CodeAIntel

CodeAIntel

Home
Threat Intelligence
AI Research
Darknet and Hacking Forums
Data Breaches
Four Days Offline Inside a Resilient Grid
A cyberattack reportedly shut a small UK generator for four days without threatening the wider grid. Local operational loss still counts.
 • Tom
The Lock Screen Was the Credential Phish.
SynkLoader turns a Teams help-desk lure into a local Windows password prompt, reverse proxy, and remote-control stack. The useful detection point is the…
 • Tom
Patch the Server. Then Audit Every Installer It Served.
CISA added two exploited TrueConf flaws to KEV. Researchers found attackers replaced a client installer with a trojanized copy carrying PhantomCore…
 • Tom
The Charges Are New. The Credential Playbook Is Not.
DOJ's expanded Mabna Institute case describes personalized phishing, password spraying, and valid-account abuse. Credential dumps can feed the same…
 • Tom
The Extension ID Stayed Put. The Payload Changed.
A 77-extension Firefox corpus tied stable add-on identities, cloned code, shared infrastructure, and version histories to wallet and credential…
 • Tom
A Web Page Should Not Reach Your AI Control Plane
CISA's active-exploitation warning for Ray CVE-2025-62593 exposes a broader weakness: local and private compute services can still be reachable through…
 • Tom
Put Private Cyber Power Under Public Command
The White House is right to mobilize vetted U.S. companies against foreign cybercriminal networks—as long as target selection, legal authority, and…
 • Tom
The Router Was Waiting for Whoever Answered
Researchers found a root-running phone-home component embedded across 20 router models. It needs no inbound exposure, trusts any answering endpoint, and…
 • Tom
The Malware Arrived With Valid Provenance
A fast-moving npm compromise used a maintainer's own release workflows to ship verifiably sourced malicious builds. The attestation was valid; the…
 • Tom
The Patch Closed One Door. The Bypass Took Another.
CISA says CVE-2026-18577 is actively exploited. The incomplete fix for CVE-2026-18556 makes patch lineage, exact-build proof, and preserved artifacts…
 • Tom
No Passwords Reported. Plenty of Pretext.
PNLD reports no evidence of credential compromise. Exposed police and justice identities—and the names of some Ask the Police users—still give…
 • Tom

July 2026

© 2026 Tom · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture