IFIN - The Independent Federated Intelligence Network

The Independent Federated Intelligence Network.

IFIN is a 501(c)(3) not-for-profit public benefit corporation incorporated in California.

Our mission: Empower organizations to independently collect, analyze, and disseminate relevant cyber threat intelligence through training, open source tools, and a decentralized intelligence sharing network.

Public Key

npub16rex2q22km8zhpqu985vak5ahsztghj8delsmsdu6saff95nca5sh8mzyl

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsdpun9q99tdn3tsswzn6xwm2wmcp95terkulcdcx7dgw55j6fuw6gpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qxnv72x

Publishing to

relay.ditto.pub

Author Public Key

npub16rex2q22km8zhpqu985vak5ahsztghj8delsmsdu6saff95nca5sh8mzyl

Show more details

Last Notes

2026-11-10 16:29:57 GMT

The recent Siemens Node-RED issue got us wondering; how many insecure Node-RED instances are there, and what happens to them?
In this original research, we examine the bustling malware landing zone that is Node-RED.
https://ifin.network/t/ifin-special-report-what-happens-to-an-open-node-red-instance/973

2026-11-05 20:49:24 GMT

How do you pronounce an asterisk? We're saying "Shh" for longer. Like "Shhhole."
This no-CVE-yet vulnerability impacts unpatched musl builds of OpenSSH, including Alpine Linux. But there are a lot of required conditions for exploitation.
https://ifin.network/t/sshole-ssh-auth-bypass-in-musl-based-linux-distros/965
#ThreatIntel #ThreatIntelligence

2026-11-04 21:20:45 GMT

Sigh
This is a silly CVE. The Siemens devices shipped Node-RED without authentication, which is Node-RED's default state. It even says so in the docs and tells you to set it up.
Anyway apparently folks are attacking this now.
https://ifin.network/t/cve-2026-58115-no-authentication-on-siemens-simatic-iot2050-node-red/964
#ThreatInte #ThreatIntelligence

2026-11-03 19:57:15 GMT

Think eMudhra was handled when you updated your browsers? Think again.
https://ifin-intel.org/blog/emudhra/
#ThreatIntel #ThreatIntelligence

2026-11-03 02:25:07 GMT

Check out our very own @nprofile…vhtf's talk about building and maintaining community lists!
#ThreatIntelIsMutualAid
#nevent1q…yfnw

2026-11-02 19:17:04 GMT

Your periodic reminder that blocking api.telegram[.]org in your network is a defensive W so huge it needs a pilot car and police escorts.

2026-11-02 14:45:19 GMT

In case you missed it over the weekend, this vulnerability is still being addressed. More patches are now available for RHEL and Rocky Linux.
#nevent1q…7cxj

2026-11-01 02:08:22 GMT

We're hearing reports of insecure private keys in trick-or-treat candy. While these are unconfirmed, we recommend brute-forcing your kids' candy for at least integers 0-255. This may require sampling the candy yourself. For security.

2026-10-31 05:54:03 GMT

Patching is taking some time on this potentially serious Linux kernel vulnerability. While we wait, we have a rundown of the partial mitigations for the known attack path.
https://ifin.network/t/cve-2026-98432-unexpected-ipv4-options-lead-to-use-after-free-code-execution-in-linux/946
#ThreatIntel #ThreatIntelligence

2026-10-30 12:54:47 GMT

For 11 hours yesterday, the Cursor Marketplace hosted a malicious version of the Claude Code extension. Up to 5000 users may have been impacted. Details, observables, and remediation steps here:
https://ifin.network/t/anthropic-vs-code-extensions-compromised/943
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-29 19:13:10 GMT

We have now seen enough evidence to say that the Brotli decoder vulnerabilities affecting NodeJS and other platforms has kindasortamaybesometimes been exploited in the wild. At the very least, it should be treated as such.
https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929
#ThreatIntel

2026-10-28 19:29:57 GMT

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
#ThreatIntel

2026-10-27 22:59:34 GMT

Do you use mutual TLS with your network appliances? You might want to check whether they use a vulnerable version of the GoAhead web server, which has some significant weaknesses in its client certificate verification.
https://ifin.network/t/goahead-tls-vulnerabilities-break-certificate-validation-session-encryption/934
#ThreatIntel #IFIN

