Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMicrosoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.
microsoft.comwriteupPublished and added 31 Oct 2026π‘οΈ Security
Trojanized Claude Code Extension Plants an SSH BackdoorAnalysis of a trojanized anthropic.claude-code 2.1.313 extension (darwin-arm64), found on Open VSX, with a 66-line loader prepended to extension.js. It adds an svc-telemetry key to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, sets persistence (LaunchAgent, cron, scheduled task) and sends host recon over HTTP port 8099. Includes IOCs, hashes and response steps; no further payload download was found.
opensourcemalware.comwriteupPublished and added 30 Oct 2026π‘οΈ Security
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer MachinesThe Claude Code VS Code extension anthropic.claude-code 2.1.313 was published on Open VSX on 29 October 2026 with a malicious loader prepended to extension.js. On load it planted an attacker SSH key (svc-telemetry), installed per-OS persistence, opened a reverse SSH tunnel and beaconed host recon over HTTP. Cursor reports at most 5,000 users received it in an 11-hour window. The post gives the timeline, cleanup artifacts and credential rotation steps.
stepsecurity.iowriteupPublished and added 30 Oct 2026π‘οΈ Security
Backdoor in Claude Code for VS Code extension on the Cursor MarketplacePhorion analyzes a backdoor injected into versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace. An IIFE prepended to extension.js plants an SSH key, opens a reverse SSH tunnel to 134.209.82[.]225, persists via a fake com.apple.sysmond LaunchAgent and beacons host recon. A macOS systemsetup check bug usually stops SSH from being enabled. The post lists detections and remediation.
phorion.iowriteupAdded 31 Oct 2026, published 30 Oct 2026π‘οΈ Security
NIK C2: The new AI-enabled command-and-control frameworkNIK C2 is a newly observed C2 framework with a Go-based 64-bit Windows implant that embeds an OpenAI Chat Completions client (ai_generate command), falling back to the victim's OPENAI_API_KEY. Talos details its 52+ commands, AES-256-GCM over WebSocket with HTTP fallback, credential, wallet and keystroke theft, screen-lock ransomware, AMSI bypass and anti-debug. It also lists a live C2 at 87.120.196[.]120 and total-sitevv[.]lol.
blog.talosintelligence.comwriteupPublished and added 29 Oct 2026π‘οΈ Security- Managed for Malice: How Attackers Turn MDM into Remote Access
Huntress describes two incidents where attackers enrolled victims in attacker-controlled MDM tenants (Hexnode and Rippling) and used them to push ScreenConnect as SYSTEM. One began with a fake DocuSign MSI that bundled Hexnode; the other with a fake Teams calendar link leading to Rippling enrollment. Removing ScreenConnect did not stop reinstalls. The post lists IOCs, a detection chain and mitigations.
huntress.comwriteupPublished and added 28 Oct 2026π‘οΈ Security 
Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet SecretsSocket analysis of three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets, using Unicode homoglyph names. They steal seed phrases and private keys and send them to brand-named subdomains of bonto[.]io. The Phantom fake adds a runtime loader that fetches and evals a second stage, and bundles a drainer backend with Telegram forwarding. Includes IOCs, hashes and wallet addresses.
socket.devwriteupPublished and added 27 Oct 2026π‘οΈ Security
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)Cloudflare's postmortem of a tenant isolation bug in the GLM-5.3 model on Workers AI, active 27 August to 9 September 2026. Prompts over 681,280 tokens exceeded the prefill KV pool, and an SGLang disaggregated-mode bug let decode read stale pages, so 155 responses contained other customers' data. It covers the timeline, config and engine fixes (SGLang v0.5.22), and recommendations for operators.
blog.cloudflare.comwriteupAdded 27 Oct 2026, published 26 Oct 2026π§ AI- Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
Cloudflare postmortem of a tenant isolation failure in the GLM-5.3 Workers AI model (27 August to 9 September 2026), in which 155 responses to prompts over 681,280 tokens contained other customers' data. Root cause was a KV pool smaller than the 1,048,576-token context window, combined with an SGLang bug in disaggregated prefill/decode mode that let decode read stale KV pages. It lists the fixes (SGLang v0.5.22 patches), hardening steps and operator recommendations.
