31 results for “telemetry”

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

Analysis of a trojanized anthropic.claude-code 2.1.313 extension (darwin-arm64), found on Open VSX, with a 66-line loader prepended to extension.js. It adds an svc-telemetry key to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, sets persistence (LaunchAgent, cron, scheduled task) and sends host recon over HTTP port 8099. Includes IOCs, hashes and response steps; no further payload download was found.

opensourcemalware.comwriteupPublished and added 30 Oct 2026🛡️ Security

The Claude Code VS Code extension anthropic.claude-code 2.1.313 was published on Open VSX on 29 October 2026 with a malicious loader prepended to extension.js. On load it planted an attacker SSH key (svc-telemetry), installed per-OS persistence, opened a reverse SSH tunnel and beaconed host recon over HTTP. Cursor reports at most 5,000 users received it in an 11-hour window. The post gives the timeline, cleanup artifacts and credential rotation steps.

stepsecurity.iowriteupPublished and added 30 Oct 2026🛡️ Security

no-agent-summary.js is a roughly 70-line Bun preload by Flamerix AI that stops Claude Code from re-sending each background agent's full transcript to its model every ~30 seconds for a status-line summary. The write-up cites OpenTelemetry measurements of 18 to 26 percent of spend (since version 2.1.232), explains the setTimeout hook, and gives install and verify steps. It was tested on Linux with Claude Code 2.1.257 to 2.1.312.

gist.github.comwriteupAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.

x.comwriteupPublished and added 8 Oct 2026🛡️ Security

Huntress details a phishing campaign that abuses legitimate Microsoft Power BI dashboards (app.powerbi.com) to host a fake "Download Reference" lure that bypasses mail filters trusting the Microsoft domain. Clicking the lure triggers browser/environment fingerprinting and Telegram-bot-based victim telemetry exfiltration via attacker domains (dailylifeproject.site, burnsworth.site, etc.), then silently downloads rogue ScreenConnect installers; a chained CMD/PowerShell script (SCAutoFix.ps1) deploys a second ScreenConnect instance, uninstalls the first for evasion, drops the defense-evasion tool HideUL_x64.exe, and sets a recurring scheduled task before Huntress's SOC intervened.

huntress.comwriteupPublished and added 7 Oct 2026🛡️ Security

DFIR.ch field notes on an incident where attackers used Ricardo J. Ruiz's TrickDump tool to dump LSASS without creating a conventional minidump file, instead leaving lock.json, shock.json, barrel.json and a ZIP of randomly-named memory-region chunks. The authors reconstructed the dump with TrickDump's create_dump.py and parsed it with pypykatz, confirming the attacker actually recovered reusable Kerberos credential material rather than just detecting that LSASS was touched. Includes hunting guidance (Sysmon EID 10 process-access telemetry, SeDebugPrivilege enablement, multi-binary workflows) and notes TrickDump fails against LSASS protected by PPL.

dfir.chwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Huntress breaks down how Microsoft Defender Antivirus (MDAV) path/extension exclusions can be abused to hide malicious binaries from scans, detailing the registry internals (HKLM...Windows Defender\Exclusions vs the GPO-driven Policies key) and the four ways to set them: PowerShell (Set/Add-MpPreference), the MSFT_MpPreference WMI class, GPO, and direct registry edits. It documents real-world abuse by GootKit (2019), WhisperGate (2022), and Muddled Libra (2024), plus an under-documented trick where setting HideExclusionsFromLocalAdmins blocks even SYSTEM from querying exclusions via PowerShell/WMI, and describes the registry-level telemetry and detections Huntress built to catch both behaviors.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Short release note for Datasette 1.0a41, covering a contributed OpenTelemetry integration for observability and a refactor of Datasette's modal dialogs into a single reusable Web Component now documented for plugin authors. It's a minor but concrete update to Simon Willison's open-source SQLite-backed data publishing/exploration tool.

simonwillison.netwriteupAdded 29 Sep 2026, published 24 Sep 2026🧠 AI

Huntress details a post-incident investigation into an INC ransomware attack that hit 175+ endpoints, reconstructed from surviving EDR telemetry and Windows event logs rather than live detection. The intrusion shows a 17-day gap between initial scheduled-task persistence and RDP lateral movement (possibly an initial access broker), and a second wave using AnyDesk, a BYOVD tool (hwau.exe loading the HwAudio kernel driver) to disable security controls, and Impacket's atexec.py to deploy INC ransomware. Attackers dropped two distinct ransom notes 53 minutes apart: a standard INC-README.txt and a detailed DATALEAK_PRESS_RELEASE.txt threatening to notify media, employees and partners with a full inventory of stolen files.

huntress.comwriteupAdded 22 Sep 2026, published 21 Sep 2026🛡️ Security

A DFIR field notes post describing how an analyst pivoted from a Microsoft Defender "Behavior:Win32/RegDump.SA" alert (flagged on svchost.exe running as SYSTEM) to identify Impacket's secretsdump.py activity. MFT analysis revealed a leftover temp file (ASOWCIKI.tmp) matching Impacket's RemoteOperations naming pattern (8 random ASCII chars + .tmp) for a partially-saved SAM registry hive, and the post explains why svchost.exe appears in telemetry due to the Remote Registry service being abused over MS-RRP/winreg via SMB. It also cross-references a similar Huntress case (April 2026) that additionally observed SCM Event ID 7040 (Remote Registry service enabled) as a corroborating artifact.

dfir.chwriteupAdded 13 Sep 2026, published 11 Sep 2026🛡️ Security

Presents a tiered trust checklist for evaluating third-party GitHub Actions before referencing them in a workflow, covering maintenance/tooling signals, unpinned transitive dependencies, release attestations, and governance, with weaker popularity-based signals separated into a second tier. It then argues that any point-in-time trust assessment only holds if the referenced commit is immutable, and compares raw SHA pinning against GitHub's immutable releases and the new gh-actions-lock CLI extension, which verifies commit reachability to defeat impostor-commit attacks. It closes by noting StepSecurity's GitHub Action Advisor automates some of the checklist's queryable signals using Harden-Runner telemetry.

jessehouwing.netwriteupAdded 21 Sep 2026, published 4 Sep 2026🛡️ Security

Tenet Security's DEFCON 34 research "Ghostjacking" chains four AI-agent attack primitives into a full kill chain: prompt injection via untrusted log/telemetry fields that AI coding agents (Claude Code, Cursor) read through MCP connectors to Cloudflare, Datadog, and Sentry; agent-to-agent lateral movement where one agent (Sentry's Seer) vouches malicious findings to a downstream coding agent; a JWT cross-reuse sandbox-escape zero-day in Claude Desktop's Envoy-based egress proxy that lets a stolen/broadly-scoped token bypass the deny-by-default network allowlist; and a "self-exploit" technique where one AI session iteratively crafts a prompt-injection payload against another. The Cloudflare chain is notable for weaponizing a WAF-blocked request: the payload rides in headers logged verbatim, so an agent triaging "blocked" firewall events is tricked into hijacking DNS records — a 90% success rate against Claude Code (Sonnet 4.6) on Cloudflare's own recommended config. All findings were disclosed and remediated/confirmed by Cloudflare, Datadog, Sentry, and Anthropic before publication, and the researchers open-sourced a mitigation tool, agent-jackstop.

tenetsecurity.aiwriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Sentry researcher Drinor Selmanaj found CVE-2026-20685, a path traversal (Zip Slip/CWE-22 class) in darwin-init, the root PID 1 process that provisions Apple Private Cloud Compute nodes by extracting cryptex bundles. By crafting a tar archive that is simultaneously a valid cryptex and a set of traversal entries, the attacker writes files as root to the persistent /var/db data volume during boot, redirects the splunkloggingd log forwarder to an attacker-controlled server, and exfiltrates CloudBoard/Trusted Inference Engine telemetry including per-request metadata, token counts, and timing side-channels — while PCC's attestation, which only measures installed software, remains indistinguishable from a clean boot. Apple rated it CVSS 6.5 information disclosure, patched it in PCC 5E290.3+, and paid a $150,000 Apple Security Bounty award.

blog.sentry.securitywriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Socket's Threat Research Team analyzed 11 malicious NuGet DotnetTool packages (published by account pepegit666) that impersonate game cheats/bots for titles like GTA5RP, Albion Online, and Throne and Liberty. Each package's .NET downloader resolves GitHub hosts via DNS-over-HTTPS, requests UAC elevation to resync the clock, and fetches a PyInstaller Windows payload (pepesoft.exe) from GitHub Releases/Hugging Face with dormant BitTorrent fallback code, that in turn authenticates to Google Sheets for telemetry, hardware-binds licenses, enforces a remote HWID ban-list, and, in three samples, drives Telegram bot commands that exfiltrate screenshots and modify Windows Installer registry keys on exit. The report includes full IOC lists (hashes, domains, hardcoded AWS-style keys, mutex GUID) and MITRE ATT&CK technique mappings.

socket.devwriteupPublished and added 15 Jul 2026🛡️ Security

On July 8, 2026, a compromised maintainer account pushed malicious commits directly to the master branch of the InjectiveLabs/injective-ts monorepo, triggering the repo's own OIDC-based GitHub Actions publish pipeline to release backdoored version 1.20.21 of @injectivelabs/sdk-ts and 17 dependent packages. The payload, disguised as 'key derivation telemetry,' hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex() to capture BIP-39 seed phrases and raw private keys, batched and base64-encoded them, and exfiltrated them via the X-Request-Id header of HTTPS requests to a typosquat-style domain (testnet.archival.chain.grpc-web.injective.network) mimicking legitimate Injective gRPC-Web traffic. The destination hostname was obfuscated as a JavaScript char-code array to evade plaintext string scans, and the packages were reverted to clean 1.20.23 roughly 49 minutes after the malicious release.

stepsecurity.iowriteupAdded 3 Sep 2026, published 12 Jul 2026🛡️ Security

A security research team traces six typosquatted npm packages (anthropic-toolkit, ai-sdk-helpers, ollama-helpers, openai-agents-helpers, @langgraphjs/toolkit, and @aspect-security/argon2) impersonating Anthropic, Vercel, Ollama, OpenAI, LangChain, and Aspect Security back to the founder of a stealth-mode cybersecurity startup. The packages use npm preinstall/postinstall hooks to silently exfiltrate a rich identity fingerprint — hostname, git/GitHub emails, SSH key comments, reflog committer emails, AWS/GCP config metadata, corporate DNS domain, and host project name — to a Google Cloud Run endpoint, while deliberately avoiding literal credentials to look benign and offering a fake telemetry opt-out. The writeup also documents version backfilling to fake package maturity and shows the payload evolving from a crude April beacon to a polished June "identity graph" collector, with full IOCs provided.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Aikido details a compromise of @injectivelabs/sdk-ts (~50,000 weekly downloads), where a hijacked maintainer account published version 1.20.21 containing hooks in PrivateKey.fromMnemonic and PrivateKey.fromHex that capture wallet mnemonics/private keys and exfiltrate them via a POST request disguised as Injective gRPC-web traffic (X-Request-Id header, char-code-obfuscated domain). The attacker simultaneously republished 17 other @injectivelabs-scoped packages pinned to the poisoned SDK version, so any downstream project resolving those transitively pulled the stealer without naming sdk-ts directly. The malicious version was live under an hour, downloaded 310 times, and has since been patched (1.20.23), though the compromised release artifacts remained on GitHub at time of writing.

aikido.devwriteupAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

InfoGuard LABS DFIR analysis of an intrusion that combined mailbombing and Microsoft Teams IT-support impersonation to deliver a modular Deno-based RAT and network proxy. The malware splits functionality across four JavaScript files (app.js, back.js, helper.js, webui.js) that abuse Deno's permission model, use string-array-shifting obfuscation, communicate C2 over a CloudFront-fronted WebSocket, and expose loopback HTTP services for command execution (127.0.0.1:10021) and TCP tunneling/pivoting (127.0.0.1:10022). The post details persistence via the HKCU Run key, Teams impersonation telemetry (TeamsImpersonationDetected), and provides KQL hunting queries for Deno execution flags, CloudFront C2 traffic, and registry persistence.

dfir.chwriteupAdded 3 Sep 2026, published 15 Jun 2026🛡️ Security

StepSecurity documents a June 2026 compromise of the Pythagora-io/gpt-pilot GitHub repo (33.7k stars), where an attacker took over a co-founder's account and force-pushed a Shai-Hulud-variant credential stealer disguised as a "Revert" commit. The malware, a 758KB obfuscated Bun/JavaScript payload delivered via a Python telemetry module, steals AWS/npm/GitHub/Kubernetes/Vault/SSH credentials, uses GitHub commit messages as a covert C2 channel, exfiltrates via newly created GitHub repos, can abuse Sigstore/Fulcio to forge SLSA Build Level 3 attestations, and plants persistence hooks in Claude Code and VS Code. Notably, the attacker's injected code was blocked twice by the project's ruff CI linter/formatter before they gave up, illustrating code-quality tooling as an accidental security control, alongside full IOCs and lessons on branch protection and force-push monitoring.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

Socket researchers found Sicoob.Sdk, a NuGet package impersonating an official C# SDK for Sicoob (a major Brazilian cooperative bank), which in versions 2.0.0-2.0.4 exfiltrates client IDs, PFX passwords, and base64-encoded PFX mTLS certificate archives via a hardcoded Sentry telemetry endpoint. The associated GitHub organization (Sicoob-Cooperativa) served as a clean-source façade, with the malicious logic only present in the compiled DLL, and the same publisher account distributed 11 other Sicoob-branded packages as dependencies of the malicious wrapper. NuGet blocked the package after Socket's abuse report.

socket.devwriteupPublished and added 29 May 2026🛡️ Security

StepSecurity and Endor Labs document a second wave of the Mini Shai-Hulud npm worm spreading through the compromised 'atool' account, which publishes timeago.js and maintains packages in Alibaba's @antv namespace, hitting echarts-for-react, jest-canvas-mock and dozens of other packages. The payload scrapes GitHub Actions Runner.Worker process memory to steal masked CI/CD secrets, harvests 130+ credential file paths (cloud, SSH, Kubernetes, Vault, crypto wallets, Claude Code/VS Code configs), exfiltrates via a GitHub API dead-drop in antvis/G2 or a fake-OpenTelemetry C2 at t.m-kosche.com, drops persistent backdoors in Claude Code/VS Code, and has already used stolen GitHub tokens to spin up 2,500+ dead-drop repositories. The writeup includes full process/network telemetry from Harden-Runner showing the attack blocked, deobfuscated payload internals, IOCs, and detection/remediation guidance.

stepsecurity.iowriteupPublished and added 19 May 2026🛡️ Security

Part two of a Huntress SOC case study untangling a Linux host compromised by three simultaneous actors: a legacy cryptominer, a multi-revenue botnet (XMR mining, EarnFM bandwidth-selling, Repocket residential proxy) with eight persistence mechanisms, and a credential-harvesting cluster that exfiltrated SSH keys, cloud credentials, and .env secrets via wget POST, while the legitimate developer used OpenAI's Codex agent to partially and ineffectively triage the same box. The SOC documents Codex's wins and misses (no root visibility, missed cron.d/UDEV persistence, race conditions with reinfecting attackers) and traces an April reinfection to unpatched CVE-2025-55182 (React2Shell) in the developer's Next.js/React app, underscoring that AI-assisted remediation without live EDR telemetry and root-cause patching leaves footholds open.

huntress.comwriteupAdded 3 Sep 2026, published 22 Apr 2026🛡️ Security

Huntress SOC details two related incidents where threat actors used PsExec for privilege escalation, a scheduled task ("Recovery Diagnostics") to run base64-encoded PowerShell that configured a renamed copy of restic (winupdate.exe) pointed at a Wasabi S3 bucket, then disabled/removed VIPRE Business Agent and Windows Defender before deploying INC ransomware. A second, near-identical prior incident on 9 February reused the same AWS access keys and used HRSword to disable Acronis security tooling, and the same TTPs were independently documented by the Cyber Centaurs team on 22 January 2026. The post highlights detection gaps (incomplete agent deployment, no SIEM) and notes RestartManager API telemetry (also seen with Akira) as a ransomware-encryption indicator.

huntress.comwriteupAdded 3 Sep 2026, published 12 Mar 2026🛡️ Security

Huntress reviews four 2025 intrusions where adversaries used LLMs (ChatGPT, DeepSeek, Gemini) to draft PowerShell tradecraft: an RDP-brute-forced credential dumper, a Veeam credential-theft script (v.ps1) over WinRM, an iterated Chrome/Edge history-scraping script chain (qb_check.ps1 → coinbase_check.ps1 → secure.chase.ps1) exfiltrating to Telegram, and a fully-featured Chrome extension RAT ("Telegram Agent + Cookies") beaconing to a C2 for cookie/screenshot/history exfiltration. The pattern across cases: AI speeds up authoring (odd comments, Cyrillic strings, verbose AI-style formatting) but doesn't produce novel primitives, so existing detections (EDR, telemetry, MFA, segmentation) still catch it.

