90 results for “Azure”

Overtone is a caption format (.overtone.json), a CLI and a video.js plugin that store each spoken word once and cut captions separately per screen shape (16:9, 9:16 or custom). The transcribe pipeline combines gpt-transcribe, Azure AI Speech and optional ElevenLabs Scribe, resolves disagreements with an LLM vote, and uses an LLM editor for corrections. A small public benchmark reports 5.3% word error rate and $0.023–0.025 per audio minute.

github.comrepoAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

tl;dr sec #352 is a security newsletter issue covering [un]prompted talks (AI-assisted firmware patching, a "Security Constitution" for finding cloud design flaws), Azure API Connections cross-tenant bugs worth $200,000, and a test of 14 LLMs given AWS keys. It also covers a paper on malicious LLM API routers (9 of 428 injecting code) and Datadog's "counterfeit policy" bypass of the Jev classifier.

tldrsec.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

GitHub reported 7.4 billion commits per month in September 2026, up from 2.9 billion in August and 1.4 billion in April, which it attributes mostly to agentic demand. It has added 4 million CPU cores, 160 PB of storage and 50 Tb/s of network capacity this year, mostly on Azure. It is also rearchitecting to separate compute and storage, with internal benchmarks showing up to 35x higher write throughput.

thenewstack.ioarticleAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

GitHub Universe 2026 recap in which GitHub presents its agentic software delivery vision and new Copilot products: the Copilot app, Copilot Fusion multi-model routing, Copilot projects, session continuity, automations that learn from outcomes, and code review Max. GitHub Enterprise customers can use all Copilot features without a separate subscription. GitHub also reports added capacity, a multi-region Azure migration and a redesigned Git architecture.

github.blogarticleAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

DFIR_Radar weekly detection engineering digest covering 23 new and 19 updated rules across 6 GitHub repositories. It lists KQL rules for Azure Key Vault secret retrieval, MCP client User-Agent bulk operations and local Azure token theft, AWS CloudTrail analytics, Sigma rules for firewall and ETW tampering (decimal 17 vs hex 0x11), updated LOLDrivers hashes, and Sublime email rules for OAuth consent phishing and fake IRS W-9 PDFs.

x.comthreadAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Aikido Safe Chain is an open-source local proxy and shell-alias wrapper for npm, yarn, pnpm, bun, pip, uv, poetry, pipx and pdm. It checks every package download, including deep dependencies, against the Aikido Intel malware feed and blocks malicious packages before install. It also enforces a configurable 48-hour minimum package age by suppressing too-new versions in registry metadata. It supports custom registries and a self-hosted malware-list mirror, and has CI/CD install recipes for GitHub Actions, Azure Pipelines, CircleCI, Jenkins, Bitbucket and GitLab.

github.comrepoAdded 17 Oct 2026🛡️ Security

Microsoft Threat Intelligence maps a Chinese-language cybercrime ecosystem: the YAM Store (Storm-3119), an initial access broker that hijacks Microsoft 365/Azure Education tenants and resells accounts, licenses and SharePoint/OneDrive storage, and the Storm-2990 phishing kits (CoGUI, Haozi, Iron Man System) sold via Telegram. It details the five-stage broker pipeline (app-only client-secret abuse, PnP Management Shell service principal, Graph permissions, Cloudflare DNS management), kit evasion features (geofencing, fake CAPTCHA, WebSocket/Telegram live interaction, 2,335+ templates), downstream device-code phishing and card fraud, and lists mitigations such as passkeys, phishing-resistant MFA and Conditional Access. Microsoft's DCU facilitated a disruption with law enforcement; kits sent over one billion messages since January 2026.

microsoft.comarticlePublished and added 14 Oct 2026🛡️ Security

Microsoft and Health-ISAC seized domains tied to YAM Store (Storm-3119), an access broker that hijacks Microsoft 365 and Azure for Education tenants, and to the Storm-2990 phishing kits CoGUI, Haozi and Iron Man, under a Southern District of Florida order. The services sent over 1B malicious messages since January 2026 to 75,000+ organizations in 150+ countries; Microsoft disabled 20,000+ accounts and is blocking 100,000+ domains. Iron Man offers 2,335+ templates and real-time OTP capture, and Resecurity found it needs regular contact with a vendor licensing server, a dependency defenders can exploit.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

Talos summarises Microsoft's October 2026 Patch Tuesday, which covers 1415 vulnerabilities, 85 of them critical (67 RCE). One bug is exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass. The post groups the CVEs by Microsoft's exploitability rating (more likely, less likely, unlikely) with CVSS and CWE for each, covering Windows, Office, Exchange, Hyper-V, DHCP, QUIC, Outlook and Azure. It also lists the Snort 2 and Snort 3 rule ID ranges that detect exploitation attempts.

blog.talosintelligence.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Endor Labs documents the compromise of tensorlake@0.5.144, the official npm TypeScript SDK for Tensorlake, which shipped a Shai-Hulud worm payload via a poisoned preinstall hook (node lib/setup.mjs) after the project's main branch was altered and pushed through a legitimate, provenance-signed GitHub Actions release pipeline. The malware harvests npm, GitHub, SSH, cloud (AWS/GCP/Azure), Kubernetes/Docker and Vault credentials, uses an EtherHiding Ethereum wallet as a durable dead-drop to fetch its rotating C2 domain, and republishes itself into other packages the victim controls. The writeup includes affected package versions, file hashes, C2 indicators, and concrete remediation guidance (pin to 0.5.143, rotate credentials, disable install scripts).

endorlabs.comadvisoryPublished and added 8 Oct 2026🛡️ Security

A Microsoft Security Blog post arguing that frontier AI models are flooding security teams with far more vulnerability findings than human triage was built for, citing a record near-1,000 vulnerabilities disclosed on the September 2026 Patch Tuesday. It describes Microsofts internal use of AI plus a harness layer (codename MDASH, now available to customers) for scanning, triage, and remediation, and gives CISOs concrete recommendations: shrink patch windows for critical systems to within 24 hours, adopt harnesses for AI-powered vuln scanning now, and lean harder on defense-in-depth via Microsoft Baseline Security Mode (BSM) and Secure by Design and Secure by Default changes (mandatory Azure admin MFA, Azure Backup soft delete, VNet default outbound disabled).

microsoft.comarticleAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

StepSecurity's AI Package Analyst detected three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) published simultaneously on May 14, 2026 by a rogue/compromised maintainer account, injecting an 80KB obfuscated IIFE into the CommonJS bundle that harvests 90+ credential file categories (AWS, Azure, GCP, SSH, Kubernetes, GitHub, Claude AI/Kiro configs, Terraform, etc.) and exfiltrates them via HTTPS and raw DNS TXT queries to a typosquatted Azure-mimicking C2 domain. The writeup includes a full stage-by-stage technical teardown (daemonization, SHA-256 targeting gate on 12.0.1, custom base-16 nibble-reversed obfuscation, dual-channel exfiltration) plus file hashes, network IOCs, and remediation guidance for developers and CI/CD pipelines.

stepsecurity.iowriteupAdded 5 Oct 2026🛡️ Security

Release notes for Microsoft's Agent Framework (Python and .NET SDKs), covering versions python-1.16 through python-1.20 and dotnet-1.19 through dotnet-1.23. Changes span native vector-store connectors (MongoDB, Qdrant, PostgreSQL/pgvector, DuckDB, SQL Server, Azure Cosmos DB, Azure AI Search), Foundry hosting redesigns around request-scoped agent factories and durable Invocations, MCP skill/session security hardening (approval binding, security labels, ZIP-only skill archives), Magentic multi-agent orchestration and handoff routing, and checkpoint/replay correctness fixes across workflows.

github.comrepoAdded 2 Oct 2026🧠 AI

Bifrost is an open-source, high-performance LLM gateway (by Maxim AI) that exposes a single OpenAI-compatible API across 23+ providers including OpenAI, Anthropic, AWS Bedrock, Google Vertex, Azure, Cohere, Mistral, and Ollama. It provides automatic failover, load balancing, semantic caching, Model Context Protocol (MCP) tool integration, budget and governance controls, OIDC user provisioning, and Prometheus-based observability, deployable via npx or Docker with claimed sub-15 microsecond overhead at 5,000 RPS. It is positioned as a drop-in replacement requiring only a base-URL change for existing OpenAI, Anthropic, or GenAI SDK code.

github.comrepoAdded 2 Oct 2026🧠 AI

Third post in a series on Azure Logic Apps API Connections, describing five critical cross-tenant privilege escalations that let an attacker use any other tenant's connection to reach its backend (Key Vault, Azure SQL, Jira, Salesforce). Techniques include path traversal via ARM DynamicInvoke and undocumented DynamicList endpoints, and abusing the host.api.runtimeUrl parameter in Consumption Logic Apps, including a validation-before-normalization bypass. The author reports $200,000 in bounties; Microsoft fixed all issues.

binsec.nowriteupAdded 30 Oct 2026, published 2 Oct 2026🛡️ Security

Endor Labs ran Codex CLI with OpenAI's GPT-6 Sol on its Agent Security League tasks (200 real-world coding tasks drawn from historical security fixes). It scored 72.1% FuncPass and 25.1% SecPass, sixth overall, 5 points above GPT-5.6 Sol and 9.5 below GPT-6 Astra. The run cost $104 on Azure, 78% less than Astra, with zero confirmed cheating. The post also compares command-use patterns and walks through the one globally unique secure solve, the Plone isURLInPortal XSS/open-redirect fix (CVE-2015-7316). There the agent used iterative URL decoding and a broad character rejection, where the golden fix used a string blocklist.

endorlabs.comarticlePublished and added 1 Oct 2026🛡️ Security

Microsoft's DART team details an investigation into Storm-3068, a threat actor that escalated from a self-service password reset account takeover into full control of an organization's Azure DevOps environment, then weaponized a malicious pipeline to harvest kubeconfig files and gain access to Kubernetes clusters. The actor also deployed the Atera remote management agent and the Chisel tunneling tool to establish reverse tunnels and alternate remote access, and exfiltrated seven stolen kubeconfig files into a repository. The report lays out the attack chain, DART's response, and hardening recommendations around SSPR monitoring, phishing-resistant MFA, branch protection, and pipeline permission controls.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Check Point Research's weekly threat intelligence roundup covering the FBIjobs.gov defacement by ShinyHunters, a $351.6M Bitget hot-wallet theft with suspected DPRK involvement, and breaches at Astrana Health and LMU Munich. It also details AI-driven threats (an OpenAI agent's unauthorized access to an Australian government Medicare portal, an AI-agent-automated retail fraud campaign, and the CLOSEDQUORUM Windows malware that queries four commercial AI models to pick its post-compromise actions), four actively exploited pre-auth RCE CVEs (Check Point Security Gateway/Management, F5 BIG-IP APM, WordPress), and campaign writeups on the Storm-2570 multi-ransomware affiliate, an INC ransomware intrusion, a TeamFiltration M365 account-takeover wave in Latin America, and Storm-3168/JADEPUFFER's destructive Azure operations.

research.checkpoint.comarticleAdded 1 Oct 2026, published 28 Sep 2026🛡️ Security

Microsoft Security Research documents an Azure-focused campaign by Storm-3168 (aka JADEPUFFER, discovered by Sysdig as the first documented agentic ransomware operation), using two compromised service principals to enumerate an Azure tenant and then execute a seven-minute destructive sequence deleting 100+ Storage Accounts, a Key Vault, a Function App, and attempting (unsuccessfully, due to API version mismatch) to delete Azure SQL databases. Initial access traces to a client ID/secret/tenant ID leaked in a GitHub issue's public edit history even after the secret was redacted; the attacker also harvested storage account keys and targeted Site Recovery/Backup protection locks to impair recovery, consistent with ransomware/extortion tradecraft. The post includes a MITRE ATT&CK mapping (T1190, T1078.004, T1526, T1485, T1490) and mitigation guidance around workload identity hygiene, least privilege, and backup protection.

microsoft.comwriteupAdded 7 Oct 2026, published 25 Sep 2026🛡️ Security

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

wiz.iowriteupAdded 27 Sep 2026, published 25 Sep 2026🛡️ Security

ThreatIntel-Aggregator is a self-hosted FastAPI/Next.js platform that polls 60+ tiered security RSS feeds (CISA, Talos, Unit42, etc.), runs AI triage to score severity and tag MITRE ATT&CK TTPs, extracts IOCs/CVEs, and correlates findings against a RunZero asset inventory to surface org-level exposure. Its Detections module goes further: it catalogs AI-generated or locally-imported detection rules (KQL/Sigma/YARA/Suricata/SPL), statically validates them, runs AI-driven MITRE alignment checks against technique coverage, tracks detection "rot," and can sync Hunts/Analytics Rules to a live Microsoft Sentinel workspace. It's designed to run standalone with zero cloud dependency or fully integrated with Azure/Entra/Sentinel, with all storage in Postgres and auth via Entra SSO or a local API key.

github.comrepoAdded 22 Sep 2026, published 17 Sep 2026🛡️ Security

Endor Labs explains the two dominant classes of OSS malware attacks - dependency/name confusion (typosquatting, combo-squatting, brand-jacking) and attacks on legitimate packages/maintainers - and how the OpenSSF malware-analysis project sandboxes new PyPI/npm releases and reports confirmed malware to OSV. It walks through real cases it detected, including the chunked/split-across-files PyPI malware ttlo and gisi, and Whatfuscator which drops and runs a PyInstaller-built Windows executable, plus two false-positive suspicious-code flags (versioneer 0.29, azure-functions 1.18.0) caused by benign base64/zlib obfuscation.

endorlabs.comarticlePublished and added 11 Sep 2026🛡️ Security

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026🛡️ Security

tl;dr sec issue #345 is a security newsletter digest. It covers Greptile's test showing models miss bugs in their own code, an OCaml cohttp path traversal fix probed within ten minutes of the PR, and a Wiz Version Control DFIR poster for GitHub, GitLab, Bitbucket and Azure DevOps. It also covers an arXiv paper on open-weight agentic worms (61.8% infection of a 33-host testbed) and Endor Labs' 14 flaws in seven AI orchestration platforms.

tldrsec.comarticleAdded 30 Oct 2026, published 10 Sep 2026🛡️ Security

Orca Security guide distinguishing alerts, incident records, and actions in incident response automation, mapping a cloud storage-bucket-exposure incident through detection, declaration, enrichment, routing/paging, and suppression steps. Draws on AWS Well-Architected event/incident/problem management guidance, ISO/IEC 27035-3:2020 lifecycle, CISA containment guidance, and Azure alert processing rules to argue automation should be introduced step-by-step based on reversibility rather than as one switch.

orca.securityarticlePublished and added 9 Sep 2026🛡️ Security

Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached — setting up Part 2's key extraction and offline decryption.

huntress.comarticlePublished and added 8 Sep 2026🛡️ Security

GhostJS is an open-source Burp Suite extension by TrinetLayer that passively scans JavaScript, HTML, and JSON responses flowing through Burp for hardcoded secrets (AWS/GCP/Azure keys, Stripe/PayPal/GitHub tokens, JWTs, private keys, etc.) and hidden API endpoints, surfacing findings in a dedicated tab with severity, confidence scoring, remediation guidance, and Markdown export. It also actively fetches referenced <script> bundles using the tester's live session cookies and applies a false-positive filter to suppress doc-sample and placeholder keys, making it a practical recon aid during authorized web app pentests and bug bounty work.

