IFIN
@ifin-intel.org
The Independent Federated Intelligence Network. Our mission: Empower organizations to independently collect, analyze, and disseminate relevant cyber threat intelligence through training, open source tools, and a decentralized intelligence sharing network.
Get the look: shop.ifin-intel.org
The IFIN Store
The official store for IFIN. Support the organization with your purchase!
shop.ifin-intel.org
Ian Campbell@neurovagrant.bsky.social · 6h agoCoffeeing up for the day. If you see me, say hi. Repping the @ifin-intel.org tee that says “Threat intel is mutual aid” today because well, because threat intel is mutual aid. We’re an ecosystem of ecosystems, and the more sharing we do at our roots, the more our core and branches thrive.
Coffeeing up for the day. If you see me, say hi. Repping the @ifin-intel.org tee that says “Threat intel is mutual aid” today because well, because threat intel is mutual aid. We’re an ecosystem of ecosystems, and the more sharing we do at our roots, the more our core and branches thrive.
We're thrilled to announce IFIN has achieved 501(c)(3) recognition! Now we can get down to business. ifin-intel.org/blog/... #IFIN
It's Official: We're a Recognized Non-Profit | IFIN
IFIN has achieved 501(c)(3) status. What this means for us, and for you.
ifin-intel.org
Here's our coverage of the current ongoing keyv/cacheable NPM attack. We've included a list of known Ethereum RPC endpoints as indicators, since the malware looks up second stage data from that blockchain. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
Not-So-Mini Mini Shai-Hulud Attack Hits 400+ NPM Packages
Last Updated: 2026-08-04T18:28:08Z (UTC) What’s Happening Starting on the morning of 2026-08-04T07:00:00Z (UTC), multiple npm packages were impacted by a new worming package payload. The initial compromise of 11 packages appears to have wormed to at least 424, per Step Security. OpenSourceMalware and Socket are also covering the attack. Step provides differentiating context for this attack from prior ones: What sets this attack apart from the axios compromise of March 2026 is that ...
discourse.ifin.network
We're thrilled to announce IFIN has achieved 501(c)(3) recognition! Now we can get down to business. ifin-intel.org/blog/... #IFIN
It's Official: We're a Recognized Non-Profit | IFIN
IFIN has achieved 501(c)(3) status. What this means for us, and for you.
ifin-intel.org
Folks fighting for ad blockers in your orgs: ifin-intel.org/blog/ad-bloc...
Just Deploy the Ad Blocker | IFIN
Enterprises sometimes shy away from free tools without support contracts. An ad blocker browser extension should not be one of them.
ifin-intel.org
Zack Whittaker@zackwhittaker.com · yesterdayBy me at this.weekinsecurity.com: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.
While this should be read as an institutional failure on behalf of the US government for failing to protect critical infrastructure, hats off to the DEF CON Franklin volunteers. This is the exact spirit in which IFIN was founded.
How volunteer cyber experts are helping protect rural water systems
A first-in-the-nation program is seeing promising results as it charts a path for supporting the U.S.’s most vulnerable infrastructure.
cybersecuritydive.com
Happy Saturday! You might want to check if your Rails app needs a patch against this critical vuln.
CVE-2026-66066: KindaRails2Shell: RCE in Rails via Active Storage
Last Updated: 2026-08-01T19:50:50Z (UTC) CVSSv3: no cvss yet KindaRails2Shell Inspired by wp2shell, rails apps using ActiveStorage and default vips processor are vulnerable to Arbitrary File Read and Remote Code Execution via image upload from untrusted users. Kinda, because there are requirements, including very common configuration and default behaviors. No PoC from the research team or any technical details have been released yet, in order to give users time to patch. Versions Affected: ...
discourse.ifin.network
Sorry to disappoint, but there will be no IFIN Threat Actor Taxonomy. Here's why:
Why We Won't Release a Threat Actor Taxonomy | IFIN
Every intel vendor has their naming scheme. We won't play a pointless game.
ifin-intel.org
Sorry to disappoint, but there will be no IFIN Threat Actor Taxonomy. Here's why:
Why We Won't Release a Threat Actor Taxonomy | IFIN
Every intel vendor has their naming scheme. We won't play a pointless game.
ifin-intel.org
Good morning. We're observing an intensifying set of campaigns targeting credentials to facilitate data exfiltration and ransom. I've pulled some initial thoughts together over at @ifin-intel.org #threatintel #infosec #cybersecurity Cohesive writeup: discourse.ifin.network/t/newly-obse...
Newly-observed vishing/phishing campaign targeting retail/finance/fintech/more
On the threat intelligence side as well as the Very Concerned Customer side, seeing rising talk of an emergent campaign consistent with previous Com-related voice phishing. Domains include terms like ...
discourse.ifin.network
New packages are still being discovered with malicious payloads. Package adoption remains disabled.
