Fake Claude Code ads deliver AMOS and persistent access on Macs
Mate Research describes fake Claude Code search ads leading to AMOS infections on developers’ Macs.
Threat intelligence, decoded.
Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
// Latest reporting
UAT-11473: KeyDrift implants on Cisco SD-WAN controllers
Talos’s UAT-11473 cluster, KeyDrift controller implants and overlap with Silent Train: verified mechanics, attribution limits and defensive priorities.
Volt Typhoon: Silent Train, management-plane access and recovery
Volt Typhoon’s Silent Train network and management-plane targeting, with vendor-specific aliases, separate exploitation clocks and evidence-led detection and recovery priorities.
Interlock: appliance exploitation, ransomware and recovery
Interlock’s appliance exploitation, credential theft and hypervisor attacks: verified case timelines, attribution limits and practical recovery priorities.
SANS reports SSH scanning associated with Sshole exploitation
SANS observes unusual SSH authentication attempts, with important limits on what its honeypot data establishes.
Qubes says November Xen advisories do not affect its security
Qubes distinguishes its own security impact from the existence of new Xen advisories; the listed batch requires no user action.
Microsoft reports ARTEX attacks against financial organisations
Microsoft links Storm-3358 to ARTEX-assisted attacks against financial organisations. The report describes exposed web systems, remote-access tooling and practical defensive signals.
European refrigeration attacks: exposed controllers and the limits of attribution
Unit 42 reviews European refrigeration attacks and exposed controllers. Exposure counts are not victim counts, and the initial access route remains unconfirmed.
Exposed OAuth secrets give AI-assisted attackers a route into cloud tenants
Microsoft reports agents finding public secrets and abusing application identities. Removing a leaked secret from code is insufficient: investigate access and revoke or rotate the credentials.
Microsoft Q3 email findings: security exceptions can defeat successful detection
Microsoft’s Q3 email research highlights malicious messages passing through security overrides. Review exception scope alongside phishing and collaboration controls.
Talos Q3 revision: telecom attribution and the defensive findings that remain
Talos’s revised Q3 report narrows its telecom attribution. What changed, what the caseload figures still establish and which defensive priorities follow.
Node.js announces high-severity security releases for 11 November
Node.js has announced forthcoming security updates for its 26.x, 24.x and 22.x lines. Prepare deployment inventories; the notice does not yet provide CVEs or fixed release numbers.