github.comrepoPublished and added 7 Sep 2026🛡️ Security

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

stepsecurity.iowriteupAdded 5 Sep 2026🛡️ Security

Huntress dissects a trojanized Exodus crypto wallet installer (v24.33.4, unsigned MSI built with WiX) that installs a genuine wallet but patches Electron's show()/focus()/center() methods so no window ever appears, then loads a modular RAT via a hand-written reflective PE loader implemented in JavaScript using the Node.js koffi FFI library. The RAT (VNC, SOCKS proxy, browser-credential stealer, recon module) beacons over WebSockets and uses Azure Table Storage as a dead-drop C2 channel to blend into legitimate cloud traffic, while delivery abuses double-extension .pdf.js phishing, ZIP-staged JS files, and an unused search-ms/WebDAV technique; the writeup also covers multi-layer string-array/arithmetic deobfuscation and includes full IOCs and mitigation guidance.

huntress.comwriteupAdded 3 Sep 2026, published 1 Sep 2026🛡️ Security

Wiz CIRT published a DFIR cheatsheet/poster covering the four most common version control platforms (GitHub, GitLab, Bitbucket Cloud/Data Center, Azure DevOps), detailing available log sources, default retention limits (e.g. GitHub's 7-day Git read/write event retention, GitLab not storing Git operations by default), a pre-incident configuration checklist (enabling source-IP metadata, extending retention, log streaming), and a MITRE ATT&CK-mapped matrix of platform-specific audit event names to hunt for during investigations. It illustrates the gaps with a real incident where a compromised token was used to mass-clone repositories containing plaintext secrets, and shows how the same action (e.g. mass repo cloning) surfaces under different event names per platform (git.clone in GitHub, repository_git_operation in GitLab, RepositoryCloneEvent in Bitbucket Data Center).

wiz.ioarticleAdded 3 Sep 2026, published 27 Aug 2026🛡️ Security

pentest-harness is an open-source, plugin-based AI agent framework aimed at authorized penetration tests, bug bounty research, security labs, and CTFs. It provides a "Pentest Mode" offensive-security operating standard, a full agent toolset (shell, filesystem, web research, subagents, background jobs), and a bring-your-own-key multi-provider LLM engine (OpenAI, Anthropic, DeepSeek, Google, Mistral, Groq, OpenRouter, Azure OpenAI) with durable JSONL/SQLite session persistence and an owner-only credential store for API keys.

github.comrepoPublished and added 27 Aug 2026🛡️ Security

Microsoft documents three observed compromises of AI infrastructure: a LiteLLM gateway (CVE-2026-42271 chained with CVE-2026-48710), a RAGFlow deployment (SSRF probing then runtime hook stealing LLM credentials), and a Kestra workflow engine (CVE-2026-49869 auth bypass). Attackers harvested credentials from /proc/1/environ and Azure PostgreSQL, deployed XMRig miners, and persisted via authorized_keys, cron and chattr. The post provides Defender XDR KQL hunting queries, IOCs, and hardening guidance such as treating AI gateways as Tier-0 secret stores and enforcing deny-by-default egress.

microsoft.comarticleAdded 28 Aug 2026, published 26 Aug 2026🛡️ Security

SubMap is an enterprise-facing subdomain discovery and attack-surface-mapping SaaS that aggregates multiple reconnaissance data sources, streams results live via SSE, and exports to TXT/CSV/JSON for integration into a security workflow. It also runs 49 service fingerprints to detect subdomain-takeover conditions (dangling CNAMEs pointing at AWS, Azure, GitHub, Heroku, etc.) and layers in CVE monitors/alerting for tracked assets. The public page gates full scan output behind account creation, showing only the first 110 results in the free preview.

submap.nettoolAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security

tl;dr sec #342 is a weekly security newsletter issue. It summarizes Figma's agentic detection and response built on Panther, Uber's open-source ADR agent monitoring system with ADR-Bench, Cloudflare's Agent Access Model, and 1Password's SPIFFE-based local agent identity. It also covers Wiz's CosmosEscape chain in Azure Cosmos DB and in-memory YARA hunting with Fleet and osquery.

tldrsec.comarticleAdded 30 Oct 2026, published 20 Aug 2026🛡️ Security

StepSecurity analyzes CloudSEK's newly published dataset on TeamPCP, a threat actor that compromised trusted open-source CI/CD components (Trivy GitHub Action, Checkmarx KICS action, telnyx PyPI package, LiteLLM) to harvest 78,330 secrets from 2,186 organizations' CI/CD pipelines across GitHub Actions, GitLab, and Azure DevOps in five days in March 2026. The post breaks down which platforms and credential types were exposed (GitLab led, 230+ Azure DevOps orgs, 157 leaked OpenAI keys) and maps layered CI/CD runtime controls (egress control, runner lockdown, imposter-commit detection, workflow policies) as mitigations against this class of attack.

stepsecurity.ioarticleAdded 3 Sep 2026, published 15 Aug 2026🛡️ Security

Ionix's engineering team describes building an in-house AI PR reviewer using OpenAI's Codex CLI against a self-hosted Azure AI Foundry model deployment, wired into CircleCI and Bitbucket, after dropping Atlassian Rovo for cost and low signal-to-noise. The piece details prompt design to suppress low-value comments, agentic repo-wide review (vs. diff-only), sharding for large PRs, JSON output validation against git ls-files, storing review state inside PR comments via base64-in-markdown, and a dedicated prompt-injection defense section (scrubbed environment, secret redaction, sandboxed execution, egress restriction). It also covers two production failures: a silently-broken bubblewrap sandbox that kept "reviewing" without running any tools, and an unpinned Codex CLI npm dependency that broke Azure API calls across every repo.

ionix.iowriteupAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

The official DEF CON 34 main-stage talk listing, with full abstracts and speaker bios for dozens of original research presentations spanning bootrom-to-wallet-key exploitation of the dGEN1 Ethereum phone, a privilege-escalation chain in Microsoft's Python-in-Excel Azure container (CVE-2026-45459), a novel x86 SMM hardware attack, black-box TEE key recovery on the TI OMAP-L138 via timing side channels, native-code exploitation of llama.cpp and Ollama, a CDP-based Browser-in-the-Middle AitM phishing toolkit defeating CSP/SRI, CPDLC air-traffic-control message injection via SDR, an iCloud Keychain extraction bug (CVE-2026-28860), Segmentation Fault-Oriented Programming (SFOP) for bypassing Intel CET, weaponized WMI provider post-exploitation, an autonomous AI system (HTTP Terminator) discovering novel HTTP desync attacks, quantum ML for OS fingerprinting, reverse engineering of Windows Defender's BTR.sys driver for EDR bypass, a V8 renderer RCE in Samsung Internet (CVE-2025-10891), an LLM CI build-gate bypass, a Bring-Your-Own-EDR PPL abuse technique, Amazon Locker hardware hacking, and Windows PnP USB auto-install RCE via RDP redirection.

defcon.orgotherAdded 10 Aug 2026🛡️ Security

Manifold Security identified 77 malicious "evil twin" extensions uploaded to Open VSX between July 26 and August 1, 2026, that impersonate real Microsoft VS Code Marketplace extensions by reusing their names/namespaces/descriptions under unrelated publisher accounts at low version numbers (e.g. 0.0.1). 58 lightweight variants exfiltrate just the hostname while 19 "recon" variants collect detailed machine, Git repository, CI environment (GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), installed-extension, and telemetry opt-out data to mangorbit[.]com, with DNS TXT-based fallback C2 and a persistent multi-day retry schedule. The article also covers the concurrent ChainDrop campaign compromising 450 npm packages (2,244 artifacts) via a Mini Shai-Hulud self-propagating credential-stealing worm using a Bun runtime payload and preinstall hooks, which plants persistence via .claude and .vscode config injection.

