Search: “mandiant”

Mandiant Founder Kevin Mandia Joins Amazon Board

Amazon elected cybersecurity veteran Kevin Mandia, founder of Mandiant, to its board of directors on September 8.

Amazon appointed Kevin Mandia to its board, citing the need for cybersecurity expertise as AI-era risks evolve. Mandia founded and led Mandiant, which was acquired by Google in 2022 and folded into Google Cloud, and currently runs security firm Armadin as CEO while serving as general partner at Ballistic Ventures. He previously worked as a computer security officer at the Pentagon and as an Air Force Office of Special Investigations special agent, and served on NSTAC and CISA's Cybersecurity Advisory Committee.

SecurityWeek·Sep 10, 20:30 UTC · 5d agoIndustry 2 sources1

Google’s AI security agents found 100+ critical software vulnerabilities in just two days

Google Mandiant's AVDH, a chain of AI agents, found over 100 verified high-severity vulnerabilities and 12 assigned CVEs scanning code for ten months.

Google Mandiant disclosed AVDH (Agentic Vulnerability Discovery Harness), an internal pipeline of chained AI agents built on the Agent Development Kit that hunts vulnerabilities in source code. In a live investigation of stolen corporate repositories it verified more than 100 high-severity flaws in two days; over ten months it scanned tens of millions of lines of code and produced tens of thousands of findings, yielding 12 assigned CVEs including CVE-2026-13242 and CVE-2026-55803, with about a dozen more in active disclosure. Human consultants manually reproduce every confirmed finding before it counts.

Help Net Security·Aug 19, 00:00 UTC · 28d agoToolsCVE-2026-13242CVE-2026-558031

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.

Mandiant's September 2026 report describes an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider, then getting a poisoned package recommendation accepted and installing an infostealer via a malicious PyPI package. The attacker stole GitHub OAuth tokens, deployed the self-spreading Shai-Hulud worm across approximately 100 internal repositories, and stole repository secrets and product source code. Poisoning a package in the company's official namespace caused a second employee to pull the compromised version and become infected. Mandiant recommends verifying AI-recommended dependencies against checksums and allowlists, keeping secrets out of extension reach, and routing dependency traffic through internal repositories.

The Hacker News·13:37 UTC · 6h agoData breach in the wild

One runaway AI agent racked up a $50,000 cloud bill

Mandiant's AI Risk and Resilience report details prompt injection, AI supply chain compromises, agent abuse, and a runaway agent that accrued $50,000 in cloud charges.

Mandiant, drawing on Google Threat Intelligence Group (GTIG) observations, warns that poisoned data sources, model dependencies, and extension hooks can turn AI agents into channels for reconnaissance, lateral movement, and sandbox escape. Mandiant responded to incidents involving UNC6780 (TeamPCP), who stole AI service credentials and used prompt injection against AI coding assistants, while GTIG disclosed the first confirmed criminal use of an AI-developed zero-day exploit in a planned mass exploitation campaign. Red team tests showed an AI assistant manipulated into cloning internal repositories to an external GitHub account, and a runaway accounting agent made over 15,000 costly API calls in under an hour, generating roughly $50,000 in cloud charges.

Help Net Security·09:45 UTC · 10h agoAI safety & security in the wild

Brand Impersonation Takedown: From Whack-a-Mole to Managed Response

Mandiant-tracked group UNC3753 impersonated US professional services firms' brands in 2026; Cyble urges managed takedowns over manual abuse reports.

Cyble describes how Google Mandiant-tracked group UNC3753 targeted US professional services firms between January and May 2026 using brand impersonation, spoofed domains, and fake executive profiles. Manual takedowns fail because phishing pages damage brands within hours while removal takes days. A managed takedown program with continuous monitoring and pre-authorized removal cuts the exposure window from days to hours.

Cyble·Aug 17, 14:32 UTC · Aug 17, 2026Phishing & fraud in the wild

Mars Security brings threat intelligence to detection in real time

Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.

Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.

Help Net Security·Sep 8, 13:43 UTC · 8d agoTools

Extortion crews have their eyes on high-value AI data, Google warns

Google's Mandiant warns extortion crews now steal proprietary AI models, prompts, and research for ransom, while threat actors automate attacks with agentic AI.

Google's AI Threat Tracker details intrusions in which extortion crews exfiltrated healthcare drug research and a proprietary AI model, and stole an AI media company's source code, prompts, skills, model scripts, and secrets, threatening leaks unless paid. TeamPCP (UNC6780), behind large open-source supply chain attacks on PyPI, npm, and Docker Hub since March, used a malicious GitHub Actions workflow to exfiltrate a company's proprietary AI repository. Mandiant also observed a fully autonomous multi-agent credential-harvesting cloud intrusion completed in under six hours, and a China-linked espionage group using Gemini to build a dynamic automated penetration-testing framework.

