InfoSec Briefing - September 03, 2026

🎧 Audio Briefing

Playback Speed:

This is the security briefing for Thursday the 3rd of September 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one today, with 12 stories to get through.

Plume Security Lab have documented how SuperBox streaming devices are being silently enrolled into residential proxy networks without user consent, then weaponised to deliver additional malware. Your home internet connection becomes a proxy node for command-and-control traffic and secondary payloads — infection layering that's difficult to spot or remove.

Check Point Research have published a static deobfuscation method for JSCeal malware, which uses compiled V8 bytecode to evade detection. They've built tooling around the View8 decompiler to reverse engineer the malware without executing it — worth flagging if you're tracking threats to cryptocurrency platforms.

Huntress have written up an abuse campaign targeting the Faronics Deploy IT management platform. Attackers used phishing to trick users into installing the legitimate agent, then leveraged native remote script execution to deploy ScreenConnect and establish persistent access — living-off-the-land evasion throughout.

The U.S. Attorney's Office in Kansas announced guilty pleas from five Venezuelan nationals involved in ATM jackpotting attacks. They used malware to remotely trigger cash dispensing after gaining physical access to install it. FBI reporting shows over 1,900 incidents nationwide since 2020, with 700 in 2025 alone — over 20 million dollars in losses.

And another Teams-based attack — Palo Alto Networks have tracked the 'Spring Ring' campaign, which uses voice phishing through Microsoft Teams to impersonate IT support staff. Attackers exploit the 'Chat with Anyone' feature to establish trust, then deploy remote access trojans or escalate to things like PetitPotam exploitation for relay attacks against domain controllers. If your organisation uses external Teams federation, flag this one.

METR disclosed two incidents from early this year: an API key theft in March where an attacker exploited a fail-open authentication flaw in a researcher's EC2 instance, consuming 600,000 dollars in API credits over three weeks; and a May campaign involving credential stuffing, OAuth token exploitation, and phishing. A bug in a public transcript viewer inadvertently exposed a read-only SQL query mechanism during May, though METR believe it wasn't successfully exploited.

BGPHorizon have documented the Virtualizor incident from late August. Attackers executed a BGP hijacking attack against Hetzner address space used by Softaculous and Virtualizor, using a forged-origin, more-specific prefix technique to bypass RPKI validation, then obtained valid TLS certificates and delivered malicious updates to a subset of Virtualizor installations. We covered the initial compromise on the 2nd — this is the technical post-mortem.

Google are tracking BREEZE COMET, a financially motivated actor targeting Brazilian financial, retail, and eCommerce organisations since 2024. They've gone after core payment infrastructure — Pix, STR, and Boleto systems — and successfully executed at least one heist worth tens of thousands of dollars through direct manipulation of payment switches and banking software.

Microsoft Defender Experts are tracking a deceptive software download campaign with parallels to Silver Fox, using counterfeit vendor websites to distribute multi-stage malware. The campaign primarily targets Chinese-speaking users and multinationals operating in China across healthcare, manufacturing, tech, logistics, government, higher education, and gaming. Sophisticated defence evasion includes disabling Defender, deleting shadow copies, and enabling hands-on-keyboard lateral movement.

Kaspersky Lab have documented Mirage Kitten conducting cyberespionage against aviation and FinTech professionals in the Middle East and Africa. The campaign uses fake job recruitment lures via LinkedIn to deliver NodeRabbit, a cross-platform Node.js-based remote access tool, targeting software engineers in Egypt, Ethiopia, and Afghanistan. It represents a shift to script-based, cross-platform implants hosted on legitimate cloud infrastructure.

Enclave researchers tested seven AI models as autonomous agents attempting to achieve remote code execution against vulnerable software including Grafana, Jenkins, and Nextcloud. Leading models successfully transitioned from vulnerability identification to full exploit execution — top performers like GPT 5.6 Sol handled complex multi-stage attack scenarios within controlled time constraints. One for anyone tracking AI-enabled offensive capabilities.

And finally, researchers demonstrated a side-channel attack where computer monitors can be weaponised as unintended radio transmitters by manipulating pixel patterns and screen refresh rates. By controlling display resolution and refresh timing, the monitor's pixel clock generates electromagnetic interference in VHF and UHF bands that can transmit data — such as Morse code — to nearby radio receivers. Exploits hardware-level electromagnetic emanations to potentially exfiltrate data from air-gapped systems.

That's your briefing for today. The articles are the work of their original authors — the analysis here was automated. We'll be back tomorrow.

📰 Articles Covered

SuperProxy: How Residential Proxy Networks Have Become Malware Delivery Platforms - Plume Design, Inc.

The Plume Security Lab’s research into "SuperProxy" highlights a significant escalation in how residential proxy networks are being weaponized beyond simple bandwidth monetization. The following precis outlines the findings regarding the exploitation of SuperBox streaming devices.

### Overview of Findings
Plume discovered that SuperBox streaming devices are being used as entry points into residential networks. Through pre-installed or bundled applications, these devices silently enroll users into residential proxy networks without their consent or knowledge.

### Key Aspects of the Threat
| Category | Details |
| :--- | :--- |
| **What Happened** | Attackers used residential proxy networks (originally established for monetizing home internet bandwidth) to deliver secondary, more dangerous malware to devices already compromised by the initial proxy enrollment. |
| **Who is Affected** | Owners of SuperBox streaming devices. These devices act as a beachhead, silently turning the user's home internet connection into a proxy node and a target for further infection. |
| **Security Implications** | The primary concern is that once a device is part of a proxy network, it becomes a target for "infection layering." This allows threat actors to silently deploy additional malware families, making it difficult for the average user to detect or remove the threat. |
| **Technical Details** | Researchers identified this activity through reverse engineering, infrastructure analysis, controlled experiments, and live traffic monitoring. The proxy infrastructure provides an ideal, "invisible" channel for command-and-control (C2) communication and payload delivery. |

### What Defenders Should Know
While the research highlights that these devices are inherently insecure, defenders and network administrators should prioritize the following strategies to mitigate the risk:
* **Network Visibility:** Monitor for unusual traffic patterns originating from streaming and IoT devices, particularly traffic directed toward known proxy services or unexpected remote infrastructure.
* **Device Isolation:** Segment IoT and streaming hardware into a separate, restricted network (VLAN) to prevent lateral movement if a device is compromised.
* **Traffic Analysis:** Implement security solutions capable of inspecting encrypted traffic or flagging suspicious connection attempts that are characteristic of proxy nodes (e.g., persistent outbound connections to unknown or suspicious IP ranges).
* **Vulnerability Awareness:** Treat low-cost or "unbranded" streaming hardware with caution, as they frequently lack secure update mechanisms and may come bundled with malicious or unauthorized background processes 【1】.
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse - Huntress

The provided summary captures the essence of the Faronics Deploy abuse campaign described in the Huntress report. Here is the detailed precis organized as requested:

### What Happened
Between July 21 and August 20, 2026, threat actors executed a campaign abusing the legitimate IT management platform **Faronics Deploy**. By masquerading as common business tools or documents via phishing emails, attackers tricked users into installing the Faronics agent. Once installed, the attackers utilized the platform's native administrative capabilities—specifically its remote script execution feature—to deploy secondary payloads, such as ScreenConnect, to maintain long-term access and control over the compromised endpoints.

### Who is Affected
Organizations with endpoints that were successfully targeted via these phishing campaigns. Because the attackers used a legitimate management tool to deliver their payload, the activity was often difficult to distinguish from standard IT administration workflows, potentially impacting any organization that does not strictly whitelist or monitor RMM (Remote Monitoring and Management) tool installations.

### Security Implications
* **Trust Exploitation:** The attack relies on "living-off-the-land" (LotL) tactics by using a trusted software platform to bypass security controls that would otherwise block unknown binaries.
* **Persistent Administrative Access:** The Faronics agent grants attackers high-level remote management privileges by design. Once the endpoint is enrolled in the actor-controlled Faronics deployment, they have a reliable, persistent backdoor.
* **Detection Evasion:** Because the primary malicious activity occurs through the legitimate Faronics infrastructure, traditional signature-based security tools often failed to flag the activity as malicious.

### Technical Details
* **Delivery & Cloaking:** Phishing emails directed users to signed Faronics installers. The attackers employed visitor-based cloaking; the delivery mechanism used browser fingerprinting to determine whether to serve the malicious installer or a benign decoy page to potential targets.
* **Execution Chain:** After installation, the endpoint is enrolled in the threat actor’s Faronics dashboard. Attackers then used the **ScriptRunner** functionality to execute PowerShell commands, which typically pulled and executed secondary tools (e.g., ScreenConnect) from hosted repositories like GitHub.
* **Key Indicators of Compromise (IOCs):**
* **Logs:** The file `C:\ProgramData\Faronics\Logs\ScriptRunner.log` is a critical artifact, as it records the remote scripts executed by the platform.
* **Networking:** The `ck` identifier found in configuration requests is a unique customer/deployment ID that can be used to link affected endpoints to the specific malicious Faronics infrastructure.

### What Defenders Should Know
* **Audit Software Inventory:** Proactively search for and verify the legitimacy of any Faronics Deploy agents installed in the environment.
* **Log Analysis:** Scrutinize `ScriptRunner.log` on any systems running Faronics for evidence of unauthorized PowerShell execution, unexpected external downloads, or the installation of remote access tools (e.g., ScreenConnect/ConnectWise).
* **Network Hunting:** Investigate network traffic for the `ck` identifier to map out potential clusters of compromised endpoints.
* **Response Actions:** If abuse is identified, isolate the affected systems, remove unauthorized RMM instances, conduct an audit for subsequent attacker activity, and perform a credential reset for accounts accessible from the compromised machines.
* **Reporting:** Organizations that detect abuse of this platform should report the findings directly to Faronics support at `support@faronics.com`.
FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs - United States Attorney's Office for the District of Kansas

This precis outlines the details of a recent federal case involving ATM "jackpotting," a growing criminal threat to financial infrastructure.

### What Happened
In December 2025, five Venezuelan nationals traveled from Indiana to Kansas to execute a series of ATM jackpotting attacks in Wamego and Manhattan. Their operation relied on a multi-stage approach:
1. **Physical Access:** A conspirator would physically gain access to the ATM to install malicious software.
2. **Remote Activation:** Once the malware was installed, the group intended to remotely send commands to the machine, forcing it to dispense all contained cash, which they would then collect.

The attempted attacks in Kansas were unsuccessful, and the group subsequently pleaded guilty to federal charges 【1】.

### Who Is Affected
* **Primary Targets:** Banks and financial institutions operating ATMs are the direct targets of these attacks 【1】.
* **Scope:** The threat is nationwide. An FBI report from February 2026 noted over 1,900 incidents since 2020, with 700 incidents in 2025 alone, resulting in over $20 million in losses 【1】.

### Security Implications
Jackpotting allows attackers to bypass standard banking authentication, effectively stealing money without performing legitimate transactions. This leaves institutions with significant financial losses and the complex task of forensic analysis to determine how the machines were compromised 【1】. The trend indicates that criminal groups are specifically scouting for and targeting ATM models they perceive as inherently vulnerable to malware 【1】.

### Technical Details
* **Mechanism:** The attack requires the installation of malicious software into the ATM's internal systems 【1】.
* **Control:** The malware acts as a backdoor that allows for remote triggering of the machine's cash dispensing mechanisms, enabling unauthorized removal of funds without triggering standard transaction logs or alerts associated with customer activity 【1】.

### What Defenders Should Know
* **Proactive Upgrades:** Law enforcement emphasizes that there is existing technology designed to thwart jackpotting. Financial institutions are strongly encouraged to invest in these security updates to harden their machines against unauthorized physical and digital interference 【1】.
* **Vulnerability Management:** Since attackers target machines they believe to be vulnerable, a comprehensive security posture must include regular assessments of physical security (to prevent malware installation) and software security (to prevent the execution of malicious commands).
* **Engagement:** The U.S. Attorney’s Office and the FBI are actively engaging with financial institutions to share information on how to implement these necessary defensive updates 【1】.
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams - Palo Alto Networks

The "Spring Ring" campaign is a sophisticated voice phishing (vishing) operation that leverages collaboration platforms—specifically Microsoft Teams—to compromise organizational security. By exploiting the inherent trust users place in these tools, attackers transition from social engineering to high-impact technical exploits, including domain controller compromise.

### Executive Summary
The campaign involves adversaries initiating unsolicited chats and voice calls with employees, masquerading as IT help desk or support personnel. By weaponizing the "Chat with Anyone" feature in Microsoft Teams, the attackers bypass traditional email-based security filters and engage victims in real-time, human-led deception to facilitate malware installation or credential harvesting.

### Who is Affected
The campaign primarily targets employees within organizations that use Microsoft Teams and have the "Chat with Anyone" (external communication) feature enabled. Attackers specifically seek out users who have administrative or elevated access, aiming to pivot from a single endpoint compromise to domain-level control.

### Technical Details
The attack typically follows two distinct operational paths once trust is established via voice call:

* **Campaign A (Remote Access):** Attackers coerce the victim into executing legitimate Remote Monitoring and Management (RMM) tools. Once remote access is established, the attackers deploy an obfuscated PowerShell-based remote access Trojan (RAT) to maintain persistence and control.
* **Campaign B (Advanced Exploitation):** This path is more complex, involving the following chain:
* **Browser Hijacking:** Victims are directed to malicious cloud endpoints to download an executable.
* **Lateral Movement:** The payload enables SMB scanning to identify internal assets.
* **NTLM Relay Attack:** The attackers utilize the **PetitPotam** exploit to force the organization's domain controller to authenticate against an attacker-controlled server, facilitating an NTLM relay attack to gain domain administrator privileges.

### Security Implications
This campaign demonstrates a shift from passive phishing tactics to active, conversational engagement. By abusing trusted communication channels, adversaries can dynamically adapt their social engineering tactics based on the victim's responses. The most critical implication is the escalation from a successful phish to full domain compromise through NTLM relay techniques, which can provide attackers with near-total control over the targeted IT environment.

### Defensive Guidance
Defenders should implement the following strategies to mitigate these risks:

| Monitoring Focus | Key Indicators |
| :--- | :--- |
| **Interaction Metadata** | Monitor for rapid transitions from external 1:1 chat requests to voice calls, and high-frequency, short-duration targeting of multiple internal identities. |
| **Identity/Persona** | Audit external `.onmicrosoft.com` tenants, particularly those using names mimicking internal support functions like "IT Help Desk" or "Infrastructure Support." |
| **Execution Behavior** | Watch for the unauthorized execution of RMM tools, unexpected access to external cloud storage URLs, and anomalous NTLM/SMB traffic originating from endpoints. |
| **Policy Enforcement** | Tighten Microsoft Teams external access policies to restrict communication with unverified external domains and provide targeted user training on the risks of unsolicited external collaboration requests. |
Update on Security at METR - METR

This report outlines two cybersecurity incidents involving METR that occurred in early 2026. METR reports that no highly sensitive data (categories 3 or 4) was accessed or compromised during these events 【1】.

### Summary of Incidents

| Incident | Date | Details |
| :--- | :--- | :--- |
| **API Key Theft** | March 2026 | A researcher inadvertently exposed an API key via a "vibe-coded" app hosted on a personal EC2 instance with a fail-open authentication vulnerability. The instance was discovered by an attacker scanning certificate transparency lists for LLM/agent-related keywords 【1】【1】. |
| **Infrastructure Probing** | May 2026 | A sustained, likely financially motivated, attack campaign targeted METR’s infrastructure using automated agents to attempt credential stuffing, OAuth token exploitation, and phishing 【1】. |

### Incident Details and Impact

* **API Key Theft (March):** The attacker used the stolen API key to impersonate an agent and gain persistent access via an SSH key. Over three weeks, they consumed approximately $600,000 worth of API credits (provided to METR for free). The incident went undetected initially due to high legitimate traffic volumes, a lack of alerts for rate-limited requests, and the absence of spending limits on the affected keys 【1】.
* **Infrastructure Probing (May):** During the reconnaissance campaign, a bug in a public transcript viewer inadvertently exposed a read-only SQL query mechanism. While scoped to public data by default, this bug could have potentially allowed access to sensitive (Category 3) evaluation data. The vulnerability was discovered and reported by an independent security researcher; METR believes the attackers probed the endpoint but did not successfully exploit this specific bug 【1】.

### Security Implications
While sensitive model data remained secure, these incidents highlighted significant gaps in METR’s infrastructure security and monitoring. The primary implications were the financial loss of API credits and the exposure of the organization’s attack surface to automated reconnaissance and agentic exploitation tools.

### What Defenders Should Know
METR has implemented several corrective measures that serve as guidance for organizations handling similar research environments:

* **Architectural Separation:** Isolate public-facing production environments from internal infrastructure to ensure that misconfigurations in public services cannot lead to internal data exposure 【1】.
* **Credential Management:** Prohibit the use of internal credentials or data on personal/non-METR infrastructure. Reduce credential longevity and scope permissions strictly 【1】【1】.
* **Proactive Monitoring:** Implement spend alerts on all API keys and monitor for anomalous usage patterns. Increase logging coverage across databases, API endpoints, and other critical services 【1】【1】.
* **Process & Review:** Formalize security reviews for any public-facing deployments and conduct regular threat modeling to identify and reduce the attack surface (e.g., shutting down legacy infrastructure) 【1】【1】.
The August 2026 Virtualizor Incident in BGPHorizon - BGPHorizon

Based on the report, here is a detailed precis of the BGP hijacking incident targeting Softaculous and Virtualizor in August 2026.

### Executive Summary: What Happened
Between August 28 and August 30, 2026, address space belonging to Hetzner—specifically used by Softaculous and Virtualizor—was subjected to a BGP hijacking attack. The incident involved two distinct waves of activity spanning approximately 33 hours, during which traffic destined for these services was diverted to attacker-controlled infrastructure.

### Who Is Affected
* **Primary Victims:** Softaculous and Virtualizor infrastructure.
* **Secondary Impact:** A small, specific subset of Virtualizor installations received a malicious update package distributed by the attackers.

### Security Implications
The primary danger of this hijack was its capacity to facilitate downstream attacks by intercepting traffic seamlessly:
* **Certificate Fraud:** Attackers successfully obtained technically valid TLS certificates for the targeted domains, allowing them to impersonate the services and potentially decrypt or intercept secure traffic.
* **Malicious Updates:** The attackers utilized the diverted traffic to deliver compromised update packages, posing a direct threat to the integrity of affected Virtualizor environments.

### Technical Details
The attack employed a sophisticated "forged-origin, more-specific" BGP hijacking technique designed to bypass common routing security validations:
* **Bypassing RPKI:** The attacker performed a "forged-origin" attack, maintaining the legitimate origin (AS24940, Hetzner) at the end of the AS path. This ensured the announcement remained "RPKI-valid" and avoided standard MOAS (Multiple Origin AS) conflict flags.
* **Routing Preference:** By announcing a `/24` prefix inside Hetzner’s existing `/16` block, the attacker leveraged the BGP preference for "more-specific" prefixes, forcing global traffic to route toward their infrastructure.
* **Propagation Path:** The malicious route was propagated through AS62390 (NexonHost) via transit provider AS6204 (Zet.net), exhibiting an AS-path structure ending in `... 6204 62390 24940`.

### What Defenders Should Know
The incident demonstrates that standard BGP security measures are insufficient against highly targeted, stealthy manipulations:
* **RPKI Limitations:** While RPKI Route Origin Validation (ROV) is a standard defense, it does not stop forged-origin, more-specific attacks if the ROA (Route Origin Authorization) matches the origin AS listed in the path.
* **Monitor for Anomalies:** The most effective detection method in this instance was flagging that the `/24` prefix had no history in the global routing table.
* **Strategic Recommendation:** Defenders should implement real-time monitoring specifically focused on their address space to detect *new* or *previously unseen* more-specific prefixes that the organization did not originate itself. Rapid detection is critical to stopping these hijacks before they can be leveraged for secondary exploitation like certificate fraud or supply-chain attacks.
Financially Motivated Threat Actor BREEZE COMET Targets Brazil - Google

The financially motivated threat actor **BREEZE COMET** (formerly tracked as UNC5669) has been conducting sophisticated campaigns targeting Brazilian financial, retail, and eCommerce organizations since 2024. Their primary objective is to manipulate payment systems and banking software to execute fraudulent transfers 【1】.

### What Happened
BREEZE COMET has shifted from traditional, high-volume retail banking fraud toward direct, high-impact intrusions into core financial switch and instant payment infrastructure (e.g., Pix, STR, and Boleto) 【1】. They have successfully executed at least one heist resulting in the theft of tens of thousands of USD 【1】.

### Who Is Affected
The threat actor targets entities with permission to conduct transactions through critical banking software, APIs, and payment systems. This includes:
* Banks and payment processors
* Retailers and eCommerce organizations
* Financial exchanges
* Fintech and banking software providers 【1】

### Security Implications
This actor represents a maturation in regional cybercrime, characterized by:
* **Operational Maturity:** Usage of custom multi-language malware (Rust, Nim, Go, Java) alongside AI-accelerated operational scripts to compress development lifecycles 【1】.
* **AI Integration:** Utilizing Large Language Models (LLMs) to generate bespoke reconnaissance scripts, validate credentials, and automate deployment workflows 【1】.
* **Persistence & Evasion:** The group maintains deep access to AD and cloud environments, specifically targeting CI/CD pipelines to steal highly privileged API keys and tokens 【1】.

### Technical Details
BREEZE COMET utilizes a redundant, multi-tiered architecture of custom backdoors:
* **Network Access:** **COBALTSPIN** (Rust) acts as a lightweight, evasive network tunneler (reverse SOCKS5 proxy) that bypasses firewalls 【1】.
* **Persistence & Backdoors:**
* **LIGHTPAINT:** Java-based backdoor that installs/configures VPNs while clearing forensic logs 【1】.
* **MILDFROST:** Passive Java JAR backdoor for covert DNS tunneling 【1】.
* **KICKPLATE:** Nim-based backdoor impersonating Windows Update Health Tools 【1】.
* **BOATBEAM:** Golang backdoor masquerading as an IIS HTTPS server on port 443 【1】.
* **Initial Access:** Methods include password spraying, social engineering (voice calls), compromising government websites to host malware, and connecting rogue hardware directly to physical networks 【1】.

### What Defenders Should Know
Defenders should prioritize hardening their environments against these specific tactics:
* **Network & Physical Security:** Implement 802.1X Network Access Control (NAC) on physical ports and physically secure networking closets to prevent unauthorized hardware connection 【1】.
* **Endpoint & Cloud Control:** Enforce application control (e.g., WDAC, fapolicyd) to block execution in writable directories. Implement strict Kubernetes RBAC and use dynamic admission controllers to prevent privileged container execution 【1】.
* **Credential & Secret Management:** Mandate centralized secret management (e.g., HashiCorp Vault) to remove hard-coded keys and enforce phishing-resistant MFA across all external-facing portals 【1】.
* **Visibility:** Perform SSL/TLS decryption and Deep Packet Inspection (DPI) on outbound traffic, and monitor for unauthorized service registration or RMM tool usage 【1】.
Counterfeit installers to system compromise: Tracking a deceptive software download campaign - Microsoft

The article outlines a deceptive software download campaign currently being tracked by Microsoft Defender Experts. The activity, which shows strong parallels to the "Silver Fox" (Yinhu) campaign, involves the use of high-fidelity counterfeit websites to distribute malicious installers.

### What Happened
Threat actors are deploying sophisticated, spoofed versions of legitimate vendor websites to deceive users into downloading malicious archives. Upon execution, these installers deploy persistent, multi-stage malware that establishes a foothold, performs privilege escalation, and enables "hands-on-keyboard" adversary activity.

### Affected Parties
The campaign is heavily concentrated on users in China, particularly targeting Chinese-speaking individuals and the local operations of multinational corporations. The scope of impact is broad, affecting multiple sectors, including:
* Healthcare and Manufacturing
* Technology and Logistics
* Government and Higher Education
* Gaming

### Security Implications
The primary security risk is full system compromise. Because the campaign incorporates human-operated activity alongside automated processes, attackers can conduct deep reconnaissance, move laterally, and exfiltrate sensitive data. Furthermore, the malware actively degrades the target's security posture by disabling defensive tools.

### Technical Details
* **Delivery:** Attackers utilize look-alike domains—predominantly `.com.cn` or `.hl.cn`—to host malicious archives. A defining technical feature is **server-side payload regeneration**, where files are dynamically regenerated for each request, ensuring that file hashes are never static.
* **Execution & Persistence:** Payloads are dropped into system or world-writable directories using wrapper installers or `msiexec.exe`. Persistence is achieved through disguised scheduled tasks, while privilege escalation is utilized to achieve SYSTEM-level access.
* **Defense Evasion:** The threat is designed to actively neutralize host security. It systematically adds Microsoft Defender path exclusions, deletes volume shadow copies, uses `icacls` to restrict access to malicious directories, and disables Windows Update components.
* **Command and Control (C2):** Communication occurs over non-standard ports. Attackers have also been observed leveraging cloud object storage (specifically Alibaba Cloud OSS) for staging malicious payloads.

### Guidance for Defenders
Defenders should shift away from indicator-of-compromise (IOC) based detection, such as file hashes, due to the attackers' use of randomization. Instead, they should focus on the following behavioral patterns:

* **Behavioral Hunting:**
* Look for specific file drop patterns in directories like `C:\Users\Public\` or `C:\Program Files (x86)\`.
* Monitor for masquerading techniques, such as the use of the "Philips Speech Driver."
* Identify tamper sequences: specifically the creation and immediate deletion of SYSTEM-level scheduled tasks that modify security settings, as well as routines that stop Windows Update or execute `vssadmin` shadow copy deletions.
* **Hardening & Protection:**
* **Tamper Protection:** Prioritize enforcing this to prevent unauthorized modifications to Defender settings and registry entries.
* **ASR Rules:** Implement Attack Surface Reduction rules designed to block executable files from untrusted sources, stop obfuscated scripts, and prevent the abuse of impersonated system tools.
* **Network Controls:** Block known delivery paths (such as `/712down` or `/73inst`) and correlate download referrer URLs to identify potential spoofed landing pages.
Mirage Kitten switches to Node.js and JavaScript malware - AO Kaspersky Lab

The report on the Mirage Kitten campaign details a sophisticated shift in the threat actor's methodology, moving toward cross-platform, script-based implants to compromise high-value targets. Below is a detailed precis of the findings.

### **What Happened**
The APT group Mirage Kitten has launched a cyberespionage campaign targeting professionals by masquerading as recruiters. The group utilizes social engineering on platforms like **LinkedIn** to contact software engineers, under the guise of offering job opportunities. Targets are lured into completing a "technical assessment" that requires them to download and execute a trojanized coding challenge archive hosted on legitimate cloud services like **Amazon S3**. This process infects the victim's machine with new backdoors designed to persist and provide remote access.

### **Who Is Affected**
* **Target Sectors:** Aviation and FinTech industries.
* **Geographic Focus:** The Middle East and Africa, specifically victims identified in **Egypt, Ethiopia, and Afghanistan**.
* **Specific Targets:** Software engineers and developers working within these critical sectors.

### **Security Implications**
This campaign demonstrates a strategic pivot from traditional native malware to **cross-platform Node.js and JavaScript-based implants**. By leveraging developer-centric tools and workflows (such as npm packages and coding assessments), the attackers successfully blend malicious activity into legitimate tasks, making detection significantly more difficult. The use of reputable infrastructure (Azure, Cloudflare, AWS) for command-and-control (C2) further allows them to bypass traditional network-based security controls.

### **Technical Details**
The campaign introduces two primary remote access trojans (RATs):
* **NodeRabbit:** A cross-platform Node.js RAT targeting Windows, Linux, and macOS.
* **Distribution:** Delivered through malicious npm packages (`colorized_terminal` or `pretty-log`).
* **Persistence:** Uses sophisticated techniques, such as masquerading as "Intel Driver & Support Assistant" or installing malicious VS Code extensions.
* **Capabilities:** Host info harvesting, arbitrary shell execution, file system manipulation, and proxy-aware C2 communication.
* **PollCat:** A JavaScript-based RAT.
* **Capabilities:** Features a comprehensive set of 22 commands, including `EVAL_JS`, which allows for arbitrary script execution.
* **Origin:** Shares significant architectural lineage with the group’s older native backdoors (`MiniFast`/`Retrograde`), including the structure of C2 handshakes and beacon timing patterns.

### **Guidance for Defenders**
* **Vigilance:** Organizations should educate employees, especially developers, on the risks of unsolicited job offers that require downloading and executing external code archives.
* **Code Inspection:** Implement mandatory manual or automated security reviews for all incoming code projects, specifically checking for suspicious imports, unknown npm packages, or injected Git hooks.
* **Network Monitoring:** Monitor for unusual traffic patterns, particularly connections directed to **Azure Websites** and **Cloudflare-backed domains** that attempt to mimic legitimate organizational infrastructure.
* **Detection:** Utilize existing security signatures; Kaspersky identifies this specific activity as `Trojan.JS.MirageKitten.*`.
* **IoCs:** Organizations should cross-reference their network and endpoint logs against the [full list of indicators of compromise](https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/#indicators-of-compromise), including specific file hashes and C2 domains identified by the researchers.
Enclave: We Raced Seven AI Models to RCE - Enclave

The article from Enclave documents an evaluation of the autonomous offensive security capabilities of seven prominent AI models. By tasking these models with achieving Remote Code Execution (RCE) against isolated, vulnerable software, the researchers aimed to quantify how effectively AI can transition from simply identifying vulnerabilities to successfully exploiting them.

### What Happened
Enclave designed a controlled environment to test seven AI models acting as autonomous agents. Each model was provided with the target software's source code, a low-privilege user account, and a Bash tool for interaction. The goal was to find, exploit, and verify a vulnerability (via a flag submission) within a 30-minute time limit, with each individual command restricted to 120 seconds. The test suite included 11 vulnerable targets (Grafana, Jenkins, and Nextcloud) and four patched "control" versions to ensure the models were not generating false positives.

### Who Is Affected
While this was a controlled experiment, the results have broad implications for **software maintainers, cybersecurity defenders, and organizations** utilizing the tested platforms (Grafana, Jenkins, and Nextcloud). The study highlights that AI-driven exploitation is no longer theoretical but is becoming a functional capability, posing a future risk to any organization with publicly accessible or exploitable software components.

### Security Implications
* **Transition to Autonomous RCE:** The study confirms that leading AI models are capable of moving beyond basic bug discovery to active, autonomous exploitation.
* **Operational Sophistication:** High-performing models (e.g., GPT 5.6 Sol) demonstrated the ability to handle complex, multi-stage attack scenarios, such as manipulating symbolic links to win race conditions in Jenkins.
* **Chain Execution:** The primary threat lies in the model's ability to chain multiple actions to achieve an end-to-end exploit, which is significantly more dangerous than isolated vulnerability identification.

### Technical Details
The research identified that success requires a distinct, three-phase process:
1. **Finding:** Models that performed well were adept at narrowing the search space by tracing backward from controllable inputs to sensitive code paths.
2. **Exploitation:** Successfully turning a bug into a functional attack required high levels of planning.
3. **Verification:** The agent had to maintain the target's state long enough to finalize the exploit chain.

A critical observation was that "more is less" in some cases: models that issued more commands or took longer often failed due to poor control over the exploit chain, such as self-sabotaging through timing issues (e.g., an agent deleting its own exploit code in a Nextcloud scenario). The most successful models typically created local, small-scale test cases to verify their exploit theory before attempting the final action against the target.

### What Defenders Should Know
* **Focus on the Entire Chain:** Because automated exploit generation is becoming viable, defense strategies must shift from focusing solely on vulnerability identification to hardening the entire lifecycle from initial input to execution.
* **Monitor Probing Behavior:** Since successful agents often test their theories locally before launching the final exploit, defenders should monitor for patterns of systematic, localized probing.
* **Exploits are Fragile:** Agents frequently fail at the verification or maintenance stages due to state management or timing issues. This suggests that complex, multi-step exploits remain brittle and difficult for AI to execute reliably.
* **Prioritize Defense-in-Depth:** Given that these agents succeed by chaining actions, defenders should focus on limiting the blast radius of post-access activity and maintaining rigorous patching schedules for known vulnerabilities.
vhf-morse-transmitter-monitor: Set radio to 148.500 MHz, selct FM, USB, or CW, set squelch to 0 or 1. xtend your radio's antenna toward monitor's HDMI - now transmit in Morse code from your monitor! - Efe Işık

This project explores a side-channel security vulnerability where standard computer monitors can inadvertently function as unintended radio transmitters. By manipulating pixel patterns and screen refresh timings, the monitor emits electromagnetic interference (EMI) that can be intercepted by nearby radio receivers.