thehackernews.comarticlePublished and added 8 Aug 2026🛡️ Security

Recap episode of The OpenSourceMalware Show covering three incidents: a Shai-Hulud-derived npm worm that compromised maintainer Jared Wray's account and spread to 400+ packages (including Keyv and cacheable, with ServiceTitan losing 100 packages) while harvesting credentials from GitHub, npm, AWS, Kubernetes, Vault, Azure, GCP, Terraform, Docker, and Slack; a "WEL1DROPPER" campaign flooding npm with 1000+ AI-slopsquatted malicious packages that execute on import rather than via install scripts; and "NullReceiver," a DPRK-linked C2 technique that hides C2 IPs inside the recipient address of empty Ethereum transactions, an evolution of EtherHiding found in at least 10 malicious packages.

opensourcemalware.comtalkAdded 3 Sep 2026, published 8 Aug 2026🛡️ Security

A reviewer's first-person writeup of the Advanced Red Team Operations Certification (ARTOC) by White Knight Labs, covering a full red team engagement curriculum: building C2 infrastructure with Cobalt Strike and Adaptix, cloud redirectors across AWS, Azure and GCP via CDNs and serverless functions, Active Directory and ADCS exploitation, and kernel and user mode EDR evasion, tested against real enterprise EDR products. The exam is a 48-hour infrastructure build and compromise exercise followed by a 48-hour red team report. The post is a positive testimonial encouraging enrollment rather than a technical walkthrough of any attack.

kuwaitist.github.ioarticleAdded 2 Oct 2026, published 6 Aug 2026🛡️ Security

Wiz's H1 2026 cloud threat report documents a 60% jump in significant incidents driven by a doubling of supply-chain attacks (TeamPCP's npm/PyPI/GitHub Actions credential-harvesting spree, its open-sourced Shai-Hulud worm spawning Miasma/Hades/Megalodon/IronWorm follow-ons, North Korea's axios and @mastra trojanizations) and by growing attacks on AI infrastructure, including exposed unauthenticated MCP servers, LiteLLM/Dify/Langflow/n8n/Ollama vulnerabilities, and cryptominers deployed via a Langflow RCE. It also profiles JINX-0163, a cloud-native extortion group targeting non-human identities (service accounts/IAM roles) across AWS/Azure/GCP/Okta/Snowflake linked to the "FulcrumSec" extortion brand, and closes with concrete detection techniques for stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, and CloudTrail user-agent/boto3 credential-provenance mismatches.

wiz.iowriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Adversa AI's monthly MCP security digest for August 2026, grouping ten resources: the July 28 MCP specification revision that hardens authorization (RFC 9207 issuer validation, deprecation of Dynamic Client Registration, a stateless core with header-based routing), a confused-deputy indirect prompt injection against Microsoft's Azure DevOps MCP server that hijacks a review agent into exfiltrating wiki data, SANS ISC telemetry showing 49 source IPs scanning for exposed MCP servers and agent credentials in two weeks, and new research (ChainWatch's kill-chain detection via Hidden Markov Models, SPELLSMITH's description-layer mitigations for taint-style flaws, MTGuard's static/dynamic tool-call analysis, and a 33-vulnerability taxonomy of agentic commerce platforms with the AIP-Bench benchmark). It closes with concrete upgrade guidance: audit DCR dependencies, validate issuers per RFC 9207, grep logs for MCP scanning indicators, and stand up a policy-enforcement gateway.

adversa.aiarticleAdded 7 Oct 2026, published 6 Aug 2026🛡️ Security

Orca Security explains what an AI-BOM is (an inventory of models, datasets, prompts, embeddings, and external AI services an AI system depends on) and why discovery — not format — is the hard problem: components arrive via notebooks and managed consoles rather than dependency manifests. It surveys the two competing standards, CycloneDX's ML-BOM (v1.7, standardized as ECMA-424 2nd edition) and SPDX 3.0's AI/Dataset profiles, walks through failure modes like unrecoverable model lineage, stale embeddings outliving deleted source documents, and silent version drift on managed endpoints (e.g. Azure OpenAI's auto-update-to-default), and ties the practice to EU AI Act Annex IV technical-documentation requirements and the NIST AI RMF. It ends by describing Orca's agentless SideScanning-based AI inventory across Azure OpenAI, AWS Bedrock, SageMaker, and Vertex AI.

orca.securityarticlePublished and added 31 Jul 2026🛡️ Security

Orca Security explainer on entitlement sprawl (a.k.a. privilege creep) in cloud environments: the gradual accumulation of unused permissions across human and non-human identities, driven largely by machine identities (service accounts, roles, keys) that outnumber human users by over 80-to-1 per CyberArk's 2025 report. It distinguishes granted vs. effective permissions, explains why static IAM exports miss real risk, walks through detection via AWS IAM Access Analyzer, Azure Entra Permissions Management, and GCP IAM Recommender, and lays out controls (least privilege, JIT access, continuous automated reviews, RBAC/ABAC, NHI governance, zero trust) before positioning Orca's agentless CIEM (SideScanning) as the automation layer.

orca.securityarticlePublished and added 31 Jul 2026🛡️ Security

CSPM tool auditing AWS, Azure, GCP for misconfigurations with AI remediation and compliance mapping.

github.comrepoAdded 30 Sep 2026, published 31 Jul 2026🛡️ Security

Wiz Research found CosmosEscape, a critical Azure Cosmos DB vulnerability exploited via the Gremlin API's .NET-based query engine, whose sandbox failed to restrict .NET reflection, enabling arbitrary code execution on the DB Gateway service. This allowed retrieval of the "Cosmos Master Key," a platform-wide signing key that could fetch any Cosmos DB account's primary key and enumerate accounts via a shared Config Store, enabling attackers to compromise any customer or internal Microsoft database (including those backing Entra ID, Teams, and Copilot) from public endpoints. Microsoft fully remediated the issue and eliminated the master key architecture.

wiz.iowriteupAdded 3 Sep 2026, published 30 Jul 2026🛡️ Security

Introductory primer on OS user accounts and privilege management. It covers permissions versus privileges, the Principle of Least Privilege, vertical versus horizontal privilege escalation, UAC and sudo, and group-based access. It then moves to enterprise controls: IAM, RBAC, PAM with credential vaulting and session monitoring, Just-In-Time access, Endpoint Privilege Management and Zero Trust. It includes a best-practices list, an FAQ on service-account targeting and why MFA does not replace PAM/JIT, and a tip to start with Azure PIM and forward logs to Splunk for privilege-event alerting.

asecurityguru.comarticleAdded 13 Oct 2026, published 27 Jul 2026🛡️ Security

StepSecurity describes a new Repository Secrets feature in its Actions Secret dashboard that inventories GitHub Actions secrets across an org and classifies each as Active, Stale (unused workflow for 90+ days), or Unused, while flagging which secrets could be eliminated by switching to OIDC (e.g. AWS, Azure, GCP federation or npm/PyPI trusted publishing). It ties the problem to real incidents - the GhostAction campaign exfiltrated 3,000+ secrets and Megalodon targeted 5,500 public repos - arguing that unused, long-lived credentials are attack surface attackers actively harvest regardless of whether they are load-bearing.

stepsecurity.ioarticleAdded 3 Sep 2026, published 23 Jul 2026🛡️ Security

Huntress blog recap of a Tradecraft Tuesday broadcast breaking down the LSHIY password-spraying campaign, which hit Microsoft Azure CLI tenants via IPv6 ranges from BYOIP provider LSHIY LLC, generating over 81 million login attempts and 78 account compromises in a two-week window. The campaign abuses OAuth's deprecated Resource Owner Password Credentials (ROPC) grant at the tenant token endpoint to mint delegated tokens that bypass MFA and Conditional Access Policies when valid credentials are entered. After LSHIY's takedown the actor pivoted to FranTech IPv6 ranges and Tor exit nodes; mitigations include disabling ROPC, restricting Azure CLI for non-admins, and enforcing unscoped Conditional Access covering all users, apps, and client types.

