Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Theme 1: Agentic AI Crosses the Line
Stories
🗞️ Anthropic Exposes Escalating AI Misuse in Landmark September 2026 Threat Report (Anthropic) — Eight months of disrupted operations show tradecraft moving from AI-as-drafting-assistant to models acting as autonomous orchestrators running full attack chains: recon, dynamic malware obfuscation for AV evasion, and credential harvesting with minimal human input. Nation-state groups and unauthorized model distillers are both in scope.
🗞️ The Rise of Autonomous AI Threats: Mandiant’s 2026 AI Risk & Resilience Report (Mandiant) — Adversaries are hijacking live AI coding sessions to deploy the Shai-Hulud worm and shipping “just-in-time” polymorphic malware that compiles in memory to defeat signature-based detection. Developers and IT are the beachhead.
🗞️ AEPD Warns of Spain’s First Data Breach Executed by an Autonomous AI Agent (Spanish Data Protection Agency) — A regulator has now formally registered an agent that probed for vulnerabilities, authenticated, accessed invoices, and modified records without continuous human direction. The theoretical risk has a case number.
🗞️ OpenAI Launches AI Model Misalignment Reporting Framework (OpenAI) — Six published reports on emergent behavior show models and agent swarms inventing out-of-band comms channels, bypassing constraints and deceiving alignment monitors when pushed to hit evaluation metrics.
🗞️ Beijing Frames US AI Models as National Security and Cyber Threat Risks (The Record) — The MSS is privately treating Western frontier models as live espionage and destabilization vectors even while publicly calling equivalent US concerns fearmongering. Useful tell on how states actually rate AI risk.
Recommendations
☑️ Treat model access credentials as production secrets — audit, rotate, and monitor AI API keys the same way you do infrastructure keys, and kill long-lived static keys in favor of short-lived Workload Identity Federation (OIDC).
☑️ Enforce identity and permission boundaries at the infrastructure layer, not in the prompt — agents should be architecturally incapable of out-of-scope tool calls, with egress filtering and zero-trust sandboxing on anything that executes code or touches files.
☑️ Retune detection for machine-speed behavior: high-tempo multi-agent execution patterns, unexplained CPU/GPU spikes from lightweight processes, rapid in-memory compilation, and anomalous rapid-sequence data access.
☑️ Put verification hooks in the AI-assisted dev pipeline so every AI-recommended dependency is checked against an allowlist and cryptographic checksum before it lands.
☑️ Update threat models and risk registers to carry agentic threats as their own category, with continuous red-teaming and alignment auditing before anything reaches production.
Theme 2: Social Engineering at Industrial Scale
Stories
🗞️ Microsoft Uncovers AI-Driven Executive Impersonation Blitz (Microsoft Security) — Over a million AI-generated phishing emails in three days, impersonating execs and vendors like ServiceNow to push $50,000 ACH transfers past accounts payable. No exploit involved, just BEC industrialized with dynamic templating, lookalike domains, and synthetic multi-turn executive threads. 🔎 Threat Hunting Package
🗞️ HBO Max Reddit Account Pushes Cross-Platform “PasteSwitch” ClickFix Ads (Hudson Rock) — A hijacked verified corporate account ran 108 malicious ads in 48 hours, using fake download buttons and CAPTCHA prompts to get Windows and macOS users pasting commands straight into PowerShell and Terminal — routing around browser download controls entirely. 🔎 Threat Hunting Package
🗞️ How Scammers Are Weaponizing Google Play’s Early Access (Bitdefender) — Fake reward games, ghost casinos, and bogus utilities parked permanently in beta, because Early Access disables public reviews by design. A legitimate anti-review-bombing feature turned into a victim-silencing mechanism, fed by social ads with AI celebrity deepfakes.
🗞️ New AI-Powered Android Trojan Steals Banking Credentials & Automates Device Control (Zimperium) — RatHat uses a generative AI engine to read the live Accessibility tree and generate adaptive navigation commands in real time, evading static script detection, with local ADB pairing for shell-level access and persistence after uninstall. 🔎 Threat Hunting Package
Recommendations
☑️ Make out-of-band verification mandatory on any high-value payment or bank detail change, using a known-good number, and require multi-person authorization regardless of who is apparently asking.
☑️ Tune EDR to flag and block suspicious command-line execution from powershell.exe, cmd.exe, or Terminal, especially Base64 decoding or direct outbound C2, and enforce script execution policy on managed devices.
☑️ Lock down MDM/MAM so corporate devices can’t sideload APKs or hand out Accessibility and Wireless Debugging permissions, and restrict Early Access or unverified app installs outright.
☑️ Harden corporate social and ad accounts with hardware-backed MFA and tight admin session privileges. A verified badge is now an attacker asset.
☑️ Refresh awareness training on the two current lures specifically: pasting terminal commands from a website, and “beta” apps with no reviews. No reviews are a red flag, not a clean slate.
☑️ Configure advanced email protection and anti-spoofing (ZAP, AI anomaly detection) to catch lookalike domains before delivery.
Theme 3: The Browser Is the Endpoint Now
Stories
🗞️ Malicious Twitch Extension Hijacks 30,000+ OAuth Tokens (Socket) — “Twitch Enhanced Viewer | JeetBot” uses genuine ad-blocking and region-unlock features as cover while appending account-scoped OAuth bearer tokens to proxy requests in cleartext — full account control with no password and no MFA prompt. It even exempts a hardcoded list of Russian streamers from harvesting. 🔎 Threat Hunting Package
🗞️ BragJack Exploit Hijacks Built-In AI Assistants Across Top 5 Web Browsers (Forever Security) — Not prompt injection: “Prompt-Forcing” abuses Declarative Net Request permissions so an ordinary extension drives the built-in agent directly, reaching local files, history, screen captures, and live camera or mic across Chrome, Edge, Opera Neon, Comet, and Claude in Chrome.
🗞️ KREMLIN Banking Trojan Hijacks Chromium Integrity Checks to Steal Session Tokens (Elastic Security Labs) — A 15-month Brazilian campaign that extracts App-Bound encryption keys, edits Secure Preferences and recalculates the HMACs so Chromium accepts rogue extensions silently — with Ethereum smart contracts as dead-drop C2 resolvers. 🔎 Threat Hunting Package
🗞️ Telegram Desktop Flaw Hijacks HTML Chat Exports (ExPatch) — Stored XSS in the HTML export pipeline lets hidden JavaScript sit dormant in bot inline keyboard buttons for months, then fire when someone exports the chat. The attacker’s bot never touches the target group — a forwarded message is enough. Acute risk for legal and compliance teams reviewing logs.
Recommendations
☑️ Enforce enterprise extension allowlisting, and block anything requesting broad header modification or request redirection. Assume any extension proxying authenticated traffic owns the session credentials.
☑️ Patch and audit now: remove JeetBot (Chrome pnhhdhhcadcjfckjhpmjneldiegbojfb, Firefox [email protected]) and revoke Twitch sessions; apply the BragJack fixes (CVE-2026-0628, CVE-2026-55945); move Telegram Desktop to 7.0.1+ or 6.9.4 beta.
☑️ Build EDR rules for non-standard processes touching Chromium Local State, modifying Secure Preferences, or calling public smart contract RPC endpoints for C2 resolution.
☑️ Extend SOC telemetry to browser AI agent API interactions — traditional EDR won’t flag malicious actions carried out through a trusted internal AI binary.
☑️ Re-export or delete pre-patch HTML chat archives, and render any third-party chat export in a sandbox or convert it to static PDF before compliance review.
☑️ Hunt persistence: scheduled tasks running Node.js binaries (e.g., fake MicrosoftNodeRuntimeUpdater) and unauthorized extensions like “AVSync System Inc.”
Theme 4: Identity and Cloud
Stories
🗞️ How Fake IT Helpdesks are Hijacking Cloud Identities (Microsoft Security) — Attackers call or Teams-message staff posing as IT, using “passkey enrolment” or “SSO setup” purely as a lure. After authentication, they register their own MFA methods for persistence and use Microsoft Graph for automated recon and bulk exfiltration. 🔎 Threat Hunting Package
🗞️ UK Government Shifts 23 Million Users to Passkeys (GOV.UK) — GOV.UK One Login is phasing out passwords for 23 million citizens in favor of device-bound passkeys. The under-reported angle is operational: dropping SMS 2FA is saving roughly £600 a day, which is the business case your CFO will actually respond to.
🗞️ Mass-Scanning Campaign Exploits Vite Dev Servers to Steal AWS & Azure Secrets (F5 Labs) — CVE-2026-39364 lets attackers append ?raw, ?import&raw or ?import&url&inline to /@fs/ requests to bypass server.fs.deny, harvesting .env files, cloud tokens and Terraform state — while spoofing Googlebot and ClaudeBot User-Agents to stay quiet.
Recommendations
☑️ Move high-risk accounts to phishing-resistant MFA (FIDO2/WebAuthn passkeys) and deprecate SMS and voice OTP entirely. They fold to SIM swap and AiTM. Establish syncable or hardware fallback keys first to avoid lockouts.
☑️ Alert on the compromise signature directly: anomalous sign-in followed closely by new MFA method registration or a spike in Microsoft Graph activity. On confirmation, revoke all sessions and delete attacker-registered auth methods.
☑️ Get dev servers off the internet — upgrade Vite to 7.3.2+/8.0.5+, bind to localhost, firewall port 5173, and WAF-drop /@fs/ requests carrying raw or import parameters against sensitive file types.
☑️ Rotate every cloud credential and API key that sat behind an exposed unpatched instance, and assume Terraform state disclosure means full account takeover potential.
☑️ Enroll any device touching corporate resources — including personal phones under BYOD — into MDM or endpoint security so you actually get telemetry from the initial social engineering step.
Theme 5: Adversary Infrastructure
Stories
🗞️ How APTs and Cybercriminals Hide in the Noise of Online Casinos (Infoblox) — China-aligned groups like PeckBirdy are parking C2 inside the vast sprawl of illicit gambling and adult domains, betting that analysts auto-dismiss those categories in DNS and proxy logs. The blind spot keeps WebSocket C2 channels running unnoticed. 🔎 Threat Hunting Package
🗞️ How “BambooToken” Malware Hijacks IoT Protocols for Stealthy Cyber Espionage (Black Lotus Labs) — Multiplatform espionage across Asia and Latin America using MQTT publish/subscribe for C2. Infected hosts only ever talk to intermediate brokers, never the operator, so the traffic reads as ordinary IoT messaging and traditional C2 models break. 🔎 Threat Hunting Package
🗞️ China-Aligned “FamousSparrow” Targets Latin America with New “SparroWocky” Backdoor (ESET Research) — The group has binned its old toolset for a custom C++ implant that pulls in MinHook and Mbed TLS, executes Beacon Object Files and patches itself in memory at runtime, aimed at governments across eight Latin American countries. 🔎 Threat Hunting Package
🗞️ UK NCSC Warns of Iranian Cyber Campaign Targeting Dissidents and Journalists (UK NCSC) — A joint NCSC/FBI/AIVD advisory on CHOSEN BRICK spyware, delivered through long-con impersonation on WhatsApp and Telegram with lures as personal as fabricated MRI results. Screen capture, mic activation, and message exfiltration on personal and work devices.
🗞️ FBI Dismantles “NightmareStresser” DDoS-for-Hire Domains in Global Crackdown (US Department of Justice) — Operation PowerOFF takes down a booter responsible for hundreds of thousands of attacks since 2022. The structural point is the barrier to entry: no skill required to rent serious disruption.
Recommendations
☑️ Stop auto-dismissing gambling and adult domain categories in hunts — investigate the connection sequence (unexpected WebSockets, beaconing cadence) rather than trusting static reputation or how the site looks.
☑️ Hunt MQTT on ports 1883 and 8883 originating from non-IoT corporate endpoints, and deploy FIM to catch DLL side-loading and execution flow hijacking on native system binaries.
☑️ Deploy memory-scanning EDR that detects runtime code modification, unmapped executable memory, and BOF execution, plus persistence via custom Windows services and Registry Run keys.
☑️ Inspect outbound TLS for RC4-encrypted exfiltration anomalies from sensitive endpoints, and enforce zero-trust segmentation and broker-level authorization so a single compromise doesn’t compromise the whole estate.
☑️ Brief high-risk individuals specifically on long-con impersonation over messaging apps, mandate phishing-resistant MFA on their comms accounts, and hunt CHOSEN BRICK indicators (unexpected Run key creation, process modification, suspicious C2).
☑️ Assume DDoS is always affordable to your adversary: keep WAF and traffic scrubbing live, build redundancy through load balancing and multiple ISP links, and exercise the IR plan against a volumetric scenario.
Feature Livestream
🚨YouTube livestream catch-up!
I went live to answer your questions. All of them.
CTI, threat hunting, detection engineering, AI in security, career advice, and more! If there’s a question you’ve never gotten a straight answer to.
No script. No filtered corporate answers. Just direct, analyst-to-analyst conversation about the stuff that actually matters in this field.
Got a question I didn’t answer? Drop it in the comments.
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