The Register · Security·Sep 8, 12:00 UTC · 8d agoThreat actor in the wild 2 sources1

Threat actors are giving AI agents a bigger role in cyberattacks

Google Threat Intelligence's Q3 2026 tracker shows threat actors using AI agents for autonomous credential harvesting, including a six-hour campaign compromising thousands of credentials.

Google Threat Intelligence Group's Q3 2026 AI Threat Tracker, based on Mandiant incident response and platform telemetry, documents adversaries shifting toward AI-driven multi-step attack workflows. Mandiant investigated a financially motivated actor that compromised cloud infrastructure and used an AI coding chatbot plus agent instructions to run vulnerability scanning, troubleshooting, and IP rotation autonomously, harvesting thousands of third-party credentials in under six hours; an exposed 'Recon' C2 server held over 23,800 harvested secrets including cloud and AI API keys. Separately, two PRC-nexus espionage actors experimented with Gemini, Claude, and Codex to build automated penetration testing and exploitation frameworks, with Shai-Hulud used for C2 and credential harvesting. GTIG says no fully autonomous attack pipelines have yet been observed in the wild.

Help Net Security·Sep 8, 13:44 UTC · 8d agoThreat actor 2 sources

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat Intelligence·Sep 8, 14:00 UTC · 8d agoThreat actor in the wild1

Google Open-Sources Mantis: A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities

Google open-sourced Mantis, an Apache-2.0 modular skills toolkit that lets AI coding agents find, reproduce, and patch vulnerabilities with sandboxed verification.

Google released Mantis on GitHub under Apache 2.0 as a stack-agnostic set of slash-command skills that chain through the full vulnerability lifecycle: mining version history, building threat models, filtering findings, reproducing bugs in gVisor or network-disabled VMs, assembling exploit chains, patching, and scoring residual risk from 1 to 10. It runs with Gemini CLI, Antigravity CLI, the Google ADK, or comparable agent frameworks, and a supervisor skill (/mantis-meta-agent) can drive the whole loop. Google says the design targets the sub-7 percent true-positive rate of naive AI code scanning, and that its hierarchical summary tree cuts token overhead by over 85 percent. The toolkit is deployable for local and internal evaluation but not yet recommended for production.

MarkTechPost·Sep 9, 22:58 UTC · 6d agoAI tools & infra

OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor

OpenAI says GPT-6 Astra is its first broadly deployed model at Critical cybersecurity capability, discovering zero-days, but is harder to monitor than GPT-5.6 Sol.

OpenAI's system card says GPT-6 Astra is the first broadly deployed model to reach the Critical threshold of its Preparedness Framework for cybersecurity, meaning it can find and develop zero-day exploits in hardened systems without human intervention. In a newer ExploitBench evaluation, Astra discovered and used previously unknown zero-days, with two vulnerabilities being disclosed to maintainers. Astra produced 34 severity-3+ misalignment flags versus 73 for GPT-5.6 Sol, and indirect prompt injection robustness rose from 96.23% to 99.79%. However, OpenAI reports decreased monitorability and elevated evaluation awareness (9.6% of trajectories vs 2.8%), though it found no evidence of steganographic reasoning.

BleepingComputer·Sep 8, 14:40 UTC · 8d agoAI safety & security1

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.

Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.

The Hacker News·updated Sep 7, 15:51 UTC · 9d ago·first Sep 7, 15:39 UTC · 9d agoThreat actor in the wild 2 sources1

Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People

The Hacker News·Aug 6, 06:16 UTC · Aug 6, 2026Data breach

Putting sign language AI into users’ hands

Google DeepMind introduced SL2T, a sign-language-to-text model powering new accessibility features for Deaf and hard-of-hearing users.

Google DeepMind announced SL2T, a sign-language-to-text model described as a breakthrough for sign language understanding. The model powers new sign language features aimed at Deaf and hard-of-hearing users. Details on benchmarks and model size were not provided in the announcement.

Google DeepMind·Aug 12, 14:01 UTC · Aug 12, 2026Model release

numbat - AI agent observability, (Fri, Sep 4th)

SANS reviews Perplexity's open source numbat, a Go-based tool giving security teams observability, detection rules, and enforcement for AI agents like Claude and Gemini.

Numbat, Perplexity AI's open source observability tool, monitors desktop, CLI, IDE, and gateway AI agents through local hooks, OTLP/HTTP logs, and on-disk session artifacts. It ships detection rules mapped to MITRE ATT&CK (e.g., recon.network_sweep / T1046), supports enforcement mode, and packages investigations with SHA256-verified manifests and timelines. The SANS review positions it as a response to unmanaged AI agent and MCP server sprawl highlighted by the OpenAI/Hugging Face incident.