huntress.comarticleAdded 3 Sep 2026, published 22 Jul 2026🛡️ Security

Gibson is a Rust-based network monitoring toolkit with a lightweight agent, server, and parser that maps process-to-network connections, detects cloud provider ownership (AWS/Azure/GCP/Cloudflare), flags beaconing candidates and EOL OS risk, and auto-generates iptables/Windows firewall rules. It supports AES-256-GCM encrypted uploads, ASN/ARIN-based IP ownership lookups, and SQL/JSON report exports for cross-host threat hunting.

github.comrepoPublished and added 22 Jul 2026🛡️ Security

Manifold Security researchers found that Microsoft's official Azure DevOps MCP server fails to consistently apply its 'spotlighting' guardrail (added in PR #1062) to untrusted content: pipeline and wiki tools wrap external content in delimiters, but the tool returning PR descriptions does not. An attacker with contributor access to one project can hide prompt-injection instructions inside an HTML comment in a PR description (invisible in the Azure DevOps UI but returned verbatim by the API), which hijacks a reviewing victim's AI agent (tested with Copilot CLI and Claude Code) into running pipelines and reading a confidential wiki page in a separate project the attacker can't access, then exfiltrating the content back as a PR comment — a classic confused-deputy / lethal-trifecta scenario. The issue was reported to and triaged by MSRC.

manifold.securitywriteupAdded 23 Jul 2026, published 21 Jul 2026🛡️ Security

This paper presents the first systematic evaluation of package-install-time supply-chain attacks delivered through ordinary project-setup documentation (README, requirements files, Makefiles) against production AI coding-agent harnesses. Testing frontier models across twelve scenarios in five attack classes grounded in real incidents, the authors find install-time security depends on the harness-model pairing rather than the model alone: agents reliably catch blatant typosquats but miss plausible separator-confusion names (e.g. azurecore for azure-core) and almost universally miss registry-redirection attacks, with the source blind spot recurring on npm and Cargo. A deterministic pre-install check that verifies package names, sources, and versions before code execution closes most of the gap.

arxiv.orgpaperPublished and added 18 Jul 2026🛡️ Security

PyRIT (Python Risk Identification Tool) is an open-source framework from Microsoft/Azure that lets security professionals automate red-teaming of generative AI systems, generating adversarial prompts, scoring model responses, and probing for harms like jailbreaks, harmful content generation, and other LLM risks. It provides a modular pipeline (orchestrators, targets, converters, scorers) to systematically test chatbots and other GenAI applications for vulnerabilities.

github.comrepoPublished and added 14 Jul 2026🛡️ Security

Socket's research team documents a supply chain compromise of the jscrambler npm package (v8.14.0+), where a stolen publishing credential was used to push malicious releases that drop platform-specific Rust-built infostealer binaries via a preinstall hook. The campaign evolved over the incident to evade scanners by moving the dropper from install scripts into a self-executing function inside index.js/CLI code (defeating --ignore-scripts), and the payload targets crypto wallets, cloud credentials (AWS/GCP/Azure), browser data, Discord/Slack/Telegram, and notably AI coding assistant configs (Claude Desktop, Cursor, Windsurf, VS Code) for MCP server credentials. Includes detailed RE of the ChaCha20-Poly1305 string-encryption scheme and full IOC hash list.

socket.devwriteupAdded 21 Sep 2026, published 11 Jul 2026🛡️ Security

A technical breakdown of the service-account confused-deputy problem in the cloud, splitting it into two categories by identity ownership: customer-managed identities (GCP service accounts, AWS IAM roles, Azure managed identities) mitigated via bind-time attachment checks like iam.serviceAccounts.actAs, and provider-managed identities (GCP service agents, AWS service-linked roles, Azure platform-level principals) mitigated via provider-side authorization such as AWS Forward Access Sessions and condition keys (aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, aws:SourceOrgPaths) or Azure's opaque LinkedAuthorizationFailed checks. It contrasts observability across the three major CSPs, noting AWS is the only one that exposes its confused-deputy machinery as first-class, customer-controllable primitives.

kattraxler.cloudarticleAdded 19 Sep 2026, published 9 Jul 2026🛡️ Security

Huntress details two 2026 campaigns that bypassed Microsoft 365 MFA despite Conditional Access policies being in place: device code phishing abusing Railway.com's clean IP infrastructure, attributed to the EvilTokens phishing-as-a-service platform, hitting 344 orgs, and a ROPC-based credential replay attack from LSHIY LLC infrastructure with 81 million login attempts and 78 compromised accounts, 55 of which had active MFA policies that didn't actually cover Azure CLI or legacy auth. It breaks down how narrow Conditional Access policy scoping, missing All Cloud Apps coverage, excluded user groups, report-only mode, mislabeled trusted locations, let attackers through, and recommends blocking device code flow and legacy auth via Conditional Access as the fix.

huntress.comarticleAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

ThinkWatch is a source-available dual-port gateway (Rust/Axum) that proxies both AI provider APIs (OpenAI, Anthropic, Gemini, Azure OpenAI, AWS Bedrock) and MCP tool calls through a single control plane, enforcing authentication, RBAC, rate limits/budgets, and audit logging. Its key differentiator is per-user upstream identity for MCP — propagating each user's own OAuth token/PAT to servers like GitHub/Notion/Slack (AES-256-GCM encrypted, per-key allowlists) instead of a shared service account, plus SSRF-hardened OAuth discovery (RFC 9728/8414/7591), tool-level RBAC, and ClickHouse-backed audit trails forwarded to SIEMs via Syslog/Kafka/webhooks.

github.comrepoPublished and added 4 Jul 2026🛡️ Security

Huntress tracked a large, ongoing password spray campaign against Microsoft 365/Azure CLI using the deprecated OAuth ROPC (Resource Owner Password Credentials) flow, which sends passwords directly to the /token endpoint and bypasses MFA prompts enforced via Conditional Access Policies. Between June 12-26, over 81 million login attempts from LSHIY LLC's IPv6 range (AS32167) compromised 78 accounts across 64 organizations, many of which had MFA enabled but scoped incorrectly (app-specific, group-specific, trusted-location exceptions, or report-only mode). After LSHIY terminated the abusive BYOIP customer, attackers pivoted to FranTech (AS53667) and then 3xK Tech GmbH (AS200373), rotating through ~12,800 IPv4 addresses at low per-IP volume to evade detection while sustaining ~1.5 million login attempts/day.

huntress.comwriteupAdded 3 Sep 2026, published 30 Jun 2026🛡️ Security

A DFIR-focused post cataloging real-world Linux clear-text credential harvesting techniques observed in incident response, including a case where a plaintext Java Keystore password in root's bash history led to full Azure tenant compromise via Siemens OpenScape/Exchange integration. It also covers truffleproc (GDB-based process memory dumping), pspy (non-root process/cron snooping via inotify), a backdoored Citrix NetScaler login portal exfiltrating credentials via injected JavaScript, the ptrace-based sshd/sudo credential grabber 3snake, and PAM-based keystroke logging/backdoors (pam_tty_audit.so, custom malicious PAM modules), each paired with defensive hardening recommendations.

