Attacks & Vulnerabilities
|
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (2 minute read)
ROMULUS, a ClickFix delivery platform, was discovered using fake landing pages to make users run malicious commands. It was found to serve PowerShell staging scripts that deploy trojanized MSI installers or padded encrypted archives containing Legion Loader. Researchers found six IP addresses running the platform. One also hosted a ClickFix script linked to malicious ChatGPT Custom GPTs and Legion Loader, then retrieved further payloads.
|
BeyondTrust Remote Support 26.2.3 suffers auth bypass CVE-2026-102764 (4 minute read)
BeyondTrust Remote Support versions 26.2.3 and earlier are affected by CVE-2026-102764, a critical authentication bypass and arbitrary file upload vulnerability with a CVSS score of 9.3. CVE-2026-102764 lets unauthenticated attackers perform file operations, escalate to root, and access credential vaults. A suspected Chinese state-sponsored espionage group, Armory Castle (UNC5221), has actively exploited this zero-day flaw since late August to deploy custom webshells such as BARECLAW for persistence and lateral movement. BeyondTrust released security patches in October for self-hosted customers, prompting CISA and the Canadian Centre for Cyber Security to advise organizations to restrict external access to appliances and conduct forensic reviews for signs of compromise.
|
|
Inside Cairn: Open Windows into massive AI-Driven Cyber Operations (16 minute read)
NorForge found more than 20 publicly exposed Cairn panels used for malicious intrusion work. One Chinese-language cluster ran over 1,100 attack projects against e-commerce and payment systems in the US, Japan, Australia, and Canada, seeking unauthenticated RCE, file-upload webshells, SQL injection, and authentication bypasses. Another cluster targeted merchant payment, crypto, and pharmaceutical sites for card and cryptocurrency theft. The panels exposed targets, credentials, API keys, agent instructions, and successful compromises. Trufflehog found hundreds of secrets, with 11% verified valid. NorForge is notifying victims and seeking panel takedowns.
|
Package Manager Sandboxing (7 minute read)
Homebrew developer Andrew Nesbitt explains Homebrew 7.0's split fetch and install phases as well as the Landlock and Seatbelt-based sandboxes. Nesbitt then reviews the sandbox implementations, allowlist implementations, and sandbox proposals from other package managers. Some package managers like Go and Elm go a step further by fully removing code execution.
|
Lambda Web Functions: Public by Default, and Already in Your lambda:* Grants (5 minute read)
Lambda Web Functions are a new AWS feature that allow for running a Node.js HTTP server behind a managed HTTPS domain. By default, the functions run with no authentication, and role credentials are included as environment variables, which could potentially be leaked for the full duration of the execution environment. Existing roles that grant lambda:* permissions have access to web functions by default, existing SCPs may not cover them, and visibility tooling may also miss functions, leading to the potential for shadow Web Functions being created and going unnoticed.
|
|
MIND (Product Launch)
MIND is a data loss prevention platform that detects and blocks data exfiltration across email, endpoints, generative AI tools, and SaaS. It classifies content and context, then investigates events, tunes policies, and resolves issues.
|
Quicksand (GitHub Repo)
Quicksand is an async Python API for launching, controlling, and snapshotting QEMU virtual machines with a particular focus on sandboxing AI agents.
|
|
A hacker broke into John Deere and SharkNinja with an army of AI agents (2 minute read)
A hacker used autonomous agents on the open-source Cairn platform to breach more than 100 sites, reportedly including John Deere, SharkNinja, and Cummins. The attacker supplied intrusion tactics in under 100 Chinese characters. The breaches took about 23 hours. Norforge found over 20 likely malicious Cairn instances. John Deere said no sensitive data was accessed. SharkNinja contained the incident.
|
DHS to Ban DeepSeek From Federal Civilian Agencies (2 minute read)
The Department of Homeland Security announced a new ban on the procurement of products from DeepSeek. The directive cited national security concerns stemming from the potential for sensitive data to be stored or processed in China. Agencies will have 60 days to request exceptions to the policy.
|
Our latest defenses against evolving web scams (3 minute read)
Chrome's Enhanced Protection added ClickFix detection that scrubs PII from copied commands, sends them to Safe Browsing for analysis, and warns users when the verdict comes back dangerous. Google also moved its Gemini scam detection from on-device to a server-side model that scores page intent and brand impersonation, and it added a lower-confidence "suspicious site" warning tier beneath the familiar red interstitial. The company claimed Enhanced Protection users were ten times safer than Standard Protection users, a figure drawn from Google's own measurement.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments