Daily Reading for 2026-08-28 - Learning in Public

Daily Reading for 2026-08-28

William Glaser
12 mins to read
daily-reading
Home / Daily Reading / Daily Reading for 2026-08-28

Daily Reading for 2026-08-28

AiTM Phishing Campaign Targeting Healthcare

Two SRA writeups document a single Sneaky 2FA adversary-in-the-middle phishing campaign chaining compromised Microsoft 365 accounts across universities and health systems. One harvested account sent to 1,454 unique recipients across 565 domains in roughly 13 minutes, using Google Sites staging pages to defeat domain-reputation filters, rotating .vu harvester domains, and ConnectWise ScreenConnect delivery as an RMM foothold. The defining insight is that AiTM kits steal live session tokens, so a password reset alone does not evict attackers — phishing-resistant MFA (FIDO2) is the control that actually breaks the chain, because the infrastructure cloaks so aggressively it scores clean on public reputation tools. Behavioral detection, inbox-rule hunting, and token revocation carry the load.

Watch for:

  • Inbox rules diverting mail to Conversation History as a high-fidelity AiTM signal.
  • Google Sites staging paths followed by new low-reputation TLD (.vu) requests from one user.
  • Newly Registered Domain blocking and FIDO2/passkey enforcement via Conditional Access.

Wardley signals:

wardley-beta
%% 1. Who are the users? Healthcare and academic-medical organizations targeted by the AiTM campaign
%% 2. What are their needs? Stop account takeovers, prevent session-token theft, and evict attackers despite phishing-resilient users
%% 3. What capabilities are required? Phishing-resistant authentication, session-token lifecycle management, and threat/inbox-rule hunting
%% 4. What components are we using? Sneaky 2FA kit, Google Sites staging, ConnectWise ScreenConnect, phishing-resistant MFA (FIDO2), session tokens, inbox-rule hunting
%% 5. How mature are they? AiTM kits and MFA are Product/Commodity; staging and ScreenConnect are Product rental; hunting practice is Custom
%% 6. Who manages them? Attackers rent the kits; defenders manage MFA, token revocation, and behavioral hunting
%% note: signals named AiTM kit as Product — kept, but FIDO2 shown as higher-visibility Commodity control breaking the chain
anchor healthcareOrg [0.95, 0.90]
component phishingResistantMFA [0.84, 0.70]
component sessionTokenMgmt [0.58, 0.62]
component inboxRuleHunting [0.50, 0.55]
component aitmKit [0.74, 0.36]
component googleSitesStaging [0.66, 0.46]
component screenConnect [0.70, 0.44]
phishingResistantMFA -> healthcareOrg
sessionTokenMgmt -> healthcareOrg
inboxRuleHunting -> sessionTokenMgmt
aitmKit -> sessionTokenMgmt
googleSitesStaging -> aitmKit
screenConnect -> aitmKit
evolve phishingResistantMFA 0.90

Microsoft Security August 2026

This month’s Microsoft Security roundup re-tools the whole stack around governing AI agents: Defender Experts MDR now spans third-party data sources (Palo Alto, AWS, Okta), Entra Tenant Governance brings multi-tenant drift and shadow-tenant risk into one view, Intune’s Autopilot adds remote sign-in, Purview auto-labeling scales to 500k files/day, and new “Secure Now” guidance prescribes agentic containment. The throughline is that autonomous agents are forcing security tooling to become a control plane — identity, exposure management, and data classification are being rebuilt around constraining what agents can do before action expands. For a technical reader this signals agent governance moving from a lab concern into productized, policy-driven defense-in-depth across a mature enterprise portfolio.

Watch for:

  • Defender Experts MDR coverage of non-Microsoft sources as a shakeout in managed detection.
  • Entra cross-tenant delegation and the configuration-drift report for multi-tenant hygiene.
  • Purview’s 500k-files/day ceiling as data-protection labeling scales for Copilot.

Wardley signals:

  • Components: Defender Experts MDR, Entra Tenant Governance, Intune Autopilot, Purview auto-labeling, Exposure Management / Secure Now agentic containment, Microsoft 365 Copilot.

  • Evolution stage: Defender Experts, Entra governance, and Purview labeling are Product (rental) — increasingly expected features in a growing portfolio; agentic-containment guidance is Custom (emerging prevention practice).

  • Doctrine: “Set exceptional standards”, “Focus on the outcome”, “There is no core” (agents as a cross-cutting control plane), “Design for constant evolution”.

  • Climatic patterns: Jevon’s Paradox (consumption grows as coverage expands), “Capital flows to new areas of value” (agent security), co-evolution of practice with activity.

  • Diffusion markers: rapid scaling of Purview limits, MDR extension to third-party sources, prescriptive “Secure Now” guidance signalling standardization.

  • ​​​​​​What’s new in Microsoft Security: August 2026

wardley-beta
%% 1. Who are the users? Enterprise security teams and CISOs in large organizations
%% 2. What are their needs? Govern AI agents, manage identity/tenant risk, secure endpoints, and protect data at scale
%% 3. What capabilities are required? Managed detection, identity governance, endpoint management, data classification, and exposure management
%% 4. What components are we using? Defender Experts MDR, Entra Tenant Governance, Intune Autopilot, Purview auto-labeling, Exposure Management / Secure Now agentic containment
%% 5. How mature are they? Mix of Product (MDR, Entra, Purview, Intune) and Custom (agentic-containment guidance)
%% 6. Who manages them? Microsoft plus in-house security operations, increasingly policy-driven
anchor securityTeam [0.95, 0.93]
component agenticContainment [0.42, 0.85]
component exposureMgmt [0.55, 0.72]
component entraGovernance [0.66, 0.62]
component defenderMDR [0.72, 0.55]
component intuneAutopilot [0.78, 0.45]
component purviewLabeling [0.82, 0.36]
exposureMgmt -> securityTeam
agenticContainment -> exposureMgmt
defenderMDR -> securityTeam
entraGovernance -> securityTeam
intuneAutopilot -> securityTeam
purviewLabeling -> securityTeam
evolve exposureMgmt 0.65

SLEEPWALKER Passive Backdoor

A detailed reverse-engineering of SLEEPWALKER, a passive Windows backdoor side-loaded as a fake dpapi.dll beside ESET’s ERAAgent.exe. It never beacons; it sleeps until a crafted magic packet arrives, then executes a custom encrypted bytecode language spanning six transports — TCP, UDP, ICMP, SMB named pipes, raw sockets, and a rare VMware VMCI guest-to-host channel. A DNS-based trigger (opcode 0x88) is implemented but disabled in the analyzed sample. The design — passive activation, covert transports, staged SHA-256-verified in-memory execution — signals a targeted, well-resourced operation. The post also benchmarks frontier AI models for malware reverse-engineering and ships YARA and PowerShell detection tooling that defenders can run read-only across an estate.

Watch for:

  • dpapi.dll/dpapisvc.dll beside ERAAgent.exe and NullSessionPipes / EveryoneIncludesAnonymous registry drift.
  • Magic-packet triggering on hosts running ESET Management Agent.
  • The DNS-trigger opcode (0x88) being switched on in later or modified builds.

Wardley signals:

  • Components: SLEEPWALKER bytecode language, ESET Management Agent (ERAAgent.exe), VMware VMCI, SMB named pipes, magic-packet trigger, YARA rules, AI-assisted reverse engineering.

  • Evolution stage: AI-assisted RE is Product (rapidly improving, feature-differentiated); the bytecode backdoor is Custom (bespoke malware); YARA detection is Commodity practice.

  • Doctrine: “Listen to your ecosystem”, “Use appropriate tools”, “Set exceptional standards” (published detection), “Bias towards data”.

  • Climatic patterns: Red Queen (defense evolving against fresh evasion), co-evolution of malware analysis practice with AI tooling.

  • Diffusion markers: AI models standardizing into reverse-engineering workflows; published toolkit/YARA enabling community-wide response.

  • 🚩 SLEEPWALKER Passive Backdoor Uses Custom Bytecode Language and Magic Packet Trigger to Evade Detection in ESET Management Agent

wardley-beta
%% 1. Who are the users? Defenders and malware analysts needing to detect a stealthy passive backdoor
%% 2. What are their needs? Early detection and response to a silent, packet-triggered implant that evades beaconing
%% 3. What capabilities are required? Host scanning, behavioral/registry hunt, and reverse engineering of the custom bytecode
%% 4. What components are we using? SLEEPWALKER backdoor, DLL side-loading, ESET Management Agent (ERAAgent.exe), magic-packet trigger, YARA detection, AI-assisted reverse engineering
%% 5. How mature are they? Detection and AI-RE are Product; the backdoor is Custom/bespoke; ESET agent is Commodity software being abused
%% 6. Who manages them? Researchers publish tooling; defenders run YARA/PowerShell and registry hunts
anchor defenderTeam [0.95, 0.93]
component yaraDetection [0.60, 0.70]
component aiRese [0.48, 0.80]
component sleepwalker [0.32, 0.35]
component dllSideLoad [0.40, 0.50]
component magicPacketTrigger [0.36, 0.44]
component esetAgent [0.70, 0.28]
yaraDetection -> defenderTeam
aiRese -> yaraDetection
sleepwalker -> yaraDetection
dllSideLoad -> sleepwalker
esetAgent -> dllSideLoad
magicPacketTrigger -> sleepwalker
evolve yaraDetection 0.68

AI Gateway and Orchestration Attacks

Microsoft documents intrusions against three distinct AI workloads — a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment — that converge on treating AI infrastructure as a control plane. Attackers exploited exposed gateway surfaces (for LiteLLM, a chain involving CVE-2026-42271 and CVE-2026-48710), ran Python droppers, harvested secrets and database connection strings, intercepted newly configured LLM provider credentials, and deployed XMRig miners on compromised compute. The pattern matters more than individual techniques: AI gateways concentrate credentials, model connectivity, data access, and execution privileges, making them prime targets where credential theft, persistence, and compute monetization converge. Defenders should inventory exposed AI management surfaces, restrict administrative access, and monitor for gateway-originated execution and secret access.

Watch for:

  • Exposure of LiteLLM, RAGFlow, or Kestra management surfaces to the internet.
  • Secret harvesting: model-provider keys, proxy virtual keys, and DB connection strings.
  • Gateway-originated execution and cryptomining (XMRig) as post-compromise indicators.

Wardley signals:

  • Components: LiteLLM, RAGFlow, Kestra, AI gateways, model-provider keys, Python droppers, XMRig miners, CVE-2026-42271 / CVE-2026-48710.

  • Evolution stage: AI-infrastructure security posture is Genesis/Custom (poorly understood new attack surface); AI gateways themselves are Product (growing adoption); cryptomining is commoditized attack practice.

  • Doctrine: “Know your details”, “Manage failure”, “Focus on the outcome”, “There is no core” (AI security as cross-cutting); defender-side “Set exceptional standards”.

  • Climatic patterns: “Capital flows to new areas of value” (attacker capital flowing to AI infra), Red Queen, “Success breeds inertia”.

  • Diffusion markers: attacker targeting replicated across three unrelated workloads; CVE-driven exploitation; defense guidance standardizing.

  • 🚩 Attackers Target AI Gateways and Orchestration Platforms for Credential Theft, Persistence, and Cryptomining

wardley-beta
%% 1. Who are the users? Organizations deploying AI gateways and orchestration platforms
%% 2. What are their needs? Protect the AI control plane against credential theft, persistence, and compute abuse
%% 3. What capabilities are required? Restricted admin access to gateways, secret management, and monitoring of gateway-originated execution
%% 4. What components are we using? LiteLLM/RAGFlow/Kestra gateways, model-provider keys, credential harvesting, XMRig miners, gateway exposure/CVEs, secret management
%% 5. How mature are they? AI gateways are Product (growing); security posture is Genesis/Custom; cryptomining is Commodity attacker practice
%% 6. Who manages them? Enterprise security teams and platform owners; attackers exploit exposed surfaces
anchor aiOrg [0.95, 0.93]
component gatewayAccessControl [0.45, 0.76]
component secretMgmt [0.56, 0.64]
component aiGateway [0.62, 0.50]
component modelKeys [0.70, 0.38]
component credHarvesting [0.30, 0.46]
component miner [0.24, 0.28]
gatewayAccessControl -> aiOrg
secretMgmt -> aiOrg
aiGateway -> secretMgmt
modelKeys -> aiGateway
credHarvesting -> aiGateway
miner -> credHarvesting
evolve aiGateway 0.70

Hyperuplink is a modern internet bulletin board shipping as a single statically-linked binary with zero JavaScript, no runtime, no interpreter, no node_modules, and no messy install — it renders HTML5/CSS server-side, talks to PostgreSQL (or a cluster) and any Redis-compatible cache, and aims to recapture the “soul” of 1998-era BBS communities while working entirely in a 2026 browser. It’s positioned as a fun, nostalgic, minimal-dependency alternative to phpBB’s runtime environment and Discourse’s JavaScript-heavy UI. For a technical reader it’s a thought experiment in the reclaim-the-web counter-movement: what a community primitive looks like when the client does nothing, and whether a deliberate constraint (JS-free, one binary) wins on deployability and longevity.

Watch for:

  • Whether a JS-free, single-binary forum gains community/feature momentum vs Discourse and phpBB.
  • Adoption as an open source project and the pace of theme/moderation ecosystem growth.
  • Single-binary + Postgres/Redis deployment as a simplification trend in self-hosted software.

Wardley signals:

  • Components: Hyperuplink, phpBB, Discourse, PostgreSQL, Redis, server-side rendering, bulletin-board communities.

  • Evolution stage: forum software is Commodity (mature, entrenched Discord/phpBB as accepted utilities); Hyperuplink is Genesis/Custom (novel reframing of a settled niche, undefined market).

