MCP servers have rapidly become the default integration layer for AI agents, but large‑scale scanning of 1,808 servers shows that 66% expose security issues. The riskiest patterns are code execution, toxic cross‑server data flows, and tool‑description prompt injection, which enable data exfiltration, supply‑chain attacks, and even zero‑click RCE via clients like IDEs and desktop agents. Real incidents demonstrate that MCP01–MCP06‑style issues are already being exploited in production. Security‑minded teams should treat MCP as a live attack surface: check servers against the MCP Security Registry, tightly scope tokens, test system prompts, and rigorously review tool and config changes before granting autonomous access.
Sponsored
Most identity governance platforms add work instead of reducing it. Databricks took a different approach with Opal, USING AUTOMATION AND DEVELOPER-FRIENDLY POLICY CONTROLS to manage access at scale while maintaining visibility and control.
cartography is a CNCF Python tool that ingests infrastructure assets from 30+ platforms into a Neo4j graph database to map asset relationships and expose hidden attack paths. Security teams can query cross-tenant IAM relationships, network ingress/egress paths, and datastore access patterns, or run framework compliance checks via `cartography-rules`, with extensible plugin support for custom data sources.
Onyx Security provides an AI control plane that discovers, monitors, and governs autonomous AI agents across cloud, endpoints, code, and SaaS so enterprises can securely deploy, supervise, and scale large numbers of agents.
Runtime mobile application instrumentation toolkit powered by Frida. Inspect, hook, and modify mobile apps through a web-based interface.
Rapid7 Labs identified an active campaign compromising over 250 legitimate WordPress sites across 12 countries, injecting a fake Cloudflare CAPTCHA ClickFix lure that tricks Windows users into pasting a PowerShell command that downloads the DoubleDonut shellcode loader, ultimately delivering Vidar Stealer v2, a newly identified .NET stealer dubbed Impure Stealer, and a new campaign-specific C++ stealer named VodkaStealer. The attack chain runs almost entirely in memory, injecting payloads into svchost.exe via VirtualAllocEx and CreateRemoteThread to evade file-based detection, while the ClickFix JavaScript actively filters out WordPress admin cookies, known bot user agents, and wp-admin referrers to avoid tipping off site owners. WordPress administrators should restrict public access to wp-admin, enforce MFA, audit plugins for known-vulnerable versions, and review Rapid7's published YARA rules and IOCs to detect this campaign.
Google closed its $32 billion acquisition of Wiz this week, marking the largest acquisition in Google's history and the largest ever of a venture-backed startup. Index Ventures' Shardul Shah, Wiz's largest shareholder, attributes the outcome to the founding team's track record and Wiz's position at the intersection of AI, cloud, and security — the three dominant enterprise spending categories. The deal signals growing consolidation in cloud security, with hyperscalers moving to acquire best-of-breed CSPM platforms rather than build them in-house.
Operation Synergia III, a six-month INTERPOL-coordinated effort spanning 72 countries from July 2025 to January 2026, resulted in the seizure of 45,000 malicious IPs and servers, 94 arrests, 110 suspects under active investigation, and over 200 devices and servers confiscated—doubling the scope of 2024's Synergia II. The targeted infrastructure included phishing sites, ransomware networks, and social engineering operations, with notable actions in Macau (33,000 fraudulent websites identified), Bangladesh (40 arrests), and Togo (dismantling a romance scam and sextortion ring). A separate but concurrent operation by European and US authorities dismantled SocksEscort, a residential proxy network used to launder malicious traffic, seizing 34 domains, 23 servers, and approximately $3.5 million in cryptocurrency.
Sponsored
Hear directly from Cisco threat researchers on how they're implementing advanced threat research by correlating IPS rules to network telemetry, and delivering detection directly to Cisco
Microsoft re-released hotpatch KB5084597 for Windows 11 24H2/25H2 and Enterprise LTSC 2024 to address three RRAS RCE flaws (CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) that allow a domain-authenticated attacker to trick users into connecting to a malicious server via the RRAS Snap-in.
Google's 2025 VRPs paid out over 17 million USD to hundreds of researchers across Chrome, Android, and cloud products.
ShinyHunters claimed responsibility for a breach at Telus Digital, alleging theft of up to 1 petabyte of data, including customer support recordings, source code, and employee records with FBI background check results.
Sponsored
AI is lowering the technical barrier for attackers, making phishing, scams, deepfakes, and prompt manipulation easier to launch at scale. Cato's AI in Cybersecurity certification [4] gives your team a clear, practical foundation on what is changing and how to respond.
PhantomRaven, an ongoing npm supply-chain campaign active since August 2025, has deployed 88 additional malicious packages across four attack waves, using slopsquatting to mimic projects like Babel and GraphQL Codegen with LLM-suggested package names. The campaign evades automated inspection via Remote Dynamic Dependencies (RDD), in which `package.json` points its dependencies to attacker-controlled external URLs, pulling and executing malware at `npm install` time rather than embedding it in the package itself. The payload harvests `.gitconfig`, `.npmrc`, environment variables, and CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI before exfiltrating to EC2-hosted C2 infrastructure, with 81 packages still live in the registry as of this writing.
BeatBanker is a dual-mode Android Trojan distributed via a fake Google Play Store page that targets Brazilian users. Once active, it overlays fake screens on crypto apps like Binance and Trust Wallet to silently swap USDT destination wallet addresses, while also deploying the BTMOB RAT for full remote access, including camera, mic, GPS, and remote wipe. It plays an inaudible 5-second audio loop to prevent the OS from killing its background process. Treat unsolicited Accessibility permission requests as an immediate red flag and avoid sideloading APKs from third-party sites.
In 2024, Chinese CDN firm Funnull bought Polyfill[.]io and then used cdn.polyfill[.]io to push malicious JavaScript that redirected visitors to gambling and adult pages. Hudson Rock later linked Funnull to North Korean operators using LummaC2 infostealer data from a hacked North Korean hacker device, which exposed logins for Funnull DNS and the Polyfill Cloudflare tenant. The traffic went into Suncity Group gambling sites to launder large amounts of cryptocurrency back to North Korea and also exposed a separate North Korean agent inside crypto exchange Gate.
Hunt.io uncovered an exposed open directory on 203.161.50[.]145 containing a complete APT28 Roundcube exploitation toolkit. This toolkit overlaps with 14 TTPs observed in Operation RoundPress, targeting Ukraine's State Migration Service using XSS payloads that simultaneously harvest credentials through hidden autofill forms, install persistent Sieve forwarding rules to advenwolf@proton[.]me, bulk exfiltrate emails via the viewsource API, extract TOTP secrets, steal address books, and deploy Chrome/Firefox credential stealers. New capabilities not previously linked to APT28 include a CSS selector side-channel attack for CSRF token extraction, a Go-based Linux backdoor with cron, systemd, and SELinux persistence mechanisms, along with container escape detection scripts. These scripts indicate regular targeting of Docker and Kubernetes environments. Defenders using Roundcube should immediately review all Sieve forwarding rules, implement a strict Content Security Policy that blocks eval() and external resource loading, monitor for bulk viewsource API requests and CSS @import chains with incrementing query parameters, and consider password resets insufficient without full 2FA re-enrollment and session invalidation.
Weightsquatting is a supply-chain attack that manipulates token-space weights in open-weight LLMs to bias code-generation output toward attacker-chosen package names, surviving format conversion, 4-bit quantization, and GGUF export. Llama 3.2 and Qwen 2.5 accepted the poisoned edits cleanly while remaining coherent, whereas DeepSeek models either collapsed visibly or reasoned past the manipulation. Organizations deploying local coding assistants should implement routine behavioral validation of model artifacts against known-good dependency outputs before production use.
