Crow's Nest - 2026-08-25

A roundup of 429 items curated from across the security community.

News

• Hackers Arrested Over 30M Euro Bank Fraud by BleepingComputer.

Hackers arrested for exploiting a service provider flaw to steal over 30 million euros through bank fraud.

• LiveOverflow Reacts to OpenAI Black Hat Agent Talk by LiveOverflow.

LiveOverflow’s reaction to the OpenAI Black Hat talk on AI agents finding vulnerabilities and moving laterally. Explores the implications for defenders.

• Gold Eagle Vulnerability Clearinghouse Faces Capacity Concerns by SwitHak ().

The Gold Eagle vulnerability clearinghouse is meant to rescue vuln management from an AI-fueled discovery crisis. Experts question whether it has the capacity and redundancy to deliver.

• BloodHound Turns 10 by Will Schroeder.

Creators harmj0y, wald0, and CptJesus celebrate a decade of BloodHound with a two-part retrospective on attack graphs and what comes next.

• How French Police Used GitHub Malware to Hack EncroChat by thaddeus e. grugq.

New details on how French police hacked the EncroChat cryptophone network using malware sourced from GitHub. Raises the question: how do you defend against an adversary that can seize your private keys and change your DNS?

• Binance Gave Russia Crypto Account Data Leading to Arrest by thaddeus e. grugq.

Russian authorities arrested an IT specialist over crypto donations to Ukraine. Binance provided extensive account data including IDs, transactions, logins, and device info to Russia’s Investigative Committee.

• Operation CameraSwarm: 14,000 Dahua Cameras Compromised by SwitHak ().

Hunt.io documents over 14,000 Dahua cameras compromised across Ukraine and Russia as part of a coordinated surveillance operation.

• GLM-5.3 Finds 1,097 Critical Bugs Across Kernels and Browsers by /r/netsec.

Z.ai’s GLM-5.3 demonstrates emergent security capabilities, discovering 1,097 critical and high severity bugs across kernels, browsers, and infrastructure. Oldest flaw dates to 1981.

• CaptiveCrunch Part II: MSPs and Black Hat Hotel Targeting by Nick Carr.

Follow-up analysis reveals three North American MSPs serving seven of the top ten US hotel chains were compromised. Activity from Las Vegas IP addresses appeared in the weeks before Black Hat and DEF CON.

• Tunnel Vision: What Microsoft Secure Edge Can’t See by Kuba Gretzky.

x33fcon talk now on YouTube. Explores gaps in Microsoft’s Secure Edge network security model and what attackers can still reach.

Techniques and Write-ups

• IDT Hijacking Under VBS/HVCI/kCET on Windows 11 by Alex Ionescu.

Kernel code execution achieved via IDT table hijacking on Windows 11 with VBS, HVCI, and kCET enabled. Alex Ionescu notes HLAT/HVPT mitigates this class of attack.

• Weaponising Windows MDM: Fake Server to SYSTEM by Johnny Fishcake.

Run a fake MDM server and gain SYSTEM with two clicks on targets that have permission to elevate. PoC included in the AmberWolf blog post.

• macOS Spotlight PostScript Memory Corruption (CVE-2026-43774) by Csaba Fitzl.

Csaba Fitzl used Claude to find CVE-2026-43774, a memory corruption vulnerability in macOS Spotlight’s PostScript parser. Fixed in macOS 26.6.

• Detecting Entra Device Registration Abuse by Dirk-jan.

Wiz research on detecting and outsmarting attackers who abuse Entra device registration for persistence and lateral movement.

• Modern iOS Security: SPTM, TXM, and Exclaves Deep Dive by kmkz.

Academic paper exploring Apple’s Secure Page Table Monitor, TXM, and Exclaves architecture on modern iOS. Covers the internal security boundaries protecting the kernel and its trusted extensions.

• ArtsOfGetSystem: SYSTEM via Scheduled Task Registration by Rémi GASCOU (Podalirius).

New PoC from daem0nc0re for executing SYSTEM processes via scheduled task registration, extending the ArtsOfGetSystem privilege escalation toolkit.

• BOFScale: In-Memory Tailscale Daemon via C2 with CDN Fronting by AndrewMohawk⁽ⁿᵘˡˡ⁾.

Runs an entire Tailscale daemon from memory inside a C2 implant. Zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, with relay connections back through the tailnet.

• BTR Reforged: Weaponizing Defender’s Remediation Driver by Michael Weber.

Check Point research shows how Defender’s signed BTR.sys driver can be abused as a kernel primitive to bypass Tamper Protection, delete EDR components before boot, and gain persistence without any vulnerability or BYOVD.

• Exploiting I/O Rings on Windows (Yarden Shafir Talk) by Stephen Sims.

Yarden Shafir’s talk on exploiting I/O Rings on Windows and the mitigations Microsoft has built to counter the technique. Full recording now on YouTube.

• Code Execution via Signed Google Chrome Installers by Sam Curry.

Signed Google Chrome installers can be abused to achieve arbitrary code execution on target systems. Full writeup from AmberWolf.

Tools and Exploits

• SCCM Privilege Escalation PoC (CVE-2026-47301) by Rémi GASCOU (Podalirius).

Public exploit for CVE-2026-47301 (CVSS 8.8) in Microsoft SCCM. Chains improper access control into domain user to SYSTEM code execution on the primary site server.

• DEF CON 34 EDR Evasion Workshop Materials Released by thaddeus e. grugq.

Full workshop materials from DEF CON 34 and BSidesLV. Covers malware development, EDR architecture, evasion techniques, C2 customization, and kernel-level approaches.

• OdinEye: Real-Time Compromise Detection in Public Beta by dylan.

Launches from a one-liner, visualizes scan results in real-time in the browser. Designed to answer one question: is this computer compromised?

• DreadIndex: Offensive Security AI Model Benchmarks by dreadnode.

Updated DreadIndex benchmarks Kimi K3 against frontier models on offensive security tasks. K3 doubles performance in web pentesting, crypto, and reversing over earlier versions.

• OFTW v4 Berlin Apple Security Talks Now on YouTube by Gergely Kalman.

All talks from the Objective-See Foundation’s OFTW v4 event in Berlin are now available on YouTube. Beginner-friendly Apple security content.

• Windows Admin Center Command Injection PoC (CVE-2026-56197) by Max.

Public PoC for CVE-2026-56197, a command injection vulnerability in Windows Admin Center. Exploitable over the network by an authorized attacker.

• Semgrep Evaluates GLM-5.3 Vulnerability Detection by thaddeus e. grugq.

Semgrep evaluates GLM-5.3 for vulnerability detection. Open-weight models are challenging frontier labs on cost-per-vulnerability found, though they still use more tokens.

• Batch of WebKit Bugs Fixed by Apple by LiveOverflow.

Apple patches a batch of WebKit bugs disclosed by itszn. Update Safari now.

• DutchOven: WFP-Based Network Gating with Detection Strategies by Florian Roth.

Red team PoC using Windows Filtering Platform to temporarily block EDR outbound connections, with detection strategies and Event ID guidance for defenders.

• tmp.0ut Volume 5: Viruses, Rootkits, and Weird Machines.

The latest volume of the underground security zine. 21 papers covering viruses, rootkits, ELF internals, weird machines, and more.