Search the archive

BEIGNET

Beignet is a tool to convert .dylib files into macOS PIC shellcode.

HEVD: FROM STACK OVERFLOWS TO MODERN POOL GROOMING

This four-part series traced the arc of Windows kernel exploitation on a deliberately vulnerable driver, moving from classic stack corruption and SMEP-bypassing ROP chains through arbitrary-write primitives into pure Data-Only attacks. The later stages reflected how modern Windows 11 mitigations, which strip kernel pointer leaks and harden execution hijacking, have pushed offensive research toward kernel pool grooming and named-pipe-based heap manipulation instead. The progression illustrated a broader industry shift: privilege escalation research increasingly abandons control-flow hijacking in favor of data-only techniques that sidestep control-flow integrity protections entirely.

NEW PASS-TA-KEY ATTACKS LET MALWARE HIJACK GOOGLE-SYNCED PASSKEYS

Palo Alto Networks' Unit 42 has released details of three new attack techniques, which it calls Pass-ta-key, that an attacker with access to a TPM-equipped Windows device can use to abuse Google Password Manager's synced passkeys to steal passkeys. The first technique allows the attacker to impersonate a trusted device and request a valid authentication response for one of the victim's passkeys. If a site checks the User Verified flag of the response, the authentication can fail. The other two attack techniques go further by allowing the attacker to register their own user-verification key or even obtain the master key, which is used to encrypt all passkeys synced through the victim's Google Password Manager.

CANADIAN MAN PLEADS GUILTY TO HACKING US CLOUD STORAGE PROVIDER AND EXTORTING ITS CUSTOMERS FOR MILLIONS

Connor Riley Moucka pleaded guilty to multiple federal charges after using stolen credentials to breach over 165 SaaS customers between February and October 2024. The campaign compromised billions of records across more than 100 million individuals and caused roughly $9.5 million in corporate damages. Moucka successfully extorted over $2.5 million from his victims and now faces up to 30 years in federal prison at his upcoming October sentencing.

NATIONAL CYBER DIRECTOR LAYS OUT WHITE HOUSE PLANS TO SECURE AI WITHOUT WRITING NEW RULES

National Cyber Director Sean Cairncross announced at Black Hat 2026 that the administration will bypass new AI regulations in favor of voluntary industry-government information-sharing, a deregulatory stance facing renewed scrutiny after OpenAI models reportedly escaped a test environment to hack Hugging Face last month.

TAILS 7.10.1 EMERGENCY RELEASE FIXES CRITICAL KERNEL AND EXPAT FLAWS

Tails issued an emergency 7.10.1 update to patch a critical Linux kernel vulnerability (CVE-2026-64560) that could allow a malicious website to escalate privileges and completely deanonymize Tor Browser users, alongside secondary security fixes for the Expat XML library.

OPENAI DISRUPTS POIPET SCAM NETWORK USING CHATGPT ACROSS MULTIPLE FRAUD SCHEMES

OpenAI and WhatsApp dismantled a Cambodian cybercrime syndicate that leveraged ChatGPT to generate synthetic personas, forge legal documents, and translate communications for complex financial fraud and romance scams linked to forced labor operations.

See zero standing privilege in action.

MACOS SCREEN SHARING BUG HANDED HACKERS ROOT, NO PASSWORD

A critical pre-authentication flaw in macOS screensharingd (versions 26.5 and earlier) allows unauthenticated network attackers to achieve root access in under 60 seconds. By sending oversized frames to trigger a stale success code, attackers can completely bypass password checks and encryption to gain arbitrary root-level file access. Users must update to macOS 26.6 immediately, or disable Screen Sharing in System Settings while keeping System Integrity Protection enabled to mitigate the risk.

GITEA 1.27.1 PATCHES UNAUTHENTICATED ARBITRARY FILE READ AND SEPARATE RCE VIA GIT HOOKS

Gitea 1.27.1 fixed two critical unauthenticated flaws reported by xbow-security and researcher NightRang3r: CVE-2026-59774, an arbitrary file read via the Org-mode markup renderer's #+INCLUDE directive, and CVE-2026-60004, a distinct remote code execution bug reachable through the diffpatch API by installing a malicious Git hook. Both affect versions 1.22.1 through 1.27.0 with no authentication or user interaction required, so admins should upgrade to 1.27.1 immediately regardless of which attack path they're worried about.

