The Defensive Line Weekly podcast is the audio version of the weekly Defensive Line Substack intelligence summary — the same stories, the same analysis, built for blue teamers and security leaders who want actionable intelligence on the go.

Story 1: Trivy Compromised, CanisterWorm Spreads

* Wiz Research — Trivy Compromised: TeamPCP Supply Chain Attack

* BleepingComputer — Trivy Vulnerability Scanner Breach Pushed Infostealer via GitHub Actions

* The Hacker News — Trivy Supply Chain Attack Triggers Self-Propagating Worm

* Elastic Security Labs — TeamPCP Container Attack Scenario

Story 2: Interlock Ransomware Exploited Cisco FMC for 36 Days

* AWS Security Blog — Amazon Threat Intelligence Teams Identify Interlock Ransomware Campaign

* The Register — Amazon, Cisco Firewall Zero-Day, Ransomware

* BleepingComputer — Interlock Ransomware Exploited Secure FMC Flaw in Zero-Day Attacks Since January

Story 3: Nordstrom’s Email Trust Broken via SSO Compromise

* BleepingComputer — Nordstrom’s Email System Abused to Send Crypto Scams to Customers

Honourable Mentions

DarkSword iOS Exploit Kit

* Google Threat Intelligence Group — DarkSword iOS Exploit Chain

* BleepingComputer — New DarkSword iOS Exploit Used in Infostealer Attack on iPhones

APT28 OPSEC Blunder

* Ctrl-Alt-Intel — FancyBear Exposure

DPRK Fake IT Workers

* The Register — Researchers Lift the Lid On DPRK Fake IT Worker Operation

Iran/Handala — Intune Hardening Guidance

* The Register — Microsoft Intune Lockdown Guidance Post-Stryker

Russian Intelligence Targeting Signal

* IC3 PSA — Russian Intelligence Targeting Commercial Messaging Apps

Vulnerability Roundup

* The Hacker News — Critical Langflow Flaw CVE-2026-33017

* BleepingComputer — Oracle Pushes Emergency Fix for Critical Identity Manager RCE Flaw

* BleepingComputer — ConnectWise Patches New Flaw Allowing ScreenConnect Hijacking

* The Hacker News — CISA Flags Apple, Craft CMS, Laravel Bugs

* BleepingComputer — Russian APT28 Military Hackers Exploit Zimbra Flaw in Ukrainian Govt Attacks

* The Register — Unknown Attackers Exploit Yet Another SharePoint Critical Flaw

A podcast version of the weekly Defensive Line Substack Intelligence Summary — focused on what matters, why it matters, and what defenders should do next.

Handala wipes Stryker (management plane)

* https://www.bleepingcomputer.com/news/security/medtech-giant-stryker-offline-after-iran-linked-wiper-malware-attack/

* https://therecord.media/stryker-tells-sec-unknown-timeline-recovery

* https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/

* https://www.recordedfuture.com/blog/the-iran-war-what-you-need-to-know

GlassWorm (developer supply chain)

* https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html

* https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/

* https://www.bleepingcomputer.com/news/security/new-phantomraven-npm-attack-wave-steals-dev-data-via-88-packages/

Chrome zero-days

* https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/

Notable mentions

Storm-2561 (fake V-P-N installers via S-E-O poisoning)

* https://go.theregister.com/feed/www.theregister.com/2026/03/13/vpn_clients_spoofed/

* https://www.bleepingcomputer.com/news/security/fake-enterprise-vpn-downloads-used-to-steal-company-credentials/

CL-STA-1087 (China espionage)

* https://unit42.paloaltonetworks.com/espionage-campaign-against-military-targets/

Vulnerability roundup

* https://go.theregister.com/feed/www.theregister.com/2026/03/12/cisa_n8n_rce/

* https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-n8n-rce-flaw-exploited-in-attacks/

* https://www.bleepingcomputer.com/news/security/veeam-warns-of-critical-flaws-exposing-backup-servers-to-rce-attacks/

Episode Summary: Episode 8 of The Defensive Line Weekly covers a week dominated by the cyber dimension of the Iran conflict, with MuddyWater pre-positioned in U.S. critical infrastructure and physical drone strikes on A.W.S data centres. We also examine InstallFix — a ClickFix evolution targeting developers via cloned tool installation pages — and a Microsoft oh-auth protocol abuse that turns legitimate Entra ID endpoints into phishing launchers. Notable mentions cover the Coruna iOS exploit kit, record zero-day exploitation data from Google's GTIG, the LexisNexis cloud breach, and a vulnerability roundup.

