▣ IT SECURITY · — · rss

Sophos X-Ops

Fetch interval: 12h

Items

Trust

80/100

Last activity

7/10/2026

Open original site ↗RSS ↗

2607_agents_vs_telemetry

An X-Ops analysis of how AI coding agents trigger endpoint detection rules designed for adversaries Categories: Threat Research

cybersecurity · government-security

Sophos X-Ops8d07/02

Vect and TeamPCP partner for ransomware campaigns

Credentials harvested through supply chain compromises enable large‑scale ransomware deployment Categories: Threat Research Tags: Vect, TeamPCP, Ransomware

cybersecurity · government-security

Sophos X-Ops23d06/17

AI in the underground: Curiosity, claims, and concerns

Amid discussions about how artificial intelligence can facilitate cybercrime, some threat actors remain skeptical Categories: Threat Research Tags: AI, Dark Web, underground

cybersecurity · government-security

Sophos X-Ops29d06/11

June Patch Tuesday smashes past 500-CVE mark

209 patches + 388 advisories = welcome to summer 2026 Categories: Threat Research Tags: x-ops, Patch Tuesday, MICROSOFT PATCH TUESDAY

cybersecurity · government-security

Sophos X-Ops36d06/04

You do surprise me.exe: An unexpected executable in Hola Browser

Following a certification test, Sophos X-Ops found an unexpected guest had hitched a ride Categories: Threat Research Tags: Crypto mining, Supply chain

borderlinecybersecurity · government-security

Sophos X-Ops38d06/02

Pointing a Cursor at evading detection

AI accelerated tool development and testing, but humans drove the workflow Categories: Threat Research Tags: AI, EDR

cybersecurity · government-security

Sophos X-Ops51d05/20

GitHub internal repositories breached

A malicious VS Code extension led to cloned private repositories, reportedly offered for sale on a criminal forum Categories: Threat Research Tags: GitHub, Supply chain

cybersecurity · government-security

Sophos X-Ops52d05/19

WantToCry ransomware remotely encrypts files

Brute-force attempts against SMB services can be early signs of an attack Categories: Threat Research Tags: Ransomware, WantToCry, SMB

cybersecurity · government-security

Sophos X-Ops57d05/14

Why AMOS matters: The macOS malware stealing data at scale

Sophos X-Ops looks at the Atomic macOS Stealer and its capabilities Categories: Threat Research Tags: MacOS, AMOS, infostealer

cybersecurity · government-security

Sophos X-Ops58d05/13

May’s Patch Tuesday hauls out 132 CVEs

With advisories, this month’s count approaches 300 – though many are already in place Categories: Threat Research, X-ops Tags: Patch Tuesday, MICROSOFT PATCH TUESDAY

cybersecurity · government-security

Sophos X-Ops59d05/12

Inside the lethal trifecta: Blast radius reduction in AI agent deployments

Seven things security teams can start doing today to reduce risk Categories: Threat Research Tags: AI, CISO, risk

cybersecurity · government-security

Sophos X-Ops64d05/07

Donuts and Beagles: Fake Claude site spreads backdoor

A malicious imitation of Anthropic’s Claude site leads to DLL sideloading – and a backdoor Categories: Threat Research Tags: Claude, Beagle, Backdoor, malvertising, AI, DONUT, DLL sideloading, Sophos X-Ops

cybersecurity · government-security

Sophos X-Ops70d05/01

Proof-of-concept exploit available for Linux 'Copy Fail' vulnerability (CVE-2026-31431)

Categories: Threat Research Tags: advisory, Linux, Copy Fail

cybersecurity · government-security

Sophos X-Ops72d04/29

'Mini Shai-Hulud' supply chain attack targets SAP npm packages

Categories: Threat Research Tags: advisory, NPM, SAP

borderlinecybersecurity · government-security

Sophos X-Ops77d04/24

Supply chain attacks hit Checkmarx and Bitwarden developer tools

Two supply chain attacks, same day, same command-and-control domain Categories: Threat Research Tags: Supply chain, Sophos X-Ops, pipeline, Bitwarden, Checkmarx

borderlinecybersecurity · government-security

Sophos X-Ops84d04/17

Microsoft addresses 163 CVEs, 88 advisories for April Patch Tuesday

Following a long-established pattern, the fourth month of the year is one of the cruelest Categories: X-ops, Threat Research Tags: Patch Tuesday

cybersecurity · government-security

Sophos X-Ops85d04/16

QEMU abused to evade detection and enable ransomware delivery

The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment Categories: Threat Research Tags: virtual machine, QEMU, PayoutsKing, GOLD ENCOUNTER, CitrixBleed2

cybersecurity · government-security

Sophos X-Ops92d04/09

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks Categories: Threat Research Tags: OpenClaw, LLM, AI, penetration testing, Red Team, CISO, Sophos X-Ops

borderlinecybersecurity · government-security

Sophos X-Ops92d04/09

Adobe Reader zero-day vulnerability in active exploitation

Categories: Threat Research Tags: advisory, vulnerability, Adobe Reader

cybersecurity · government-security

Sophos X-Ops101d03/31

Axios npm package compromised to deploy malware

Categories: Threat Research Tags: advisory, NPM, Axios

cybersecurity · government-security

Sophos X-Ops102d03/30

Incident responders, s'il vous plait: Invites lead to odd malware events

A phishing campaign targeting multiple organizations led to RMM installations – but not much else (yet). A threat actor experimenting, or an access-as-a-service attack underway? Categories: Threat Research Tags: STAC6405, infostealer, RMM, Phishing

cybersecurity · government-security

Trust

Reputable· 80/100

Recent crawls

5/24/26, 12:42 AM	ok	0/15
5/24/26, 12:42 AM	ok	0/15
5/23/26, 11:09 PM	ok	0/15
5/23/26, 11:09 PM	ok	0/15
5/23/26, 11:02 PM	error	0/0
5/23/26, 11:02 PM	error	0/0
5/23/26, 12:42 PM	error	0/0
5/23/26, 12:42 PM	error	0/0
5/23/26, 6:53 AM	error	0/0
5/23/26, 6:53 AM	error	0/0

Health checks

7/10/26, 3:23 AMOK127 ms

7/10/26, 2:23 AMOK139 ms

7/10/26, 1:23 AMOK157 ms

7/10/26, 12:23 AMOK277 ms

7/9/26, 11:23 PMOK133 ms

7/9/26, 10:23 PMOK223 ms

7/9/26, 9:23 PMOK221 ms

7/9/26, 8:23 PMOK120 ms

7/9/26, 7:23 PMOK127 ms

7/9/26, 6:23 PMOK133 ms

7/9/26, 5:23 PMOK141 ms

7/9/26, 4:23 PMOK122 ms

7/9/26, 3:23 PMOK139 ms

7/9/26, 2:23 PMOK150 ms

7/9/26, 1:23 PMOK189 ms

7/9/26, 12:23 PMOK125 ms

7/9/26, 11:23 AMOK126 ms

7/9/26, 10:23 AMOK172 ms

7/9/26, 9:23 AMOK225 ms

7/9/26, 8:23 AMOK123 ms

7/9/26, 7:23 AMOK237 ms

7/9/26, 6:23 AMOK253 ms

7/9/26, 5:23 AMOK626 ms

7/9/26, 4:23 AMOK104 ms

7/9/26, 3:23 AMOK119 ms

7/9/26, 2:23 AMOK195 ms

7/9/26, 1:23 AMOK171 ms

7/9/26, 12:23 AMOK119 ms

7/8/26, 11:23 PMOK130 ms

7/8/26, 10:23 PMOK158 ms