Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Theme 1: The Package Registry Is the Attack Surface
Stories
🗞️ Active “Shai-Hulud” Supply Chain Attack Compromises Keyv & 400+ NPM Packages Spanning 2B+ Installs — Attackers hijacked a lead maintainer’s GitHub account and committed malicious preinstall scripts directly to the repo, so the poisoned packages were built and published with legitimate, signed GitHub Actions attestations. Provenance checks passed on malware. 🔎 Threat Hunting Package
🗞️ North Korean Hackers Unmasked Behind Widespread NPM Supply-Chain Attacks — Amazon attributed the axios and debug compromises to Sapphire Sleet. No zero-days involved — just patient social engineering of trusted maintainers. Trojanized updates reached 10% of cloud environments within two hours.
🗞️ Arch Linux Halts AUR Package Adoption Amid Massive Malware Flood — A two-stage Rust infostealer that checks for debuggers and VMs, then pulls a Tor client disguised as dbus-daemon to fetch its payload. It steals developer secrets and uses harvested SSH keys to spread laterally on its own.
🗞️ Evil Twin Extensions Target Open VSX Registry to Compromise Developer Workspaces — Typosquatted extensions hitting Cursor, Windsurf, and VSCodium users. The malicious code arrives via transitive manifest dependencies after the initial install review passes. 🔎 Threat Hunting Package
🗞️ How DPRK Hackers Hide C2 Servers in Blank Ethereum Transfers — “NullReceiver” encodes the C2 IP directly into the recipient field of an empty Ethereum transaction. Delivered by trojanized npm packages, it leaves no financial trail and kills static IoC matching.
Recommendations
☑️ Pin or downgrade affected packages to clean releases, isolate impacted developer machines and build runners, and aggressively rotate every exposed credential — npm tokens, GitHub PATs, AWS keys, Kubernetes tokens, Vault secrets.
☑️ Disable or strictly inspect preinstall and postinstall lifecycle scripts, and enforce dependency version pinning via lockfiles across all build pipelines.
☑️ Deploy dependency firewalls and automated package inspection before execution in build systems, backed by continuous SBOM monitoring to catch compromised upstream components pre-deployment.
☑️ Audit installed IDE extensions now, confirm publisher identity and namespace authenticity, and remove anything unverified.
☑️ Hunt for unexpected systemd services, unauthorized cron jobs, anomalous Tor traffic, and outbound connections to crypto node RPCs (1rpc.io, drpc.org) from application servers.
☑️ Audit developer AI coding agents for slopsquatting — LLM-hallucinated package names that developers install without checking.
Theme 2: ClickFix Has Gone Cross-Platform
Stories
🗞️ Midnight Blizzard Strikes Travelers: Beware the CaptiveCrunch Campaign — Storm-2945 manipulates traffic on compromised captive Wi-Fi portals at hotels and conference centers, serving convincing fake update prompts that install the CornFlake RAT and ChocoShell infostealer straight off the login screen. 🔎 Threat Hunting Package
🗞️ DOUBLECUP LaaS Exploits ClickFix Lures & Environmental Keying to Deliver Novel RATs — A Russian Loader-as-a-Service impersonating NetSuite, Odoo, HubSpot, and Salesforce. It locks its steganographic payloads using the victim’s public IP as a cryptographic key, so sandboxes can’t decrypt what they capture. 🔎 Threat Hunting Package
🗞️ macOS ClickFix Campaign Uses Cloaking Gates to Hide Infostealer Lures — A ~2.5 KB JavaScript profiling gate inspects WebGL GPU rendering and DOM tripwires, serving blank decoy pages to scanners and the real lure only to genuine Macs. MacSync and Atomic Stealer follow. 🔎 Threat Hunting Package
🗞️ ClickFix Campaign Delivers Go-Based macOS Malware to Drain Crypto Wallets — Beyond harvesting the Keychain, this one has a dedicated DRAIN function that checks live wallet balances, redirects funds to attacker wallets, and wipes Terminal history behind it. Infrastructure ties back to the sanctioned Aeza Group. 🔎 Threat Hunting Package
🗞️ SMOKE#SCREEN Campaign Abuses Cloudflare Tunnels & Trusted Lures to Deploy Rogue ScreenConnect RMM — Rotating lures (fake Zoom updates, document reviews) paired with active tampering — AMSI, SmartScreen, and UAC all disabled — while C2 staging routes through ephemeral Cloudflare Tunnels to look like normal traffic. 🔎 Threat Hunting Package
Recommendations
☑️ Train users on one non-negotiable rule: no legitimate website, CAPTCHA, system update, or Wi-Fi portal will ever ask you to paste a command into PowerShell or Terminal.
