Red Team — Tags — Hive Security

Week 32 Security Roundup: The Management Plane Is the Target

TeamCity, N-central, and Cisco FMC put the same lesson in three different packages: attackers want the systems that already control everything else.

Dependency Confusion: Your Internal Package Name Is a Public Attack Surface

Publish a package with the same name as a company's private one, give it a higher version number, and package managers will happily install the attacker's code instead. Here's how it still works in 2026.

Prompt Injection in 2026: From Research Toy to Real CVEs, Agent Hijacking, and Zero-Click Exfiltration

CVE-2025-32711 (EchoLeak) exfiltrated M365 data with zero user interaction. The Anthropic MCP server had three exploitable injection CVEs. OpenAI says AI browsers may never be fully fixed. Here's the full attack chain — and how to detect it.

The VPN Was Never the Problem: How a Windows Telemetry ID Unmasked a Scattered Spider Suspect

A 19-year-old allegedly hid behind a VPN and ngrok during an $8M jewelry-retailer extortion case. Windows' Global Device Identifier (GDID) gave investigators a device-level pivot.

RFC 10008: The New HTTP QUERY Method and the Attack Surface Still Catching Up

IETF published RFC 10008 in June 2026, standardizing the HTTP QUERY method. Here is where WAFs, caches, CORS handling, and CSRF assumptions need review.

ChocoPoC: The Exploit You Cloned Is the Attack

ChocoPoC hides a remote access trojan inside trojanized CVE proof-of-concept repositories on GitHub, using a malicious PyPI dependency chain to compromise the researchers who clone them.

One HTTP Header, Full Admin Access: Gitea's June 2026 Security Release Explained

Gitea 1.26.3 and 1.26.4 addressed a dense security release window, including a 9.8 CRITICAL auth bypass exploitable with a single HTTP header. Here's what broke and how to fix it.

Your Favicon Is Leaking Your Entire Infrastructure

A single 16x16 icon file can expose hundreds of servers, bypass WAF protections, and map your entire attack surface — here's how attackers use favicon hashing with Shodan, and how defenders can stop it.

pedit COW & DirtyClone: Two New Linux Root Exploits That Bypass On-Disk Integrity Checks

CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.

Trump Died of Rabies — And What That Means for Your Package Manager

When DuckDuckGo's AI killed Trump with rabies, the world laughed. When AI coding assistants invent package names, attackers register them. Nobody's laughing then.

Cordyceps and GitHub Actions: When CI/CD Trust Boundaries Become the Supply Chain Attack

Novee's Cordyceps research is a reminder that GitHub Actions workflows are executable attack surface, not harmless YAML. Here is how to audit the trust boundary before an outside pull request borrows maintainer authority.

47-Day Certificates Will Make Every Website Look Like a Phishing Site

The CA/Browser Forum is cutting TLS certificate lifespans from 398 to 47 days by 2029 to reduce the value of stolen certificates. The fix creates a bigger target: the automation that now issues every certificate on the internet.

Pwnd Blaster: How a $280 Soundbar Becomes a Wireless BadUSB

A Bluetooth flaw in Creative's Sound Blaster Katana V2X lets anyone within 15 meters flash malicious firmware and turn the soundbar into a keystroke-injecting keyboard — no pairing required.

SaaS Hacking: The New Internal Network Attackers Already Use

Attackers no longer need malware on every endpoint. With one valid identity, token, or integration, they can move through Microsoft 365, Google Workspace, Salesforce, Slack, GitHub, and other SaaS platforms like an internal network.

Miasma and Mini Shai-Hulud: When npm Malware Learned to Persist in AI Coding Agents

Mini Shai-Hulud and Miasma show how supply chain malware can move from npm install-time execution into Claude Code hooks, VS Code tasks, and CI/CD persistence.

The AI Evasion Lab

Sophos X-Ops uncovered a threat actor using Claude Opus 4.5 and Cursor IDE to build an automated, modular EDR evasion framework — 80 modules, 70+ techniques, tested against Sophos, CrowdStrike, and Defender.

Poisoned AI: How Hugging Face Became a Malware Distribution Platform

A fake OpenAI repo hit #1 trending on Hugging Face with 244K downloads in 18 hours. Here's every attack vector targeting AI model repositories — and how to defend against them.

The IT Guy Who Wasn't: How Attackers Walk Through Your Front Door

Physical social engineering is back — and the attacker doesn't have to be an IT guy. Learn how anyone with the right uniform and pretext can walk through your front door, and how organizations can fight back.

SSH-keysign-pwn: The Nine-Year Linux Kernel Flaw

CVE-2026-46333 (ssh-keysign-pwn) is a nine-year-old Linux kernel race condition that lets an unprivileged local user steal SSH host keys and dump /etc/shadow. Root command execution is also possible on specific configurations.

