Right now, no one has caught him! And no antivirus detects it 👀

Yesterday I received on one of my honeypots, a new malware written in rust

It’s not DNS There’s no way it’s DNS It was DNS #cloudflare

I offer help for free, via email, to people using Redis Vector Sets in production or if they are experimenting with it. Feel free to ping me! If you don't know what I'm talking about, check this:

Inside the Time-to-exploit -1 days era, How Self-Updating malware exploits vulnerabilities before patches are deployed | AI deception platform

𝐒𝐒𝐇 𝐋𝐋𝐌 𝐇𝐨𝐧𝐞𝐲𝐩𝐨𝐭 𝐜𝐚𝐮𝐠𝐡𝐭 𝐚 𝐫𝐞𝐚𝐥 𝐭𝐡𝐫𝐞𝐚𝐭 𝐚𝐜𝐭𝐨𝐫 How an AI-powered honeypot can trick a threat actor into revealing their tactics and infrastructure. (+ tool GitHub link so you can try it)

The race is over before it even begins. 🔗 Full analysis with reverse-engineered code: https://t.co/WgwZE7IZ5U

🚨 Time-to-Exploit = -1 days: attackers now exploit vulnerabilities BEFORE patches even exist. How is this possible? Technical analysis of malware that updates exploit code in 3 seconds via in-place binary patching. Deploys exploits faster than you can read the CVE.

Supply chain security is everyone’s responsibility, sharing information like this helps protect the entire ecosystem. 🙂

🛑 What it does: • Drops & runs TruffleHog • Steals tokens + cloud creds • Injects a GitHub Actions workflow • Exfiltrates secrets to hxxps://webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7 ✅ Action: • Pin to a safe version • Rotate affected creds • Audit CI/CD pipe.

🚨 Supply Chain Alert The popular npm package @ctrl/tinycolor (2M+ weekly downloads) was compromised. Malicious versions: 4.1.1 & 4.1.2

AI Security Tools - August 2025 🧰 Claude Code Security Review - Prompts and scripts to run code security reviews with Claude Code, producing structured findings and suggested fixes ⭐️2.2k @AnthropicAI https://t.co/q1za4qAG8f 🧰 Beelzebub - Offensive AI security toolkit and

In an update to their advisory, @NxDevTools have confirmed that the CI/CD vulnerability noted here by @adnanthekhan was the initial access vector in the recent #s1ngularity supply chain attack that allowed the attacker to steal an npm token: https://t.co/WVq1UQPni2

Beelzebub MCP isn’t just defense, it’s intelligence. Every caught honeypot call teaches you how to harden your AI agents. Because sometimes, the best way to secure a system… …is to bait the attacker. @BeelzebubLabs

Works with monitoring stacks like Prometheus, Grafana, or ELK. Lets security teams see exactly how an attacker tried to manipulate the agent. @elastic @grafana

Honeypots catch attacks in real time. They’re: ✅ Low false-positive ✅ Easy to integrate ✅ Adaptive — evolve traps as attacks change.

How it works: 1️⃣ Real tools: legitimate functions the agent can use. 2️⃣ Honeypot tools: traps with unique identifiers. 3️⃣ Monitoring: detect & log any honeypot call. 4️⃣ Response: block, alert, investigate.

The idea: add fake, high-risk functions (“honeypots”) into the agent’s toolset. Functions that the agent should NEVER call in normal operation. If they’re triggered? 🚨 Instant red flag.

Modern AI agents are powerful — but also vulnerable. Attacks can: • Hijack instructions • Steal sensitive data • Abuse tools for unintended actions Traditional guardrails aren’t enough.

AI agents can be tricked. Prompt injections, malicious inputs, tool abuse. But what if we gave them a “forbidden” tool… …and watched who tries to use it? 🕵️‍♂️ Meet Beelzebub MCP: honeypots for AI agents. 🔗 https://t.co/vFZFapb1lV @SwiftOnSecurity @ProjectHoneynet @BeelzebubLabs