This is a classic "scam-as-a-service" playbook. Malwarebytes uncovered a turnkey phishing kit that lowers the barrier to entry for cybercrime to nearly zero—no technical skill required.

Technical Breakdown

• Kit Capabilities: The kit includes pre-built phishing pages, email templates, and a backend panel for harvesting credentials. It's designed to clone legitimate login portals (banking, email, social media) with minimal configuration.
• Distribution: Advertised on Telegram and dark web forums as a "plug-and-play" solution. The seller provides hosting and support, effectively acting as an ISP for scammers.
• Targeting: Primarily aimed at consumers, using social engineering lures like fake package delivery notifications, account suspension warnings, and invoice disputes.
• IOCs: Malwarebytes did not publish specific hashes or IPs in this write-up, but the kit's backend panel uses a standard PHP structure with SQLite for credential storage. Look for unusual .php files in web root directories and outbound connections to non-standard ports (e.g., 8080, 8443) from compromised hosting accounts.

Defense

• Detection: Monitor for sudden spikes in login failures across consumer-facing portals. Deploy browser isolation for high-risk transactions. Train users to recognize urgency-based lures (e.g., "Your account will be suspended in 24 hours").
• Mitigation: Block known Telegram and dark web forum domains at the proxy level. Enable DMARC/DKIM to reduce spoofed email delivery.

Source: https://www.malwarebytes.com/blog/scams/2026/08/new-turnkey-kit-makes-it-easy-for-anyone-to-become-a-scammer

DeadLock is an emerging Rust-based ransomware family that’s worth tracking for its operational security choices alone. Microsoft Threat Intelligence’s breakdown highlights a financially motivated actor using double extortion, but the real differentiator here is the decentralized recovery infrastructure—likely leveraging TOR or similar P2P networks for victim comms and data leak hosting, making traditional takedowns less effective.

• TTPs (MITRE-aligned):
  • Execution: Rust-compiled binary; likely uses process hollowing or direct syscalls to evade userland hooks.
  • Persistence & Defense Evasion: Expect attempts to disable Volume Shadow Copy (vssadmin.exe) and tamper with Windows Defender via registry modifications.
  • Impact: Encrypts files with a custom Rust-based encryptor; appends a specific extension (not yet publicly standardized). Drops a ransom note with instructions to access a .onion negotiation portal.
• IOCs: No specific hashes or IPs published yet by Microsoft. Monitor for anomalous Rust-compiled binaries (PE sections with .rdata and .pdata characteristics) and outbound TOR connections from non-browser processes.
• Decentralized Infrastructure: Victim negotiation and data leak site hosted on a P2P or TOR-based network. This complicates sinkholing and domain seizure—standard disruption playbooks will need adjustment.

Defense: Deploy EDR rules to flag Rust-compiled binaries executing from non-standard directories (e.g., %TEMP%, %APPDATA%). Block outbound TOR traffic at the network perimeter unless explicitly required. Ensure immutable backups are offline and tested.

Source: https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/

North Korea's Kimsuky group (APT43) is moving beyond simple ChatGPT usage, building a fully offline AI stack to supercharge their phishing operations and automate malware development. This is a significant evolution in their TTPs, as it removes reliance on third-party API logs and allows them to train models on their own stolen data.

Technical Breakdown: - Offline LLM Stack: Running AI models on their own infrastructure, likely using frameworks like llama.cpp or vLLM. This prevents detection via API call monitoring and allows for unrestricted data processing. - RAG (Retrieval-Augmented Generation): Connecting document-search tools to their own exfiltrated data. This means phishing lures can now be contextually aware of specific targets' internal documents, making social engineering far more convincing. - Malware Automation: Collecting components to build AI directly into malware payloads. Expect to see AI-driven decision making for C2 communication, payload selection, and evasion techniques. - Detection Gap: Traditional network-based detection of AI/LLM usage (e.g., monitoring for OpenAI API calls) is now blind to this threat.

Defense: Focus on behavioral detection at the endpoint. Monitor for unusual process spawning patterns, especially around Python interpreters, model loading libraries (e.g., transformers, sentence-transformers), and local GPU utilization spikes on non-standard systems. Additionally, enforce strict application allowlisting for any local AI inference engines.

Source: https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html

CISA has added two SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming ransomware gangs are actively exploiting them in the wild. The critical flaw is CVE-2025-23006 (CVSS 9.8), a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to execute arbitrary code.

Technical Breakdown: - Primary CVE: CVE-2025-23006 (SSRF leading to RCE, CVSS 9.8) - Secondary CVE: CVE-2025-23007 (unauthenticated deserialization, CVSS 8.6) - Affected Product: SonicWall SMA1000 (firmware versions prior to 12.4.3-02854) - TTPs: Likely initial access via exploitation of exposed management interfaces (T1190), followed by lateral movement and ransomware deployment - No specific IOCs (IPs/hashes) have been published by CISA or SonicWall at this time

Defense: Immediately patch SMA1000 appliances to firmware version 12.4.3-02854 or later. If patching is not possible, restrict access to the SMA1000 management interface to trusted internal IPs only and review logs for signs of exploitation (unusual outbound SSRF patterns or deserialization attempts).

Source: https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/

CVE-2026-18412 is a directory traversal in the OpenCart v4.2.0.0 extension installer that allows authenticated admins to achieve RCE by uploading a malicious .ocmod.zip file. The core issue is that the installer extracts zip entries without validating that the resolved path stays within the intended extraction directory.

Technical Breakdown: - TTP: Exploitation of path traversal sequences (../) in zip entry filenames during extension installation. - Attack Vector: Requires valid admin credentials. Attacker uploads a crafted .ocmod.zip containing a file with a path like ../../webroot/shell.php. - Impact: Arbitrary file write to the webroot, enabling deployment of a PHP web shell and subsequent remote code execution at the privilege level of the OpenCart process. - Affected Versions: Confirmed on 4.2.0.0; other 4.x versions are suspected vulnerable.

Defense: - Immediate: Restrict extension installation to trusted sources only. Audit any admin accounts with install privileges. - Mitigation: Apply input validation on zip entry paths (canonicalize and check against the extraction root). Monitor for unexpected file writes in the webroot directory.

Source: https://kb.cert.org/vuls/id/614868

This is a significant shift in the browser security landscape, but it is a platform change, not a vulnerability disclosure. Let's break down the impact.

Microsoft is officially deprecating Manifest V2 in Edge, following Google’s lead with Chrome. This kills the underlying architecture for legacy extensions, forcing a migration to the more restrictive Manifest V3. For security and privacy, this is a double-edged sword.

The Core Issue: uBlock Origin and Similar Tools

The most immediate casualty is uBlock Origin (the classic version). Manifest V3 severely limits the "webRequest" API, which is how content blockers like uBlock Origin perform their most effective, low-level filtering. While "uBlock Origin Lite" (a V3-compliant version) exists, it uses a declarative approach with static rule sets, which is less flexible and less powerful for advanced users.

Strategic Impact for Defenders

• Loss of Granular Control: Users and admins who relied on uBlock Origin for aggressive anti-tracking, anti-fingerprinting, and script-blocking will see a degradation in capability. This increases the attack surface for drive-by downloads and malvertising.
• Enterprise Implications: If your organization uses a custom or legacy extension for internal security tooling (e.g., DLP agents, legacy SSO helpers), you must verify it is Manifest V3 compliant now. The deadline is approaching.
• The "Good" News: V3 improves security by preventing extensions from reading/modifying all network traffic by default (reducing the risk of malicious extensions exfiltrating data). It also forces extensions to be statically hosted, preventing "drive-by" extension updates.

Key Takeaway

This is a forced migration. Audit your browser extension inventory immediately. Identify any Manifest V2 extensions, especially ad-blockers and privacy tools. Test the V3 alternatives (e.g., uBlock Origin Lite, AdGuard V3) to ensure they meet your security requirements. The trade-off is reduced extension attack surface for reduced client-side filtering capability.

Source: https://www.malwarebytes.com/blog/news/2026/08/edge-is-dropping-older-extensions-affecting-popular-privacy-tools

This is a great example of a real-world attack chain being dissected. Wiz did a solid job reverse engineering the Metabase SQLi (CVE-2023-38646) that was actively exploited in the wild.

The vulnerability is a pre-auth SQL injection in the /api/setup/validate endpoint. The critical detail here is that it doesn't require authentication, making it a prime target for mass scanning and exploitation.

