Hello there 👋
Welcome back to the Kraven Security weekly newsletter, where we triage the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!zx
Top News Stories
Theme 1: The AI Arms Race
Stories
🗞️ Autonomous ARTEX Agent Escapes Sandbox to Breach WorkOS (WorkOS) – An AI pentest agent got out of a researcher’s sandbox and breached WorkOS without anyone meaning it to. It found an exposed API and a local-development credential left in production, then pulled customer records from an old internal sales app.
🗞️ Hackers Exploit AI Assistant Interface to Breach German Web Host Mittwald (Mittwald) – Attackers used a flaw in Mittwald’s MCP server to compromise 56 customer projects and went undetected for eight days. They moved through the systems within seconds, which suggests they used AI to speed up the attack.
🗞️ Weaponized AI Pentest Tool ‘AntiFox’ Accelerates AWS Intrusions (Arctic Wolf) – Attackers are using an open-source AI agent framework to plant IIS webshells and enumerate AWS. A wall of “AccessDenied” responses doesn’t mean the attack failed, because the agent fires hundreds of requests and still extracts the secrets. 🔎 Threat Hunting Package
🗞️ Anthropic’s Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattacks (The Hacker News) – Fable 5.2 completed 76.3% of the multi-stage attack challenges on CyScenarioBench. It also scored 89.6% on CVE Rediscovery, which tests whether a model can find known vulnerabilities given only the affected source code.
🗞️ OpenAI Launches Daybreak Security Agents: Automating the Defense Loop (The Register) – OpenAI has launched Daybreak Red Team and Defense Factory. Defense Factory investigates flaws on its own and writes tested pull requests ready to merge, shrinking the gap between finding a bug and fixing it.
Recommendations
☑️ Treat MCP servers and AI assistant integrations as public-facing APIs. Validate input, rate-limit them, monitor them, and make sure you can switch them off without taking core services down.
☑️ Hunt for activity happening at machine speed. Look for very fast lateral movement and bursts of discovery calls across services from one IP using several identities. Don’t write off floods of “AccessDenied” as failed attacks.
☑️ Turn on CloudTrail data-event logging for critical S3 buckets. The default management events don’t record object-level reads or deletes.
☑️ Remove default, predictable, and local-development credentials from internet-facing APIs and production. Add rate limiting and modern access controls to legacy and internal apps.
☑️ Prioritize fixes by whether an attacker can actually reach the flaw and by your threat model, not by raw severity score. Add AI-assisted code scanning to CI/CD.
☑️ If you run autonomous security agents, keep them in isolation that fails safe, give them tight scopes, and have a human review AI-generated patches before they ship. Plan for losing access to a frontier-model vendor.
Theme 2: Poisoned Pipelines
Stories
🗞️ Massive Supply Chain Attack: ‘wfx-loot’ Campaign Compromises 4,800+ GitHub Accounts (Aikido) – Attackers used stolen GitHub accounts to push a CI secret stealer into tens of thousands of repositories. After stealing the secrets, they revert the commit and delete the workflow logs, so a missing workflow run is one of the few reliable signs of compromise. 🔎 Threat Hunting Package
🗞️ Infected GitHub Repositories Target Cybersecurity Professionals with Multi-Stage Malware (Dr. Web) – Poisoned security and blockchain-game repos deliver a modular trojan with a backdoor, a crypto clipper, and a stealer. It evades defenses with a Smart App Control bypass, Ntdll unhooking, and Halo’s Gate, and it targets security people specifically. 🔎 Threat Hunting Package
🗞️ AI Coding Agents Are Accidentally Leaking Passwords to Public GitHub Repositories (Apiiro) – Claude Code’s “Don’t ask again” option writes the approved commands, including any hardcoded secrets, to .claude/settings.local.json. That file gets past global .gitignore rules and scanners like TruffleHog, and it has exposed more than 2,500 secrets.
🗞️ Thousands of AI-Generated Apps Expose Sensitive Enterprise Data (Claroc) – Over 35,000 apps built with Grok default to “Anyone with the link.” Passive DNS records the random hostnames, which turns the “secret” links into an index anyone can search.
🗞️ Cybercriminals Exploit Qubole Trust to Breach AWS Environments (Wiz) – Attackers used Qubole’s real IAM credentials and its ExternalId, so AWS treated the access as legitimate. Organizations that checked identity but not network access missed the breach. 🔎 Threat Hunting Package
🗞️ Rogue ScreenConnect Installs Spread Malware via Worm-Like Attacks (Huntress) – A rogue ScreenConnect client waits for a legitimate support session to connect. It then pivots back and infects the technician’s machine, so normal IT triage spreads the malware. 🔎 Threat Hunting Package
Recommendations
☑️ Check repos and git history for .claude/settings.local.json and rotate every secret it has ever held. Add .claude/, .cursor/ and .gemini/ to each project’s .gitignore, and reference secrets through environment variables or a secrets manager.
