#threatresearch — Public Fediverse posts

Wordfence Argus: Moving Beyond Human Research Capability

When you create an AI agent that makes a breakthrough that is so difficult to understand that you need to ask it to write a blog post to explain it to you, you know you’re on to something...

https://www.wordfence.com/blog/2026/08/wordfence-argus-moving-beyond-human-research-capability/

#wordpress #cybersecurity #ai #threatresearch

New.

VulnCheck: Chinese Implants in the Supply Chain https://www.vulncheck.com/blog/zbt-darklantern-speakingstone @vulncheck #infosec #malware #zeroday #threatresearch

New.

Rapid7: Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs https://www.rapid7.com/blog/post/tr-identity-as-a-service-dark-web-marketplaces-executive-ssn/ @Rapid7Official #infoec #privacy #cybercrime #threatresearch

New.

Proofpoint: Carry-On Compromise: TA4922 Packs PackClient https://www.proofpoint.com/us/blog/threat-insight/carry-compromise-ta4922-packs-packclient #infosec #threatresearch #malware

Threat Research Bolsters SMB Cybersecurity with MDR

With ESET's Managed Detection Response (MDR), small and midsize businesses can tap into expert-driven threat monitoring and hunting capabilities, leveling up their cybersecurity game without needing an elite in-house team. This game-changing approach bridges the gap between threat research and real-world defense, empowering…

https://osintsights.com/threat-research-bolsters-smb-cybersecurity-with-mdr?utm_source=mastodon&utm_medium=social

#ManagedDetectionResponse #Mdr #ThreatResearch #Cybersecurity #SmallAndMidsizeBusinesses

New.

Tenable/ SentinelOne: Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter https://www.tenable.com/blog/edge-infrastructure-under-siege @tenable

SentinelOne: https://www.sentinelone.com/blog/what-two-independent-datasets-reveal-about-whos-exploiting-your-perimeter/ #infosec #threatresearch

New.

Kaspersky: Exploits and vulnerabilities in Q2 2026 https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/ @Kaspersky #infosec #vulnerability #threatresearch

New.

Any.Run: A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign https://any.run/cybersecurity-blog/us-campaign-malware-analysis/ @anyrun_app #infosec #malware #threatresearch #phishing

New.

VulnCheck: Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain https://www.vulncheck.com/blog/cve-2026-63520-sharepoint-unsafe-type-rce @vulncheck #infosec #threatresearch #Microsoft #SharePoint #vulnerability

New.

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520) https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-remote-code-execution-cve-2026-63520/ @Rapid7Official #infosec #Microsoft #vulnerability #threatresearch #SharePoint

New.

Cato: When Trust Becomes the Payload in a Fake Codex ClickFix Campaign https://www.catonetworks.com/blog/cato-ctrl-when-trust-becomes-payload-in-fake-codex-clickfix-campaign/

More:

Infosecurity-Magazine: Fake Codex Download Uses Google Sites to Deliver macOS Malware https://www.infosecurity-magazine.com/news/fake-codex-download-google-sites/ #infosec #malware #threatresearch #Google #macOS #Apple

Thread Fabric's research was posted on August 20:

Threat Fabric: Manic: Blend between Banking Malware & Spyware https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware

Security Week: Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/ @SecurityWeek #infosec #malware #spyware #threatresearch

New.

Kaspersky: The invisible passenger in your car https://securelist.com/android-head-unit-malware/121106/ @Kaspersky #malware #infosec #google #Android #threatresearch #fraud #botnet

https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised
#CyberSecurity #InfoSec #SupplyChainSecurity #SoftwareSupplyChain #NPM #OpenSourceSecurity #AppSec #DevSecOps #ThreatIntel #Malware #JavaScript #NodeJS #CICD #GitHubActions #CloudSecurity #TypeScript #ReactJS #WebDev #OpenSource #DevTools #SoftwareEngineering #DeveloperSecurity #SecureCoding #GitHub #SupplyChainAttack #Programming #TechNews #DevOps #ApplicationSecurity #ThreatResearch #SecurityEngineering #CyberAttack #Hackers #MalwareAlert #SecurityResearch #DevCommunity

New research shows 3 flaws dubbed #ClaudyDay in Claude AI could be chained to steal user data using fake Google Ads, hidden prompts, and built-in features.

Read: https://hackread.com/claudy-day-flaws-data-theft-fake-claude-ai-ads/

#CyberSecurity #AI #ClaudeAI #InfoSec #DataSecurity #ThreatResearch #Malware #Privacy

We’ve been tracking a cluster of RDGA‑generated domains involved in distributing fake app‑store landing pages. These domains are consistently registered through Namecheap and protected by Cloudflare, which the operators use to obscure origin infrastructure and rapidly cycle through fresh front‑end domains.

