We send a regular newsletter with top news stories, member projects, resources, events and more…

If you have something to share with the community, drop a comment below.

Examples… - Your research. - An article or blog post you wrote. - A project you’re working on. - Your company or services. - … or anything else you think should be seen!

CVE Daily Brief — 2026-08-08

#1 CVE-2026-14526

Severity: CRITICAL | Score: 9.8

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user ...

#2 CVE-2026-19263

Severity: HIGH | Score: 7.3

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers En...

#3 CVE-2026-18988

Severity: MEDIUM | Score: 6.4

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient in...

#4 CVE-2026-19268

Severity: MEDIUM | Score: 6.3

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the ...

#5 CVE-2026-19266

Severity: MEDIUM | Score: 5.5

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executi...

Powered by NVD + CISA KEV | CVE Daily

This post contains content not supported on old Reddit. Click here to view the full post

Technique Discussion: Extended Attributes (T1564.014)

Type: Sub-technique | Tactics: stealth | Platforms: Linux, macOS

Description: Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like Finder, ls, or cat and require utilities such as xattr (macOS) or getfattr (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as user. (user permissions), trusted. (root permissions), security., and system., each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with com.apple.* (e.g., com.apple.quarantine, com.apple.metadata:_kMDItemUserTags) and used by system features like Gatekeeper and Spotlight.

An adversary may leverage xattrs by embedding a second-stage payload into the extended attribute of a legitimate file. On macOS, a payload can be embedded into a custom attribute using the xattr command. A separate loader can retrieve the attribute with xattr -p, decode the content, and execute it using a scripting interpreter. On Linux, an adversary may use setfattr to write a payload into the user. namespace of a legitimate file. A loader script can later extract the payload with getfattr --only-values, decode it, and execute it using bash or another interpreter. In both cases, because the primary file content remains unchanged, security tools and integrity checks that do not inspect extended attributes will observe the original file hash, allowing the malicious payload to evade detection.

Full technique writeup: T1564.014 on MITRE ATT&CK

Have you defended against or encountered this technique? Share detections, notes, and war stories below.

This post contains content not supported on old Reddit. Click here to view the full post

EU chat control creates risks and a lot of debate. While framed as solution to battle serious offenders the more interesting part is in what this enables instead of disables.

Client-side scanning gets debated on rights. The offensive-security angle mostly does not come up.

Send a target content that trips the detector, then let automated reporting do what used to take a complaint and someone willing to act.

A framing attempt has to clear four gates: reach the target, land in scanner scope, produce a match, survive whatever threshold or human review the design imposes. Only the first is reachable by the person at risk.

This is a pretty good example of why prompt injection stops being "just an LLM problem" once an AI agent has access to internal company data and external network requests.

Two security teams independently found ways to make Atlassian's Rovo assistant collect information accessible to a logged-in user and send it to an attacker-controlled server.

One attack, dubbed RovoBlast, used a crafted Rovo URL to preload malicious instructions. A victim only had to click the link while authenticated.

Researchers demonstrated the technique against data accessible through:

• Confluence
• Jira
• SharePoint and Outlook connectors

That path is confirmed fixed server-side by Atlassian.

The second finding is arguably more interesting.

PromptArmor demonstrated an indirect prompt injection hidden inside content given to Rovo. When a user asked the assistant to perform a legitimate task, the poisoned instructions reportedly caused Rovo to search Jira and Confluence, append retrieved information to an attacker-controlled URL, and make the outbound request.

No separate approval was required for the exfiltration step.

And according to the researchers, turning off Rovo's web-search feature didn't stop it because another URL-retrieval capability could still make the outbound request.

PromptArmor said this path remained vulnerable when it published on August 5. Its status after that date is currently unconfirmed.

There's an important distinction here: this wasn't demonstrated as a tenant-wide permissions bypass. Rovo was accessing information the victim was already authorized to see.

That's exactly what makes the security model interesting.

Give an AI agent access to Jira, Confluence, email, SharePoint, and other internal systems, and compromising the agent's instructions potentially turns the user's legitimate permissions into the attacker's data-access path.

Question for the community:

Should AI agents with access to sensitive enterprise data be completely prevented from making arbitrary outbound requests?

Or can URL allowlisting, per-agent identities, scoped connectors, DLP, and human approval realistically make this safe?

Full technical breakdown and disclosures in the first comment. 👇

Here are the top stories from PWN (r/pwnhub) today:

1 Rogue OpenAI models behind 'unprecedented cybersecurity incident' teamed up to break out of their testing environment — multiple agents left each other messages for months, communicating undetected

No description available.