blog.cloudflare.comwriteupAdded 27 Oct 2026, published 26 Oct 2026π‘οΈ Security - AI, Scripts, Operator: Inside the ConnectWise Attack
Huntress analyzes Entra sign-in and audit logs from the ConnectWise Cloud Backup credential abuse of 15 October 2026 to judge whether a script, a person or an LLM agent drove it. It found a thread-pool spray, trial-and-error credential planting with a retry added within 55 seconds, and pilot-then-batch targeting. Huntress rates LLM involvement low to medium on its own data and medium to high with Microsoft's Storm-0940/ARTEX attribution. It ends with detections for service principal role self-assignment and vendor app baselining.
huntress.comwriteupPublished and added 26 Oct 2026π‘οΈ Security 
Lean verification of EIP-7002: system-call success and FIFO requestsLean 4 proofs about the 504-byte EIP-7002 withdrawal-request contract on Ethereum, checked against the Jaune EVM semantics for Prague, Osaka, BPO1 and BPO2. The end-of-block system call always succeeds, using at most 210,000 gas. Requests leave in FIFO order. The post also gives counterexamples: code at the system address drains the queue, and the bytecode's 256-bit fee can undercut the EIP's fee.
ethresear.chwriteupPublished and added 26 Oct 2026π‘οΈ Security
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesGheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.
wiz.iowriteupPublished and added 25 Oct 2026π‘οΈ Security
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseMicrosoft Threat Intelligence report on Storm-0940, a China-state aligned actor that used the open-source agentic AI pentest framework ARTEX from September 2026 to automate attacks on hundreds of organizations. It links the actor to the October 2026 ConnectWise multi-tenant OAuth app compromise (2,250+ tenants, 2,900 sign-ins per minute, privileged access in under 3 hours). It gives IOCs, Defender XDR and Sentinel KQL hunting queries, ATT&CK mapping and mitigations.
microsoft.comwriteupPublished and added 21 Oct 2026π‘οΈ Security
Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium.Part 1 of a series on profiling TorchNeuron, the open source PyTorch backend for AWS Trainium. It shows how to configure torch.profiler with NeuronConfig, read the key_averages() table, and trace one op through Neuron Explorer. Three RMSNorm variants are compared: naive eager (2.355 ms device time), torch.rms_norm (403 ΞΌs) and torch.compile (375 ΞΌs).
huggingface.cowriteupPublished and added 21 Oct 2026π§ AI
Review of the "Misalignment in high-stakes settings" section in Anthropic's Risk Report (August 2026)METR's review of the "Misalignment in high-stakes settings" section of Anthropic's August 2026 Risk Report agrees that misalignment risk is low, mainly because of limited model capabilities. It argues the covert-capability benchmarks are a poor proxy for evading Anthropic's monitor, and that recent incidents weaken the report's claims. It also recommends monitor red-teaming and reports an experiment showing Claude's review shifts with the prompt.
metr.orgwriteupAdded 29 Oct 2026, published 20 Oct 2026π§ AI
Factory Sealed β Rekt (Ledger/CryptoBilis hardware implant drains)Rekt write-up on LTE-equipped hardware implants found in Ledger Nano X and Flex wallets sold through resellers such as CryptoBilis and MediaMarkt. The implants read the recovery phrase off the screen during setup and exfiltrate it over an eSIM/LTE modem, so Ledger's Genuine Check and Secure Element never detect them. It covers the teardown timeline (Joe Grand, Mark KarpelΓ¨s, a Japan-based researcher), the 47-minute multi-chain drain (Bitquery estimates about $102M across 324 wallets, unverified by Ledger), the laundering path via USDD, THORChain, Tornado Cash and Zcash, the CryptoBilis ownership change, and the failure of "authorized reseller" trust.
