Emerging Threats

Hiding In Plain Sight: Abusing Model Assumptions To Deceive & Attack Offensive AI Agents

Artificial Intelligence, Emerging Threats /

Hiding In Plain Sight: Abusing Model Assumptions To Deceive & Attack Offensive AI Agents 2026-11-11 at 17:00 By Tom Neaves AI Agents are increasingly being used offensively in an autonomous fashion, with chain of thought and tool chaining available to them. An operator (or ‘human in the loop’) is hopefully still involved to review output […]

Hiding In Plain Sight: Abusing Model Assumptions To Deceive & Attack Offensive AI Agents Read More »

Is Your Refrigerator Running? Yes, It’s Running an Outdated OS: What the Supermarket Refrigeration Attacks Reveal About Embedded Security

Emerging Threats, Tips & Tricks, Vulnerabilities /

Is Your Refrigerator Running? Yes, It’s Running an Outdated OS: What the Supermarket Refrigeration Attacks Reveal About Embedded Security 2026-11-04 at 14:30 By Nolen Johnson Overnight on November 2, freezers in supermarkets across Sweden, Belgium, Luxembourg and Ireland climbed to around 50°C, and stores awoke to spoiled stock. This is the second wave within a month, […]

Is Your Refrigerator Running? Yes, It’s Running an Outdated OS: What the Supermarket Refrigeration Attacks Reveal About Embedded Security Read More »

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits

Emerging Threats /

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits 2026-10-30 at 16:37 By Serhii Melnyk, Cris Tomboc and King Orande Anyone who has signed in to a streaming app on a smart TV by typing a short code into a phone has used a device code flow. Microsoft supports the same mechanism for […]

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits Read More »

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits

Emerging Threats /

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits 2026-10-30 at 15:56 By Serhii Melnyk, Cris Tomboc and King Orande Anyone who has signed in to a streaming app on a smart TV by typing a short code into a phone has used a device code flow. Microsoft supports the same mechanism for […]

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits Read More »

LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft

DFIR, Emerging Threats, Reports /

LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft 2026-10-28 at 16:00 By Explore the latest tactics, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing in the quarterly TTP Briefing, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue during Q3 2026. Download the […]

LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft Read More »

PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers

Artificial Intelligence, Emerging Threats, News, Vulnerabilities /

PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers 2026-10-22 at 15:18 By Karl Sigler On October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team. The two vulnerabilities, combined, are being called PHP2Shell. The vulnerabilities are in PHP Core, which […]

PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers Read More »

Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts

Emerging Threats, Microsoft Security /

Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts 2026-10-20 at 18:26 By Cris Tomboc and Kevin Adriano LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts. In addition to recent reporting by The Hacker News, our analysis […]

Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts Read More »

Filling the Well: Nightmare-Eclipse’s BigDiskBuster and the Defender Update That Never Lands

Emerging Threats, Microsoft Security /

Filling the Well: Nightmare-Eclipse’s BigDiskBuster and the Defender Update That Never Lands 2026-10-05 at 15:57 By Serhii Melnyk and Timmy Lister A new proof of concept called BigDiskBuster, published on GitHub on September 19, 2026, by the actor known as MSNightmare, shows that Defender doesn’t need to be disabled to stop receiving updates, it just […]

Filling the Well: Nightmare-Eclipse’s BigDiskBuster and the Defender Update That Never Lands Read More »

TIKTOUK: Tracing a WordPress Credential Collection Toolkit

Emerging Threats /

TIKTOUK: Tracing a WordPress Credential Collection Toolkit 2026-10-01 at 15:41 By Maor Gabay TIKTOUK brings together WordPress probing, collection of exposed configuration data, recovery of encrypted email credentials, and JavaScript secret scanning. Its two Python components and Go-based Linux crawler turn website responses into structured results for a central hub: an HTTP service that distributes […]

TIKTOUK: Tracing a WordPress Credential Collection Toolkit Read More »

Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators

Emerging Threats, News, Vulnerabilities /

Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators 2026-09-30 at 23:34 By Sean Shirley With contributions from James Rodriguez, Gus Staminatos, and Timmy Lister. This article is an excerpt from LevelBlue SpiderLabs Blog View Original Source

Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators Read More »

Citrix NetScaler Zero-Day Exploited Globally

Emerging Threats, News, Vulnerabilities /

Citrix NetScaler Zero-Day Exploited Globally 2026-09-29 at 18:41 By Karl Sigler On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities […]

Citrix NetScaler Zero-Day Exploited Globally Read More »

File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)

email security, Emerging Threats /

File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”) 2026-09-24 at 15:30 By A recent trend has emerged where threat actor groups (e.g., ShinyHunters, PEAR, HELIX, etc.) have been leveraging phishing and vishing techniques to gain access to M365 email accounts. Through identity and token abuse, these actors have then automated large-scale file […]

File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”) Read More »

One Patch Behind: Nightmare-Eclipse’s ShieldCrash and the Defender Bypass That Won’t Stay Fixed

Emerging Threats, Microsoft Security, Vulnerabilities /

One Patch Behind: Nightmare-Eclipse’s ShieldCrash and the Defender Bypass That Won’t Stay Fixed 2026-09-16 at 16:35 By Serhii Melnyk and Timmy Lister In our previous blog, we analyzed four proofs of concept (PoCs) from the leak persona Nightmare-Eclipse that targeted Kaspersky, Avast, NVIDIA, and CrowdStrike, respectively. This article is an excerpt from LevelBlue SpiderLabs Blog […]

One Patch Behind: Nightmare-Eclipse’s ShieldCrash and the Defender Bypass That Won’t Stay Fixed Read More »

Expanding the Attack Surface: Analyzing Nightmare-Eclipse’s Latest PoCs

Emerging Threats, Vulnerabilities /

Expanding the Attack Surface: Analyzing Nightmare-Eclipse’s Latest PoCs 2026-09-09 at 15:37 By Serhii Melnyk and Timmy Lister In our previous blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft’s ecosystem, including Windows Defender, Cloud Files, and core operating system functionality. This article is an excerpt from LevelBlue SpiderLabs […]

Expanding the Attack Surface: Analyzing Nightmare-Eclipse’s Latest PoCs Read More »

Still Circling: Inside the Operator Behind Blind Eagle’s GitHub Loader

Emerging Threats, Vulnerabilities /

Still Circling: Inside the Operator Behind Blind Eagle’s GitHub Loader 2026-08-28 at 17:00 By Serhii Melnyk This is a collaborative follow-up to our original post, developed jointly with Emmanuel C., an independent security researcher not affiliated with LevelBlue, who contributed additional infrastructure and tooling findings based on an analysis of the same GitHub staging account. […]

Still Circling: Inside the Operator Behind Blind Eagle’s GitHub Loader Read More »

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking

Emerging Threats, News /

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking 2026-08-19 at 18:40 By Serhii Melnyk and Timmy Lister Following GreenPlasma, YellowKey and MiniPlasma, RoguePlanet and GreatXML, and LegacyHive, the Nightmare-Eclipse disclosure actor has published ShieldBreak — its latest Windows proof of concept (PoC) released shortly after Microsoft’s August 2026 Patch Tuesday. […]

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking Read More »

Beyond the Inbox: How BEC Leads to SSO Abuse

email security, Emerging Threats, Vulnerabilities /

Beyond the Inbox: How BEC Leads to SSO Abuse 2026-08-13 at 20:40 By Jamie Mamroe and Federico Cedolini For years, many business email compromise (BEC) investigations have followed a familiar playbook: an attacker phishes credentials, logs into the victim’s mailbox, establishes persistence with inbox rules, monitors communications, and waits for an opportunity to steal money […]

Beyond the Inbox: How BEC Leads to SSO Abuse Read More »

The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains

email security, Emerging Threats /

The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains 2026-08-12 at 16:42 By Karla Agregado To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based URL scanner that constantly evaluates the digital landscape. We closely monitor VirusTotal for instances where LevelBlue acts as the sole detection layer — a crucial tactic for spotting new phishing campaigns […]

The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains Read More »

Scroll to Top