IFIN - The Independent Federated Intelligence Network

Announcing IFIN Lists | IFIN

IFIN Lists is a project to build a well curated, community driven set of permanent block lists for all to use.

It's Official: We're a Recognized Non-Profit | IFIN

IFIN has achieved 501(c)(3) status. What this means for us, and for you.

IFIN

Claude Cowork for Windows Vulnerable to DLL Sideloading, Closed as Won't-Fix

DLL sideloading in Claude Cowork for Windows, closed as not an issue because it requires host compromise. It’s true that DLL sideloading is not strictly Claude’s problem, but at the very least defenders should know this is a potential attack path. A malicious DLL can gain full root permissions on the Claude Cowork sandbox VM used for local compute tasks by the harness. Attack chain from the article here: https://www.armadin.com/blog-posts/exploiting-root-execution-in-claude-coworks-san

IFIN

CVE-2026-85102 and 93616 - Check Point Security Gateway RCE/Path Traversal Exploited

Last updated: 2026-09-22T20:07:55Z (UTC) CVSSv3: 9.8 What’s Happening In what’s-old-is-new-again news, two CVEs were released today for Checkpoint Security Gateway management toolsets, including a pre-auth remote code execution and a path traversal in the management web service. Here are Check Points internal support center details: Since I started writing this Check Point posted notification of exploitation on their blog. Both CVEs have been added to CISA KEV. Actions Check the advi

IFIN

ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My!

Last Updated: 2026-07-29T21:28:50Z (UTC) What’s Happening Earlier this month, Microsoft reported on ACR Stealer, a new campaign leveraging both Steganography and Etherhiding techniques for delivery. Yesterday, I caught myself a sample. Mine doesn’t have Etherhiding, but the rest makes for a fun exploration anyhow. Let’s dive in. ▶ Recommended Musical Accompaniment Disclaimer: A LLM assisted with deobfuscation/decryption of later stages. Stage 1: Initial Access via ClickFix While the infe

IFIN

Pirated Games Come with a Side of Amatera Stealer

Last Updated: 2026-07-20T16:00:07Z (UTC) What’s Happening Malwarebytes is reporting on a new infostealer campaign using pirated games (shocker) as a watering hole. What’s notable about this campaign is the continued use of Etherhiding for second-stage loading. We’re going to be talking a lot about Etherhiding in the next couple of weeks. Some other fun malware analysis in the post as well for those interested. Actions Don’t pirate games! Don’t let your employees pirate games! Pro tip: if y

IFIN

CVE-2026-11405: Multiple Tenda Routers Have an Admin Backdoor

Last Updated: 2026-07-08T15:51:19Z (UTC) CVSSv3: None yet Multiple versions of Tenda firmware have a backdoor in remote administration login, allowing anyone to access configuration of the device. Affected Versions: US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE US_AC10V1.0re_V15.03.06.46_multi_TDE01 US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 US_AC6V2.0RTL_V15.03.06.51_multi_T No patch is currently available. We recommend burning your Tenda devices in

IFIN

Compromised Website Hosting ClickFix Payload Leads to NetSupport RAT Infection

Last Updated: 7/1/2026 What’s Happening A recent trending post by a Mastodon user caught my attention since I actively track ClickFix campaigns: BLUF: The website wavesandwild[.]com was compromised with the ClickFix social engineering technique to trick victims into executing malicious commands injected into their clipboard which installs and runs NetSupport RAT, a remote access tool. NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for

IFIN

Remember that Cursor git.exe bug? It's in VSCode too

CVSSv3: 7.3 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE: None The Cursor Bug is in VSCode Earlier this week, a potential vulnerability was disclosed in Cursor, the AI-enabled development platform that is a fork of VSCode. This vulnerability is a file called git.exe in the root of a repo or any project folder will be automatically executed without user interaction. That was viewed as a potential flaw in the software, but apparently Cursor was told about it in December and has really had no respons

IFIN

Latest Miasma Attack Uses Blockchain Garbage You Should Have Already Blocked

Last Updated: 2026-07-14T22:16:54Z (UTC) What’s Happening I was trying to come up with a framing for this story other than “Oh look another supply chain attack, whoopty-doo.” But yeah, asyncapi packages were hit today. Actions Of course you want to do the usual package checks, rotations, say three Hail Marys, turn around three times and throw salt over your shoulder. But also, this payload presents some good reminders about goofy attacker techniques that should not survive a mature netwo

news.ifin.network

The Independent Federated Intelligence Network News Feed

IFIN

Minnesota water system suffers a breach due to exposed access keys

Last Updated: 2026-07-30T15:57:44Z (UTC) What’s Happening On July 27, 2026, threat actors exploited a known vulnerability on a Rockwell Automation device and disrupted water treatment facilities in four counties in Minnesota, US. Shieldworkz has a detailed writeup: Tenable also has a decent writeup, providing broader threat context. This activity is consistent with prior activity with Iran-aligned actors under the guise of “CyberAv3ngers,” although no direct evidence has yet emerged t

IFIN

LuaJIT Loader Uses Prometheus Obfuscation and Etherhiding

Last Updated: 2026-07-23T17:18:49Z (UTC) What’s Happening I spent quite a bit of time investigating and reversing a malware sample I found in the wild. The initial malware sample, which I’ll explain in depth below, caught my attention because of the usage of a Lua obfuscator that I could not find a publicly available deobfuscator for. I am relatively new to malware reverse engineering and, with full disclosure, a lot of the work done here was with the assistance of AI. Late into the investig

IFIN

Microsoft SharePoint CVE-2026-50522

Last Updated: 2026-07-25T12:48:20Z (UTC) What’s Happening Microsoft SharePoint Remote Code Execution Vulnerability CVE-2026-50522 is actively exploited in the wild since 2026-07-17T00:00:00Z (UTC). This is an unauthenticated deserialisation vulnerability. A public proof-of-concept has been available since 2026-07-20T05:53:56Z (UTC). A patch is available since 2026-07-14T00:00:00Z (UTC) (Patch Tuesday). Actions Collect forensic evidence including but not limited to Windows Event logs, AV/EDR

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

What are Durable Objects?

Durable Objects provide globally unique, single-threaded compute instances with persistent storage on Cloudflare.

IFIN

New AUR Attack Prompts Adoption Lock

Last Updated: 2026-08-03T16:19:14Z (UTC) What’s Happening A new round of Arch User Repository malware has prompted the disabling of package adoption. The first package with confirmed malware appears to be openconnect-sso. User ysf has performed initial analysis of the payloads. Stage 1: AUR validator.malware (stage 1) · GitHub Stage 2: AUR validator.malware (stage2 agent linux x86_64) · GitHub Interestingly, many of the behaviors (especially Tor exfil) look similar to the last campaig

OpenAI warns autonomous hacks are ‘watershed moment for computer security’

Company employees said their industry should rethink how it balances capabilities and safeguards.

IFIN

CVE-2026-11405: Multiple Tenda Routers Have an Admin Backdoor

Last Updated: 2026-07-08T15:51:19Z (UTC) CVSSv3: None yet Multiple versions of Tenda firmware have a backdoor in remote administration login, allowing anyone to access configuration of the device. Affected Versions: US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE US_AC10V1.0re_V15.03.06.46_multi_TDE01 US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 US_AC6V2.0RTL_V15.03.06.51_multi_T No patch is currently available. We recommend burning your Tenda devices in

IFIN

Bad Epoll LPE - Linux Kernel - CVE-2026-46242

A new LPE on the Linux Kernel has been released, affecting versions 6.4+ of the kernel. Some distros may be vulnerable if they backport though. There is no mitigation, only patching. There is an existing PoC but for google’s KernelCTF. Original writeup: security-research/pocs/linux/kernelctf/CVE-2026-46242_lts_cos/docs/exploit.md at submit-cve-2026-46242 · J-jaeyoung/security-research · GitHub More Information: GitHub - J-jaeyoung/bad-epoll · GitHub and https://compsec.snu.ac.kr/blog/badepoll