# threat-intelligence Published articles for threat-intelligence. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 DevFeed: [CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026]() Original publisher: [Read original article]() Author: Counter Adversary Operations Published: 2026-09-18T01:40:54.157408Z Content type: article Language: en Sources: [Blog]() Topics: [Threat Research](), [Security](), [Threat Hunting & Intel](), [Vulnerabilities](), [telemetry](), [Cloud](), [Artificial Intelligence](), [Software as a service]() Tags: [2026](), [cloud](), [infrastructure](), [malware](), [security](), [telemetry](), [threat-hunting-intel](), [threat-intelligence](), [vulnerabilities]() ### AI overview CrowdStrike was named a Leader in Forrester's Q3 2026 External Threat Intelligence Service Providers evaluation, receiving the highest scores for Strength of Offering and Strength of Strategy. The article highlights platform-native intelligence, endpoint telemetry, threat hunting, vulnerability intelligence, malware analysis, and external threat data. ### Source excerpt CrowdStrike has been named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026, receiving the highest scores in both Strength of Offering and Strength of Strategy. Learn more! ## Atomic macOS (AMOS) Stealer Activity DevFeed: [Atomic macOS (AMOS) Stealer Activity]() Original publisher: [Read original article]() Author: Bradley Duncan Published: 2026-09-16T10:00:06Z Content type: article Language: en Sources: [Unit 42]() Topics: [Malware](), [Aeternum](), [macOS](), [sensitive data](), [Zsh](), [ClickFix](), [cURL]() Tags: [ads](), [clickfix](), [credentials](), [cryptocurrency](), [curl](), [general](), [insights](), [macos](), [malware](), [sensitive-data](), [threat-intelligence](), [unit-42](), [zsh]() ### AI overview This article analyzes a laboratory-generated Atomic macOS (AMOS) stealer infection observed on Aug. 5, 2026. It describes a deceptive macOS toolkit installation page that led users to paste a command into Terminal, retrieving a Zsh script containing an encoded compressed payload and a follow-up script designed to run a Mach-O binary. AMOS targets macOS and can exfiltrate system information, login credentials, and sensitive data from applications including browsers and cryptocurrency wallets. ### Source excerpt Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42. ## The Dodo Digest: The Report Is the Product DevFeed: [The Dodo Digest: The Report Is the Product]() Original publisher: [Read original article]() Author: Rishabh Goel Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [Dodo Payments Blog]() Topics: [anthropic](), [Threat Research](), [Artificial Intelligence](), [Software Engineering]() Tags: [ai](), [anthropic](), [newsletter](), [product](), [report](), [threat-intelligence](), [v1]() ### AI overview This newsletter discusses Anthropic's report on eight months of AI misuse, including a campaign in which one person built an AI-assisted platform for mass attacks. It argues that startups can use reports to document learning, demonstrate expertise, and build trust, and mentions Dodo Payments v1.113.28 product improvements. ### Source excerpt Anthropic turned eight months of threat intelligence into a public report. Why every startup should document what it learns, plus v1.113.28: Reports, grace periods, and blocklists. ## SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System DevFeed: [SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System]() Original publisher: [Read original article]() Author: Joshua Platt Published: 2026-07-06T18:54:30Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Artificial Intelligence](), [Malware](), [Threat Research](), [PowerShell](), [C2](), [Caching](), [Encryption](), [Resilience](), [Routing (disambiguation)](), [Polymorphism](), [Back end](), [Spec Driven Development]() Tags: [ai](), [artificial-intelligence](), [backend](), [c2](), [cache](), [cybersecurity](), [detection-engineering](), [encryption](), [malware](), [malware-analysis](), [polymorphism](), [powershell](), [resilience](), [routing](), [spec-driven-development](), [threat-intelligence]() ### AI overview The article describes SpectrePaste, a previously undocumented fileless malware delivery system that threat actors used with AI as its primary orchestrator and developer. Its early architecture included automated AMSI-bypass generation, XOR-encrypted payloads, resilient command-and-control traffic handling, caching, request