☀️ Good morning. Here's everything that happened in cybersecurity yesterday — in under 5 minutes.
Wiz put a name to the crates.io compromise, tying the poisoned Rust packages to North Korean supply-chain operations through shared command-and-control infrastructure, while Abnormal documented a $10,000 phishing kit that quietly registers an attacker-controlled passkey so a password reset no longer evicts anyone. Check Point showed that Microsoft Defender's own signed remediation driver can be turned into a kernel operation primitive on fully patched Windows 11, and Trend Micro's TrendAI flagged 14 trojanized npm packages dropping a Linux backdoor with a natural-language control layer. On the policy side, TikTok agreed to pay $400 million to settle the Justice Department's child-privacy suit. The common thread: yesterday's attacks did not break anything, they registered into things that were already trusted.
🔥 Top Stories
01 — North Korean Operators Linked to the crates.io Rust Compromise
Nation-State / Supply Chain
Wiz researchers tied the compromise of arrayref, internment, and append-only-vec to recent North Korean supply-chain activity, matching the attacker's command-and-control infrastructure to the campaigns that poisoned the Mastra and axios npm packages earlier this year. The crates were republished from a compromised maintainer account, each carrying a typosquatted proc-macro1 dependency whose build script ran an infostealer at compile time. Wiz built the case on where the malware connected rather than on the code: the payload beacons to the request path /49890878, the same endpoint seen in the Mastra compromise attributed to Sapphire Sleet, and the beacon IP shares an SSL issuer with infrastructure from that activity. arrayref alone carries roughly 245 million all-time downloads and sits in about three-quarters of the cloud environments running Rust, per Wiz telemetry. The poisoned releases were live for 86 to 107 minutes before the Rust Security Response Team pulled them, and the team found no evidence any of them were used.
This is a strong lead built on infrastructure overlap, not a confirmed cross-vendor verdict, and that distinction should shape how you act on it. The remediation does not wait on attribution: grep lockfiles across your repositories for arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, and the attacker-controlled crate names, pin arrayref at 0.3.9 or earlier, and search the local registry cache on build hosts and developer machines. Treat any workstation or CI runner that compiled an affected project as compromised: reset browser-stored logins and rotate cloud secrets, tokens, and signing keys reachable from those hosts. The durable detection is outbound network calls during cargo build, cargo check, or cargo test.
02 — Phishing Kit Registers Attacker Passkeys That Survive a Password Reset
Identity & Phishing
Abnormal documented iAuthFlow V2, a phishing toolkit advertised for $10,000 on a Russian-language cybercrime forum, that silently enrolls an attacker-controlled passkey on the account it compromises. Because a passkey is a FIDO2 credential registered to the account rather than a token derived from the password, it outlives both of the moves at the top of nearly every phishing-response playbook. A password reset invalidates what hangs off the password, and session revocation kills the browser cookies keeping an attacker signed in. Neither touches a separately registered authenticator, so the incident closes on paper while the access stays open.
The exposure is not Gmail-specific. Any identity provider supporting passkeys, from Okta to Microsoft Entra ID, has the same structural property, and passkey adoption has climbed for two years on vendor pushes to make them the phishing-resistant default. The fix is a runbook change, not a purchase: when an account is reset for suspected phishing, enumerate every passkey and security key on it and confirm each one with the user, alert on registration events that land minutes after a suspicious sign-in from an unfamiliar device, invalidate and re-enroll authenticators outright for high-value accounts, and page someone when a new passkey appears on an executive, admin, or finance account. Write the passkey-enumeration query for your identity provider before you need it.
03 — Defender's Own Signed Driver Can Be Repurposed as a Kernel Primitive
Vulnerability Research
Check Point Research disclosed that BTR.sys, Microsoft Defender's legitimately signed Boot Time Removal driver, can be redirected into a kernel operation primitive for arbitrary file and registry changes across Windows 7 through Windows 11 25H2. Repurposed, it deletes locked files and directories, moves files into protected paths, and creates or deletes registry keys, executing from Ring 0 and attributed in telemetry to the System process. Nothing is broken in the process: no outside driver is imported and no software flaw is exploited. In a live Black Hat USA 2026 demonstration, the proof-of-concept removed the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection enabled. Check Point published the paper and tool on August 20, 2026.
The technique requires an account that is already an administrator and holds SeLoadDriverPrivilege, and Microsoft's Security Response Center confirmed on that basis that the findings do not meet the criteria for immediate servicing. So there is no patch coming, and the vulnerable-driver blocklist structurally cannot cover a required Defender component. Two actions follow. Audit where SeLoadDriverPrivilege has been granted and pull it back to the smallest possible set of accounts, which is the highest-leverage hardening step available. Then build detections around Check Point's published indicators, starting with a driver load immediately followed by a file deletion attributed to the System process. Note the history here: SentinelLabs disclosed CVE-2021-24092 in the same tool in 2021.
04 — TrendAI Flags 14 npm Packages Dropping an AI-Assisted Linux Backdoor
Malware / Open Source
Trend Micro's TrendAI team disclosed 14 trojanized npm packages posing as calendar and streak utilities while delivering RedC2 4.0, a cross-platform Linux backdoor carrying an AI-assisted command-and-control layer marketed as Red Agent that turns natural-language intent into framework commands. Each package carries a bundled binary disguised as a math accelerator, and the packages work as advertised, so a developer who pulls one in gets a functioning date helper alongside the implant. The critical detail for defenders is the trigger: the payload fires on import rather than on install, which sidesteps the install-script hardening npm shipped this year, because importing a module is the ordinary act of using it. TrendAI notes a transitive import is enough, meaning a team can pull in the malicious code without ever listing one of the 14 packages in its own manifest.
