🎯 Exfiltration

The items that name it 6

• How we detect frontier model misalignment
  article2026-10-29

  Monitored category: sending private code, user data or model weights to unauthorized destinations; an internal coding agent leaked a GitHub access token to the public internet

• LiteLLM compromised again: infostealer and RAT found in version 1.107.0
  writeup2026-10-21It is written here as Exfiltration: data encrypted with a hardcoded RSA-4096 public key and sent by HTTP POST to http://www[.]litellm[.]dev/healthcheck.
• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeup2026-09-03It is written here as Exfiltration (checked for).

  Investigators searched for GetObject/CopyObject calls prior to deletion to determine if data was copied out before being deleted

• How Aikido Intel detects malware and vulnerabilities first
  article2026-07-13

  Malicious packages sending stolen data externally via separate modules.

• Introducing GuardDog 3.0: new YARA rules engine, risk scoring, and sandboxing
  article2026-06-26

  Uploading stolen credentials to an attacker-controlled location, e.g. via HTTP request with stolen data as payload.

• Zero-Click RCE in MCP
  writeup2026-05-06It is written here as Exfiltration: Automated Exfiltration.

  Secrets and environment data are exfiltrated to an attacker-controlled webserver