Search the archive

SERVAL'S PATH TO PRODUCT-MARKET FIT

"What's your biggest pain point?" is dead as a discovery question.

BEING A “SYSTEM OF RECORD” WON'T SAVE YOU. IT'LL JUST MAKE YOUR DECLINE MORE COMFORTABLE

System of Record businesses that don't own the AI layer on top of their platforms will see spend flowing around them - while they will get renewals, they won't see growth.

AGENT SKILLS ARE THE RECIPE. VERTICAL AGENTS ARE THE CAKE

Selling skills is like selling the recipe, and you want to be in the cake business.

→ Earn 3 ISC2 CPE Credits

→ Start free certification

NEW PHANTOMRAVEN NPM ATTACK WAVE STEALS DEV DATA VIA 88 PACKAGES

PhantomRaven, an ongoing npm supply-chain campaign active since August 2025, has deployed 88 additional malicious packages across four attack waves, using slopsquatting to mimic projects like Babel and GraphQL Codegen with LLM-suggested package names. The campaign evades automated inspection via Remote Dynamic Dependencies (RDD), in which `package.json` points its dependencies to attacker-controlled external URLs, pulling and executing malware at `npm install` time rather than embedding it in the package itself. The payload harvests `.gitconfig`, `.npmrc`, environment variables, and CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI before exfiltrating to EC2-hosted C2 infrastructure, with 81 packages still live in the registry as of this writing.

BEATBANKER ANDROID TROJAN USES SILENT AUDIO LOOP TO STEAL CRYPTO

BeatBanker is a dual-mode Android Trojan distributed via a fake Google Play Store page that targets Brazilian users. Once active, it overlays fake screens on crypto apps like Binance and Trust Wallet to silently swap USDT destination wallet addresses, while also deploying the BTMOB RAT for full remote access, including camera, mic, GPS, and remote wipe. It plays an inaudible 5-second audio loop to prevent the OS from killing its background process. Treat unsolicited Accessibility permission requests as an immediate red flag and avoid sideloading APKs from third-party sites.

POLYFILL SUPPLY CHAIN ATTACK IMPACTING 100K SITES LINKED TO NORTH KOREA

In 2024, Chinese CDN firm Funnull bought Polyfill[.]io and then used cdn.polyfill[.]io to push malicious JavaScript that redirected visitors to gambling and adult pages. Hudson Rock later linked Funnull to North Korean operators using LummaC2 infostealer data from a hacked North Korean hacker device, which exposed logins for Funnull DNS and the Polyfill Cloudflare tenant. The traffic went into Suncity Group gambling sites to launder large amounts of cryptocurrency back to North Korea and also exposed a separate North Korean agent inside crypto exchange Gate.

OPERATION ROUNDISH: UNCOVERING AN APT28 ROUNDCUBE EXPLOITATION TOOLKIT TARGETING UKRAINE

Hunt.io uncovered an exposed open directory on 203.161.50[.]145 containing a complete APT28 Roundcube exploitation toolkit. This toolkit overlaps with 14 TTPs observed in Operation RoundPress, targeting Ukraine's State Migration Service using XSS payloads that simultaneously harvest credentials through hidden autofill forms, install persistent Sieve forwarding rules to advenwolf@proton[.]me, bulk exfiltrate emails via the viewsource API, extract TOTP secrets, steal address books, and deploy Chrome/Firefox credential stealers. New capabilities not previously linked to APT28 include a CSS selector side-channel attack for CSRF token extraction, a Go-based Linux backdoor with cron, systemd, and SELinux persistence mechanisms, along with container escape detection scripts. These scripts indicate regular targeting of Docker and Kubernetes environments. Defenders using Roundcube should immediately review all Sieve forwarding rules, implement a strict Content Security Policy that blocks eval() and external resource loading, monitor for bulk viewsource API requests and CSS @import chains with incrementing query parameters, and consider password resets insufficient without full 2FA re-enrollment and session invalidation.

