Featured Content
When the AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability in AWS's Agentic IDE
We discovered a remote code execution vulnerability in Kiro, AWS’s agentic IDE. By planting hidden instructions in a web page Kiro reads, an attacker can make it rewrite its own MCP configuration file (~/.kiro/settings/mcp.json) and launch malicious code, bypassing the user-approval boundary meant to stop risky actions. A routine request like “summarize this page” becomes silent code execution on the developer’s machine. AWS has patched the flaw, so update Kiro to the latest version.
Two Trojan Families Trotting in Through Google Search Ads
Two malware families spread via Trojanized utility apps (PDF and file converters) promoted through Google search ads. SilentMare is a downloader that acts as a beachhead, active since 2024 across three generations; it swaps implementation languages but keeps the same pattern: a daily-checking updater that loads AES-encrypted .NET payloads directly from memory. HollowMare is a PUA that force-installs browser extensions or hijacks the default search engine. Their infrastructure overlaps, but shared authorship isn’t confirmed.
OrBit (Re)turns: Tracking an open-source Linux rootkit across four years of forks and deployments
In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized.
Tracing a Paper Werewolf campaign through AI-generated decoys and Excel XLLs
An XLL is a native Windows DLL that Excel loads as an add-in, allowing it to execute arbitrary code through exported functions like xlAutoOpen. Since at least mid-2017, threat actors began abusing Microsoft Excel add-ins via the .XLL format, the earliest documented misuse is by the threat group APT10 (aka Stone Panda / Potassium) injecting backdoor payloads via XLLs.