Daily Reading for 2026-08-07

Security

Security Risk Advisors

• 🚩 STAC4749 Abuses Microsoft Teams Vishing and Remote Support Tools to Deploy Chaos Ransomware across North American Organizations.

  ONE SENTENCE SUMMARY: Sophos details STAC4749, a Microsoft Teams vishing campaign using IT-themed domains and remote support tools to deliver Chaos ransomware across North America.

  MAIN POINTS:

  1. STAC4749 impersonates IT helpdesk staff via Teams chats and calls.
  2. Attackers created “.top” IT-themed domains and plausible employee usernames.
  3. Remote access abused Quick Assist and the RemSupp RMM tool.
  4. Loaders and backdoors persisted via registry Run key masquerades.
  5. Golang implants used hard-coded certificate pinning for C2.
  6. At least three intrusions escalated to Chaos ransomware deployment.
  7. Time from initial access to encryption was under 17 hours.
  8. Chaos is ransomware-as-a-service linked to former BlackSuit members.
  9. Operators used reverse SOCKS proxies and tunneling for lateral movement.
  10. Defenders should monitor Teams, PowerShell, and registry Run keys.

  TAKEAWAYS:

  1. Teams vishing is a growing initial-access vector across threat groups.
  2. Audit registry Run keys and Startup folders for hidden persistence.
  3. Enforce EDR and application control to block loader abuse.
  4. Train users to recognize suspicious remote-access and support requests.
  5. Restrict and monitor legitimate remote support and RMM tools.

• 🚩 SMOKE#SCREEN Campaign Abuses Trusted Software Updates and ScreenConnect RMM to Silently Compromise Windows and MacOS Systems.

  ONE SENTENCE SUMMARY: The SMOKE#SCREEN campaign abuses trusted software updates and ScreenConnect RMM to silently compromise both Windows and macOS systems.

  MAIN POINTS:

  1. Campaign abuses trusted software update mechanisms for delivery.
  2. ScreenConnect RMM is abused for remote access and control.
  3. Targets both Windows and macOS systems.
  4. Compromise is designed to be silent and persistent.
  5. Relies on trust in legitimate software and admin tooling.

  TAKEAWAYS:

  1. Monitor legitimate RMM tools for anomalous installation or use.
  2. Treat trusted-update channels as an abuse and phishing vector.
  3. Detect unexpected remote-access tooling on endpoints.

• 🚩 Zbtlink routers ship with pre-installed remote access implant (ENDLESSDOORS) allowing unauthenticated root command execution.

  ONE SENTENCE SUMMARY: VulnCheck finds Zbtlink routers ship with ENDLESSDOORS, a pre-installed rctl-based implant phoning home to C2 and granting unauthenticated root shells (CVE-2026-66747).

  MAIN POINTS:

  1. Zbtlink routers ship with a pre-installed rctl remote-access implant.
  2. The implant runs as unbracketed “kworker” userland root processes.
  3. Roughly two dozen firmware images embed and auto-start the trojan.
  4. The device dials out, needing no inbound port or internet reachability.
  5. Anyone controlling the C2 address can hijack implants and get root.
  6. The protocol has no handshake, allow-list, or client verification.
  7. Server commands execute via popen() as uid 0.
  8. No fixed firmware exists; treat as a device-trust problem.
  9. Affected models span Zbtlink, Wiflyer, and white-label brands.
  10. VulnCheck published Suricata, Snort, and YARA detection content.

  TAKEAWAYS:

  1. Inventory network hardware by model number, not brand name.
  2. Check for unbracketed kworker processes and known implant files.
  3. Block and alert on the four C2 endpoints at egress and resolver.
  4. Replace or segment affected devices behind strict egress control.
  5. Anticipate supply-chain implants in low-cost IoT hardware.

