Author: Staff Writer

Top Highlights Frontier AI models can autonomously identify vulnerabilities, chain exploits, and adapt defenses in real-time, enabling attack speeds faster than patching cycles. AI-driven vulnerability chaining allows attackers to combine lower-severity issues into critical exploits, bypassing traditional filters. Enhanced AI analysis of source code accelerates supply chain compromises, especially affecting open-source components, increasing the risk of widespread breaches. Threat, Attack Techniques, and Targets Frontier AI refers to the most advanced large-scale models, like the Anthropic Mythos, which can reason and code fluently. These models differ significantly from earlier language models because they can find software vulnerabilities, create complex exploit chains,…

Top Highlights Vercel experienced a security breach involving compromised customer accounts linked to a wider internal system compromise. The attack stemmed from a breach in Context.ai, used by a Vercel employee, which led to unauthorized access to Vercel’s environment. Investigation suggests malware infection, including Lumma Stealer, as a possible "patient zero," with threat actors actively distributing malware targeting tokens and credentials. The incident underscores risks of OAuth integrations, emphasizing the importance of rapid detection and containment rather than solely prevention. Discovery of More Compromised Accounts Highlights Ongoing Risks Recently, Vercel announced they found additional customer accounts that had been compromised.…

Essential Insights A North Korean state-sponsored group, HexagonalRodent, is running a campaign that manipulates software developers through fake job offers and rigged coding tests to install malware and steal cryptocurrency, targeting Web3 developers specifically. The group uses AI tools like ChatGPT to craft convincing fake websites, profiles, and malware code, and employs sophisticated infection methods involving malicious VSCode configuration files that execute when a developer opens a project. The malware, primarily written in NodeJS and Python, includes modules like BeaverTail (credential theft), OtterCookie (remote access), and InvisibleFerret, which work together to exfiltrate data and maintain system control. HexagonalRodent has expanded…

Summary Points UNC6692 exploits social engineering via Microsoft Teams and email spam to deceive targets into installing custom malware, including malicious browser extensions and remote access tools. The group uses legitimate cloud services for payload delivery, exfiltration, and command-and-control, bypassing traditional security filters. Attackers target high-level executives, employing sophisticated tactics like browser hijacking, lateral movement, and credential harvesting to facilitate data theft and network compromise. Threat Overview, Techniques, and Targets UNC6692 is a new threat activity group. It uses social engineering tactics through Microsoft Teams to infect targets. The group often pretends to be the IT helpdesk. They send fake…

Essential Insights Emergence and Purpose: A sophisticated macOS malware called notnullOSX, surfaced in early 2026, targets Mac users holding over $10,000 in cryptocurrencies, aiming to steal their assets through social engineering and malware distribution via fake applications and hijacked channels. Distribution Tactics: The malware is propagated using fake Google documents, a fake wallpaper app (WallSpace), and a hijacked YouTube channel, with targets manually identified and vetted based on wallet balances, ensuring focus on high-value victims. Installation & Operation: Infection involves convincing victims to run Terminal commands or install a fake app, granting Full Disk Access that bypasses security prompts, allowing…

Fast Facts Anthropic’s Project Glasswing uncovered deeply hidden vulnerabilities, chaining multiple bugs into sophisticated exploits, highlighting AI’s advanced offensive capabilities. The cybersecurity gap has widened: less than 1% of AI-discovered vulnerabilities are patched, as defenders operate on slower, manual cycles contrasted with machine-speed attacks. To keep up, organizations must shift to signal-driven validation, context-aware prioritization, and automated, closed-loop remediation processes that match AI attack speed. Autonomous exposure validation platforms like Picus Swarm enable real-time, traceable vulnerability testing, drastically shortening detection-to-fix cycles from days to minutes. Project Glasswing Demonstrates AI’s Power to Detect Software Flaws Last week, a new AI model,…

Essential Insights UNC6692 exploited SNOWBELT extension to download malicious files and used internal port scanning and PsExec for lateral movement, including RDP access to backup servers. They extracted LSASS memory to obtain credential hashes, exfiltrating this sensitive data covertly via LimeWire to escalate privileges. The attacker used Pass-The-Hash to access domain controllers, downloaded and exfiltrated critical Active Directory data with FTK Imager, and monitored activities through screenshot captures. Threat, Attack Techniques, and Targets The threat actor UNC6692 used social engineering and custom malware to attack specific targets. They employed the SNOWBELT extension to download files such as SNOWGLAZE, SNOWBASIN, AutoHotkey…

Fast Facts A cyberattack linked to the threat group Tropic Trooper exploits trojanized PDFs and open-source tools, notably using a modified SumatraPDF binary and a novel AdaptixC2 framework via GitHub, targeting Chinese-speaking individuals in Taiwan, South Korea, and Japan. The campaign demonstrates sophisticated use of legitimate developer tools like VS Code tunnels for covert remote access, making detection challenging due to their trusted status in enterprise environments. Tropic Trooper employs innovative tactics, such as encrypting C2 communication with RC4, and deleting uploaded malicious payloads quickly on GitHub to evade detection and attribution. Defenders should monitor unusual GitHub activity, restrict execution…

Top Highlights A nation-state-linked hacking group, Harvester APT, has developed a Linux version of its backdoor that covertly communicates via legitimate Microsoft Outlook mailboxes using the Microsoft Graph API, making detection difficult. The attack leverages trusted cloud infrastructure, with malware setting up persistence in Linux systems through systemd units and autostart entries, and employs hardcoded Azure AD credentials to poll and execute commands via email. Initial access is gained through social engineering, with malicious Linux ELF binaries disguised as legitimate documents, enabling the malware to run silently and wipe traces after task completion. Organizations should scrutinize Linux autostart entries, monitor…

Essential Insights Vercel experienced a security breach through an OAuth supply chain attack, stemming from a compromised Context.ai tool, which led to unauthorized access to internal systems and customer data. The attacker exploited a malware infection on a Context.ai employee’s machine to steal OAuth tokens, enabling access to Vercel’s environment by hijacking the employee’s Google Workspace account. The breach exposed non-sensitive environment variables like API keys and credentials, but sensitive data encrypted by Vercel remained secure; some customer accounts showed evidence of prior, unrelated compromises. Vercel is advising immediate security measures, including rotating environment variables, enabling multi-factor authentication, and reviewing…