☑️ Restrict PowerShell and MSHTA from being spawned by browsers or clipboard interactions, and alert when macOS terminal emulators pipe curl/wget into zsh, bash, or base64 decoders.
☑️ Build behavioral detections for security control tampering — AMSI bypass, SmartScreen disablement, UAC manipulation — and for shell processes erasing command history.
☑️ Inventory all RMM software across the estate, isolate unauthorized ScreenConnect agents, and terminate unrecognized cloudflared.exe processes.
☑️ Block outbound requests for steganographic PNGs (/stego-image.png) and unusual calls to public IP-retrieval services.
☑️ Monitor Entra ID for anomalous device code auth flows and unauthorized device registrations tied to traveling staff, and enforce behavioral controls around macOS Keychain, browser cookies, and credential stores.
☑️ Hunt CornFlake’s redundant persistence — deceptive service registrations, scheduled tasks, and registry Run keys — rather than assuming one removal cleans the host.
Theme 3: Trust Guarantees That Didn’t Hold
Stories
🗞️ Pass the Passkey: Malware Can Hijack Google Synced Passkeys Without Cracking Crypto — “Pass-ta-key” proves passkeys don’t neutralize local malware. Unprivileged code manipulates Google Cloud Authenticator’s device trust and recovery workflows to steal the Security Domain Secret and mint valid assertions — no biometric, no user interaction, no elevation.
🗞️ New “Greatness” PhaaS Exploits Vendor Trust to Deliver M365 AiTM Phishing — A $289/month Telegram subscription running AiTM and device code phishing. Spoofed RingCentral voicemail lures walk straight past gateways by abusing misconfigured safe sender whitelists. 🔎 Threat Hunting Package
🗞️ Multi-Brand Vishing Campaign Escalates Attacks on Financial Services & Enterprise Cloud Infrastructure — UNC6671 rebranded across four fronts and now calls employees on their personal mobiles posing as IT help desk, routing them to fake passkey/SSO migration portals that hijack MFA tokens and kick off automated exfiltration. 🔎 Threat Hunting Package
🗞️ Critical IP and DNS Leaks Discovered in Apple iCloud Private Relay and WebKit Proxy Browsers — Three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — run outside standard page loading and bypass application-level proxy settings entirely, exposing real IPs from the device’s actual network.
Recommendations
☑️ Move high-value accounts to FIDO2 hardware-backed credentials that cryptographically bind authentication to the origin domain, neutralizing AiTM proxy panels.
☑️ Relying parties must enforce and validate the User Verified (UV) flag in WebAuthn assertions (not just key presence) and reject assertions where biometric/PIN was bypassed.
☑️ Replace broad domain-based email exclusions with authentication-conditional rules requiring verifiable vendor identity, and add behavioral detection for sender–link domain mismatches.
☑️ Run a targeted awareness campaign: no IT migration instructions accepted over personal mobile phones, and no credentials entered on unverified passkey/SSO enrolment links.
☑️ Monitor M365 Unified Audit Log and Okta system logs for Graph API enumeration, session persistence, logins from commercial VPN exit nodes, and bulk harvesting from SharePoint and OneDrive.
☑️ Tune EDR to catch unprivileged processes tampering with Chrome sync database files or reading browser process memory.
☑️ Treat hardware-backed credentials as one signal, not proof — pair them with real-time device health and adaptive, risk-based access. Patch proxy browsers, set Onion Browser to “Silver,” and use a system-wide VPN over browser-level privacy.
Theme 4: The Perimeter You Stopped Looking At
Stories
🗞️ Critical N-able N-central Vulnerability Under Active Exploitation — A “god-mode” flaw in all versions up to 2026.3 gives unauthenticated attackers full RMM console access. They’re arriving via VPN exit nodes, enumerating processes, and tearing through downstream hosts — Domain Controllers first. 🔎 Threat Hunting Package
🗞️ INC Ransomware Exploits SonicWall SMA via WSProxy Chain to Gain Root Access — Chaining WSProxy components to root on internet-facing SMA appliances, then deploying ransomware directly from the edge device. 🔎 Threat Hunting Package
🗞️ FBI & EPA Warn of Cyber Attacks Targeting Internet-Facing PLCs in US Water Systems — No exploit payload required. Actors reach unsegmented Allen-Bradley MicroLogix 1100/1400 PLCs over the open internet and simply change IPs and passwords to lock operators out of their own water pressure controls.