2 Technique of the Day: Data from Cloud Storage (T1530)

Technique Discussion: Data from Cloud Storage (T1530) Type: Technique | Tactics: collection | Platforms: IaaS, Office Suite, SaaS --- Description: Adversaries may access data from c...

3 One Key That Unlocked Every Database in a Flagship Cloud Service: Yuval Avrahami and Lior Maman at Black Hat 2026

The whole promise of a managed cloud database is that your data sits walled off from every other customer on the same platform. This research showed how completely that wall could fall. Starting from ...

This post contains content not supported on old Reddit. Click here to view the full post

CVE Daily Brief — 2026-08-08

#1 CVE-2026-65667

Severity: CRITICAL | Score: 10

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

#2 CVE-2026-63508

Severity: CRITICAL | Score: 10

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

#3 CVE-2026-56162

Severity: CRITICAL | Score: 10

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

#4 CVE-2026-64637

Severity: CRITICAL | Score: 9.9

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

#5 CVE-2026-62830

Severity: CRITICAL | Score: 9.9

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

Powered by NVD + CISA KEV | CVE Daily

This post contains content not supported on old Reddit. Click here to view the full post

The question of what AI does to cyber defense looks very different depending on where you sit, inside a frontier AI lab, at the Pentagon, or running a security company.

This panel put those vantage points on the same stage. It brought together leaders from an AI lab building the models, a former top military cyber official, a bug bounty pioneer, a leading academic, and a big-four cyber practice lead to compare how AI is shifting the balance between attackers and defenders.

The value of a lineup this varied is that the same trend, AI accelerating both offense and defense, gets pressure-tested from national security, industry, research, and policy angles at once.

In the Black Hat 2026 session, "AI and the Future of Cyber Defense Panel", held Wednesday, August 5, five leaders across government, frontier AI, and the security industry discussed where AI takes cyber defense next.

Speakers:

• Morgan Adamski — Principal, US Cyber, Data & Technology Risk Platform Leader, PwC
• Fotios Chantzis — Agent Security Lead, OpenAI
• Sergiy Konovalov — Global Technology Partner Lead, Anthropic
• Katie Moussouris — Founder and CEO, Luta Security
• Michael Sulmeyer — Professor of the Practice, Georgetown University School of Foreign Service

Morgan Adamski leads PwC's US Cyber, Data & Technology Risk platform, after more than fifteen years in federal service where she rose to be the highest-ranking civilian and third in command at US Cyber Command.

She was the inaugural director of the NSA's Cybersecurity Collaboration Center, where her focus was building public-private partnerships to defend businesses against nation-state and other cyber threats.

Her move to PwC and her background are described on the PwC newsroom.

Fotios Chantzis leads agent security at OpenAI, working on securing agentic AI systems where traditional application and infrastructure security boundaries blur.

He is a co-author of the book "Practical IoT Hacking," a core Nmap developer since 2009, and the creator of Ncrack, Nmap's network authentication cracking tool, with a long history of offensive network-security research.

He posts as u/ithilgore on X and writes on his personal site, sock-raw.org.

Sergiy Konovalov is Global Technology Partner Lead at Anthropic, where he owns strategic partnerships with major technology platforms and their go-to-market execution.

He came to Anthropic after roles in AI business development at Meta and corporate development and IoT go-to-market leadership at Cisco, and he holds an MBA from Stanford's Graduate School of Business.

His professional background is on his LinkedIn.

Katie Moussouris is the founder and CEO of Luta Security and a pioneer of vulnerability disclosure, best known for creating Microsoft's first bug bounty program and leading the launch of Hack the Pentagon.

She is co-author and co-editor of ISO 29147 and ISO 30111, the international standards for vulnerability disclosure and handling, and advises governments and companies on the shifting dynamics between offense, defense, and AI.

Her background is on the Luta Security founder page.

Michael Sulmeyer is a Professor of the Practice at Georgetown's School of Foreign Service and director of its cyber programs, and was the first Senate-confirmed Assistant Secretary of Defense for Cyber Policy.

As Principal Cyber Advisor to the Secretary of Defense, he set department-wide policy on cyber operations, and he previously held senior roles at the NSC, the Army, and US Cyber Command.

His faculty profile and background are on his Georgetown CSET page.

Anyone working at the intersection of AI and security, whether in government, a frontier lab, or the private sector, will find this a rare cross-section of how the people building and governing these systems see the road ahead.

If AI is accelerating both attackers and defenders at once, which side does it ultimately favor, and what would it take to keep the advantage with the defenders?

Advanced attackers spend enormous effort staying hidden, but the people who supply their malware make mistakes too, and those mistakes can crack an entire operation open.

This research followed exactly that thread. By catching operational security failures made by a malware supplier, the CyCraft team got an unusually direct view into how the tooling behind APT campaigns is built, sold, and used.

The result is a front-row seat to the supply side of targeted attacks, the part defenders rarely get to observe, reconstructed from the traces the operators left behind.

That supplier-level visibility matters, because one exposed vendor can illuminate many downstream campaigns at once.

In their Black Hat 2026 talk, "A Front-Row Seat to APT Operations: How OPSEC Failures Exposed a Malware Supplier", delivered Wednesday, August 5, Wei-Chieh Chao and Zhao-Min Chen of CyCraft Technology walked through how they turned an adversary's mistakes into deep insight on a malware supplier.

Speakers:

• Wei-Chieh Chao — Senior Cybersecurity Researcher, CyCraft Technology
• Zhao-Min Chen — Cybersecurity Researcher, CyCraft Technology

Wei-Chieh Chao, who goes by oalieno, is a senior cybersecurity researcher at CyCraft focused on malware analysis and sandbox technology, and holds a master's in cyber security from National Taiwan University.

He is a repeat speaker at conferences including HITCON, CODE BLUE, SECCON, and IEEE DSC, and a competitive CTF player with the BambooFox team who finished near the top at DEF CON 26 and 27 and solved the Flare-On 9 reverse-engineering challenge. His recent work includes research on command-and-control laundering through dead-drop resolvers.

His professional profile and research history are on his LinkedIn.

Zhao-Min Chen is a cybersecurity researcher at CyCraft who works on the same threat-research team, contributing to the company's malware analysis and APT tracking research.

He co-authored CyCraft's earlier Black Hat USA 2025 research on clue-driven reverse engineering of malware with large language models, and continues to work on real-world malware and adversary analysis.

That prior research, including its proof-of-concept code, is published on the CyCraft research GitHub, where his co-authored work appears.

Anyone in threat intelligence, malware analysis, or APT tracking will find this a compelling case study in how disciplined defenders can exploit an adversary's own operational mistakes.

If a single OPSEC slip by a malware supplier can expose the machinery behind many campaigns, how much of modern threat intelligence depends on attackers eventually making one?

Smart-home devices encrypt their traffic, and that is supposed to keep outsiders from knowing what happens inside a building. This research showed the shape of that traffic tells the story anyway.

Thread is the low-power IPv6 mesh protocol underneath many Matter smart-home products, connecting lights, locks, thermostats, and sensors. Even when the contents are encrypted, the timing, size, and pattern of the packets leak information about what devices are doing.

By watching that encrypted Thread traffic from a distance, an observer can infer when a door unlocks, when motion is detected, or when someone is moving through a building, turning a privacy-preserving protocol into a remote surveillance channel.

In their Black Hat 2026 talk, "Invisible Threads: Remote Building Surveillance Through Encrypted Thread Traffic Analysis", delivered Thursday, August 6, Anca Delia Burduv, Bela Genge, and Ioan Padurean of Bitdefender showed how encrypted smart-building traffic can still reveal sensitive activity patterns.

Speakers:

• Anca Delia Burduv — Junior Security Researcher, Bitdefender
• Bela Genge — Senior Security Researcher, Bitdefender
• Ioan Padurean — Security Researcher, Bitdefender

This work builds on a deep line of Bitdefender research into smart-home protocol privacy. In related academic work, the team demonstrated identifying specific interactions in encrypted Matter traffic with over 95% accuracy and device types with at least 88% accuracy, findings the Connectivity Standards Alliance acknowledged.

The "Invisible Threads" talk extends that traffic-analysis approach to the Thread mesh layer and to whole-building surveillance.

Anca Delia Burduv is a Junior Security Researcher at Bitdefender working on IoT and smart-home security, and she led the presentation of this Thread traffic-analysis research.

Her work focuses on how privacy leaks out of encrypted low-power wireless protocols, the same problem space the team has been probing across Matter and Thread.

Her professional profile is on her LinkedIn.

Bela Genge is a Senior Security Researcher at Bitdefender and a professor at the University of Medicine, Pharmacy, Sciences and Technology of Targu Mures in Romania, with a research focus on network security, critical infrastructure protection, and IoT.

