[FORECAST] TeamPCP shows why package cleanup is not containment

Supply-chain attacks are becoming access pipelines. The defender move is to follow credentials, not just packages.

[SIGNALS WEEKLY] Telephony, Observability, and Identity Under Quiet Pressure

The boring stack moved. CUCM WebDialer. Splunk sidecar. Messaging recovery keys. Very normal. Very annoying.

[FORECAST] NetNut/Popa was a capacity disruption, not just a botnet takedown

The NetNut/Popa action matters. The harder question is whether the residential-proxy market reroutes.

[DEEP RESEARCH] Operation Endgame Hit SocGholish, Amadey, and StealC. Now Watch the Rebuild.

Operation Endgame gave defenders a strong scoreboard: servers and domains actioned, millions of stolen credentials recovered, thousands of compromised websites remediated, and tens of millions in criminal crypto assets identified or restricted.

[SIGNALS WEEKLY] Control Planes, Stealers, and Emerging AI-Tool Abuse

The control plane blinked. Management surfaces are still getting treated like furniture.

[DEEP RESEARCH] The Hackers Are Not Stealing Trucks. They Are Stealing Authority.

Cyber-enabled cargo theft is less about malware novelty and more about who gets trusted to move the load.

[GAME THEORY] Beyond Domain Takedowns: A causal framework for testing chokepoints in World Cup scam infrastructure

World Cup fraud shows why removing infrastructure is not the same as disrupting the operation.

[SIGNALS WEEKLY] Compressed Timelines at the Edge of the Network

Fortinet VPN portals are getting probed. npm installs can execute more than your build expected. And now the AI conversation is not “someday” — it is about compressed timelines.

[DEEP RESEARCH] Verified for Hire: How Fox Tempest Turned Code Signing Into a Criminal Utility

The certificate was real. The identity behind it was fraudulent—and the signing pipeline was rented to other criminals.

[FORECAST] The VPN You Retired on Paper Is Still Selling Access

A forecast for when legacy VPN compatibility debt becomes ransomware access — and what to verify before certainty arrives.

[SIGNALS WEEKLY] Converging on Exposed Management Planes

The management plane blinked. Everyone treated it like plumbing until the attacker used it like a front door. PeopleSoft PSEMHUB, REDCap, VPN gear, SD-WAN managers, logging sidecars — different products, same pattern. The exposed control layer keeps turning into the incident path.

[DEEP RESEARCH] The bad IP was never the Actor.

A bad IP can be accurate and still tell the wrong story.

gametheory

[GAME THEORY] The Agent Did Not Hack You. The Connector Did.

MCP is not just an AI security story. It may be the first real test of agent connector supply-chain risk.

weekly

[SIGNALS WEEKLY] Perimeter Pressure, Supply Chain Drift, and Identity Theft

The perimeter blinked. VPN portals and CI tokens are still doing incident cosplay.

forecasts

[FORECAST] Fake Hires, Real Access

Forecasting is not fortune-telling. It is how defenders turn messy signals into better questions.

gametheory

[GAME THEORY] Your AI Agent Remembered the Secret. So Did the Attacker.

AI agents are becoming useful because they remember. That also means they are quietly becoming data stores.

weekly

[SIGNALS WEEKLY] Shifting Extortion Tactics and Fragile Software Supply Chains

The pipeline had keys. Nx Console and Megalodon are the same warning: your CI/CD workflow may be production access wearing YAML pajamas. CI/CD is not “just automation.”

forecasts

[FORECAST] The next secret-stealing campaign may start with a tool you trusted

AI coding tools are becoming trusted middlemen. That gives defenders a new attack path to understand before it gets ugly.

breach

[BREACH] The Extension Had the Keys

The plugin had keys. A VS Code extension sat beside repos, tokens, terminals, and AI configs. That is not just productivity. That is inherited access.

weekly

[SIGNALS WEEKLY] Tokens, Edges, and Exploits: Shifting Paths to Compromise

The token survived. npm packages, CI/CD runners, and edge boxes keep turning “contained” into “still owned.” The boring weakness became the breach path.

gametheory

[GAME THEORY] AI-agent spoofing is becoming a claim-vs-proof problem

Known AI agents are becoming trusted traffic. The first defender move is finding claims without proof.

forecasts

[FORECAST] The Threat Was Real. The Public Proof Probably Falls Short (Final: 2026-05-21)

The forecast likely resolves No, but the useful lesson is where Iran-linked operators still depend on access defenders can pressure.

weekly

[SIGNALS WEEKLY] Identity-First Intrusions and AI-Driven Attack Surface Shifts

The login was real. The control plane did the rest. Storm-2949 is the ugly part: one Entra ID identity can turn into SaaS theft and Azure abuse. Nobody owns this until incident day.

podcast

[PODCAST] ANALYST YELLS AT CLOUD

Get closer to the people who understand where threat actors are today — and where they are likely headed tomorrow.