Andrew Pease

Elastic Security Labs Technical Lead. Lawful Neutral. Threat Hunting with the Elastic Stack author. Retired CW4.

[Andrew Pease @andythevariable]

I think the really big takeaway from this is the abuse of a legitimate tool's plugin capability to execute💀scripts. Many hours of work over the weekend by @soolidsnakee @DanielStepanic and @SBousseaden.

[Elastic Security Labs @elasticseclabs]

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto.

The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault.

Full analysis: https://t.co/y7sGjClCKc

[Andrew Pease @andythevariable]

Analysis + hunts + rules by @RFGroenewoud @bryans3c

[Elastic Security Labs @elasticseclabs]

Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

You can still focus on detection coverage today.

Security Labs writeup (coverage + guidance): https://t.co/aBB6g7gCZ5

Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.

• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root

The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.

We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.

The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.

(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)

Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.

Guidance + every rule link below.

[Kostas @Kostastsale]

I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here:

https://t.co/fGAoNleFEW

You’re welcome.

[Andrew Pease @andythevariable]

@SolanaFloor Here’s a deep dive from @k33b0i and @DanielStepanic that walks through the implant, campaign, and detections and preventions.

[Elastic Security Labs @elasticseclabs]

We identified a malicious npm package, apexacc/cli, which led us to an operation posing as a Web3 accelerator.

Read more about REF8801 by @k33b0i and @DanielStepanic : https://t.co/QPBorc9VJg

The fake accelerator spent months courting crypto founders with free Claude and Gemini credits.

Our supply-chain monitor caught the package. It was malicious from its first published version.

The 2 Apex packages we examined, and what they deliver:
• apexacc/cli: redirects OpenRouter-labeled model requests to an attacker-controlled API
• apexacc/audit: MCP server whose 18 tools return fabricated findings
• macOS payload: CloudSyncD backdoor
• Windows payload: infostealer that exfiltrates to Telegram

We asked the operation's scoring tool to rate a project that doesn't exist. It scored 51 in every category, and said its AI scorer was down.

[Ayush Anand @Securityinbits]

There are plenty of ways to build a detection lab, but elastic-container is the fastest Elastic stack setup I know.

One script gives you:
- Elasticsearch + Kibana + Fleet
- Detection Engine on, prebuilt rules bulk-enabled by OS
- 100% containerized, one command up or down

Have Claude or Codex set it up for you. Credit: Andrew Pease (@andythevariable).

https://t.co/gVJntk9pt1

[The Hacker News @TheHackersNews]

🚨 KREMLIN banking malware bypasses Chromium integrity checks to install a Chrome and Edge extension that steals credentials and session tokens.

It also uses Ethereum smart contracts to rotate C2 and payload locations.

How the attack chain works: https://t.co/HJlK4rPf3u

[Andrew Pease @andythevariable]

RE work by @cyril_t_f uncovered a kill switch in the implant for an NX domain, so we registered it.

It was rewarding to see the implants checking in and then terminating - hopefully giving defenders detections and time to remediate.

[Elastic Security Labs @elasticseclabs]

KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users.

New research from Elastic Security Labs (REF9334): https://t.co/0QDgJEmYho by @cyril_t_f and @andythevariable

The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration.

KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction.

The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on.

Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP.

Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign.

The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

[Elastic Security Labs @elasticseclabs]

We reproduced the new Log4j 2 deserialization bug on official 2.26.1 JARs.

Getting to command execution took two things Log4j does not ship:
- A process still deserializing serialized LogEvent objects
- A gadget library already on that JVM

log4j-api and log4j-core alone were not enough.

So here is what to hunt for: Java accepting a network connection, followed by spawning a suspicious child process.

That is post-exploitation behaviour, not a signature of the bug itself.
Treat it as possible gadget execution and check the JVM.

ES|QL hunt queries and affected versions are in the post.