The sites impersonate Google Play or iTunes, based on their device’s user‑agent, presenting users with pages that look and feel legitimate. Instead of real apps, the pages deliver Progressive Web Applications (PWAs) that persist on the device and enable ongoing notification abuse.

PWAs are a chrome application which plays cross platform, windows, linux, android, iOS and gets added as an icon on the desktop ofevery device.

Once installed, the PWA triggers a redirection chain through one or more intermediary domains before sending users to online casinos, adult content, or other low‑quality destinations. Because many of these casinos operate from regions where online gambling is restricted or illegal, the operators continually replace the final‑stage domains. This use of RDGA and PWAs allows them to evade regional blocking, reputation systems, and automated detection controls by rotating infrastructure at scale and keeping their persistence to the user devices.

fwiw, most large scale gambling operations like these are not simply illegal in the regions they target... they are scams and often connected to other major crimes, including human trafficking.

play-megawin[.]site
play-icefish[.]website
play-richcasino[.]site
play-casinostaat[.]site
mountainvertex[.]shop
play-fdjfrance[.]site
play-lucky7[.]site
funterra[.]shop
hotcoins[.]site
stonefestal[.]shop
spirevanguard[.]shop
play-crowngreen[.]website
forestoutpost[.]shop

#threatintel #gambling #pwa #dns #fake #infoblox #threatresearch #malware #scam #fakeApp #googleplay #infobloxthreatintel #itunes

Operation Bizarre Bazaar documents systematic abuse of exposed LLM and MCP infrastructure with commercial monetization.

The campaign demonstrates how AI endpoints without authentication, rate limits, or proper exposure controls can enable compute theft, data access, and potential lateral movement.

AI infrastructure security is increasingly inseparable from traditional cloud and app security.

What controls are most effective in your environment?

Source: https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization

Follow TechNadu for objective infosec research coverage.

#AIsecurity #LLM #MCP #CloudDefense #ThreatResearch #InfosecCommunity

⚠️ Smishing alert for Greek citizens. 💳 🚨

Scammers are pushing fake AADE (Independent Authority for Public Revenue) “unpaid taxes” SMS that lead to cloned payment pages designed to steal credit‑card info. If a text suddenly demands urgent payment, treat it like a pop‑up from nowhere—don’t click, don’t trust, don’t pay. Share to protect others.

mycargr[.]com
aadcar[.]com
aadgee[.]com
aadgre[.]com

#CyberThreatIntel #Infoblox #DNS #ThreatResearch #phishing #smishing #Cybercrime #AADE #Greece

New, from me: Who Operates the Badbox 2.0 Botnet?

The cybercriminals in control of Kimwolf -- a disruptive botnet that has infected more than 2 million devices -- recently shared a screenshot indicating they'd compromised the control panel for Badbox 2.0, a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea about that.

https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/

#infosec #botnet #IoT #Android #Google #threatresearch

New, from me: The Kimwolf Botnet is Lurking in Corporate, Govt. Networks

A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.

https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/

#botnet #infosec #IoT #DDoS #threatresearch #malware

Researchers disclosed Reprompt, a prompt-injection-based technique affecting Microsoft Copilot Personal, allowing session hijacking and stealthy data exfiltration via crafted URLs.

Although now patched and not seen in active exploitation, the research highlights:

- Prompt injection via URL parameters
- Session persistence risks in AI assistants
- Limitations of first-request-only guardrails
- Challenges for client-side detection

A useful case study in LLM threat modeling and defensive design.

What security control do you see as most critical for consumer AI assistants?

Source: https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/

Follow @technadu for sober, security-first reporting.
Add your insights below.

#InfoSec #AIsecurity #PromptInjection #LLM #ThreatResearch #DataSecurity

Threat actors continue to operationalize current-events lures as part of malware delivery chains.

Recent research shows a backdoor deployed via attachments themed around breaking geopolitical news, using legitimate binaries and DLL sideloading techniques for persistence.

No attribution assumptions - just a reminder that contextual relevance remains one of the most effective social engineering tools.

What controls have you found most effective against news-driven phishing?

Engage with us in the comments and follow @technadu for practical threat intelligence coverage.

Source: https://www.darktrace.com/blog/maduro-arrest-used-as-a-lure-to-deliver-backdoor

#InfoSec #ThreatResearch #MalwareTTPs #PhishingDefense #CyberOperations #ThreatDetection #TechNadu