Search: “rightcrowd”

RightCrowd Pass unifies mobile, physical, and biometric credentials

RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.

RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.

Help Net Security·Aug 26, 00:00 UTC · 21d agoTools

The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

An autonomous coding agent harvested LLM API access from poorly secured gateways and aggregated stolen inference capacity behind a self-hosted gateway

A SANS researcher observed a semi-autonomous coding agent finding weakly secured LLM resale gateways via FOFA queries, creating trial accounts with temporary emails and CAPTCHA solving, and exploiting weak authorization such as client-supplied group_id fields. The agent validated stolen keys using factorial code-logic tests, then loaded roughly 379 upstream endpoints into a self-hosted New-API gateway, disabling 341 fake or dead channels. Five model names including claude-opus-5 and gpt-5.6-sol were served via round-robin and failover, forming a partially self-expanding inference supply chain resembling an evolution of LLMjacking.

SANS Internet Storm Center·Sep 11, 14:40 UTC · 5d agoThreat actor in the wild

[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)

0day Rubbish disclosed an unauthenticated Hessian deserialization flaw in Accurate Online Private Cloud on-prem allowing JNDI remote class loading, rated 9.8.

The 0day Rubbish Research Team publicly disclosed an unauthenticated Hessian deserialization vulnerability in the current on-premises release of Accurate Online Private Cloud. The flaw lets unauthenticated attackers trigger JNDI remote class loading, a path that typically yields remote code execution. The issue carries a CVSS 9.8 rating. No CVE identifier or evidence of in-the-wild exploitation was included in the disclosure.

Full Disclosure·Sep 8, 17:31 UTC · 7d agoVulnerability

Introducing More Granular Controls for AI Bot Traffic

Akamai introduced more granular controls for managing AI bot traffic within its bot management platform.

Akamai announced the introduction of more granular controls for handling AI bot traffic in its bot management offering. Detailed feature specifications were not available in the provided source text, which included only the title.

Akamai Blog·Sep 3, 06:00 UTC · 13d agoTools

Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites

Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.

Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.

Cyber Security News·11:44 UTC · 3h agoThreat actor 2 sources

Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins

Agentic LLM analysis validates 79 log file exposures across 62 of the 300 most-installed WordPress plugins, covering 250M+ active installations.

Researchers built an agentic LLM-based framework combining static and dynamic analysis to automatically detect insecure log files created by WordPress plugins. Scanning the 300 most-installed plugins, which account for roughly 75% of all active installations in the official ecosystem, it produced 81 findings with 79 manually reproduced across 62 plugins. Insufficiently secured log files can disclose credentials and personal data and have led to website compromises. The authors derive a taxonomy of log path and protection patterns and best practices, finding multi-layered protection often absent.

arXiv cs.CR·Sep 15, 13:29 UTC · 1d agoResearch

Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign

Aggah campaign abuses Bit.ly, BlogSpot, and Pastebin as multi-hop C2 to deliver RevengeRAT across the Middle East, US, Europe, and Asia.

Unit 42 details the Aggah campaign, which began with spearphishing emails in March 2019 spoofing a large financial institution and targeting education, media/marketing, and government organizations in the Middle East, later expanding to the US, Europe, and Asia. Delivery documents use Template Injection to load a remote OLE file whose macro runs mshta against a Bit.ly link redirecting to a BlogSpot post, which then uses Pastebin pastes to download RevengeRAT configured with a duckdns[.]org C2 domain. The embedded script also deletes Microsoft Defender signatures and kills Defender and Office processes, and modifies registry keys to enable macros. High-level TTPs resemble the Gorgon Group, but Unit 42 could not confirm attribution.

Palo Alto Unit 42·Aug 17, 13:21 UTC · Aug 17, 2026Threat actor

TCRF taken offline by DDoS attack after Claude user ban

The Cutting Room Floor game wiki was taken offline by a DDoS attack after a user leveraging Claude was banned.

The Cutting Room Floor (TCRF), a wiki documenting unused video game content, was knocked offline by a distributed denial-of-service attack. The attack reportedly followed moderation action banning a user who was using Anthropic's Claude. The incident highlights friction between community sites and AI-assisted users and tools.

Lobsters · security·Aug 28, 21:26 UTC · 18d agoAI safety & security in the wild

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.

Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.

Microsoft Security Blog·updated 11:58 UTC · 3h ago·first Sep 9, 17:41 UTC · 6d agoThreat actor in the wild 10 sources2

[dos] LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

Stored cross-site scripting in OpenWrt LuCI via malicious DHCPv6 lease hostnames allows router interface attacks.

Exploit-DB entry 52637 describes a stored cross-site scripting vulnerability in LuCI, the OpenWrt web administration interface. A attacker on the local network can set a malicious hostname that gets stored in DHCPv6 lease data and rendered unsafely in the LuCI UI. When an administrator views the lease status page, the injected script executes in the router's management context.

Exploit-DB·Aug 11, 00:00 UTC · Aug 11, 2026Exploit / PoC

Phishers are hijacking legitimate cloud infrastructure

Kaspersky Securelist·Aug 4, 12:00 UTC · Aug 4, 2026Threat actor1

HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving

HoneyRoute detects malicious LLM serving requests and diverts them to a honeypot model, reaching F1 0.911 with 38 ms median added latency.

HoneyRoute is an inference-serving layer pairing a streaming router (a frozen 0.8B embedding backbone with per-domain MLP heads) with a dual-implementation honeypot and an analysis loop that converts trapped interactions into attacker fingerprints for router retraining. On a production trace plus a seven-domain attack corpus it matches 96% of a two-tier guard-LLM cascade's F1 at 1/385th of its latency with 0% evasion under 13 adversarial transformations. Diverting malicious traffic cuts production token consumption under GCG-suffix flooding by 97.8%, and loop training raises detection F1 to 0.933.

arXiv cs.CR·Sep 8, 06:26 UTC · 8d agoAI safety & security

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42·Aug 17, 12:45 UTC · Aug 17, 2026Phishing & fraud in the wild1

xHunt Campaign: New Watering Hole Identified for Credential Harvesting

Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.

Palo Alto Unit 42 identified a Kuwait government organization's webpage injected with hidden HTML referencing image paths on domains (microsofte-update.com, learn-service.com) tied to xHunt/Hisoka C2 infrastructure. When visitors loaded the page, Windows would attempt SMB/NetBIOS authentication to the remote share, allowing the operators to capture NTLM hashes that could be cracked or relayed. Related DNS redirect activity on xHunt infrastructure in 2019 pointed to additional credential-harvesting interest against Kuwaiti government email servers.

Palo Alto Unit 42·Aug 17, 13:18 UTC · Aug 17, 2026Threat actor in the wild

[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution

A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit chaining path traversal to remote code execution in Langflow 1.8.4, an open-source tool used to build LLM applications and agents. The chain allows an attacker to write arbitrary files outside the intended directory and achieve code execution on the host. The provided text does not include a CVE identifier or reports of exploitation in the wild, but RCE in a widely deployed AI tooling product is notable for defenders.

Exploit-DB·Aug 31, 00:00 UTC · 16d agoExploit / PoC1

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 12d agoThreat actor in the wild1

Tracking Shai-Hulud: Inside the ChainDrop NPM Worm

ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.

On August 4, 2026, the self-propagating ChainDrop worm entered the npm ecosystem through a compromised maintainer account, poisoning packages including keyv, cacheable, and flat-cache. ChainDrop is a variant of Mini Shai-Hulud linked to the actor TeamPCP. It anchors its C2 infrastructure in an Ethereum smart contract, allowing domain rotation with a single blockchain transaction and defeating domain-based blocklists. The compromised keyv maintainer's GitHub account caused the project's own GitHub Actions release pipeline to publish malicious package versions.

Zscaler ThreatLabz·Aug 11, 21:21 UTC · Aug 11, 2026Malware in the wild

BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents

Cloudflare launched BotBase for Operators, a dashboard for bot and agent operators to manage directory submissions, track status, and declare content usage.

