--- title: "#threat-intelligence articles | Hashnode" description: "Explore 1,264 articles tagged #threat-intelligence on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/threat-intelligence" --- Tag # #threat-intelligence 1,264 posts · 35 followers [404 Founders](https://hashnode.com/@404-founders) · [6h ago](https://hashnode.com/posts/key-eater-stolen-entra-id-app-credentials-msp/6af7564379e43bb57322eff5) ### [Key Eater: Stolen Entra ID App Credentials Walk Into MSP Clients](https://404-founders.com/blog/key-eater-stolen-entra-id-app-credentials-msp?utm_source=hashnode&utm_medium=feed) One operator, about 45 stolen app secrets, 27 organizations reached, and a Conditional Access block that does not cover multi-tenant apps 14 min read · [404-founders.com](https://404-founders.com/blog/key-eater-stolen-entra-id-app-credentials-msp?utm_source=hashnode&utm_medium=feed) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [1d ago](https://hashnode.com/posts/claude-code-extension-cursor-ssh-backdoor-en/6af521707f684f460a365300) ### [A verified publisher name, 11 hours of distribution, and one SSH key that stays behind: the fake Claude Code extension on Cursor Marketplace](https://blog.fiscybersec.com/claude-code-extension-cursor-ssh-backdoor-en?utm_source=hashnode&utm_medium=feed) Summary On October 29, 2026, two versions of the Anthropic.claude-code extension — 2.1.312 and 2.1.313 — appeared on the Cursor VS Code Extension Marketplace with malicious code injected. The distribu 13 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/claude-code-extension-cursor-ssh-backdoor-en?utm_source=hashnode&utm_medium=feed) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [1d ago](https://hashnode.com/posts/magecart-campaign-15-months-and-953-victims-a-valuable-lesson-about-the-reinfection-loop-in-retail-security/6af5211188ec53c60be457da) ### [Magecart campaign 15 months and 953 victims: A valuable lesson about the "reinfection loop" in retail security](https://blog.fiscybersec.com/magecart-campaign-15-months-and-953-victims-a-valuable-lesson-about-the-reinfection-loop-in-retail-security?utm_source=hashnode&utm_medium=feed) Campaign Summary At least 953 online stores globally - most operating on the Magento and Adobe Commerce platforms - have been infiltrated in a large-scale e-skimming/Magecart campaign operating contin 18 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/magecart-campaign-15-months-and-953-victims-a-valuable-lesson-about-the-reinfection-loop-in-retail-security?utm_source=hashnode&utm_medium=feed) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [1d ago](https://hashnode.com/posts/loadmine-huggingface-trust-remote-code-gpu-miner-en/6af5216088ec53c60be536ad) ### [A 42-byte weight file, 32,000 downloads, and a GPU cluster mining for someone else: the Load/Mine campaign on Hugging Face](https://blog.fiscybersec.com/loadmine-huggingface-trust-remote-code-gpu-miner-en?utm_source=hashnode&utm_medium=feed) Summary On October 29, 2026, Pluto Security published the Load/Mine campaign: 31 malicious model repositories across 7 Hugging Face accounts, totaling more than 32,000 downloads, installing a cryptomi 15 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/loadmine-huggingface-trust-remote-code-gpu-miner-en?utm_source=hashnode&utm_medium=feed) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [1d ago](https://hashnode.com/posts/hiding-behind-the-cover-of-openai-and-windows-update-netamloader-s-sophisticated-cyber-espionage-campaign/6af5215488ec53c60be5174f) ### [Hiding behind the cover of OpenAI and Windows Update: NetamLoader's sophisticated cyber espionage campaign](https://blog.fiscybersec.com/hiding-behind-the-cover-of-openai-and-windows-update-netamloader-s-sophisticated-cyber-espionage-campaign?utm_source=hashnode&utm_medium=feed) Campaign Summary In the first half of 2026, Kaspersky GReAT's global cybersecurity research team discovered a sophisticated