  • Doctrine: “Think fast, inexpensive, restrained and elegant” (single binary, no runtime), “Use appropriate tools”, “Bias towards action”.

  • Climatic patterns: creative destruction / counter-movement against heavy JS stacks; shift toward utility; “Change is not always linear”.

  • Diffusion markers: none strong yet — an early, niche nostalgic project; watch for ecosystem uptake and forking.

  • Hyperuplink: Discuss like it’s 1998

wardley-beta
%% 1. Who are the users? Self-hosters and small communities wanting a lightweight, nostalgic forum
%% 2. What are their needs? A fast, simple, JavaScript-free community board that runs anywhere with minimal dependencies
%% 3. What capabilities are required? Server-side rendering, durable storage, caching, and a simple deployment model
%% 4. What components are we using? Hyperuplink, server-side rendering, PostgreSQL, Redis, and incumbent forums (phpBB/Discourse)
%% 5. How mature are they? Forums are Commodity (mature); Hyperuplink is Genesis/Custom (novel reframing); Postgres/Redis are Commodity utilities
%% 6. Who manages them? A single author ships the binary; admins self-host the data layer
anchor forumAdmin [0.95, 0.93]
component hyperuplink [0.55, 0.68]
component serverSideRender [0.70, 0.50]
component postgres [0.80, 0.40]
component redis [0.84, 0.34]
component legacyForums [0.60, 0.30]
hyperuplink -> forumAdmin
serverSideRender -> hyperuplink
postgres -> hyperuplink
redis -> hyperuplink
legacyForums -> forumAdmin
evolve serverSideRender 0.78

Claude Code Auto Mode Prompt Injection

Johann Rehberger found a prompt-injection attack that defeats Claude Code’s Auto Mode — now Anthropic’s default for coding agents — roughly 80% of the time. It works by tricking the agent into downloading and unwrapping a zip archive so that an import base64 silently executes a malicious local struct.py shadowed from the archive. Strikingly, Auto Mode sometimes blocked the very cleanup command meant to stop the compromise, meaning the safety classifier itself became part of the failure chain. Simon Willison and the researcher converge on the same remedy: unattended agents that might face adversarial input should run only in sandboxes — container/VM/OS isolation, restricted network egress, monitoring, and no exposed home directories, SSH keys, or cloud credentials.

Watch for:

  • Auto Mode’s classifier behavior under independent testing and Anthropic’s response to the claims.
  • Sandboxing/containerization being built into coding-agent runtimes by default.
  • Zip-archive plus module-shadowing (struct.py-style) injection techniques in agent workflows.

Wardley signals:

  • Components: Claude Code Auto Mode, prompt injection, zip-archive decompression, module shadowing, sandboxing (container/VM/OS), LLM coding agents.

  • Evolution stage: LLM coding agents are Product (rapidly growing, feature-differentiated); agent safety/security is Genesis/Custom (poorly understood, high uncertainty); sandboxing is Product/Commodity practice.

  • Doctrine: “Manage failure”, “Focus on the outcome”, “Set exceptional standards” (safety classifier), “There is no core”.

  • Climatic patterns: Red Queen (adversarial attack/defense co-evolution), “Not everything is random” (attacker inventiveness), “Success breeds inertia” (reliance on default auto mode).

  • Diffusion markers: an independent researcher’s finding driving sandboxing doctrine; likely copy-cat attacks; Anthropic making Auto Mode default signals standardization ahead of hardening.

  • Breaking Claude Code Opus 5 Auto Mode

wardley-beta
%% 1. Who are the users? Developers and organizations running unattended LLM coding agents
%% 2. What are their needs? Safe autonomous agent runs that resist prompt injection and cannot exfiltrate or self-compromise
%% 3. What capabilities are required? Sandboxing/isolation, safe agent runtime, and injection-aware control
%% 4. What components are we using? Claude Code Auto Mode, the injection safety classifier, prompt injection, module-shadowing technique, and sandboxing
%% 5. How mature are they? Coding agents are Product (growing); agent safety is Genesis/Custom; sandboxing is Product/Commodity practice
%% 6. Who manages them? Vendors (Anthropic) and operators; attackers probe auto mode defaults
anchor developerOrg [0.95, 0.93]
component agentRuntime [0.55, 0.58]
component sandboxing [0.68, 0.72]
component autoMode [0.50, 0.62]
component promptInjection [0.28, 0.40]
component moduleShadowing [0.33, 0.45]
agentRuntime -> developerOrg
sandboxing -> agentRuntime
autoMode -> agentRuntime
promptInjection -> autoMode
moduleShadowing -> promptInjection
evolve sandboxing 0.76