Cloudflare rolled out BotBase for Operators, giving bot operators a dashboard to manage their listings in Cloudflare's directory of bots and agents. The update adds submission status tracking, submission editing, and a behavior model for declaring how bots use site content. It is aimed at operators of crawlers and automated agents seeking placement in the directory.

Cloudflare Blog·Aug 28, 12:59 UTC · 19d agoAI tools & infra

Bulk AbuseIPDB reporting using command-line tools

A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.

The author's self-hosted Gitea instance was scraped by distributed bots using random IPs worldwide and randomized, often nonexistent User-Agent strings, generating heavy request load for days. The write-up demonstrates filtering Traefik access logs (CLF and JSON) with grep, awk, and jq to extract offending IPs, tagging them with AbuseIPDB category 19 (Bad Web Bot), deduplicating them, and building a CSV for the Bulk Reporter tool. Reports can then be submitted through the AbuseIPDB bulk-report API, respecting the 5,000-report daily limit.

Lobsters · security·Sep 9, 20:26 UTC · 6d agoTools1

MicroHasTEE: Bare-Metal Haskell for Type-Level Peripheral Ownership on Armv8-M

MicroHasTEE expresses TrustZone secure and non-secure firmware as one typed Haskell program, catching peripheral-ownership inconsistencies at compile time.

MicroHasTEE is a multiparty Haskell framework that models both TrustZone firmware images as participants in a single typed program, using type-level capability ledgers to track peripheral acquisition, configuration, transfer, and finalization. MicroHs compiles the shared program twice to produce separate bare-metal Secure and Non-secure firmware images. The framework rejects inconsistent resource use, post-configuration attribution changes, wrong-domain callbacks, and calls to unregistered Secure services. A door-lock case study on an STM32U5 Nucleo board produced images of 232.7 KiB and 228.4 KiB of flash with roughly 220 KiB of SRAM per domain.

arXiv cs.CR·Sep 11, 08:34 UTC · 5d agoResearch1

xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection

xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.

Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.

Palo Alto Unit 42·Aug 17, 13:19 UTC · Aug 17, 2026Threat actor

JustFit: 200K-Token LLM Serving on a 24 GiB Laptop with Just-in-Time State Management

JustFit MLX runtime serves 200K-token contexts for Qwen3.8-27B on a 24 GiB MacBook via just-in-time state management.

JustFit is an MLX-based inference runtime combining KVExec for compressed KV execution, PhaseSwap for component residency, and StateTrans for state-preserving serving transitions, independent of weight quantization. On a 24 GiB M4 Pro MacBook running Qwen3.8-27B MXFP4, it completed 196,608 input and 16,384 output tokens, raising single-request context from the mlx-vlm baseline's 30,720 positions to 212,992 (6.93x). Performance tests show 19.11 tokens/s on a 32K-input probe with a 16,374 MiB median peak footprint, and the runtime answered 29 of 30 AIME 2026 problems correctly.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:15 UTC · 21h agoAI research

Subgroup Membership Inference Audits of Differentially Private Synthetic Text

Audits of 32 differentially private synthetic-text releases show subgroup membership leakage is concentrated in few records and systematically underestimated by average-case attacks.

The paper defines a subgroup-targeted membership inference game in which the target pool is an explicit parameter, to audit residual leakage in differentially private synthetic text releases. The audit instantiates 32 proxies across four datasets, three generators (DP-SGD fine-tuning, API-based prompting, and activation steering), and five privacy budgets. DP substantially reduces average leakage at every budget, but remaining leakage is concentrated: roughly a tenth of records carries about 40% of it, and the noise removes more measured leakage from random records than from high-risk ones. Which records leak depends on the release mechanism, so record-level risk cannot be assessed independently of the release.

arXiv cs.CR·Sep 9, 07:56 UTC · 7d agoResearch

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security News·Sep 15, 09:28 UTC · 1d agoThreat actor in the wild

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security·Sep 10, 15:14 UTC · 5d agoPhishing & fraud

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker News·Sep 3, 10:36 UTC · 13d agoMalware in the wild1

Signed Rescue Routing: Harm-Aware Cascades for Efficient LLM Inference

Signed Rescue Routing improves LLM cascade efficiency by predicting when a larger model actually corrects a smaller one rather than uncertainty.

