Threat Spotlight: Phishing pages that exist only inside the victim’s browser
https://blog.barracuda.com/2026/09/09/browser-based-phishing-blob-urls-microsoft-redirects
https://blog.barracuda.com/2026/09/09/browser-based-phishing-blob-urls-microsoft-redirects
Barracuda Blog
Browser-based phishing hides pages inside victims’ browsers
Learn how attackers are using blob URLs, service workers, and Microsoft redirects to create browser-based phishing pages that evade traditional URL-based detection.
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
injecting backdoor in to terraform
https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
injecting backdoor in to terraform
https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
Unit 42
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
Using autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address and defend against agentic attacks.
Forwarded from Yevgeniy G.
Open SysConf'26 - Доклад: поиск уязвимостей в эпоху AI
Кибербезопасность, AI - сегодня идут нога в ногу, в качестве союзников, иногда в качестве врагов.
Доклад от @Thatskriptkid - Malware analyst, threat hunter, vulnerability researcher, автора множества интерейснейших ресерчей и интересных докладов, автора канала Order of Six Angles - https://t.me/orderofsixangles, хорошего друга, человека, который поддерживает и с первого Open SysConf с нами.
Рассказ автора про свою хоум лабу, про проекты которые крутятся на ней, как были найдены баги в Pixel, Xiaomi, Mediatek в результате подготовки ресерча, опыт автора с локальными ЛЛМ, Android Exploitation, Фаззинг драйверов Windows и не только...
10 Октября, в 10 утра, SmartPoint зал "Freedom Amphitheatre", Алматы.
https://sysconf.io/2026
Кибербезопасность, AI - сегодня идут нога в ногу, в качестве союзников, иногда в качестве врагов.
Доклад от @Thatskriptkid - Malware analyst, threat hunter, vulnerability researcher, автора множества интерейснейших ресерчей и интересных докладов, автора канала Order of Six Angles - https://t.me/orderofsixangles, хорошего друга, человека, который поддерживает и с первого Open SysConf с нами.
Рассказ автора про свою хоум лабу, про проекты которые крутятся на ней, как были найдены баги в Pixel, Xiaomi, Mediatek в результате подготовки ресерча, опыт автора с локальными ЛЛМ, Android Exploitation, Фаззинг драйверов Windows и не только...
10 Октября, в 10 утра, SmartPoint зал "Freedom Amphitheatre", Алматы.
https://sysconf.io/2026
Unmasking EvilTokens: Getting to the root of device code phishing
https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/
Microsoft News
Unmasking EvilTokens: Getting to the root of device code phishing
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption…
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
https://microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations
https://microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations
Microsoft News
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat
https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
Cleafy
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | Cleafy
Cleafy's TIR team analyzed the operator infrastructure behind RATHat, an Android banking trojan that abuses Accessibility Services to enable wireless debugging on the victim's phone, obtain a shell, and deploy a hidden native service outside the app. The…
Forwarded from Yevgeniy G.
Open SysConf'26 - N-click атаки изнутри и зачем математика хакеру?
Современные атаки - не похожи на атаки, порой сами ведут жертву на эшафот, буквально за руку.
Доклад от
Основатель различных исследовательских лабораторий по кибербезопасности, спикер более 30+ международных конференций (BlackHat, DEFCON, Security BSides, hack.lu etc)
Доклад:
10 Октября, в 10 утра, SmartPoint зал "Freedom Amphitheatre", Алматы. Регистрация.
https://sysconf.io/2026
Современные атаки - не похожи на атаки, порой сами ведут жертву на эшафот, буквально за руку.
Доклад от
cocomelonc (@abuyerzh) - cybersecurity enthusiast, автор, спикер и математик, автор популярных книг по malware R&D: MD MZ Malware Development Book (Github, 2022, 2024), MALWILD: Malware in the Wild Book (Github, 2023), Malware Development for Ethical Hackers Book (Packt, 2024, 2026), AIYA Mobile Malware Development Book (Github, 2025)Основатель различных исследовательских лабораторий по кибербезопасности, спикер более 30+ международных конференций (BlackHat, DEFCON, Security BSides, hack.lu etc)
Доклад:
Раскрывает внутреннее устройство N-click атак - сложных цепочек эксплуатации, запускаемых действием пользователя, от первого клика по ссылке до полного контроля над системой. На реальных примерах мы разберем, почему современный хакинг неотделим от математики: как теория вероятностей помогает обходить ASLR, а геометрия памяти, битовая арифметика и формальная логика позволяют конструировать надежные примитивы чтения и записи. Слушатели увидят, что за каждым успешным эксплойтом стоит не просто написание кода, а точный математический расчет. Вы узнаете, как математический аппарат - от теории информации Шеннона до булевой алгебры и выравнивания адресов - превращает обычный сбой программы в управляемый инструмент выполнения кода.
