 150+ ORGANIZATIONS WITH PASSWORD SPRAYING ATTACK

Datadog Security Labs uncovered a password spraying campaign targeting AWS root accounts. Datadog stated that it has not identified a successful login yet, making the attacker's motive unclear. AWS root account logins require an account email, so it is possible that the attackers have access to a dataset or exposed email addresses that they are using in their campaign.

DON'T LET ABLITERATION ABLITERATE YOUR BUG HUNTING: DISCOVERING VERDICT BIAS IN UNCENSORED MODELS

Tests of Gemma and Qwen builds found that abliterated variants approved of far more vulnerability candidates. In FreeBSD's sys/rpc, one Heretic build marked 138 of 144 candidates VALID, while the base marked 26 of 40. The Heretic run missed CVE-2026-4747 after spending its scan on false findings. A false heap-overflow claim survived because abliterated builds described the buffer bound, then still confirmed an overflow.

CAN AI CREATE PLC ATTACKS? YES, BUT IT'S NOT THAT EASY YET

Forescout used an AI model to port an RCE exploit from a WAGO 750-852 PLC to a 750-831 PLC running the same vulnerable Nucleus FTP server (CVE-2021-31886). The AI needed constant human guidance: correcting false leads, supplying disassembly context, and running Ghidra scripts it wrote itself. The final exploit stage took 8 hours 32 minutes and cost $535.74 in API tokens. A follow-up attempt to build a C2 implant bricked the PLC. Once code execution worked, the AI wrote working ICMP and UDP payloads within minutes.

SPRING RING: AN INSIDE LOOK AT VOICE PHISHING CAMPAIGNS IN MICROSOFT TEAMS

Threat actors are executing voice phishing campaigns by registering external .onmicrosoft[.]com tenants with fake help desk names, initiating Microsoft Teams chats, and escalating to calls to trick victims into launching remote management tools. Following initial access, the attackers deliver distinct payloads that include an obfuscated PowerShell RAT designed to disable AMSI via the amsiInitFailed flag, and a Python-based execution chain that attempts PetitPotam coercion against domain controllers over port 445. To mitigate this threat, organizations must restrict external Teams access by default, block the associated payload hash, and proactively hunt for rapid chat-to-call sequences originating from commercial VPN nodes.

HUMANBOUND

Open-source adversarial testing engine, SDK, and CLI for AI agents. Attack your agent the way real users and attackers will: live endpoints, multi-turn conversations, and tool abuse. Then turn every failure into a firewall rule. Runs locally or against the Humanbound Platform. No login required to start.

OPEN-KRITT

open-kritt is an open-source, self-hosted vulnerability research platform that turns focused AI analysis into de-duplicated, ranked findings with configurable validation and enrichment.

MICROBURST

MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post-exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.

BRITISH PUBLIC OPPOSE SECRET SURVEILLANCE POWERS AND WANT STRONG PROTECTIONS FOR ENCRYPTED COMMUNICATIONS

CDT polling of 2,000 UK adults found 53% judge encryption-access security risks greater than law-enforcement benefits. 84% fear hidden access would create exploitable vulnerabilities, fraud, data leaks, and cybercrime. The findings follow Apple's tribunal challenge to UK Technical Capability Notices after a demand for encrypted iCloud access.

CATO CTRL INSIGHTS: WHEN TRUST BECOMES THE PAYLOAD IN A FAKE CODEX CLICKFIX CAMPAIGN

Sponsored Codex searches routed macOS users to Google Sites lures with attacker-controlled iframes. Fake installers copied Terminal commands that decoded URLs, fetched shell loaders, and launched Mach-O payloads from /tmp/helper. The chain sent event=pasted telemetry, cleared quarantine attributes with xattr -c, and showed delivery overlap with AMOS.