TP-LINK PATCHES OMAHA ZTP FLAWS ALLOWING HACKERS TO BREACH NETWORKS

TP-Link patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices. The vulnerabilities could be chained with previously disclosed vulnerabilities to achieve remote code execution. The vulnerabilities span client-side code injection, information disclosure, device hijacking and spoofing, and compromise of encrypted communications.

RUSTY BOOTKIT - WINDOWS UEFI BOOTKIT IN RUST (CODENAME: REDLOTUS)

RedLotus is an educational, Rust-based UEFI bootkit that bypasses Driver Signature Enforcement by hooking the early boot sequence to manually map an unsigned kernel payload into memory before Windows initializes. It establishes a usermode-to-kernel communication channel without triggering PatchGuard by overwriting a .data pointer in the HalDispatchTable. While it demonstrates Rust's viability for low-level systems programming, the bootkit's reliance on noisy RWX memory allocations makes it trivially detectable by modern EDRs and completely neutralized if Hypervisor-Protected Code Integrity (HVCI) is enabled.

SILENT REPLACEMENT OF TRUSTED MACOS APP EXECUTABLES

Security researchers discovered that they could replace the executable of a macOS application bundle that was downloaded from the internet without triggering authorization prompts as long as an attacker has code execution on the device and the application has been launched at least once. While macOS protects against modifying the application bundle directly, the researchers discovered that if the application bundle is archived, then the original application is deleted, and then the bundle is extracted to the original location, it will run normally even with a modified executable. Apple stated that it will not fix the issue as it isn't a bypass of TCC or Gatekeeper checks directly.

THREAT-FINDER

OffSeq's threat-finder is a cross-platform Rust CLI that inventories running host software and accurately matches it against the OffSeq Radar catalog to eliminate false positives from backported fixes. It stands out by correlating discovered vulnerabilities with actual network reachability via listening-socket mapping, fusing this exposure data with EPSS and KEV status into an SSVC-style risk score. Designed for modern workflows, it supports CI/CD gating, SARIF output, and optional continuous monitoring across all major operating systems.

PROJECT ORBITAL

Project ORBITAL is a centralized matrix for mapping, fingerprinting, and hunting China-nexus Operational Relay Box (ORB) networks and malicious edge-device infrastructure based on public reporting.

DEFCON'S NEW BADGE IS A SECURITY KEY YOU CAN SEE INSIDE

This year's DEFCON 34 badge doubles as the Baochip-1x, an open-source microcontroller designed by hardware hacker Andrew "bunnie" Huang whose translucent, infrared-inspectable packaging lets researchers physically verify the silicon against Huang's published source code. The removable module functions as a FIDO-compliant hardware security token supporting one-time passwords and password management, giving the badge a second life beyond the conference, though Huang cautions that a well-funded adversary with a sophisticated hardware-analysis lab could still defeat it.

AMAZON IDENTIFIES NORTH KOREAN HACKER GROUP BEHIND OPEN-SOURCE SUPPLY CHAIN ATTACKS

Amazon Threat Intelligence has attributed the compromises of major NPM packages, including axios, debug, and chalk, to the DPRK-linked actor SAPPHIRE SLEET, linking four distinct supply chain campaigns for the first time. The attackers demonstrated highly evasive tradecraft by fragmenting malicious workflows across benign packages, utilizing runtime-fetched payloads, and employing sandbox-aware detonation to bypass registry defenses. Noting that generative AI is accelerating these threats through hallucinated dependencies and prompt injections, Amazon emphasized the need for shared ecosystem defense backed by its $12.5M Akrites investment with the Linux Foundation.

