Good morning. This is your security briefing for Wednesday, March 04, 2026, covering 11 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
SpecterOps has released Nemesis 2.2, an offensive security tool that significantly lowers the barrier for attackers to bypass Windows DPAPI and App-Bound Encryption protections. The tool automates decryption of SYSTEM and user masterkeys, CNG keys, and can extract sensitive data like browser cookies and saved credentials from Chrome, Edge, and other Chromium-based browsers by processing registry hives, LSASS dumps, and credentials.
gen0sec has introduced Jailer, an open-source eBPF-based Mandatory Access Control system for Linux that uses BPF LSM hooks to enforce process containment and role-based policies. The tool restricts file access, network usage, and execution to mitigate threats including path traversal, command injection, reverse shells, and SSRF attacks, though it's currently in active development and not yet production-ready.
SCI Semiconductor has announced ICENI, the first silicon implementation of the CHERIoT architecture, featuring hardware-level memory safety protections including spatial memory safety and use-after-free protection. The chip operates at up to 250 MHz and provides deterministic mitigation of memory safety vulnerabilities like buffer overflows.
Check Point Research reports that Iran-nexus threat actors have intensified targeting of Hikvision and Dahua IP cameras across Israel, Qatar, Bahrain, Kuwait, UAE, Cyprus, Lebanon, and Iraqi Kurdistan since February 28. The activity coincides with physical warfare events and is assessed to support Iranian military operations, including battle damage assessment and pre-missile launch targeting corrections, serving as a potential early indicator of kinetic military activity in the region.
Team Cymru tracked CyberStrikeAI, an AI-native offensive tool developed by China-based individual Ed1s0nZ who has apparent ties to China's Ministry of State Security through affiliations with Knownsec and CNNVD. The tool orchestrates over 100 security tools and was observed targeting Fortinet FortiGate devices, with 21 unique IP addresses running the platform between January and February 2026, primarily hosted in China, Singapore, and Hong Kong.
According to LazyAdmin, Microsoft will automatically enable passkey profiles and synced passkeys in Microsoft Entra ID starting this month, replacing existing FIDO2 configuration. This change affects all Entra ID tenants and introduces the passkeyType property for granular control, requiring administrators to proactively review configurations before auto-enablement to prevent unintended MFA registration campaign changes.
The IETF Trust has published a draft framework for AI agent authentication and authorization that uses existing standards to address security gaps in autonomous AI workloads. The document, draft-klrc-aiagent-auth-00, targets developers and security professionals implementing AI agent systems that interact with LLMs and external tools, aiming to prevent unauthorized access and malicious actions through proper identity management and authorization controls.
Security researchers have released an ASPX web shell tool on GitHub that uses a COFF loader to execute Beacon Object Files on compromised servers. The tool enables in-memory arbitrary code execution on ASPX web applications through a semi-interactive Python client, demonstrating techniques that threat actors could leverage for stealthy post-exploitation activities.
According to the Proofpoint Threat Research Team, law enforcement and private sector partners disrupted Tycoon 2FA today, a phishing-as-a-service platform enabling adversary-in-the-middle attacks to bypass MFA and compromise Microsoft 365 and Gmail accounts. The operation involved infrastructure seizure and legal action against alleged creator Saad Fridi, with the platform having impacted nearly 100,000 organizations globally and enabling credential harvesting and session cookie theft for full account takeover.
The United States Department of Justice, in coordination with Europol and law enforcement agencies from 14 countries, has dismantled LeakBase, one of the world's largest cybercriminal forums with over 142,000 members. The platform hosted an extensive archive of hacked databases containing hundreds of millions of account credentials, credit card numbers, banking information, and personally identifiable information, with law enforcement seizing the LeakBase database and domains to disrupt this critical marketplace for stolen data.
That concludes today's briefing.