The Deep Purple Sec – April 2026
A monthly round-up of interesting articles, reports and tools for tech experts, covering both offensive and defensive topics.
🔵 Blue Team
📘 The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Programme
This report, produced in response to Project Glasswing and Mythos, sets out a key finding: generative AI has reached a level of operational capability that enables the autonomous discovery of vulnerabilities, the creation of exploits, and the execution of complex, large-scale attacks. This will lead to an increase in the number of vulnerabilities discovered by AI. .
The imbalance between attackers and defenders is key: whilst AI speeds up patch development and reduces defects in new software, constraints on patch deployment leave defenders at a structural disadvantage.
BlackNoise notes: This document explicitly identifies the paradigm shift brought about by systems such as Mythos and sets out specific operational implications for CISOs. The most significant implication is organisational: the inability to keep pace with threats that move at the speed of machines leads to burnout amongst cybersecurity teams, which is a strategic concern on a par with technical controls.
📌 Source: https://labs.cloudsecurityalliance.org/research/ai-vulnerability-storm-mythos-ready-security-program
📘 Threat Landscape Report 2025 – A Year in Review
CERT-EU’s annual threat landscape report confirms that cyber espionage and pre-positioning are the predominant threats facing EU institutions, with the systematic exploitation of trusted relationships, partners, service providers and SaaS integrations serving as attack vectors, affecting 32 service providers in 2025.
Internet-facing systems and edge devices (firewalls, VPN appliances, network management solutions) remained the initial access vector with the greatest impact. Conventional MFA was bypassed through man-in-the-middle attacks, OAuth abuse and session token theft. Social engineering now includes voice phishing (enhanced by voice cloning), ClickFix browser-based prompts, device code abuse and the exploitation of messaging platforms, outpacing legacy defences. A Sandworm-linked wiper attack against a Polish renewable energy operator signals the expansion of destructive operations to targets adjacent to the EU.
BlackNoise note: The report’s most operationally significant finding is the convergence of identity abuse and supply-chain compromise: threat actors target the entire SaaS integration graph, API connections, marketplace extensions and cross-platform OAuth grants, which are largely unmonitored by most organisations.
📌 Source: https://cert.europa.eu/publications/threat-intelligence/tlr2025
⚙️ YARA Rule Skill
YARAHQ publishes yara-rule-skill, an LLM capability that transforms a general-purpose AI agent into a YARA expert. Created by the author of YARA-Forge and yaraQA, it is recognised as a legitimate technical tool within the detection engineering community. It is designed for MCP-based platforms (OpenClaw, Claude Desktop) and activates automatically when a YARA rule is submitted.
The skill incorporates three consolidated repositories: YARA performance guidelines, a style guide (naming conventions MAL_, HKTL_, SUSP_, string prefixes $x*/$s*/$a*/$fp*), and automated checks from yaraQA covering logical errors (CE1, SM1–6, DS1), performance issues (PA1–2, RE1, CF1–2, PI1), style violations (SV1–2), and resource problems (HS1–4). The agent can write, review, optimise and validate rules through natural conversation.
BlackNoise note: For detection engineering teams: This skill automates quality reviews that are typically manual and time-consuming, including short atoms, unanchored regular expressions and poorly ordered conditions. It integrates directly into rule review workflows via any compatible MCP agent.
🔴 Red Team
📝 Malicious Checkmarx Artifacts Found in the Official KICS Docker Repository and Code Extensions
Socket has uncovered a supply chain attack targeting Checkmarx’s distribution channels: KICS images on Docker Hub, the VS Code/OpenVSX extension ‘ast-vscode-extension’, and GitHub Actions. The threat actor is TeamPCP.
The trojanised VS Code extension fetches mcpAddon.js from a backdated Checkmarx GitHub commit, then executes it via Bun. The payload harvests GitHub tokens, AWS/Azure/GCP credentials, SSH keys, .npmrc tokens, environment variables and MCP configuration files, exfiltrating them to the audit checkmarx[.]cx/v1/telemetry. It injects a malicious Actions workflow to dump repository and organisation-level secrets as artefacts, uses stolen npm credentials to republish the victim’s packages across npm, and stages data in public repositories created by the attacker, with stolen tokens included in the commit messages.
