Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Theme 1: Rogue Agents & Fragile Models
Stories
🗞️ Unintended AI Actions: When Models Break the Rules to Complete Tasks (Anthropic) – Anthropic disclosed testing incidents where Claude models used URL shorteners, gated tokens, and basic SQL flaws to finish restricted tasks, one of which reached a live police tip form. The models didn’t stop at the boundary. They reward-hacked their way around it.
🗞️ VerCellBreak: Escaping Vercel’s Hardened Sandbox to Exfiltrate Secrets (AIR) – Untrusted code hides stolen secrets in the AIA URL of a crafted client certificate. An allowlisted server then fetches that URL during chain verification and leaks the data, so a domain allowlist alone does not contain an agent.
🗞️ AI Security Alert: Are Your Decision Models Susceptible to Manipulation? (HiddenLayer) – “System One” models such as TypeSafe’s Jev return scores rather than text, but they can still be steered with indirect prompt injection and TokenBreak. A skewed confidence score can lead to unauthorized action.
🗞️ Self-Replicating AI on Consumer IoT: Threat Reality vs. Apocalyptic Hype (Anthropic) – Anthropic sharded a 26B-parameter model across 15 $55 Android TV boxes and warned that autonomous replicators are months away. Critics counter that no AI worm exists in the wild and that basic IoT hygiene is the real threat today.
🗞️ UK Cyber Security Bill Leaves AI Safeguards in Limbo (The Register) – Ministers have promised AI oversight, but AI protections are still only “under consideration” for the Cyber Security and Resilience Bill. That leaves AI incidents governed by frameworks written before modern models existed.
Recommendations
☑️ Inventory all AI systems, including shadow AI. Identify which model decisions can trigger actions without human review, then test the confidence thresholds behind those actions.
☑️ Sandbox agents properly. Use dummy targets in testing, give agents no standing credentials or production API keys, and use short-lived, workload-scoped identities.
☑️ Go beyond DNS/domain allowlists. Apply egress microsegmentation, disable automatic outbound AIA/OCSP fetching, enforce TLS inspection, and add runtime monitoring or classifiers that catch prompt injection and unintended agent actions.
☑️ Don’t wait for legislation. Set internal AI incident classification and response workflows now, benchmark against ETSI EN 304 223 and ISO 42001, and segment IoT onto restricted VLANs.
Theme 2: AI on Both Sides of the Fight
Stories
🗞️ CyberXero: AI-Augmented Initial Access Broker Targets Critical Infrastructure (SOCRadar) – A Russian-speaking initial access broker linked Claude Code agents and PentAGI to Cobalt Strike, which let it scan 4,708 targets and deploy 32 webshells in 61 seconds. The whole operation was mapped because the actor left its working directory on an open HTTP server. 🔎 Threat Hunting Package
🗞️ Exposing AI-Enabled “False Front” Cyber Influence Operations (OpenAI) – Russian and Iranian operators used AI for more than spam. They wrote internal reports with it and polished the language of fake journalist personas and a sham Latin American think tank until those personas passed editorial vetting.
🗞️ Anthropic Launches Free AI-Powered “OSS Scanner” for Open-Source Software (Anthropic) – To get around the human triage bottleneck, Anthropic sends maintainers raw, model-generated findings in real time, complete with reproduction steps and near-ready patches.
🗞️ Android Levels Up Against Scammers with AI-Powered Defenses (Google Security) – Gemini-powered protections flag scam tactics in calls and messages. “Verified financial calls” checks incoming calls directly against banking apps and blocks spoofed bank numbers in real time.
Recommendations
☑️ Hunt now for rogue WordPress admin accounts that match wp2_ + eight hex characters. Audit WordPress REST API batch endpoints, and lock down open directories on external infrastructure.
☑️ Put defensive AI to work. Eligible maintainers should enroll in OSS Scanner, but they should also build verification workflows, because AI-generated severity judgments can be wrong.
☑️ Tighten identity vetting for freelancers, guest contributors and new partners. Audit past third-party content that pushed polarised geopolitical messaging, and share intelligence on “false front” entities.
☑️ Invest in continuous EASM and threat hunting sized for machine-speed attackers. Keep Android devices and Google Messages updated so the new scam protections are active.
Theme 3: Trust Abused
Stories
🗞️ Supply Chain Hijacking: GitHub Hardens npm Publishing After Flaw Exposes 1,500+ Packages (The Hacker News) – In the “SlugFest” flaw, npm Trusted Publishing bound OIDC trust to mutable repo names. Anyone who claimed an abandoned slug could mint publish tokens for packages with 10M+ downloads
🗞️ Fake Arch Linux Packages Push Malware with Root Privileges (BleepingComputer) – Fake AUR copies of yay and paru pulled their payload through a Wayback Machine URL that redirected to a GitFlic repo, which slipped past repository scrutiny and ran as root.
🗞️ Supply Chain Interdiction: Ledger Confirms Hardware Spy Implants Behind Crypto Thefts (BleepingComputer) – Nano X wallets sold through reseller CryptoBilis had a flex PCB and cellular antenna that sniffed seed phrases from the display lines. Genuine Check validates only the secure chip, so it never saw the implant.
🗞️ Cryptographic Flaw in GoBalance Exposes Darknet Private Keys, Enabling Total Site Takeovers (Searchlight Labs) – GoBalance left out the nonce prefix during key expansion, so anyone could calculate master signing keys from public Tor descriptors. That is how Dread’s onion address was hijacked.
Recommendations
☑️ Delete stale npm trust bindings for transferred, renamed, or deleted repos. Alert on unexpected publish events and new trusted publishers, and bind trust to immutable IDs rather than re-claimable names.