wardley-beta
%% 1. Users: Security analysts, incident responders, network defenders, organizations
%% 2. Needs: Stop ransomware, defend against vishing/phishing, secure remote-access tooling, verify device supply chain
%% 3. Capabilities: Ransomware detection, vishing/phishing defense, RMM abuse monitoring, firmware-integrity validation, endpoint visibility
%% 4. Components from articles: Teams vishing (STAC4749), ScreenConnect RMM abuse (SMOKE#SCREEN), router implants (ENDLESSDOORS), software-update trust
%% 5. Maturity: Ransomware detection → Product; Endpoint visibility → Product; RMM monitoring → Custom; Vishing defense → Custom; Update trust → Custom; Router firmware validation → Genesis
%% 6. Managed by: Security vendors (Sophos, Securonix, VulnCheck), internal SOC/DFIR teams, security researchers

anchor stopRansomware [0.92, 0.92]
anchor defendVishing [0.88, 0.88]
anchor secureRemoteAccess [0.86, 0.80]
anchor verifySupplyChain [0.82, 0.82]

component ransomwareDetection [0.60, 0.55]
component endpointVisibility [0.55, 0.50]
component vishingDefense [0.35, 0.70]
component rmmMonitoring [0.40, 0.60]
component routerFirmwareValidation [0.15, 0.75]
component updateTrust [0.48, 0.42]

ransomwareDetection -> stopRansomware
endpointVisibility -> stopRansomware
vishingDefense -> defendVishing
rmmMonitoring -> secureRemoteAccess
rmmMonitoring -> ransomwareDetection
routerFirmwareValidation -> verifySupplyChain
updateTrust -> rmmMonitoring
updateTrust -> vishingDefense
endpointVisibility -> rmmMonitoring

evolve ransomwareDetection 0.75
evolve endpointVisibility 0.70
evolve routerFirmwareValidation 0.10

Bug Bounty

PortSwigger Research

• CSS:the bomb inside your inbox

  ONE SENTENCE SUMMARY: Gareth Heyes breaks out of webmail CSS sanitization to control UI, exfiltrate tokens, hijack AI browsers, track reads, and steal passwords.

  MAIN POINTS:

  1. Webmail sanitizers diverge from what browsers actually render.
  2. HTML labels can trigger arbitrary UI actions like pinning messages.
  3. Pseudo-elements hide text to manipulate AI browser prompts.
  4. Nested attribute selectors brute-force and exfiltrate login tokens.
  5. Even CSP-blocked external requests can leak pasted tokens.
  6. Image-proxy bypasses track email reads in Fastmail and Gmail.
  7. CSS gadgets exploit app-added DOM nodes to break trust boundaries.
  8. CSS hotwiring forces clicks to perform unintended UI actions.
  9. Real-time CSS keyloggers spoof login screens via select elements.
  10. Fastmail paid bounties for mediaText mutation vulnerabilities.

  TAKEAWAYS:

  1. Audit sanitizers for label, pseudo-element, and attribute-selector abuse.
  2. Reconsider remote image proxies as a read-tracking bypass vector.
  3. Sanitizers must handle CSS parser mutations and escapes.
  4. AI browsers amplify indirect prompt injection from emails.
  5. Test webmail against keylogger and UI-hijacking CSS payloads.

wardley-beta
%% 1. Users: Bug bounty hunters, security researchers, email security testers
%% 2. Needs: Discover novel client-side/CSS attacks; deliver exploits through email parsing
%% 3. Capabilities: Client-side CSS injection research; email content parsing; exploit payload development; vuln reporting
%% 4. Components from articles: CSS injection (bomb inside inbox), email HTML/CSS parser, payload dev, reporting platforms, email delivery
%% 5. Maturity: CSS injection → Genesis; Payload dev → Custom; Email parsing → Product; Reporting platforms → Commodity
%% 6. Managed by: Independent researchers, email vendors, bug bounty platforms

anchor novelClientSideDiscovery [0.95, 0.92]
anchor emailExploitDelivery [0.90, 0.85]

component cssInjection [0.15, 0.80]
component emailParser [0.65, 0.60]
component payloadDev [0.40, 0.70]
component reportingPlatforms [0.88, 0.35]
component emailDelivery [0.75, 0.45]

cssInjection -> novelClientSideDiscovery
emailParser -> emailExploitDelivery
payloadDev -> cssInjection
payloadDev -> emailParser
reportingPlatforms -> novelClientSideDiscovery
emailDelivery -> emailParser

evolve cssInjection 0.20
evolve payloadDev 0.45
evolve emailParser 0.70

Programming

マリウス

• GL.iNet Mudi 7

  ONE SENTENCE SUMMARY: A three-month review finds the GL.iNet Mudi 7 (GL-E5800) the most capable 5G Wi-Fi 7 travel router, despite tri-band limits, no MLO, and firmware quirks.

  MAIN POINTS:

  1. Mudi 7 is a 5G NR tri-band Wi-Fi 7 travel router.
  2. It offers dual nano-SIM plus onboard eSIM, dual USB-C, 2.5 GbE.
  3. A removable 5380 mAh battery is rated near 13.5 hours.
  4. LTE reception is a clear upgrade over the Netgear Nighthawk M2.
  5. The tri-band chipset drives only two bands at once.
  6. The device has no Multi-Link Operation (MLO) support.
  7. Firmware has a cellular bug leaving the device stuck on Connecting.
  8. Weight and footprint are a step back from the M2.
  9. OpenWrt openness is limited by a proprietary Qualcomm blob.
  10. The author retains the Mudi 7 and retires the aging M2.

  TAKEAWAYS:

  1. Check band coverage before choosing NA versus EU variants.
  2. 5G peak throughput is marketing; expect 600-900 Mbps sustained.
  3. Use USB-C tethering as a flexible secondary WAN option.
  4. Battery drains faster than the older M2 under sustained use.
  5. True software freedom remains limited in 5G-capable routers.

Simon Willison’s Weblog

• datasette 1.0a38

  ONE SENTENCE SUMMARY: Datasette 1.0a38 fixes a SQL injection letting users with public-table access read private table data in the same database.

  MAIN POINTS:

  1. Fixes a SQL injection affecting mixed public/private table databases.
  2. The bug allowed execute-sql users to read private table data.
  3. Exploitable when a database exposes busy public and private tables.
  4. The fix is also available in Datasette 0.65.3.
  5. The vulnerable mixed-configuration is judged likely rare.

  TAKEAWAYS:

  1. Disable execute-sql on databases serving private tables.
  2. Upgrade to Datasette 1.0a38 or 0.65.3 to close the hole.
  3. Avoid mixing public and private tables in a single database.

• datasette 0.65.3

  ONE SENTENCE SUMMARY: Datasette 0.65.3 back-ports the SQL injection security fix from 1.0a38 to the stable release branch.

  MAIN POINTS:

  1. Back-ports the SQL injection fix from Datasette 1.0a38.
  2. Addresses the same public/private table access vulnerability.
  3. Stable-branch users should upgrade to receive the patch.

  TAKEAWAYS:

  1. Upgrade Datasette to 0.65.3 for the security fix.
  2. Keep stable and alpha branches aligned on security patches.

• Simon Willison on Technical Blogging

  ONE SENTENCE SUMMARY: Simon Willison highlights his Write-that-blog interview advice, urging bloggers to lower standards and publish while still unhappy with their drafts.

  MAIN POINTS:

  1. Simon was interviewed by Cynthia Dunlop for Write that blog!.
  2. His top tip is to lower standards when blogging.
  3. Aim to publish while still unhappy with what you wrote.
  4. The alternative is a pile of drafts and nothing published.
  5. The flaws you see are invisible to everyone else.

  TAKEAWAYS:

  1. Publish imperfect work rather than hoarding drafts.
  2. Keep standards low enough to sustain output momentum.
  3. Guidance applies to any writer getting started.

wardley-beta
%% 1. Users: Developers, hobbyists, technical writers, data practitioners
%% 2. Needs: Build & ship software; run data tools; share knowledge; tinker with hardware
%% 3. Capabilities: Data tooling; tech writing; release management; hardware experimentation
%% 4. Components from articles: datasette, sqlite, technical blogging, router tinkering (GL.iNet Mudi 7), package releases
%% 5. Maturity: sqlite → Commodity; tech blogging → Commodity; datasette → Product; package releases → Custom; router tinkering → Genesis
%% 6. Managed by: Maintainers, developer communities, individual makers

anchor softwareBuild [0.95, 0.93]
anchor shareKnowledge [0.90, 0.90]
anchor runDataTools [0.88, 0.85]

component datasette [0.60, 0.65]
component sqlite [0.85, 0.40]
component techBlog [0.82, 0.55]
component packageRelease [0.55, 0.35]
component routerTinkering [0.20, 0.80]

datasette -> softwareBuild
datasette -> runDataTools
sqlite -> datasette
techBlog -> shareKnowledge
packageRelease -> datasette
routerTinkering -> softwareBuild

evolve sqlite 0.92
evolve techBlog 0.88
evolve datasette 0.75
evolve packageRelease 0.60
evolve routerTinkering 0.10