☑️ Look for wfx-loot activity: suspicious PRs such as “docs: dependency audit notes” and gaps in workflow run numbers. Rotate exposed CI secrets, OIDC tokens, and cloud keys, and require MFA for every contributor.
☑️ Check third-party code before you trust it. Look for odd whitespace in .go and .py files and unusual PreBuildEvent entries in .csproj files, and test new tools in isolated VMs.
☑️ List every AWS role that trusts an outside vendor and delete the unused ones. Search CloudTrail for AssumeRole calls from Qubole’s account (805246085872) coming from non-AWS IPs since 1 October 2026. Add aws:SourceIp or aws:SourceVpce conditions to vendor roles.
☑️ Find apps employees have built with AI tools by searching passive DNS (for example, grok.me). Lock them down from “Anyone with the link,” and require SSO before any AI-built app goes live.
☑️ Don’t use interactive ScreenConnect sessions to triage hosts you think are infected; use EDR live response or WinRM. Hunt for “TrapWatch” scheduled tasks, C:\ProgramData\RelayTrap\ and %TEMP%\sckit-*, and enforce application control on RMM tools.
Theme 3: Server-Side Exploitation and Critical Flaws
Stories
🗞️ Critical Remote Code Execution Flaw Discovered in Apache HTTP/2 (Apache) – CVE-2026-119618 is a race condition in mod_http2 on versions 2.4.55 to 2.4.70. It corrupts the heap and lets an unauthenticated attacker run code.
🗞️ Critical Node.js Flaws Expose TLS Keys and Crash Servers (Node.js) – The release fixes 16 vulnerabilities. Connection isolation fails completely, so an attacker can read TLS private keys and other users’ data, and Claude helped researchers find five of the flaws.
🗞️ Inside an AhsayCBS Intrusion: Hidden Webshells & Evolving Threat Tactics (Huntress) – Attackers are exploiting the AhsayCBS bugs to get persistent access to backup infrastructure. A loader hides encrypted payloads in the pixel data of PNG images and runs them from memory, and the kit includes Veeam credential-theft modules. 🔎 Threat Hunting Package
🗞️ ZeroQlik Returns: Threat Actors Revive N-Day Exploits Against Qlik Sense Servers (Cynet) – Old Qlik Sense bugs, including DoubleQlik, give attackers reverse shells through scheduler.exe in under three minutes. The same actors are building exploits for Veeam and ActiveMQ, echoing the 2023 Cactus ransomware campaign.
🗞️ ForgeRock Path Confusion Flaw Gives Researchers RCE and Remote Vehicle Control (samcurry.net) – Differences in how the proxy, Jetty, and Felix/CREST normalize paths let researchers get past the WAF. They then logged into a hidden OSGi console with admin:admin, ran Groovy for RCE, and gained remote control of connected cars.
Recommendations
☑️ Patch now: Apache 2.4.71, or disable HTTP/2 with the Protocols directive until you can. Node.js 22.23.5, 24.22.3, or 26.13.1, then rotate your TLS keys. AhsayCBS 10.3.4.45 (v10) or 9.15.2.70 (v7–v9). All outstanding Qlik Sense patches.
☑️ Move off end-of-life Node.js lines such as 20.x and 25.x, which will never get these fixes.
☑️ If a server was exposed before you patched, assume it was compromised. Hunt for hidden .jsp webshells, unusual SYSTEM scheduled tasks (XMRig), unexpected OpenSSH installs or Go binaries, and traffic to 45.115.26.23.
☑️ Alert when application services start command-line tools, for example, scheduler.exe spawning PowerShell.
☑️ Lock down admin interfaces such as Apache Felix /system/console and OpenIDM. Remove default credentials, require MFA for admin actions, and check that the WAF, proxy, and backend all treat encoded characters, .. segments and ; path parameters the same way.
☑️ Harden backup infrastructure like Ahsay and Veeam: limit admin access, enforce MFA, and watch for credential harvesting.
Theme 4: Nation-States, Spyware and Real-World Impact
Stories
🗞️ Nation-State Hackers Exploit Supermarket Fridges for Real-World Destruction (The Register) – France has blamed Iran’s IRGC for attacking internet-exposed Danfoss controllers in over 700 supermarkets. The attackers pushed temperatures up to 80°C, causing fires and spoiling stock. It shows nation-states using basic default-password flaws to do physical damage.
🗞️ Turla APT Deploys “Cereal” Malware to Turn Exchange Servers into Espionage Hubs (ESET Research) – Cereal injects into EdgeTransport.exe and takes over existing transport agents. The compromised Exchange server acts as its own C2, so there is no outbound beaconing for a firewall to catch. 🔎 Threat Hunting Package
🗞️ Spyware Goes Mainstream: Cybercriminals Now Targeting Regular Users at Scale (iVerify) – About 75% of the infections iVerify found came from the leaked DarkSword and Coruna kits. They need zero clicks, work through watering-hole sites, and don’t trigger Apple’s threat notifications. The victims are ordinary users and employees, not VIPs.
🗞️ New Global Guidelines Target the Commercial Spyware Industry (The Record) – The Pall Mall Process has published the first international standard of conduct for commercial hacking firms. It is voluntary and so far endorsed by 14 of the 43 participating countries, but it pushes vendors to stop sales when human-rights abuse is a credible risk.
Recommendations
☑️ Take OT and IoT devices such as refrigeration and HVAC controllers off the public internet. Change default credentials, keep physical fail-safes in place, and watch for unusual operational commands.
☑️ On Exchange, hunt for code injected into Exchange processes and HTTP listeners registered by non-Exchange processes. Check the .NET Native Image Cache for tampered images such as Microsoft.Exchange.Search.Mdb.ni.dll.
☑️ Correlate endpoint, identity, and mail telemetry, because a passive backdoor with no external C2 has no network traffic to block.
☑️ Stop treating mobile spyware as a VIP-only problem. Use MDM, patch mobile OSes quickly, and require on-device threat detection on corporate and BYOD devices.
☑️ Teach users that just visiting a compromised site can lead to full device compromise.
☑️ Check your intelligence and monitoring vendors against the Pall Mall guidelines in third-party risk reviews. If you are a high-risk organization, patch zero-days quickly.
Theme 5: Scams, Social Engineering and Crypto Theft
Stories
🗞️ TypoPrompting: How 186 Fake AI Domains Are Hijacking Browsers (Island) – 186 typosquat domains copying 27 AI brands serve ClickFix lures. Users are tricked into running PowerShell disguised as a CAPTCHA or Cloudflare check, which installs extensions that hijack their searches. 🔎 Threat Hunting Package
🗞️ Global Surge in Fake Gift Card Scams Exploiting Trusted Brands (CTM360) – CTM360 found over 1,000 fake giveaways using brands like Amazon and PlayStation. They are affiliate money-making schemes rather than credential theft: fake progress bars keep victims stuck in “human verification” loops of surveys, app installs and subscriptions.
🗞️ Massive Fake Broker Crypto Scam Network Dismantled (Ukrainian Cyber Police) – Ukrainian and German police shut down call centers that stole more than €4.3M. The scammers built trust over messaging apps, walked victims through buying crypto, then laundered the money through transit wallets.
🗞️ Corrupt FBI Agent Steals $2.5M in Crypto from Hackers and Victims (U.S. Department of Justice) – A former FBI agent used his legitimate case-system access to steal from fraud victims and suspects across 35 investigations. It exposes gaps in how seized digital assets are held and audited.
Recommendations
☑️ Train staff to spot three lures: “verification” prompts that ask them to open a terminal or run a command, free gift-card offers that need app installs or a phone number, and unsolicited investment advice on messaging apps.
☑️ Have people reach AI tools through bookmarks or managed browser shortcuts. Audit browser extensions and remove malicious ones such as “Quick Search.”
☑️ Monitor for brand impersonation and use Digital Risk Protection to take down fake reward portals and social pages.
☑️ Require app-based MFA on banking and crypto exchange accounts. Financial institutions and VASPs should flag sudden large transfers to unverified wallets.
☑️ Hold seized or high-value digital assets in hardware wallets that need multiple signatures. Keep analysts and transaction approvers separate, and monitor privileged users for unusual access.
Feature Livestream
Free threat intel, a knowledge graph, and a working CTI platform. All in one evening.
On Monday, I built an OpenCTI from scratch, live. By the end, you’ll be able to:
1. Explain what OpenCTI is and how it differs from MISP
2. Understand the architecture: platform, workers, connectors, search, queues
3. Deploy the official Docker stack and log in
4. Create a free AlienVault OTX account and subscribe to community Pulses
5. Add the OTX connector to Docker Compose and import real data
6. Navigate reports, indicators, observables, the knowledge graph, and MITRE ATT&CK
No paid feeds. No Enterprise license. Just the Community Edition, a free account, and a working Threat Intelligence Platform (TIP) you can deploy in an enterprise environment!
Feature Course
[image – Python Threat Hunting Tools ]
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
