Cloud Guardrails, Supply-Chain Hardening, and Active Threats

Cloud providers rolled out new guardrails for agentic workloads, governance, and observability, while the software supply chain saw both hardening moves and fresh compromise. Threat activity remained active across destructive malware, phishing, and identity abuse, and industry reporting pointed to rising ransomware volumes. The updates collectively emphasize prevention-first controls, disciplined identity management, and improved eventing for faster incident response.

Guardrails for Agentic and Cloud Workloads

AWS added OAuth support to its Model Context Protocol environment via the AWS MCP Server, enabling standard authorization code and headless client credentials flows backed by existing IAM permissions and organizational controls. The release introduces OAuth-specific IAM actions and condition keys, Dynamic Client Registration, and token introspection and revocation APIs. OAuth grants are represented as IAM resources, allowing admins to apply familiar policies, permission boundaries, and SCPs. Additional CloudTrail events help correlate API activity with sign-in session context, supporting auditing and incident response.

Google announced Cloud Run sandboxes in public preview to safely execute untrusted or AI-generated code inside running services. Cloud Run sandboxes provide isolation from service environment variables and the metadata server, deny-by-default outbound networking (opt-in), and a read-only filesystem with a temporary in-memory overlay. Sandboxes spawn quickly within existing instance CPU/memory, integrate with the Agent Development Kit and ComputeSDK, and offer a cost-effective option for ephemeral, contained execution.

For continuous compliance, AWS expanded the coverage of managed governance checks. AWS Config now includes 191 additional managed rules across services such as Bedrock, SageMaker, ECS, EKS, RDS, Redshift, S3, and CloudTrail. The rules target encryption, logging, network exposure, data protection, and service-specific hardening, and can be deployed individually or via conformance packs to strengthen posture and reduce manual policy work.

The UK’s National Cyber Security Centre outlined a national-scale, AI-enabled defense concept. The Cyber Shield blueprint proposes coordinated “red” and “blue” AI agents for rapid vulnerability discovery, detection, containment, and eventual automated mitigation. Priorities include explainable AI, federated architectures, coordinated response, and national-scale scanning, with early focus on government and critical sectors and an emphasis on governance, auditability, and reversal mechanisms as automation expands.

Supply-Chain and Developer Ecosystem Hardening

GitHub shipped npm 12 with defaults that turn implicit behaviors into explicit opt-in, reducing package installation risk. By default, allowScripts is disabled and both --allow-git and --allow-remote default to none; users must explicitly approve scripts and commit an allowlist. The release also tightens granular access tokens (GATs), limiting sensitive operations and moving toward staged publishing with human 2FA, with guidance to adopt OIDC-based trusted publishing. Additional ecosystem changes include pnpm improvements to registry auth scoping, as detailed by The Hacker News.

Researchers reported a targeted compromise of a popular JavaScript SDK for a Layer‑1 blockchain. A malicious version of @injectivelabs/sdk-ts captured mnemonic seed phrases and private keys when wallet functions were invoked and exfiltrated the data via HTTP POST, blending with legitimate infrastructure. The tainted release (1.20.21) was quickly replaced, but was downloaded hundreds of times and pinned across related packages. Guidance urges fund transfers to new wallets and rotation of secrets, according to BleepingComputer.

Wiz described a UI deception pattern that lets AI coding agents write outside sandboxes while presenting sanitized prompts to humans. The GhostApproval issue, an instance of CWE‑451, affected multiple assistants, with several vendors issuing fixes. The finding underscores that human‑in‑the‑loop confirmation screens are not sufficient safety controls for privileged agents and reinforces the need for patch discipline, sandboxing, version pinning, and strict write controls when working with untrusted repositories.

Datadog Security Labs highlighted campaigns using dormant and compromised GitHub accounts to enumerate organizations, repositories, and users via the public API and GraphQL. The activity abuses “ghost” accounts created years earlier and exposed personal access tokens to map targets at scale, with at least one case of private repository cloning. Recommended mitigations include token rotation, least‑privilege access, inactive account hygiene, and monitoring for coordinated API patterns, per The Hacker News.

