Daily Hunt Feed - 2026-10-27

Threat Hunt Feed (2026-10-27)

Hacker News: Best

• Switzerland. Block by block. At 1:1 scale — Mon, 26 Oct 2026 08:46:09 +0000
  • Matched TTPs: Hardware (T1592.001), Server (T1584.004), At (T1053.002)
• Behind the scenes at the NeXT Computer office — Mon, 26 Oct 2026 03:31:11 +0000
  • Matched TTPs: At (T1053.002)

BleepingComputer

• PHP2Shell security flaws now sucessfully exploited in the wild — Mon, 26 Oct 2026 05:19:57 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)

Darkreading

• In-the-Wild Attack Abuses AI Agents’ Trust in Markdown — Mon, 26 Oct 2026 20:59:26 GMT
  • Matched TTPs: Malware (T1588.001), Malicious File (T1204.002), Vulnerabilities (T1588.006), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
• ‘Gheist’ Weaponizes GitHub Tokens to Steal Cloud Secrets — Mon, 26 Oct 2026 18:01:40 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• 10 Software Security Practices Built for the Next 250 Years — Mon, 26 Oct 2026 14:00:00 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Software (T1592.002), At (T1053.002)
• Trust Is Not What It Seems — and Fraudsters Are Counting on It — Fri, 23 Oct 2026 20:57:56 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), Impersonation (T1656), At (T1053.002)

The Hacker News

• Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento — Mon, 26 Oct 2026 23:42:22 +0530
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw — Mon, 26 Oct 2026 23:15:57 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002), Compression (T1027.015)
• Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware — Mon, 26 Oct 2026 21:22:40 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Server (T1584.004), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Email Bombing (T1667), Impersonation (T1656), Python (T1059.006), At (T1053.002)
• ⚡ Weekly Recap: This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More — Mon, 26 Oct 2026 19:36:13 +0530
  • Matched TTPs: Keylogging (T1056.001), Sharepoint (T1213.002), Artificial Intelligence (T1588.007), JavaScript (T1059.007), Malware (T1588.001), Social Media Accounts (T1585.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Process Injection (T1055), Private Keys (T1552.004), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Tool (T1588.002), Phishing (T1566), Lua (T1059.011), Software (T1592.002), Input Capture (T1056), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes — Mon, 26 Oct 2026 17:22:41 +0530
  • Matched TTPs: Serverless (T1584.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations — Mon, 26 Oct 2026 14:05:51 +0530
  • Matched TTPs: Adversary-in-the-Middle (T1557), IP Addresses (T1590.005), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Email Accounts (T1585.002), Domains (T1584.001), Server (T1584.004), Password Spraying (T1110.003), Proxy (T1090), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), Conditional Access Policies (T1556.009), At (T1053.002)
• Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware — Mon, 26 Oct 2026 11:33:48 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Malicious File (T1204.002), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Proxy (T1090), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)