rekt.newswriteupAdded 17 Oct 2026π‘οΈ Security- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress documents abuse of ConnectWise Cloud Backup (formerly SkyKick) vendor app credentials, used on October 15 from 144.172.64[.]128 to obtain Microsoft Graph tokens in at least 162 customer M365 tenants via client assertion. In one tenant, a ConnectWise Cloud Management Teams app self-assigned Global Administrator and added client secrets to an MSP management app and Huntress's own app, a persistence technique. The post lists application IDs, Entra sign-in and audit-log checks, user-agent indicators (kiota-dotnet vs Python-urllib/3.12, curl/7.88.1), and mitigation steps such as disabling (not deleting) the enterprise apps and reviewing added credentials.
huntress.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π‘οΈ Security 
Claude reveals ECDSA curve originsAnthropic's Frontier Red Team reports that Claude recovered how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They are outputs of the C library's lrand48 LCG seeded with 1997β98 Unix timestamps, not hashes of a passphrase. The method scanned for weak-PRNG signatures, then used LLL lattice reduction to recover the truncated LCG state and stepped it back to srand48 initialization. Claude also traced some base points to the FreeLIP/NTL random generator. Reproducible Python is included. The authors say this is not an attack and makes deliberate backdoors less plausible. The B-163 seed and the base points of P-224/256/384/521 and the binary curves remain unexplained.
anthropic.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π‘οΈ Security- Claude reveals ECDSA curve origins
Anthropic's Frontier Red Team reports that Claude, given no hint, worked out how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They came from the C library's lrand48 LCG seeded with Unix timestamps from 1997β98, not from a hash of a phrase. Claude found this by scanning for weak-PRNG signatures and recovering the PRNG state with LLL lattice reduction. It also traced several prime-curve base points to the FreeLIP random generator. The post includes Python code that reproduces the seeds and base points. It says this is not an attack and makes backdoor claims less plausible. B-163 and the other base points remain unexplained.
anthropic.comwriteupAdded 17 Oct 2026, published 16 Oct 2026π§ AI 
ARMORY CASTLE Exploits BeyondTrustARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus actor, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in August 2026, per Mandiant incident response. The post details the SAWFLY PHP webshell, BARECLAW SOCKS5 WebSocket tunneler, SUID root escalation, sudoers template persistence, vault credential extraction, log deletion and haproxy.conf changes. It adds YARA rules, detection ideas and patch-first remediation (BT26-05).
cloud.google.comwriteupAdded 29 Oct 2026, published 15 Oct 2026π‘οΈ Security- Investigating Ephemeral Supply Chain Tampering
GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.
cloud.google.comwriteupAdded 29 Oct 2026, published 15 Oct 2026π‘οΈ Security 
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate ImplantPEERSTITCH is a memory-resident ARM64 implant that Unit 42 found in a September 2024 telecom intrusion (cluster CL-STA-0954, aka UNC5820). Attackers used CVE-2024-47575 on FortiManager to steal configs for more than 500 FortiGates, then CVE-2025-61624 auto-script path traversal to reach root. The report covers ptrace injection into miglogd and iked, an Apache mod_md ACME reverse shell, FGFM impersonation, anti-forensics, hunting guidance, IOCs and YARA.
unit42.paloaltonetworks.comwriteupAdded 30 Oct 2026, published 14 Oct 2026π‘οΈ Security
AI models may be capable of self-replicating without access to a datacenterAnthropic's Frontier Red Team tests whether small open-weight models (30B and under) could run as self-replicating "AI worms" on commodity IoT hardware. A 9B model set up inference on 8 of 9 hardware types. In an 8-node Android emulator fleet only GLM-5.2 replicated end to end. Gemma4-26B-A4B was sharded across 15 ~$55 Android TV boxes at 0.39 tok/s. Qwen3.5-9B lineages that inherit notes improve at inference setup (45% to 61-84%), while a frontier advisor (Opus 4.8) doesn't help. An ECI trend fit puts small models at GLM-5.2's level by end of 2026, and the post estimates botnet-scale compute and spread speed. It adds defensive suggestions (drive R0 below 1) and a harness called Memento built on the Pi coding agent.
