MadHat Unspecific, InfoSec Mercenary

cybers thot lead. worshipped idle. dispenser of the obvious. awkward

[MadHat Unspecific, InfoSec Mercenary @unspecific]

I told my wife this was the manliest watermelon I have ever seen. I said it was sexy.

I need a vacation.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

https://t.co/wSyAWd2tTK

[𝔹obℂat🐈‍⬛of the family Qevax Binygvar 𝐴𝑃𝐿 ∛𝕏 @BobKitten]

@DFrissard62701 @MrAndyNgo @AnnCoulter https://t.co/UCDcfZUiZh

[MadHat Unspecific, InfoSec Mercenary @unspecific]

@HackingLZ Had worse.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Anyone ever run into a situation where the owner of a service tightened down the security settings, but only for the infosec staff?

“Infosec verified the right protections are in place, tested it themselves. “

[MadHat Unspecific, InfoSec Mercenary @unspecific]

@dansult @joff_thyer @HackingDave Allows one to focus more on the architecture than the deciding which library or function to use. Prototyping ideas instead of mocking up screenshots.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Date night with my beautiful wife.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

I realized today I have a favorite tweezer brand.

[Johnny Xmas @J0hnnyXm4s]

I made an agentic tool to poll SEC EDGAR for cyber-incident 8-Ks & auto-extract IOCs to JSONL/STIX. Supports TAXII pushes. Hint: 8-Ks never have IoCs because of the strict filing timelines. I built this to win an argument. Now you can. too!

https://t.co/wjN7RGW9q4

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Start of a 2 hour meeting.

Stomach says… you know how you have been constipated for the last few days, we feel bad, so we are going to release it all… right now.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Just remember. Everyone has to have the same experience and because you had a bad time, everyone had a bad time, even when they didn’t.

Some of you have amazing egos telling you that you have the only one true experience and everyone else is wrong.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Have we not learned that computers are not always right?

I mean they never were but come on.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

I am looking for a mid level AI specialist for my team in Mexico City. Also have a GRC analyst and SOC analyst.

The AI and automation specialist will help manage the internal AI platform and help teams set up automation.

Share if you know anyone.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

So a pen test?

[solst/ICE of Astarte @IceSolst]

Security budget unlocker service:

You Venmo me and give me credentials of a random employee, and I cause a relatively minor yet threatening incident that gets leadership to immediately approve the extra headcount you’ve been begging for

[MadHat Unspecific, InfoSec Mercenary @unspecific]

The whole industry is fucking up with AI. Making it way harder than it needs to be and putting more faith into marketing than technology.

“Oh look, it’s magic, so we have to do something different “

We always drop the ball at first.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

I missed the screenshot.

I was brainstorming research around self harm ideations with Claude. After it describes what we are discussing I get a popup just above the keyboard with I message about if you or someone else… hotlines and resources. I was not thinking, (X) keep typi

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Heading to NTXCSG to talk about AI and real risks.

I’ll post a summary.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Vendors stopped calling my phone as much. Guess because I don’t answer those calls.

Now they are texting me.

Thanks LinkedIn.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

The AI is not replacing the employee.

Stick to what the real issue is. Meta doing questionable shit.

Too bad most companies do it without the excuse to train AI.

This has nothing to really do with AI. The concern is employee monitoring.

[Official Layoff @LayoffAI]

LEAKED AUDIO FROM META ALL-HANDS AHEAD OF LAYOFFS TOMORROW

Mark Zuckerberg, in his own words, told Meta employees their devices are being tracked to train AI models.

His reasoning? Meta employees are smarter than the contract workers the rest of the industry uses for data labeling. So instead of hiring outside help, Meta is turning its own workforce into training data.

"The average intelligence of the people who are at this company is significantly higher than the average set of people that you can get to do tasks if you're working through these contractors."

He wants the AI to learn how "really smart people use computers" by watching employees work. He says the content is "stripped out" and none of it is used for surveillance or performance tracking.

Then he admitted the rollout was botched but said Meta intentionally kept employees in the dark because leaking competitive AI strategy would help rivals.

"It is not strategically in your interest for us to communicate everything in all the detail that we normally would on this."

Translation: We're watching you, we told you as little as possible, and we did it on purpose.

AI is replacing the contractor. Then the employee trains the AI. Then the AI replaces the employee.

This story and this company keeps getting weirder.