55
30
The Machines Are Calling: Measuring Automated and Synthetic Voices in Unwanted Inbound Calls
Voice honeypot measurement finds at least 26.9% of unwanted US inbound calls open with machine voices, 13.1% with fresh synthetic speech.
An interactive voice honeypot using language-model personas on real US numbers recorded 10,987 calls over 66 days, following the FCC's February 2024 ruling that AI-generated voices fall under the TCPA. Of 7,233 greeted calls, 13.8% opened with recordings replayed from other calls and 13.1% with fresh audio labeled synthetic, with replays making up 45% of the detector's flagged rate. Synthetic openings concentrated in lead-generation spam (33.8%) rather than fraud (21.1%), and only 0.44% of calls disclosed automation. Prevalence tracked how long a bait number had circulated, and campaigns outlasted their numbers, with one synthetic voice serving nine campaigns.
33
Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.
Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.
45
42
Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.
45
What Zero-Day Response Should Be in the Post-Mythos Era
Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.
The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.
45
42
30
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.
Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.
15
30
30
30
42
30