ARTEX servers observed on over 2,200 hosts, exceeding Cobalt Strike and all other C2 frameworks combined. New AI-generated C2 frameworks are already being used by threat actors, some not publicly detected.
Key points
More ARTEX servers than Cobalt Strike and all other C2 frameworks combined.
Almost 2,200 servers are running ARTEX with exposed default admin panels.
New/not publicly detected AI-generated C2 frameworks already in use.
Sources
TpDirectCallbackHijack: thread-pool callback PoC
TpDirectCallbackHijack is a process injection PoC that overwrites a function pointer in a thread pool object and dispatches shellcode via a single completion packet. The restore stub puts the pointer back, keeping the thread pool functional, and it uses no remote thread or Get/SetThreadContext.
Key points
Release: TpDirectCallbackHijack released as a process injection PoC.
Technique: overwrites one function pointer inside an existing thread pool object (TP_IO / TP_ALPC / TP_JOB) and posts a single completion packet to execute shellcode.
Sources
- Original post
- github.com - Linked in the post
Padre Terminal fake app linked to $23K Solana wallet theft
Padre Terminal, a fake crypto trading app previously on the Apple App Store, drained about $23,000 from 27 Solana wallets. The malicious app has been removed but the drainer remained active after removal.
Key points
Drained 27 Solana wallets since October 25, 2026, stealing approximately $23,000.
Converted 4,070 USDC tokens to SOL on October 29 and transferred 192 SOL to a new wallet.
Sources
Polymarket compromised, millions stolen in past hour
Polymarket was compromised by an unknown Threat Actor and millions of dollars were stolen in the past hour. The post also references a prior mock of Threat Actors for enumerating infrastructure and building targets.
Key points
Compromise: unknown Threat Actor compromised Polymarket.
Loss: millions of dollars stolen in the past hour.
Sources
Binance compromised, $3.5B stolen across chains
Binance compromised at approx. the same time as the Polymarket compromise, with theft estimates crossing into the billions. Total hacked is around $3.5B now across multiple chains.
Key points
Compromise occurred approx. same time as Polymarket compromise.
Total hacked is around $3.5B now across multiple chains.
Sources
GitLab vulnerability CVE-2026-97229 added to KEV Catalog
GitLab Community Edition & Enterprise Edition vulnerability CVE-2026-97229 was added to the KEV Catalog. Cisco Secure Firewall ASA Software and Cisco Secure FTD Software vulnerability CVE-2026-76418 was also added.
Key points
CVE-2026-97229 added to KEV Catalog
CVE-2026-76418 added to KEV Catalog
Sources
- Original post
- go.dhs.gov - Linked in the post
BloodHound v8.0 Innovation of the Year finalist 2026 SANS DMA
BloodHound v8.0 with OpenGraph is a finalist for Innovation of the Year (Open Source Product or Tool) in the 2026 SANS Institute Difference Makers Awards. Voting closes November 9.
Key points
BloodHound v8.0 with OpenGraph is a finalist for Innovation of the Year (Open Source Product or Tool) in the 2026 SANS Institute Difference Makers Awards.
Voting closes November 9.
Sources
- Original post
- ghst.ly - Linked in the post
Microsoft Authenticator passkey enrollment – new CA exclusion method
Microsoft Authenticator now supports passkey enrollment when Compliance or App Protection policies are required by excluding the Azure Credential Configuration Endpoint Service (appId ea890292-c8c8-4433-b5ea-b09d0668e1a6). The exclusion removes the need for the previously hacky workaround.
Key points
Excluding service principal ea890292-c8c8-4433-b5ea-b09d0668e1a6 allows passkey registration with app protection enforced.
Register the service principal in Graph (e.g., New-MgServicePrincipal –AppId ea890292-c8c8-4433-b5ea-b09d0668e1a6) before adding it to Conditional Access.
Sources
- Original post
- Improving passkey registration experiences - Linked page