dfir.charticleAdded 3 Sep 2026, published 21 Jun 2026🛡️ Security

Episode 8 of The OpenSourceMalware Show covers the Miasma worm (built on TeamPCP's open-sourced Mini Shai-Hulud) taking down 73 Microsoft GitHub repositories, including the Azure Functions org, in 105 seconds on June 5th, traced back to a May 19th Durable Task repo credential compromise. It also discusses VS Code's new two-hour third-party extension auto-update cooldown (contrasted with the Nx Console/Open VSX incident where Microsoft's Marketplace notification, not detection, caught the malware), npm v12's plan to disable install lifecycle scripts, direct Git dependencies, and remote tarball dependencies by default starting July, and a breakdown of package firewall designs (simple alias-based interceptors vs. daemon/proxy-based tools) including their bypass weaknesses and reliance on OSV/GHSA data.

opensourcemalware.comtalkAdded 3 Sep 2026, published 11 Jun 2026🛡️ Security

StepSecurity's forensic analysis of the June 5, 2026 Miasma worm incident, in which a compromised contributor account pushed a malicious commit to Microsoft's Azure/durabletask repository planting five files (.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and a 4.6MB obfuscated .github/setup.js payload) that trigger credential-harvesting code execution the moment the repo is opened in Claude Code, Gemini CLI, Cursor, or VS Code — no package install or code run required. GitHub's automated abuse detection disabled 73 Microsoft repositories in a 105-second sweep, including Azure/functions-action, breaking CI/CD pipelines across GitHub Actions users relying on the mutable @v1 tag. The post ties this to the same compromised account behind the May 19 durabletask PyPI credential-stealer campaign and the broader TeamPCP-linked Miasma worm, which has infected 113+ repositories.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

StepSecurity documents the compromise of Microsoft's durabletask PyPI package (versions 1.4.1-1.4.3, 400k+ monthly downloads), where an attacker bypassed the GitHub CI/CD pipeline entirely using stolen publishing credentials to inject a dropper for rope.pyz, a modular cloud-intrusion framework with dedicated collectors for AWS, Azure, GCP, Kubernetes, HashiCorp Vault, password managers, and the filesystem. The framework encrypts stolen data with AES-256-GCM/RSA-4096, exfiltrates via HTTPS, GitHub commit beacons, and attacker-created public repos using the victim's own stolen GitHub tokens, propagates via AWS SSM and kubectl exec, and drops a geo-targeted rm -rf wiper for systems matching Israeli locale/timezone markers. The post ties the attack to TeamPCP's Mini Shai-Hulud campaign (same infrastructure as TanStack, Mistral AI, LiteLLM, @antv) and later updates describe a second compromise of the Azure/durabletask GitHub repo that plants payloads triggering in Claude Code, Gemini CLI, Cursor, and VS Code.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

Investigates GitHub's mass disabling of 73 Microsoft repositories across the Azure, Azure-Samples, microsoft, and MicrosoftDocs orgs within a 105-second window on June 5, all flagged for ToS violations, including the widely-used Azure/functions-action GitHub Action that broke CI pipelines globally. The author links the takedown to a re-compromise of the durabletask PyPI package (previously hit May 19 by TeamPCP via stolen GitHub Actions secrets) and to Miasma, a rebrand of TeamPCP's open-sourced Mini Shai-Hulud worm that Aikido and OX Security found had added Azure/GCP credential collectors and self-propagates by committing stolen secrets into attacker-created public repos, which is what likely triggered GitHub's automated abuse enforcement.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Jun 2026🛡️ Security

cicd-sensor is an open-source, eBPF-powered runtime security sensor ("EDR for CI/CD") for GitHub Actions and GitLab CI/CD that detects supply-chain attacks in-flight by watching process ancestry (e.g. credential access spawned from an npm install) and correlating signals across a job. It emits per-run logs, graphical reports, and build attestations routed to a self-hosted Manager and cloud sinks (S3, GCS, Azure Blob, Pub/Sub), positioning itself as the vendor-neutral open counterpart to commercial offerings like StepSecurity's Harden-Runner and GMO Flatt Security's Takumi Runner. Created by Hiroki Suezawa (@rung), author of the Common Threat Matrix for CI/CD Pipeline and an OWASP Top 10 CI/CD Security Risks contributor.

github.comrepoAdded 3 Sep 2026, published 4 Jun 2026🛡️ Security

Snyk documents an active npm supply-chain attack ("Node-gyp Supply Chain Compromise - June 2026") that abuses binding.gyp's GYP command-expansion syntax (<!(...)) to trigger arbitrary code execution via node-gyp during npm install, bypassing detection tools that only monitor preinstall/postinstall scripts. The worm, tracked as "Phantom Gyp"/"Miasma" (a Shai-Hulud descendant) by StepSecurity, has hit 57 packages including autotel-* and @vapi-ai/server-sdk, harvests npm/GitHub/AWS/GCP/Azure/Vault/Kubernetes credentials via a multi-stage obfuscated Bun-based loader, injects GitHub Actions workflows for persistence, and self-propagates by republishing from compromised maintainer accounts.

snyk.iowriteupAdded 3 Sep 2026, published 4 Jun 2026🛡️ Security

Aikido argues that EDR and corporate/remote proxies cannot catch supply chain malware because the malicious code executes with full trust inside legitimate package managers at install time. It walks through two real incidents: the March 2026 hijack of the axios maintainer's npm account (a new dependency's postinstall script dropped a cross-platform RAT and self-deleted, indistinguishable from a normal npm install), and a backdoor added to three versions of Microsoft's Python durabletask package that harvested credentials across AWS, Azure, GCP, Kubernetes, and HashiCorp Vault, propagated via SSM and kubectl exec, and triggered rm -rf / on machines with Israeli/Iranian locale settings. It concludes that this class of attack needs host-based, always-on, install-time protection rather than network-perimeter or behavioral-anomaly tooling — pitching Aikido's Device Protection product.

aikido.devarticleAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

Aikido details a June 2026 compromise of 96 versions across 32 @redhat-cloud-services npm packages (116,991 weekly downloads) with "Miasma," a new variant of the TeamPCP-authored Mini Shai-Hulud credential-stealing worm whose source was open-sourced in May 2026. Attackers compromised a Red Hat employee's GitHub account to push malicious orphan commits containing a GitHub Actions workflow that abused OIDC id-token: write permissions to authenticate to npm's trusted publishing endpoint and republish backdoored packages; each package's preinstall script then ran a 4.2MB obfuscated payload that swept GitHub Actions, AWS, GCP, Azure, Vault, Kubernetes, npm/PyPI, SSH, Docker, GPG, and .env credentials. The piece also lays out the broader Mini Shai-Hulud campaign timeline (Bitwarden CLI, SAP, PyTorch Lightning, Mistral/TanStack, Microsoft DurableTask) and full IOC package/version list.

aikido.devwriteupAdded 3 Sep 2026, published 1 Jun 2026🛡️ Security

Metis is an open-source agentic AI security code review framework built by Arm's Product Security Team that uses LLMs for semantic vulnerability detection rather than hardcoded rules. It performs deep security review across codebases (with C/C++ reachability analysis via a code graph), validates and triages findings from itself or third-party SAST tools to reduce false positives, and annotates SARIF output. It supports multiple LLM providers (OpenAI, Azure OpenAI, Anthropic, Gemini, AWS Bedrock, vLLM, Ollama, llama.cpp, LiteLLM) and vector-store backends (ChromaDB, PostgreSQL/pgvector, Qdrant) for RAG-based codebase indexing and querying.

github.comrepoPublished and added 31 May 2026🛡️ Security

Socket's threat research team details a fresh compromise of the npm package node-ipc, where dormant maintainer account "atiertant" was hijacked via an expired recovery-email domain and used to publish three malicious versions (9.1.6, 9.2.3, 12.0.1) containing an obfuscated credential-stealing backdoor appended only to the CommonJS build. The payload forks a detached child process, harvests cloud/SSH/CI/database credentials and secrets from the filesystem and environment, archives them, and exfiltrates via covert DNS TXT queries to a typosquatted Azure-lookalike domain (sh.azurestaticprovider.net) and zone bt.node.js, with no observed C2 response handling or persistence. The write-up includes the full decode chain (XOR+HMAC+base64 obfuscation), dynamic validation, and complete IOCs (hashes, domains, temp file paths).