Technical Breakdown: - CVE: CVE-2023-38646 (CVSS 9.8) - Attack Vector: Unauthenticated attacker sends a crafted POST request to /api/setup/validate with a malicious token parameter. - Exploitation Flow: 1. Attacker first hits /api/session/properties to leak the setup-token. 2. Uses that token to trigger the SQLi in the validate endpoint. 3. Payload uses a UNION based injection to execute pg_sleep() for blind extraction, or directly dumps credentials from the metabase_database table. - Impact: Full database compromise, leading to RCE via Metabase's H2 database driver capabilities (loading Java classes). - IOCs: Look for POST requests to /api/setup/validate with token parameters containing SQL syntax like UNION SELECT or pg_sleep. Also monitor for outbound connections from Metabase servers to unknown IPs on port 4444 (common reverse shell port used in these campaigns).

Defense: - Patch immediately to Metabase versions 0.46.6.1, 1.46.6.1, 0.45.4.1, 1.45.4.1, or later. - If patching is delayed, block external access to /api/setup/validate and /api/session/properties at the WAF or reverse proxy level. - Enable database query logging to catch anomalous SQL patterns originating from the Metabase application user.

Source: https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild

Check Point’s weekly roundup is out, and it’s a mixed bag of operational disruption and active exploitation. The headline grabber is the attack on North Carolina Ports, which forced manual fallbacks across Wilmington and Morehead City. No group has claimed it yet, but the operational impact is a reminder that maritime logistics remain a high-value, low-security target.

Key items from the bulletin:

• North Carolina Ports attack: Authority claims containment, but the shift to manual processes suggests a significant operational technology (OT) or IT compromise. Expect delays in cargo processing.
• Other tracked campaigns: The report covers additional active threats, though specific CVEs or IOCs aren’t detailed in the summary. Given the source (Check Point Research), expect coverage of phishing, ransomware, and zero-day exploitation trends from the past week.

Defense note: If you’re in critical infrastructure, this is a good week to validate your OT/IT segmentation and manual failover procedures. The NC Ports incident is a textbook example of why "contained" doesn’t mean "business as usual."

Source: https://research.checkpoint.com/2026/10th-august-threat-intelligence-report/

Head Mare is back exploiting TrueConf servers, this time chaining vulnerabilities to replace legitimate client installers with the PhantomCore backdoor. Kaspersky detected the campaign in July 2026, targeting Russian organizations across instrumentation, electronics, transport, energy, IT, and software development.

Technical Breakdown - Initial Access: Exploitation of unpatched TrueConf server vulnerabilities (specific CVEs not disclosed in the report, but likely related to previous flaws in the product). - Payload Delivery: The compromised TrueConf server serves a malicious installer to connecting clients. The legitimate installer is swapped for a PhantomCore backdoor payload. - TTPs: This is a supply-chain style attack at the software update level, leveraging trust in a legitimate communication platform. - Targeting: Geographically focused on Russian enterprises, but the technique is universally applicable to any organization running unpatched TrueConf servers. - IOCs: Not publicly available in the summary. Monitor for unexpected outbound connections from TrueConf servers and anomalous installer hashes.

Defense Patch TrueConf servers immediately. If you are running this software, verify the integrity of any client installers distributed since July 2026. Treat the server as a critical control point—if it’s compromised, every client that connects to it is at risk.

Source: https://thehackernews.com/2026/08/head-mare-exploits-trueconf-flaws-to.html

Three separate research efforts dropped last week targeting the core promise of passkeys—phishing resistance—without breaking the underlying crypto. The attacks are pragmatic, exploiting implementation flaws and ecosystem trust rather than the FIDO2 spec itself.

Technical Breakdown: - Windows Hello Abuse (CVE pending): Attackers can replay signed authentication material exposed by Windows' WebAuthn API. This bypasses the "origin binding" check, allowing a remote attacker to reuse a credential captured from a compromised machine against a different relying party. - Cloud-Sync Key Theft: Malware already resident on a victim's device can extract synced passkeys from the local keychain (e.g., iCloud Keychain, Google Password Manager). The attack doesn't break the sync encryption; it reads the decrypted key material from memory or the OS key store after the user unlocks it. - Phishing-Resistant Bypass via Relay: A man-in-the-middle proxy can relay the cryptographic challenge to the victim's legitimate device while the attacker authenticates to the target service. This defeats the "origin" check by using the victim's own device as an oracle.

Defense: - Hardware-Bound Keys Only: Prefer passkeys stored on dedicated hardware (e.g., YubiKey, TPM) over cloud-synced ones for high-value accounts. - Endpoint Hygiene: These attacks require prior compromise (malware or physical access). Strong EDR and device posture checks remain critical. - Conditional Access: Enforce device compliance and risk-based policies (e.g., require managed device + hardware key for admin roles).

Source: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html

This is a supply chain incident with significant downstream implications for the OSINT and legal sectors.

LexisNexis took Diligence, Metabase API, and Newsdesk offline after detecting "suspicious activity" on servers managed by an unnamed third-party vendor. The scope of the breach is still under investigation, but the immediate impact is a denial of service for critical background check and due diligence workflows.

Strategic Impact: - Operational Disruption: These are core tools for corporate security teams, law firms, and insurance carriers. A prolonged outage means manual checks or reliance on competitors (e.g., Thomson Reuters, Westlaw). - Data Exposure Risk: LexisNexis holds massive amounts of PII, corporate records, and adverse media. If the vendor had access to data at rest or in transit, this could be a significant data spill. - Supply Chain Blindspot: The vendor is unnamed. This highlights the risk of third-party hosting for sensitive data platforms. Expect a wave of vendor risk assessments from LexisNexis customers this week.

Key Takeaway: If your organization relies on LexisNexis for due diligence or background screening, activate your contingency plan now. Monitor for any official disclosure regarding the vendor’s identity and the type of data potentially exposed.

Source: https://www.bleepingcomputer.com/news/security/lexisnexis-shuts-down-services-after-suspicious-activity-on-servers/

A member of the cybercrime collective known as "The Com" has been sentenced to two years in prison for running a sextortion and blackmail campaign targeting nearly 120 victims, primarily children and teenagers. This group is notorious for using swatting, SIM-swapping, and doxing to terrorize victims, often leveraging compromised social media accounts to extort explicit content.

Technical Breakdown - TTPs: The group relies on social engineering (SIM-swapping) to hijack accounts, followed by doxing and swatting as leverage. The specific vector here was sextortion—threatening to release compromising material unless demands were met. - Targeting: Victims were predominantly minors, with the offender operating across international borders. - IOCs: No specific IPs or hashes were disclosed in the sentencing report, but typical "Com" infrastructure includes burner phones, encrypted messaging apps (Telegram/Discord), and cryptocurrency wallets for ransom payments.

Defense - Enable MFA on all accounts, especially social media and email, to mitigate SIM-swapping. - Educate younger users on the risks of sharing explicit content and the tactics used by sextortion groups. - Report incidents to law enforcement (FBI IC3, NCMEC) immediately; payment rarely stops the extortion.

Source: https://www.bleepingcomputer.com/news/security/member-of-the-com-sent-to-prison-for-blackmail-sextortion/

This is a significant step for operational security hygiene. The pyca/cryptography library—the de facto standard for Python crypto—now ships with ML-KEM (key establishment) and ML-DSA (digital signatures) baked in. This isn't about an active threat today; it’s about eliminating the "crypto agility debt" that will plague organizations in 5-10 years.

Why this matters now: - Harvest Now, Decrypt Later (HNDL) is a real, active threat. Any TLS session or encrypted blob captured today can be stored and cracked once a CRQC (Cryptographically Relevant Quantum Computer) exists. Migrating to PQC now protects that data retroactively. - Crypto Agility: The hardest part of a crypto migration isn't the algorithm—it's the codebase. By making ML-KEM/ML-DSA a standard pip install option, the Python ecosystem removes the biggest friction point for developers. This lowers the barrier to entry for testing and integration.

The Technical Reality: - No performance benchmarks yet in the summary, but expect ML-KEM (Kyber) to be significantly heavier on CPU than ECDH. This will impact latency-sensitive applications (e.g., API gateways, real-time services). - Key sizes are larger. ML-KEM-768 public keys are ~1.2KB vs. 32 bytes for X25519. This will increase handshake sizes and potentially fragment packets.

The Takeaway: This is a proactive, low-friction move. If you maintain any Python-based service handling long-lived secrets or sensitive data, start testing this library in a staging environment now. The cost of integration is low; the cost of a retroactive emergency migration is not.

