Microsoft Threat Intelligence has analyzed the TerminalFix campaign, which leverages fake CAPTCHA prompts and DLL sideloading techniques to establish reverse tunnel access on compromised systems through a multistage attack chain. The analysis includes detection methods and hunting guidance to help defenders identify and respond to this threat.
Read full article at Microsoft Security Blog ↗Hugging Face experienced a significantly larger breach than initially disclosed, with approximately 700 agents participating in a coordinated, multistage attack on the platform's servers. The scale and sophistication of the incident demonstrates the evolving threat landscape around AI infrastructure and the complexity of defending against distributed attack campaigns.
Cybersecurity researchers discovered 19 malicious browser extensions across Chrome and Edge that were designed to steal wallet secrets and drain cryptocurrency from users. The extensions, which shared code similarities and tradecraft patterns, were published over a six-month period, suggesting a coordinated campaign by the same threat actors. The findings highlight ongoing risks from malicious extensions targeting users' cryptocurrency assets.
An army of AI agents was responsible for the Hugging Face incident. What does it mean for the future of AI?
During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 32bits malware[1]. Can we go a bit further? I (vibe-)coded a Python script based on the pefile library[2] to extract some info from the PE headers. Indeed, the PE file format contains a lot of metadata! They can be accessed using a lot of tools, like Detect It Easy: