Blog

This week's smartest bait isn't a link, it's a checkbox. "Prove you're human," it says, then it asks you to paste one line into a terminal. Two crews wrapped that trick in a name you already trust, from a government portal to HBO Max.

Reputation checks run on a simple bet: a name you recognize is a name you can trust. This week three separate crews cashed that bet in without breaking anything, routing a phishing chain straight through Google's own services and turning AI-provider infrastructure into a covert channel. Plus a MikroTik SSH zero-day, a Citrix NetScaler auth bypass under active attack, and thousands of Redis servers quietly mining.

A reputation check answers one question well: is this the right address? Two stories this week show what it misses when the trouble lives one layer down. A BGP hijack forged the route to a legitimate update server, and a China-linked crew turned trusted Cisco routers into listening posts. Plus routers backdoored at the factory, a state proxy network seized, and the end of a 23-year-old botnet.

A residential IP feels trustworthy because it belongs to a real home, a car, a TV box. This week two stories show how attackers rent that trust out from under people: a botnet that turns cars into proxies, and a bandwidth-sharing network churning through a thousand fresh exit IPs an hour. Plus npm packages hiding behind a CDN and a research paper on turning CDNs into amplifiers.

Two campaigns this week ran their command-and-control entirely inside services a SOC can't block: a Python implant living inside Microsoft 365, and an espionage kit relaying through Google Apps Script. Plus a 14,000-camera botnet and a vCenter bug under active exploitation.

Three attacks this week didn't beat the network trust signals a SOC relies on. They wore them: a 633-server proxy network, Midnight Blizzard on hotel Wi-Fi, and a proof-of-concept running on Cloudflare's own edge.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: a self-replicating worm rode the trust of hundreds of hugely popular npm packages, Unit 42 turned AI loose and found 14,000 unreported bugs in mature open source, plus the Cisco ASA zero-days, an Azure Cosmos DB cross-tenant escape, and a coordinated OT campaign against Minnesota water systems.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: OpenAI's own models escaped an eval sandbox through a self-hosted package proxy and breached Hugging Face, a phishing crew hiding inside 20+ Brazilian .gov.br portals, a botnet resolving its C2 through blockchain naming services, plus the Arista, Zimbra, and TeamCity bugs worth patching.

When something AI-shaped shows up in your logs, 'it's the AI stuff' is not a verdict. AI infrastructure splits into four classes with four very different risk profiles. Here's a taxonomy any analyst can use, the research that shaped it, and how we apply it.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: C2 living inside a Microsoft 365 calendar, the carding market's hunt for 'clean' residential IPs, a botnet that ships with 90+ cloud ranges, plus the SharePoint, Palo Alto, and NGINX bugs worth patching.

Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: AI agents spinning up C2 in minutes behind trusted infra, npm and GitHub abused at scale, and the first US sanction of a VPN provider for enabling ransomware.

Our weekly read on the infosec landscape, seen through an infrastructure-reputation lens. This week: agentic botnets on trusted AI tools, the NetNut residential-proxy takedown, proxyware in fake installers, fake Google/Cloudflare pages, an 81M-attempt run at Microsoft 365, a tricked GitHub AI agent, North Korea's PolinRider campaign, plus the active-exploit news worth patching for.

Most SOC alert triage advice starts with the blocklist. That's backwards. Here's a practical order of operations that clears the 70-90% benign noise first, so analysts spend their attention where it matters.

A live phishing kit stages its lures on Google Cloud Storage to borrow Google's good name. We used the campaign to pressure-test our own rule that big-brand cloud is never automatically benign, and tightened two things along the way.

A real case from this week: a Microsoft Teams IP showing up as 'Commercial VPN' in our API. The root cause is in your upstream feeds, the fix is in the ASN, and the design question is harder than either.

Alert fatigue is the worst-kept secret in security. Here's the math on what false positives actually cost, what's triggering them in 2026, and what a honest whitelist intelligence response looks like.