Daily Hunt Feed - 2026-09-30

Threat Hunt Feed (2026-09-30)

Hacker News: Best

• US sanctions force The Netherlands off Microsoft and toward alternative NixOS — Tue, 29 Sep 2026 11:44:25 +0000
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Hardware (T1592.001), Server (T1584.004), Cloud Services (T1021.007), Software (T1592.002), At (T1053.002)
• 500k facial scans at UK stations yield no arrests, 1 false positive — Tue, 29 Sep 2026 11:35:18 +0000
  • Matched TTPs: Artificial Intelligence (T1588.007), At (T1053.002)

BleepingComputer

• Custom ChatGPTs push ClickFix attacks to deploy RAT malware — Tue, 29 Sep 2026 16:59:39 -0400
  • Matched TTPs: Scheduled Task (T1053.005), Malware (T1588.001), Hardware (T1592.001), DLL (T1574.001), Msiexec (T1218.007), Domains (T1584.001), Server (T1584.004), PowerShell (T1059.001), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• Hackers exploit Citrix NetScaler zero-day to deploy web shells — Tue, 29 Sep 2026 14:37:12 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Domains (T1584.001), Web Shell (T1505.003), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Former US Air Force members sent to prison over BEC attacks — Tue, 29 Sep 2026 14:09:39 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Domains (T1584.001), Email Addresses (T1589.002), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Catch threats before they escalate with real-time Identity Telemetry — Tue, 29 Sep 2026 10:01:11 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Domains (T1584.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), At (T1053.002)

Darkreading

• Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution — Tue, 29 Sep 2026 21:08:42 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Tool (T1588.002), Phishing (T1566), Exploits (T1588.005), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• ‘NeedyMantis’ Provides Long-Term Access to Compromised Networks — Tue, 29 Sep 2026 15:12:39 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Supply Chain Compromise (T1195), Masquerading (T1036), Phishing (T1566), Software (T1592.002), At (T1053.002)
• Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers — Tue, 29 Sep 2026 14:19:43 GMT
  • Matched TTPs: Malvertising (T1583.008), Hardware (T1592.001), Vulnerabilities (T1588.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), At (T1053.002)
• Nvidia Launches AI Agent Safety Platform to Prevent Rogue Activities — Mon, 28 Sep 2026 22:02:46 GMT
  • Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), At (T1053.002)

The Hacker News

• French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks — Tue, 29 Sep 2026 23:17:01 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Tool (T1588.002), Multi-Factor Authentication (T1556.006), Social Media (T1593.001), At (T1053.002)
• Russia’s Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor — Tue, 29 Sep 2026 22:50:08 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Sharepoint (T1213.002), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Email Accounts (T1585.002), Control Panel (T1218.002), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Social Media (T1593.001), Python (T1059.006), Malicious Link (T1204.001), At (T1053.002)
• 101 Malicious npm Packages Add Developers’ WhatsApp Accounts to Groups Without Consent — Tue, 29 Sep 2026 19:15:10 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), At (T1053.002)
• Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials — Tue, 29 Sep 2026 11:38:25 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions — Tue, 29 Sep 2026 10:42:32 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Tool (T1588.002), Social Media (T1593.001), At (T1053.002)
• OpenAI Pauses Tool Use After Agent Bypasses Internet Controls to Reach External Chatbot — Tue, 29 Sep 2026 10:15:20 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), DNS (T1071.004), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Search Engines (T1593.002), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)