Elastic Security Labs
elastic-seclabs · B · active
https://www.elastic.co/security-labs
Elastic Security research. 2026-05-08 audit: 5 dated articles 5-8 May 2026 (TCLBANKER, Traefik, AI hunting). | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.elastic.co/security-labs (listing) then webfetch www.elastic.co/security-labs/<slug> for body. AVOID: Nothing — webfetch works cleanly on both listing and article. | 2026-07-05 admiralty audit: B — vendor research lab, first-hand original research; live, keep active.
Cited in 9 entries
Citation cadence
Citation days per ISO week (11 weeks of coverage span, total 8).
- CHAINDROP — the Shai-Hulud npm worm returns through the keyv maintainer, backdoors 400+ packages, and resolves its exfiltration endpoint from an Ethereum smart contract2026-08-06
- The autonomous-attacker claim got measured this week rather than argued — and the AI toolchain became the vulnerable surface while AI-assisted review failed as an assurance control2026-08-02
- The Hugging Face AI-agent intrusion, from the detection side: the worker was reached through its own dataset loader, and the agent's mistakes are a triage signal2026-07-31
- npm / developer-ecosystem supply-chain wave status: AsyncAPI was the week's marquee compromise, and DPRK's Contagious Interview broadened the developer-as-target vector from package poisoning to CI/CD pipelines and job-interview repos2026-07-19
- ClickFix was the week's universal crimeware delivery vector, and macOS gained a coercion playbook — five families this week converged on paste-into-terminal delivery, local password validation before theft, and decentralized dead-drop C22026-07-19
- Contagious Interview (DPRK) hides an OTTERCOOKIE-aligned payload in SVG-comment steganography inside fake coding-interview repos2026-07-18
- TELEPUZ — a modular Windows RAT/MaaS spread through ClickFix→Vidar chains, executing syscalls from patched trusted DLLs2026-07-16
- Elastic shows how the newly-GA Azure AD Graph Activity Logs close a long-standing Entra enumeration blind spot2026-06-23
- Tycoon 2FA after the March 2026 takedown: two-tier AiTM operator architecture and the OAuth device-code variant2026-05-27