DLTA

Cyber Security intelligence, assessment and consulting. Across
enterprise, digital assets and AI systems.

[DLTA @DLTA_Sec]

@NetAskari Yeah, absolutely should raise flags !

[DLTA @DLTA_Sec]

Coding agents now surface smart contract vulnerabilities faster than the teams shipping those contracts can review them.

An attacker runs that agent against every deployed protocol at once; a defender runs it against one codebase before launch.

This does not stay on-chain.

The same agents read CI/CD configs, exposed RPC endpoints, and deployment keys, and the cheapest route to a protocol's treasury is often the web2 host holding its signing infrastructure.

Audits priced for a quarterly cycle do not survive an adversary iterating in minutes.

DLTA tracks that exposure off-chain, mapping the controls a digital asset team needs to its real maturity.

#DeFi #SmartContractSecurity #Web3Security #CTI

[DLTA @DLTA_Sec]

@NetAskari An APK that passes review clean and only pulls the USDT stealer after install defeats EDR allowlists, MDM checks, and exchange mobile-app review by design, because every one of them inspects the wrapper and never the payload that arrives after.

[DLTA @DLTA_Sec]

@cyber_razz If the researchers who surface Defender privilege-escalation bugs get legal letters instead of patches, who is left to find the next one before it is sitting on the workstations holding domain admin tokens, code-signing certs, and exchange withdrawal keys?

[DLTA @DLTA_Sec]

@MsftSecIntel Packages that route exfiltration through Hugging Face repos mean the stolen developer tokens, CI/CD secrets, and wallet signing keys leave inside traffic every SOC already whitelists as normal ML tooling.

[DLTA @DLTA_Sec]

@Jeremybtc A delay window built so users could cancel a hack turns into the one control an attacker has to beat once, the same trap as the EDR console, the backup system, and the multisig approval flow that got trusted absolutely after being added for safety.

[DLTA @DLTA_Sec]

@GreyNoiseIO Defenders who patch a CVSS 10 edge bug on disclosure day are already behind the attackers who watched the scanning countdown compress from 39 days to 2, and so are the VPN gateways, CI/CD runners, and validator and custody hosts living behind that device.

[DLTA @DLTA_Sec]

@yousukezan A memory-exhaustion DoS that folds nginx and IIS with a trickle of traffic also takes down the RPC nodes, validator dashboards, and exchange API gateways that ride the same HTTP/2 front end.

[DLTA @DLTA_Sec]

This weekend, attackers reset Instagram accounts by spoofing a location to Meta's AI support bot and asking it to drop MFA.

One of the hijacked accounts belonged to the Obama White House.

The assistant wired into account recovery had quietly become the authentication authority, and nobody scoped it as one.

Every support chatbot, KYC helper, and wallet-recovery agent now sits on that same boundary, one prompt away from the session tokens, password resets, and MFA toggles it was given to be helpful with.

For a crypto exchange or custodian, the support bot that handles a locked-out user is the same surface that can release an account holding real funds.

DLTA maps the intelligence-to-control loop for that boundary, at the maturity level the client is actually at, before the helpful agent becomes the initial-access vector. https://t.co/K3HbdtGjim

#AISecurity #Web3Security #CTI #ThreatIntel

[DLTA @DLTA_Sec]

@DailyDarkWeb Five million leaked customer records become a credential-stuffing list within hours, replayed against bank logins, SSO portals, and the exchange accounts and custody KYC profiles where one reused password still unlocks everything.

[DLTA @DLTA_Sec]

@MosheTov A worm that runs at npm install time never needs a CVE, because the build already trusts the package; that same install hook reaches the CI/CD runner, the cloud IAM role, and the deployer and hot-wallet keys baked into whatever a digital asset team ships from the same pipeline.

[DLTA @DLTA_Sec]

A spear-phishing ZIP aimed at government officials lands the same on any supplier in that vendor graph, putting developer workstations, code-signing chains, and M365 inboxes next to the validator operator keys and custody approval inboxes a digital asset firm keeps in the same tenant.

[DLTA @DLTA_Sec]

@PeckShieldAlert Fourteen bridge exploits in one year trace back to one repeated design choice: trusting a relayer or verifier to vouch for a cross-chain message, the on-chain twin of a CI system that accepts any signed artifact or an IdP that honours a replayed token.

[DLTA @DLTA_Sec]

@mrgretzky Binding the session to the device closes the cookie-theft path in the browser, but the stolen-token economy just moves upstream to the SSO assertion, the OAuth refresh token, and the exchange API key and validator dashboard session that were never device-bound to begin with.

[DLTA @DLTA_Sec]

@KO_Kryptowaluty If a support chatbot can be talked into resetting an account with a spoofed location, what stops the same trick against the exchange help desk, the custody onboarding agent, and the wallet recovery flow that all sit behind a model nobody scoped as an auth boundary?

[DLTA @DLTA_Sec]

Four security incidents this week, one shared failure: the control that was supposed to decide who gets in stopped deciding.

Palo Alto’s GlobalProtect gateway let attackers bypass authentication and reach the internal network.

A published one-click RCE in self-hosted Flowise surrenders the cloud IAM roles and wallet API keys wired into the agent.

A MiCA-licensed stablecoin issuer was drained while its paperwork still read compliant.

On-chain, cross-chain bridges still account for 42% of losses because a single verifier keeps approving forged withdrawal messages.

The web2 perimeter and the web3 signing path fail for the same reason: an authorization check that trusts whoever calls it first.

DLTA maps that gap to the control at your current maturity level, not to a compliance checkbox.

#CTI #Web3Security #ThreatIntel #DigitalAssets

[DLTA @DLTA_Sec]

@Defi_Edward Monthly losses falling 90% while bridges hold at 42% says the dollar total dropped, not the flaw; a relayer approving a forged cross-chain message fails for the same reason an unverified webhook or forged SAML assertion clears the web2 perimeter.

[DLTA @DLTA_Sec]

China-aligned groups pivoting toward AI and robotics intellectual property puts the build pipelines, code-signing chains, and developer workstations of every supplier in that chain on the target list, alongside the validator keys and bridge relayers of any digital asset firm in the same vendor graph.

[DLTA @DLTA_Sec]

@SlowMist_Team An unguarded reward function is the on-chain version of an admin endpoint shipped without an authorization check, the same access-control gap that leaves cloud IAM roles, CI deploy tokens, and contract owner modifiers all trusting whoever calls them first.