threat-actors - AlphaHunt Converge

weekly

[SIGNALS WEEKLY] Telephony, Observability, and Identity Under Quiet Pressure

The boring stack moved. CUCM WebDialer. Splunk sidecar. Messaging recovery keys. Very normal. Very annoying.

weekly

[SIGNALS WEEKLY] Edge Access, False Flags, and Emerging AI Attack Surfaces

The edge box blinked. PAN-OS, Ivanti, Teams lures, ClickFix, AI agents. Different doors. Same ugly pattern: access keeps hiding in the plumbing. The boring surface became the breach path.

weekly

[SIGNALS WEEKLY] Quiet Shifts In Tradecraft, Loud Signals In Exposure

Everyone waits for the sexy zero-day. Meanwhile “IT” is in your Teams chat asking for Quick Assist, and your user clicks yes. The breach starts looking a lot like normal work.

ai

The Next 3–6 Months: Where Threat Actors Will Move Faster Than Defenders

Everyone’s hunting “AI attacks.” Meanwhile the ugly money is still in trusted pages, stolen sessions, and users politely pasting the command for them.

weekly

[SIGNALS WEEKLY] GitHub, npm, and Fake Interviews: Why Developer Supply Chain Attacks Are Converging

2026 cyber lesson: attackers don’t need your prod box first. They want your dev, your repo, your package manager, and your CI runner. Force-pushes, fake interviews, poisoned installers. Real classy stuff. 🤡🔧🔥

weekly

SIGNALS WEEKLY: Seedworm in U.S. Networks, Coruna on iPhones, and a Patch Window Measured in Days

This week’s pattern is ugly and simple: Seedworm is reportedly already sitting inside multiple U.S. organizations, Coruna shows spy-grade iPhone exploitation bleeding into broader use, and KEV + March patch drops are shrinking defender response time from “soon” to “right now.”

ai

[DEEP RESEARCH] Who’s Most Likely to Abuse MCP Integrations? UNC3944, TraderTraitor, UNC6293

Three intrusion sets already excel at getting users to approve tools and auth flows. This assessment is probabilistic: it highlights who is best positioned to adapt that tradecraft to MCP-style environments next..

weekly

SIGNALS WEEKLY: How AI Is Turbocharging Attacks on 600+ FortiGate Firewalls

Your firewall isn’t the perimeter. It’s the onboarding portal. 🔥

weekly

SIGNALS WEEKLY: Pre-Filled Links That Poison AI Recommendations (and Memory)

Pre-filled AI prompt links: now a delivery vector. Microsoft warns they can poison assistant recommendations + memory. 🧠🧪

ai

The Next AI Security Frontier: “Agents With Hands” Are Becoming a Board-Level Risk

Your new “AI helper” is basically shadow IT with hands 🤖🧨 Untrusted content → model decides → tools execute. That’s the breach loop.

weekly

SIGNALS WEEKLY: Teams QR/callback phishing beats patching

KEV speedrun of the week 🏁: Office CVE-2026-21509 + WinRAR CVE-2025-8088. Patch anyway… then protect sessions 🍪 (Teams QR/callback lures 📱, SSO/SAML token abuse)

china

Typhoon by Consent: Quiet, Durable, Everywhere

One “Allow” → tenant-wide weather event. 🌀 AI agent phish wraps the consent flow, device-code keeps churning, and Typhoon rides “good” U.S. infra. Kill list: user consent, device-code, or EWS app perms—what’s first?