queuing, and administrative priority routing. ### Source excerpt by Joshua Platt and Jason Reaves [TLP:CLEAR] Earlier this year, Google Threat Intelligence[1] reported threat actors are increasingly deploying novel, AI-enabled malware in active operations[2]. While investigating a recent OSINT article[3] on malware campaign activity reported as "DeepLoad", our threat intelligence team identified a separate, previously undocumented fileless delivery system we track as "SpectrePaste". The prior public reporting correctly suspected AI involvement in the "DeepLoad" delivery chain, but our analysis reveals a more conclusive and concerning reality. AI did not just play a supporting role. It acted as the primary orchestrator and developer behind the entire SpectrePaste system. Threat actors internally referred to the early system as "PasteFast Panel." In this initial iteration, the system was highly modular, structured, and designed specifically for resilience against high-volume bot traffic. One of the hallmarks of automated, AI-assisted development. The early architecture functioned as a centralized PowerShell payload delivery system with several notable features: Automated Evasion Generation: The paste builder module automatically prepended Anti-Malware Scan Interface (AMSI) bypass scripts to payloads upon creation, followed by XOR encryption using a custom obfuscator template. This ensured every payload served was dynamically packed. C2 Resilience & High-Load Handling: The most sophisticated feature of the early version was its custom cache manager queue system. The threat actors anticipated massive, simultaneous beaconing from compromised hosts. To prevent database exhaustion, the panel featured an automated threshold toggle. During traffic spikes, the system queued requests, cached the encrypted payloads in memory, and deduplicated IP addresses to ensure a single infected bot could not inadvertently DDoS the command server. Admin Priority Routing: Developer requirements explicitly prioritized operator access. Administrative routes ## AI threats in the wild: The current state of prompt injections on the web DevFeed: [AI threats in the wild: The current state of prompt injections on the web]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2026-04-23T21:38:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [prompt injection](), [Artificial Intelligence](), [Security](), [Threat Research](), [Vulnerabilities](), [Google](), [AI Chat]() Tags: [ai](), [ai-agents](), [google](), [none](), [prompt](), [prompt-injection](), [research](), [security](), [snapshots](), [threat-intelligence](), [vulnerabilities]() ### AI overview Google Threat Intelligence teams describe a public-web investigation into indirect prompt injection, an attack in which malicious instructions embedded in websites, emails, or documents can redirect an AI system away from the user's intent. The article examines whether real-world attackers are operationalizing these attacks and uses Common Crawl snapshots to study known patterns. ### Source excerpt Posted by Thomas Brunner, Yu-Han Liu, Moni Pande At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today - and if so, how? To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. The threat of indirect prompt injection Unlike a direct injection where a user "jailbreaks" a chatbot, IPI occurs when an AI system processes content--like a website, email, or document--that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent. This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed our work in this area and researchers have further highlighted the evolving nature of these vulnerabilities. Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks? Proactive monitoring at GoogleThe landscape of IPI on the web There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them. Public research confirms these attacks are ## ETH Rangers Program Recap DevFeed: [ETH Rangers Program Recap]() Original publisher: [Read original article]() Author: Protocol Security Team; Grants Management Team Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Security](), [Vulnerabilities](), [Incident response](), [Threat Research](), [Open Source](), [DeFi]() Tags: [community](), [defi](), [ethereum](), [exploits](), [incident-response](), [open-source](), [root-cause-analysis](), [security](), [smart-contract](), [state](), [talks](), [threat-intelligence](), [vulnerabilities](), [web3](), [workshops]() ### AI overview The Ethereum