How the bypass works, which versions carry it, and what to hunt for by @RFGroenewoud and @bryans3c : https://t.co/3vgarDxeIa

[Elastic Security Labs @elasticseclabs]

We reverse engineered malware built to kill our own EDR.

In August 2026, eSentire documented a ClickFix campaign selling a DLL sideloader as a service.

It drops a malicious mscoree.dll next to a signed Microsoft binary, vb7to8.exe. Windows loads the planted copy first. Attacker code then runs inside a trusted process.

The kit also ships a vulnerable driver (BYOVD) to disable EDR, including Elastic Endpoint.

So we rebuilt it. A NativeAOT .NET 7 library, exports faked, a module initializer that fires on load.

We dropped it beside vb7to8.exe and ran it.

Elastic Defend 9.5.0 flagged the load as DLL Hijack: Masquerading.

Detecting this before 9.5.0 took ~88 lines and a list of ~2,600 library names. Now it's one line.

MITRE ATT&CK: T1574.001 (Hijack Execution Flow: DLL), T1036 (Masquerading).

Reverse engineering walkthrough, the .NET rebuild, and the detection breakdownby @0xfluxsec and @django88_: https://t.co/l1xdUTa7tN

Original campaign research by @eSentire.

[SolidSnake(Salim Bitam) @soolidsnakee]

Some #GoldenGh0st I have been tracking lately.

Cool stuff and very active
#campaign

[Elastic Security Labs @elasticseclabs]

A new Shai-Hulud campaign deployed a self-propagating worm across the npm supply chain.

Our supply chain monitor caught it yesterday, August 4th. The campaign targeted keyv: 600 million monthly downloads.

CHAINDROP activates on stolen npm tokens with write permissions, then backdoors every package the victim controls.

Over 400 npm packages compromised.

Full research and IOCs in the blog: https://t.co/ADYaOU6L0X

[Elastic Security Labs @elasticseclabs]

Elastic Security Labs is tracking Golden Gh0st RAT targeting Western companies, expanding beyond its previously documented targeting of financial organizations in the Asia-Pacific region.

Same TTPs as @ExpelSecurity CylindricalCanine research post: https://t.co/1HwpJUx1eY

The initial payload was delivered as a fake screenshot with a .pif extension, signed with a revoked certificate and hosted on myphotos[.]s[.]gy.

Follow-on payloads were staged in a public Google Cloud Storage bucket at storage[.]googleapis[.]com/nikeupdat/.

Multiple stages, and every one is either validly code-signed or never exists on disk as an executable.

Abused code-signing certificates, all valid at time of use.

Two are EV, same CA, both dated 2026-07, issued to two different "Private Organization" subjects:
- 杭州思维宇宙科技有限公司 (Hangzhou Siwei Yuzhou Technology), thumbprint: 14E0FCA3F0F656D1AF6EA66E1B2B7C6B4ACD8E2D
- Dongguan Jieshan Technology Co., Ltd, thumbprint: C29C3C494A348EA879ABFF50DD56B85E9CB6366A

IOCs:
api[.]probref[.]com:5188 (C2)
storage[.]googleapis[.]com/nikeupdat/
myphotos[.]s[.]gy
5ef6019fb6ee1db1201ee479a68669b47eb0d5d82770dbd30b05f46ccbc68f4f
b6cb6d5de2c62aa1351b1b240dc223c3d6fa95083cf43b2866d84a8a6c4d0446

[Andrew Pease @andythevariable]

@vxunderground @ClownYouAllDay This’ll calm ‘em down.

[Andrew Pease @andythevariable]

Lots of rule coverage and a rad interactive timeline by @jamesspi

https://t.co/pUKxa5bqvc

[Elastic Security Labs @elasticseclabs]

When the attacker is an autonomous agent, outcome detections beat process tree trust.

OpenAI's eval models escaped a research sandbox during ExploitGym testing. The agent exploited a package-registry zero-day, reached the open internet, and hit Hugging Face's dataset processing pipeline.

