A Grip Security analysis of 23,000 SaaS environments found every one of them runs embedded AI, with public SaaS attacks up 490% year-over-year and 80% of incidents exposing PII or customer data. The 2025 Salesloft Drift breach shows the blast radius: attackers stole OAuth tokens and used them to access 700+ organizations, including Cloudflare and Palo Alto Networks. Companies average 140 AI-enabled SaaS environments, most of which are installed without a security review.
Oasis Security researchers combined three vulnerabilities — an invisible prompt injection through URL parameters, an open redirect on claude.com, and data exfiltration via the Anthropic Files API into a single attack called "Claudy Day." When a victim clicks a malicious Google search result, it loads covert instructions that silently extract conversation history, save it to a file, and then upload it to the attacker's Anthropic account. If MCP servers or integrations are active, the attack's impact extends to files, messages, and connected APIs.
Charles Bennet and Gilles Brassard were awarded the Turing Award for their pioneering work in Quantum Information Science.
Anthropic, AWS, GitHub, Google, Microsoft, and OpenAI have pledged $12.5M to a project to help open source maintainers combat the deluge of AI-generated bug reports.
CVE-2026-32746 (CVSS 9.8) is an unpatched buffer overflow in GNU InetUtils telnetd's LINEMODE SLC handler affecting all versions up to 2.7 that enables unauthenticated RCE as root via a single connection to port 23.
Sponsored
A new survey by Bitwarden has revealed that 89% of organizations use SSO... but:
Qihoo 360, one of the largest cybersecurity companies in China, accidentally shipped a highly sensitive wildcard SSL private certificate in the public installer for its OpenClaw wrapper product. The key can be retrieved by anyone with a basic extraction tool. This comes after the founder of Qihoo promised that the platform would never leak passwords.
Security researcher Jeremiah Fowler discovered three publicly exposed, unprotected databases containing a total of 3.7M chat logs, audio recordings, and text transcripts of phone calls from 2024 to 2026. All of the files contained references to Sears Home Services. Public access was removed upon the researcher's request, and his report was forwarded to the person who manages the AI chatbot.
Intruders used a phishing attack to steal an Intuitive employee's credentials and access internal IT business apps, pulling some customer, employee, and corporate data. The company says robotic platforms, segmented networks, and hospital systems stayed unaffected and online.
TASZK Security Labs' research on the Xiaomi C400 smart camera uncovers three vulnerabilities in the proprietary miIO setup protocol: an authentication bypass in the handshake, a cryptographically weak PRNG, and a heap buffer overflow leading to controlled heap metadata corruption and reliable RCE over Wi‑Fi. By exploiting protocol design flaws and allocator behavior, an attacker in radio range can first win the setup race or abuse a factory reset, then pivot from packet parsing to full root access, implant a persistent “cloud jailbreak,” and reroute video/control through self‑hosted infrastructure while firewalling Xiaomi's cloud.
An OPSEC failure on a NameCheap VPS exposed FancyBear/APT28's active C2 infrastructure, revealing a modular webmail exploitation toolkit targeting Roundcube and SquirrelMail via XSS to silently exfiltrate 2,800+ emails, steal 240+ credential sets including TOTP secrets, and deploy 140+ persistent Sieve forwarding rules redirecting all incoming mail to advenwolf@proton[.]me — all triggered without victim interaction beyond opening a spearphishing email. The exposed open directory on port 8889 contained server-side C2 source code, full telemetry logs, and lure PDFs targeting Ukrainian prosecutors, the Romanian Air Force, the Greek GEETHA, and the Serbian MoD across six countries. Defenders should audit Roundcube and SquirrelMail instances for unauthorized Sieve rules, block zhblz[.]com and 203.161.50[.]145, rotate credentials and TOTP secrets for any organization in the victimology, and disable ManageSieve where not operationally required.
NGSOTI (Next Generation Security Operator Infrastructure) is an initiative designed to train analysts not only on tools, but also on real-world workflows, collaboration models, and operational constraints. The ecosystem has several integrated tools that provide threat intel sharing, vulnerability enrichment, data filtering, endpoint visibility and detection engineering, and collaborative rule sets. The full platform is tied together by SkillAegis, which provides a structured environment for exercises, simulations, and evaluation.
