The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions 2026-09-14 78 Cyril François,Andrew Pease True Linux Detection Engineering - Local Privilege Escalation 2026-09-11 70 Ruben Groenewoud True How to correlate Kubernetes audit logs with container runtime data 2026-09-03 70 Isai Anthony True REVSTEALER ramps up: analysis of up-and-coming infostealer 2026-09-02 78 Daniel Stepanic,Salim Bitam,Jia Yu Chan True Linux Detection Engineering - Fileless Execution 2026-09-01 60 Ruben Groenewoud True From 88 lines to 1: Detecting DLL hijacking with Elastic Defend 2026-08-28 75 Ian Garratt,Tamás Péter True Living off the coding agent: Two tales of tunnels and LaunchAgents 2026-08-07 65 True Living off the coding agent: Two tales of tunnels and LaunchAgents 2026-08-07 70 Mika Ayenson,Jia Yu Chan True Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages 2026-08-06 92 Elastic Security Labs True Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages 2026-08-06 92 True Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows 2026-08-04 0 Dhrumil Patel True Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend 2026-07-31 78 Elastic Security Labs True Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend 2026-07-31 80 True What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support 2026-07-31 70 True What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support 2026-07-31 70 Pedro Jaramillo,Roxana Gheorghe,Mia LaVada True wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution 2026-07-23 85 True wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution 2026-07-23 80 Ruben Groenewoud,Bryan Porras Blanch True New North Korean campaign uses fake coding interviews to steal developer credentials 2026-07-18 88 Daniel Stepanic True New North Korean campaign uses fake coding interviews to steal developer credentials 2026-07-18 88 True TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains 2026-07-16 78 Cyril François True TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains 2026-07-16 75 True ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit 2026-07-08 75 True ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit 2026-07-08 75 Jia Yu Chan,Salim Bitam True From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI 2026-06-23 0 True Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap 2026-06-19 30 Terrance DeJesus True Lost in relocation: analysis of a new loader distributing CASTLESTEALER 2026-06-19 75 Daniel Stepanic,Jia Yu Chan True Lost in relocation: analysis of a new loader distributing CASTLESTEALER 2026-06-19 72 True Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace 2026-05-26 88 Samir Bousseaden,Terrance DeJesus True Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace 2026-05-26 88 True PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT 2026-05-22 88 Salim Bitam True PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT 2026-05-22 85 True Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild 2026-05-09 90 Ruben Groenewoud,Eric Forte,Samir Bousseaden True Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild 2026-05-09 80 True TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook 2026-05-07 78 Jia Yu Chan,Daniel Stepanic,Seth Goodwin,Terrance DeJesus True TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook 2026-05-07 78 True DFIR: From alert to root cause using Osquery without leaving Elastic Security 2026-05-01 45 Raquel Tabuyo True DFIR: From alert to root cause using Osquery without leaving Elastic Security 2026-05-01 45 True CI/CD pipeline abuse: the problem no one is watching 2026-04-29 85 Mika Ayenson True CI/CD pipeline abuse: the problem no one is watching 2026-04-29 85 True The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation 2026-04-21 30 True Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT 2026-04-14 80 Salim Bitam,Samir Bousseaden,Daniel Stepanic True Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT 2026-04-14 80 True How we caught the Axios supply chain attack 2026-04-02 90 Joe Desimone True Hooked on Linux: Rootkit Detection Engineering 2026-04-02 70 Ruben Groenewoud,Remco Sprooten True How we caught the Axios supply chain attack 2026-04-02 92 True Hooked on Linux: Rootkit Detection Engineering 2026-04-02 70 True Inside the Axios supply chain compromise - one RAT to rule them all 2026-04-01 90 Ruben Groenewoud,Samir Bousseaden,Salim Bitam,Joe Desimone,Colson Wilhoit,Andrew Pease True Elastic releases detections for the Axios supply chain compromise 2026-04-01 90 True Inside the Axios supply chain compromise - one RAT to rule them all 2026-04-01 90 True Elastic releases detections for the Axios supply chain compromise 2026-04-01 85 Ruben Groenewoud,Samir Bousseaden,Salim Bitam,Joe Desimone,Colson Wilhoit,Andrew Pease True 
