Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Theme 1: AI Agents Are Going Off-Script
Stories
🗞️ AI Agents Access Sensitive Data at Indian Organizations Undetected (CERT-In) – AI agents under test reached sensitive business records through exposed credentials. None of the victims noticed. They found out only when the AI companies reported the incidents to CERT-In themselves.
🗞️ OpenAI Discloses Rogue Agent Actions: Research Model Spent Third-Party Test ETH to Deploy Smart Contract (OpenAI) – OpenAI disclosed seven incidents where research models slipped their sandboxes. In one, a model justified using a publicly found seed phrase by deciding the testnet ETH was “valueless.” Other models tampered with their sandboxes to force resets after failing checks.
🗞️ NVIDIA Supercharges AI Agent Management with OpenShell Partnership (The Register) – NVIDIA is bringing OpenShell into its AI workflows to rein in “shadow AI” agents. It marks a shift from deploying AI to actively governing it, with one place to monitor agents and enforce guardrails.
🗞️ WhatsApp Caught Hiding System Prompts That Suppressed Privacy Regulators (Wired) – More than 100 hidden “WHAT NOT TO SAY” prompt blocks were left in client-side code. They told Meta’s support chatbot never to cite data protection laws or point users to regulators, even when users asked directly.
🗞️ DHS Mandates Immediate DeepSeek Purge Across US Federal Civilian Agencies (The Register) – The directive covers more than DeepSeek’s own apps and APIs. It also bans any tool “developed using” DeepSeek, leaving organizations unsure where they stand on distilled models, fine-tuned derivatives, and multi-model routing gateways.
Recommendations
☑️ Inventory every AI agent, model, and AI gateway in your environment, sanctioned or not. That includes third-party brokers that might be quietly routing prompts to restricted models like DeepSeek.
☑️ Contain agents with hard technical controls rather than prompt instructions:
- default-deny egress
- ephemeral least-privilege identities
- circuit breakers that kill execution on unauthorized connections or sandbox changes
☑️ Build an AI governance framework that includes:
- defined permissions for what agents may do
- system prompts kept server-side
- prompt-architecture audits and red-teaming
- agent anomalies piped into SOC alerting like any other threat
Theme 2: Dev Secrets Are the New Crown Jewels
Stories
🗞️ OpenCode Hack Exposes API Keys Amid Massive AI Distillation Attack (BleepingComputer) – Attackers used users’ linked AI provider keys to run large-scale distillation queries for 48 hours. Some individual victims were left with rogue charges of up to $1,700.
🗞️ Infostealer Hidden in Fake Font Files Across 94 GitHub Repositories (OpenSourceMalware) – This copycat of DPRK tradecraft hides a Node.js stealer as fa-solid-400.woff2 and auto-runs it through .vscode/tasks.json. It also leaves a #ghc2 crontab backdoor that survives even after the malicious repo files are deleted. 🔎 Threat Hunting Package
🗞️ LiteLLM 1.107.0 Compromised on PyPI and Docker to Steal Cloud and AI Credentials (Socket) – The payload abuses Python startup hooks (cook.pth, sitecustomize.py). That means simply launching Python or pip fires the stealer, without LiteLLM ever being imported. 🔎 Threat Hunting Package
🗞️ Immediate Action Required for Developers Using Railway (Railway) – Decrypted environment variables may have been exposed as part of a wider campaign against AI inference providers. Railway hosts more than 16 million services and has halted all deployments while it investigates.
🗞️ Threat Actors Target IQ.Lvbs’ NovaSpark AI Model in Corporate Espionage Attack (IQ.Lvbs) – Attackers decompiled client binaries to pull out access credentials and go after the proprietary model. The activity was traced to IPs belonging to rival Comma.ai, which is itself accusing IQ.Lvbs of model theft.
Recommendations
☑️ If you used OpenCode, LiteLLM 1.107.0, Railway, or any of the affected repos, assume compromise:
- From a clean environment, rotate every exposed cloud key, AI API token, SSH key, Git credential, and database string.
