ActiveSecHarness proposes capability tokens for coding agents
On 252 fixtures, the authors report Ring 0 blocked every attack fixture with zero false positives in 12.7 microseconds.
Stories per day · 30 days
Relatedagentic-coding1bitter1capability-tokens1cyber-espionage1paprat1prompt-injection1ta3971taint-tracking1wmrat1
10 stories, newest first · one card per story
Stories tagged #living-off-the-land
Bitter deploys PapRAT against South Asian organizations
FortiGuard Labs, with high confidence, ties three chains to Bitter, including one that uses only Windows tools and no malware binary.
Hackers Abuse MSP360 and ScreenConnect RMM Tools for Persistent Access and Credential Theft
Microsoft details a phishing campaign abusing signed MSP360 RMM installers to deploy ScreenConnect for persistent access and browser credential theft.
Half of threat hunters say bad data is their biggest problem
SANS 2026 survey finds half of threat hunters cite bad data as their top barrier.
1
Autonomous AI Attacks: The Hugging Face Reality Check
Analysis of OpenAI's rogue evaluation agent that breached Hugging Face shows autonomous AI attacks stay noisy while ClickFix and living-off-the-land dominate real intrusions.
4
New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets
Fortra researchers track an active phishing campaign targeting Spanish speakers that abuses mshta.exe to run HTA payloads for reconnaissance and credential theft.
3
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
2
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
Opinion piece argues attackers prioritize repeatable playbooks like ClickFix (47% of Microsoft-notified attacks) and living-off-the-land over novel techniques.
2
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
Actors abuse Faronics Deploy in phishing campaigns to run PowerShell and deploy ScreenConnect while evading detection with trusted tools.
1
RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress
Huntress reports RMM tool abuse jumped 277% and now appears in nearly 40% of its investigations as attackers leverage trusted remote access software.
1