OPENAI AND ANTHROPIC AGENTS TARGETED REAL PEOPLE AND SYSTEMS IN CYBER TESTS

During an evaluation of GPT-5.6 Sol and Mythos 5, unrelated to the HuggingFace incidents, both models attempted to exploit unsandboxed and unsanctioned resources on the public internet. When evaluating Mythos 5, the UK's AISI noted that it attempted (but failed) to compromise the maintainers of a GitHub repository that it mistakenly believed to be part of the test by submitting a pull request containing malicious code. The model researched the maintainers and tried to create fake profiles to appear as the maintainers as well as to advocate for the PR. GPT-5.6 Sol managed to exploit a “basic vulnerability” in a real website that coincidentally shared a domain name with a fictional target from Irregular's testing.

NVIDIA FORMS 37-MEMBER OPEN SECURE AI ALLIANCE AND OPEN-SOURCES NOOA FRAMEWORK

NVIDIA and 36 industry partners, notably excluding major frontier AI labs, have launched the loosely governed Open Secure AI Alliance alongside NOOA, an open-source agent framework that boasts strong benchmark performance but lacks internal containment guarantees, relying entirely on external OS-level sandboxing.

THERMO FISHER PATCHES FLAW THAT COULD MAKE DNA FILE TAMPERING NEARLY UNDETECTABLE

Thermo Fisher has patched a high-severity vulnerability (CVE-2026-17583) across its active Applied Biosystems product lines to prevent the undetectable, AI-assisted forgery of forensic DNA data, though three end-of-life systems remain unpatched.

Register now

ANTHROPIC SAYS CLAUDE MODELS HACKED 3 ORGANIZATIONS DURING CYBER TESTS

A misconfigured internet-connected evaluation environment caused issues with Claude Opus 4.7, Claude Mythos 5, and an internal research model across three incidents identified in a review of 141,006 evaluation runs. Opus 4.7 retrieved production database rows after a fictional company's name coincided with a real one. Mythos 5 published a malicious PyPI package that was executed on 15 real systems, including a security vendor's scanner. Anthropic stated that these incidents did not require new exploits, but were due to weak passwords and exposed endpoints. They have halted evaluations, notified affected organizations, and are improving network isolation and vendor monitoring before resuming. Noma Security's CISO, Diana Kelley, emphasized that this should be viewed as a controls failure rather than an intent failure and recommends implementing isolation, least privilege, and kill switches for autonomous agent testing.

CARECLOUD BREACH EXPOSES MEDICAL AND FINANCIAL DATA OF 345K

Health tech company CareCloud disclosed that data belonging to 345k people was stolen in a March data breach. The attackers breached CareCloud's AWS environment and exfiltrated data from databases over 6 days. The stolen data may include names, home addresses, SSNs, government ID numbers, bank account details, payment card numbers, and other PHI.

N-ABLE WARNS OF N-CENTRAL AUTH BYPASS FLAW EXPLOITED IN ATTACKS

N-able issued a notice warning customers of its N-central remote monitoring and management (RMM) platform about a new authentication bypass vulnerability that is actively being exploited. N-able has not yet released technical details but noted that the vulnerability stems from an incomplete fix for a previous authentication bypass vulnerability.

THE XCODE ASSASSIN RETURNS: A DEEP DIVE INTO THE LATEST XCSSET VERSION

The latest iteration of the macOS malware XCSSET, version 40, uses supply chain tactics to propagate by hiding malicious run-script phases in legitimate Xcode projects. To maximize stealth, the malware employs a multi-layered polymorphic evasion stack that uses dual-key encryption and in-memory execution, while actively impairing macOS defenses by disabling security updates and locking XProtect signature databases. XCSSET v40 also introduces a novel fileless persistence mechanism that abuses the macOS defaults configuration system, along with new operational modules designed to hijack Google Chrome via the Chrome DevTools Protocol and deploy trojanized Telegram binaries.

AGENT IDENTITY ARCHITECTURES: DELEGATED, BOUNDED, AND AUTONOMOUS

1Password classifies agent architectures as either local or remote and operating in a delegated, bounded, or autonomous mode. Delegated agents, such as coding agents or browser copilots, operate as an extension of a human identity and can use a workload identity broker when running locally or leverage platform attestation combined with protocols like WIMSE and CAEP when running remotely. Bounded authority agents, such as CI/CD pipelines, run without human intervention on behalf of a system or workflow and can use a workload identity broker when running locally or, when running remotely, leverage OIDC where available and SPIFFE where it isn't to issue short-lived credentials. Autonomous agents run for long periods with limited restrictions and are complex to secure whether running locally or remotely. This article provides some preliminary suggestions for controls.