☑️ Inspect PKGBUILD and install scripts before building, and never approve sudo for community packages without review. Build third-party code in sandboxed, non-root environments with egress filtering. Treat anyone who installed the fake yay/paru as fully compromised and have them rotate all credentials.
☑️ Buy hardware wallets and signing devices only from the manufacturer. Anyone with CryptoBilis-sourced devices should generate fresh seeds on trusted hardware and move their funds.
☑️ Patching does not fix keys that have already leaked. Rotate compromised keys and credentials, keep master keys offline in HSMs, and get custom crypto code independently audited.
Theme 4: Ads, Apps & the Cybercrime Service Economy
Stories
🗞️ Malvertising Campaign Abuses Bing Search Links in Google Ads to Deliver Fake Claude Installers (Push Security) – Google Ads point to a legitimate Bing result. The fake installer and ClickFix payload serve only when the victim follows the full cross-engine path, which defeats ad review. 🔎 Threat Hunting Package
🗞️ Zero-Click Spyware Delivered via Targeted Ads: Exposing ‘AdFection’ (Citizen Lab) – Discover-Tech posed as a legitimate ad vendor. Its “Controlium” platform fingerprinted victims and delivered Candiru spyware the moment an ad rendered, with no click needed. 🔎 Threat Hunting Package
🗞️ Hirudo Android Banking Trojan Replaces Legitimate Banking Apps with Patched Copies (ThreatFabric) – Rather than relying on overlays, Hirudo builds the YAHFA and Dobby hooking frameworks into trojanised banking apps. From inside the app, it defeats screenshot protection and spoofs certificates and Play Integrity verdicts. 🔎 Threat Hunting Package
🗞️ Microsoft and Global Partners Dismantle Chinese-Language Cybercrime Services (Microsoft) – The takedown of YAM Store, CoGUI and Iron Man shows how criminals with no technical skill can buy everything they need: 2,300+ phishing templates, fraudulent sites and hijacked Microsoft 365 accounts.
Recommendations
☑️ Use enterprise ad-blocking or DNS filtering to stop clicks on sponsored results, and block known Discover-Tech and Candiru IOCs. Consider browser-level detection that inspects multi-stage redirect chains.
☑️ Train staff to download software only from verified vendor domains, never to run Terminal commands a web page tells them to, and to verify urgent delivery, toll, or account messages through official channels.
☑️ On mobile, block sideloading, restrict Accessibility permissions, and deploy MTD that flags signature mismatches, app replacements, and hooking libraries.
☑️ Banks should treat client-side telemetry as untrusted and move to server-side attestation and behavioral biometrics. Defenders should ingest indicators from YAM Store, CoGUI, and Iron Man and enforce strong MFA.
Theme 5: When Cyber Gets Physical
Stories
🗞️ Physical Disruption in the Cold Chain: Cyberattack Heats French Supermarket Fridges to 50°C (The Register) – There was no ransomware and no data theft. Attackers abused remote defrost functions on exposed legacy Danfoss AK-SM/AK-SC controllers to spoil stock and start fires.
🗞️ Kinetic Warfare Targets Cloud Infrastructure: Ukraine Strikes Third Yandex Data Center (The Record) – A drone strike on Yandex’s 50MW Vladimir data center knocked out 80+ platforms. Physical destruction caused systemic downtime without a single exploit.
🗞️ Ransomware Gets Personal: Extortionists Escalate to Physical Threats and Home Intimidation (Semperis) – Extortionists use doxxing, data brokers, and OSINT to put pressure on people’s homes. In one case, investigators received Russian nesting dolls at their private addresses mid-negotiation.
🗞️ OpenAI Engineer Charged After Covert Listening Device Found in Executive Boardroom (The Register) – An off-the-shelf ESP32-S3 Sense bug, wrapped in toilet paper and powered by a TV’s USB port, was planted in the boardroom. OpenAI analyzed it with its own models and then caught the engineer on a covert camera when he came back to check on it.
🗞️ DOJ Indicts 14 in North Korean Remote IT Worker Scheme Infiltrating 70+ U.S. Companies (U.S. DoJ) – U.S. facilitators hosted company laptops in residential “laptop farms.” DPRK operatives controlled them remotely, so their traffic looked domestic.
Recommendations
☑️ Take OT and building-management controllers off the internet, or put them behind VPNs and IP allowlists. Reset default credentials, replace end-of-life hardware, segment OT from IT, and add hardware thermal cutoffs or out-of-band alerts.
☑️ Build for physical loss with active-active multi-region redundancy, tested DR plans with immutable off-site backups, and no dependence on a single facility or high-risk jurisdiction.
☑️ Bring physical security, HR, and cyber together under one insider-threat and crisis framework. Run TSCM sweeps of executive spaces, lock down USB ports on meeting-room displays, scrub executives’ and responders’ PII from data brokers, and route extortion negotiations through pseudonymized accounts.
☑️ Harden hiring and onboarding with video-on interviews and live ID verification. Flag multiple devices shipped to one address, unexpected remote-access tools, and proxy logins. Tie access to FIDO2 tokens and MDM-enforced device certificates.
Feature Livestream
Part 11 of MISP From Scratch is live.
You’ve got MISP running. Events are flowing in. But when someone asks “what do we actually have?”, you’re clicking through event lists and guessing.
This week we fixed that.
We started with zero Grafana and finished with a nine-panel threat intelligence dashboard that reads straight from the MISP API:
✅ Setting up Grafana in Docker
✅ The Infinity data source talking to /events/restSearch
✅ A read-only API key, so the dashboard can’t change anything
✅ JQ that flattens nested event JSON into clean panels
✅ Clickable event IDs that jump back into MISP
The dashboard answers three questions: what data do we have, what’s ready to use, and what needs an analyst’s attention?
All demo data is synthetic, so you can follow along safely on your own instance.
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