- Hunt developer machines for persistence such as #ghc2 cron entries.
☑️ Harden developer tooling and pipelines:
- Set task.allowAutomaticTasks to off in VS Code.
- Pin dependencies and container digests.
- Require code-owner approval for .github/workflows and .vscode changes.
- Restrict who can publish releases.
- Never embed static tokens in client binaries.
☑️ Contain the blast radius of stolen secrets:
- Prefer short-lived tokens.
- Enforce phishing-resistant MFA on code-hosting accounts.
- Set billing limits and usage alerts on AI provider accounts.
- Monitor API logs for anomalies like User-Agent switching and bursts of 403s.
Theme 3: Patch Windows Are Now Measured in Hours
Stories
🗞️ Leaked ‘php2shell’ RCE Flaws Threaten Millions of Web Servers (Huntress) – A leak on Hacker News broke the disclosure embargo before patches were ready. The PHP team had to rush an emergency release, and end-of-life branches may never get a fix.
🗞️ Threat Actors Exploited PHP2Shell Flaws Before Public Disclosure (Amazon) – MadPot honeypots saw exploitation attempts on October 17, four days before disclosure. The disclosure date is no longer a reliable marker for when exploitation starts. 🔎 Threat Hunting Package
🗞️ Critical RCE Vulnerability in GitLab Exposes 12 Years of Releases (SOC Prime) – A CVSS 10.0 integer overflow in the regex compiler has existed since version 7.0. It puts source code, CI/CD secrets, and infrastructure configs at risk, though there’s no sign of active exploitation yet.
🗞️ 16-Year-Old “WPSplinter” Flaw Exposes Millions of Broadcom WiFi Routers to Remote Takeover (QTNKSR) – Attackers can trigger this flaw over the air with no WiFi password or WPS enrollment. From there, they can steal the PSK or open a reverse shell on ISP-supplied gateways.
🗞️ Major Browsers Block Compromised eMudhra Certificates (BleepingComputer) – A simple scripting error produced private keys so weak that anyone could recover them almost instantly. That opened the door to forged certificates for legitimate sites.
Recommendations
☑️ Patch critical internet-facing flaws in hours, not 7- or 30-day SLAs. This week that means PHP and GitLab, with no workarounds available for either.
- Inventory PHP that’s hiding inside vendor appliances.
- Update browsers, operating systems, and certificate stores, including certifi, Go, and ca-certificates.
☑️ Hunt from before disclosure, not after it:
- For PHP, start from October 17 and look for PHP_SESSION_UPLOAD_PROGRESS POSTs.
- Watch for PHP or GitLab worker processes spawning shells or download utilities.
- If you find activity from before you patched, treat the host as compromised.
☑️ Reduce exposure you can’t patch:
- Pull end-of-life PHP and legacy access points off the internet.
- Disable WPS.
- Move critical assets off ISP-provided edge hardware.
- Monitor continuously for revoked certificates.
Theme 4: Trusted Access, Turned Against You
Stories
🗞️ ARMORY CASTLE Exploits BeyondTrust Remote Support Zero-Day for Persistent Espionage (Google Threat Intelligence Group) – The actor knew the appliance inside out. They abused /ns/sbin/bt-secrets to dump the credential vault, modified HAProxy configs to survive reboots, and wiped logs to leave no forensic trace. 🔎 Threat Hunting Package
🗞️ ConnectWise Suspends Cloud Backup Following Microsoft 365 Tenant Compromises via Abused Service Principals (ConnectWise) – Attackers hijacked over-privileged service principals and authenticated straight through Entra ID, sidestepping passwords and MFA. Within minutes, they gave themselves roles like Exchange Administrator and planted client secrets in other trusted apps.
