BluePhishing demonstrates consent abuse against Entra agent blueprints
Proofpoint’s BluePhishing research describes social engineering against Microsoft Entra agent-blueprint consent.
Threat intelligence, decoded.
Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
// Latest reporting
Fake Claude Code ads deliver AMOS and persistent access on Macs
Mate Research describes fake Claude Code search ads leading to AMOS infections on developers’ Macs.
Recorteiro: Rust banking malware turns fake electricity bills into live fraud
Pedro Tavares reports a Portugal-targeting campaign in which fake electricity invoices deliver Recorteiro, a Rust banking trojan also described using the WindowsHelpers and CryptoPRO-X names.
SectopRAT loaders: custom bytecode, GPU decryption and EtherHiding
ExaTrack’s 5 November analysis describes a SectopRAT delivery chain using VMLoader and GPULoader.
UAT-11473: KeyDrift implants on Cisco SD-WAN controllers
Talos’s UAT-11473 cluster, KeyDrift controller implants and overlap with Silent Train: verified mechanics, attribution limits and defensive priorities.
Volt Typhoon: Silent Train, management-plane access and recovery
Volt Typhoon’s Silent Train network and management-plane targeting, with vendor-specific aliases, separate exploitation clocks and evidence-led detection and recovery priorities.
Interlock: appliance exploitation, ransomware and recovery
Interlock’s appliance exploitation, credential theft and hypervisor attacks: verified case timelines, attribution limits and practical recovery priorities.
SANS reports SSH scanning associated with Sshole exploitation
SANS observes unusual SSH authentication attempts, with important limits on what its honeypot data establishes.
Qubes says November Xen advisories do not affect its security
Qubes distinguishes its own security impact from the existence of new Xen advisories; the listed batch requires no user action.
Microsoft reports ARTEX attacks against financial organisations
Microsoft links Storm-3358 to ARTEX-assisted attacks against financial organisations. The report describes exposed web systems, remote-access tooling and practical defensive signals.
European refrigeration attacks: exposed controllers and the limits of attribution
Unit 42 reviews European refrigeration attacks and exposed controllers. Exposure counts are not victim counts, and the initial access route remains unconfirmed.
Exposed OAuth secrets give AI-assisted attackers a route into cloud tenants
Microsoft reports agents finding public secrets and abusing application identities. Removing a leaked secret from code is insufficient: investigate access and revoke or rotate the credentials.