October 19, 2026
- DLL sideloading still produced an Adaptix beacon under Elastic Security in a Windows 10 lab. The walkthrough covers missing-library discovery with Procmon and the resulting Elastic EDR observations. Its assumptions are narrow—including Procmon at a predictable path and a single home-lab deployment—so it is most useful as a purple-team exercise rather than a universal bypass claim.
· Vulnerabilities & Offensive Research
in AOMEI Backup Packages Were Swapped in Brief Supply-Chain Bursts
September 17, 2026
- KREMLIN force-installs Chrome and Edge extensions without user approval — it waits for or kills the browser, copies the extension into the profile directories, enables developer mode, then retrieves the browser's own encryption keys to regenerate the Secure Preferences HMACs so the add-on passes Chromium's integrity checks. The chain starts from a JS file masquerading as an invoice, pulls Node.js, persists via scheduled task, and resolves its payload location from an Ethereum smart contract. Elastic tracks the Brazilian operation as REF9334 across at least seven campaigns since May 2025 impersonating 12 banks, with 1,515 confirmed infections almost all in Brazil. BleepingComputer, The Hacker News.
· Threat Activity
in One Extension Hijacks the AI Assistant in Five Major Browsers
August 1, 2026
- Elastic Security Labs published detection mapping for the Hugging Face AI-agent breach, translating the autonomous agent's tactics — untrusted-data exploitation to RCE, credential theft, lateral movement, and C2 staging — into outcome-based signals rather than register-based ones (Elastic). Useful purple-team follow-up to the earlier coverage of the incident, with a companion narrative in The New Yorker.
· AI & Offensive Security
in When the Attacker Is a Model: AI Lands on Both Sides of the Fight
July 18, 2026
- DPRK "Contagious Interview" hides malware in SVG images — Elastic Security Labs details steganography and obfuscated JavaScript in trojanized coding repos to exfiltrate developer credentials (Elastic).
· Threat Activity
in A Pre-Auth RCE Lands in WordPress Core, Proof-of-Concept and All