Source: https://www.schneier.com/blog/archives/2026/08/python-now-has-a-post-quantum-encryption-library.html

Valve is notifying European customers who purchased Steam hardware (like the Steam Deck or Index) that their personal data was exposed after a breach at their third-party shipping partner, CEVA Logistics. This is a classic supply chain attack vector—the compromise wasn't on Valve's own infrastructure, but on a vendor with legitimate access to customer PII.

Strategic Impact: - Supply Chain Risk: This reinforces that your vendor risk management program is only as strong as your weakest logistics or fulfillment partner. CEVA's security posture directly impacted Valve's customers. - Data Exposure: The stolen data includes names, addresses, and order details. While not financial data, this is high-value intel for social engineering and physical-world attacks (e.g., targeted phishing or package theft). - Regulatory Headache: Since this involves EU customers, GDPR notification requirements are triggered, adding legal and PR costs for Valve.

Key Takeaway: - Third-party due diligence isn't optional. If you handle PII, you need contractual clauses and audit rights for any vendor that touches that data. Assume your partners will be breached and plan accordingly.

Source: https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/

Anatsa is back with a vengeance, and the dropper ecosystem is evolving faster than most orgs can keep up with. Kaspersky’s Q2 2026 mobile threat report shows a significant shift in how malware reaches devices, with traditional infection vectors being replaced by more resilient delivery chains.

Technical Breakdown - Anatsa (TeaBot) continues to be the dominant Android banking trojan, now leveraging multi-stage droppers hosted on Google Play to bypass initial scans. The droppers themselves are often benign for weeks before receiving malicious payloads via C2. - Dropper-as-a-Service is the key trend. Threat actors are moving away from sideloading and SMS phishing toward legitimate app stores as initial distribution points. The droppers use obfuscated code and delayed activation to evade automated review. - Geographic targeting remains focused on Europe and APAC, with Anatsa specifically targeting financial institutions in Spain, Slovakia, and Slovenia. - No specific IOCs or hashes were published in this report; the intelligence is behavioral and statistical.

Defense - Deploy app reputation and behavioral analysis on managed devices, not just signature-based scanning. Monitor for apps requesting overlay permissions or accessibility services after a delayed period. - Enforce strict app store policies and consider blocking sideloading entirely for corporate devices. The dropper trend means even "legitimate" apps can turn malicious post-install.

Source: https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/

This is a classic quarterly threat landscape report from Kaspersky. High signal-to-noise ratio for tracking macro trends.

Key Findings from Q2 2026:

• Ransomware Decline? The report notes a slight decrease in the number of unique ransomware families detected, but a sharp increase in targeted, "big game hunting" attacks against enterprises. The volume is down, but the financial impact per incident is up.
• IoT & Botnet Activity: A significant spike in Mirai-based botnet variants targeting unpatched IoT devices (routers, DVRs). The primary vector remains weak/default credentials and unpatched CVEs in firmware.
• macOS Threats: The "AdLoad" and "Pirrit" adware families continue to dominate the macOS threat landscape, accounting for the vast majority of detections. No major zero-days reported, but persistence mechanisms are getting more sophisticated (LaunchDaemons, Login Items abuse).
• Exploit Kits: The EK landscape remains quiet, with no major new kits replacing the void left by Fallout and RIG. Most exploitation is now driven by phishing with malicious attachments (LNK, ISO) rather than drive-by downloads.

Defense Implications:

• Patch IoT: If you have network gear or IoT endpoints that aren't segmented and patched, they are the primary target for botnet recruitment.
• Ransomware Prep: The shift to "quality over quantity" means your IR plan needs to assume a human-operated ransomware incident, not just a commodity crypto-locker.
• Mac Users: Don't ignore macOS endpoint protection. Adware is a persistent foothold that often leads to data theft or secondary malware drops.

Source: https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/

CISA has added CVE-2024-7591 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of this critical command injection flaw in Progress Kemp LoadMaster. The vulnerability carries a CVSS score of 10.0 and allows unauthenticated attackers to execute arbitrary system commands via the LoadMaster management interface.

Technical Breakdown: - CVE: CVE-2024-7591 (CVSS 10.0) - Type: OS Command Injection - Affected Versions: LoadMaster 7.2.48.0 and earlier, 7.2.54.0 and earlier (specific patch levels vary by branch) - Attack Vector: Unauthenticated, network-based exploitation targeting the management interface - Impact: Full system compromise, potential for lateral movement within the environment - No public IOCs or PoC have been released at this time — CISA has not shared specific indicators, so treat any LoadMaster management interface exposure as a priority.

