The IT Nerd

SOCRadar announced a new dual-layered API suite that enables MSSPs to build or white label their own threat intelligence. They’ll now have the choice between complete multi-tenant, backend platform automation or raw threat intelligence ingestion to build their own proprietary features. This dual-layered approach allows partners to engage with SOCRadar’s technology in the exact way that suits their business model, whether they want to embed the technology into ready-made platform capabilities or harvest SOCRadar’s data to power their own proprietary tools.

Until now, MSSPs, technology vendors and large enterprises that wanted to embed threat intelligence into their own platforms had to choose between flexibility and speed and were faced with two competing constraints. If they wanted to build differentiated products on top of raw intelligence data, they were forced to accept pre-packaged, “black box” outputs that limited customization and innovation. If they needed a ready-made, white-label solution, they were stuck with manual, one-by-one provisioning, creating tenants, licenses, and configurations by hand, which didn’t scale as their client base grew.

SOCRadar’s new dual-layered API suite solves that limitation by bridging two critical capabilities into one unified suite:

• The Multi-Tenant API provides a two-way, automated engine API that lets partners programmatically issue alarms, create and manage licenses, provision tenants, and configure settings at scale, without manual back-office work.
• The Advanced API gives partners direct, raw-data access to underlying intelligence data so they can build their own features, models, and product experiences on top of it.

This dual approach allows partners to leverage SOCRadar’s technology to meet their specific needs and business model, including embedding the company’s ready-made platform capabilities or harvesting its data to power their own proprietary tools.

SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026.

Key findings include:

• Rapid evolution: Within weeks of its public launch, ICMacOS moved from one-shot credential and wallet theft to a persistent remote access trojan, adding LaunchAgent persistence and a live WebSocket-based shell that lets operators run commands on infected Macs in real time
• Developer and enterprise exposure: The malware specifically harvests SSH keys, AWS, Kubernetes and cloud CLI credentials, Git tokens, and .env files, creating a potential pathway from a single compromised Mac into broader enterprise infrastructure and the software supply chain
• Convincing social engineering: ICMacOS is delivered through ClickFix pages that trick victims into pasting terminal commands, then displays a fake “System Preferences” dialog to capture the user’s login password and validates it against the local Keychain
• Wide collection scope: Targets include browser credentials and cookies across Chromium, Safari, and Firefox, 29 browser extensions covering crypto wallets and password managers, desktop crypto wallets, the macOS Keychain, Telegram, WhatsApp, Discord, iMessage, and Apple Notes; the latest version adds Steam, Outlook, clipboard contents, and additional password managers
• Commercial operation: The stealer is sold by an actor using the handle GlowComa, operating under the MADHASH crypto-draining affiliate group, at $699 per week, $1,199 every two weeks, or $1,699 per month, and it is configured to avoid infecting systems in Russia and CIS countries

For full details, the analysis can be found here: https://socradar.io/blog/icmacos-infostealer-rat/

Yesterday, the FBI and the U.S. Secret Service published a joint Cybersecurity Advisory on FortiBleed, the active global credential compromise campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.

Today, the SOCRadar Threat Research Unit, which first documented FortiBleed in June, published a new report to help organizations defend or triage the Fortinet exposure. It adds field-response detail that changes how you should scope, hunt and remediate. It also includes what is operationally relevant right now: what has changed since the earlier reporting, the indicators to hunt on today, and the actions that actually close the gap.

Here’s the new report: FortiBleed Is Still Active, Locking Organizations Out, 

SOCRadar’s Threat Research Unit (STRU) has today published a new piece of research on CyberXero, a Russian-speaking Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. 

The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure. More than 628,000 Ukrainian individuals have confirmed data in the actor’s possession, including residents of Kharkiv, a city on an active war front.

Significantly, the entire operation surfaced from a single configuration error.

For the complete technical analysis, here is the full PDF report: https://socradar.io/resources/report/cyberxero-threat-research-report/

The blog covering the key points is accessible here: https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/

An estimated 17.3 trillion stored rows across a wide range of Microsoft datasets in Microsoft’s Titan analytics service, were reachable through a single internal analytics service, all because it never checked the signature on a login token. The flaw, which a 16-year-old security researcher known as Faav uncovered, enabled him to claim an administrator’s identity and submit unauthorized SQL queries without any real credentials.

