Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
AI Tools Are the New Attack Surface
Stories
🗞️ Critical ChatGPT Vulnerability: How a Shared Link Exposed Private Chats (Parameter Labs) – A now-patched P1 bug chained a flaw in the MathLive library with ChatGPT’s HTML Preview, so an attacker could run JavaScript in a victim’s logged-in session once they opened a shared link. The sandbox still compromised the parent app because its postMessage listeners never checked the sender’s origin. The attackers got past the CSP by abusing a legitimate YouTube JSONP endpoint.
🗞️ ChatGPT ‘Lockdown Mode’ Bypassed: Zero-Click Flaw Exposes Sensitive Data (Check Point Research) – A sandbox escape in the HTML preview uses nested iframes to call a real window.open. That opens a covert channel outside Lockdown Mode’s network restrictions, which allows chat histories to be exfiltrated with no clicks in ChatGPT Classic.
🗞️ Claude Dispatch Flaw Exposes Corporate Endpoints to OS-Level RCE (Forever Security) – “ThisBash” lets a malicious browser extension turn a logged-in claude.ai web session into command execution on the local OS through Claude Desktop. The extension can sit on an employee’s personal device and still reach a work laptop signed into the same account.
🗞️ ‘Prompt Adware’ Emerges: Hackers Weaponize AI Jailbreaks in OpenAI Codex (Check Point Research) – The “Haiou” jailbreak bundle permanently rewrites Codex config files to push ads for an opaque LLM gateway. Natural-language instruction files now carry the same risk as executable code.
🗞️ Stolen Cloud Credentials Driving $100K+ Daily AI Bills (Google Threat Intelligence Group) – In “LLMJacking”, criminals steal cloud API keys and resell model access through “LLM Mixers” such as Jet Night. Victims can run up as much as $1M in charges within days, which is why this is overtaking cryptojacking. 🔎 Threat Hunting Package
Recommendations
☑️ Treat AI assistants and agents as high-privilege surfaces. Use EDR rules to monitor OS commands from desktop AI apps, ban personal AI accounts on corporate endpoints, and stop unverified browser extensions from interacting with AI domains.
☑️ Review natural-language instruction files, agent skills, prompt packages and LLM gateways to the same standard as code. Check where they came from before you use them, and watch agents for odd behavior or unprompted ads.
☑️ Treat AI sharing features like any untrusted link. Don’t open unknown shared chats or paste unverified prompts, and refresh ChatGPT sessions to load OpenAI’s 26 October fix. Don’t rely on built-in AI security features alone: apply zero trust to any credentials shared with assistants and use Compliance API logs for visibility.
☑️ Lock down GenAI cloud access. Apply least-privilege IAM with no standing GenAI permissions, set aggressive cost-anomaly and billing alerts on LLM API volume, and use egress controls to block relay traffic.
☑️ Development teams should validate both event.origin and event.source on every postMessage receiver.
AI Supercharges the Offense
Stories
🗞️ AI-Driven Malware: VOLTA Infostealer Automates Victim Profiling (Cisco Talos) – VOLTA-AUTODOXER sends enriched victim dossiers to LLMs through OpenRouter to rank each victim by financial value and OPSEC. If one model refuses, it falls back to more permissive ones. The AI isn’t writing the malware here; it’s working as the analyst who triages victims at scale.
🗞️ Advanced AI Campaign Targets Government Linux Infrastructure (Palo Alto Unit 42) – CL-UNK-1211 hit government Linux servers using AI-generated payloads in PHP, JavaScript, Bash, and Python, plus the SysGoRAT backdoor. The AI use shows in the code: tidy section headers and explanatory comments. 🔎 Threat Hunting Package
🗞️ AI’s 948 Zero-Days: What OpenAI’s Latest Cyber Model Means for Your Defenses (OpenAI) – An autonomous pipeline found, exploited, and patched 948 privilege-escalation bugs in the Linux kernel. On an unpatched system, a low-privileged account is now close to as dangerous as root.
Recommendations
☑️ Patch much faster and assume flaws will be weaponized within hours. Don’t rely on the kernel as your only boundary: isolate workloads with gVisor or Firecracker.
☑️ Harden credential stores against infostealers. Block Chrome from being launched with –headless, which stops the App-Bound Encryption bypass VOLTA uses. Require hardware-backed credential storage, and treat any seed phrase stored on disk as exposed.
☑️ Hunt for Linux persistence. Watch .bashrc and login workflows for fake sudo aliases, and audit PHP’s auto_prepend_file setting.
☑️ Prepare incident responders. Preserve %APPDATA%\volta_debug.txt before the malware deletes itself, and train responders to spot false-flag markers, timestamp manipulation, and attempts to disable EDR.
