← Feed

Posts

• View post

  Anthropic: infostealers stole Claude login sessions and drained user usage. Not LLMjacking. That is API key theft, fixed by rotating the key. This is session cookie theft, and per Anthropic the attacker may skip password and 2FA entirely. Change your password on an infected machine and you just minted them a new cookie. Clean first, revoke second, rotate third. [https://blog.relayshield.net/this-is-not-llmjacking-and-rotating-your-key-will-not-fix-it]

• View post

  12.08M autonomous agent payments last month. Average: $0.0635. At six cents nobody approves anything. The agent finds a service, gets a 402, signs, pays. Nothing in that flow checks who received the money. x402 verifies the payment and has no opinion on the recipient. A correct payment to a drainer is still a correct payment. https://blog.relayshield.net/your-agent-has-a-wallet-nothing-asks-who-it-is-paying #infosec #AIagents #x402

• View post

  MFA worked, so attackers stopped attacking it. Two stealer families this month, same shift: don't beat the login, occupy the session after it. One drives a real browser on an invisible desktop on the victim's own machine. Impossible-travel, device fingerprinting, behavioural scoring all pass honestly. Password = delivery mechanism. Session cookie and cloud token = payload. #infosec #threatintel

• View post

  We searched public GitHub for AWS keys leaked against a domain. 4,240 hits. The top five results: a docs table, a literal AKIA.... placeholder, a redaction tool's own README, a link list, and a domain allowlist. Five out of five. Not one contained a credential. Any scanner that treats a search hit as a finding calls all five a CRITICAL exposure. Free local scanner, MIT: #infosec #devsecops #appsec #opensource

• View post

  If one of your AI agents leaked its LLM API key tomorrow, the first signal you'd get is the bill. No endpoint compromised, so EDR sees nothing. No anomalous login, so the SIEM sees nothing. No data left, so DLP sees nothing. Sysdig measured $46,000/day from compromised Bedrock creds. We match 19 key formats across 14 providers, including DeepSeek, Qwen and Moonshot, which most scanners miss entirely. Free check, no API key: https://blog.relayshield.net/your-ai-agents-have-credentials-som...

• View post

  New reference implementation shipped today: #LangChain middleware that gates AI agents from connecting to unfamiliar MCP servers behind a mandatory security check. It is not an optional tool call the agent is free to skip. https://github.com/nzdsf2-gif/relayshield-langchain-gate #InfoSec #MCP #AgentSecurity #AIsecurity

• View post

  We checked 24 DeFi/fintech/prediction-market brands for lookalike domains: 341 found, registered and resolving right now. Only 1 is currently blocklist-flagged. That's a floor, not a ceiling: blocklists catch domains after they're weaponized, not before. We cross-check registration age + TLS cert issuance timing instead. That's the leading indicator. Full writeup: [https://relayshield.hashnode.dev/341-lookalikes-1-alarm-domain-hygiene-research?utm_source=hashnode&utm_medium=fe...

• View post

  OnyxC2 MaaS: $250/month, 0/71 AV detections, 4,717 session cookies stolen from a single device. Refund policy included. The stolen VPN credentials are the ransomware entry point that comes weeks later. Full breakdown: https://relayshield.hashnode.dev/onyxc2-when-250-month-buys-everything-on-your-employees-devices?utm_source=hashnode&utm_medium=feed #infosec #malware #infostealer #ransomware #MaaS #SMBSecurity #cybersecurity

• View post

  425,000+ rug pulls detected. 54% of all crypto threats. A rising chart and a loud Telegram community are not signal — they're part of the attack. AI-generated phishing now delivers 53% of crypto scam attempts via email. Your inbox is the primary vector, not Discord or Twitter. https://relayshield.hashnode.dev/rug-pulls-are-now-54-of-all-crypto-threats-here-s-how-they-stay-hidden-until-it-s-too-late?utm_source=hashnode&utm_medium=feed #infosec #crypto #web3security #rugpull #...

• View post

  Cybernews found a 24 billion record credential database sourced from 30+ criminal Telegram channels. Most records: infostealer logs with plaintext passwords and active session cookies. The owner was actively updating it using CVE trackers and breach news monitoring. Full writeup: https://relayshield.hashnode.dev/24-billion-credentials-just-leaked-is-yours-in-there?utm_source=hashnode&utm_medium=feed #infosec #infostealer #databreach #threatintel #opsec

• View post

  RelayShield: breach, SIM swap, infostealer, domain lookalike, OAuth supply chain, and live IOC threat intel database lookup with REST API + verified n8n node. 75K+ IOCs from criminal Telegram channels, ThreatFox, URLhaus, CISA KEV, Feodo Tracker, and MalwareBazaar. Infostealer signal runs 24-72h ahead of public aggregators. $499/mo — in-house SOC teams and lean security environments $999/mo — MSSPs and multi-client enrichment pipelines api.relayshield.net/developers #infosec #threatin...

• View post

  400,000+ indicators of compromise. One API. Pay per call. RelayShield is now a verified node on n8n Cloud — breach check, infostealer exposure, SIM swap detection, session risk, IOC lookup, ransomware risk, identity graph, supply chain risk. 12 actions total. Submitted to Zapier App Directory this week. $0.10/breach check. No subscription required. relayshield.net/developers #infosec #threatintel #n8n #automation #cybersecurity

• View post

  We've been quietly building a threat intel API for MSPs and security teams. Current corpus: 600K+ IOCs, 1,000+ malware families, 17 live feeds (C2IntelFeeds, Feodo Tracker, PhishTank, criminal Telegram channels). New this month: identity graph correlation from criminal dumps, ransomware victim signals, NHI/token exposure detection, GitHub secret scanning. REST API, n8n node, MCP server. Free IOC lookup at api.relayshield.net/developers #threatintel #infosec #cybersecurity #MSP #MSSP...

• View post

  For the DeFi/prediction markets folks here: We ingested the full UNC4221/UAC-0185 IOC set (June 2026 bulletin — 32 indicators, CERT-UA#12414) and launched a free public badge endpoint that DeFi protocols can embed to show live credential-layer risk status. `https://api.relayshield.net/v1/badge?domain=example.com` The credential/supply chain attack vector is real, it's active, and it's unmonitored by most DeFi security tooling. t.me/RelayShield

• View post

  Crypto Shield Mobile is now live on the Solana dApp Store. It includes read-only wallet security monitoring (Solana, EVM, TON, BTC, XRP), address poisoning detection, NFT drainer/scam detection, and criminal-Telegram-sourced threat intel. This release adds Mobile Wallet Adapter connect. Never asks for a seed phrase or private key — it's watch-only by design. https://cryptoshieldmobile.relayshield.net #infoSec #Solana #WalletSecurity

• View post

  Remus Stealer: new MaaS infostealer, $250-$1,000/mo tiers, Lumma-derived code, ships with Google OAuth cookie restoration (regenerates session access even after a password change). Streams stolen logs straight to Telegram. Wrote up what it does and what to actually check if you suspect compromise: [https://www.linkedin.com/pulse/remus-stealer-new-250-a-month-infostealer-renting-out-your-e1goc/?trackingId=1qeb%2Bv0Gd2NBf6e%2B3%2B%2BZig%3D%3D] #infoSec #threatIntel #malware

• View post

  An AI agent on AWS Bedrock AgentCore just autonomously found and paid for one of our security APIs via Coinbase's x402 Bazaar. Real on-chain payment, zero custom code, verifiable tx: 0x1cb95ce37d54201b4def745269c42790fdb9bc7255f102aa648cf6f91fab0e3a (Base) As agents start transacting autonomously, they become an attack surface. We built the security layer to be agent-native too witih 23 endpoints now agent-discoverable + payable. #infosec #AI #x402 api.relayshield.net/developers

• View post

  New from RelayShield: four #AIsecurity checks for agents built with smolagents, published as an MCP server on @huggingface. - MCP server reputation check before your agent connects - Prompt-injection pattern detection on ingested content - Tech-stack CVE monitoring (covers agent frameworks themselves — Langflow's CVE-2025-3248 was the initial-access vector in the first documented autonomous-agent ransomware op) - Bulk identity-risk scoring Self-serve, pay-per-call, no subscription. https:...

• View post

  Shipped today: RelayShield's AI-agent security checks are live as an MCP server on Hugging Face including MCP server risk, prompt-injection breach detection, agent framework CVE monitoring, and bulk agent-identity risk scoring. Same "Agentic Attack Surface" thesis behind our AgentCore/x402 work: security built for how agents actually get compromised, not humans. Live now: https://huggingface.co/blog/relayshieldadmin/relayshield-agentic-attack-surface-mcp #AIAgents #MCP #AgentSec...

• View post

  RelayShield's Threat Intelligence & Identity Security API is now live on AWS Marketplace — 2M+ IOC corpus, 37+ monitored criminal Telegram channels, STIX/TAXII 2.1 and MISP feed export. https://aws.amazon.com/marketplace/pp/prodview-z3izf6val3jb2 #cybersecurity #threatIntel #AWS #MSP #MSSP

• View post

  UNC4221 / UAC-0185 (Russia-aligned) has been silently reading Telegram, WhatsApp, and Signal messages via fake device-linking QR codes since 2022. Confirmed active June 2026. Attack chain: phishing message → fake device-link page → attacker's device linked → silent real-time message copy. No alerts, no notifications. IOC set from CERT-UA#12414 (32 indicators) ingested in RelayShield TI corpus. Check your linked devices now. Full breakdown: [https://hashnode.com/edit/cmr0ystn900010ajghg2v5...

• View post

  11.1 million devices infected with infostealers in 2025. 3.3 billion credentials now circulating in criminal markets. Vidar surged to 73% of infected hosts by early 2026. Lumma dropped to 1.1%. The ecosystem rotates tools faster than detection catches up. MaaS entry point: $60/month. Less than most SaaS subscriptions. The ransomware connection that gets overlooked: stolen VPN/RDP credentials are how attackers enter the perimeter as legitimate users, weeks before the payload fires. Full break...

• View post

  Supply chain attacks leave a signal trail in credential intelligence before malicious code fires — usually days to weeks before breach day. The Polymarket incident ($2.9M, June 26) is a documented case study: compromised vendor → stolen CI/CD tokens → malicious JS injected to frontend → $2.9M drained while everything looked normal to users. We mapped each precursor signal and the monitoring layer that catches it: [https://relayshield.hashnode.dev/how-relayshield-would-have-caught-the-polymarke...