#threatresearch — Public Fediverse posts

A reexamination of recent OpenAI sins: 1) a cyberattack and 2) attempted theft of data.

New.

"In May 2026, a malicious package campaign forced RubyGems to suspend new registrations and remove hundreds of packages [1]. Researchers later linked the activity to OpenAI agents, reporting unauthorized code execution and attempted API-key theft [2]. OpenAI acknowledged its agents’ use of RubyGems to retrieve public information [3]. RubyGems could not independently confirm attribution and found no evidence of successful key theft."

Picus: Inside the OpenAI-RubyGems Incident: Did AI Agents Attack RubyGems? https://www.picussecurity.com/resource/blog/openai-rubygems-incident-ai-agents #infosec #threatresearch #RubyGems #cyberattack #OpenAI

Cisco has addressed a critical September 2 vulnerability.

CRITICAL: CVE-2026-20274, CVE-2026-20275, and CVE-2026-20276: Cisco IOS XR Software Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM @TalosSecurity

More related to Cisco:

Rapid7: CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild/ @Rapid7Official #threatresearch #infosec #Cisco #vulnerability

New.

Sophos: Devil’s advocate? Uncensored Luciferus AI service advertised underground https://www.sophos.com/en-us/blog/uncensored-luciferus-ai-service-advertised-underground @SophosXOps #infosec #threatresearch #scam

New.

Group-IB: Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit https://www.group-ib.com/blog/smishing-triad-outsider-jwr/ #infosec #threatresearch #phishing

New.

Group-IB: Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit https://www.group-ib.com/blog/smishing-triad-outsider-jwr/ #infosec #threatresearch #phishing

New.

Group-IB: Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit https://www.group-ib.com/blog/smishing-triad-outsider-jwr/ #infosec #threatresearch #phishing

New.

Group-IB: Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit https://www.group-ib.com/blog/smishing-triad-outsider-jwr/ #infosec #threatresearch #phishing

New.

Group-IB: Smish. Click. Drained: Inside the Smishing Triad's Phishing Cockpit https://www.group-ib.com/blog/smishing-triad-outsider-jwr/ #infosec #threatresearch #phishing

The recent MikroTik RouterOS vulnerabilities have several conditions for exploitation.

That may make mass exploitation more difficult, but targeted attacks are another story.

@martijn_grooten and @silas break down what an attacker needs. https://censys.com/podcasts-videos/censys-arc-flash-episode-5/

#CensysARC #MikroTik #ThreatIntelligence #ThreatResearch #InfoSec #Cybersecurity

Trellix’s latest threat-hunting report traces state-backed phishing, the DarkSword iPhone exploit kit, a Node.js-based crypto stealer and poisoned Axios npm packages across five covert campaigns.

Listen/Read: https://hackread.com/trellix-darksword-jsceal-axios-npm-attack-apt28/

#Cybersecurity #ThreatResearch #Malware #APT28

Trellix’s latest threat-hunting report traces state-backed phishing, the DarkSword iPhone exploit kit, a Node.js-based crypto stealer and poisoned Axios npm packages across five covert campaigns.

Listen/Read: https://hackread.com/trellix-darksword-jsceal-axios-npm-attack-apt28/

#Cybersecurity #ThreatResearch #Malware #APT28

Trellix’s latest threat-hunting report traces state-backed phishing, the DarkSword iPhone exploit kit, a Node.js-based crypto stealer and poisoned Axios npm packages across five covert campaigns.

Listen/Read: https://hackread.com/trellix-darksword-jsceal-axios-npm-attack-apt28/

#Cybersecurity #ThreatResearch #Malware #APT28

Trellix’s latest threat-hunting report traces state-backed phishing, the DarkSword iPhone exploit kit, a Node.js-based crypto stealer and poisoned Axios npm packages across five covert campaigns.

Listen/Read: https://hackread.com/trellix-darksword-jsceal-axios-npm-attack-apt28/

#Cybersecurity #ThreatResearch #Malware #APT28

Trellix’s latest threat-hunting report traces state-backed phishing, the DarkSword iPhone exploit kit, a Node.js-based crypto stealer and poisoned Axios npm packages across five covert campaigns.

Listen/Read: https://hackread.com/trellix-darksword-jsceal-axios-npm-attack-apt28/

#Cybersecurity #ThreatResearch #Malware #APT28

Home from #LABScon23 and I know I’ll be thinking about many of these talks and the great conversations for days to come. Getting to talk a bit about the Internet presence and security of #MFT tools like #MOVEit and #GoAnywhere was an added bonus 📂☺️🗄️

#threatResearch #security #infosec