A deeper look at the npm debug/chalk supply-chain incident: deobfuscating the wallet-hijacking browser interceptor, quantifying the ~2-hour exposure with Wiz telemetry (~99% package prevalence, ~10% malware presence), and unpacking what made it spread so fast.   #attack   #defend   #supply-chain

This post announces the launch of MCP Registry, an open catalog and API for discovering MCP servers. It standardizes server distribution, allows creation of sub-registries, and includes community-driven moderation features.   #announcement   #ai

Exposed cloud credentials become the launchpad for mass phishing, highlighting email services as a prime target in cloud exploitation campaigns.   #aws   #attack

Red Canary's Threat Hunting team recently investigated an incident that illustrates how stealthy and patient an OAuth application attack can be.   #attack   #saas

This post touches the structured attack chain mapped to the SharePoint Online Attack Matrix, showcasing how to move from access to impact using native features, minimal noise, and a whole lot of cloud-native mischief.   #attack   #defend   #saas

This article discusses securing GitHub Actions CI/CD pipelines against contributors with repository access, covering script injection prevention, branch protections, secrets management, environment security, and tag protection best practices.   #ci/cd   #github   #attack

This article reveals a vulnerability in Microsoft 365 Copilot where users could access files without generating audit log entries by simply asking Copilot to omit file links. Microsoft fixed but chose not to disclose this issue.   #ai   #azure   #attack

Exploring the risks of Google Apps Script abuse, from cryptomining to stealthy service accounts, and ways to detect misuse.   #gsuite   #attack   #defend   #monitor

GCP Workload Identity Federation does not support AWS ECS tasks out of the box. Here is why and what you can do about it.   #aws   #gcp   #iam   #containers

Find dangling domains in a multi cloud environment.

Turn plain-English behaviors or small log samples into production-ready detection packs — Sigma, KQL (Sentinel), and SPL (Splunk) — with tests and a short response playbook, all mapped to MITRE ATT&CK.

Proof-of-concept Python package index/mirror proxy tool. You can also refer to the companion blog post.

An offensive & defensive framework for mailbox rule obfuscation and detection in Exchange environments.

Dedicated Local Zones provide a robust solution for running regulated workloads for all industries, to meet strict data residency and digital sovereignty, integrating services like AWS Nitro System, AWS KMS External Key Store, ACM, AWS Shield, Amazon GuardDuty, Amazon Inspector, and AWS CloudTrail.

Multifactor enforcement for Azure Portal sign-ins was rolled out for 100% of Azure tenants in March 2025. Now, Azure is announcing the start of Phase 2 MFA enforcement at the Azure Resource Manager layer, starting October 1, 2025.