This is the security briefing for Tuesday the 25th of August 2026, drawn from the BlueTeamSec community on infosec.pub. Fifteen stories to get through today.
New Zealand's National Cyber Security Centre published their Q2 report, showing stable incident numbers but increasing complexity — ninety-two cases needed specialist support. Key trends include malware scams using social engineering and quishing attacks, with one example being tampered parking meters in Christchurch that directed victims to fake QR codes.
Synacktiv released a comprehensive forensics framework for AWS EKS environments, covering control plane, data plane, and infrastructure layers. The guide emphasises proactive logging and tackles the challenge of investigating ephemeral Kubernetes workloads — one for incident responders working in cloud-native environments.
Jeffrey Appel documented methods for auditing Microsoft Defender and Intune configuration changes, addressing a platform limitation where unauthorised policy modifications lack native alerting. The article recommends using Infrastructure as Code and detection queries to spot configuration drift — particularly relevant if you're running these platforms at scale.
Irregular Research evaluated the Kimi K3 open-weight AI model against offensive security benchmarks and found it achieved capabilities previously limited to closed-source frontier models. It successfully completed advanced challenges including cryptographic attacks and multi-stage operations, though it still lags behind top-tier closed models in sustained long-horizon attacks.
TrendAI detailed an npm supply chain attack delivering RedShell, a Linux implant from the RedC2 framework. The malicious packages bypassed ignore-scripts protections by embedding execution directly in module code, delivering a sophisticated tool with AI-enhanced command capabilities. Worth flagging if you're managing developer environments with Linux or WSL.
And another npm campaign — CloudSEK documented BridgeHead, which used typosquatting to target developers using Windows Subsystem for Linux. When installed, the packages detected WSL environments and crossed the isolation boundary to steal cryptocurrency wallets and credentials from the host Windows system. We've seen similar supply chain activity in the Rust ecosystem recently.
A security researcher released Rogue-Framework, an open-source desktop tool integrating the AFL++ fuzzer and Ghidra into a unified interface for vulnerability research. It's designed for exploit developers working on Linux, with transparent project management and human-readable configurations — one for those doing serious vulnerability research.
Aikido benchmarked ten AI models across nearly twelve billion tokens to identify vulnerabilities in real codebases, finding that open-weight models like DeepSeek and GLM now match or exceed frontier closed models. DeepSeek achieved the highest recall at twenty-eight out of thirty-two known vulnerabilities, which is notable given the resource disparity.
A technical demonstration published in tmpout volume five showcases Perl code obfuscation through keyword scrambling. The script dynamically shuffles Perl keywords to evade static analysis — not malicious itself, but the technique is commonly used by malware authors to frustrate reverse engineering.
Corelight published a three-part series on improving Zeek package testing. Part three describes using the Input Framework to replay months of historical logs instead of relying on short PCAPs, helping developers identify intermittent bugs. Part two outlines methods for testing detection logic without external PCAP files, using event generation and trace replay. And part one discusses moving away from PCAP-based testing to code-level unit testing. Useful background if you're developing or maintaining Zeek packages.
A new open-source tool called natural-language-nmap converts plain language queries into Nmap commands using a locally-hosted small language model. It's CPU-only and designed for security professionals who'd rather not memorise complex syntax — straightforward utility for reconnaissance tasks.
Ali Mosajjal released fortitool, an open-source utility that decrypts configuration secrets from Fortinet FortiOS firmware images. The research reveals that a hardcoded encryption key from a twenty nineteen vulnerability remained functional through version seven point two point three, and discovered a new undisclosed hardcoded key in version seven point four. This follows earlier supply chain activity involving the vendor that we covered earlier this month.
NetbyteSEC documented a sophisticated ClickFix crimekit campaign targeting macOS users through social engineering. Victims are tricked into manually executing malicious commands in Terminal, which then deploys AMOS stealer, XMRig miner, and remote shells. The malware uses smart contracts on the Polygon blockchain for dynamic C2 resolution, bypassing Gatekeeper through user-initiated execution.
And that's your briefing for today. Attribution goes to the original authors — the analysis here was automated.