2026-10-27 20:05:51 GMT

CISA has added the Brotli vulnerability to the KEV list. While evidence of successful exploitation outside labs is scarce, we have detection opportunities in our thread.
https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929
#ThreatIntel

2026-10-27 16:48:24 GMT

Wanna know more about IFIN? Executive Director @nprofile…44dh was just at JawnCon to explain how we started and what we're about.
https://www.youtube.com/live/CK-7M5YDf_Y?t=21524s
#ThreatIntelIsMutualAid

2026-10-27 06:57:50 GMT

When IFIN started, we used a legacy server hosted with Digital Ocean for reverse proxy services. Their recent choices to support fascist-adjacent tech and cease supporting open source projects have made that relationship untenable for us. As of tonight, IFIN infrastructure has moved entirely off DO.

2026-10-26 18:16:47 GMT

While everyone (including us) was losing their heads about PHP and Brotli, our community was tracking a widespread WhatsApp Phishing campaign in Europe. Domains and TTPs in this excellent thread.
https://ifin.network/t/whatsapp-ghostpairing-attacks-in-europe-using-the-wa-fisher-phishing-kit/924
#ThreatIntel #IFIN

2026-10-24 14:01:22 GMT

We've updated this story to reflect the wider impact of the vulnerable Google Brotli library, Action is likely necessary.
#nevent1q…t8gq

2026-10-23 19:10:12 GMT

Hey, has IFIN been valuable to you this week? We sure would appreciate some support of the mission. We're a registered nonprofit and rely on community support to keep the lights on!
https://ifin-intel.org/support
#ThreaIntelIsMutualAid

2026-10-23 18:31:51 GMT

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.
https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929
#ThreatIntel

2026-10-22 19:53:22 GMT

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
#ThreatIntel

2026-10-22 17:24:56 GMT

We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.

2026-10-22 06:02:54 GMT

After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.
Our standard for "exploited in the wild" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.

2026-10-21 23:35:04 GMT

If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today.
https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-21 20:56:46 GMT

While you were patching PHP, LiteLLM went and get compromised again.
https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-21 17:03:41 GMT

We now have sufficient confirmation to call these exploited in the wild.
#nevent1q…t0f4

2026-10-21 14:11:10 GMT

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

2026-10-21 13:05:56 GMT

If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed.
#ThreatIntelIsMutualAid #TIIMA

2026-10-20 20:34:19 GMT

We are aware of the upcoming critical vulnerability disclosures in PHP. Watch this post for updates as they are available.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-20 15:02:32 GMT

Eight intermediate certificates used by eMudhra/Emsign have been compromised. These certificates are in multiple trust stores. This will require significant manual action to remediate, including the updates of several packages.
https://ifin.network/t/emudhra-intermediate-certificates-compromised/909
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-17 16:40:38 GMT

Microsoft 365 tenants have been compromised via a stolen ConnectWise Cloud Backup credential. We have the details and investigation steps you need if you use this application in your environment.
https://ifin.network/t/unauthorized-access-in-connectwise-cloud-backup/906
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-14 20:58:58 GMT

If your Palo Alto management interface is internet-exposed, you might notice even more traffic on it today. But if that was your security posture, maybe you're fine with that.
Anyway this is exploited in the wild. Authenticated, so creds required.
https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-14 20:40:23 GMT

tap tap
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/441/195/119/366/921/original/fce4287d6cf1d0e5.png

2026-10-13 16:15:54 GMT

An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity.
https://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-13 15:32:12 GMT

Let's reset expectations about sharing information. When defensive action is possible, more sharing means more safety for all of us.
https://ifin-intel.org/blog/tlp-clear/

2026-10-10 00:16:58 GMT

IFIN will be submitting commentary in strong opposition to the obviously dangerous requested TLDs in the latest round of applications to ICANN. Anything that is approved and still dangerous will be added to the IFIN Lists for easy blocking.
We encourage others to submit commentary before November 17.
https://www.icann.org/en/announcements/details/icann-reveals-2026-round-applications-for-new-generic-top-level-domains-07-10-2026-en

2026-10-09 15:10:04 GMT

Once again:
Evidence of exploitation attempts
Is not
Evidence of exploitation
That's a much higher bar to clear.