cyber espionage campaign using an unprecedented malicious framework called N 22 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/hiding-behind-the-cover-of-openai-and-windows-update-netamloader-s-sophisticated-cyber-espionage-campaign?utm_source=hashnode&utm_medium=feed) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [1d ago](https://hashnode.com/posts/cve-2026-41709-when-the-cvss-2-7-vulnerability-on-vmware-esxi-becomes-an-expensive-zero-day-for-apt/6af5213a88ec53c60be4ce09) ### [CVE-2026-41709: When the CVSS 2.7 vulnerability on VMware ESXi becomes an expensive Zero-Day for APT](https://blog.fiscybersec.com/cve-2026-41709-when-the-cvss-2-7-vulnerability-on-vmware-esxi-becomes-an-expensive-zero-day-for-apt?utm_source=hashnode&utm_medium=feed) Risk Summary What's more dangerous than an RCE CVSS 10.0 vulnerability being exploited loudly on the Internet? The answer from digital forensic experts is: A CVSS 2.7 vulnerability allows hackers to b 12 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/cve-2026-41709-when-the-cvss-2-7-vulnerability-on-vmware-esxi-becomes-an-expensive-zero-day-for-apt?utm_source=hashnode&utm_medium=feed) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [1d ago](https://hashnode.com/posts/ucreator-malware-analysis-android-virtualization-steals-telegram-2fa/6af5212b88ec53c60be4a172) ### [uCreator malware analysis: Android virtualization steals Telegram 2FA](https://blog.fiscybersec.com/ucreator-malware-analysis-android-virtualization-steals-telegram-2fa?utm_source=hashnode&utm_medium=feed) Overview A completely original Android device, no jailbreak (non-root), no million dollar zero-day exploit chain, Telegram or WeChat applications still operate smoothly without a trace of lag. However 17 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/ucreator-malware-analysis-android-virtualization-steals-telegram-2fa?utm_source=hashnode&utm_medium=feed) [Damiano Bianda](https://hashnode.com/@damianobianda) · [4d ago](https://hashnode.com/posts/the-ai-didn-t-break-in-it-knocked-on-every-door-what-the-bossai-mesh-actually-tells-us/6af1989606c60eaeba71716a) ### [The AI Didn't Break In. It Knocked on Every Door: What the BOSSAI Mesh Actually Tells Us](https://damianobianda.hashnode.dev/the-ai-didn-t-break-in-it-knocked-on-every-door-what-the-bossai-mesh-actually-tells-us?utm_source=hashnode&utm_medium=feed) For twelve days this summer, researchers at Acronis's Threat Research Unit watched a single person run a nation-state-scale attack operation from Hualien City, Taiwan. They watched from inside: the op 5 min read · [damianobianda.hashnode.dev](https://damianobianda.hashnode.dev/the-ai-didn-t-break-in-it-knocked-on-every-door-what-the-bossai-mesh-actually-tells-us?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [4d ago](https://hashnode.com/posts/workos-breach-ai-pentest-agent-artex/6af1c205c0d5784cc275e451) ### [WorkOS Breach: An AI Pentest Agent, a Dev Credential and Five Quiet Days](https://404-founders.com/blog/workos-breach-ai-pentest-agent-artex?utm_source=hashnode&utm_medium=feed) A researcher's ARTEX agent left its lab, found an exposed API that accepted a dev credential and pulled customer records in bulk. 11 min read · [404-founders.com](https://404-founders.com/blog/workos-breach-ai-pentest-agent-artex?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [5d ago](https://hashnode.com/posts/fake-security-tools-github-visual-studio-malware/6af080825e148fe7076e244f) ### [Fake Security Tools on GitHub Run Code When You Build Them](https://404-founders.com/blog/fake-security-tools-github-visual-studio-malware?utm_source=hashnode&utm_medium=feed) Doctor Web counted 2,000+ infected PCs. How the .suo and PreBuildEvent tricks work, what Trojan.Loader.3261 disables, and how to check a repo first. 13 min read · [404-founders.com](https://404-founders.com/blog/fake-security-tools-github-visual-studio-malware?utm_source=hashnode&utm_medium=feed)