Main Stories

1. Iran Conflict Cyber Update — MuddyWater, Camera Exploitation, and AWS Strikes

Iran-linked threat group MuddyWater (attributed to Iran’s MOIS) has been embedded in multiple U.S. organisations since early February 2026, deploying the Dindoor and Fakeset backdoors and exfiltrating data via Rclone to Wasabi cloud storage. Check Point Research reported exploitation of patched Hikvision and Dahua camera CVEs across the Middle East. Drone strikes physically damaged four AWS data centres in the UAE and Bahrain.

Sources:

* Symantec/Carbon Black — Iran Cyber Threat Activity

* Check Point Research — Iranian IP Camera Targeting

* BleepingComputer — AWS Data Centre Drone Strikes

* BleepingComputer — NCSC UK Advisory

* AttackIQ — Operation Epic Fury Emulation

2. ClickFix Evolves into InstallFix — Developer Tool Lures Deliver Infostealers and Ransomware

Push Security disclosed InstallFix, a ClickFix variant that clones legitimate developer tool installation pages (e.g., Claude Code) to trick developers into pasting malicious install commands. Distribution is via Google Ads malvertising, hosted on legitimate platforms (Cloudflare Pages, Squarespace). Payloads include Amatera, Lumma, and macOS SHub infostealers. Ransomware group Velvet Tempest (Termite) has adopted the technique to deploy CastleRAT.

Sources:

* Push Security — InstallFix Disclosure

* BleepingComputer — Fake Claude Code Install Guides

* Malwarebytes — Fake CleanMyMac / SHub Stealer

* BleepingComputer — Termite / CastleRAT ClickFix

* DeliverTo — Claude Code InstallFix Test Payload

3. Microsoft OAuth Error-Flow Abuse — Trusted Login URLs Redirect to Phishing and Malware

Microsoft Defender researchers disclosed a campaign abusing the OAuth 2.0 error redirection mechanism to redirect victims from legitimate Microsoft Entra ID endpoints to attacker infrastructure. Lures include e-signature requests, meeting invitations, and password resets. Outcomes include AitM credential theft (EvilProxy) and malware delivery via ZIP/LNK/HTML smuggling. Targeting government and public-sector organisations.

Sources:

* Microsoft — OAuth Redirection Abuse

* BleepingComputer — Microsoft OAuth Error-Flow

* Malwarebytes — OAuth Redirect Analysis

Notable Mentions

Coruna — Spyware-Grade iOS Exploit Kit Enters Criminal Use

Google GTIG disclosed Coruna, a 23-exploit iOS kit (covering iOS 13.0–17.2.1). The kit has moved from a surveillance vendor customer to Russian espionage (UNC6353, Ukraine watering-hole attacks) to Chinese financially motivated actors (UNC6691, crypto theft). CISA added three exploited CVEs to KEV on 5 March 2026. Coruna does not work on iOS 17.3+.

Sources:

* Google GTIG — Coruna iOS Exploit Kit

* BleepingComputer — Coruna Crypto Theft

* iVerify — Coruna Tracking

* BleepingComputer — CISA KEV Coruna

Shrinking Patch Windows — GTIG Zero-Day Report and Zero Day Clock

Google GTIG tracked 90 zero-days exploited in 2025 (up 15%), with enterprise appliances and edge devices representing a record 48%. Zero Day Clock shows mean time-to-exploit has crossed the one-week threshold; 67.2% of exploited CVEs in 2026 are zero-days.

Sources:

* Google GTIG — 2025 Zero-Day Review

* Zero Day Clock

* BleepingComputer — Zero-Day Record

LexisNexis Data Breach — React2Shell Exploited to Pillage AWS

Threat actor FulcrumSec exploited an unpatched React frontend (React2Shell) to pivot into LexisNexis’s AWS environment. A single ECS task role with broad Secrets Manager read access enabled exfiltration of 53 secrets, 3.9 million records, and ~400,000 cloud user profiles including ~118 .gov accounts.

Sources:

* BleepingComputer — LexisNexis Data Breach

* The Register — LexisNexis Breach Details

Vulnerability Roundup

* Cisco Catalyst SD-WAN — CVE-2026-20122 and CVE-2026-20128 now actively exploited (continuation from last week’s CVE-2026-20127, CVSS 10.0). ACSC Hunt Guide | Cisco Advisory

* VMware Aria Operations — CVE-2026-22719, unauthenticated RCE, CISA KEV, CVSS 8.1. Workaround script available. BleepingComputer | Broadcom Advisory

* Qualcomm Android Zero-Day — CVE-2026-21385, integer overflow in Qualcomm Graphics, 235 chipsets affected, under limited active exploitation. Prioritise 2026-03-05 patch level. BleepingComputer

Watchlist: Signed Malware via Stolen EV Certificate

Microsoft reported malware signed with a stolen Extended Validation code-signing certificate, impersonating workplace apps to deploy RMM tools as persistent backdoors.

Source: Microsoft

Subscribe

* Podcast: Available on all major podcast platforms — search The Defensive Line Weekly

* Newsletter: thedefensiveline.substack.com

Cisco Catalyst S.D-WAN (CVE-2026-20127)

* NCSC-UK Advisory — Exploitation of Cisco Catalyst SD-WANs — https://www.ncsc.gov.uk/news/exploitation-cisco-catalyst-sd-wans

* BleepingComputer — Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023 — https://www.bleepingcomputer.com/news/security/critical-cisco-sd-wan-bug-exploited-in-zero-day-attacks-since-2023/

* The Hacker News — Cisco SD-WAN zero-day CVE-2026-20127… — https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html

* The Record — Five Eyes warn hackers exploit Cisco SD-WAN — https://therecord.media/five-eyes-warn-hackers-exploit-cisco-sd-wan

GRIDTIDE (UNC2814) — Google Sheets API C2

* Google Threat Intelligence — Disrupting GRIDTIDE, a global espionage campaign — https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign

* BleepingComputer — Chinese cyberspies breached dozens of telecom firms, govt agencies — https://www.bleepingcomputer.com/news/security/chinese-cyberspies-breached-dozens-of-telecom-firms-govt-agencies/

* The Hacker News — Google disrupts UNC2814 / GRIDTIDE… — https://thehackernews.com/2026/02/google-disrupts-unc2814-gridtide.html

* The Record — China cyber-espionage: Google disrupts… — https://therecord.media/china-cyber-espionage-google-disrupt

Scattered LAPSUS$ Hunters (S.L.H) — Paid helpdesk vishing

* Dataminr — SLH recruiting women for vishing — https://www.dataminr.com/resources/intel-brief/slh-recruiting-women-for-vishing/

* The Hacker News — SLH offers $500–$1,000 per call to recruit… — https://thehackernews.com/2026/02/slh-offers-5001000-per-call-to-recruit.html

* The Register — Scattered Lapsus Hunters female recruits… — https://go.theregister.com/feed/www.theregister.com/2026/02/26/scattered_lapsus_hunters_female_recruits/

* BleepingComputer — Diesel Vortex phishing campaign targets freight & logistics — https://www.bleepingcomputer.com/news/security/diesel-vortex-phishing-campaign-targets-freight-logistics/

Honourable mentions

* Symantec/Broadcom — Lazarus + Medusa ransomware — https://www.security.com/threat-intelligence/lazarus-medusa-ransomware

* BleepingComputer — North Korean Lazarus linked to Medusa ransomware attacks — https://www.bleepingcomputer.com/news/security/north-korean-lazarus-group-linked-to-medusa-ransomware-attacks/

* The Hacker News — Lazarus Group uses Medusa ransomware… — https://thehackernews.com/2026/02/lazarus-group-uses-medusa-ransomware-in.html

* The Record — Ukraine cyberattacks guiding Russian missile strikes — https://therecord.media/ukraine-cyberattacks-guiding-russian-missile-strikes

* BleepingComputer — Ransomware payment rate drops to record low despite attack surge — https://www.bleepingcomputer.com/news/security/ransomware-payment-rate-drops-to-record-low-despite-attack-surge/

* The Record — Ransomware payments (Chainalysis)… — https://therecord.media/ransomware-payments-chainalysis-cybercrime

* The Register — Ransomware: Chainalysis… — https://go.theregister.com/feed/www.theregister.com/2026/02/27/ransomware_chainalysis/

Episode 6 of The Defensive Line Weekly examines how attackers are increasingly exploiting legitimate infrastructure to bypass defences: a Russian-aligned threat actor abuses Microsoft’s real authentication pages to harvest SSO credentials, China-nexus espionage actors exploit hardcoded credentials in Dell’s backup platform after eighteen months of silent access, and a financially motivated group uses AI to compromise over 600 FortiGate devices at scale. The episode also covers Google’s first Chrome zero-day of 2026, critical vulnerabilities in widely used VS Code extensions affecting over 128 million downloads, and a new ClickFix variant that uses DNS queries to deliver malware payloads — bypassing the PowerShell monitoring that defenders have hardened against.