THE TENSOR IN THE HAYSTACK: WEIGHTSQUATTING AS A SUPPLY-CHAIN RISK

Weightsquatting is a supply-chain attack that manipulates token-space weights in open-weight LLMs to bias code-generation output toward attacker-chosen package names, surviving format conversion, 4-bit quantization, and GGUF export. Llama 3.2 and Qwen 2.5 accepted the poisoned edits cleanly while remaining coherent, whereas DeepSeek models either collapsed visibly or reasoned past the manipulation. Organizations deploying local coding assistants should implement routine behavioral validation of model artifacts against known-good dependency outputs before production use.

HOW I USE LLMS FOR SECURITY WORK

Many LLM users try to prompt an LLM the same way that they search Google: using keywords instead of rich prompts. The author of this post presents some tricks to more effectively prompt an LLM, such as role stacking, being explicit about the desired technology stack, requesting thoroughness, asking for validation, and thinking in terms of long-term systems vs. point-in-time solutions. They stress the importance of keeping humans in the loop to add judgment and intuition.

environment. Book with us and get your free report

N.EKO

n.eko is a self-hosted virtual browser that runs in Docker and streams a full desktop environment to multiple simultaneous users over WebRTC with built-in audio support. Security-relevant use cases include containerized throwaway browsing with Tor, a VPN-backed isolated session, a jump host for internal app access without VPN, and an automated browser for Playwright/Puppeteer workflows with live interception.

QUANTRO SECURITY (PRODUCT LAUNCH)

VM.Analyst is an AI agent that ingests and normalizes data from existing security tools, then provides contextual, prioritized vulnerability-risk insights and remediation recommendations.

LENSPECT

A lightweight security threat scanner intended to make malware detection more accessible and efficient.

PROACTIVE PREPARATION AND HARDENING AGAINST DESTRUCTIVE ATTACKS: 2026 EDITION

Mandiant's 2026 hardening guide covers five core focus areas for defending against destructive cyberattacks: external-facing asset hardening, critical asset and backup protections, on-premises lateral movement controls, credential and account protections, and Kubernetes/CI/CD pipeline security. The guide provides prescriptive, actionable controls spanning MFA enforcement, virtualization enclave architecture, AD CS hardening, NTLM restriction, WDigest disablement, and LAPS deployment, each paired with MITRE ATT&CK-mapped detection opportunities. Organizations operating hybrid or cloud environments should treat this as a living reference, particularly given the guide's coverage of hypervisor-level disk swap attacks, immutable backup architecture, and CI/CD supply chain compromise scenarios.

INC RANSOMWARE GROUP HOLDS HEALTHCARE HOSTAGE IN OCEANIA

INC's affiliates have shifted from initial US/UK targeting into Australia, New Zealand, and Tonga, hitting hospitals, clinics, and ministries using purchased credentials, phishing, and known-vuln exploits. Australia logged at least 11 incidents since mid-2024. A Tongan MoH intrusion disrupted national health services, and a New Zealand provider had data stolen, encrypted, and leaked.

NEW "LEAKYLOOKER" FLAWS IN GOOGLE LOOKER STUDIO COULD ENABLE CROSS-TENANT SQL QUERIES

Researchers found nine cross-tenant issues in Google Looker Studio that allowed arbitrary SQL on connected data sources and broader GCP projects, including BigQuery, Spanner, PostgreSQL, MySQL, and Google Sheets. Attackers could hijack reports, reuse stored credentials, and trigger one-click data exfiltration via crafted reports and browser-side code.

remote tools. Learn how it works and how to stop it.

ENISA TECHNICAL ADVISORY FOR SECURE USE OF PACKAGE MANAGERS

ENISA framework secures dependency supply chains through curated package selection, integrity enforcement during integration, continuous vulnerability monitoring, and rapid mitigation to counter malicious injection and compromised dependencies.

SWISS E-VOTING PILOT CAN'T COUNT 2,048 BALLOTS AFTER USB KEYS FAIL TO DECRYPT THEM

Basel-Stadt's e-voting pilot failed to decrypt 2,048 online ballots from Swiss referendums after three USB sticks with the correct code all malfunctioned, even with IT help.