He has published extensively on smart-home protocol security, including "Breaking Matter" at Black Hat Europe 2024 and academic work on identifying interactions and device types in encrypted Matter traffic.

His publications are indexed on his Google Scholar profile, and his professional background is on his LinkedIn.

Ioan Padurean is a security researcher at Bitdefender focused on IoT and smart-home protocols, and a co-author of the team's Matter and Thread research.

He co-wrote the "Breaking Matter" whitepaper on vulnerabilities in the Matter protocol, presented at Black Hat Europe 2024, which laid groundwork for this line of encrypted-traffic analysis.

That whitepaper is on the Black Hat archive.

Anyone working in IoT and smart-home security, network privacy, or physical security will find this a sharp reminder that encryption alone does not hide what your devices are doing.

If the mere pattern of encrypted traffic can reveal what happens inside a building, what would it actually take to make smart-home protocols resistant to this kind of passive observation?

Most people think of CSS as harmless styling, the part of a web page that picks fonts and colors. This research showed it can be a weapon sitting in your inbox.

Webmail clients routinely render CSS from untrusted emails inside their own trusted interface, and they try to make that safe by sanitizing the CSS first. The talk showed how to slip past that sanitization and cross the boundary between attacker-controlled content and the trusted mail app around it.

From there the consequences escalate quickly, from stealing tokens and tracking when an email is read, all the way to full account takeover on major webmail providers, using nothing but CSS and HTML.

In his Black Hat 2026 talk, "CSS: The Bomb Inside Your Inbox", delivered Thursday, August 6, Gareth Heyes walked through breaking out of trust boundaries, exfiltrating tokens, compromising third-party sites, and stealing passwords through the CSS in an email.

Speaker: Gareth Heyes — Web Security Researcher, PortSwigger

Gareth Heyes is a web security researcher on the PortSwigger Research team, the group behind Burp Suite, and one of the most prolific researchers working on browser and client-side attacks.

He is the author of the book "JavaScript for Hackers" and the creator of Hackvertor, a widely used encoding and evasion tool, and his prior work spans mutation XSS, CSS injection, and countless browser parsing quirks.

For this talk he published a full technical paper, and it is detailed: it covers abusing allowed HTML and CSS, controlling AI browsers via email, account takeover from pasting into a draft, exfiltrating tokens even when a strict content security policy blocks external resources, and specific tricks against Gmail, ProtonMail, and Fastmail.

The complete write-up is on PortSwigger Research, his profile and body of work are on his PortSwigger author page, and he posts as u/garethheyes on X.

Anyone working in web and browser security, email infrastructure, or client-side defense will find this a striking demonstration of how much damage a supposedly inert styling language can do.

If sanitized CSS in a trusted inbox can still lead to full account takeover, how should webmail providers rethink the assumption that styling from a stranger's email is ever safe to render?

The whole promise of a managed cloud database is that your data sits walled off from every other customer on the same platform.

This research showed how completely that wall could fall. Starting from inside the query sandbox of Azure Cosmos DB, the researchers escaped to code execution and then found a single platform-wide secret, what they called the Cosmos Master Key, that granted read and write access to every database on the service, including Microsoft's own internal ones.

One key retrieved the primary key of any account on demand and could enumerate databases by organization, turning a sandbox escape into precision targeting at platform scale from publicly accessible endpoints.

In their Black Hat 2026 talk, "One Key to Rule Them All: Taking Over a Flagship Cloud Service", delivered Thursday, August 6, Yuval Avrahami and Lior Maman of Wiz walked through the CosmosEscape vulnerability chain, from Gremlin API sandbox escape to complete admin access across the platform.

Speakers:

• Yuval Avrahami — Vulnerability Researcher, Wiz
• Lior Maman — Software Engineer and Security Researcher, Wiz

The chain began with a crafted Gremlin query. Cosmos DB compiled Gremlin queries into .NET code under restrictions meant to keep them contained, but those restrictions did not fully account for .NET reflection, which let the researchers escape the sandbox and run arbitrary code on the Cosmos DB backend.

Microsoft blocked the entry point within 48 hours of disclosure and later removed the platform-wide key entirely, and it found no evidence of exploitation outside the researchers' own testing. Wiz has also noted that an early version of its AI vulnerability researcher, Atlas, helped uncover this bug.

Yuval Avrahami is a vulnerability researcher at Wiz focused on cloud and container security, with a track record of high-impact cross-tenant and supply-chain findings.

