We share our initial set of recommendations to shore up your defenses based on our own findings and security practices." name="description"/><meta content= We share our initial set of recommendations to shore up your defenses based on our own findings and security practices." name="description"/><meta content="Preparing your security program for AI-accelerated offense | Claude" property="og:title"/><meta content=

A thoughtful piece by Anthropic on AI-accelerated offense. In my mind, the only sustainable answer to vulnerability management is modern design and shrinking the attack surface. claude.com/blog/preparing-your-secu...

Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise | Microsoft Security Blog The Microsoft Defender Security Research Team uncovered a sophisticated macOS intrusion campaign attributed to the North Korean threat actor Sapphire Sleet that abuses user driven execution and social...

Microsoft dropped another blog with the full social engineering attack chain of the actor responsible for Axios. More interesting though is Socket’s blog about the campaign that resulted in Axios.

www.microsoft.com/en-us/securi...

socket.dev/blog/attacke...

Sanctions-evasion-ception

Sorry busy pretending to be Iranian to try to get hired as a North Korean IT worker pretending to be American.

flare.io/learn/resour...

*don’t sweat it ffs

I have maybe one good take a year. Your posts are ridiculously high quality at ridiculously high volume and I cannot say enough good things about spending the time to mentor junior folks. Thank you for the ACK but sweat it for even a second

There is an underlying lesson about building working relationships, creating the achievement muscle memory, and being there in the moments and hours and weeks that make a difference and then getting recognition for it. Anyone who says that there’s only one path is mistaken.

A lot of things Tay says are gospel but success looks different for different folks and there are a lot of different sizes and types of orgs out there where this does not apply. I am wildly successful working for an old school Fortune 500 and I’ve physically been to an office once ever.

It’s trite but this marks the dawn of a new era of hacking. This is Pandora’s box and we just have to hope that some of the defender benefits outweigh the bad.

These are the technical details of the hack of the government of Mexico using AI. cdn.prod.website-files.com/69944dd945f2...

Yes I had a role in this but that’s not the only reason I’m sharing it haha!

For reference: www.bloomberg.com/news/article...

It’s trite but this marks the dawn of a new era of hacking. This is Pandora’s box and we just have to hope that some of the defender benefits outweigh the bad.

These are the technical details of the hack of the government of Mexico using AI. cdn.prod.website-files.com/69944dd945f2...

IT workers at big tech companies revealed as North Korean spies | 60 Minutes Australia A major investigation into Kim Jong-Un’s devious plan to send North Korean spies to work at IT firms in Australia, the United States and other Western countries. *Quid Game (2026)* ► Subscribe: http://9Soci.al/chmP50wA97J ► WATCH Full Episodes on 9NOW: https://9now.app.link/uNP4qBkmN6 FOLLOW 60 Minutes Australia ► Instagram: https://www.instagram.com/60minutes9 ► TikTok: https://www.tiktok.com/@60minutes9 ► Facebook: https://www.facebook.com/60Minutes9 ABOUT 60 Minutes Australia 60 Minutes Australia have been telling the world’s greatest stories for half a century. Reporters Tara Brown, Amelia Adams, Adam Hegarty, Dimity Clancey and Nick McKenzie look past the headlines to show the bigger picture. Watch the latest from 60 Minutes Australia every Sunday on Channel 9 and 9Now. #60Mins

60 Minutes Australia has always had some interesting DPRK coverage. This one on fake IT workers is really good. They actually catch a few on the line and talk to them. youtu.be/kIcw6vpmAHI?si=qWDQX...

I'd encourage companies build tabletops around this insider scenario.

Pouring one out for all the open source maintainers dealing with AI slop pull requests, DPRK targeting, malicious worms, tech sector contractions, and the current/impending avalanche of Anthropic vulns.

Compromised npm Package mgc Deploys Multi-Platform RAT The npm package mgc was compromised via account takeover, with four malicious versions published in rapid succession deploying a full Remote Access Trojan targeting macOS, Windows, and Linux.

The same actor got another developer/package albeit one that doesn’t have remotely the same footprint. safedep.io/malicious-np...

-Cybercrime losses passed $20b last year
-Authorities disrupt APT28 router botnet that intercepted email logins
-Iran hacks PLCs across US
-Exploitation hits ComfyUI and Flowise AI servers
-Anthropic unveils 0-day computer God

Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS548/

This is an impressive amount of work. Unfortunately, though, with insufficient and inconsistent underlying data and that data was organized in a very strange way leading to some odd framing and conclusions. Wish the author had taken time to bounce some of their ideas off an expert.

I don’t agree with everything in this piece but I wholeheartedly agree that letters of marquee will make things much worse in several different ways.

Wanted to warn the #NodeJS community: This campaign is active. Thank you to the maintainers who shared their stories - some of these came frighteningly close. One got all the way to the fake meeting before walking away. The more we talk about this, the harder it is for these attacks to succeed.

The Hidden Blast Radius of the Axios Compromise - Socket The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

We’re seeing cases where teams can’t explain how they were compromised by the Axios incident because it doesn’t show up in their project's lockfile. The blast radius here is much larger than it looks.

Deep dive into the messy reality of modern dependency resolution → socket.dev/blog/hidden-...

North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack | Google Cloud Blog A North Korea-nexus threat actor targeted the popular axios NPM package in a massive supply chain attack.

This is officially publicly attributed to Sapphire Sleet / BlueNoroff / TA444 / Stardust Chollima / DangerousPassword / UNC1069 / CageyChameleon. Yes, I know it’s a pile of ridiculous names and yes I know we, the CTI industry, created this mess. Sigh.

cloud.google.com/blog/topics/...

axios Compromised on npm - Malicious Versions Drop Remote Access Trojan - StepSecurity Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that drops a cross platform RAT. We are actively investigatin...

www.stepsecurity.io/blog/axios-c...

Welp this is gonna be a day

Computer enabled elder abuse, romance scams, and business fraud cause exponentially more harm than all other forms of hacking combined.

More controversially, sophistication in hacking doesn’t matter nearly as much as measures of success / impact.

Cybersecurity Ignorance Is Dangerous A new book gets the policy recommendations right while making technical errors that could undermine trust in its conclusions.

It’s not a good book and while mobile vulnerabilities exist, they’re expensive, difficult, less reliable, and there are relatively few people creating them compared to vulnerabilities for a lot of other platforms.

foreignpolicy.com/2021/05/03/c...

As a general rule, my philosophy on new technology is broadly summed up as: no.

Slightly less summed as: hellll no.

I tend to be fairly conservative on the hot new whatever, and I'm usually against bandwagons.

[Ed note: Steve works on 30-year-old auth protocols, of course he's like this.]

I am not an expert on router security but this seems completely and utterly insane to me.

Someone has publicly leaked an exploit kit that can hack millions of iPhones | TechCrunch Leaked "DarkSword" exploits published to GitHub allow hackers and cybercriminals to target iPhone users running old versions of iOS with spyware, according to cybersecurity researchers.

If you have an iPhone, today is a good day to make sure you are running the latest software. techcrunch.com/2026/03/23/s...

Aisuru/Kimwolf botnet got disrupted today

SLEUTHCON 2026 is coming! 🐍🐻🌲

Registration is open and our CFP is live!

We're back on June 5th, in-person in Arlington, VA and virtually. CFP closes April 17th + tickets will sell out!

sleuthcon.com

#SLEUTHCON #SLEUTHCON2026 #Cybercrime