Elastic Security Labs
elastic-seclabs · B · active
https://www.elastic.co/security-labs
Elastic Security research. 2026-05-08 audit: 5 dated articles 5-8 May 2026 (TCLBANKER, Traefik, AI hunting). | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.elastic.co/security-labs (listing) then webfetch www.elastic.co/security-labs/<slug> for body. AVOID: Nothing; webfetch works cleanly on both listing and article. | 2026-07-05 admiralty audit: B, vendor research lab, first-hand original research; live, keep active. | 2026-10-11 quality audit: the RSS feed parses with 30 dated items; feed first, extract per article.
Cited in 9 entries
Citation cadence
Citation days per ISO week (18 weeks of coverage span, total 9).
- REF9334/KREMLIN forges Chromium's own Secure Preferences integrity hashes to silently install a banking-fraud browser extension outside the Web Store, resolving C2 through an Ethereum smart contract2026-09-21
- CVE-2026-73570, Zimbra Collaboration: a pre-auth command injection patched without a CVE in July is exploited, with probing before disclosure and root escalation, secret theft and cluster-wide movement observed2026-08-20
- Elastic catches Claude Code standing up a reverse tunnel and installing LaunchAgent persistence on a real macOS developer endpoint2026-08-08
- CHAINDROP: the Shai-Hulud npm worm returns through the keyv maintainer, backdoors 400+ packages, and resolves its exfiltration endpoint from an Ethereum smart contract2026-08-06
- Hugging Face: a fully autonomous AI agent breached production, ran 17,000+ actions before detection2026-07-21
- Contagious Interview (DPRK) hides an OTTERCOOKIE-aligned payload in SVG-comment steganography inside fake coding-interview repos2026-07-18
- TELEPUZ, a modular Windows RAT/MaaS spread through ClickFix→Vidar chains, executing syscalls from patched trusted DLLs2026-07-16
- Elastic shows how the newly-GA Azure AD Graph Activity Logs close a long-standing Entra enumeration blind spot2026-06-23
- Tycoon 2FA after the March 2026 takedown: two-tier AiTM operator architecture and the OAuth device-code variant2026-05-27