BloodHound CE: Map Active Directory Attack Paths to Domain Admin (2026)

Run SharpHound, read attack graphs, abuse ACL misconfigurations and Kerberoastable accounts — step-by-step path to Domain Admin in Active Directory.

Your Firewall Just Became Their Foothold

CVE-2026-20182 (CVSS 10.0) and CVE-2026-0300 (CVSS 9.3) hit simultaneously — one owns your firewall, the other poisons your entire SD-WAN fabric.

LOLBins in 2026: How Attackers Use Windows Against Itself

79% of attacks in 2024 used no malware. Certutil, mshta, rundll32 — execution, persistence, and evasion via Windows built-ins. Detection rules included.

Windows Attack Techniques 2026: BYOVD, ClickFix, and C2 over Cloud

BYOVD EDR evasion, ClickFix delivery, C2 over cloud services — how modern Windows attackers operate in 2026, and the detection logic to catch them.

SQL Injection 2026: Blind, Time-Based, ORM Bypass, and WAF Evasion

Still powering major breaches in 2026 — blind injection, time-based attacks, ORM bypasses, WAF evasion. Real payloads and detection queries.

Shai-Hulud: The Open-Source GitHub Actions Token Harvester That Just Went Public

TeamPCP's Shai-Hulud is a TypeScript/Bun C2 framework targeting GitHub Actions CI/CD pipelines — it steals GitHub tokens, exfiltrates via a fake git domain, and has now been open-sourced for anyone to deploy.

The Cache That Bites Back: GitHub Actions Cache Poisoning Attacks

How attackers turn GitHub Actions' shared build cache into a supply chain weapon — real cases, attack mechanics, detection logic, and mitigations.

When the Weapon Learns: How Nation-States Weaponized AI Across the Full Attack Chain

Google GTIG's May 2026 report documents a turning point: state actors now use AI to write zero-day exploits, build self-navigating backdoors, and poison the AI supply chain itself.

AD Attack Chains: From Initial Access to Domain Admin

A complete purple team walkthrough of Active Directory attack chains — from initial foothold through Kerberoasting, DCSync, and Golden Tickets to full domain compromise, with detection rules for every technique.

ADCS Abuse with Certipy: From Low-Priv User to Domain Admin via Certificate Services

Active Directory Certificate Services is installed in most enterprise networks — and almost always misconfigured. Here's how attackers exploit ESC1 through ESC8 with Certipy, and how to detect and stop them.

AI Agent Traps: Six Ways Attackers Manipulate Autonomous AI — With Real Examples

Google DeepMind published the first systematic taxonomy of AI agent manipulation techniques. Here's what each attack looks like in practice — and why most AI deployments are already vulnerable.

AirSnitch: How Attackers Silently Break Wi-Fi Client Isolation

AirSnitch bypasses Wi-Fi client isolation using four attack primitives — even on WPA3. Every router tested was vulnerable. Here's how it works and how to defend against it.

AitM Phishing: How Attackers Bypass MFA and How to Stop Them

Adversary-in-the-Middle phishing silently proxies real login pages and steals session tokens — making MFA useless. Here's how it works and how to detect it.

API Security in 2026: JWT Attacks, OAuth Abuse, and GraphQL Exploitation

APIs are the most exploited attack surface in 2026. Learn how attackers abuse JWT tokens, OAuth flows, and GraphQL endpoints — and how to stop them.

Attack to Defend: Why the Best Security Professionals Think on Both Sides

The most dangerous defenders understand how attackers think. The best red teamers understand what defenders see. Here's why the divide between offense and defense is killing your security program.

AutoHotkey Malware Loaders: How Attackers Weaponize Automation Scripts

AutoHotkey isn't just for productivity scripts — attackers use it as a stealthy malware loader. Learn how AHK-based campaigns work and how to detect them.

AWS IAM Privilege Escalation to Data Exfil: The Full Attack Chain

How attackers escalate from a low-privilege AWS IAM credential to full S3 data theft — and the CloudTrail events, GuardDuty findings, and Sigma rules that expose them.

Browser-in-the-Browser: The Phishing Attack That Fakes the Browser Itself

Browser-in-the-Browser (BitB) attacks forge convincing browser popup windows using pure HTML and CSS — making phishing pages nearly impossible to spot by eye. Here's how it works and how to defend against it.

BYOVD: How Attackers Use Legitimate Drivers to Kill Your Security Tools

BYOVD (Bring Your Own Vulnerable Driver) lets attackers reach the Windows kernel using signed, legitimate drivers — and then silently kill your EDR before ransomware drops.

The Build Is the Target: CI/CD Pipeline Attacks and How to Detect Them

Your CI/CD pipeline stores production credentials, runs code automatically, and trusts pull requests. Here's how attackers exploit that — and the detection logic to catch them.