🗞️ SafePay Ransomware Escalates Attacks on Critical Infrastructure (CISA) – SafePay gets in through edge devices, then lives off the land with legitimate tools to slip past signature-based defenses like ScreenConnect, AnyDesk, TeamViewer, and RClone. 🔎 Threat Hunting Package
🗞️ Rogue Tor Exit Nodes Hijacked in Coordinated SSH Man-in-the-Middle Campaign (KABA.CX) – Attackers took over about 10% of Tor exit nodes and quietly redirected port 22 traffic to 12 interception servers. Those servers stole passwords and tried to push the Ebury backdoor.
🗞️ Partisan Zmiy Threat Actors Lurked in Healthcare Network for Two Years Undetected (Solar) – The attackers hid in a blind spot: VMware software that was installed but never used. A custom scheduler disguised their payloads as VMware Tools and WSUS components. 🔎 Threat Hunting Package
Recommendations
☑️ Patch and wall off remote access and edge appliances:
- Apply BT26-05 and harden firewalls and VPNs.
- Put management interfaces behind ZTNA or VPN.
- Forward logs off-box to a SIEM with multi-month retention, so log wiping can’t blind you.
☑️ Lock down non-human and remote identities:
- Audit Entra ID for new client secrets, role assignments, and mailbox or transport rule changes.
- Block unauthorized RMM tools.
- Disable password-based SSH in favor of keys or FIDO2.
☑️ Assume patching isn’t eviction:
- Hunt for persistence such as SAWFLY, modified proxy rules, torrc changes, hijacked services, and suspicious DLL loads.
- Remove or monitor unused installed software.
- Segment trusted partner and subsidiary connections.
Theme 5: ClickFix Scales Up, Defenders Hit Back
Stories
🗞️ New Multi-Payload Delivery Platform Powering ClickFix Malware Campaigns (Forescout) – ROMULUS turns ClickFix into a modular malware-as-a-service platform. It pairs trojanized MSIs with binaries padded to around 880 MiB, so they slip under scanner file-size limits. 🔎 Threat Hunting Package
🗞️ Google Chrome Levels Up Defenses Against Evolving Web Scams & ClickFix Attacks (Google Security) – ClickFix gets around browser download protections by having users paste commands into a terminal themselves. Chrome now flags suspicious clipboard commands in real time and adds two-tier site warnings.
🗞️ Global Police Dismantle Massive Cybercrime Networks in Africa (INTERPOL) – Operation Serengeti III ran across 21 countries, made 1,462 arrests, and recovered more than $105 million. It shows what coordinated international and private-sector action can achieve against borderless cybercrime.
Recommendations
☑️ Detect the ClickFix execution chain. Alert on browsers, clipboard activity or the Run dialog spawning PowerShell or cmd.exe with encoded command lines. Also check that scanners and sandboxes don’t automatically skip oversized, padded files.
☑️ Close the execution path with application control (AppLocker or WDAC):
- Block unauthorized MSI installs.
- Block unsigned DLL loads from user-writable directories.
- Turn on Chrome Enhanced Protection across the fleet.
☑️ Train people on the lures:
- “Paste this into a terminal” is always a red flag.
- Explain what Chrome’s suspicious and dangerous warnings mean.
- Cover AI-assisted phishing and BEC.
- Back it with enforced MFA on email and critical systems.
Feature Video
In 2013, a $1.6 million security system caught the Target breach.
The alert fired. Twice. ‼️
Nobody stopped it because the ticket said “malware.binary” and nothing else.
🚀 Over four decades earlier, a 24-year-old engineer had 17 seconds to make a call during the Apollo 11 landing. He got it right because of one page taped under plexiglass.
Weeks before, a bad simulation had pushed Gene Kranz to order something boring: a catalog of every possible alarm code and the exact action for each one.
When the 1202 alarm lit up three minutes from touchdown, nobody had to reason from first principles under pressure. They read the documentation.
The difference between a moon landing and a $300 million breach wasn’t technology. Somebody bothered to write it down. 📄
Most SOCs don’t have a detection engineering program. They have a rule library with a subscription attached.
👉 I broke down what good detection documentation looks like, and how to stop it rotting, in my latest video using the ADS framework!
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
