Devon Kerr

@ImposeCost Information has a spectrum of resolution, form factors, use cases and consumers. Yesterday's data is today's decision advantage and by tomorrow its just history. Finished intelligence?! Finished to whom, amirite?

7 trojanized repos targeting developers. Zero detections across every AV vendor. Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings. The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography. Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start. What deploys: - Credential stealer targeting 25 crypto wallet extensions plus browser login data - File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code - Socket. IO RAT providing real-time interactive shell access - Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2 Full analysis from Elastic Security Labs by @danielstepanic : go.es.io/4fqEhgp

APT41 built malware called Calendarwalk that uses Google Calendar events as its command and control channel. The malware reads instructions embedded in calendar event descriptions. Google Calendar is on virtually every corporate allowlist. No unusual domain. No suspicious traffic pattern. Just calendar sync. A companion malware called Tabbywalk from the same group uses Google Drive in the same role. Both variants share the same loader, which is how analysts linked them to the same threat actor.

Receiving connection requests from "CEO & Founder of <Some AI Slop InfoSec Company>" is the new "I wanted to connect to discuss an exciting role" on LinkedIn 🤦‍♂️

#Threat actor left an unauthenticated write functionality in their server that lets you modify config files. The AI slop is hitting hard, inexperienced threat actors relying too much on it are leaving massive security gaps and digital footprints behind them. We will see even more #OPSEC failure in the near future 🙂‍↕️

So much good RE work, artifacts at multiple stages of the execution chain, and detailed analysis of the command framework - another stellar deep dive by @cyril_t_f

TELEPUZ is a new modular malware spreading via CLICKFIX-VIDAR chains. Elastic Security Labs is tracking it. Active since late April 2026. The delivery path: ClickFix social engineering tricks users into running a PowerShell command that downloads a VIDAR Go variant, which then fetches a lightweight stager and the main TELEPUZ payload. The core DLL communicates over WebSockets and pulls additional modules from C2 on demand: Keylogger Stealer Web injector: intercepts browser sessions via CDP and WebDriver BiDi, with default configs targeting financial form fields like IBANs 36 commands. Indirect syscalls. AMSI and ETW patching. NTDLL unhooking. Multiple UAC bypasses. Still in active development: the shellcode injection command returns a TODO placeholder. C2 infrastructure is small (2 domains), but fallback methods include Telegram channels, Steam profiles, DNS records, and a Polygon smart contract that doubles as a kill switch. New builds hit VirusTotal daily. The C2 footprint is small, but this thing is moving fast for something that started 2 months ago. Full technical analysis: go.es.io/4wg6i1p

@rekdt @anton_chuvakin Is two better than X, cost you nothing

Most people do have ZDR?? Zero Detection & Response

Ongoing #infostealer #campaign hitting devs. It's the "Contagious Interview" (DPRK style). Shows up as a coding test or job-interview repo. You run it, it beacons out, steals your whole environment, and opens a JS eval() backdoor. Been collecting #IOCs, sharing below 🧵

@anton_chuvakin @techspence Hope-as-a-Service

@techspence What do you have against the sacred practice of Luck-based Security?!?

Read any threat report and you will see, one singular defensive control/security product is never enough. Coverage and layered defense is the game. Not silver bullets and crossing your fingers.

It'll be rude of me to not talk about one of the most pragmatic trailblazers in the industry: @rootkovska Joanna Rutkowska (pronounced root-kov-ska) is a polish computer security researcher known for her pioneering in low-level system security, stealth malware, and building one of the most security focused desktop operating systems. Major achievements n contributions: > In 2006, she demonstrated Blue Pill at Black Hat Briefings(aforementioned in the tweet below). She was named one of Five Hackers Who Put A Mark on 2006 by eWeek. > She coined the term 'Evil Maid attack'(physical compromise via firmware/bootloader tampering, e.g., via USB) and researched related defenses(Anti EVil Maid). > She founded Invisible Things Lab (2007) and led the development of Qubes OS (starting 2010), a security-oriented OS that uses Xen virtualization for strong compartmentalization ('security by compartmentalization'). It has been praised by experts including Edward Snowden, who said it was the best OS for security. she has spoken at major conferences and published influential papers, such as 'Intel x86 Considered Harmful (2015) Career timeline and shift -- Early career: off sec research on Windows/LInux kernel malware, virtualization insecurities, intel technologies (TXT, vPro/AMT, etc.). -- 2007-2018: Founded and led Invisible Things Lab: developed Qubes OS. -- 2018 onward: stepped down from day-to-day Qubes/ITL leadership to join the Golem Foundation (as Chief Strategy/Security Officer), focusing on decentralized systems and the Wildland project. -- Recent years: Continued architectural work on Wildland/Golem-related efforts. -- As of early 2026: she has largely stepped away from active computer security work. In February 2026, she launched a new personal blog called Traces Of Humanity (tracesofhumanity[.]org), describing it as a place for her struggles between rationality and humanism, and discussing personal projects. she has described her philosophy as : 'Distrusts computers. Keeps embracing them anyway.' Online presence: -twitter @rootkovska - bluesky @rootkovska.bsky.social - mastodon @[rootkovska] - github [github.com/rootkovska - personal website/blog (tracesofhumanity[.]org)

I'll be joining Andrew Brandt and Rich Mozeleski next week to discuss a recent massive password spray attack we observed. huntress.com/upcoming-webin…

@At0mXploit @5mukx Our work at @elasticseclabs on #Oxloader malware check it out here elastic.co/security-labs/…

REF6045 deploying SCMBANKER via #ClickFix. Research by @k33b0i and @soolidsnakee. Detections, IoCs included. Check it out! #malware elastic.co/security-labs/…

Check out our latest research on an #AI slop of a #banking toolkit targeting mexican banking customers. We found the promts in their comments, #OPSEC failure that exposed critical parts of their infra (content write) Research by @k33b0i and myself go.es.io/4eP6VZF #malware

The second part of the #FortiBleed campaign analysis is out. Important Findings: -Links to #INC & #Lynx ransomware groups -Internal structure of affiliates -FortiGate attacking playbooks -AI-assisted vulnerability research. socradar.io/resources/whit…

TIL: Entra ID Sign-In Logs... Legacy apps. I'm so used to "What is the app ID & name?", I overlooked the 'client_app_used' field which clearly states a MSFT-labeled legacy app, SMTP at that where "Office 365 Exchange Online" is the app. So show me client apps used that are known legacy. First occurrence on UPN. Or just make sure "Block legacy authentication" CAP is enabled 😅 #threathunting

To no surprise. The more phishing infra I hunt, the more I see ops leverage/abuse Cloudflare captchas/workers.dev/etc. #threathunting

#TROOPERS26 afterglow: @4ndr3w6S on building a solid LDAP detection stack - why signature-based detection is failing and volume-based detection generally wins. Lots of tips for detecting SharpHound, ldapnomnom, SOAPy & more. Detection engineering is so cool..

Reminder to monitor for ROPC-based auth. Not just Entra ID sign-in logs, but UAL as well. BAV2ROPC user-agent may suggest legacy app usage. First-occurrence based rules for this are generally low volume from telemetry I've seen. Aggregation-based queries can help identify more stats driven anomalies like password spraying. Happy hunting! #azure #password github.com/elastic/detect…