### What Happened
The researchers demonstrated that by carefully controlling the screen resolution and refresh rate, the pixel clock frequency of a computer monitor—which drives the HDMI or DisplayPort signal—can be tuned to match frequencies within the VHF and UHF bands. By displaying specific high-contrast, flashing patterns (e.g., Morse code), the monitor generates modulated electromagnetic emissions that act as a low-power, short-range radio transmitter.

### Who Is Affected
* **Users:** Individuals using standard consumer-grade computer displays are susceptible to this unintentional signal leakage.
* **Photosensitive Individuals:** The exploit relies on high-frequency, high-contrast screen flashing, which poses a significant health risk to individuals with photosensitive epilepsy or related conditions.
* **Regulatory Compliance:** Anyone utilizing this technique must be aware of, and adhere to, local radio frequency (RF) regulations, as unauthorized transmissions—even accidental ones—may violate telecommunications laws.

### Security Implications
This project highlights a **side-channel attack** vector. Because the emission is a byproduct of high-speed digital signaling (the pixel clock), it is difficult to mitigate via traditional software security patches. It demonstrates that hardware, even when operating "normally," can leak sensitive data through electromagnetic emanations, potentially bypassing air-gapped systems if an attacker can control the screen content.

### Technical Details
The fundamental emission frequency ($f_{\text{pixel}}$) is determined by the video timing parameters of the monitor:
$$f_{\text{pixel}} = H_{\text{total}} \times V_{\text{total}} \times f_{\text{refresh}}$$

By adjusting the display's resolution and refresh rate, the pixel clock can be aligned with specific radio bands. Examples provided in the research include:

| Resolution | Refresh Rate | Fundamental Frequency | Target Band |
| :--- | :--- | :--- | :--- |
| 1920 x 1080 | 60 Hz | 148.500 MHz | VHF Amateur (2m) |
| 1920 x 1080 | 144 Hz | 356.400 MHz | UHF Military/Aviation |
| 2560 x 1440 | 60 Hz | 241.500 MHz | VHF High |
| 1280 x 720 | 60 Hz | 74.250 MHz | VHF Low (4m) |

### What Defenders Should Know
* **Detection:** Monitoring for this vulnerability involves using an SDR (Software Defined Radio) or a standard radio receiver.
* **Configuration:** To intercept these signals, the receiver should be tuned to the calculated $f_{\text{pixel}}$ frequency, set to a wide filter bandwidth, and have squelch disabled.
* **Proximity:** The signal strength is generally low, typically requiring the receiver antenna to be placed in very close proximity (e.g., directly behind the monitor, near the display input connectors) to achieve reliable reception.
* **Mitigation:** Because this is an inherent property of high-speed digital video signaling, defense-in-depth strategies are required, such as physical shielding (Faraday cages) for high-security environments, or the use of higher-quality, shielded display cables to minimize EMI leakage.
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - Check Point Research

The summary provided accurately covers the technical analysis and security implications of the JSCeal malware research as detailed by Check Point Research.

As noted, the primary breakthrough in this analysis is the ability to perform **static deobfuscation** on compiled V8 bytecode (`.jsc` files). By utilizing the **View8** decompiler and a customized pipeline, security researchers can now bypass the malware's obfuscation layers—such as string encryption and control-flow flattening—without needing to execute the malicious code in a sandbox.

### Key Takeaways for Defenders:
* **Static Analysis Superiority:** Given that JSCeal is designed to evade traditional dynamic analysis and sandboxing, moving toward static deobfuscation of V8 bytecode is essential for effective reverse engineering.
* **Tool Utilization:** Defenders and security analysts can leverage the [jsc\_deobfuscator](https://github.com/hasherezade/jsc_deobfuscator) toolkit provided by the researchers to dismantle future iterations of this or similar V8-based threats.
* **Threat Surface:** Because the malware targets specific cryptocurrency platforms (e.g., Binance, Bybit, Ledger) through HTTPS MITM proxying and session hijacking, defensive efforts should prioritize:
* Monitoring for unauthorized installation of root certificates.
* Identifying malicious Node.js runtime artifacts on end-user machines.
* Implementing strict endpoint controls over browsers and cryptocurrency wallet applications.

If you require deeper technical analysis on specific components of the deobfuscation pipeline or further details on the malware's evolution, please let me know.