Pinned Tweet
🤩 I am super proud to announce that my book Visual Threat Intelligence won the @ForewordReviews Bronze award in the Science and Technology category!
Thanks to everyone who supported the journey; this small victory is for you! 🙏💚 🥹 #ForewordINDIES
bit.ly/VTIaward
Thanks to everyone who supported the journey; this small victory is for you! 🙏💚 🥹 #ForewordINDIES
bit.ly/VTIaward
28
18
190
56,907
Human-operated! 🥲
Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors impersonated IT or help desk personnel via Teams messages and calls, tricking users into granting interactive remote access, primarily through Quick Assist. msft.it/6010aFi3j
Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths through ESC1 template abuse or ESC8 authentication relay.
These paths show how a user-approved remote session can lead to certificate-backed access to privileged identities and domain infrastructure, and why comprehensive containment matters. Read the blog for technical analysis, investigation guidance, mitigations, detections, and hunting queries.
3
0
16
1,206
I very much align with what @eyalsela said “the death of TTPs” but with some nuances.
I think this is the death of TTPs as we know it.
But there is new forms of TTPs we can analyze and track, starting with adversarial prompts, agent behaviors, AI infrastructure correlations I think our CTI processes should adapt for this kind of attack patterns.
Overall awesome talk 👌@unpromptedconf
I think this is the death of TTPs as we know it.
But there is new forms of TTPs we can analyze and track, starting with adversarial prompts, agent behaviors, AI infrastructure correlations I think our CTI processes should adapt for this kind of attack patterns.
Overall awesome talk 👌@unpromptedconf
3
8
43
3,541
The talk I was waiting for! @eyalsela is talking about autonomous attacks at @unpromptedconf
0
2
13
1,103
I guess you are not working on compiled binaries! 😅
But yes for interpreted code this is great! Also be careful to fake comments or hidden instructions 🙂
But yes for interpreted code this is great! Also be careful to fake comments or hidden instructions 🙂
AI-developed malware is fucking amazing because it leaves us a shit ton of comments in the code, so whenever I search for strings, I get exactly what it's doing and why 🙃
You should update your .md accordingly.
1
0
5
1,386
The good thing with AI is that now every project gets beautiful interfaces! But the reality is that with agents nobody will use anymore static interfaces in the future. Simply because static interfaces and dashboards are for an old world and we are moving toward a hyper-customized use of the internet!
That’s a prediction 🔮😅
That’s a prediction 🔮😅
6
2
20
2,113
🧐
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concernin…
1
1
8
2,195
👀 New original @SecurityBreakAI research!
Inside Omega AI: An All-in-One Underground AI Platform
@pedrinazziM investigated Omega AI, an underground platform that combines unrestricted AI models, jailbreak prompts, offensive security tools, and malware monetization guidance in one place.
An all-in-one platform that have one goal: lower the barrier to entry for less experienced threat actors.
Read our research 👇
blog.securitybreak.io/inside-omega-a…
Inside Omega AI: An All-in-One Underground AI Platform
@pedrinazziM investigated Omega AI, an underground platform that combines unrestricted AI models, jailbreak prompts, offensive security tools, and malware monetization guidance in one place.
An all-in-one platform that have one goal: lower the barrier to entry for less experienced threat actors.
Read our research 👇
blog.securitybreak.io/inside-omega-a…
3
16
56
5,271
🤓 At @UnpromptedAU I talked about AI Threat Intelligence.
How threat actors are using AI and how to track them!
Check out the recording below 👇
youtu.be/hqCO0S8qzVA?si…
How threat actors are using AI and how to track them!
Check out the recording below 👇
youtu.be/hqCO0S8qzVA?si…
0
4
28
2,479
👀
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/81003…
1
0
3
3,319
👀👀
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
1
2
5
3,268
🤓 If you want to take a break from PHP2Shell I recorded a new video where I show you the free MCP/SKILL scanner we created so you can check the content before you decide to install it.
We have also released a NOVA MCP server so you can ask your agent to scan an MCP server or before installation.
This video is in partnership with @feedly Threat Intelligence, I demonstrate how to use their new Ask AI feature for threat intelligence. Feedly Ask AI allows you to customize the context of your organisation and tailor threat intelligence to your specific needs.
Check out the video below for more info! The Agent Scanner link is in the first comment 👇
We have also released a NOVA MCP server so you can ask your agent to scan an MCP server or before installation.
This video is in partnership with @feedly Threat Intelligence, I demonstrate how to use their new Ask AI feature for threat intelligence. Feedly Ask AI allows you to customize the context of your organisation and tailor threat intelligence to your specific needs.
Check out the video below for more info! The Agent Scanner link is in the first comment 👇
5
9
35
2,270
🤓 Our training Practical AI for CTI (renamed AI Threat Intelligence Bootcamp) is getting an update! You will learn methodologies for hunting adversarial AI agents, AI attackers infrastructure, prompt hunting and more!
The training will be available at @BlackHatEvents Europe (almost sold out) and Black Hat Asia.
I’ll share more updates in the next few weeks!
You can already book for Black Hat Asia! 👇
Cc: @SecurityBreakAI
blackhat.com/asia/training/…
The training will be available at @BlackHatEvents Europe (almost sold out) and Black Hat Asia.
I’ll share more updates in the next few weeks!
You can already book for Black Hat Asia! 👇
Cc: @SecurityBreakAI
blackhat.com/asia/training/…
What's a good class to take for someone who wants to learn more about using AI in threat hunting? I know @fr0gger_ 's class is really good, are there some others that people would recommend?
1
1
9
1,359
Second Time this year LiteLLM get compromised 🧐
Check the blog for full details: wiz.io/blog/litellm-c…
1
3
13
1,427