Week of September 1, 2025

A technique using raw disk reads to directly access sensitive files like SAM and NTDS.dit was demonstrated, bypassing filesystem ACLs, exclusive file locks, and EDR solutions that monitor higher-level API calls. This method allows attackers to extract credentials without triggering endpoint detection.

A vulnerability in Electron's code integrity checks allows attackers to tamper with V8 heap snapshot files, bypassing the EnableEmbeddedAsarIntegrityValidation and OnlyLoadAppFromAsar fuses. This enables persistent backdooring of Electron-based applications like Signal, 1Password, and Slack without triggering OS code-signing or integrity checks. The issue affects applications installed to user-writable locations and can be exploited for stealthy persistence.

Hexstrike-AI, a newly released AI-powered offensive security framework, orchestrates over 150 specialized agents to autonomously scan, exploit, and persist in targets. Within hours of release, threat actors discussed weaponizing it against Citrix NetScaler zero-days, claiming to reduce exploitation time from days to under 10 minutes. The framework's architecture allows high-level intent to be translated into precise technical actions, lowering the skill barrier for complex attacks.

Palo Alto Networks suffered a data breach after attackers used compromised OAuth tokens from the Salesloft Drift supply chain attack to access its Salesforce CRM. Exposed data includes business contact information, account records, and basic support case data, but no technical support files or attachments. The incident did not affect any Palo Alto Networks products, systems, or services.