OpenShell is a safe, private runtime for autonomous AI agents. It provides sandboxed execution environments governed by declarative YAML files.
Bold runs an AI agent on every available endpoint to spot and stop user-based threats, prevent data loss, and govern AI tool usage in real time, without sending data to the cloud.
ReARM is an abbreviation for "Reliza's Artifact and Release Management". It is a DevSecOps and Supply Chain Security tool and SBOM/xBOM repository and evidence store that organizes product releases with their metadata, including various Bills of Materials (SBOMs/xBOMs) and security findings.
SafeDep identified react-refresh-update, a typosquat of Meta's react-refresh (42M weekly downloads) that injected a two-layer XOR-obfuscated dropper into runtime.js — executing silently on require() with no install hooks — and attributed the C2 domain malicanbur[.]pro and secondary IP 173.211.46[.]22:8080 to Lazarus Group's DeceptiveDevelopment campaign, with the second-stage binary independently classified as PylangGhost RAT by multiple AV vendors. The payload is OS-aware: on Windows, it fetches a 28.71 MB self-extracting archive via chunked axios range requests and executes start.vbs via a hidden, detached wscript process. On Linux and macOS, it downloads and executes /var/tmp/macspatch.sh with TLS verification disabled. The encrypted-in-memory eval() execution pattern evades static analysis tools scanning for child_process references, making this campaign a notable escalation in AI coding agent supply chain targeting, where inflated version numbers and mirrored codebases can pass automated package selection without human review.
Attackers sent a JPMorgan-themed phishing email to an Outpost24 executive that passed DKIM checks and existing email security controls. The link chained through Cisco Secure Web, Nylas tracking, a compromised Indian firm, an expired-reused domain, and a Cloudflare-hosted site before a Microsoft 365 credential page.
Ahead of the UN Global Fraud Summit in Austria, eleven tech platforms, including Google, Microsoft, Amazon, and OpenAI, joined to create the new Online Services Accord Against Scams. The agreement involves the platforms agreeing to share intelligence and best practices about threats on their platforms and integrate defensive tools. The pact is voluntary and does not include any enforcement measures.
Atos researchers identified a ClickFix variant that trojanizes WorkFlowy's .asar archive to execute a C2 beacon with user privileges before the legitimate application initializes, bypassing Microsoft Defender for Endpoint by avoiding scripting engines and living-off-the-land binaries.
Researchers from Ghent University and KU Leuven published the first white-box analysis of Microsoft PhotoDNA, revealing that its piecewise-linear hash function can be exploited within seconds on a standard laptop to produce exact collisions, generate false positives matching CSAM hashes, evade detection, and partially reconstruct source images.
Apple patched CVE-2026-20643, a Same Origin Policy bypass in WebKit's Navigation API, via its new Background Security Improvements channel across iOS, iPadOS, and macOS without requiring a full OS update.
Sponsored
Environments have become more distributed and messier -- yet many IT Ops teams still rely on manual workflows to manage capacity, reliability, and scale. The result? Hidden waste, slower incident response, growing risk, and teams stuck firefighting instead of improving systems.
Socket identified 72 more malicious Open VSX extensions active since January 31, 2026, as part of an intensified GlassWorm campaign. This campaign exploits `extensionPack` and `extensionDependencies` in `package.json` to chain seemingly harmless extensions into delivery mechanisms for transitive malware once trust is established. The malware continues to exhibit classic GlassWorm features, such as Russian locale checks, Solana transactions used as dead-drop resolvers for C2 resilience, and invisible Unicode characters used to hide payloads. Additionally, it now employs greater obfuscation and wallet rotation to evade detection. Meanwhile, Aikido linked the same actor to LLM-generated cover commits across 151 GitHub repositories and two npm packages (@aifabrix/miso-client, @iflow-mcp/watercrawl-watercrawl-mcp) from March 3 to March 9, 2026, targeting credentials, tokens, and secrets.
The UK's Companies House, the agency responsible for incorporating and dissolving the nation's listed companies, has taken its WebFiling dashboard down due to a vulnerability. The vulnerability allowed a user to access other companies' dashboards by selecting “file for another company” and repeatedly pressing the “back” key when prompted for an authentication code, which would redirect them to the other company's dashboard. Attackers could exploit this to view and edit information belonging to other companies.
2026.03.17·infosecurity-magazine.com·2 min read·TLDR InfoSec InfoGuard Labs researchers decrypted the AES-256-CBC-encrypted CLIPS rule files shipped with Palo Alto Cortex XDR agents 8.7 and 8.8 (content version 1790-16658), exposing hardcoded global whitelists that exempted any process with `:\Windows\ccmcache` in its command line from roughly half of all BIOC detections, including LSASS dump prevention rules mapped to MITRE ATT&CK T1003/TA0006. The global whitelist has been removed in Cortex XDR Agent 9.1 with content version 2160, though individual rule exceptions remain exploitable by attackers with knowledge of the plaintext rules. Defenders running agents below 9.1 should prioritize upgrading immediately. Those on patched versions should audit process command-line telemetry for ccmcache path injection and treat any closed-box EDR as a single layer rather than a complete control.
Outpost24's threat intel team uncovered a multi-stage phishing campaign that starts with DKIM-validated JP Morgan–themed emails and abused Cisco Secure Email Gateway links, then chains through Nylas tracking, a compromised Indian development company's infrastructure, and a re-registered legacy domain before landing on Cloudflare-protected infrastructure. An anti-bot “human validation” step filters out automated analysis and ultimately delivers a highly convincing Microsoft 365 credential-harvesting page, likely powered by the Kratos Phishing-as-a-Service kit.
GitHub is seeing a surge of malicious repositories that impersonate legitimate projects and offer only infected Windows binaries, often removing build instructions and technical detail while using LLM‑generated text to appear authentic. Some repos target macOS/Linux ecosystems like Homebrew but still ship only Windows executables, suggesting a low‑effort or automated campaign. Attackers abuse README updates and recognizable zip naming patterns to climb search rankings, sometimes using long‑standing or hijacked accounts. While many downloads are now blocked by browser and AV protections, developers still need to verify repos and binaries carefully to avoid compromise.
Sponsored
CSPM and CNAPP lock the doors, but attackers are already logging in with stolen keys. This Mitiga report [11] lays out a dual-layer strategy that protects AI adoption while minimizing AI-driven threats. See why posture management falls short and what zero-impact breach
redStack is a Terraform-provisioned, boot-to-breach red team lab on AWS that deploys Mythic, Sliver, and Havoc C2 servers behind an Apache redirector with X-Request-ID header validation, URI filtering, and AV/Tor exit blocking, all accessible via a Guacamole portal with an isolated Windows operator workstation. The architecture uses dual VPCs with peering to keep all C2 servers off the public internet and supports OpenVPN integration for closed-lab environments such as HackTheBox, Proving Grounds, and VulnLab.
YouTube Media Storage is a tool that allows for storing files on YouTube by encoding them into lossless video and then decoding them back to the original file.
sigmalite is a Golang package that provides a parser and execution engine for the Sigma detection format.
Hacked records from DHS's Office of Industry Partnership, obtained by transparency nonprofit Distributed Denial of Secrets, expose over 1,400 funded contracts worth $845M spanning 2004 to late 2025, including May 2025 awards for mobile biometric harvesting devices, AI-powered airport CCTV passenger profiling systems, and a nationwide 911 call data lake with predictive policing capabilities. The leak also reveals 6,000+ companies that bid with the agency, showing the full breadth of private-sector appetite for DHS surveillance work and technologies considered but never funded. The disclosures arrive amid DHS's $165B funding boost and ongoing controversy over agents collecting visual and biometric data on protesters, reigniting civil liberties debates around AI-assisted behavioral screening programs that have repeatedly failed independent review.
Meta announced it is discontinuing end-to-end encryption in Instagram DMs due to low adoption. The feature had only been rolled out to a subset of users and required opting in for each chat individually. While Meta does support end-to-end encryption in WhatsApp, it has been unclear about the progress made towards it in Messenger and other apps.
The FBI's Seattle division is requesting that gamers who installed Steam titles containing malware complete a form to provide additional information. Based on the questions in the form, the FBI appears to be investigating the apps for cryptocurrency theft and account takeover. Victims are also requested to include any screenshots of communications with individuals promoting the games.
