Netcrook
#LLM
Passkeys Become the Bait: A Vishing Crew Turns Microsoft Entra Enrollment Into a Trap
A panel-driven phishing operation is using fake security calls to pressure Microsoft 365 users into registering a new passkey, showing how identity attacks can target the enrollment process instead of the login itself.
When an AI Gateway Turns Into a Miner: The Quiet Theft of Cloud Compute
A compromised AWS-hosted AI gateway tied to Amazon Bedrock shows how generative AI middleware can become valuable enough to hijack for cryptocurrency mining.
Datadog’s AI Push Turns Incident Response Into a Governed Machine
At Dash 2026, Datadog put Bits AI and its AI governance stack at the center of a strategy built on faster triage, tighter model control, and less blind trust in agentic systems.
The Fake Passkey Trap: How Vishing Is Moving Into Identity Enrollment
A reported Microsoft Entra-themed scam shows why attackers are now targeting the moment a user adds a new sign-in method, not just the login page.
When the Demo Ends, the Real Work Begins: How AI Projects Survive Production
LLMOps and AIOps are less about spectacle than discipline: the controls that keep model quality, latency, governance, and cloud spend from drifting out of bounds once real users arrive.
Fake Passkey Enrollment Is Becoming the New Front Door for Microsoft 365 Intrusions
A vishing-led campaign is abusing the trust users place in passkey onboarding, showing that phishing resistance can still be undermined at the enrollment step.
How a Phone Call Can Become a Cloud Break-In
A recently reported extortion operation shows how voice phishing, device-code login abuse, and rushed MFA enrollment can turn Microsoft 365 identity controls into a pathway for data theft.
When a Model’s Guess Becomes a Supply-Chain Trap
A newly named technique turns AI coding mistakes into a security boundary problem, showing how a hallucinated identifier can become a dangerous trust decision.
AI Agents Are Learning to Trust the Wrong Text
A new research update from CrowdStrike pushes prompt injection into a more methodical phase, where defenders are tracking attack families instead of chasing isolated jailbreak tricks.
When LLMs Translate More Than Words, They Expose the Shape of Thought
A recent Italian essay turns LLMs into a test case for universal translation, asking whether models are learning shared structures across languages, code, and genres - and what that means for knowledge itself.
When Botnets Start Renting Brainpower: The Quiet Rise of AI Compute Abuse
A report-level claim about Mycelium points to a darker pattern in cybercrime: stolen AI keys, compromised hosts, and local model runtimes being folded into one illicit compute pipeline.
When Chat Becomes Action: The Quiet Shift Toward Agentic AI at Work
The real change is not a smarter chatbot, but software that can take steps, coordinate tasks, and move from suggestion into execution with human oversight.
Hallucinated Names, Real Control: The AI Weak Spot Behind a New Botnet Playbook
A reported technique called HalluSquatting shows how an LLM’s confidence can become an attacker’s entry point when agents are allowed to fetch or run what the model invents.
The AI Boom Is Becoming a Balance-Sheet Stress Test
Behind the chip rush, the harder question is whether promised compute, datacenters, and revenue can arrive fast enough to justify the capital now pouring into the LLM race.
The Quiet Attack That Turns AI Instructions Against Themselves
Prompt injection is less about breaking a model and more about tricking a system into treating hostile text as trusted instruction - a growing problem for AI tools that browse, retrieve, and act.
When a Filing Starts Talking Back: The Hidden Prompt Risk Inside Court Documents
A Brazilian labor-court decision has put a rare but serious AI security problem on the map: untrusted legal text can become a hidden instruction only if an LLM-based workflow reads it as context.
When AI Governance Becomes the Real Casino Bet
The sharpest AI strategy is not blind speed or perfect caution - it is disciplined risk-taking backed by controls that let teams learn without losing the table.
When AI Skills Become the Payload: Static Scanners Lose Sight of the Trap
A new supply-chain risk in LLM coding agents shows why install-time checks can miss malicious skill packages that only reveal their behavior once execution begins.
When the Model Becomes the Attack Surface: Why AI Red Teaming Matters Now
A July 2026 explainer on testing LLMs for weaknesses points to a bigger shift in security: generative AI now needs adversarial testing, not just product tuning.
When an AI Agent Becomes the Intruder: The JadePuffer Case Redraws the Ransomware Map
Researchers believe JadePuffer is the first documented ransomware operation run entirely by an LLM agent, a warning that exposed AI workflow servers can become both the foothold and the control plane for extortion.