Stories Covered

1. Microsoft Entra Device Code Vishing — Storm-2372

A Russian-aligned threat actor (Storm-2372) has been running an active campaign since August 2024, abusing Microsoft’s legitimate device authorisation grant flow to harvest authenticated sessions across SSO-connected applications. Victims are socially engineered via phishing emails and vishing calls into entering device codes on the genuine microsoft.com/devicelogin page — granting attackers access without stealing passwords or bypassing MFA directly.

Source: Microsoft Security Blog

2. Dell RecoverPoint Zero-Day — CVE-2026-22769

CISA added a maximum-severity hardcoded credential vulnerability in Dell RecoverPoint for Virtual Machines to its Known Exploited Vulnerabilities catalogue on 18 February 2026. Suspected China-nexus espionage actors have actively exploited the flaw since at least mid-2024 — an eighteen-month window — deploying custom malware families against backup and disaster recovery infrastructure.

Sources: The Register, SecurityWeek

3. AI-Augmented Threat Actor Compromises FortiGate Devices at Scale

Amazon Threat Intelligence reported a Russian-speaking, financially motivated actor who used commercial generative AI to compromise more than 600 FortiGate devices across 55+ countries between 11 January and 18 February 2026. The attack relied on exposed admin interfaces and weak credentials — no new vulnerability was required. Post-compromise activity included Active Directory credential theft and targeting of Veeam backup infrastructure, consistent with pre-ransomware sequencing.

Source: AWS Security Blog

4. Chrome Zero-Day CVE-2026-2441 Under Active Exploitation

Google released emergency updates on 19 February 2026 for the first Chrome zero-day exploited in attacks in 2026 — a use-after-free vulnerability in Chrome’s CSS implementation discovered by Google’s Threat Analysis Group. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue. The fix is available in Chrome version 134.0.7323.88 and later, across Windows, macOS, and Linux.

Source: BleepingComputer

5. Critical Vulnerabilities in Popular VS Code Extensions

OX Security reported high to critical vulnerabilities across four popular Visual Studio Code extensions collectively exceeding 128 million downloads — including Live Server (remote file exfiltration), Code Runner (remote code execution), Markdown Preview Enhanced (JavaScript execution), and Microsoft Live Preview (XSS to file exfiltration). Three of the four extensions had unresponsive maintainers despite disclosure in mid-2025.

Source: OX Security

6. ClickFix Attacks Evolve to Use DNS for Payload Delivery

Microsoft and Huntress disclosed a new ClickFix variant using DNS TXT records to deliver malware payloads — the first known use of DNS as a ClickFix delivery channel. The variant uses the legitimate nslookup command instead of PowerShell or mshta, evading security tools that monitor those execution paths. Recent campaigns delivered ModeloRAT, a remote access trojan for Windows.

Sources: BleepingComputer, Dark Reading

Based on The Defensive Line Weekly intelligence summary for 15–22 February 2026. Subscribe at thedefensiveline.substack.com

Episode summary

This episode looks at a shift in initial access: attackers increasingly win by exploiting trust relationships rather than pure exploit chains. We cover how A-I platforms, messaging and meeting workflows, software updates, and browser extensions are becoming a new perimeter—and what to do about it.

Topics and sources

Adversarial A-I moving from experimentation to operational tooling

* GTIG quarterly A-I threat tracker (Q4 2025)

* Source link: https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use

* Edge devices and the “human layer” beating perimeter controls

* GTIG report on threats to the defence industrial base

* Source link: https://cloud.google.com/blog/topics/threat-intelligence/threats-to-defense-industrial-base

* Telegram compromise + meeting-tool impersonation leading to ClickFix execution

* Mandiant / Google Threat Intelligence Group reporting on North Korean activity targeting crypto firms

* Source link: https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering

* Notepad++ update infrastructure compromise (selective targeting)

* DomainTools analysis of Notepad++ update mechanism compromise

* Source link: https://dti.domaintools.com/research/lotus-blossom-and-the-notepad-supply-chain-espionage-campaign

* Malicious Chrome extensions posing as A-I assistants

* LayerX research into malicious extensions and browser DOM scraping

* Source link: https://layerxsecurity.com/blog/aiframe-fake-ai-assistant-extensions-targeting-260000-chrome-users-via-injected-iframes/

This week covers five stories showing attackers exploiting well-understood defensive gaps. Shadow Campaigns breached 70+ organisations across 155 countries using conventional techniques. DKnife framework compromises edge devices for persistent traffic interception. A real-world attack used a decade-old forensic driver to disable 59 security products. Critical Google Looker vulnerabilities enable RCE against business intelligence platforms. GlassWorm malware spread via compromised developer accounts targeting the software supply chain. The common thread: edge exposure, patch lag, credential compromise, and driver signature gaps remain exploitable at scale.

Topics Covered

1. Shadow Campaigns: Asia-Based Threat Actor Breaches 70+ Organisations

Palo Alto Networks Unit 42 disclosed a coordinated global espionage operation targeting government agencies and critical infrastructure. Unit 42 report at least 70 organisations breached, with broader reconnaissance and targeting activity observed across 155 countries. The threat actor (TGR-STA-1030) focused on diplomatic communications, trade negotiations, military operations, and rare earth minerals intelligence between 2025 and early 2026.

Key Points:

Conventional techniques: edge exposure, patch lag, account compromise

Tight correlation between cyber operations and geopolitical events

Custom malware loader “DiaoYu.exe” checked for only 5 endpoint security products

Primary targeting: governments and ministries with spillover to critical infrastructure

Sources:

Palo Alto Networks Unit 42

BleepingComputer

2. DKnife: China-Nexus Framework Hijacks Edge Device Traffic

Cisco Talos disclosed DKnife, an adversary-in-the-middle framework used to compromise edge devices and network gateways for persistent monitoring. Active since at least 2019, the framework enables SSL/TLS interception, HTTP header injection, DNS manipulation, and secondary malware delivery.

Key Points:

Persistence through infrastructure rather than endpoints

Transforms compromised edge devices into persistent collection platforms

Traditional EDR won’t detect traffic manipulation at gateway level

Attributed to China-nexus threat actor

Sources:

Cisco Talos

BleepingComputer

The Hacker News

3. Attackers Use Forensic Driver to Terminate EDR in Real-World Incident

Huntress documented a real-world attack where threat actors used a legitimate but long-revoked EnCase forensic driver to disable 59 endpoint security products during an active intrusion. The driver’s certificate expired in 2010 and was revoked, yet Windows still loads it.

Key Points:

Attack chain: compromised SonicWall VPN credentials → reconnaissance → EDR killer deployment

BYOVD (Bring Your Own Vulnerable Driver) attack exploiting Windows driver signature enforcement gap

Attack disrupted before ransomware deployment

Demonstrates endpoint security alone is insufficient

Sources:

Huntress

Dark Reading

4. Critical Google Looker Vulnerabilities Enable RCE and Data Access

Tenable disclosed critical vulnerabilities in Google Looker (CVE-2025-12743) enabling remote code execution and unauthorised access to internal databases. Looker is used by more than 60,000 organisations across 195 countries. Google patched cloud-hosted instances; self-hosted deployments require manual updates.

Key Points:

RCE chain allows arbitrary command execution and full system compromise

Business intelligence platforms concentrate access to sensitive data across organisations

Cloud instances patched automatically; self-hosted require manual intervention

Compromise can enable credential theft, data exfiltration, and lateral movement

Sources:

Google Cloud Security Bulletin

Tenable

Dark Reading

SecurityWeek

5. GlassWorm Returns via Compromised Developer Account

Socket documented a GlassWorm malware campaign that compromised an established Open VSX publisher account to distribute self-replicating infostealer malware through trusted developer extensions. Four established extensions with 22,000+ combined downloads were updated with malicious versions on 30 January 2026.

Key Points:

Targets macOS developers, stealing NPM credentials, GitHub tokens, Git credentials, cryptocurrency wallets

Self-propagating: uses stolen credentials to compromise additional packages and extensions

Bypasses security heuristics by using established publisher accounts with multi-year history

Demonstrates sophisticated supply chain attack vector

Sources:

Socket

Dark Reading

SecurityWeek

Subscribe

Substack Newsletter: The Defensive Line Weekly

Podcast: Subscribe for weekly actionable security intelligence

Coverage period: 27 January–2 February 2026

Episode summary: This episode covers four critical security stories including industrialised vishing campaigns targeting approximately 100 organisations, a vendor-managed SSO zero-day demonstrating dependency risk, wiper attacks on Polish energy infrastructure, and critical SolarWinds Web Help Desk vulnerabilities.

Stories Covered

1. Match Group Breach Validates SSO Vishing Industrialisation

ShinyHunters breached Match Group (Tinder, Match.com, Meetic, OkCupid, Hinge) via vishing campaign targeting Okta SSO credentials. Campaign targeting ~100 organisations using voice phishing with domains like matchinternal[.]com. Compromised AppsFlyer marketing analytics, Google Drive, and Dropbox accounts.

Sources:

* BleepingComputer: Match Group breach

* The Register: ShinyHunters Match Group

* Recorded Future News: Bumble Match breaches

2. Fortinet FortiCloud SSO Zero-Day Affects Fully Patched Devices

CVE-2026-24858 (CVSS 9.4) authentication bypass in FortiCloud SSO affecting FortiOS, FortiManager, FortiAnalyzer. Vulnerability in vendor cloud infrastructure, not customer devices. Exploitation via malicious accounts cloud-noc@mail[.]io and cloud-init@mail[.]io. Fortinet mitigated via server-side changes; patches in development.

Sources:

* BleepingComputer: Fortinet blocks exploited FortiCloud SSO zero-day

* Fortinet PSIRT advisory

3. Russia-Aligned DynoWiper Attack Targets Polish Energy Infrastructure

Sandworm (GRU-affiliated) deployed DynoWiper malware against 30+ Polish energy facilities on 29 December 2025. Initial access via default credentials and absence of MFA on OT interfaces. DynoWiper execution blocked at combined heat/power plant serving 500,000 customers.

Sources:

* CERT Polska incident report

* Dragos analysis

* ESET Research: Sandworm DynoWiper

* The Hacker News

* BleepingComputer: Sandworm Poland power grid

4. SolarWinds Web Help Desk Critical Vulnerabilities

Six vulnerabilities in Web Help Desk, including four critical (CVSS 9.8) unauthenticated RCE and authentication bypass flaws. Fixed in version 2026.1. History of exploitation and patch bypasses.

Sources:

* SolarWinds Release Notes

* SolarWinds Security Advisories

* BleepingComputer: SolarWinds Web Help Desk RCE

* The Hacker News

Key Defensive Takeaways

* Deploy passkeys for all external SSO access to prevent AitM credential theft

* Eliminate default credentials and enforce phishing-resistant MFA on all OT interfaces

* Patch immediately: SolarWinds Web Help Desk

* Review authentication logs for indicators of FortiCloud SSO compromise

* Implement defence in depth for critical infrastructure—endpoint protection, network segmentation, least privilege

Full intelligence summary: The Defensive Line Weekly: 27 January–2 February 2026

20–26 January 2026

Episode Overview

This week’s episode covers five critical security stories: industrialised voice phishing targeting SSO credentials, GitLab MFA bypass creating supply chain risk, AWS CodeBuild misconfiguration exposing the AWS Console supply chain, email threat research confirming the shift from malware to identity compromise, and sobering findings from Bank of England red team assessments showing what actually works against major financial institutions.

Hosts:

* Carter – Intelligence Analyst covering threat landscape and attacker behaviour

* Lizzie – Blue Team Expert providing practical defensive guidance

Topics Covered

1. Industrialised Voice Phishing and AitM Campaigns

* Vishing kits enabling real-time AitM attacks now sold as-a-service

* ShinyHunters claimed breaches via vishing campaigns targeting Okta, Microsoft, Google SSO

* Microsoft documented multi-stage campaigns against energy sector with over 600 internal phishing emails

* Key takeaway: AitM credential theft is fully commoditised—SSO consolidation creates high-value targets

2. GitLab MFA Bypass (CVE-2025-0199)

* Critical authentication bypass allowing account takeover without second factors

* GitLab repositories contain source code, secrets, API keys, deployment credentials

* Compromise of privileged accounts creates genuine supply chain risk for software vendors

* Key takeaway: Patch immediately—this is emergency patching with no workarounds

3. AWS CodeBuild Supply Chain Misconfiguration

* CodeBreach vulnerability: two-character regex error in AWS CodeBuild pipelines

* Missing regex anchors allowed bypassing security filters and triggering privileged builds

