redactMalware
Last reported 2 days ago, by CISA advisories9 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1105Ingress Tool Transfer
“MITRE ATT\&CK maps this behavior to Ingress Tool Transfer, T1105 and explicitly calls out curl and wget as common Linux utilities for moving files into a victim environment.”
- T1552.004Private Keys
“The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to attacker-controlled Cloudflare Workers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Siemens SIMATIC S7 Webserver API“Affected applications do not properly redact PLC restore passwords from HTTP error exception messages.”
-
How Does AI Change the Shared Responsibility Model?“They block unauthorized model access, redact sensitive data before it reaches a model and restrict agent tool invocations in real time.”
-
Inside the Exchange Inspector: How Tenable uses OpenAI GPT cyber models to review open-source AI agents“…s, tokens, or credentials includes leaking secrets in prompts, logs, or tool outputs, granting tokens overly broad scopes, or failing to redact sensitive data from the model’s context.”
-
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials“Match host, path, method, parameter names, and campaign marker; redact field w.”
-
Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing“…aknesses in Salesforce’s Trusted URLs controls, which are supposed to restrict the external destinations that Agentforce can access, and redact links or images pointing to untrusted URLs.”
-
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source“…jections’ of open source dependencies that are re-implemented under different constraints to optimize for specific use cases (TanStack’s redact comes to mind).”
-
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face“Privacy is a reason to redact the incident record, not a reason to make it unauditable.”
-
How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts“The rules redact known secret patterns before aggregation and before COMPLETION runs.”
-
Elastic changes the SIEM game with AI-driven security analytics“Elastic takes an LLM-agnostic approach and enables organizations to anonymize and redact confidential data by default.”
Indicators in its reports
named in the reports above- a502264fa0b64eecae60498b0c48fca3in 1 report
- hxxps://httpbin[.]org/base64/UkVNT1RPSFgoin 1 report
- httpbin[.]orgin 1 report
- hxxp://169.254.169[.]254/metadata/instance?api-version=2021-02-01in 1 report
- mail[.]tmin 1 report
- reg[.]runin 1 report
- hxxps://www.siemens[.]com/cert/operational-guidelines-industrial-securityin 1 report
- hxxps://www.siemens[.]com/industrialsecurityin 1 report
- hxxps://www.siemens[.]com/cert/advisoriesin 1 report
- hxxps://www.siemens[.]com/productcert/terms-of-usein 1 report
- 168.63.129[.]16in 1 report
- acs-mirror.azureedge[.]netin 1 report
- apt.puppetlabs[.]comin 1 report
- get.gravitational[.]comin 1 report
- cdn.teleport[.]devin 1 report
- cdn.playwright[.]devin 1 report
- browserweb[.]comin 1 report
- icy-star-f45c.workers[.]devin 1 report
- fondationanimalaidrelief.workers[.]devin 1 report
- webtools[.]coin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.