Many LLM users try to prompt an LLM the same way that they search Google: using keywords instead of rich prompts. The author of this post presents some tricks to more effectively prompt an LLM, such as role stacking, being explicit about the desired technology stack, requesting thoroughness, asking for validation, and thinking in terms of long-term systems vs. point-in-time solutions. They stress the importance of keeping humans in the loop to add judgment and intuition.
2026.03.13·dispatch.thorcollective.com·5 min read·TLDR InfoSec Sponsored
Claude, Cursor, and Copilot use MCP, skills, and shell commands to access credentials and environments — all unmonitored and ungoverned. If your team can't inventory what's running, you can't secure it. MCPTotal [12] runs a complimentary Shadow AI Discovery Report that maps AI agents and tools on endpoints across your
n.eko is a self-hosted virtual browser that runs in Docker and streams a full desktop environment to multiple simultaneous users over WebRTC with built-in audio support. Security-relevant use cases include containerized throwaway browsing with Tor, a VPN-backed isolated session, a jump host for internal app access without VPN, and an automated browser for Playwright/Puppeteer workflows with live interception.
VM.Analyst is an AI agent that ingests and normalizes data from existing security tools, then provides contextual, prioritized vulnerability-risk insights and remediation recommendations.
A lightweight security threat scanner intended to make malware detection more accessible and efficient.
Mandiant's 2026 hardening guide covers five core focus areas for defending against destructive cyberattacks: external-facing asset hardening, critical asset and backup protections, on-premises lateral movement controls, credential and account protections, and Kubernetes/CI/CD pipeline security. The guide provides prescriptive, actionable controls spanning MFA enforcement, virtualization enclave architecture, AD CS hardening, NTLM restriction, WDigest disablement, and LAPS deployment, each paired with MITRE ATT&CK-mapped detection opportunities. Organizations operating hybrid or cloud environments should treat this as a living reference, particularly given the guide's coverage of hypervisor-level disk swap attacks, immutable backup architecture, and CI/CD supply chain compromise scenarios.
INC's affiliates have shifted from initial US/UK targeting into Australia, New Zealand, and Tonga, hitting hospitals, clinics, and ministries using purchased credentials, phishing, and known-vuln exploits. Australia logged at least 11 incidents since mid-2024. A Tongan MoH intrusion disrupted national health services, and a New Zealand provider had data stolen, encrypted, and leaked.
Researchers found nine cross-tenant issues in Google Looker Studio that allowed arbitrary SQL on connected data sources and broader GCP projects, including BigQuery, Spanner, PostgreSQL, MySQL, and Google Sheets. Attackers could hijack reports, reuse stored credentials, and trigger one-click data exfiltration via crafted reports and browser-side code.
Sponsored
Remote monitoring and management (RMM) abuse often starts with phishing. This allows attackers to exploit legitimate, pre-installed
ENISA framework secures dependency supply chains through curated package selection, integrity enforcement during integration, continuous vulnerability monitoring, and rapid mitigation to counter malicious injection and compromised dependencies.
Basel-Stadt's e-voting pilot failed to decrypt 2,048 online ballots from Swiss referendums after three USB sticks with the correct code all malfunctioned, even with IT help.
The AiLock ransomware gang claims to have stolen 129GB of data from England Hockey and threatens to publish it unless a ransom is paid, with the organization confirming an active investigation.
Sponsored
If you're tired of clicking through dashboards, taking screenshots, labeling files, and then doing it all again for the next audit...
A phishing campaign exploited Microsoft's OAuth 2.0 device code flow by tricking victims into visiting Cloudflare Workers-hosted pages that imitate Adobe Acrobat Sign, using BEC-compromised sender domains. It automatically copied an attacker-generated device code to the clipboard and redirected victims to the legitimate microsoft.com/devicelogin portal to collect tokens. The attacker's backend polls Microsoft's device code endpoint every 3 seconds, exchanges the completed code for OAuth access and refresh tokens scoped to Microsoft Graph, and then silently redirects victims to adobe.com—leaving no signs of compromise. Indicators of compromise (IOCs) from 23 workers.dev subdomains, along with suspected sender addresses embedded in account names, are published. Defenders should look for device code authentication events in Entra SigninLogs by filtering for `AuthenticationProtocol == "deviceCode"`. They should also flag first-time device code authentications with no prior 30-day history (`ResultType == 0`) and alert on workers.dev URLs in inbound email that are linked to the same-user authentication events.
Tire maker Michelin has confirmed that attackers exploited an Oracle E-Business Suite zero-day as part of a wider Cl0p-led campaign tied to FIN11, accessing a small volume of non-sensitive data from its environment. Cl0p claims to have leaked over 315GB of Michelin files.
Hackers hit Bell Ambulance in Wisconsin and stole sensitive data for about 238,000 people, including Social Security numbers, IDs, financial details, medical, and insurance information. The breach was detected in February 2025, with notifications rolling out from April as more victims were identified. The Medusa ransomware gang claimed the attack and tied it to a $400,000 ransom demand for 219 GB of data.
CVE-2025-68402 is an authentication bypass in the FreshRSS edge branch caused by changing the login nonce from a 40-character SHA-1 hex string to a 64-character SHA-256 hex string, which, combined with bcrypt's 72‑byte input limit, results in a vulnerability. The longer nonce pushed all password‑dependent bcrypt data past the truncation boundary, so password_verify() returned true for any password until the concatenation order was fixed.
Four 2026 incidents involving Excel Copilot, Chrome Gemini, Microsoft Copilot Personal, and Perplexity Comet revealed a common architectural issue: AI agents inherit extensive permissions (such as file access, network egress, credential autofill, and camera/microphone access) and cannot reliably distinguish legitimate user instructions from attacker-injected content, enabling zero-click exfiltration, session hijacking, and full credential vault takeover through indirect prompt injection (OWASP LLM01:2025). While all four vulnerabilities have been patched, the structural gap persists: 83% of organizations plan to deploy agentic AI, yet only 29% feel prepared to secure it. Security teams should enforce outbound network restrictions on AI-enabled applications, audit agent permission scopes to ensure least privilege, and treat untrusted data sources (documents, calendar invites, and URLs) as potential injection vectors in any agentic workflow.
Postman's application security team leveraged embedded security engineers to create a custom product security scorecard that teams and management can use to quickly surface security issues and their fixes across projects. The scorecards pair detected security issues with preventive controls, such as repo scanning, and can also incorporate more free-form “security asks” from Jira tickets. The security scorecard allowed teams to roll PR blocking out to their repos and use commit pre-checks to block noncompliant commits.
Sponsored
Attackers chain identity relationships to reach critical assets. BloodHound Scentry pairs the BloodHound platform with SpecterOps experts to identify and disrupt identity attack paths across on-prem, cloud, and hybrid environments.
Jazz provides an AI-native data loss prevention platform that monitors how sensitive data is used across systems, infers user intent and context, and surfaces only high-risk incidents instead of noisy rule-based alerts.
Promptfoo embeds automated red-team tests into the build and release processes, provides actionable guidance for the identified issues, and feeds the results into the organization's existing vulnerability management workflows.
Nerva is a CLI application that provides fast service fingerprinting. It can identify 120+ network protocols and extract rich metadata.
Within one day of the US-Israeli "Operation Epic Fury" strikes against Iran, Camaro Dragon targeted Qatari entities with conflict-themed lures delivering a PlugX variant via DLL hijacking of a legitimate Baidu NetDisk binary, while a separate China-nexus campaign deployed Cobalt Strike through a novel Rust-based loader exploiting DLL hijacking of nvdaHelperRemote.dll — a component of the NVDA screen reader previously seen in only a handful of Chinese-nexus operations. Both attacks used AI-generated lures impersonating regional governments to blend into fast-moving crisis communications. The pivot reflects both opportunistic intelligence collection and a broader shift in collection priorities toward Qatar's position at the intersection of competing global powers. Defenders should treat the Iran conflict as an active geopolitical lure theme, reinforce EDR coverage and MFA, and review Check Point's published IoCs for both campaigns.