Hugging Face reconstructed 17,000+ events from the intrusion. The TTPs were conventional: dataset pipeline RCE, credential harvest, lateral movement, self-migrating C2. The speed and alert volume were not.

We mapped MITRE ATT&CK and ATLAS stages to production Elastic Defend and SIEM rules you can enable today.

Full campaign analysis on the blog: https://t.co/fVJfMhyZyC

[Mika Ayenson @stryker0x]

🤔GenAI CLIs and IDE agents are starting to look a lot like LOLBins on developer laptops.

I shipped LOL-GAI (Living Off Legitimate GenAI): open catalog of 123 tools with binaries, signing, artifacts, abuse recipes, MITRE, and a JSON/CSV API.

https://t.co/ZO1VIuspyF

[Elastic Security Labs @elasticseclabs]

7 trojanized repos targeting developers. Zero detections across every AV vendor.

Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings.

The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography.

Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start.

What deploys:
- Credential stealer targeting 25 crypto wallet extensions plus browser login data
- File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code
- Socket. IO RAT providing real-time interactive shell access
- Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2

Full analysis from Elastic Security Labs by @danielstepanic : https://t.co/EetHfm7lXu

[The Hacker News @TheHackersNews]

🚨 ClickFix now delivers TELEPUZ, a new modular Windows malware.

Paste the command behind a fake browser fix, and it can steal browser cookies, log keystrokes, capture screenshots, and run operator commands.

How the attack chain gets there: https://t.co/adZuix3rMA

[Andrew Pease @andythevariable]

So much good RE work, artifacts at multiple stages of the execution chain, and detailed analysis of the command framework - another stellar deep dive by @cyril_t_f

[Elastic Security Labs @elasticseclabs]

TELEPUZ is a new modular malware spreading via CLICKFIX-VIDAR chains. Elastic Security Labs is tracking it.

Active since late April 2026. The delivery path: ClickFix social engineering tricks users into running a PowerShell command that downloads a VIDAR Go variant, which then fetches a lightweight stager and the main TELEPUZ payload.

The core DLL communicates over WebSockets and pulls additional modules from C2 on demand:
Keylogger
Stealer
Web injector: intercepts browser sessions via CDP and WebDriver BiDi, with default configs targeting financial form fields like IBANs

36 commands. Indirect syscalls. AMSI and ETW patching. NTDLL unhooking. Multiple UAC bypasses.

Still in active development: the shellcode injection command returns a TODO placeholder.

C2 infrastructure is small (2 domains), but fallback methods include Telegram channels, Steam profiles, DNS records, and a Polygon smart contract that doubles as a kill switch.

New builds hit VirusTotal daily. The C2 footprint is small, but this thing is moving fast for something that started 2 months ago.

Full technical analysis: https://t.co/TTKETmNUwB

[SolidSnake(Salim Bitam) @soolidsnakee]

Ongoing #infostealer #campaign hitting devs. It's the "Contagious Interview" (DPRK style). Shows up as a coding test or job-interview repo. You run it, it beacons out, steals your whole environment, and opens a JS eval() backdoor. Been collecting #IOCs, sharing below 🧵

[sin @sinfulrawr]

I decided to look into GDID after this, and reading the court document gave some hints. After poking at some stuff I can confidently say I figured out majority of the system end to end. Check it out at https://t.co/z0AtBqH0qf

p.s yes Claude helped don't come yell at me AI haters

[Elastic Security Labs @elasticseclabs]

We tracked a new activity cluster targeting Mexican banking customers.

Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures.

The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit.

The toolkit gives operators a full fraud workflow from:
•Vishing overlay: lock the screen behind a fake bank warning
•Browser redirect: paste a phishing URL via automated keystrokes
•Clipboard swap: replace CLABE or card numbers mid-transfer
•Remote access: install Remote Utilities for hands-on takeover

Research by @k33b0i and @soolidsnakee.

Full analysis from Elastic Security Labs: https://t.co/a1mxxU6N1m