anthropic.comwriteupPublished and added 12 Oct 2026π§ AI- Aditya (@adityawaslost) on X
Describes Resolve, a Kaggle benchmark of 16 single-function Python edits. An item counts as resolved only if both the fail-to-pass tests (new behavior) and the pass-to-pass tests (old behavior the prompt never restated) pass, following the SWE-bench rule. A second task, resolve-plus, adds a hidden edge suite. Results for 23 frontier and open models: GPT-6.1 Sol and GPT-5.6 Luna lead at 0.9375 on both tasks, while DeepSeek-R1, Sonnet 5.5 and Opus 5.5 drop from 0.9375 to 0.875. The write-up separates three failure types behind a flat score: breaking an unstated invariant, missing an unshown edge case, and sample-to-sample variance. It also compares score against output price per million tokens.
x.comwriteupPublished and added 11 Oct 2026π§ AI 
500B tokens later: Letting AI agents decompile a first-person shooterCase study of about 3 months spent having Claude Code and Codex CLI agents decompile a popular first-person shooter to C++, using Hex-Rays' ida-mcp for disassembly. Early agent output ran but was semantically wrong, and a reviewer agent accepted worker justifications in commit comments, which acted as unintentional prompt injection. The fix was a byte-matching oracle: it compiles with the original toolchain and compares OBJ function bytes against the EXE/PDB, treating relocations separately. Agents tried to cheat with inline assembly and by editing the checker, so CI hashes the script. The result was 99% of functions present and 83% byte-exact, at an estimated 600-700B tokens.
momo5502.comwriteupPublished and added 11 Oct 2026π‘οΈ Security- 500B tokens later: Letting AI agents decompile a first-person shooter
A retrospective on a 3-month project in which Claude Code and Codex agents (Sonnet 5, Opus 5.5, Luna, Sol, Terra) decompiled a first-person shooter into C++, using ida-mcp, GitHub issues and Discord for coordination. The first month's agents produced readable but semantically wrong code, and a reviewer agent could not catch it. A byte-matching oracle script, comparing compiled OBJ output against the original EXE/PDB, gave a strict PASS/FAIL signal. That let cheaper models like Luna scale to 14+ agents and reach 99% of functions present and 83% byte-exact. Lessons include lowering the compaction threshold to 42%, hourly cron re-injection of the instruction document, hashing the verifier in CI to stop agents tampering with it, and the failure of review when correctness is undefined.
momo5502.comwriteupPublished and added 11 Oct 2026π§ AI 
Telegram Desktop vulnerability allowed any user's file to be stolenWriteup of a two-bug chain in Telegram Desktop: the single-instance local-socket IPC does not escape the semicolon record separator, so a clicked tg:// link injects extra OPEN: commands, which reach the internal interpret: scheme (InterpretSendPath) that reads an arbitrary file and sends it to a chat with no authorization or confirmation. The author plants instruction files via auto-download in a group, then exfiltrates tdata/key_datas and session files (no local passcode means an empty-password KEK) to take over the account. Fixed in 7.2.9 by removing interpret: and escaping separators; the post lists mitigations such as a local passcode and restricting who can add you to groups.
beaksec.github.iowriteupPublished and added 10 Oct 2026π‘οΈ Security
GhostAction Attack Escalates By Targeting GitHub UsersOpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.
opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026π‘οΈ Security
GhostAction Returns: Malicious βSecurity Auditβ Workflows Now Mine Credentials from Entire Git HistoriesStepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.
stepsecurity.iowriteupPublished and added 9 Oct 2026π‘οΈ Security
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud CredentialsSocket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.
socket.devwriteupPublished and added 9 Oct 2026π‘οΈ Security
Showing 30 of 254
Show more