30
42
57
30
Malware bypasses browser checks to force install Chrome, Edge extensions
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.
Elastic Security Labs analyzed KREMLIN, a toolkit used by a Brazilian operation in at least seven campaigns since May 2025 that impersonates 12 banks to trick users into opening a JavaScript file disguised as a bank receipt or invoice. After anti-sandbox checks, it downloads Node.js, persists via a scheduled task, and fetches payload locations from an Ethereum smart contract, hiding payloads in JPEG images on Internet Archive. The toolkit bypasses Chromium integrity mechanisms to install unapproved Chrome/Edge extensions masquerading as AVSync that steal cookies, keylog form input, capture screenshots, and intercept HTTP traffic, while recent campaigns deployed the REMCOS RAT and earlier ones Pulsar RAT. Elastic confirmed 1,515 infected systems, almost all in Brazil, and disrupted the campaign by registering an anti-sandbox canary domain; the linked wallet handled roughly 20,800 USDT incoming and 19,000 USDT outgoing.
62
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team raised AI alert-triage accuracy from 60% to 92% using three self-correcting agents integrated into Slack triage.
Elastic's InfoSec team deployed three AI agents that read detection-rule investigation guides and closure reasons from 30 days of historical cases to triage alerts. The agentic pipeline lifted triage accuracy from 60% to 92%. Analysts now clear most alerts with a single click in Slack.
35
How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Elastic Security explains how background 'maintainer' jobs build user, host and service entities from raw logs and drive identity resolution and risk scoring.
Elastic Security Labs describes the internal background jobs, called maintainers, that each own one piece of every user, host and service record in Elastic Security. The maintainers construct entities from raw logs, resolve identities across sources and compute risk scores, and the write-up explains how the team keeps this entity machinery consistent.
25
30
30
30
30
30
30
KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.
Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.
70
Data access: the hidden cost of security vendor lock-in
Elastic compares SIEM data egress cost, latency, and fidelity across CrowdStrike, Microsoft, Google, and Splunk, arguing vendors engineer lock-in.
Elastic Security Labs published an opinion piece comparing how major SIEM and security vendors handle data egress, based on each vendor's public documentation as of September 2026. It rates CrowdStrike Falcon Data Replicator and Palo Alto Networks XSIAM Event Forwarding as restricted (paid add-ons with batch delays), Microsoft as partially open, Splunk as open, and Elastic as open with no export license. The piece argues frictionless ingestion paired with licensed or delayed egress is an intentional lock-in business model, and cites CrowdStrike's 2026 Global Threat Report eCrime breakout time of 29 minutes to argue real-time telemetry access is now essential.
24
How to correlate Kubernetes audit logs with container runtime data
Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.
Elastic Security Labs demonstrates correlating Kubernetes audit logs with Defend for Containers (D4C) runtime telemetry in Elastic. In an Amazon EKS lab, a compromised workload service account performed discovery, read secrets, minted a token, created a privileged pod, and execed into it to attempt a container escape via nsenter and chroot. The escape wrappers appeared only in the decoded Kubernetes audit requestURI, not in runtime process events. The post covers join fields, prebuilt EQL sequence rules, and continues the control-plane correlation thread from the TeamPCP container attack scenario and the Hugging Face intrusion write-up.
30
42
30
55
30
60
30
30
30
55
30
60
30
30
30
30
50
55
30
55
Cybersecurity jobs available right now: August 18, 2026
Help Net Security lists current cybersecurity job openings at ADI Global Distribution, Schneider Electric, L'Oreal, GovCIO, Elastic, and others across multiple countries.
A recurring job roundup featuring roles such as CISO at ADI Global Distribution, Cybersecurity Analyst at Schneider Electric in India, Cybersecurity Architect at L'Oreal in France, and security engineering positions at GovCIO, Neros Technologies, Elastic, and Chamelio. Most listed positions are no longer accepting applications; several emphasize AI-enabled security environments and identity threat detection and response. No vulnerability, incident, or research content is included.
10
Linux Detection Engineering - Fileless Execution
Elastic Security Labs reproduces five Linux fileless execution patterns, including memfd_create staging and in-memory kernel module loads, and maps each to Elastic Defend rules.
Elastic Security Labs reproduced five Linux fileless execution patterns using its FENIX tooling: memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads. Each pattern is mapped to the Elastic Defend detection rules that catch it. The post is part of the team's ongoing Linux detection engineering series.
30
42
30
30