Foundation and partner organizations recap the six-month ETH Rangers Program, which funded 17 stipend recipients conducting public-goods security work across the Ethereum ecosystem. Reported outcomes include recovered or frozen funds, vulnerability and bug reports, threat-awareness work, security challenges, educational events, incident responses, and open-source tooling. ### Source excerpt In late 2024, the Ethereum Foundation, together with Secureum, The Red Guild, and Security Alliance (SEAL), launched the ETH Rangers Program, an initiative to provide stipends for individuals doing public goods security work in the Ethereum ecosystem. The goal of the program was straightforward: to fund independent efforts that... ## Marriott Deploys Cisco Umbrella DNS-Layer Security Across Nearly 5,000 Properties to Block Access to CSAM DevFeed: [Marriott Deploys Cisco Umbrella DNS-Layer Security Across Nearly 5,000 Properties to Block Access to CSAM]() Original publisher: [Read original article]() Author: Negisa Taymourian Published: 2024-03-12T08:00:00Z Content type: article Language: en Sources: [OpenDNS]() Topics: [Security](), [Cisco](), [Security & compliance, Cloud security]() Tags: [cisco](), [cisco-talos](), [cloud](), [cloud-security](), [customer-focus](), [deployment](), [dns](), [dns-layer-security](), [dns-security](), [scalability](), [security](), [security-service-edge](), [sse](), [threat-intelligence]() ### AI overview The article describes Marriott's deployment of Cisco Umbrella DNS-layer security across nearly 5,000 properties to block access to child sexual abuse materials and other malicious or unwanted domains. It highlights deployment speed, scalability, guest-network performance, manageability, and Cisco Talos threat intelligence. ### Source excerpt Marriott has rapidly deployed Cisco DNS-layer security across thousands of properties to advance human rights by limiting access to CSAM materials. The post Marriott Leads the Way in the Fight to Protect Children Online appeared first on Cisco Umbrella. ## The ISPs sharing your DNS query data DevFeed: [The ISPs sharing your DNS query data]() Original publisher: [Read original article]() Author: ben@benjojo.co.uk Published: 2018-06-25T15:10:39Z Content type: article Language: en Sources: [benjojo blog]() Topics: [Internet](), [Network](), [Security](), [Threat Research](), [Logging](), [Cache](), [Cloudflare](), [1.1.1.1]() Tags: [1-1-1-1](), [cache](), [cloudflare](), [dns](), [internet](), [logging](), [network](), [security](), [threat-intelligence]() ### AI overview The article investigates whether internet service providers share DNS query data with third parties. It explains how unencrypted DNS queries can be observed by network intermediaries and describes an experiment that sent ISP-specific queries to open resolvers to identify which infrastructure handled the lookups. ### Source excerpt The ISPs sharing your DNS query data DNS is fundamental to how the web works, and for most of the population it's completely transparent. Everything on the web is accessed by a DNS name. Since DNS is an old protocol ([November 1987 in fact](http ## Encrypting IP Addresses DevFeed: [Encrypting IP Addresses]() Original publisher: [Read original article]() Published: 2017-05-07T18:46:14Z Content type: article Language: en Sources: [Bert Hubert's writings]() Topics: [Encryption](), [Security](), [Networks](), [Cryptography]() Tags: [encryption](), [internet](), [networks](), [privacy](), [security](), [threat-intelligence](), [traces]() ### AI overview The article examines encrypting IP addresses in network log files as a way to support security analysis while limiting immediate privacy impact. It discusses preserving IP address representation for existing tools and the limitations of zero-padding, XOR, stream ciphers, and block ciphers for encrypting 32-bit IPv4 addresses. ### Source excerpt On IP address encryption: security analysis with respect for privacy Frequently, privacy concerns and regulations get in the way of security analysis. I'm a big fan of privacy, but I'm also a big fan of security and preventing people from getting hacked. If you are hacked you have no privacy either. Per-customer/subscriber traces are extremely useful for researching the security of networks. Specifically, lists of DNS requests per IP address make spotting infected users or infected devices very easy, especially if you look at "yesterday's traffic" and compare it to today's threat intelligence.