Elektrine lite

← Feed

Tanawts

Enigma@infosec.exchange

<p>Things are not always what they seem</p><p>Redfin | Rent Head of Information Security</p><p>Former Ubisoft Director of Security Operations<br />Microsoft Alumni | Former Director of MSRC&#39;s Cloud Incident Response | He/Him/Hrm | Philosopher &amp; Ninja</p><p>SANS: <br />GCIH #16353 - Cerified Incident Handler<br />GWAPT #3274- Web Application Pen Tester<br />GXPN #164 - Exploit Researcher and Advanced Penetration Tester</p>

Posts

  • View post

    The Miasma worm has evolved to now target &amp;amp; infect Ai Agent Tools like, Cursor, Claude, VS Code + Ai Agent Extensions, etc via SessionStart Hooks / post-install initialization steps. We are no longer just looking at infection via Packages, Libraries, Dependencies, or Extensions, but now also Ai Cfgs as well. Having controls in place for settings.json for Hooks is essential. If you do not have your code sources on lockdown, you run the risk of an upstream cloned source infecting your Ai...

  • View post

    Well, this post aged well...

  • View post

    Previous internet worms, you could patch to protect yourself; these new worms aren&amp;#39;t stopped by patching, there&amp;#39;s a fundamental change needed to your development lifecycle thats needed, and you should be working on it right_now. A great write up by StepSecurity to give a recap of the last few days this week. https://www.stepsecurity.io/blog/5-supply-chain-attacks-in-48-hours-why-securing-one-layer-is-not-enough

  • View post

    You may have heard that Github had an incident recently involving the TeamPCP Supply Chain Worm, in this case a poisoned Visual Studio Code Extension. I cannot stress this enough, this is not a &amp;#39;GitHub only&amp;#39; risk, these worms propagate by stealing personal access tokens, ssh keys, api keys, and other forms of credentials to infect other downstream users/consumers. Did you or your company also install/update the same Visual Studio Code Extension that GitHub did? These worms ar...

  • View post

    If you&amp;#39;re keeping score, it&amp;#39;s been a very big week https://cybersecuritynews.com/megalodon-malware-github-repos/

  • View post

    RE: https://flipboard.com/@techradar/gemini-siri-co-pilot-and-alexa-the-ai-wars-commence-kfgucor8z/-/a-OflcEtQKSR-yO5cRNZeTIA%3Aa%3A2416536031-%2F0 Yaaa, you will want Incident Reports to be certified organic... Templates and style-guides are highly recommended though

  • View post

    Very prudent slides from Blue Hat 2026 a few weeks ago. &amp;quot;A compromised dev workstation is NOT a user endpoint compromise -- it is potentially a compromise of every service the workstations tokens can reach.

  • View post

    Visual Studio Code Extensions lack a means of enforcing a minimum age to protect against updates that spread worms. There is a feature request to compel Microsoft to add this festure functionality, it only has 212 likes today. Please help give it a BIG signal boost! https://github.com/Microsoft/vscode/issues/316867

  • View post

    If you are a GitHub Enterprise Server customer, you will need to take action. GitHub announced that one of the keys compromised by the threat actor breach was a signing key. https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/