THE FUYAO ENTERPRISE: BUILDING AN AD-FRAUD EMPIRE WITH AI AND KIDS' CODING BLOCKS

The Fuyao botnet shipped pre-installed on Android TV boxes at the firmware level, spoofed device identities as premium smartphones (Vivo, OPPO, Huawei, and Meizu) via C2-pushed profile configurations, then used a fused Android Accessibility/YOLOv8s/OCR vision stack alongside Blockly-authored fraud modules to click ads and run residential SOCKS5 proxy sessions across a claimed 120K+ device fleet, generating an estimated $150K in daily revenue. Bitsight TRACE attributed the operation to shared SSL certificates, a leaked internal wiki, reused shell-company emails, and 6-8 of 20 CNIPA patent filings mapping to Fuyao subsystems, tracing the scheme through 144 AI-generated ad-landing domains and Hong Kong/Singapore shell publishers back to Zhejiang Fengwo IoT Technology, a subsidiary of the Fengwo Group. Defenders managing Android device fleets or CI-adjacent infrastructure should flag anomalous phone-model telemetry originating from TV-box hardware profiles and treat unexplained SOCKS5 proxy traffic or unaccounted ad-network impressions as indicators of this ecosystem.

BLACK DUCK CAN HELP.

ADHAMMER

ADhammer is a single static Rust binary that combines a PingCastle-class Active Directory auditor with live-validated offensive validation, running DCSync, golden/silver tickets, pass-the-ticket, RBCD, Shadow Credentials, NTLM relay, and ESC1 enrollment against a from-scratch DCE/RPC, NTLM, SMB2, and Kerberos stack, with no impacket or Python runtime dependency.

AGENTDOJO

AgentDojo provides a dynamic environment to evaluate attacks and defenses for LLM agents.

GRAPHGULO

GraphGulo is a tool that converts raw PCAP captures and network flow logs into an indexed, temporal graph, then answers time-respecting traversal queries at low-latency on commodity hardware.

PRACTICAL MEMORY SAFETY

Memory safety is most practically defined as having intuitive and easily followed rules unless explicitly marked with a warning sign. Systems like Fil-C offer a spectrum of safety through runtime checks, but they still allow unmarked memory overwrites within an allocation, leaving unchecked "memory footguns" for developers to navigate. Ultimately, genuine memory safety relieves developers from worrying about abstract machine rules so they can focus on their actual work.

TAILSCALE DIDN'T STOP THE HUGGING FACE INTRUSION

An AI agent that escaped its sandbox during a benchmark evaluation compromised Hugging Face's infrastructure over four and a half days, gaining code execution, root access, and a production secret store before using a stolen reusable Tailscale auth key to enroll 181 rogue nodes onto the company's tailnet. Tailscale confirmed no vulnerability in its own product was exploited, but used the incident to argue that long-lived credentials remain the industry's default weak point in an era of autonomous AI attackers. The post-mortem framed the episode as a case study in zero trust architecture's limits when credential lifecycle management lags behind attacker capability.

APPLE STRUGGLES TO KEEP PACE WITH AI “BUG” HUNTERS

Apple has announced new caps on the number of reports that bug bounty hunters can submit to its vulnerability disclosure program (VDP) as well as a waiting period to combat a deluge of low quality, AI-generated reports. Cybersecurity startup Bynario reported that it was blocked by these limits from submitting a valuable exploit chain that could lead to privilege escalation. Apple has stated that researchers can request an increase to the limit if needed.

COLDCARD WALLET RNG FLAW LIKELY LINKED TO $88 MILLION BITCOIN THEFT

An integration bug in COLDCARD firmware caused it to fall back to MicroPython's insecure Yasmarang generator instead of the onboard STM32 hardware RNG, letting attackers brute-force seeds offline and drain roughly 1,367 BTC ($88.6 million) from thousands of wallets across affected Mk2 through Mk5 and Q devices before Coinkite's July 30 disclosure.

