Living off the coding agent: Two tales of tunnels and LaunchAgents 2026-08-07 True True Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages 2026-08-06 True True What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support 2026-07-31 True True Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend 2026-07-31 True True What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support 2026-07-31 True Pedro Jaramillo,Roxana Gheorghe,Mia LaVada True wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution 2026-07-23 True Ruben Groenewoud,Bryan Porras Blanch True wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution 2026-07-23 True True New North Korean campaign uses fake coding interviews to steal developer credentials 2026-07-18 True True TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains 2026-07-16 True True ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit 2026-07-08 True True From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI 2026-06-23 True True Lost in relocation: analysis of a new loader distributing CASTLESTEALER 2026-06-19 True True Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace 2026-05-26 True True PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT 2026-05-22 True True Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild 2026-05-09 True True TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook 2026-05-07 True True DFIR: From alert to root cause using Osquery without leaving Elastic Security 2026-05-01 True Raquel Tabuyo True DFIR: From alert to root cause using Osquery without leaving Elastic Security 2026-05-01 True True CI/CD pipeline abuse: the problem no one is watching 2026-04-29 True True The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation 2026-04-21 True True Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT 2026-04-14 True True Hooked on Linux: Rootkit Detection Engineering 2026-04-02 True True How we caught the Axios supply chain attack 2026-04-02 True True Elastic releases detections for the Axios supply chain compromise 2026-04-01 True True Elastic releases detections for the Axios supply chain compromise 2026-04-01 True Ruben Groenewoud,Samir Bousseaden,Salim Bitam,Joe Desimone,Colson Wilhoit,Andrew Pease True Inside the Axios supply chain compromise - one RAT to rule them all 2026-04-01 True True Fake Installers to Monero: A Multi-Tool Mining Operation 2026-03-31 True True Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER 2026-03-27 True True Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework 2026-03-26 True True Supercharge Your SOC 2026-03-24 True Paul Ewing True Supercharge Your SOC 2026-03-24 True True Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario 2026-03-20 True Ruben Groenewoud True Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario 2026-03-20 True True From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect 2026-03-19 True True Patch diff to SYSTEM 2026-03-06 True Joe Desimone True Patch diff to SYSTEM 2026-03-06 True True Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft 2026-03-05 True True MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites 2026-02-20 True True The Immutable Illusion: Pwning Your Kernel with Cloud Files 2026-02-20 True True Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder 2026-02-18 True True Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder 2026-02-18 True James Spiteri,Dhrumil Patel True BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign 2026-02-11 True True SolarWinds Web Help Desk Exploitation - February 2026 2026-02-10 True True SolarWinds Web Help Desk Exploitation - February 2026 2026-02-10 True Elastic Security Labs True DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector 2026-02-06 True True DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector 2026-02-06 True Elastic Security Labs True Automating GOAD and Live Malware Labs 2026-02-05 True True Automating GOAD and Live Malware Labs 2026-02-05 True Nic Palmer,Adrian Chen True NANOREMOTE, cousin of FINALDRAFT 2025-12-11 True True RONINGLOADER: DragonBreath’s New Path to PPL Abuse 2025-11-15 True True 