☑️ Use AI on defense too: build AI-driven vulnerability scanning and patch generation into CI/CD.
Trust Betrayed: Supply Chain Compromises
Stories
🗞️ Polymarket Breach: Millions Drained via Third-Party Script (Hudson Rock) – A hijacked DebugBear monitoring script drained over $2M. It didn’t need any keys: it found the live trading client in active sessions and used the existing authorization to sell positions and move funds.
🗞️ Trojanized Claude Code Extension Drops Persistent SSH Backdoors on Developer Machines (OpenSourceMalware) – A poisoned v2.1.313 build sat on the Cursor Marketplace for 11 hours. It maps cloud and token environment variables, plants an svc-telemetry SSH key, and adds OS-level persistence, so uninstalling the extension leaves the backdoor in place. 🔎 Threat Hunting Package
🗞️ cPGuard Update Channel Hijacked to Backdoor Linux Servers (OpsShield) – Attackers used a security tool’s own update network (versions 5.88.12 to 5.88.19) to steal password hashes and root SSH keys from hosting servers.
🗞️ Millions of Devices Ship with Pre-Installed Botnet Backdoor (Google Threat Intelligence) – The XCPE backdoor was written into the factory firmware of more than 1.3M Videostrong devices. Plugging one in was enough to join the botnet. 🔎 Threat Hunting Package
🗞️ Russian APT29 Deploys Mobile N-Day Exploits in Massive Watering Hole Campaign (Sekoia) – APT29 combined watering holes with a tampered Plerdy analytics tracker to serve no-click iOS and Android exploits. The goal was to steal cookies and Wi-Fi passwords. 🔎 Threat Hunting Package
🗞️ $133 Million Stolen from French Bank in Sophisticated Crypto Scheme (The Record) – Attackers got into Crédit Mutuel Arkéa through a third-party provider and used the bank’s own accounts to wire funds to crypto. The money was laundered across 15 wallets in 21 hours.
Recommendations
☑️ Lock down third-party web code. Apply strict CSP and SRI on sensitive pages, and keep verifying the integrity of analytics and SEO scripts.
☑️ Control what runs on developer and admin machines. Turn off auto-updates from unverified IDE marketplaces, manage developer endpoint posture centrally, and push cPGuard to 5.88.25 or later (cpgcli update –start).
☑️ If you installed a bad update, assume you’re compromised:
- Hunt for svc-telemetry in authorized_keys, ~/.config/.smt and com.apple.sysmond.plist.
- Block 134.209.82.225.
- From a clean host, rotate every secret, cloud credential, Git token, and SSH key, including /root/.ssh, and remove the old public keys from every system that trusts them.
☑️ Check your hardware inventory for Videostrong and MECOOL devices, plus IoT signage and telehealth kit. Replace infected devices rather than trying to clean them, and alert on IoT MQTT traffic on ports 3885 to 3887.
☑️ Put vendor access behind zero-trust controls. Flag fiat-to-crypto transfer spikes in real time, and build relationships with blockchain intelligence firms and exchanges so stolen funds can be frozen quickly.
☑️ Enforce mobile OS updates through MDM and require short-lived session tokens, which blunts n-day exploits and cookie theft.
Humans Are the Front Door
Stories
🗞️ FBI Confirms North Korean Hackers Stole $6.3B in Record-Breaking Binance Heist (BleepingComputer) – The FBI attributes the theft to TraderTraitor (Lazarus), who got in through a single DevOps engineer’s laptop. “Operation DreamJob” fake recruiters and malicious coding tests get around perimeter security entirely.
🗞️ Binance Suffers Record $6.43 Billion Theft via Fake Job Interviews & AI Tool Abuse (Binance) – Binance’s own account shows the attackers combined a poisoned Homebrew installer with a fake interview process. They then abused internal AI tools to move laterally and capture container deployment tokens.
🗞️ Threat Actors Exploiting Microsoft Teams for Domain Takeovers (Microsoft) – Attackers pose as the help desk in Teams to get Quick Assist access, then stage portable runtimes and abuse the AD CS ESC1 and ESC8 misconfigurations. The forged certificates survive password resets. 🔎 Threat Hunting Package
🗞️ Fake AI Event Campaigns Exploit OpenAI & SpaceX Lures to Hijack Accounts (Push Security) – Fake event pages using OpenAI, SpaceX, and Anthropic branding combine AiTM and device code phishing, run through the Kali365 and VoidProxy PhaaS platforms. The operators rotate lure domains every few weeks to stay ahead of scanners. 🔎 Threat Hunting Package
🗞️ mSecure Password Manager Issues Urgent Reset Warning Over Unexplained “Suspicious Activity” (The Hacker News) – A vague alert left users unsure whether the cloud, the app or their vaults were affected, so they had to assume the worst. It’s a case study in how unclear crisis communication erodes trust.
