New PoC Spoofs Callstacks Around Intel CET to Blind Modern EDRs

A detailed proof-of-concept shows how to forge legitimate-looking Windows callstacks even with Intel CET shadow stacks enforced, reopening an evasion technique defenders thought was closing. AI coding agents kept taking damage from both sides today — new memory-poisoning and image-hidden prompt attacks against them, and fresh offensive tooling built on top of them.

Offensive & Evasion

• CET-compliant callstack spoofing via thread-pool execution and enum-callback trampolining is detailed in a new write-up and Rust PoC from @_MrTiz, showing how indirect syscalls with context switching and shadow-stack reconciliation produce clean-looking call stacks without touching unwind metadata — defeating the callstack-based telemetry many EDRs rely on, despite Intel CET having killed traditional spoofing. mrtiz.github.io (discussion)
• An autonomous agent ported an Android epoll use-after-free exploit to a hardened Pixel 10, achieving privilege escalation into the vold domain by working through Android mitigations with heap grooming, memory reallocation, and gadget chaining — a concrete data point on how far LLM agents can now carry real exploit-development work (with human help). guysrd.github.io

AI & Model Security

• MemGhost plants persistent false memories in AI assistants through a single email: an inbox-connected agent is tricked into saving a bogus “fact” about the user, hides the change, and quietly steers later sessions — the victim never sees the tampering. The Hacker News
• xAI’s Grok Build CLI was uploading entire Git repositories — including private codebases — to a Google Cloud bucket, per researchers who advise anyone who used it to check logs (~/.grok/logs/unified.json for repo_state.upload). A sharp reminder that AI dev tooling is itself a supply-chain exposure. @Dinosn
• Context bombs flip AI guardrails into a defensive tool: hidden triggers seeded into canary secrets measurably reduce offensive-AI success rates and alert defenders when an agent trips them, most effective when tailored to a specific model and topic. Tracebit
• Ghostcommit — hiding prompt injection in PNG images to trick AI code reviewers into leaking .env files (earlier coverage) — picked up additional write-ups; @JalkarnaGautam argues the real fix isn’t a smarter reviewer but never handing the agent a filepath to secrets: mount them into a scoped runtime vault, not a file on disk. Malwarebytes
• Fabreix launched “Playground,” an open-source CTF for AI agents with $100K+ in weekly rewards, publishing each challenge agent’s full system prompt so anyone can attempt to break its defenses; the first challenge (“The Gatekeeper”) is live. @FabraixHQ
• Apple sued OpenAI over alleged trade-secret theft by former employees. @Dinosn

New Tools & Releases

• google/mantis — a modular, stack-agnostic toolkit of security-review “skills” that lets AI coding agents autonomously find, reproduce, and patch vulnerabilities. @Dinosn
• Passive AD enumeration via native ADSI/COM interfaces — directory recon with no .NET, no PowerShell, and no managed runtime, sidestepping the telemetry those stacks generate. @ipurple
• Argo — LLM-native static vulnerability detection that reads a local folder or repo like a human auditor and produces a reviewable vuln report with auto-enriched prompts and adversarial validation. @Dinosn

Cloud & Identity

• Forg365, a new phishing-as-a-service operation ($400/month via Telegram), targets Microsoft 365 with device-code phishing, adversary-in-the-middle session theft, antibot evasion, AI-assisted lure generation, and post-compromise mailbox operations. The Hacker News
• A misconfigured public Python HTTP server exposed three separate AiTM phishing operations run by operators “codemado,” “mail-argenta,” and “saroula01,” revealing custom Evilginx forks used to bypass MFA and harvest credentials across platforms for over a year. Lexfo

Threat Activity

• The US and eight allies issued a joint advisory (AA26-194a) warning that FSB Center 16 is opportunistically compromising poorly configured routers worldwide via SNMP and Cisco flaws, and CISA added the exploited Cisco IOS vulnerability to its KEV catalog — the technical follow-through to this week’s first joint EU/UK cyber sanctions over the Poland grid attack (earlier coverage). Recommended defenses include disabling Smart Install, hardening SNMP, and firmware updates. CISA, BleepingComputer
• The US Treasury sanctioned First VPN Service (1VPNS) and its Ukrainian administrator, plus Belarusian national Yegeniy Silayev for malware “cryptor”/obfuscation services, over their role enabling ransomware groups that hit hospitals, schools, and businesses. The Record
• The FBI and Google dismantled “Outsider,” an $88-a-week phishing-as-a-service platform linked to roughly $1.9 billion in losses. Ministry of Cyber Affairs
• Telegram’s core t.me domain was placed on serverHold at the .me registry — a registry-level suspension that stopped all t.me links from resolving, though the app itself kept working. @DarkWebInformer (discussion)
• Suspected China- and India-aligned actors ran a multi-group espionage campaign against Pakistani law enforcement, compromising Balochistan Police web apps holding criminal and citizen data between February 2024 and April 2026. The Hacker News

Malware

• CrashStealer is a new macOS infostealer written in native C++ (not the usual AppleScript/Objective-C droppers) that poses as Apple’s crash-reporting tool, validates the victim’s login password locally, and uses a notarized dropper to pass Gatekeeper before harvesting credentials, keychain data, and crypto wallets. BleepingComputer, Jamf via The Hacker News
• RedHook Android malware now abuses Wireless ADB to obtain shell-level privileges without a connected computer — a novel on-device escalation path. BleepingComputer
• Siggen (Siggen2.5906) backdoors Windows developers by infecting Visual Studio projects, stealing data, hijacking cryptocurrency info, and dropping miners via stealthy C2. Hackread
• Google and Microsoft pulled ModHeader (~1.6M installs) from Chrome and Edge after researchers found a hidden, dormant browsing-history collector in the official store build; an empty allow-list had kept it switched off with no evidence it ever fired. The Hacker News

Vulnerabilities & Exploits

• RabbitMQ carries a flaw letting unauthenticated attackers retrieve the broker’s confidential OAuth client secret and take full control. SecurityWeek
• Zimbra patched a critical code-execution bug where malicious code embedded in crafted emails runs when the message is opened. SecurityWeek

Detection & Purple Team

• AMSI provider hijacking for persistence gets a defender-focused playbook: attackers with elevated rights can register a fake AMSI provider DLL, detectable via Sysmon event 7 (image load), Event 4663 (registry key modification), and 4688 (regsvr32 process). @ipurple

Breaches

• Odido disclosed a February 2026 breach exposing personal details of 6.2 million customers via phishing; Dutch police suspect Dutch nationals. Security Affairs
• Lidl notified customers in Germany, Belgium, and the Netherlands that a service-provider breach exposed their personal data. BleepingComputer