2026-10-08 21:09:58 GMT

I'm tired, boss.
A new #Citrix CVE affecting SAML IdP/SP-configured devices is out.
https://ifin.network/t/cve-2026-107406-somehow-another-citrix-netscaler-saml-vulnerability/891
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-08 16:12:54 GMT

The Shai-Hulud style attack on tensorlake has a nasty trick up its sleeve: try to cycle the stolen token, and it'll blow away your home folder, if you're not careful.
https://ifin.network/t/tensorlake-supply-chain-attack-comes-with-booby-trap/890
#ThreatIntel #ThreatIntelligence #IFIN

2026-10-06 17:26:05 GMT

Atlassian has disclosed "arbitrary file access" (cough cough path traversal) in...basically everything. Patches available, but so now is a broad proof-of-concept. Not yet known-exploited, emphasis on "yet."
https://ifin.network/t/cve-2026-21589-arbitrary-file-access-in-multiple-atlassian-products/885
#IFIN #ThreatIntel #ThreatIntelligence

2026-10-04 04:37:20 GMT

This is the patch that never ends
It goes on and on my friends
Some people
Started applying it
Not knowing what it was
And they will keep applying it
Forever just because
(CVE-2026-88779 advisory and patch included now)
https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867
#Citrix #Netscaler #ThreatIntel #ThreatIntelligence

2026-10-02 19:42:54 GMT

Sigh
The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.
https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867
#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN

2026-09-30 18:29:01 GMT

Well would you look at that; it's Cisco 0-day o'clock again.
https://ifin.network/t/cve-2026-76504-cisco-sd-wan-auth-bypass-actively-exploited/874
#ThreatIntel #ThreatIntelligence #IFIN

2026-09-29 15:32:12 GMT

If you're involved in vulnerability management/VulnOps, the last several months have been overwhelming. But take heart: there is a path forward, despite the madness surrounding us.
https://ifin-intel.org/blog/vuln-flood/

2026-09-29 15:21:13 GMT

We've been continuously updating this post with the latest information—now including details on exploitation of CVE-2026-88772. And all relevant indicators have been added to our MISP feed.
https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867
#ThreatIntel #ThreatIntelligence #IFIN

2026-09-26 23:40:59 GMT

We are tracking the story about undisclosed 0-days in Citrix Netscaler devices. We have confirmation from multiple source now about the veracity of the claims, although few details from Citrix themselves. This is a developing story.
https://ifin.network/t/citrix-advises-shutdown-due-to-new-undisclosed-netscaler-0-days/867
#ThreatIntel #ThreatIntelligence #IFIN

2026-09-23 21:42:36 GMT

The best time to block the finger protocol (port 79/tcp) outbound from your network was like…the second Clinton administration? But now's a good time too.
#ThreatIntel #ThreatIntelligence #IFIN

2026-09-23 16:03:06 GMT

A format string vulnerability in Shrubbery's TACACS+ library (and Facebook's archived fork of it) can lead to secret disclosure, DoS, and potentially remote code execution. No, Cisco gear isn't affected, but many other devices will be.
As of now, no CVE has been assigned.
https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859

2026-09-22 22:28:10 GMT

Completing our tour of new known-exploited vulns today, here is Arista's perfect-10.
https://ifin.network/t/arista-cve-2026-93952-auth-bypass-exploited-in-the-wild/856
#ThreatIntel #ThreatIntelligence #IFIN

2026-09-22 20:51:00 GMT

When it rains, it pours. F5 BIG-IP APM also has an exploited CVE!
https://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855
#ThreatIntel #ThreatIntelligence #IFIN

2026-09-22 19:56:52 GMT

Two Check Point critical vulnerabilities are now listed as exploited in the wild.
https://ifin.network/t/cve-2026-85102-and-93616-check-point-security-gateway-rce-path-traversal-exploited/853
#ThreatIntel #ThreatIntelligence #IFIN

2026-08-28 18:53:15 GMT

We've updated this post with more patches from PaperCut and reports from Huntress.
#nevent1q…h80p

2026-08-25 15:04:46 GMT

IFIN has an ambitious set of goals for our first year. Learn about the plan and how you can help us succeed.
https://ifin-intel.org/blog/action-plan/
#IFIN #ThreatIntel #ThreatIntelligence #TIIMA

2026-08-24 20:16:54 GMT

We have the details on the recent MacSync infostealer malware family.
https://discourse.ifin.network/t/macsync-infostealer-infrastructure-and-ttps/781
#ThreatIntel #ThreatIntelligence #IFIN

2026-08-24 15:20:41 GMT

Expel's recent discovery of SynkLoader combined lots of fun behaviors into a single malware sample. There are a couple strong detection opportunities worth reviewing.
https://discourse.ifin.network/t/synkloader-windows-loader-malware-brings-its-own-python-and-lock-screen/780
#IFIN #ThreatIntel #ThreatIntelligence

2026-08-22 15:15:13 GMT

We have a breakdown of recent Citrix vulnerabilities for you. Again. Not a series we wanted to make, but here we are.
https://discourse.ifin.network/t/recent-citrix-netscaler-vulnerability-roundup-2026-08-22/772

2026-08-20 16:36:40 GMT

Rust joins the supply chain party with a set of compromised packages and account takeovers/impersonations today.
https://discourse.ifin.network/t/rust-supply-chain-attack-arrayref-internment-and-append-only-vec-poisoned-by-proc-macro2-typosquat/765
#ThreatIntel #ThreatIntelligence #IFIN #RustLang

2026-08-18 12:08:25 GMT

Iranian-backed "313 Team" (a front for MOIS operations) has claimed credit for both GitHub and Bluesky DDoS attacks yestderday.
https://discourse.ifin.network/t/iranian-backed-313-team-claims-github-bluesky-ddos-attacks/756

2026-08-14 18:04:55 GMT

We have received reports that this VMWare vulnerability is currently exploited in the wild. Our MISP feed has the existing indicators, including the YARA rule for dropped artifacts.
https://discourse.ifin.network/t/cve-2026-59309-critical-auth-bypass-in-broadcom-vmware-vcenter/746
#ThreatIntel #ThreatIntelligence #IFIN

2026-08-08 13:45:38 GMT

You mean there's another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.
If you aren't already on 7.0.3, please patch ASAP. Also, consider limiting login page access.
https://discourse.ifin.network/t/cve-2026-64638-xss2shell-does-what-it-says-patch-wordpress-now/729
#CVE #IFIN #ThreatIntel #ThreatIntelligence

2026-08-05 13:16:41 GMT

Get the look:
https://shop.ifin-intel.org
#nevent1q…akqt

2026-08-04 18:32:11 GMT

Here's our coverage of the current ongoing keyv/cacheable NPM attack. We've included a list of known Ethereum RPC endpoints as indicators, since the malware looks up second stage data from that blockchain. Not sure why nobody else will say so, but these should be considered malicious.
https://discourse.ifin.network/t/not-so-mini-mini-shai-hulud-attack-hits-400-npm-packages/718
#ThreatIntel #ThreatIntelligence #IFIN

2026-08-04 15:10:12 GMT

We're thrilled to announce IFIN has achieved 501(c)(3) recognition! Now we can get down to business.
https://ifin-intel.org/blog/nonprofit/
#IFIN

2026-08-04 13:19:32 GMT

Folks fighting for ad blockers in your orgs: https://ifin-intel.org/blog/ad-blocker/
#nevent1q…sj5p

2026-08-01 20:10:08 GMT

Happy Saturday! You might want to check if your Rails app needs a patch against this critical vuln.
https://discourse.ifin.network/t/cve-2026-66066-kindarails2shell-rce-in-rails-via-active-storage/705

2026-07-31 17:52:57 GMT

Sorry to disappoint, but there will be no IFIN Threat Actor Taxonomy. Here's why:
https://ifin-intel.org/blog/attribution/

2026-07-31 12:55:27 GMT

New packages are still being discovered with malicious payloads. Package adoption remains disabled.
#nevent1q…lvy2

2026-07-30 20:03:45 GMT

Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples.
https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-30 16:05:14 GMT

We've compiled the latest information regarding the Minnesota water systems attacks.
https://discourse.ifin.network/t/minnesota-water-system-suffers-a-breach-due-to-exposed-access-keys/695
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-29 21:58:35 GMT

We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer.
https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-27 16:59:51 GMT

We continue to use our own RSS-Filter project to curate our feed aggregator. We've removed "Startups" from the other-wise excellent TechCrunch security news feed to keep the feed relevant and actionable.
Our Newsfeed: https://news.ifin.network
RSS-Filter: https://codeberg.org/ifin/rss-filter

2026-07-24 19:18:52 GMT

- reply

This is what we're here for! If you see something suspicious and want someone else to check it out, drop us a tip! We take care of each other by sharing what we see.

2026-07-24 19:08:37 GMT

Following up on a Fediverse tip, we found a new use for fake software download sites: the referral program hustle. Mirror FOSS, get cash.
There are almost certainly more of these out there.
https://discourse.ifin.network/t/pdf-arranger-and-terabox-referrals-lamer-than-malware/683
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-23 17:30:28 GMT

Fantastic research by our community here on a continuing Lua-based campaign that uses Prometheus obfuscation and our old friend Etherhiding for C2 configuration acquisition.
https://discourse.ifin.network/t/luajit-loader-uses-prometheus-obfuscation-and-etherhiding/679
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-23 15:24:49 GMT

The critical SharePoint vulnerability CVE-2026-50522 now appears to be under massive exploitation. We have context and current IOCs in this post. We've also updated the MISP feed with the same.
#ThreatIntel #ThreatIntelligence #IFIN
https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678

2026-07-22 20:55:12 GMT

With confirmed exploit sources, we've now added this one to our MISP feed.
https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678/2
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-20 16:16:35 GMT

If you pirate games, you should expect malware. That's a tale as old as 1970-01-01T00:00:00.000Z. But using Etherhiding as the second stage source? Well that's slightly newer.
In case you couldn't tell, we're declaring war on #Etherhiding. More to come.
https://discourse.ifin.network/t/pirated-games-come-with-a-side-of-amatera-stealer/675
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-18 15:21:50 GMT

This has been confirmed exploited in the wild. Updated with IoCS.
#nevent1q…ah3u

2026-07-18 12:56:31 GMT

Apparently (?) there's a Pre-Auth RCE (!) in core WordPress (?!), but there are extremely few details as yet.
If it's as gnarly as it sounds, a lot of sites are going to have a very bad time. We'll keep this story updated as details emerge.
https://discourse.ifin.network/t/wp2shell-pre-auth-rce-in-wordpress-no-cve/672

2026-07-15 20:20:47 GMT

Cursor will run anything called git.exe when you open it, but it isn't the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.
https://discourse.ifin.network/t/remember-that-cursor-git-exe-bug-its-in-vscode-too/665

2026-07-14 22:34:28 GMT

The latest supply chain attack has some novelty, but the techniques should have long been mitigated in your network. IPFS, cryptocurrency, and Nostr have no place in a professional network.
https://discourse.ifin.network/t/latest-miasma-attack-uses-blockchain-garbage-you-should-have-already-blocked/663
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-12 13:07:29 GMT

Are you using jscrambler to obfuscate your JS code?
Forget scrambling—depending on version, you might be cooked a different way.
https://discourse.ifin.network/t/popular-js-obfuscator-jscrambler-compromised/657
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-09 20:05:46 GMT

We need to talk about AWS S3 abuse and anti-patterns. Loose association between brands and buckets leads to easy prey for spoofers and squatters.
https://ifin-intel.org/blog/s3-anti-pattern/

2026-07-08 15:43:42 GMT

Terry Pratchett said: "If you show a clown a ladder and bucket of water, he only knows one way to act."
The same applies to LLMs and secrets in CI/CD pipelines.
https://discourse.ifin.network/t/gitlost-prompt-injection-in-github-agentic-workflows/647

2026-07-07 18:30:29 GMT

Soooo Tenda devices have an admin backdoor. Potential redeployment locations: a wood chipper, the nearest active volcano, or that really annoying neighbor's house.
No patch; have fun!
https://discourse.ifin.network/t/cve-2026-13753-multiple-tenda-routers-have-an-admin-backdoor/646

2026-07-06 16:14:45 GMT

Device Code authorization in OAuth 2.0 was intended for input-constrained devices like Smart TVs. It probably shouldn't be used for anything else, especially since attackers are using it effectively for phishing.
https://discourse.ifin.network/t/the-dangers-of-device-code-flow/642
#ThreatIntel #ThreatIntelligence #IFIN

