Heads-up: New round of Apple Threat Notifications is going out right now, distinct from the August wave and tied to new attacks!
Apple’s notice:
“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in , sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”
Received one and need help? DM me, happy to assist.
Apple’s notice:
“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in , sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”
Received one and need help? DM me, happy to assist.
1
13
27
With Kimi K3.1 Pro’s offensive cyber capabilities deliberately reduced before its open-weight release, GLM-5.3 may remain the strongest practically usable open-weight model for cyber tasks for some time. Reuters citing research from Irregular:
4
4
26
Been hitting guardrails more often during the past two days. Even with /daybreak "on", Sol refusing various types of work: "This content can’t be shown. Some cybersecurity requests are still limited, even when Daybreak is on." Example:
6
4
17
Threat actors vibe-coding their C2s like it's "yet another web app" opens a whole new world of possibilities 🙃
4
6
33
The official IDA MCP is out. According to their blog, reduces token consumption by about 20% through an efficient architecture and works well with both frontier and local models. Link below.
The official IDA MCP Server is here. It's free, open source, and works with any LLM.
Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time.
𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕
hex-rays.com/blog/hex-rays-…
(copy-paste: uvx ida-hcli mcp install)
3
28
210
A very interesting little model almost anyone can run on a GPU and has 98% of Qwen 3.8 28B's precision? Testing!
Today, we’re announcing Ternary Bonsai 2 27B.
Based on Qwen3.8 27B, Bonsai 2 27B is 9x smaller than its full-precision counterpart while retaining 98.2% of its aggregate benchmark performance.
Two months after the first Bonsai 27B release, the biggest change is quality. The B, but the gap to full precision has narrowed materially, with particularly strong gains in agentic coding, multimodal reasoning, and long-horizon tool use.
Ternary Bonsai 2 27B is available today under Apache 2.0.
0
0
15
Do you like local AI models? The model that is best for Joe may not be the best for you. My totally unscientific top 10 based on evaluating the quorum on cyber threat intel workflows from last week between various models.
6
8
49
🚨 Investigating a suspected ClickFix campaign affecting compromised WordPress sites globally.
We confirmed polymorphic JavaScript injections on multiple live sites. The loader uses custom variable-width base-N encoding, filters bot-like user agents - including headless Anthropic - removes its own <script> element, and fingerprints the browser. Telemetry is XOR-obfuscated and POSTed over HTTPS to:
C2: siege-close[.]com/x9i32md/w1/la02
The response is XOR-decoded and can be executed through indirect eval(), giving the server arbitrary JavaScript execution in the victim’s browser.
Quick OSINT search identified 44 affected sites across 15 countries.
#ClickFix #ThreatIntel #WordPressSecurity
We confirmed polymorphic JavaScript injections on multiple live sites. The loader uses custom variable-width base-N encoding, filters bot-like user agents - including headless Anthropic - removes its own <script> element, and fingerprints the browser. Telemetry is XOR-obfuscated and POSTed over HTTPS to:
C2: siege-close[.]com/x9i32md/w1/la02
The response is XOR-decoded and can be executed through indirect eval(), giving the server arbitrary JavaScript execution in the victim’s browser.
Quick OSINT search identified 44 affected sites across 15 countries.
#ClickFix #ThreatIntel #WordPressSecurity
7
52
218
Looking into this YARA rule, we immediately observe it doesn't run, because of an error -> warning: rule "msaRAT_Chaos_Ransomware_RAT" in orig.yara(24): string "$handshake" may slow down scanning
error: rule "msaRAT_Chaos_Ransomware_RAT" in orig.yara(31): unreferenced string "$eoffending strings in this screenshot so they are immediately visible:
error: rule "msaRAT_Chaos_Ransomware_RAT" in orig.yara(31): unreferenced string "$eoffending strings in this screenshot so they are immediately visible:
1
1
13
The blog doesn't have any new IOCs on msaRAT and generally has an AI vibe feeling, but it does come with a YARA rule. The YARA rule:
1
1
10
On Huggingface having to use GLM-5.2 for cybersecurity work because Claude hit guardrails. This was also my typical experience with opus 4.8. Even when I was verified for cyber, it would still stop while doing purely defensive research work. In practice, for me Claude wasn’t able us security work at all. Things are better with opus 5, haven’t gotten a refusal yet. 🙏
6
7
41
NEW! On the Three Buddy Problem we talked to Mark Dowd on the state of offensive research, the economics of the exploit market, the AI hype machine, daily stresses of running an offensive shop, and state of zero-day market: youtu.be/NEDlOKHG8nY?si…
1
14
55
Hostinger published a small analysis of the Notepad++ supply chain attack. No IOCs or hard details, but reading between the lines we can get some ideas.
3
17
82
Google TAG Bulletin for Q4 2025 - terminating influence operation campaigns across platforms. Most originated from China, Indonesia second, Russia third. blog.google/threat-analysi…
2
4
15
New CERT-PL report on #DynoWiper just dropped - with many new IOCs, attributes it towards Berserk Bear / Static Tundra, deems wiper similarity to Sandworm too low. Grab while hot: cert.pl/en/uploads/doc…
4
11
48
@ACosmin99 I'd say most enthusiasts install a more powerful AV solution anyway; relying on Defender alone is very risky. From the article:
1
0
1
After the food is finished and the presents are unwrapped, what better way to unwind than watching the final 2025 episode of The Three Buddy Problem, live on YouTube in about 30 minutes: youtube.com/watch?v=_n95Lo…
0
4
21
The end of the year "Three Buddy Problem" show is Live this Friday! Stream: youtube.com/watch?v=_n95Lo…
2
5
21
Hmm... what we do we have here? "ORACLE_EBS_NDAY_EXPLOIT_POC_SCATTERED_LAPSUS_RETARD_CL0P_HUNTERS.zip"
4
10
117
Weekend mystery: the 2-days old domain chesselo2000[.]cfd - registered on Joker.com and hosted at AS20473 / VULTR - has become the 4th most popular domain in Brazil, ahead of Youtube, Facebook and Instagram, according to Cloudflare. Most of the requests come from he purpose is unclear and the site won't load for me. Perhaps chess is finally going mainstream?? 😅
4
9
38