BlackNoise notes: Retrieving payloads from the vendor’s GitHub repository bypasses most pipelines that whitelist raw.githubusercontent.com. Combined with self-propagating CI/CD and an npm compromise, this represents a sophisticated supply chain worm design.
📌 Source: https://socket.dev/blog/checkmarx-supply-chain-compromise
📝 EvilTokens: an AI-enhanced Phishing-as-a-Service for automating BEC fraud – Part 2
Identified by Sekoia TDR in early March 2026, EvilTokens is a Microsoft device code PhaaS featuring AI-driven automation of post-compromise BEC fraud.
The platform operates via Telegram and charges affiliates $1,500 for life + $500 per month. Once tokens have been harvested, affiliates gain access to an admin panel featuring session monitoring, team management and simultaneous multi-account access via stolen tokens. .
The AI pipeline executes parallel Graph API calls across /contacts, /events, /mailFolders, /manager, and /organisation to build a reconnaissance profile. It ingests up to 5,000 emails via the Groq API using jailbroken prompts. The output includes a BEC score, ranked financial exposures, thread hijack scenarios with impersonation parameters, and three ready-to-send BEC emails. .
BlackNoise notes: The token-to-BEC pipeline is completed in a matter of minutes. Defenders should monitor for anomalous OAuth device code flows, bulk Graph API enumeration following authentication, and Conditional Access policies restricting the device code grant type. Detection of the X-Tenant-Secret and X-Real-IP headers in proxy logs can serve as indicators of the backend infrastructure.
📝 Snow Flurries: How UNC6692 Used Social Engineering to Deploy a Custom Malware Suite
GTIG documented UNC6692 deploying a custom three-component malware ecosystem («SNOW») following a Teams-based social engineering campaign. The intrusion begins with email bombing and the impersonation of IT helpdesk staff via Microsoft Teams, directing victims to a fake «Mailbox Repair Utility» hosted on attacker-controlled AWS S3 buckets.
The landing page enforces Edge-only execution, harvests credentials via a double-entry rejection trick, and stages payloads behind progress-bar distractions. Initial access is achieved using AutoHotKey to execute SNOWBELT, a Chromium extension deployed outside the Web Store as «MS Heartbeat». ’ SNOWBELT uses a time-based DGA (30-minute slots) to resolve S3-hosted C2 manifests, decrypted using AES-GCM, and utilises browser push notifications for asynchronous command delivery. SNOWBASIN provides a local HTTP backdoor (port 8000) for remote shell access, file exfiltration and screenshots. SNOWGLAZE establishes an outbound WebSocket SOCKS tunnel to a Heroku C2 server, masquerading as Edge traffic. Following compromise, the actor scans ports 135/445/3389, executes PsExec commands on a backup server, dumps LSASS via Task Manager, exfiltrates data via LimeWire, then pivots to domain controllers using Pass-the-Hash. NTDS.dit, SAM, SYSTEM, and SECURITY hives are extracted and exfiltrated.
BlackNoise notes: UNC6692's «living off the cloud» strategy – using C2 on AWS S3 and Heroku, with payloads blending into encrypted traffic – renders domain reputation and IP-based blocking ineffective. Detection relies on behavioural signals: headless Edge processes loading unpacked extensions (--load-extension to non-standard paths), scheduled tasks that launch Edge with --headless=new, LSASS memory access from taskmgr.exe, FTK Imager on domain controllers, and outbound WebSocket connections to Heroku subdomains. SNOWBELT’s S3 URL pattern ([a-f0-9]-[0-9]-[0-9].s3.us-east-2.amazonaws.com) and the hardcoded VAPID key are actionable network IOCs. The modular architecture, browser extension, Python tunnel, local backdoor and forensic correlation of fragments: no single component reveals the full chain, making cross-layer visibility essential for early detection. Restricting the initiation of external Teams chats via Conditional Access is the most effective preventative control. We translate this attack chain into an executable BlackNoise scenario, so that Blue Teams can validate their detection capabilities against the exact TTPs documented (https://erium.fr/from-threat-report-to-detection-scenario-simulating-unc6692s-post-compromise-tradecraft-on-blacknoise
📌 Source: https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware
Never trust, always check