CERT-UA says attackers planted fake Cloudflare checks on more than 100 legitimate websites to get visitors to install Lunex Stealer themselves. Ontinue says its browser components can keep file access after the stealer is deleted, so cleanup has to reach the browsers.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives25
- Confidence70
buildOne report1 publisher 167 of 1,383 public Claude Code mods break on Windows by calling Unix-only tools
A review of 1,383 public Claude Code mods found that 167 break on Windows because they call Unix tools like tail and open through $.process.run. The call uses no shell, so a tool Windows does not ship rejects on launch.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence48
Attackers hide malware from Microsoft Defender by adding scan exclusions
Huntress details four ways attackers who already hold administrator rights add Microsoft Defender exclusions to keep malicious files out of every scan. A registry value can also hide those exclusions from any admin who checks for them.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+8
- Incentives62
- Confidence60
Fake custom GPTs on chatgpt.com open an eight-stage ClickFix malware chain
Huntress traced at least two of more than 40 ClickFix malware incidents to fake custom GPTs on OpenAI's chatgpt.com. On that route every hop before the PowerShell command sat on a Google or OpenAI address, so staff taught to trust familiar domains would click through each one.
Reality
- Evidence45
- Adoption20
- Hype gap+20
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher A release-gate scanner printed PASS for two months while scanning zero files
One developer's secrets scanner printed PASS before every release for two months while matching zero files, according to a dev.to post. The fix gives a scan of nothing its own failing exit code, so a broken check stops looking clean.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence55
Microsoft has removed the legacy WMIC binary rather than deprecating it again. WMI itself stays, so admin scripts and detection content keyed to wmic.exe both need rework this cycle.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 67%
- Investor
- Investor 5%
Reality
- Evidence72
- Adoption65
- Hype gap+15
- Incentives
- Not scored
- Confidence74
Check Point Research says exposed directories revealed the logs, source code and management tooling behind StopAndProtect, a campaign it links to more than 5,000 infected machines.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 63%
- Investor
- Investor 7%
Reality
- Evidence62
- Adoption30
- Hype gap+10
- Incentives55
- Confidence65
Microsoft's TerminalFix writeup shows the same fake CAPTCHA lure now feeding multi-line PowerShell into Windows Terminal, where it sideloads a signed binary, pulls payloads out of PNG files and leaves a reverse tunnel behind.
Perspective Coverage
4 publishers
- Builder
- Builder 20%
- Operator
- Operator 75%
- Investor
- Investor 5%
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+20
- Incentives30
- Confidence65
third-party.com is an ordinary registered domain that developer documentation has used as a stand-in for years. It currently answers with a fake Cloudflare check that tells Windows users to paste a PowerShell command into the Run box.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence70
Securonix pulled four scheduled tasks and a Startup folder copy out of one infected machine, and the two PowerShell modules restart each other. Delete the desktop script and the backdoor keeps collecting documents.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher Role-based journeys turned up a 429 before they produced a usable p95
Extending a PowerShell endpoint suite with roles, sessions and think time exposed authentication, contract, cleanup and rate-limit defects first. The nine journey sessions still share three accounts, one per role.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−18
- Incentives20
- Confidence52
ClickFix crews are staging the second stage inside Binance Smart Chain smart contracts
Blackpoint's SOC worked an incident where a fake captcha on the victim company's own WordPress site ran a hidden PowerShell downloader, and the campaign's later stage sits in a blockchain contract no provider can pull.
Publishers:blackpointcyber.com
Reality
- Evidence60
- Adoption30
- Hype gap+15
- Incentives65
- Confidence55
APT36 hides Operation RapidRust command traffic inside private GitHub repositories
Zscaler ThreatLabz says the Pakistan-aligned group worked government and defense targets in India and Afghanistan with four undocumented tools, one of them a Rust backdoor that takes its orders from files in a private repo.
Reality
- Evidence40
- Adoption25
- Hype gap+18
- Incentives65
- Confidence45
buildOne report1 publisher Conditional PutItem claim on orderId blocks duplicate charges from repeated SQS messages
SQS standard queues and Lambda event source mappings both deliver at least once, and that guarantee is about the envelope. A lab in us-east-1 sent the same 150-real order four times and logged four charges.
Reality
- Evidence56
- Adoption
- Not scored
- Hype gap−8
- Incentives22
- Confidence62
buildOne report1 publisher A running Windows process keeps the PATH it inherited at creation
A fresh terminal resolves ffmpeg while the IDE on the same machine says the tool is missing. The difference is the environment block each process got when it was created, and Windows sends no update to a process already running.
Reality
- Evidence76
- Adoption
- Not scored
- Hype gap−12
- Incentives18
- Confidence70
buildOne report1 publisher One system-prompt rule kept this local 27B from burning its whole context on a Splunk repair
A quantised 27B on one 16GB GPU audited a home Splunk and Sysmon install with nothing leaving the host. Its first repair attempt ran the 128K context window dry. A halt rule in the system prompt got it under control.
Reality
- Evidence38
- Adoption9
- Hype gap+22
- Incentives32
- Confidence44
buildOne report1 publisher September's Office update stops Excel pasting on perpetual and volume installs
A dev.to writeup pins silent copy/paste failures in Excel 2016 through 2024 on KB5002914, and says MSI machines can drop the patch while volume Click-to-Run installs have to be moved back a whole build.
Reality
- Evidence30
- Adoption20
- Hype gap+30
- Incentives40
- Confidence45
buildOne report1 publisher An external app with user consent reads mail without holding an account in the tenant
Microsoft's guidance on illicit consent grants says password resets and MFA do not touch the access, and it sends admins to the Purview audit log, where the entry can take up to 24 hours to appear.
Publishers:learn.microsoft.com
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap−12
- Incentives58
- Confidence66
buildOne report1 publisher Three weeks of unattended agent runs logged OK on a check that only proved the process exited
Seven Claude Code subagents produced 382 commits, 24 board meetings and 16 articles in 21 days, and no revenue. The reusable part of the writeup is the runner that treated exit code 0 as proof the work happened.
Reality
- Evidence45
- Adoption18
- Hype gap−20
- Incentives55
- Confidence42
buildOne report1 publisher Parlotype's localization gate landed before roughly 450 keys left the markup
A parity script, an xUnit mirror of it, two Claude Code hooks and a skill file all went in before any hardcoded string moved, and a JSON baseline of per-file literal counts is what let a half-finished extraction still pass.
Reality
- Evidence58
- Adoption15
- Hype gap−5
- Incentives30
- Confidence55