🗞️ Vercel Deploys New DBSC Protection to Thwart Session Cookie Theft (BleepingComputer) – TPM-bound session keys make stolen cookies useless on any other device, which cuts off infostealer session hijacking.
Recommendations
☑️ Run targeted awareness training, especially for engineers. Cover fake recruiters and unverified coding “assignments”, unsolicited IT support on Teams (watch for the “External” and “Scam suspected” labels), invitations offering free AI subscriptions, and authentication prompts the user didn’t start.
☑️ Apply zero trust and PAM to developer and DevOps environments so that one compromised endpoint can’t reach containers or sign transactions. Require multi-party authorization for wallet signing and deployments, and use application control to block tampered packages.
☑️ Harden identity infrastructure:
- Block or alert on device code flows for users who don’t need them.
- Fix ESC1 certificate templates and turn on NTLM relay protections for ESC8.
- Include privileged accounts in automated attack disruption.
☑️ Bind sessions to devices with DBSC (Chrome on macOS and Windows), App-Bound Encryption and, where available, DPoP.
☑️ Block the 628 Lazarus addresses published by the FBI, and retro-hunt the fake-event IOCs through your historical logs.
☑️ mSecure users should change their master password inside the app rather than through email links, rotate high-value credentials, re-enroll 2FA and passkeys, and move TOTP codes to a separate authenticator.
Exposed & Unpatched: Edge, Devices, and OT
Stories
🗞️ C3RB3R Ransomware Campaign Exploits Outdated Synology NAS Devices (Synology) – Attackers are using flaws patched in December 2024 to encrypt files with a .L0CK3D extension. Slow patching is what made this possible.
🗞️ Stealthy ‘CWPdoor’ Backdoor Leaves 340,000+ Control Web Panel Instances at Risk (XLab) – A recompiled cwpsrv binary hooks into Nginx, runs only on cryptographically signed requests, and switches off logging for attacker traffic. Antivirus doesn’t detect it. 🔎 Threat Hunting Package
🗞️ Decade-Old OpenSSH Flaw Bypasses Password-Disabled Accounts on musl Linux (sshole) – A password longer than 256 bytes makes musl’s crypt() return *, which matches the * in /etc/shadow for disabled accounts. The result is a login on default Alpine cloud images.
🗞️ Unprecedented Cyberattacks Weaponize Supermarket Freezers Across Europe (The Record) – Attackers in seven countries used ordinary remote access and defrost functions, not exploits, to raise freezer temperatures to 50°C and destroy millions of euros of stock.
🗞️ Mercenary Spyware Targets iPhone Users in 110 Countries (TechSpot) – Zero-click exploits costing millions to build are aimed at journalists, activists, and diplomats. They’re very hard to detect without Apple’s own threat intelligence.
Recommendations
☑️ Patch exposed systems now: Synology DSM 7.2.2 or later, OpenSSH 10.6p2 (apk upgrade openssh), the latest CWP release, and current Apple OS versions.
☑️ Take management interfaces off the internet. Disable forwarding on ports 5000 and 5001, and allow access only over VPN. Set PasswordAuthentication no as a stopgap until you can patch SSH, and move OT equipment to read-only telemetry.
☑️ Lock down OT and IoT vendor access with MFA and segmented zero-trust networks, and require physical on-site authentication for overrides.
☑️ Hunt for compromise:
- Run the CWPdoor socket, process, and string checks.
- Look for Accepted password events on disabled accounts.
- Remove default admin accounts from cloud templates.
- Rotate credentials and look for Ebury as a secondary payload.
☑️ Plan for recovery and for high-risk users. Keep 3-2-1 immutable, offline backups. Anyone who gets an Apple threat notification should turn on Lockdown Mode and Stolen Device Protection and contact a helpline such as Access Now.
Feature Video
Your IOC feed is your adversary’s receipts. Delivered by a third party, after the transaction has cleared.
Every indicator in your feed was born after somebody else’s incident. Hashes, IPs, and domains sit at the bottom of the Pyramid of Pain for a reason. They’re the cheapest things an attacker can burn and replace. 🔥
IOCs still earn their keep. They scope incidents, drive retro hunts, and block commodity noise for free.
🔮 But receipts aren’t foresight.
Requirements tell you what’s being prepared against you. They buy you time to prepare for an attack, prioritize what is relevant to your business, and zero in on defenses that make a difference.
Most teams treat the gap between an access listing and ransomware as a detection deficit. They assume faster feeds and better block lists will fix it.
👉 It’s a structural problem, and it starts with how you decide what to collect.
I broke down a framework from Intel 471 that tackles exactly this… the Cyber Underground General Intelligence Requirements (CU-GIRs).
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