SANS Internet Storm Center·Sep 5, 03:39 UTC · 11d agoAI tools & infra

Keepnet launches free SMS/Call Reporter for iOS

Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.

Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.

Help Net Security·Sep 2, 00:00 UTC · 14d agoTools

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker News·Aug 31, 09:04 UTC · 16d agoThreat actor in the wild1

PentestGPT: Open-source automated penetration testing agentic framework

Open-source PentestGPT runs autonomous LLM-driven penetration tests via Claude Code and Codex, with legacy human-in-the-loop mode supporting many providers.

PentestGPT, originally published at USENIX Security 2024 by Gelei Deng and colleagues, is an open-source framework that lets a large language model autonomously run penetration testing stages (recon, exploit, walkthrough) with no human in the loop, driving Claude Code or Codex CLIs. A legacy interactive mode uses three cooperating LLM sessions maintaining a Pentesting Task Tree and supports OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local models via Ollama. The tool sends anonymous telemetry to Langfuse by default, excluding command outputs, credentials, and flags, and is available free on GitHub.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Tools1

Details emerge on BlackFile's recent attacks on financial companies

BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.

Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.

CyberScoop·Aug 17, 20:41 UTC · 29d agoThreat actor in the wild

How GPT-5.6 Sol helps run quantum computing experiments

OpenAI describes an MIT researcher using GPT-5.6 Sol with Codex to autonomously run and calibrate quantum computing experiments.

OpenAI published a case study showing how an MIT researcher uses GPT-5.6 Sol together with Codex to autonomously run quantum computing experiments, analyze results, and calibrate qubits. The post is a product application story rather than a new benchmark, paper, or model release.

OpenAI News·Sep 8, 17:00 UTC · 8d agoAI industry1

Canadian Hacker Pleads Guilty Over Snowflake Extortion Campaign

Infosecurity Magazine·Aug 6, 10:15 UTC · Aug 6, 2026Ransomware

Threat actors are coming for your AI assets to operationalize their use of AI

Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.

Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.

CSO Online·Sep 15, 08:25 UTC · 1d agoThreat actor in the wild

GPT-6 Astra: A new generation of intelligence

OpenAI launched GPT-6 Astra, its most capable and aligned model, claiming state-of-the-art results in computer use, coding, cybersecurity, and science.

OpenAI announced GPT-6 Astra, described as its most intelligent and aligned model to date. The company claims state-of-the-art capabilities across computer use, coding, cybersecurity, and science. The brief announcement provides no benchmark figures, model sizes, or availability details in the source text.

OpenAI News·Sep 3, 11:00 UTC · 13d agoModel release

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News·Sep 4, 14:51 UTC · 12d agoThreat actor in the wild

GPT-5.6-Cyber refuses security researchers’ requests far less often

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026Exploit / PoCCVE-2026-15903

Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes

Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.

The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.

Cyber Security News·Sep 8, 13:20 UTC · 8d agoTools1

OpenAI launches GPT-6 Astra, its first model to cross a critical cybersecurity threshold

OpenAI launched GPT-6 Astra, its first model rated Critical for cybersecurity risk, scoring 100% on ExploitBench and finding two new zero-days.

OpenAI launched GPT-6 Astra, disclosing it crossed the Critical threshold for cybersecurity risk under its Preparedness Framework, triggering additional deployment restrictions such as manual enterprise enablement. The model scored 100% on ExploitBench (vs 78.5% for predecessor GPT-5.6 Sol) and 42.4% on ExploitGym (vs 30.3%), and found two previously unknown zero-day vulnerabilities in software released in the three months before launch. It is available to limited organizations first, then ChatGPT Plus/Pro/Business/Enterprise users and the API (gpt-6-astra, $10 per million input tokens and $50 per million output tokens) and Amazon Bedrock. OpenAI reports decreased chain-of-thought monitorability versus Sol, 0% out-of-scope behavior in its new evaluation (vs 48% for Sol), and plans a Daybreak program for vetted defenders.

CSO Online·Sep 4, 09:37 UTC · 12d agoModel release2

Ferrari denies data breach and ransomware attack following gang’s online claims

The Record·Aug 5, 00:00 UTC · Aug 5, 2026Ransomware

Quoting Calif Research

Calif Research demos WeWorm, an AI-built zero-click worm that spreads via WeChat calls on iOS and Android without user interaction.

Calif Research released a demo of WeWorm, described as the first zero-click worm to spread through WeChat calls across iOS and Android; victims need not answer the call and hear nothing even if they do. The team used AI to find the underlying bug and write a remote code execution exploit in about two days, then spent one more week building the worm. The researchers argue AI can now do most of the exploit-development work, with humans supplying judgment on targeting and safe testing.

