Tech MacGyver

Tech/Biz Solutions & Sarasota-Bradenton Computer Service #InfoSec #TechMacGyverTip #CyberSecurity #SRQ #Sarasota #Bradenton #LWR #TampaBay

[BleepingComputer @BleepinComputer]

🚨 Microsoft just released its largest Patch Tuesday ever.

🩹 570 vulnerabilities fixed
🔥 3 zero-days (2 actively exploited)
💻 141 remote code execution flaws

Microsoft recently warned larger Patch Tuesdays were coming as it uses AI to help discover more security flaws before attackers do.

➡️See full report: https://t.co/54Kxatd2WK

[Microsoft Threat Intelligence @MsftSecIntel]

The July 2026 security updates are available:

[Tech MacGyver @TechMacGyver941]

@MsftSecIntel Many people tell AI things they don't share with their spouses. Think about how captured data (or stolen from legit services) can be weaponized and ransomed.

[Tech MacGyver @TechMacGyver941]

@MichaeleneUSA @PhiladelphiaGov @IHTrust It's a beautiful building. Life w/o beauty is just "existing." No thanks. Kudos to the restortation team!

[Tech MacGyver @TechMacGyver941]

@LilBitCrazy70 Check out this cover version! https://t.co/T9x9sfkQJe

[Tech MacGyver @TechMacGyver941]

Interesting development. HR people that screen people with AI are like the mouse jigglers taking the day off with Ferris Bueller. DO YOUR JOB SLACKERS!!!

[Tyler @harristhefrench]

@FinancialPhys Here’s what I could find if you want to help build the case. I certainly will be.

https://t.co/lbiUAlRaux

[BleepingComputer @BleepinComputer]

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks
https://t.co/s1EDQUZXmU

https://t.co/s1EDQUZXmU

[Tech MacGyver @TechMacGyver941]

@sherrod_im @gabsmashh

[Microsoft Threat Intelligence @MsftSecIntel]

Attackers are targeting open-source software ecosystems at scale, using coordinated and repeatable approaches that take advantage of dependency chains and maintainer trust models to distribute malicious packages across widely used registries. https://t.co/Gh6lgCtIHM

The use of AI is reducing barriers to entry, enabling high‑volume package creation and faster iteration of malicious code. At the same time, shifts in coding patterns and tooling behaviors can provide defenders with signals to better identify and track adversary activity.

These campaigns increasingly focus on the software supply chain itself, targeting the tools, libraries, and pipelines used to build and distribute applications. As a result, a single compromised component can propagate across complex dependency trees and significantly expand impact.

Learn more from Microsoft Security’s Allie Luhrs and Mario Samolis from their talk at this year’s Blue Hat USA on the Microsoft Threat Intelligence Podcast, hosted by Sherrod DeGrippo.

[Tech MacGyver @TechMacGyver941]

@Breachrr @MsftSecIntel CMMC tries to address this. Sounds like an endless rabbit hole though.

[Tech MacGyver @TechMacGyver941]

@blackroomsec

[Tech MacGyver @TechMacGyver941]

@blackroomsec I'm still trying to figure out how my after-job-interview-report said I was "using AI" during the interview. Did an AI detector do that? And if AI was trained on real people, and I think I'm a real people, shouldn't I get bonus points?

[Tech MacGyver @TechMacGyver941]

@blackroomsec Barnaby's quests always result in HR incidents. How is it that HR is encouraging this simutaneously? Just thinking about this makes my digital wallet hemorage.

[Microsoft Threat Intelligence @MsftSecIntel]

Compromised npm packages ([email protected], [email protected]) are abusing Hugging Face repos as exfiltration infrastructure. The packages deploy a remote access trojan (RAT) that captures keystrokes, screenshots, and crypto wallet credentials.

Indicators of compromise (IOCs):
- npm user: hexalpha10 / author: toskypi
- 195.201.194[.]107:8010 (WebSocket C2)
- c2-toskypi.onrender[.]com (HTTP C2)
- huggingface[.]co/api (exfiltration endpoint)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem64 (persistence)
- MicrosoftSystem64.service (Linux systemd persistence)
- \MicrosoftSystem64 (Windows scheduled task)
- MicrosoftSystem64/payload.js (payload directory)

Defenders: treat unexpected huggingface[.]co/api calls from non-ML workloads as suspicious.

[Tech MacGyver @TechMacGyver941]

@LibertyCappy He's not wrong.

[Tech MacGyver @TechMacGyver941]

@MrBeardyBeard @TracketPacer We're packet plumbers!

[Tech MacGyver @TechMacGyver941]

@DrClownPhD After this, is "Elliot" now a dead name? Asking for a friend.

[Tech MacGyver @TechMacGyver941]

@gabsmashh Incoming!

[Tech MacGyver @TechMacGyver941]

@MarioNawfal Hunter Biden has reemerged. Still barely qualified to tie his shoes yet the center of attention.

[Tech MacGyver @TechMacGyver941]

@IT_unhinged Ariel approves this message.