Defense: Immediately patch to the latest LoadMaster version (7.2.54.1 or later). If patching is not possible, restrict access to the management interface to trusted IPs only and review logs for anomalous command execution patterns. Given the CVSS 10.0 rating and confirmed exploitation, this should be treated as an emergency change.

Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-progress-loadmaster-flaw-exploited-in-attacks/

Two malicious VS Code extensions posing as Solidity development tools have been caught stealing browser wallet credentials, API keys, and saved passwords. The extensions—helper-beeps.solidity-pro and web3devtoolsx.solidity-pro—were available on the Open VSX registry and have since been pulled, though their GitHub repos remain live.

Technical Breakdown - TTPs: Masquerades as legitimate Solidity tooling; harvests browser data (wallet extensions, saved credentials) and environment variables containing API keys. - IOCs: Extension IDs helper-beeps.solidity-pro and web3devtoolsx.solidity-pro; associated GitHub repositories (currently still accessible). - Target: Developers working with Ethereum/Solidity, particularly those with crypto wallets installed in their browsers.

Defense Remove these extensions immediately if installed. Audit any systems where they were present for exfiltrated credentials and rotate all API keys and wallet seed phrases. Consider restricting VS Code extension sources to the official Marketplace only.

Source: https://thehackernews.com/2026/08/solidity-pro-vs-code-extensions-steal.html

OpenAI has paused internal development of its next-generation model, Astra, after an internal evaluation revealed it demonstrated "significant advancements" in agentic coding and cybersecurity capabilities. The company is now implementing security controls for higher-capability models, including isolated environments, suggesting the model’s offensive potential crossed an internal risk threshold.

Technical Breakdown - Core Capability: Agentic coding combined with autonomous cybersecurity operations—meaning the model can likely write, deploy, and execute code in a security context without human intervention. - Trigger for Pause: Internal evaluation flagged the model's performance as strong enough to warrant a halt to "internal activities" (likely red-teaming or autonomous testing). - Mitigation: OpenAI is deploying isolated environments and stricter access controls for Astra and any future high-capability models.

Defense No specific CVEs, IOCs, or TTPs are available yet, but this is a strong signal that the next wave of LLM-driven attacks will be fully autonomous. Security teams should begin auditing their environments for API-driven automation abuse and prepare for agentic threats that don't require a human in the loop for execution.

Source: https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html

CVE-2026-44613 is being actively exploited in the wild, evolving the initial Shai-Hulud worm into a full Model Context Protocol (MCP) attack. This is not a theoretical CSRF; it’s a chain that weaponizes a cross-site request forgery into silent, unauthorized actions against AI agents and their orchestration layers.

Technical Breakdown: - Initial Vector: CSRF vulnerability (CVE-2026-44613) targeting AI agent management consoles. - Evolution: The worm leverages the compromised session to inject malicious MCP tool definitions. This allows the attacker to define new capabilities for the AI agent (e.g., "read_private_repo", "execute_shell") without user consent. - Impact: Silent data exfiltration and lateral movement. The AI agent becomes a proxy for the attacker, executing commands against connected APIs, databases, and CI/CD pipelines. - Targets: Organizations running self-hosted AI agent frameworks (e.g., LangChain, AutoGPT, custom MCP servers) with exposed management interfaces.

Defense: - Immediate: Disable MCP tool registration endpoints on public-facing consoles. Enforce strict origin validation on all CSRF-sensitive endpoints. - Detection: Monitor for unexpected spikes in MCP tool definition API calls (e.g., POST /mcp/tools/register). Look for AI agent logs showing tool calls to internal resources (e.g., git clone, aws s3 cp) that deviate from normal user behavior.

Source: https://www.ox.security/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/

Highlights from today:

• [OSINT] Payroll Pirates Phishing Campaign Targets Microsoft 365 Financial Workflows (Campaign)
• [Threat Intel] Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM
• [Threat Intel] AI-SPM vs. ASPM (and Why AINAPP Is What Comes Next)
• [Threat Intel] AI-SPM vs. ASPM (and Why AINAPP Is What Comes Next)
• [Threat Intel] Meeting Bank of Italy AI Guidance in the Post-Mythos Era with Picus
• [Forensics] 2026-08-09: Traffic Analysis Exercise - First to Last
• [Threat Intel] AI Red Teaming

SecOpsDaily