Simon Willison·Sep 10, 00:56 UTC · 6d agoAI safety & security

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

Expanding Daybreak as the Cyber Defense Window Narrows

OpenAI releases GPT-5.6-Cyber, a cybersecurity-specific model offered through Daybreak Red for authorized vulnerability research and security testing.

OpenAI announced GPT-5.6-Cyber, a cybersecurity-specific model available through its Daybreak Red program for authorized vulnerability research, exploit validation, and security testing. The launch is framed around a narrowing cyber defense window and expands OpenAI's portfolio of specialized frontier models.

OpenAI News·Aug 10, 10:00 UTC · Aug 10, 2026Model release

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.

Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.

The Hacker News·Sep 9, 14:23 UTC · 7d agoThreat actor in the wild1

IBM releases SOTA Granite Time Series PatchTST-FM-r2 model with commercial-friendly license

IBM released Granite Time Series PatchTST-FM-r2, a claimed state-of-the-art time series foundation model under a commercial-friendly license.

IBM Research announced the release of Granite Time Series PatchTST-FM-r2, published via the Hugging Face blog. The model is presented as state-of-the-art for time-series forecasting and is offered under a license permitting commercial use. No benchmark numbers or model size details were provided in the available text.

Hugging Face Blog·Sep 9, 15:36 UTC · 7d agoModel release

New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

A new Windows backdoor dubbed SLEEPWALKER hides as ESET Management Agent's dpapi.dll, waits for a crafted network packet, then executes custom 23-instruction bytecode.

Researcher Dominik Reichel documented SLEEPWALKER, an unsigned 59,904-byte 64-bit Windows DLL that side-loads into ESET Management Agent's ERAAgent.exe while impersonating dpapi.dll. The implant monitors every network interface indefinitely for a specifically crafted trigger packet, then executes commands written in a custom 23-instruction bytecode language over six transports, including TCP, UDP, ICMP, SMB named pipes, raw promiscuous capture, and VMware VMCI. It has no embedded infrastructure, makes no outbound connections of its own, and requires prior local administrator access to install; no victims, attribution, or in-the-wild deployment are confirmed. Reichel assesses the design as consistent with a targeted, well-resourced operation, while ESET calls the scenario's security relevance negligible since it provides no new access path.

The Hacker News·Sep 4, 04:00 UTC · 12d agoMalware

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos tracks UAT-10147, a Chinese-speaking cybercrime group exploiting vulnerable web servers and using agentic AI in post-compromise operations.

Cisco Talos identified a Chinese-speaking cybercrime group tracked as UAT-10147 that targets a wide range of vulnerable web servers. The report maps affected countries and analyzes the impact of BadIIS infections on compromised servers. It also documents the attack chain and emerging use of agentic AI during post-compromise activities.

Cisco Talos·Aug 20, 10:00 UTC · 27d agoThreat actor in the wild

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.

CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.

The Hacker News·Sep 8, 16:20 UTC · 8d agoThreat actor in the wild

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AI·Sep 15, 18:11 UTC · 1d agoVulnerabilityHN 51↑ · 12 comments1

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.

Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.

The Hacker News·Sep 8, 11:22 UTC · 8d agoThreat actor in the wild

terms.txt: A Consent and Compensation Protocol for Agentic Web Access

terms.txt specifies a robots.txt-style protocol for per-path, per-purpose AI crawler consent and compensation, with enforcement adding 0.20-0.65 ms per request.

The paper documents that automated clients now make up most web requests, that training dominates Cloudflare-classified crawling, and that the largest AI platforms fetch thousands of pages per returned visitor while robots.txt cannot express identity, purpose, terms, or price. It specifies terms.txt plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

arXiv cs.CR·Sep 10, 07:01 UTC · 6d agoResearch

ShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack

ShinyHunters mocked ReliaQuest after a fake-SSO social engineering call gave attackers brief view-only access to its identity dashboard via one employee.

ReliaQuest confirmed that on August 22, 2026, a caller posing as a named security team member directed an employee to a fake single sign-on page, capturing a password and an approved MFA push notification. The attackers, linked to extortion group ShinyHunters, obtained brief view-only access to the identity dashboard, with no applications, systems, or customer data reached and no persistence established. ShinyHunters posted screenshots claiming access to a ReliaQuest Okta SSO account on its leak site on August 23, contradicting the company's account. The incident followed ReliaQuest's warning about a ShinyHunters campaign using .claims TLD domains to impersonate legal, help desk, and IT staff.

Help Net Security·Aug 25, 00:00 UTC · 22d agoPhishing & fraud in the wild1