2026-07-02 19:24:44 GMT

We're shocked, shocked I say that Claude Cowork is vulnerable to DLL sideloading.
Well, not that shocked.
https://discourse.ifin.network/t/claude-cowork-for-windows-vulnerable-to-dll-sideloading-closed-as-wont-fix/640

2026-07-01 16:14:25 GMT

An IFIN community member caught this #ClickFix campaign, followed it, reversed the payload, and brought the IOCs. This is the juice right here. A perfect example that #ThreatIntelIsMutualAid
https://discourse.ifin.network/t/compromised-website-hosting-clickfix-payload-leads-to-netsupport-rat-infection/633
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-30 18:50:28 GMT

If you're running a SimpleHelp server, it's patch-o'clock. Also maybe incident-response-o'clock.
(It's always incident-response-o'clock somewhere)
https://discourse.ifin.network/t/stealers-exploit-cve-2026-in-simplehelp-attack/629
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-29 17:15:11 GMT

Maaaaybe just block the whole dot garden top-level domain.
https://discourse.ifin.network/t/garden-tlds-change-to-a-bad-neighborhood/627
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-26 19:16:40 GMT

If you're running Lantronix gear on the internet, you might want to check your logs for suspicious logins and command execution.
https://discourse.ifin.network/t/lantronix-openwrt-luci-attacks/625
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-24 18:55:16 GMT

Another Mini Shai-Hulud-like attack. Again using Bun, but this one also installs persistence to AI coding assistant configs.
If you're not a JS dev shop, maybe block Bun? The attackers will move on, but for now it's a favorite.
https://discourse.ifin.network/t/mini-shai-hulud-hits-codfish-semantic-release/620
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-24 13:02:54 GMT

We're excited to introduce IFIN's first open source project! RSS-Filter solves a problem we suspect is common: our RSS feeds were full of noise. Sponcon, unrelated stories, etc. While some services exist to filter feeds by title, we had none that could filter by category or other criteria. RSS-Filter fixes that.
https://codeberg.org/ifin/rss-filter
This tool allows you to configure a set of feed sources and filter rules. It will produce filtered feeds that can be hosted by any web server, or simply consumed as local files.
We're using RSS-Filter today to get sponcon out of BleepingComputer and a few other feeds. We hope you find it useful!

2026-06-22 19:02:16 GMT

A thousand blessings upon Dirk-Jan and Fabian for this post about CAP bypasses in Entra, and the EntraScopes lookup tool.
https://discourse.ifin.network/t/entra-patched-cap-bypasses-but-you-might-have-to-opt-in/612

2026-06-20 13:22:51 GMT

Let's talk about ClickFix.
https://discourse.ifin.network/t/lets-talk-about-clickfix/603/1

2026-06-19 22:10:13 GMT

We've updated our post with the latest information from CloudSek and, of course, @nprofile…g4vn.
#nevent1q…evy9

2026-06-18 16:54:53 GMT

Trusted sites are favorites for the baddies as command-and-control and exfiltration destinations, because they think you can't block them or observe them. That's exactly what this attack expects.
But not all "trusted" sites should be, and there are ways to monitor traffic to confound the adversary.
https://discourse.ifin.network/t/ai-lures-in-malvertising-utilizing-lots-and-share-urls-to-deliver-clickfix-attacks/600
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-17 21:26:55 GMT

Etherhiding is so hot right now. When your malware sample contains blockchain artifacts, learn how to pivot on them and get all the indicators from the campaign.
https://ifin-intel.org/blog/etherhiding/

2026-06-17 13:29:10 GMT

Fortinet customers: please take note of this massive breach of SSL VPN credentials. The scale of attacker infrastructure and list of impacted organizations commands attention.
https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597
#ThreatIntel #ThreatIntelligence #IFIN

2026-06-16 20:22:27 GMT

This report from GTIG is worth a moment's consideration. Research institutions with public-facing assets should take this opportunity to harden their external posture.
https://discourse.ifin.network/t/google-china-based-espionage-targeting-redcap-servers/595
#ThreatInte #ThreatIntelligence #IFIN