The blog entry with started all of this is here: https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records

Ensar Seker, CISO at SOCRadar, commented:

“This is a strong example of how one fundamental authentication mistake can undermine multiple layers of otherwise well-designed access controls. Titan was validating information inside the JWT, such as the tenant, audience and application, but according to the researcher it was not verifying the cryptographic signature. If an attacker can control the claims without proving who issued the token, those downstream checks provide very little protection. The 17.3 trillion figure also needs to be understood carefully. It represents an estimated number of database rows technically reachable through the vulnerable environment, not 17.3 trillion individuals or confirmed stolen records. There is currently no evidence presented that malicious actors exploited the vulnerability, and the researcher deliberately limited access during testing.

“What makes this case particularly interesting is the combination of AI automation and human security expertise. The AI system handled repetitive discovery, enumeration and authentication testing over several days, while the decisive breakthrough came from the researcher questioning an assumption about how the application interpreted the user identity field. That is likely a preview of how both offensive security research and defensive testing will evolve: AI can dramatically increase the speed and breadth of investigation, but human intuition and contextual reasoning remain critical.

“For security teams, the lesson is straightforward: authentication controls should fail closed, JWT signatures must always be cryptographically verified, unsigned tokens must be rejected, and externally reachable APIs should be independently assessed even when the associated application is supposedly protected by VPN or internal-access controls.”

Well, this is a sign of things to come. Which is guaranteed to be bad for all of us.

SOCRadar’s just-released AI Identity Exposure Report 2026 reveals that 80,000+ enterprises had employee AI logins stolen and ChatGPT is the front door.

SOCRadar mapped more than a million infostealer records against corporate domains

The report looks at the growing exposure of corporate AI identities and credentials, particularly how infostealer malware is capturing access to AI platforms, sessions, credentials, and other sensitive information used by organizations.

It includes research and analysis covering:

• The scale of AI-related identity and credential exposure revealing that 80,000+ enterprises had employee AI logins stolen and ChatGPT is the front door to the exposure
• Compromised corporate accounts and AI platform logins
• Infostealer activity and how attackers obtain AI-related credentials and session data
• Exposure of AI tools such as ChatGPT and other enterprise AI platforms
• The risks associated with stolen session cookies, credentials, API keys, and other forms of access
• The growing “Shadow AI” problem, where employees use AI services outside formal corporate security controls
• Industry and organizational trends around AI identity exposure
• How attackers can potentially leverage compromised AI access for further intrusion, data access, or unauthorized AI resource usage
• Key security recommendations for organizations to reduce AI-related identity exposure

Free AI Exposure Checker

The company also released its free AI Exposure Checker that allows companies to check their domain against 3 billion credentials records. A saved AI password is where the intrusion starts, not where it ends. Infostealers take the login, the live session cookie, and the API keys sitting in the same profile so it is important to check for possible exposure.

To view the full report, please see this link AI Identity Exposure Report 2026.

Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-nexus threat groups to execute cyberespionage, conduct sabotage and influence operations, and generate revenue for state-sponsored nuclear weapons programs.

Recently, the SOCRadar Threat Research Unit (STRU) uncovered Operation Conflict Compass, a targeted campaign by the DPRK-aligned actor Konni, aimed at gathering intelligence on the ongoing trajectory of the Russian invasion of Ukraine.

Key points: 

• Spear-phishing ZIPs with LNK files disguised as PDFs, using Russia-Ukraine peace framework. Targeting potentially points to diplomatic entities, think tanks, and NGOs.
• The chain sets up a scheduled task that runs a PowerShell downloader STRU named VelvetCake every minute. It keeps almost no capability on the host, pulling and running server-side scripts on demand, then wiping its artifacts.
• A recovered second-stage script performs host enumeration and screen capture, exfiltrated over HTTP POST.
• The same components were also delivered via a trojanized Zoom installer.
• Attribution to Konni is moderate confidence: targeting, VelvetCake code characteristics, shared C2 and GitHub staging infrastructure, and operator time zone. 

For full details, the research can be read here: https://socradar.io/blog/operation-conflict-compass-konni-ukraine-lnk-lure/

SOCRadar’s Threat Research Unit (STRU) has documented VectraRAT, a Malware-as-a-Service platform built entirely from scratch rather than forked from leaked RAT code. Renting from $250 a month, it gives operators hidden-desktop control, keylogging, clipboard hijacking, browser credential theft, and a UAC bypass that elevates with no prompt.

Key Takeaways: 

• VectraRAT is a previously undocumented, full-stack Malware-as-a-Service platform built from scratch. It is not a reskin of AsyncRAT, XWorm, or QuasarRAT.
• It pairs a Go control server called VectraHub, with a Vue3 operator panel compiled into the binary, with a native C++ Windows implant. The two speak a proprietary binary TCP protocol using MessagePack over port 3308.
• The operator “Vectra” is a rebrand of an older identity, “Nyxel”, with a YouTube channel dating back to August 2022. Nearly four years of activity with no public reporting.
• Capabilities span both the RAT and the stealer space: hidden desktop (HVNC), keylogging, SOCKS5 relay, clipboard hijacking with regex replacement, remote shell, and mass browser credential theft, plus a UAC bypass that elevates without a prompt.
• Rented from $250 per month and delivered through the Amadey loader and ClickFix pages, with 48% of observed victim entries on corporate Windows editions, including active exfiltration from Windows Server 2025 hosts.

The research can be read here: https://socradar.io/blog/vectrarat-undocumented-stack-maas/

Download the full report (PDF) for the complete technical analysis, including the decompiled protocol internals, panel artifacts, and the full indicator set.

Today, SOCRadar’s Threat Research Unit (STRU) published new research about AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) platform built to steal the Apple ID and passcode needed to unlock a stolen iPhone. A basic coding mistake in its backend exposed the whole operation — developer, resellers, and operators.

Apple’s Activation Lock turns a stolen iPhone into scrap unless someone gets the owner’s Apple ID and passcode. AnonyMousKIT turns that into a subscription service: load a stolen device’s details into the panel once, and it works through email, SMS, WhatsApp, a recorded call, and an AI phone call on its own until the owner responds. Two exposed relative file paths handed STRU months of production logs, tracing this one storefront back to a shared codebase running on 506 domains under 168 brand names.

What STRU found:

• Device-led lures: messages cite the phone’s real Apple model number, like iPhone16,2, and its live Find My location pulled straight off the stolen device.
• An AI voice agent posing as Apple Support: a rented commercial voice AI, scripted as “Alice from Apple Support” in English, Spanish, and Portuguese, talks victims into reading out their passcode live, then walks them to the phishing link.
• A reseller network behind the rebrands: the shared codebase ties 506 domains and 168 storefronts together; scanning that family found 30 still-active backends across 42 domains.

The color detail:

• Ten cents a call: 200 AI voice calls, 90% to Brazil, cost the operator $19.24 total — cheap enough that targets don’t need to be chosen carefully.
• The bait doesn’t even work: the panel’s four “free” jailbreak tools only run on chips up to the iPhone A11, while 92.7% of targeted devices are A12 or newer.
• One buyer, three storefronts: an identical setup-check email (26 log lines, every time) shows up in 12 of 24 exposed backends, and three storefronts launched in the same second on April 10, 2026, sharing the same Gmail relay accounts.

The defender takeaway:

• The tell is the ask: no legitimate Apple or IT support team will ever call and request a passcode or 2FA code out loud.
• Not just a consumer problem: AnonyMousKIT alone emailed lures to 27 South African government addresses and a local university — a compromised personal Apple ID can still expose corporate Keychain credentials.
• Still running as of our last collection date, and SOCRadar continues tracking the wider family.

To view the full research, IOCs, and ATT&CK mapping, see the just-published report  Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain

SOCRadar today announced a new reseller collaboration with GuidePoint Security, the leading cybersecurity solution provider that helps organizations make better decisions that minimize risk. The collaboration is designed to expand customer access to SOCRadar’s award-winning Extended Threat Intelligence platform through GuidePoint’s extensive network of enterprise and public sector customers. 

As organizations face increasingly sophisticated cyber threats, SOCRadar’s comprehensive threat intelligence capabilities and intelligence-driven approach, combined with GuidePoint’s proven advisory and integration expertise, enable customers to proactively identify, assess, and mitigate external risks before they impact business operations. 

SOCRadar is the pioneer of Agentic Threat Intelligence serving organizations across more than 150 countries. The company’s award-winning Agentic Threat Intelligence Platform delivers an industry-first early warning cyber risk detection and mitigation system to proactively identify and reduce external cyber threats before attackers can exploit them. The platform uniquely combines AI agents with one of the industry’s most comprehensive cyber intelligence ecosystems to continuously discover, investigate, and prioritize risks across the internet, deep web, dark web, social media platforms, third-party ecosystems, and exposed digital assets. Integrating Brand Protection and Attack Surface Management (ASM) through its XTI platform, SOCRadar helps customers defend against external threats like phishing, brand impersonation and ransomware, as well as account takeover, exposed credentials, supply chain risks, and emerging attacker activity.