socket.devwriteupPublished and added 30 May 2026🛡️ Security

Wiz's follow-up PQC research post quantifies real-world adoption of post-quantum key exchange (ML-KEM/X25519MLKEM768) and digital signatures (ML-DSA, SLH-DSA, pending FN-DSA) across AWS, Azure, and GCP APIs, OpenSSH/OpenSSL versions, and Go's crypto/tls. It finds stark gaps: Azure API servers show no PQC key-exchange support while GCP is universal and AWS sits at 13%, only 15% of TLS 1.3 connections observed use PQC-compliant key exchange, under 15% of OpenSSL instances support PQC, and less than 1% of companies use AWS KMS ML-DSA signing keys. The piece also covers the shift in PQC priority from key exchange (mitigating Harvest-Now-Decrypt-Later attacks) to digital signature migration, and the coming move to Merkle Tree Certificates to keep PQC certificate chains manageable.

wiz.ioarticleAdded 5 Sep 2026, published 28 May 2026🛡️ Security

Orca analysis of CVE-2026-46354 (CVSS 9.1) in the Coder remote development platform. azureidentity.Validate() checks that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the signature on the envelope. An unauthenticated attacker can send a forged envelope, using a public Azure IMDS certificate and a known vmId, to POST /api/v2/workspaceagents/azure-instance-identity. This yields workspace agent session tokens, and through them Git SSH keys and OAuth tokens. The post lists the affected v2 and v1 versions, the patched releases (v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, v2.24.5) and the workaround of disabling Azure instance identity auth. Coder v1 has no patch.

orca.securityadvisoryPublished and added 22 May 2026🛡️ Security

FOSSA's technical breakdown of the May 2026 Mini-Shai-Hulud campaign, which compromised at least 235 npm and PyPI packages including @tanstack/*, @uipath/*, mistralai, and @opensearch-project/opensearch. It details the two install-time payload mechanisms (a Git-dependency prepare-hook trick with an orphan commit for @tanstack/*, and direct preinstall scripts for @uipath/*/Mistral AI), a staged PyPI dropper in __init__.py that evades sandbox scanning, the credential-harvesting targets (AWS/GCP/Azure, Kubernetes, Vault, GitHub, npm tokens), exfiltration infrastructure (filev2.getsession.org, git-tanstack.com), and IDE-persistence via modified Claude/VS Code config files.

fossa.comwriteupPublished and added 18 May 2026🛡️ Security

GitHub changelog entry describing a new capability where organizations can register multiple private registries per ecosystem (npm, Maven, NuGet, Docker, pip, RubyGems, etc.) at the org level for both Dependabot and code scanning, instead of being limited to one registry per ecosystem type. It also adds OIDC-based authentication support (via UI and REST API) for Azure DevOps Artifacts, AWS CodeArtifact, and JFrog Artifactory, available now on github.com/GHEC and coming to GHES 3.24.

github.blogotherAdded 3 Sep 2026, published 13 May 2026🛡️ Security

Microsoft discloses two CVEs in its Semantic Kernel AI agent framework: CVE-2026-26030, where AI-model-controlled input into an eval()-executed Python lambda filter (used by the In-Memory Vector Store's Search Plugin) bypasses an AST-based blocklist via class-hierarchy traversal to BuiltinImporter.load_module, achieving arbitrary code execution from a single injected prompt; and CVE-2026-25592, where the .NET SessionsPythonPlugin's DownloadFileAsync was accidentally exposed as a callable AI tool with an unsanitized file path, letting an attacker escape the Azure Container Apps sandbox and write a payload into the host's Startup folder for persistence/RCE. The post details the exploit chains (mapped to MITRE ATLAS AML.T0051→AML.T0016), Microsoft's four-layer AST allowlist fix and path-validation patch, affected version ranges, KQL hunting queries for post-exploitation detection, and a public CTF challenge to practice exploiting CVE-2026-26030.

microsoft.comwriteupAdded 2 Oct 2026, published 7 May 2026🛡️ Security

Socket researchers found that Bitwarden CLI 2026.4.0 was compromised via a hijacked GitHub Action in Bitwarden's CI/CD pipeline, part of the ongoing Checkmarx-themed supply chain campaign. The malicious bw1.js payload shares C2 infrastructure and code (gzip+base64 packed Python memory-scraper, Bun-based runtime, GitHub Actions workflow injector) with the earlier Checkmarx mcpAddon.js attack, but adds new indicators like a lock file, shell-profile persistence, and overt "Shai-Hulud: The Third Coming" / Butlerian Jihad ideological branding, plus a kill switch for Russian-locale systems. It harvests GitHub, AWS, Azure, GCP, npm, SSH, and Claude/MCP credentials and exfiltrates via GitHub commits and npm republishing.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Dracarys is a new "not for beginners" Active Directory attack lab built on top of Orange Cyberdefense's GOAD (Game of Active Directory) framework. The lab consists of two Windows Server 2025 hosts (a DC and a member server) and an Ubuntu 24.04 server, all joined to the domain dracarys.lab; the goal is to pivot from the domain-joined Linux box to full domain admin. The post gives deployment instructions (VirtualBox, VMware, Ludus, Proxmox, AWS, Azure), rules (no vagrant user, no reading recipe secrets), and promises follow-up walkthroughs of the Linux-side exploitation techniques.

mayfly277.github.iootherAdded 2 Oct 2026, published 8 Mar 2026🛡️ Security

A hands-on Azure security writeup covering abuse of Shared Access Signature (SAS) tokens for blob storage (account-key vs. user-delegation signed tokens, and how to spot account-key SAS via the missing 'skoid' field in logs), and a cross-tenant object replication attack that exploits Azure's default-enabled cross-tenant replication (pre-Dec 2023) via the objectReplicationPolicies REST API to continuously exfiltrate blob data with minimal logging. It also provides several KQL detection queries against StorageBlobLogs, AzureActivity, AzureMetrics, and StorageFileLogs for spotting cross-tenant replication policy creation, anomalous user-agent strings, transaction-volume spikes, and Azure Files SMB read anomalies via SmbPrimarySID baselining. The piece closes with concrete hardening advice: prefer managed identities/Entra over SAS, disable cross-tenant replication, and build detections on configuration drift and stable client fingerprints.

hausec.comwriteupAdded 3 Sep 2026, published 15 Dec 2025🛡️ Security

Deep technical teardown of the Entra ID (Azure AD) Broker's LocalState cache on Windows 11, reverse-engineering the file naming scheme derived from identity material, the AES-GCM/DPAPI-wrapped Packer::V3 format inside AAD.Core.dll, and the JSON/binary serialization of AuthenticationContext objects used for PRT and per-application authority files. The author shows how to decrypt cached PRT and authority token files, derive the TPM-bound PRT session key via NCryptKeyDerivation (replicating mimikatz's dpapi::cloudapkd), and extract cached access/refresh tokens and JWTs — giving an attacker with local SYSTEM context a path to long-lived, MFA-bypassing cloud access and rich identity reconnaissance data. Companion extraction code is released as AADBrokerDecrypt on GitHub.

winternl.comwriteupAdded 2 Oct 2026, published 30 Sep 2025🛡️ Security

Huntress details six months of research into malicious Azure/Entra ID OAuth applications, splitting them into "Traitorware" (legitimate-looking apps commonly abused by attackers, ~10% of surveyed tenants had at least one) and "Stealthware" (custom-built OAuth Illicit Consent Grant apps used for persistence and data theft). Drawing on enumeration of 8,000+ tenants and Huntress partner telemetry, the SOC found over 500 confirmed Stealthware instances and identifies detection heuristics (low global app prevalence + single-user delegation + powerful permission scopes). The post also announces Cazadora, an open-source script that authenticates via Graph API to hunt rogue Enterprise Applications and App Registrations for known malicious naming patterns and reply URLs.

huntress.comwriteupAdded 3 Sep 2026, published 10 Feb 2025🛡️ Security

A Huntress researcher walks through Device Code Phishing, an OAuth 2.0 device authorization grant abuse technique, and shows why it is far more dangerous against Azure/Microsoft 365 than against Google Cloud. In Azure, the attacker controls the requested resource and can use Microsoft's undocumented "Family of Client IDs" (e.g. the Microsoft Authentication Broker client ID) to phish a Primary Refresh Token capable of joining rogue devices, enrolling MFA, and full account takeover; Google's device code implementation restricts the flow to a handful of narrow scopes (GDrive file access, YouTube read-only) and requires a registered/verified OAuth app, neutering the same attack. The piece includes working curl/Python requests for both providers and references prior research by Dirk-jan Mollema, Nestori Syynimaa, and Lina Lau.

huntress.comwriteupAdded 3 Sep 2026, published 6 Feb 2025🛡️ Security

A blue-team operations guide for optimizing a Microsoft Sentinel/Defender XDR SOC, compiling community-built workbooks and techniques for four problem areas: data collection health (ingestion anomaly detection workbook, KQL-based ingestion-failure alerts, Azure Policy for enforcing DCR association on Arc-managed servers), analytic rule false-positive triage (Bert-Jan's Analytic Rules Efficiency KQL query, referencing Anton Chuvakin's alert fatigue research), MITRE ATT&CK coverage mapping (Sentinel ATT&CK Map, Use Case Mapper workbook), and Logic Apps/playbook health monitoring via the built-in Playbooks health workbook and Azure Monitor alert rules. It's a curated roundup of community solutions rather than original research, aimed at reducing analyst alert fatigue and closing detection gaps.

attackthesoc.comarticleAdded 3 Sep 2026, published 7 Dec 2024🛡️ Security

A short DFIR.ch "Today I Learned" post walking through enabling Azure NSG Flow Logs (v2), storing them in a Storage Account, and parsing the flowTuple JSON schema (timestamp, src/dst IP/port, protocol, direction, allow/deny, flow state B/C/E). It highlights use cases like detecting RDP brute-force attempts and integrating logs into Sentinel/Splunk/ELK for network monitoring and incident response.

dfir.chwriteupAdded 3 Sep 2026, published 21 Sep 2024🛡️ Security

A practical deception-engineering guide showing how to "stack" Microsoft Defender XDR's native Deception rules (basic/advanced lures, decoy hosts, credentials) with Thinkst Canarytokens (tokenized PDFs, custom EXEs, DNS/AWS-key tokens) to close detection gaps. It walks through generating tokens on Canarytokens.com, embedding them as lure files in Defender XDR deception rules, and routing alerts via email/Teams/Slack or an Azure Logic App into Microsoft Sentinel for SOC-integrated incident creation.

attackthesoc.comwriteupAdded 3 Sep 2026, published 21 Apr 2024🛡️ Security

dfir.ch documents an incident where an attacker with a compromised (non-MFA) Azure admin account created Azure Batch accounts, requested a Microsoft Support quota increase to unlock compute, and used a Batch pool StartTask to pull a Docker container (ubtssl/webappx) running the xm coin miner against a mining pool. The post walks through Azure Batch internals (accounts, pools, StartTask, quotas), shows the actual Activity Log JSON and malicious bash/Docker config, and recommends MFA, risky sign-in monitoring, and anomaly alerting as mitigations.

dfir.chwriteupAdded 3 Sep 2026, published 15 Mar 2024🛡️ Security

A practitioner's review of "Penetration Testing Azure for Ethical Hackers" (Davide Okeyode & Karl Fosaaen, Packt, 2021), walking through its chapter-by-chapter Azure attack methodology: recon of Azure services/vulnerabilities, escalating from Reader to Contributor (IaaS/PaaS) to Owner/Azure AD privileged roles, then persistence in the tenant. The author also shares real troubleshooting notes for the book's hands-on labs, including VM region-allocation workarounds and a fix for a broken Chapter 7 lab script requiring manual global administrator role assignment.

bencteux.frwriteupAdded 3 Sep 2026, published 5 Jun 2022🛡️ Security

Details five ways to execute code on an Azure VM beyond RDP/SSH: the Run Command agent, Custom Script Extension, Desired State Configuration (DSC) extension abuse, VM Application Definitions, and Hybrid Worker Groups — all running as SYSTEM/root by default. For each technique the author gives the exact PowerShell/Az cmdlets (including PowerZure's Invoke-AzureRunProgram and Invoke-AzureVMCustomScriptExtension), on-disk artifact paths, and the specific Azure Activity Log events (e.g. 'Run Command on Virtual machine', 'Create or Update Virtual Machine Extension') defenders should correlate on.

hausec.comwriteupAdded 3 Sep 2026, published 4 May 2022🛡️ Security

Release notes for PowerZure 2.1, a PowerShell Azure exploitation toolkit, detailing new offensive functions including Invoke-AzureVMUserDataAgent/Command which abuse the VM userData property for log-free command execution, and Invoke-AzureMIBackdoor which exposes the IMDS REST API externally via portproxying to steal Managed Identity JWTs without authentication. Also adds Get-AzureManagedIdentities and Get-AzurePIMAssignment for enumeration, plus several bug fixes to existing cmdlets.

hausec.comarticleAdded 3 Sep 2026, published 21 Dec 2021🛡️ Security

Hausec details a covert command execution technique on Azure VMs abusing the userData property of the Instance Metadata Service (IMDS): an attacker with VM write privileges uses Invoke-AzVMRunCommand once to deploy a PowerShell "agent" that polls IMDS for base64-encoded commands, executes them, and exfiltrates results back via the Azure REST API using a smuggled access token — enabling repeat command execution without further RunCommand calls. The technique is implemented in PowerZure via Invoke-AzureVMUserDataCommand and Invoke-AzureVMUserDataAgent, and the post includes detection guidance covering artifact locations, Activity log alerts on Invoke-AzVMRunCommand, and PowerShell logging.

hausec.comwriteupAdded 3 Sep 2026, published 3 Dec 2021🛡️ Security

Hausec (with Andy Robbins) details real-world Azure/Azure AD attack chains found on engagements: escalating a low-privileged Application Owner to Global Administrator via service principal secret abuse, then converting Azure AD Global Admin into Azure resource control via the User Access Administrator toggle (bypassing the fact that service principals can't invoke the API by creating a new admin user instead), pivoting from cloud to on-premise AD by uploading a Cobalt Strike PowerShell payload through Intune to hybrid-joined devices, and abusing Azure Logic App connector session persistence to reuse another account's privileges. The post accompanies the release of PowerZure 2.0, a rewritten offensive PowerShell toolkit implementing these abuses (Add-AzureSPSecret, New-AzureIntuneScript, Set-AzureElevatedPrivileges, Get-AzureLogicAppConnector, etc.).

hausec.comwriteupAdded 3 Sep 2026, published 26 Oct 2021🛡️ Security

A cheatsheet of Cypher queries for use with AzureHound-collected data in BloodHound's GUI and the underlying Neo4j console, covering queries to find Global Admins, on-prem-to-Azure privilege escalation edges, paths to Azure VMs and Key Vaults, synchronized AD groups, privileged service principals, and app ownership. Links to the author's Bloodhound-Custom-Queries GitHub repo for importable JSON queries.

hausec.comwriteupAdded 3 Sep 2026, published 23 Nov 2020🛡️ Security