Threat actor "Icarus" exploited a stale credential in Klue (market intelligence platform) starting June 11, 2025, stealing OAuth tokens to access customers' CRM systems (Salesforce, Gong, etc.). Huntress confirmed exfiltration of sales/contact data only; no product, credential, or threat telemetry data was impacted.

Mitiga Labs scanned 50,000+ AI instruction files across 7,000+ repos, finding prompt-exfiltration malware, ANTHROPIC_BASE_URL MITM overrides, YOLO-mode permission bypasses, and 1,230+ hardcoded API keys. They released Skillgate, a free scanner, to detect these techniques.

A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems.

This post explores four vectors for threat actors to abuse Azure Storage to maliciously encrypt victim blobs, including step-by-step explanations and event codes for detection.

GCP's deprecated serviceData field gets silently stripped when audit logs reach your SIEM, leaving detection rules blind to disabled logging. Here's the gap.

A compromised npm account published 140+ malicious @mastra/* packages on 2026-06-17, injecting a typosquatted dependency (easy-day-js) that runs a cross-platform infostealer at install time, stealing browser data, crypto wallet extensions, and exfiltrating to attacker C2 servers.

Datadog's Security Research team has analyzed current Salesforce threats, logging, and detection opportunities. This post provides the queries and context you need to begin hunting for attacker behavior across your Salesforce environment.

Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

A Burp extension that easily allows for switching a request's session (headers, cookies) on the fly. You can also check out the companion blog post.

Inline proxy for software package registries to provide observability and policy controls to installs. You can also check out the companion blog post.

A CLI that inventories security-relevant metadata on developer workstations.

Open source MCP Gateway and Registry (Apache 2.0) provides enterprise governance for AI assets (MCP servers, agents, skills) via centralized discovery, fine-grained RBAC, supply-chain security scanning, hybrid semantic/keyword search, OpenTelemetry observability, federation with external registries, and deployable on EKS/ECS/EC2.

AWS Continuum is a new agentic security product in gated preview that addresses code vulnerability lifecycles at machine speed. It uses multiple frontier models to perform discovery, prioritization, validation, and automated remediation, with graduated trust from human-in-the-loop to enforce mode.

Amazon S3 now lets you attach up to 1 GB of rich, mutable, and queryable context directly to your objects using annotations, purpose-built for AI agents and autonomous workflows that need to discover, understand, and act on data at scale without maintaining separate metadata systems.