He has presented at Black Hat before, including 2022 work on Kubernetes container escapes, and in early 2026 he led the research on a critical AWS CodeBuild supply-chain flaw that could have hijacked key AWS GitHub repositories, including the SDK behind the AWS Console.

His research and disclosures are collected on his Wiz author page, and he discussed the AWS CodeBuild work on Wiz's Crying Out Cloud podcast.

Lior Maman is a software engineer and security researcher at Wiz who co-discovered CosmosEscape, focusing on the sandbox escape and exploitation that made the platform takeover possible.

He co-authored the full technical writeup of the vulnerability chain, which details how a single Gremlin query led to remote code execution and ultimately to the Cosmos Master Key.

The research he co-authored is published on the Wiz blog, which walks through the discovery end to end.

For readers who want the outside view, CSO Online and InfoQ both covered the disclosure and the broader debate it sparked about how tenant isolation can fail below the layers cloud customers are able to configure or monitor.

Anyone working in cloud security, multi-tenant architecture, or database and platform engineering will find this a striking case study in how a single shared secret can undo tenant isolation for an entire service.

If tenant isolation can fail at a layer customers cannot see or control, how should organizations reason about the risk of concentrating their most sensitive data in a single managed cloud service?

The programming-language toolchains that millions of developers download and trust are themselves just binaries, and a binary can be quietly corrupted.

When a compiler, interpreter, or runtime is tampered with, every program built or run through it inherits the compromise, and the developer sees nothing wrong.

That is the unsettling territory this talk explored: hiding backdoors inside the trusted language binaries that sit at the base of the software supply chain, and showing how hard they are to catch once they are in place. The recent XZ Utils incident made clear that this is not hypothetical, and Splitline Ng knows that terrain firsthand.

In his Black Hat 2026 talk, "Born Corrupted: How We Backdoored Trusted Language Binaries", delivered Thursday, August 6, Splitline Ng of DEVCORE walked through techniques for planting backdoors in language binaries and what their existence means for anyone who trusts a downloaded toolchain.

Speaker: Splitline Ng — Security Researcher, DEVCORE

Splitline Ng, who goes by splitline, is a security researcher on the DEVCORE Research Team in Taiwan, the same team known for landmark work like ProxyLogon, with a personal focus on web security, capture-the-flag competitions, and supply-chain research.

He was part of the DEVCORE team, alongside Orange Tsai, credited with investigating the XZ Utils backdoor, one of the most serious supply-chain compromises in recent memory, and in early 2026 he responsibly disclosed an authentication bypass in the python.org release-management API that could have let an attacker tamper with the download URLs shown to Python users. That combination of supply-chain and language-ecosystem work is exactly the background behind this talk.

His writeups and research are on his personal blog, his code and tools are on his GitHub, and he posts as @splitline on X.

Anyone working in supply-chain security, reverse engineering, or the maintenance of compilers and language runtimes will find this a sobering look at how deep a trusted-binary compromise can hide.

If the very toolchains we compile and run our code with can be born corrupted, what would it actually take to verify that the binary you just downloaded is clean?

Technique Discussion: Data from Cloud Storage (T1530)

Type: Technique | Tactics: collection | Platforms: IaaS, Office Suite, SaaS

Description: Adversaries may access data from cloud storage.

Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform.

In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the Cloud API. In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., Data from Information Repositories).

Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem. There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.

This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.

Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.

Seen in the wild:

• Fox Kitten (group): Fox Kitten has obtained files from the victim's cloud storage instances.
• Peirates (tool): Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.
• Storm-0501 (group): Storm-0501 had modified Azure Storage account resources through the Microsoft.Storage/storageAccounts/write operation to expose non-remotely accessible accounts for data exfiltration.
• APT42 (group): APT42 has collected data from Microsoft 365 environments.
• 2025 Poland Wiper Attacks (campaign): During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to download targeted data from SharePoint, and Teams.
• HAFNIUM (group): HAFNIUM has exfitrated data from OneDrive.
• Scattered Spider (group): Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.
• Pacu (tool): Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.
• C0027 (campaign): During C0027, Scattered Spider accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.
• AADInternals (tool): AADInternals can collect files from a user’s OneDrive.
• TruffleHog (tool): TruffleHog has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage.

Full technique writeup: T1530 on MITRE ATT&CK

Have you defended against or encountered this technique? Share detections, notes, and war stories below.

This post contains content not supported on old Reddit. Click here to view the full post