The 'Fix' Is the Exploit: ClickFix, FileFix, JackFix and Pastejacking Attacks Explained

ClickFix attacks trick users into running malicious code disguised as legitimate troubleshooting. Learn how these social engineering tactics work and how to defend against them.

Cobalt Strike Detection & Hunting: A Defender's Playbook

How to detect Cobalt Strike beacons in your environment — network fingerprints, process injection patterns, Sigma rules, and practical hunting queries for blue teams.

CrackArmor: Nine AppArmor Flaws That Let Attackers Own the Kernel

Qualys TRU disclosed nine confused deputy vulnerabilities in Linux AppArmor — exposing 12.6 million servers to root escalation, KASLR bypass, and container isolation collapse. Technical deep dive and detection guide.

CSRF Explained: How Attackers Trick Your Browser Into Making Requests for Them

CSRF (Cross-Site Request Forgery) forces authenticated users to unknowingly submit requests to a site they're logged into. Learn how it works, how to find it, and how to fix it.

DCSync: How Attackers Steal Every Password in Your Domain — and How to Stop Them

DCSync abuses Active Directory replication to pull every password hash from a domain controller without touching it. Here's how the attack works, what it leaves in your logs, and how to build detections that catch it.

The Digital Parasite: How Attacker Tradecraft Evolved in 2026

80% of top MITRE ATT&CK techniques now focus on evasion and persistence. Attackers abandoned smash-and-grab for long-term parasitic operations in networks.

Entra ID Attacks in Practice: Device Code Phishing, PRT Theft, and Conditional Access Bypass

MFA is no longer enough to protect Microsoft Entra ID accounts. Attackers steal tokens, register their own devices, and bypass Conditional Access — without ever touching a password. Here's the full attack chain and how to detect it.

Hacking Prison Sentences: Real Convictions That Should Terrify You

From 10 years to life in prison - real cybercrime convictions from Europe, USA, and Asia. DDoS, ransomware, and data theft aren't victimless crimes.

IDOR Explained: How Attackers Access Anyone's Data by Changing a Number

IDOR (Insecure Direct Object Reference) is one of the most common and most impactful web vulnerabilities. Learn how it works, how to find it, and how to fix it.

Invisible Characters as an Attack Vector

Unicode's invisible characters are being weaponized — hiding malicious code in repositories, hijacking AI agents, and bypassing security reviews without leaving a trace visible to human eyes.

The EDR Dead Zone: How Attackers Pivot Through Cameras and NAS Devices

IoT devices like IP cameras and NAS boxes sit on your network but outside your EDR coverage. Here's how attackers exploit them to pivot — and how defenders can detect it.

Linux Lateral Movement: Attack Techniques and How to Detect Them

A complete guide to Linux lateral movement — SSH pivoting, ssh-agent hijacking, credential harvesting, port forwarding, and NFS abuse. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

Linux Privilege Escalation: Attack Techniques and How to Detect Them

A complete guide to Linux privilege escalation — SUID abuse, sudo misconfig, cron hijacking, capabilities, and kernel exploits. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

Trust Me, I'm a Shortcut: How LNK Files Lie to Windows Explorer

Windows .lnk shortcut files can show one target while silently executing another. Discover five spoofing techniques including CVE-2025-9491, how attackers exploit them, and how to detect them.

macOS Offensive Security: How Attackers Exploit Apple's Unique Attack Surface

TCC bypass, Keychain theft, Launch Agent persistence, dylib hijacking — how attackers target macOS and how defenders detect them. Attack→Detect with real commands.

MCP Servers Through an Attacker's Eyes: What Happens When You Plug In Without Thinking

MCP servers let AI assistants control your tools — but most users install them without understanding the attack surface. Here's what attackers already know.

Mobile Pentesting: How to Attack Android and iOS Apps Like a Professional

A practical guide to mobile application penetration testing on Android and iOS — static analysis, dynamic analysis, traffic interception, and the most common vulnerabilities found in real engagements.

Network Penetration Testing: From Nmap Scan to Pivoting Deep Into the Network

A practical guide to network penetration testing — host discovery, service enumeration, vulnerability exploitation, credential attacks, and pivoting through segmented networks.

NTFS Alternate Data Streams: How Attackers Hide in Plain Sight

NTFS Alternate Data Streams let attackers hide executables inside innocent-looking files. Learn how ADS works, how malware uses it, and how to detect it with PowerShell, Sysinternals, and Sysmon.

NTLM Relay in 2026: Microsoft Declared It Dead. Attackers Didn't Get the Memo.

Microsoft is officially deprecating NTLM — yet CVE-2025-24054 was actively exploited days after patching, and the Coercion → Relay → ADCS → Domain Admin chain still works in most enterprise environments. Here's the full 2026 kill chain and how to detect it.