Destructive Malware and Identity‑Driven Intrusions

Microsoft analyzed a destructive Windows backdoor dubbed GigaWiper that combines a raw disk wiper, a fake ransomware module, and a multi‑pass wiper, alongside remote‑control and espionage features. Operators leveraged legitimate enterprise services for C2 and exfiltration and masked persistence as OneDrive. Recommended detection steps include monitoring scheduled tasks, enterprise messaging traffic from endpoints, and file permission modifications on boot files, as reported by The Hacker News.

Symantec detailed a rebranded ransomware family called GodDamn that uses a signed PoisonX kernel driver in a BYOVD attack to disable endpoint defenses. Operators employed AnyDesk for remote access, PsExec for lateral movement, and a NirSoft‑based credential harvester prior to encryption, with variations in appended file extensions and ransom communication methods. The signed driver’s adoption by affiliates signals continued escalation in defensive evasion, according to The Hacker News.

ZeroBEC researchers described a PhaaS platform, Forg365, that targets Microsoft 365 via device‑code phishing and AiTM proxies, augmented by AI‑generated lures and a browser extension to maintain cookie persistence. The operation leverages legitimate delivery and hosting services to blend into normal traffic. Defenders are advised to restrict device‑code authentication, monitor Entra logs and OAuth grants, and revoke/refresh tokens promptly, per BleepingComputer.

ReliaQuest identified “Helix,” a data‑extortion group that uses vishing to drive device‑code phishing, registers new authenticators for persistence, and automates SharePoint enumeration and bulk exfiltration. Mitigations include disabling device‑code authentication where feasible, restricting SharePoint to managed devices, and blocking interactions with newly registered domains, as reported by BleepingComputer.

AssuranceAmerica disclosed a breach impacting 6,998,886 people after attackers accessed portions of its IT environment and copied data files. Exposed data includes personal and policy details and driver’s license numbers. The insurer reset credentials, isolated affected systems, enhanced monitoring, and advised customers to scrutinize financial statements and credit reports, per BleepingComputer.

Infrastructure Signals and Event‑Driven Operations

Amazon Timestream for InfluxDB now emits instance and cluster lifecycle events to Amazon EventBridge, covering creates, deletes, scaling, parameter updates, maintenance, and reboots, including success and failure states. Events land on the default bus with source aws.timestream-influxdb, enabling routing to Lambda, Step Functions, SQS, SNS, and cross‑account buses for automation, notifications, and audit pipelines.

Amazon MSK Replicator can now move data between external Apache Kafka clusters and MSK Standard brokers in both directions, supporting SASL/SCRAM and mTLS. The service preserves topic names, avoids replication loops, and bidirectionally syncs consumer group offsets to support migrations, failover, and multi‑cloud distribution.

AWS Client VPN expanded to Canada West (Calgary), Mexico (Central), New Zealand, and Taipei, extending managed remote access coverage with centralized administration and pay‑as‑you‑go pricing for distributed workforces and regional compliance needs.

Darktrace described a compromise of an EC2 instance operating as a LiteLLM proxy for Bedrock that was repurposed for XMRig mining, alongside subsequent IAM activity consistent with post‑compromise persistence. The incident highlights AI gateways as concentrated control points for credentials, prompts, logs, and model access, with recommended mitigations around closing public admin paths, tightening IAM scope, and monitoring model access patterns, detailed by CSO.

Checkpoint reported higher global attack volumes, with ransomware incidents up year over year and a leadership change as “The Gentlemen” accounted for 17% of published attacks. The analysis also notes steady GenAI exposure and embedded usage patterns across organizations, reinforcing the need for prevention‑first controls across domains, per Check Point Research.

Cisco Talos tracked an expansion of Operational Relay Box networks by a China‑associated actor exploiting edge routers to deploy upgraded LONGLEASH and DOGLEASH backdoors and create decentralized proxy infrastructure. The newsletter stresses patching edge devices, monitoring for covert proxying, and using provided indicators to aid detection, as covered in Talos Intelligence.