ENGLAND HOCKEY INVESTIGATING RANSOMWARE DATA BREACH

The AiLock ransomware gang claims to have stolen 129GB of data from England Hockey and threatens to publish it unless a ransom is paid, with the organization confirming an active investigation.

56% OF GPT-5.4'S CITATIONS GO TO BRAND WEBSITES. ONLY 8% OF GPT-5.3'S DO

OpenAI's GPT-5.4 model in ChatGPT cites brand websites far more often than its GPT-5.3 model. Brand sites receive 56% of GPT-5.4 citations but only 8% of GPT-5.3 citations. GPT-5.4 sends an average of 8.5 fan-out queries per prompt, while GPT-5.3 sends only 1 query. GPT-5.4 also cites commercial pages far more often. It cited pricing pages 138 times across 50 prompts, while GPT-5.3 cited them only 4 times. The models rarely cite the same sources.

SOFTWARE ISN'T DEAD. WHAT'S VALUABLE IS CHANGING

AI is shifting software value from user interfaces to systems that capture data and automate work. The selloff in software stocks followed a narrative that AI makes SaaS obsolete, yet code was never the main moat. The most valuable layer is structured data systems of record that give AI agents the context needed to act, while new systems can now be created by extracting structured information from previously unstructured sources. Workflow products still matter because they encode industry knowledge about how work should be done, even if agents perform the steps instead of humans. The biggest shift is automation that replaces labor, which allows software to sell economic output instead of tools.

LABOR MARKET IMPACTS OF AI: A NEW MEASURE AND EARLY EVIDENCE

Anthropic's study finds that AI is reshaping knowledge-based roles rather than low-wage jobs. They introduce a measure called observed exposure. It combines theoretical AI capabilities with real-world usage and focuses on automated, work-related tasks. Computer programmers, customer service reps, and financial analysts are the most exposed. Actual AI coverage remains far below its theoretical potential. Workers in these roles are generally older, female, highly educated, and higher-paid. Overall, unemployment has not risen, but hiring of younger workers in exposed occupations has slowed. The US Bureau of Labor Statistics projects slower growth in these fields through 2034.

WIN REPORT: HOW AN INGENIOUS USE OF CTAS INCREASED CONVERSIONS BY 57%

Clear expectations at the point of action increased conversions by 57% for FanTokens.com. The site redirects buyers to an external exchange to complete a purchase. User testing showed that many visitors felt uneasy when the redirect appeared without warning. The site changed the CTA from “Buy” to “Buy on [exchange name]” and added exchange logos and colors to the buttons. This change removed the surprise and improved trust during a critical step in the buying process.

HOW TO DECIDE WHAT EMAILS TO SEND TO YOUR AUDIENCE

Email content works best when it starts with understanding the signals your audiences give. Segment your list into groups based on behavior, engagement, or purchase stage. Tailor emails to what each group needs. Intent-driven emails respond to actions or objections. Awareness emails educate or build trust. Campaign emails share product launches, events, or promotions, but only to relevant recipients. Look for ideas in support interactions, reviews, and online discussions. Keep each email focused on one goal with guidance and a clear next step.

FROM SEARCH TO PURCHASE: UNDERSTANDING THE NEW BUYING JOURNEYS (WEBINAR)

This webinar on March 18 looks at how buying journeys have become fragmented as consumers search across social platforms, marketplaces, and AI tools. It introduces Search Intelligence and explains how analyzing search behavior can reveal localized trends and ensure brands appear where audiences seek information. The session also shares real examples of companies using Trajaan to turn search data into insights that enhance brand visibility.

HOW TO USE AI FOR CONTENT WITHOUT CREATING SLOP (58 MINUTE VIDEO)

In this video, Eoin Clancy, VP of Growth at Airops, explains the role of content engineers and the 3 key signs of low-quality AI content. He also shares strategies for using AI without producing “slop”. Eoin dives into why webinars are Airops' top growth channel. He covers how they select topics, choose guests, run ungated sessions, and follow up to drive revenue.

WHY MOST BRANDS STILL MISUNDERSTAND CREATOR MARKETING

Many brands still misunderstand creator marketing because it often gets added late in campaigns instead of being built into strategy from the start. Brands often assign influencer work to social or PR teams even though creator partnerships require separate expertise and dedicated processes. Many strategies also fail because agencies do not explain why specific creators or tactics support larger marketing goals. Long-term creator partnerships produce better insights and performance because brands gain audience feedback and data across multiple campaigns.

BRANDS THAT WIN ARE CLEARER, NOT LOUDER

Signal theory says that every brand action communicates something to the market, and brands that chase trends or cultural moments often signal desperation rather than the relevance they intended. The brands that stand out are committed to a specific identity that alienates some people and attracts exactly the right ones. If a competitor's logo can be swapped onto a brand's marketing without anything changing, the brand has no signal worth following.

STOP ASKING ENGINEERING FOR FAVORS: GIVE THEM AN SEO PRD

Most SEO fixes fail to ship not due to technical complexity but due to framing, with SEO teams making requests in a format engineering teams are not built to act on. Adopting a product requirements document structure forces SEO recommendations into the same language product managers use to get features built, complete with problem statements tied to business impact, user stories, acceptance criteria, and rollback thresholds. The format also creates accountability on both sides since a PRD with clearly defined requirements and success metrics gives the SEO team a paper trail when fixes are poorly implemented due to vague specs.

SCART-FRAMEWORK TO WRITE ANY POST

A framework to structure posts that balances stories, education, and promo content.

DISNEY+ IS ROLLING OUT ITS TIKTOK-LIKE ‘VERTS' SHORT-FORM VIDEO FEED

Disney+ is bringing short-form vertical video to its US mobile app with Verts, a scrollable feed of scenes and moments from its catalog designed to drive content discovery and daily engagement.

START CREATING WITH AGENT 4

5 WAYS PRODUCT DISCOVERY BREAKS DOWN

Product discovery breaks down when companies fast-track “must-have” features and lack clear outcome-based goals. Evidence-guided discovery with shared metrics and measurable outcomes helps teams prioritize better ideas and avoid feature-factory behavior.

WTF DOES A PRODUCT MANAGER DO? (AND WHY ENGINEERS SHOULD CARE)

As AI reduces the cost of building software, the real challenge becomes deciding what to build, pushing engineers to adopt product management skills. The three most important are gathering context, tracking results through feedback loops, and communicating decisions in a way that drives action.

DANCING WITH PROBLEMS

Product problems rarely have a single clear definition. Teams must continually move between behavioral, contextual, and strategic perspectives to understand them. Product leaders create shared understanding by helping teams explore these layers together and refine the real problem over time.

WILL FEATURES EVEN EXIST? HOW AI IS FORCING SAAS TO RETHINK THE PRODUCT ITSELF

AI is eroding the traditional SaaS model built around predefined features. The real moat will shift to platforms that let customers generate and govern their own workflows securely and reliably.

research-backed solutions. Read the report.

HOW GOOD IS YOUR BACKLOG? HOW TO SHAPE THE WORK FOR PRODUCT SUCCESS

When backlog items feel too big or vague, the problem is usually poor shaping around customer needs, not just missing detail. Teams should shape work together through problem clarification, workshops, and spikes so they can learn faster, avoid handoff friction, and deliver value in smaller, clearer steps.

KILL YOUR DARLINGS (22 MINUTE PODCAST)

Flatlining products that generate some revenue but show no growth often block better opportunities. Product leaders must deliberately sunset them as portfolio decisions to free teams to discover the next source of growth.

VISHAL KAPOOR'S 10 RULES FOR BUILDING HONEST PRODUCTS WITH AI

AI can accelerate experimentation and prototyping, but building trustworthy products still requires human judgment, customer understanding, and first-principles thinking. Teams should use AI to explore ideas faster while prioritizing simplicity, transparency, and real customer value.

WHAT EXCELLENT GROWTH TEAMS SEE THAT OTHERS MISS (43 MINUTE VIDEO)

Great growth teams don't chase experiments or tactics. They identify and remove the real friction blocking users from getting value. Sustainable growth comes from deep customer understanding, faster learning, and compounding the insights that truly matter.