10 Октября, в 10 утра, SmartPoint зал "Freedom Amphitheatre", Алматы. Регистрация.
https://sysconf.io/2026
FortiBleed Is Still Active, Now Locking Orgs Out
https://socradar.io/blog/fortibleed-still-active-locking-organizations-out/
https://socradar.io/blog/fortibleed-still-active-locking-organizations-out/
SOCRadar
FortiBleed Is Still Active, Locking Organizations Out
On October 6, 2026, the FBI and the U.S. Secret Service published a joint Cybersecurity Advisory on FortiBleed, the active global credential compromise,,,
Suspicious Activity AI Models from OpenAI?
https://openai.com/hugging-face-incident-and-misalignment/#model-misalignment-2026-09-30-model-activity-review
https://openai.com/hugging-face-incident-and-misalignment/#model-misalignment-2026-09-30-model-activity-review
OpenAI
The Hugging Face incident and other third-party impact from misaligned models
Read OpenAI’s findings on the Hugging Face incident and AI model misalignment, including investigation updates, safety research, and lessons learned.
AWS Innovation Day 2026 - 22 октября, Астана
Представители гос. организаций и компаний Казахстана, соберутся чтобы обсудить будущее AI, интеллектуальных агентов и облачных технологий в Astana Hub.
На повестке:
• AI-агенты и применение их в бизнесе
• развитие AI в гос. секторе
• кейсы генеративного AI и AI-стратегии
• реальные кейсы и демо агентного AI
Участие бесплатное, по регистрации
https://qcloudy.io/innovation-day
Представители гос. организаций и компаний Казахстана, соберутся чтобы обсудить будущее AI, интеллектуальных агентов и облачных технологий в Astana Hub.
На повестке:
• AI-агенты и применение их в бизнесе
• развитие AI в гос. секторе
• кейсы генеративного AI и AI-стратегии
• реальные кейсы и демо агентного AI
Участие бесплатное, по регистрации
https://qcloudy.io/innovation-day
Forwarded from (Yevgeniy G.)
Malware from USB will never go out of style...
https://www.howtogeek.com/anything-can-be-a-keyboard-if-youre-evil-enough/
https://www.howtogeek.com/anything-can-be-a-keyboard-if-youre-evil-enough/
How-To Geek
Anything can be a keyboard if you're evil enough
A banana can be a keyboard. So can a USB drive carrying malware.
Inside Cairn: Open Windows into massive AI-Driven Cyber Operations
https://norforge.com/blog/inside_cairn
https://norforge.com/blog/inside_cairn
NorForge
Inside Cairn: Open Windows into massive AI-Driven Cyber Operations - NorForge
NorForge research into publicly exposed Cairn AI pentesting panels: how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and expose their victims' secrets in the process.
How I got over 300 Tor exit nodes removed
333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible..:
https://kaba.cx/posts/20261020_Tor/
333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible..:
https://kaba.cx/posts/20261020_Tor/
kaba.cx
How I got over 300 Tor exit nodes removed
Choose Your Backend: Three TLS Bugs in GoAhead
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
foxio.io
Choose Your Backend: Three TLS Bugs in GoAhead - FoxIO | Cyber Innovation
We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.
Binance Was Hacked
https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
Binance
Binance Announcement: New Coin Listings, New Trading Pairs, Crypto Airdrops, Crypto Updates and More | Binance Support
Stay updated on the latest news from the Binance Exchange, keeping track of new crypto listings, new trading pairs, recent delistings, new fiat listings, crypto airdrops and other latest Binance news.
Forwarded from (Yevgeniy G.)
Securing Internet-Critical Software: How We Could Have Backdoored Bash
https://www.hacktron.ai/blog/hacking-gnu-savannah
https://www.hacktron.ai/blog/hacking-gnu-savannah
Hacktron AI
Securing Internet-Critical Software: How We Could Have Backdoored Bash
A shell injection hidden in an email address gave us code execution on GNU Savannah, then root, then the ability to push to the upstream Bash repository. We reported it, kept auditing, and helped the FSF fix 26 vulnerabilities in the forge that hosts GNU.
Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads
https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads
https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads
Todyl
Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads | Todyl
Todyl is investigating an actor that signs in to Microsoft Entra ID as application service principals using valid, pre-existing credentials.
Analyzing a fake event campaign combining AiTM and device code phishing payloads
https://pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis
https://pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis
Push Security
Fake event invites combine Kali365 and VoidProxy payloads
Push found fake registration pages for OpenAI, SpaceX, and Anthropic events, using Kali365 to phish Microsoft accounts and VoidProxy to phish Google accounts.