30
30
30
30
30
The modern attack chain: Rethinking Google Workspace security in the age of AI
Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.
The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.
48
Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems
Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.
Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.
40
30
Attack Paths Into VMs in the Cloud
Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.
Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.
42
42
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
DDRop uses a sub-$200 DDR5 interposer to drop memory writes, breaking Intel TDX and AMD SEV-SNP confidentiality guarantees.
Researchers at KU Leuven, ETH Zurich, Durham University, and Google will present DDRop at ACM CCS 2026, a first active interposer attack on DDR5 that silently drops memory writes so processors keep reading stale encrypted data, exploiting the missing freshness guarantee in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP. On Intel TDX's default logical integrity mode it enabled reading victim VM memory, toggling debug mode, and forging remote attestation; AMD SEV-SNP was limited to copying pages between VMs. TDX's stronger cryptographic integrity blocks cross-VM attacks but likely not attestation forgery. The team will release board designs, firmware, and attack code on GitHub; no evidence of real-world use exists and no simple patch is available.
55
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.
55
Risky Bulletin: Expired cards can be used for new transactions
Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.
University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.
55
55
30
30
30
DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory
KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.
Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.
65
30
30
30
30
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.
Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.
45
Enterprise Defenses Recovered at the Edge and Collapsed Inside
Picus Labs' Blue Report 2026 finds perimeter prevention at 69% but post-compromise prevention just 37%, with reconnaissance blocked only 10% of the time.
Picus Labs' Blue Report 2026, based on 434,000+ simulated attacks across client production environments in H1 2026, found perimeter prevention effectiveness rose from 62% to 69% while the Post-Compromise Prevention Rate was only 37%. Quiet techniques fared worst: reconnaissance was blocked 10% of the time, registry-based credential access less than 1%, and the alert score stayed at 14% despite logging at a four-year high of 58%. IOC-based prevention fell to 50% from 71% in 2024, and Mimikatz's LSASS path was blocked about 94% while alternative credential-read paths went nearly undetected.
45
30