huntress.comwriteupAdded 3 Sep 2026, published 12 Jan 2026🛡️ Security

Huntress DFIR writeup analyzing three related intrusions (Nov 6, 17, 25) that all began with command execution via IIS's w3wp.exe against custom login/web pages, followed by attempts to deploy a Golang trojan (agent.exe, identified in one case as SparkRAT) using certutil.exe as a LOLBin downloader. Using EDR telemetry, Sysmon, and IIS/web logs, the analysts trace repeated failures — Windows Defender blocks, failed service starts for a "WindowsUpdate" persistence service, mistyped/unsuccessful executions — and show how the same actor adapted between incidents by proactively adding Windows Defender exclusions and later deploying a renamed GotoHTTP RMM tool, illustrating that real intrusions are messier and more iterative than the "sophisticated playbook" narrative suggests.

huntress.comwriteupAdded 3 Sep 2026, published 22 Dec 2025🛡️ Security

A Huntress detection engineer explains why naive LDAP Sigma rules for Impacket recon tools (GetADUsers.py, GetADComputers.py, GetNPUsers.py, GetUserSPNs.py, findDelegation.py, secretsdump.py) never fire: Active Directory silently transforms LDAP extended-matching-rule OIDs like 1.2.840.113556.1.4.803 into bitwise operators (&) before writing them to Event ID 1644, so rules searching for the OID string in logs get zero hits. The post walks through a source-code-to-telemetry methodology (analyze Impacket source, run tools in a lab, inspect Event 1644/Event 30, then write and validate Sigma rules) and ships working detection logic for each tool, plus notes on correlating server-side Event 1644 with client-side Event 30 (wldap32.dll tools only) for attribution.

huntress.comwriteupAdded 3 Sep 2026, published 16 Dec 2025🛡️ Security

Huntress details six months of research into malicious Azure/Entra ID OAuth applications, splitting them into "Traitorware" (legitimate-looking apps commonly abused by attackers, ~10% of surveyed tenants had at least one) and "Stealthware" (custom-built OAuth Illicit Consent Grant apps used for persistence and data theft). Drawing on enumeration of 8,000+ tenants and Huntress partner telemetry, the SOC found over 500 confirmed Stealthware instances and identifies detection heuristics (low global app prevalence + single-user delegation + powerful permission scopes). The post also announces Cazadora, an open-source script that authenticates via Graph API to hunt rogue Enterprise Applications and App Registrations for known malicious naming patterns and reply URLs.

huntress.comwriteupAdded 3 Sep 2026, published 10 Feb 2025🛡️ Security

Huntress researcher explores using Windows Performance Monitor (PerfMon) and its underlying ETW Active Directory Diagnostics trace as an alternate Kerberos telemetry source for detecting Kerberoasting, AS-REP Roasting, and the lesser-known 'Roasting from the AS' technique, going beyond standard Event IDs 4768/4769. The post demonstrates attacks with Rubeus against a lab AD domain, shows how mass TGS/AS request spikes and LDAP serviceprincipalname queries appear in PerfMon counters, and also touches on detecting obfuscated LDAP queries via Charlie Clark's PowerView fork.

huntress.comwriteupAdded 3 Sep 2026, published 23 Jan 2025🛡️ Security

A DFIR analysis by dfir.ch dissecting a real-world phishing campaign that abuses the Windows "search-ms" URI protocol handler embedded in an HTML attachment ("Booking_Confirmation.html") to trigger a WebDAV connection via rundll32/davclnt.dll, present a spoofed Explorer search result, and lure the victim into executing an LNK file. The LNK launches a headless conhost.exe pulling an obfuscated batch script (new.bat) over a trycloudflare.com tunnel, which drops a decoy PDF, downloads a full Python interpreter (FTSP.zip) and additional scripts, and ultimately performs shellcode injection. The post also documents Sysmon process-create telemetry and the HKCU WordWheelQuery registry key as forensic artifacts of the search-ms query.

dfir.chwriteupAdded 3 Sep 2026, published 4 Aug 2024🛡️ Security