IFIN@ifin-intel.org · 6d agoYet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
New AUR Attack Prompts Adoption Lock
Last Updated: 2026-07-30T19:59:19Z (UTC) What’s Happening A new round of Arch User Repository malware has prompted the disabling of package adoption. The first package with confirmed malware appears to be openconnect-sso. User ysf has performed initial analysis of the payloads. Stage 1: AUR validator.malware (stage 1) · GitHub Stage 2: AUR validator.malware (stage2 agent linux x86_64) · GitHub Interestingly, many of the behaviors (especially Tor exfil) look similar to the last campaig...
discourse.ifin.network
Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
New AUR Attack Prompts Adoption Lock
Last Updated: 2026-07-30T19:59:19Z (UTC) What’s Happening A new round of Arch User Repository malware has prompted the disabling of package adoption. The first package with confirmed malware appears to be openconnect-sso. User ysf has performed initial analysis of the payloads. Stage 1: AUR validator.malware (stage 1) · GitHub Stage 2: AUR validator.malware (stage2 agent linux x86_64) · GitHub Interestingly, many of the behaviors (especially Tor exfil) look similar to the last campaig...
discourse.ifin.network
We've compiled the latest information regarding the Minnesota water systems attacks. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
Minnesota water system suffers a breach due to exposed access keys
Last Updated: 2026-07-30T00:16:10Z (UTC) What’s Happening On July 27, 2026, threat actors exploited a known vulnerability on a Rockwell Automation device and disrupted water treatment facilities in four counties in Minnesota, US. This activity is consistent with prior activity with Iran-aligned actors under the guise of “CyberAv3ngers,” although no direct evidence has yet emerged tying this activity to that group or any other. Actions The CVE used for initial access is CVE-2021-22681. This ...
discourse.ifin.network
We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My!
Last Updated: 2026-07-29T21:28:50Z (UTC) What’s Happening Earlier this month, Microsoft reported on ACR Stealer, a new campaign leveraging both Steganography and Etherhiding techniques for delivery. Yesterday, I caught myself a sample. Mine doesn’t have Etherhiding, but the rest makes for a fun exploration anyhow. Let’s dive in. ▶ Recommended Musical Accompaniment Disclaimer: A LLM assisted with deobfuscation/decryption of later stages. Stage 1: Initial Access via ClickFix While the infect...
discourse.ifin.network
We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My!
Last Updated: 2026-07-29T21:28:50Z (UTC) What’s Happening Earlier this month, Microsoft reported on ACR Stealer, a new campaign leveraging both Steganography and Etherhiding techniques for delivery. Yesterday, I caught myself a sample. Mine doesn’t have Etherhiding, but the rest makes for a fun exploration anyhow. Let’s dive in. ▶ Recommended Musical Accompaniment Disclaimer: A LLM assisted with deobfuscation/decryption of later stages. Stage 1: Initial Access via ClickFix While the infect...
discourse.ifin.network
There are security patches available for Discourse so the forum will go down shortly for updates. Be back soon!
We continue to use our own RSS-Filter project to curate our feed aggregator. We've removed "Startups" from the other-wise excellent TechCrunch security news feed to keep the feed relevant and actionable. Our Newsfeed: news.ifin.network
Following up on a Fediverse tip, we found a new use for fake software download sites: the referral program hustle. Mirror FOSS, get cash. There are almost certainly more of these out there. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
PDF Arranger and TeraBox Referrals: Lamer Than Malware
Last Updated: 2026-07-24T18:46:25Z (UTC) What’s Happening PDF Arranger, a legitimate FOSS application, has picked up a fake download site at pdfarranger[.]net. We’ve seen instances before of fake installer sites. Usually the payload is directly observable. Not so in this case. In fact, the hashes for the downloaded files match what’s on GitHub. So what’s the catch? The linked downloads files are hosted on TeraBox, a “legitimate” Japan-based file hosting/sharing service that offers 1T...
discourse.ifin.network
Fantastic research by our community here on a continuing Lua-based campaign that uses Prometheus obfuscation and our old friend Etherhiding for C2 configuration acquisition. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
LuaJIT Loader Uses Prometheus Obfuscation and Etherhiding
Last Updated: 2026-07-23T17:18:49Z (UTC) What’s Happening I spent quite a bit of time investigating and reversing a malware sample I found in the wild. The initial malware sample, which I’ll explain in depth below, caught my attention because of the usage of a Lua obfuscator that I could not find a publicly available deobfuscator for. I am relatively new to malware reverse engineering and, with full disclosure, a lot of the work done here was with the assistance of AI. Late into the investig...
discourse.ifin.network
The critical SharePoint vulnerability CVE-2026-50522 now appears to be under massive exploitation. We have context and current IOCs in this post. We've also updated the MISP feed with the same. #ThreatIntel #ThreatIntelligence #IFIN
Microsoft SharePoint CVE-2026-50522
Last Updated: 2026-07-23T15:22:41Z (UTC) What’s Happening Microsoft SharePoint Remote Code Execution Vulnerability CVE-2026-50522 is actively exploited in the wild since 2026-07-17T00:00:00Z (UTC). This is an unauthenticated deserialisation vulnerability. A public proof-of-concept has been available since 2026-07-20T05:53:56Z (UTC). A patch is available since 2026-07-14T00:00:00Z (UTC) (Patch Tuesday). Actions Update Microsoft SharePoint to a patched version or limit external access until a...
discourse.ifin.network
With confirmed exploit sources, we've now added this one to our MISP feed. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
Microsoft SharePoint CVE-2026-50522
CTI from the raw TLP:CLEAR sources. Everything related to a time between 2026-07-19 and 2026-07-22. Indicator Indicator type Comments 45.63.58.216 ipv4-addr Exploit source IPv4. AS20473 Vultr 103.114.161.6 ipv4-addr Exploit source IPv4. AS142036 Hosteons Pte. Ltd. 146.19.216.119 ipv4-addr Exploit source IPv4. AS134677 Dromatics Systems Pte Ltd. 77.110.123.40 ipv4-addr Exploit source IPv4 and callback IPv4. AS203273 NetCrafters OU 149.102.254.84 ipv4-addr Exploit source IPv4. AS2...
discourse.ifin.network
If you pirate games, you should expect malware. That's a tale as old as 1970-01-01T00:00:00.000Z. But using Etherhiding as the second stage source? Well that's slightly newer. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
Pirated Games Come with a Side of Amatera Stealer
Last Updated: 2026-07-20T16:00:07Z (UTC) What’s Happening Malwarebytes is reporting on a new infostealer campaign using pirated games (shocker) as a watering hole. What’s notable about this campaign is the continued use of Etherhiding for second-stage loading. We’re going to be talking a lot about Etherhiding in the next couple of weeks. Some other fun malware analysis in the post as well for those interested. Actions Don’t pirate games! Don’t let your employees pirate games! Pro tip: if y...
discourse.ifin.network
If you pirate games, you should expect malware. That's a tale as old as 1970-01-01T00:00:00.000Z. But using Etherhiding as the second stage source? Well that's slightly newer. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN
Pirated Games Come with a Side of Amatera Stealer
Last Updated: 2026-07-20T16:00:07Z (UTC) What’s Happening Malwarebytes is reporting on a new infostealer campaign using pirated games (shocker) as a watering hole. What’s notable about this campaign is the continued use of Etherhiding for second-stage loading. We’re going to be talking a lot about Etherhiding in the next couple of weeks. Some other fun malware analysis in the post as well for those interested. Actions Don’t pirate games! Don’t let your employees pirate games! Pro tip: if y...
discourse.ifin.network
This has been confirmed exploited in the wild. Updated with IoCS.
IFIN@ifin-intel.org · 3w agoApparently (?) there's a Pre-Auth RCE (!) in core WordPress (?!), but there are extremely few details as yet. If it's as gnarly as it sounds, a lot of sites are going to have a very bad time. We'll keep this story updated as details emerge.
Apparently (?) there's a Pre-Auth RCE (!) in core WordPress (?!), but there are extremely few details as yet. If it's as gnarly as it sounds, a lot of sites are going to have a very bad time. We'll keep this story updated as details emerge.
WP2Shell: Pre-Auth RCE in WordPress (No CVE)
CVSSv3: N/A This is mostly a placeholder as the hype site has no details. But the claim is: Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core. The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins. Affected Versions Version Status < 6.9.0 not affected 6.9.0 - 6.9.4 affected, fixed in 6.9.5 7.0.0 - 7.0.1 affected, fixed in 7.0.2 Actions Update to the fixe...
discourse.ifin.network
UPDATE: We've tracked this down to Copilot Chat's "Enable AI Feature" setting.
IFIN@ifin-intel.org · 3w agoCursor will run anything called git.exe when you open it, but it isn't the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.
Cursor will run anything called git.exe when you open it, but it isn't the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.
Remember that Cursor git.exe bug? It's in VSCode too
CVSSv3: 7.5 The Cursor Bug is in VSCode Earlier this week, a potential vulnerability was discovered in Cursor, the AI-enabled development platform that is a fork of VSCode. This vulnerability is a file called get.exe in the root of a repo or any project folder will be automatically executed without user interaction. That was viewed as a potential flaw in the software, but apparently Cursor was told about it in December and has really had no response at all to it. Fast forward to today, when I...
discourse.ifin.network
Cursor will run anything called git.exe when you open it, but it isn't the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.
Remember that Cursor git.exe bug? It's in VSCode too
CVSSv3: 7.5 The Cursor Bug is in VSCode Earlier this week, a potential vulnerability was discovered in Cursor, the AI-enabled development platform that is a fork of VSCode. This vulnerability is a file called get.exe in the root of a repo or any project folder will be automatically executed without user interaction. That was viewed as a potential flaw in the software, but apparently Cursor was told about it in December and has really had no response at all to it. Fast forward to today, when I...
discourse.ifin.network