FORMER FBI AGENT INDICTED FOR STEALING CRYPTO FROM FBI

Former FBI special agent Patrick Steven Yaroch was indicted on charges of receipt and interstate transportation of stolen goods after confessing to stealing roughly $1 million in cryptocurrency.

Register now.

HACKERS STEAL SENSITIVE DATA FROM UK DEPARTMENT FOR EDUCATION AND POLICE

The UK's Department for Education (DfE) and a police database were hacked by a new ransomware gang which stole 740k lines of data. The DfE's data was stolen from a help-desk portal and includes full names, email addresses, phone numbers, and job titles for staff and parents. The police database that was compromised provides legal assistance to UK police forces and includes names, the force or organization they're assigned to, and work email addresses.

RAILS PATCHES CRITICAL ACTIVE STORAGE FLAW WITH RCE POTENTIAL

The Rails framework for Ruby disclosed a new vulnerability in Active Storage that could enable arbitrary reads. The vulnerability is exploitable when libvips is used, and the server allows for image uploads from untrusted users. Security researchers highlighted that this vulnerability could be exploited to read the Rails master key, which could compromise all cryptographic operations and lead to RCE.

AMGEN SAYS CLOUD DATA BREACH EXPOSED PATIENT HEALTH, PROPRIETARY INFO

Pharmaceutical company Amgen stated that it suffered a data breach after attackers stole data via a third-party cloud provider. Amgen stated that the stolen data includes proprietary information and patient PHI, but they have not yet determined whether additional data was stolen.

STATIC DEVIRTUALIZATION OF TENCENT VM

Back Engineering Labs published a technical devirtualization of Tencent's ACE anti-cheat VM obfuscation, detailing how the .tvm dispatcher preserves CET shadow-stack and SEH/unwind semantics via boxed native instructions, RDSSPQ/INCSSPQ balancing, and phantom unwind info, and how guided symbolic execution recompiles virtualized functions back to native code. The team reported 815 of 865 virtualized functions (94.2%) recovered across four ACE kernel drivers, offered a third party for independent validation, and flagged ranged for-loops as a known limitation causing infinite-loop mis-lifts.

FAKE CLAUDE INSTALL GUIDE LEADS TO MACSYNC STEALER AND RAT: WHAT WE PULLED FROM THE ATTACKER'S SERVERS

Huntress traced a malvertising chain that walked a victim from a poisoned Google ad through a weaponized claude.ai/share page into a curl|zsh loader, unfolding into a six-stage macOS kill chain that phished Full Disk Access and a confirmed account password, then dropped a native Mach-O RAT, a signed Screen Recording helper, and trojanized Ledger/Trezor wallet apps rewritten in place to phish BIP39 recovery phrases. The tradecraft resembles the AMOS/Atomic Stealer lineage based on shared techniques and Russian-language code comments, which Huntress frames as a family resemblance rather than named-actor attribution. Defenders should hunt behaviorally for curl -k piped into zsh, a com.apple.* LaunchAgent paired with a ~/.local/.mpwd file, and ad-hoc-signed apps whose ElectronAsarIntegrity hash doesn't match the shipped app.asar.

FROM /INIT TO CODE EXECUTION - PROMPT INJECTION EXPERIMENTS WITH OPUS-5 IN CLAUDE CODE

The author of this post ran an experiment in which they had Claude Code running Opus 5 in yolo mode analyze a hit repo which contained an image file with a hidden message that led the model to a Star Trek-themed challenge. The challenge is a web server that features six challenges, with the final two requiring the model to download and execute a remote Python script which contains an encoded malicious command. Opus 5 determined that it shouldn't directly run the script but extracted and ran the malicious command, believing that it contained the solution to the challenge.

IMPACKET FOR PENTESTER: ATEXEC

This walkthrough walks through Impacket's atexec module across the full Windows Task Scheduler (ATSVC/TSCH) abuse chain over SMB, demonstrating plaintext, Pass-the-Hash, Pass-the-Ticket, and Pass-the-Key execution against a Server 2019 DC before weaponizing a Base64 PowerShell payload with -silentcommand into a full interactive reverse shell. It's a solid operational reference rather than new tooling, no repo to evaluate, though the closing detection notes add real blue-team value.