Inventory your npm dependency tree, direct and transitive, against TrendAI's published package list and treat any match as malicious. Be clear-eyed about what remains open: the disclosure does not publish install or download counts, so real-world exposure is unquantified, it is not confirmed whether npm has removed all 14, and attribution is unsettled because RedC2 4.0 is a commercial framework rather than one actor's private tool. That commercial status is the part worth carrying forward, since it means the AI control layer is available to anyone who pays.
05 — TikTok Agrees to $400 Million Child-Privacy Settlement With DOJ
Policy & Privacy
The Justice Department announced Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit alleging the platform violated U.S. child privacy law. Under the terms, TikTok pays $300 million immediately, with a further $100 million contingent on entry of an order vacating a prior consent decree against the company.
The figure sets a reference point for children's-privacy enforcement that compliance teams at consumer platforms should be reading closely, particularly the structure that ties a portion of the payment to unwinding an earlier decree. If your product collects data from users who may be under 13, the practical takeaway is to revisit age-gating, retention windows, and third-party SDK data flows before a regulator does it for you.
📊 By The Numbers
245 million — All-time downloads of arrayref, the most widely used of the three compromised Rust crates, per Wiz telemetry.
86 to 107 minutes — How long the poisoned crates.io releases were live before the Rust Security Response Team pulled them.
$10,000 — Advertised price of the iAuthFlow V2 phishing toolkit on a Russian-language cybercrime forum.
14 — Trojanized npm packages TrendAI tied to the RedC2 4.0 Linux backdoor.
$400 million — TikTok's settlement with the DOJ over child-privacy claims, $300 million of it payable immediately.
⚡ The Signal
Four of yesterday's five stories describe the same maneuver from different angles: nothing was broken, something trusted was simply used. The crates.io payload rode a legitimate maintainer account and a build script, which is executable code by design. iAuthFlow V2 does not defeat passkeys, it registers one, using the enrollment path exactly as specified. BTR.sys is signed by Microsoft and doing something close to what it was built to do. The npm packages deliver working calendar utilities. In none of these cases is there a flaw with a CVE and a patch queue behind it, which is why Microsoft declined to service the Defender finding at all.
That has a direct consequence for how defense gets funded and staffed. The controls that answer this class of problem are inventory controls, not patching controls: which authenticators are registered on this account, which crates are pinned in this lockfile, which accounts hold SeLoadDriverPrivilege, what is actually in the transitive dependency tree. Those are unglamorous, they never produce a clean "resolved" ticket, and they are the only lever that works when the adversary's entry point is a legitimate trust relationship rather than a bug. The remediation advice across all four stories converges on the same verb, and it is audit.
The second thread is price. A $10,000 toolkit that defeats the standard phishing runbook, and a commercial backdoor framework whose selling feature is a natural-language operator interface, both point at capability that used to require a skilled operator now shipping as a product with support. The North Korean attribution in the Rust case came from infrastructure overlap precisely because tooling is increasingly shared and reused rather than bespoke. Expect the gap between nation-state tradecraft and commodity crimeware to keep narrowing, and expect the tell to keep being infrastructure rather than code.
The practical read for this week: pick one enrollment surface and one dependency surface, and go enumerate them. Passkeys registered on your privileged accounts, and lockfiles across your build hosts. Neither will feel urgent on Monday, and both are where yesterday's stories actually land.
🔍 What You May Have Missed
Banking Trojans Manic, Grandoreiro and ToxicPanda 2.0 in the Spotlight — Three concurrent campaigns: the spyware-equipped Manic, a persistent Grandoreiro push across Latin America and Europe, and an expanded ToxicPanda 2.0. Worth reviewing your mobile banking fraud controls if you operate in those regions.
AWS Security Makes an Inscrutable Choice on Leaked Credentials — An argument that quarantining leaked credentials rather than revoking them leaves customers exposed. If you rely on AWS to catch your leaked keys, understand what that safety net does and does not do.
Your Expired Visa Card Could Be 'Zombified' to Make Contactless Payments — WIRED's weekly roundup also covers an unprecedented volume of Apple spyware notifications and Ukrainian cyber and drone strikes on a Russian ecommerce firm.
📅 What to Watch
Frontier AI Labs Still Won't Say How They'd Contain a Rogue Model — A new study finds leading labs have few publicly documented containment plans. Expect this to become a procurement question as enterprises formalize AI vendor due diligence.
Securing the Overlooked Corners of the SDLC Supply Chain — Unit 42 argues attackers are shifting to CI/CD pipelines and developer tooling rather than application code, which is exactly the pattern behind both supply-chain stories above.
If You're Not Using AI to Attack Your Own Systems, Your Adversaries Will — The case for AI-assisted offensive testing, plus the flip side: agents are themselves a new attack surface. A theme to expect throughout the fall conference season.
Postal Service Moves to Finalize Mail Ballot Rules Before SCOTUS Ruling — Rules already rejected by multiple state courts are being finalized ahead of a possible favorable Supreme Court decision. Election-infrastructure teams should track the timeline.
Stay sharp. Stay ahead.
Till next time,
The CyberSignal Team