* Affected AWS JavaScript SDK powering AWS Console—installed in ~66% of cloud environments

* Key takeaway: CI/CD platforms are high-value targets where small configuration errors create catastrophic risk

4. Sublime Security 2026 Email Threat Research

* Email threats shifted from malware delivery to identity compromise

* Attackers increasingly abuse trusted platforms (file-sharing services) to host phishing pages

* Significant increase in AitM-capable phishing kits and QR code phishing

* Key takeaway: Identity is the new perimeter—protecting credentials and sessions matters more than blocking malware

5. Bank of England CBEST Red Team Findings

* 13 threat intelligence-led penetration tests of major UK financial institutions

* Red teams achieved full compromise using publicly available exploits and commodity phishing

* Five weaknesses: weak passwords/plaintext storage, unpatched systems, poor monitoring, inadequate segmentation, successful social engineering

* Key takeaway: Authentication strength and detection effectiveness determine blast radius—not perimeter hardening

Key Defensive Actions

* Deploy passkeys for all external access to cryptographically prevent AitM token theft

* Enforce phishing-resistant MFA via Conditional Access policies with authentication strengths

* Patch GitLab immediately to address CVE-2025-0199 MFA bypass

* Audit CI/CD webhook configurations and regex patterns for misconfigurations

* Eliminate plaintext credential storage and enforce proper secrets management

* Segment critical assets and restrict lateral movement paths

* Implement mail filtering with behavioural analysis for trusted platform abuse

Subscribe

For weekly actionable security intelligence written for and by blue teamers:

* Newsletter: The Defensive Line on Substack

* Podcast: Available on all major platforms

This podcast is AI-generated and based on our weekly newsletter. We’re improving the format every week—your feedback helps.

Episode Overview

This week’s episode covers five critical security stories: authentication failures in enterprise platforms, regulatory enforcement driving security improvements, supply chain attacks on automation tools, Russian hacktivist DDoS campaigns, and browser extension malware campaigns.

Hosts:

* Carter – Intelligence Analyst covering threat landscape and attacker behaviour

* Lizzie – Blue Team Expert providing practical defensive guidance

Topics Covered

1. ServiceNow AI Agent Vulnerability (CVE-2025-12420)

* Critical flaw affecting 85% of Fortune 500 companies

* Three combined failures: universal credentials, email-only authentication, excessive permissions

* 2.5-month silent patching window before public disclosure

* Key takeaway: AI features need purpose-built authentication, not retrofitted legacy controls

2. French Telecoms Fined €42 Million

* FREE MOBILE and FREE fined after 16-year-old breached VPN

* 24 million subscriber records compromised

* CNIL explicitly called out weak authentication and absent detection

* Key takeaway: Regulators now treat inadequate security controls as serious GDPR violations

3. n8n Supply Chain Attack

* Malicious npm packages targeting n8n workflow automation platform

* Attackers impersonated legitimate integrations to steal OAuth credentials

* At least 9 malicious packages identified with thousands of downloads

* Key takeaway: Automation platforms are credential vaults requiring strict supply chain controls

4. NCSC Warning on Russian Hacktivist DDoS

* NoName057(16) targeting UK organisations including OT systems

* Shift from website disruption to operational technology represents escalation

* Groups coordinate through public Telegram channels

* Key takeaway: DDoS defences must cover all internet-facing services, not just websites

5. Browser Extension Malware Campaigns

* Two overlapping campaigns: enterprise targeting (2,300+ users) and GhostPoster (840,000+ installs)

* GhostPoster evaded all major browser stores for five years

* Extensions block incident response and enable session hijacking

* Key takeaway: Browser extension allowlisting is the only reliable control

Key Defensive Actions

* Deploy phishing-resistant MFA on all remote access paths (FIDO2, passkeys, certificates)

* Apply least privilege to credentials, API keys, and service accounts

* Treat automation platforms like identity providers with appropriate controls

* Implement browser extension allowlisting for all users, prioritising privileged accounts

* Do security changes proactively under control, not rushed after breaches

Subscribe

For weekly actionable security intelligence written for and by blue teamers:

* Newsletter: The Defensive Line on Substack

* Podcast: Available on all major platforms (well, only Spotify for now)

This podcast is AI-generated and based on our weekly newsletter. We’re improving the format every week—your feedback helps.