Sponsored
Hear directly from Cisco threat researchers on how they're implementing advanced threat research by correlating IPS rules to network telemetry, and delivering detection directly to Cisco
ByteDance has delayed the global rollout of Seedance 2.0, its viral AI video model, after Hollywood studios, including Disney, issued cease-and-desist letters over unauthorized use of copyrighted IP.
Attackers accessed a non-critical Loblaw network segment and stole customer contact data, including names, phone numbers, and email addresses.
Hackers recently tried to breach IT systems at Poland's National Centre for Nuclear Research, which operates the MARIA research reactor and backs the country's civilian nuclear program.
Sponsored
Compliance doesn't end when you get your SOC 2 certificate. Security reviews, audits, and vendor questionnaires demand constant attention -- and leave GRC teams too overwhelmed to actually think about security strategy.
China's CNCERT warned that OpenClaw, an open-source self-hosted AI agent, poses significant risks due to weak default settings and privileged system access. These vulnerabilities can enable indirect prompt injection attacks, where malicious instructions embedded in web content can force the agent to exfiltrate sensitive data via attacker-constructed URLs shown as link previews in Telegram or Discord — no user click needed. Other attack points include malicious skills uploaded to ClawHub that can execute arbitrary commands or install malware, instruction misinterpretation leading to irreversible data deletion, and threat actors distributing trojanized OpenClaw installers on GitHub that deliver malware such as Atomic Stealer, Vidar Stealer, and the Golang proxy GhostSocks via ClickFix-style lures. Recommended mitigation steps include blocking OpenClaw's default management port from internet exposure, isolating the service in a container, avoiding plaintext credential storage, and restricting skill installations to trusted channels only.
Phishing sites impersonating Starbucks Partner Central captured employees' credentials, allowing an unauthorized third party to access staff accounts between January 19 and February 11. The intrusion exposed names, Social Security numbers, dates of birth, and bank and routing details for 889 employees.
Law enforcement shut down the SocksEscort proxy service, which sold traffic tunneled through 369,000 infected home and small-business routers in 163 countries since at least 2021. Operation Lightning seized 34 domains, 23 servers, and froze $3.5 million in crypto linked to more than €5 million in proxy sales. Criminals used the network for fraud, ransomware, DDoS, and CSAM, abusing RCE and command injection flaws in some 1,200 router models and, in some cases, flashing custom firmware that permanently disabled updates.
The Phexia Campaign, likely linked to APT28, deploys a four-stage macOS attack chain initiated via a ClickFix prompt that tricks users into pasting a base64-obfuscated osascript payload into Terminal, establishing LaunchAgent persistence at ~/Library/LaunchAgents/com.components.campaign-id.plist and polling a Telegram bot for live C2 domain updates. The implant uses tccutil reset All to clear TCC permissions and resurface permission dialogs, masquerades a credential-harvesting dialog as System Preferences with 150 retry loops to capture the macOS user password, then, every 60 seconds, pulls and executes a Phexia Stealer osascript payload targeting all crypto wallets, browsers, Keychain, and Telegram auth data. Defenders should alert on launchctl load activity writing to ~/Library/LaunchAgents, monitor for tccutil reset All execution, block vdsina[.]com-hosted domains at the DNS layer, and treat any Terminal paste prompt from a website as an immediate IOC.
Endor Labs identified 88 new malicious npm packages across three PhantomRaven waves (Waves 2–4) published between November 2025 and February 2026, with 81 packages still live and two C2 servers still active, both AWS EC2 instances running plaintext HTTP on port 80. The campaign abuses Remote Dynamic Dependencies (RDD) like HTTP URL entries in package.json that cause npm itself to fetch and execute a 259-line credential-harvesting payload from attacker infrastructure at install time, exfiltrating developer emails, CI/CD tokens, and full system fingerprints via triple-redundant GET/POST/WebSocket channels to PHP endpoints jpd.php and npm.php. Defenders should reject any npm package with non-registry URL dependencies, block outbound HTTP to domains matching the artifact-themed C2 pattern, and audit CI/CD pipelines for token exposure across the 50+ disposable npm accounts attributed to this operator.