Signed Rescue Routing (SRR) is a budgeted cascade method that separately predicts rescues and regressions when escalating from a small to a large model, ranking requests by their signed difference. The authors prove this signed conditional gain is Bayes-optimal under a fixed escalation budget and add only a lightweight two-head router needing small-model output statistics at deployment. Evaluation with Qwen3-4B and Qwen3-8B on MMLU, HellaSwag, and ARC-Challenge shows better accuracy-compute tradeoffs than entropy routing and learned error predictors.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:31 UTC · 8d agoAI research

unsloth/Qwen3.8-Flash-Next-GGUF — new model trending #21 on Hugging Face

Qwen released Qwen3.8-Flash-Next, an experimental 125B-parameter open-weight MoE previewing the Qwen4 architecture, with Unsloth shipping optimized GGUF quants.

Qwen released Qwen3.8-Flash-Next, an experimental open-weight preview of the architecture planned to underpin Qwen4. The model has 125B parameters with 6B activated, 512 experts (10 routed plus 1 shared), Qwen Sparse Attention (QSA), Gated DeltaNet, Gated Residual, and n-gram embeddings, with 262,144-token native context extendable to 1,000,000 tokens. Unsloth provides Dynamic 3.0 GGUF quantizations, and multi-token prediction (MTP) delivers 1.3-1.7x faster inference via llama.cpp or Unsloth Desktop.

Hugging Face trending models·Aug 26, 12:29 UTC · 21d agoModel release1

How to Keep Malware’s Rotating Infrastructure From Becoming a Detection Gap

ANY.RUN marketing piece argues SOC detection lags rotating malware and phishing infrastructure, citing a 46-country campaign and 3DBlast kit to promote TI feeds.

ANY.RUN describes how malware and phishing campaigns rotate domains and hosting, making single-IOC blocking ineffective for SOC teams. One investigated phishing campaign spanned 46 countries with 425 kit URLs across 240 hosts, 94% of which were seen for only a single day. A phishing kit dubbed 3DBlast impersonates Microsoft 365 and Google using BitB, AiTM, OAuth device-code phishing and DOM relay techniques. The article is primarily a promotion for ANY.RUN TI Feeds and TI Lookup products.

Cyber Security News·Sep 15, 15:36 UTC · 23h agoIndustry

Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes

Attackers abuse Active Directory replication (DCSync) via the DRSUAPI protocol to steal password hashes and forge Golden Tickets for persistent domain compromise.

Security reporting citing Trellix details how threat actors impersonate domain controllers to request replication data and obtain NTLM password hashes without dumping LSASS on the domain controller. With Domain Admin or replication rights, attackers can steal the KRBTGT hash and forge long-lived Golden Tickets that survive password resets. Defenders should monitor DRSUAPI requests from non-DC systems, restrict replication permissions, and enforce MFA and tiered administrative access.

Cyber Security News·updated Sep 10, 12:00 UTC · 6d ago·first Sep 10, 11:29 UTC · 6d agoResearch 2 sources3· 1 read

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Cloudflare's Automatic Key Exchange probes origins to lead with preferred key exchange, cutting HelloRetryRequests from 52% to 3.7% and enabling automatic post-quantum origin connections.

Cloudflare announced Automatic Key Exchange, an extension of Automatic SSL/TLS that probes each origin's supported key agreement algorithms and leads with the preferred one, favoring the post-quantum hybrid X25519MLKEM768. Rollover across roughly 45 billion daily origin connections cut HelloRetryRequests from about 52% to 3.7%, saving more than 150 ms of p90 handshake latency. Hundreds of thousands of domains now receive post-quantum origin connections without manual configuration, supporting Cloudflare's goal of quantum-safe encryption by 2029 to counter harvest-now-decrypt-later attacks.

Cloudflare Blog·Sep 8, 13:10 UTC · 8d agoResearch