Bring Your Own Vulnerable Driver has industrialized into a commodity EDR-killer market. The defensive problem is a race: the driver’s whole job is to blind the telemetry you’d use to catch it, so you have to get the driver-load event off the host before the killer disables collection or clears the logs.
Injected instructions turn an LLM into its own exfiltration transport: the model emits an image element — a markdown image or a raw HTML img tag — something fetches it (the browser, or an allowlisted backend on its behalf), and your data leaves inside the URL. Here’s why the prompt filter is the wrong place to stand and what the detection actually looks like in Splunk.
Hugging Face says an autonomous agent breached its production infrastructure over a weekend by getting a malicious dataset to run code on a processing worker. Strip the AI theater and it’s a credential-blast-radius story about treating the ML pipeline as untrusted-code execution.
Iran-nexus Screening Serpens paired AppDomainManager hijacking with DLL sideloading across its 2026 campaigns. A managed loader assembly runs before the host binary’s normal entry point and isn’t reliably represented in Sysmon ImageLoad telemetry, so the detection has to move to file-create events and .config content.
Eight US-based ‘laptop farmers’ sentenced in five months, across cases spanning more than 100 US companies in one prosecution and nearly 70 in others: the North Korean IT worker is already on payroll, and what resolves it is correlating unauthorized remote-access tooling with the connection and endpoint telemetry it throws off — not the hiring interview, and not sign-in geography alone.
A process on a Linux host where io_uring is enabled can read files, connect out, and write to disk without issuing any of the file and network syscalls your auditd rules and EDR hooks watch. Here is the creation-time syscall that still fires, what to alert on, and why the real fix is a sysctl (already the default on RHEL 9).
CVE-2026-53359 is a 16-year-old use-after-free in KVM’s shadow MMU that lets a guest-root attacker on a vulnerable nested-virt KVM/x86 host crash the box or, with a separate withheld exploit, run as root on the hypervisor. The clearest detection is a kernel oops in journald; the real control is patching plus turning off nested virt you never used.
EDR-Freeze abuses WerFaultSecure.exe — a Microsoft-signed WinTCB/PPL crash dumper — to suspend Defender and third-party EDR for as long as the operator holds it, with no kernel driver and almost no forensic residue. Here is what the detection actually looks like in Sysmon, why the filename-based Sigma rule everyone shipped first is a canary rather than a control, and which process-access relationship the real rule matches.
A researcher pulled roughly 3,000 live ClickFix payloads and found the delivery running like a metered API — request 100, get 100 different builds. That breaks detection built on the pasted command, the encoded blob, or a string IOC. Here’s the content-blind detection that survives, and why the registry rule was never the durable part.
A block of Unicode characters that renders as nothing can carry a full paragraph of instructions into your LLM, and your content filter can miss it because it inspects a sanitized or transformed representation while the model receives the original code points. Here is where the detection actually has to live, and what you spend the first week of tuning on.
