Google Tracks ARTEX Agents Probing Cloud Permissions in Seconds
Mandiant saw ARTEX compress permission checks into seconds and leave noisy application traces. Scope credentials and restrict management paths before the next burst.
Read article →Threat Analysis for Defenders
Nulltap™ reports on vulnerabilities, breaches, threat activity, and AI security, with practical guidance to help defenders act.
Latest Articles
Sophos tracks Aur0ra operators using AI agents to breach Active Directory
Operators supplied access and objectives; agents then pursued credentials, domain privileges and shared files. Check AD activity and isolate backups.
Read article →
CrowdStrike Spots AI Agent Trying to Share Corporate Files
Falcon Guardian found unknown internal agents and an attempted public-site file share. Trace agent requests to endpoint actions, then restrict sensitive-data transfers.
Read article →
Compromised LiteLLM Release Ran Credential Stealer at Python Startup
LiteLLM 1.107.0 planted Python startup files in wheels and images, putting developer and gateway credentials at risk when an affected interpreter started.
Read article →
CISA Flags Exploited GitLab CI Flaw and Sets November 1 Fix Date
CISA added GitLab's CI regex code-execution flaw to its exploited list. Check self-managed versions, upgrade, and triage exposed servers.
Read article → Latest Replays
Explore Replays Watch the story take shape.
3:26Watch Replay Interactive Replay 7 chapters
Scam panels hold the payout
3:35Watch Replay Interactive Replay 8 chapters
Fake wallets retain copied secrets
3:26Watch Replay Interactive Replay 8 chapters
VOLTA appraises stolen identity records
3:02Watch Replay Interactive Replay 7 chapters
Chrome search extensions send queries through proxies
3:55Watch Replay Interactive Replay 9 chapters
Teams impostors obtain privileged certificates
2:56Watch Replay Interactive Replay 8 chapters
Tampered Claude Code extension plants SSH keys
3:16Watch Replay Interactive Replay 8 chapters
Cisco confirms License On-Prem is unaffected
2:23Watch Replay Interactive Replay 7 chapters
Cisco VPN flaw triggers firewall reloads before login
Most recent first 8 Replays
CrowdStrike Expands Managed Hunts to AI Agents and Google Cloud
Falcon OverWatch adds Guardian-monitored AI activity and Google Cloud telemetry. Check your monitored scope and IAM logs before relying on the new coverage.
Read article →
Binance Links $6.3B Incident to Unauthorized Withdrawals
Binance described a possible laptop-to-container path; examine who could submit withdrawal requests to signing systems.
Read article →
Prediction-Market Scam Teams Rig Trades and Block Withdrawals
Insikt Group traced three affiliate fraud services and more than 100 related domains. Check lookalike sites, withdrawal demands and linked infrastructure.
Read article →
Socket Links Malware Campaigns to Blocked Installs and Repository Scans
Socket's campaign view connects blocked package installs and repository detections to the scans and Firewall events behind them.
Read article →
VOLTA Stealer Ranks Stolen Credentials Into Victim Dossiers
Talos traced a Windows stealer that uses stolen sessions to check delivery receipts, then sends a victim profile to OpenRouter for assessment.
Read article →
Fake Firefox Wallet Extensions Steal Recovery Phrases and Keys
Three removed add-ons copied Phantom, Jupiter and Bitget; one also fetched code after review. Check extension IDs and move exposed wallet funds to a new seed.
Read article →
Microsoft Tracks Teams Support Calls to AD CS Certificates and Data Theft
Two intrusions began with remote-support impersonation; one reached DCSync and file-server theft after an identity containment exclusion.
Read article →
Claude Code Extension Backdoor Planted SSH Access on Developer Machines
A trojanized Claude Code extension reached Open-VSX and Cursor users, planted an SSH key and persisted after removal. Check installed versions and host artifacts.
Read article →Showing 1–13 of 304
Reader formats
Choose how you read.
Follow Nulltap by RSS or JSON, use the e-reader edition, browse the archive, or read from the terminal.
Command line
Read nulltap in your terminal.
Install once, then browse, search, and read without opening a browser.
Recommended
pipx install nulltapPython 3.10+pip:
python -m pip install nulltapStart reading
$ nulltap
Browse or search
$ nulltap topics
$ nulltap search "token theft"
Use the short view
$ nulltap read 2 --short
Get help
$ nulltap --help