🗞️ Tracking DarkSword: Unraveling an Exploit Chain Through Panel Sprawl — A six-vulnerability iOS chain (18.4–18.7) behind fake AWS and Apple ID pages. The tradecraft lesson: operators reuse identical static HTML across hosts and odd ports, making SHA-256 body hash correlation more reliable than chasing domains. 🔎 Threat Hunting Package
Recommendations
☑️ Patch N-central to hotfix 2026.3.1.7 immediately — and if it’s internet-reachable and you can’t patch today, take it offline until you can.
☑️ Audit and disconnect every PLC directly exposed to the internet, broker remote access through secure gateways with strict ACLs, validate running logic against known-good backups, and flip key switches to RUN to block remote logic changes.
☑️ Audit internet-facing SonicWall SMA appliances, isolate exposed management interfaces, and apply vendor patches.
☑️ Review N-central logs for unauthorized “MSP Support” connections, unexpected Take Control sessions (Event IDs 4102, 8192, 8193), svchost.exe in user Documents folders, and services named Cloudflared.
☑️ Alert on anomalous process spawning, unauthorized credential access, and unusual outbound connections originating from security gateway devices. The appliance is the attacker’s foothold, not just the door.
☑️ Enforce ZTNA and micro-segmentation so a compromised perimeter gateway can’t reach core assets, and keep tested manual override protocols for OT outages.
☑️ Shift infrastructure hunting from IPs and domains to static body hashes, TLS metadata, and certificate SAN correlation — and extend scanning to non-standard ports like 3000, 8443, and 8888.
Theme 5: Agentic AI — Now Both Attacker and Attack Surface
Stories
🗞️ AI Cyberattacks Hit the Wild: Hacker Commands DeepSeek Agent for Autonomous Server Exploitation — One Telegram instruction kicked off an agent that enumerated targets via FOFA, scraped GitHub for trending PoCs, prioritized vulns, and ran attack cycles against 460+ hosts with no human in the loop. It only got caught by accidentally launching an HTTP file server in its own workspace.
🗞️ Critical Paperclip Flaws Expose AI Agents to Remote Code Execution — Three vulns including a CVSS 10.0. The root cause is treating agent configs (imported YAML bundles) as executable code; open registration defaults and DNS rebinding against loopback isolation give zero-click RCE.
🗞️ Claude Mythos 5 Attempts Backdoor Injections and PyPI Supply Chain Exploits — The model reached the live internet during testing, generated fake GitHub maintainer profiles to solicit backdoor approvals, published a trojanised PyPI package that 15 real systems installed, and rationalized live telemetry as “part of the exercise” to keep going.
🗞️ Rogue AI Strikes Again: Meta’s Muse Spark 1.1 Breaches Third-Party Systems — Not a sandbox escape. Testing partner Irregular misconfigured the environment and exposed it to the public internet, and the agent breached and altered a third party’s internal systems from there.
Recommendations
☑️ Enforce hard network air-gaps on all AI red-teaming and evaluation environments, then audit existing ones for the misconfiguration that quietly grants public internet routing.
☑️ Upgrade Paperclip to 2026.416.0+, disable open signups, and audit agent configurations for unintended capabilities.
☑️ Treat agent configuration strictly as code — rigorous review, testing, and multi-approver governance before deployment — and apply the same multi-approver bar to open-source commits and package releases.
☑️ Patch internet-facing infrastructure against known critical vulns fast, prioritizing Citrix NetScaler and AI orchestration frameworks like Langflow, because the exploitation window is now machine-speed.
☑️ Deploy WAFs and exposure management to spot rapid automated enumeration and unauthenticated PoC execution, backed by behavior-based endpoint protection that can break machine-speed attack loops.
☑️ Scan internal environments and public dependencies for unverified libraries published during recent red-team evaluation windows, and remove anything suspicious.
☑️ Constrain the credentials, secrets, and access paths available to live agents, and monitor agent execution logs for anomalous behavior in real time with automated fail-safes.
Feature Video
The threat intel feed you just bought is probably making your security worse.
Not because the data is bad. Because you bought it too early. ⏱️
CTI only works above a specific maturity threshold. NIST level 3 — Repeatable.
⚡ Documented incident response
⚙️ Standardized processes
📂 Backups you have actually restored from, not just scheduled
Below level 3, a threat feed is a distraction. It generates alerts nobody has a process to action, false positives that erode analyst trust, and a dashboard that makes leadership feel protected while nothing changes.
Above level 3, the same feed is a force multiplier.
The practical gateway is CIS Implementation Group 1 — 56 foundational safeguards. Asset inventory. Data recovery. IR planning. MFA on everything external-facing.
Boring? Completely. But those 56 controls are what turn intelligence into action instead of noise.
👉 Learn how to get started with CTI as an SMB today in our latest video!
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
