The Watch

The evasion is engineered against named products

SMOKE#SCREEN's fake Zoom update page auto-downloads after two seconds. That is not the consequential detail. The consequential one is that the operator stopped destroying Microsoft Defender and started quietly evading it. AV-tampering events are among the highest-fidelity alerts most SOCs own, because they are loud. An actor that leaves Defender running produces silence instead, and detection anchored to AV-disable telemetry has nothing to fire on.

Second engineered detail: a 180-second sleep between stages, chosen to fall outside Elastic EDR's event-correlation window. Read that as a disclosure about the tooling rather than about the malware. A correlation window is a configuration value that someone reverse-engineered and now treats as a known adversary parameter. So test it: benign stage-1 execution, a 180-second pause, then a stage-2 network callback. If the chain does not reassemble in the SIEM, the fix is a longer window or stateful behavioral chaining. Better learned on a Wednesday than during triage.

Why the terminal stage defeats artifact detection

Delivery is diversified across VBScript droppers, batch loaders and .NET executables. The end of the chain is a fully functional, signed ConnectWise ScreenConnect agent beaconing to attacker-controlled relay servers. Nothing here is unsigned and no hash is novel. The parent-process tree looks like IT remote support because it is IT remote support software. The prerequisite control is unglamorous and most organizations skip it: a tenant-level allowlist of approved RMM instance IDs and relay FQDNs. Without that list, helpdesk traffic and intruder traffic are indistinguishable, and the detections worth writing collapse into noise.

The same pattern, one platform over

XCSSET v40 makes the point on macOS. It has spread through infected Xcode projects since April 2026, affecting dozens of legitimate apps with thousands of users. It ships no C2 of its own. Instead it replaces Chrome's launch process with a wrapper that enables remote debugging, then abuses the Chrome DevTools Protocol to inject JavaScript, steal credentials and API tokens, tamper with MetaMask transactions, and run a fileless reverse shell through console messages. Google's Windows-side protections have not yet reached macOS. The C2 channel is a browser feature, so egress inspection sees Chrome doing Chrome things.

Where the reporting agrees and where it splits

Both bodies of reporting converge on mechanism: attackers operating inside sanctioned tooling rather than smuggling code past it. They diverge on ownership. Cyberpresso frames it as a detection-engineering problem, testable and tunable. The Hacker News frames the same class as an identity and authorization problem, pointing at phishing kits that ride genuine Microsoft authentication infrastructure so that look-alike-domain tooling never fires. Both readings are correct. They bill to different budgets: one buys correlation and RMM allowlists, the other buys Conditional Access and behavioral authorization.

A stack that asks whether a binary is known-bad has nothing to say about a signed support tool talking to an unapproved relay.

Timing baselines have to span both directions

One number pair from the reporting should reset behavioral baselining. Malicious marketplace extensions phoned home 4 to 5 seconds after activation. SMOKE#SCREEN waited 180 seconds. A window tuned tightly enough to catch the first misses the second, and a window loose enough to catch the second drowns in benign activity unless it is chained on behavior rather than time alone. Test both ends against the same detection content before declaring coverage.

The persistence path no scanner owns

Theft is not the differentiator in this campaign. The worm writes hooks into Claude Code and VS Code: hook and settings files, .vscode/tasks.json, workspace settings, extension configs. Execution resumes at the start of every later developer session while SCA tooling reports a clean lockfile. Microsoft's own description, relayed through AI Breakfast, is blunter. CLAUDE.md and .mcp.json survive package reinstalls and sit outside file-integrity and EDR baselines entirely. Gitignoring of these files is inconsistent, so drift from a known-good state stays invisible even in repos that get close review.

The counts disagree. Scope by host, not by package.

Three research vantage points produced three defensible numbers. The Hacker News cites 353 SafeDep-verified poisoned packages spreading from [email protected] across the Keyv and Cacheable namespaces. CyberScoop reports 440+ packages injected in under four hours from a hijacked GitHub maintainer account, and 860+ packages touched and 2 billion-plus combined monthly installs. CSO reporting says 400+ and appends the words "thus far." None of the three is wrong. They are snapshots of a campaign still moving, which makes any published package list a floor rather than a scope. The scoping question that holds up: which endpoints and runners executed an install during the window, and what those hosts could reach.

The credential class nobody rotates

Alongside npm, GitHub, AWS and CI credentials, the payload harvests AI configuration files and crypto wallets. Model provider API keys, MCP server configs and agent config files sit in developer home directories and container images with no owner, no expiry, no rotation schedule and no revocation trigger. They almost never appear in an enterprise secrets inventory. They are therefore absent from the rotation runbook currently in flight.

The convergent vector is instructions, not code

Separately from the worm, poisoned agent instruction files have been found in repositories. The path set is short and unguarded: AGENTS.md, CLAUDE.md, .cursor/rules, .github/copilot-instructions.md, .mcp.json, devcontainer definitions. SCA skips them because they are not dependencies. SAST skips them because there is no code to analyze. CODEOWNERS was written around source directories, so a change to one of these paths merges on a casual approval from whoever is on rotation. The payload is natural language, and the reviewer instinct (it's just docs) is the instinct being monetized.

A pull request touching one of those paths is functionally a code-execution request against whatever tool scope the agent holds. Blast radius is not the laptop. It is whatever that laptop can sign, publish or deploy through a live cloud session, an SSH agent, a kubeconfig, or a long-lived registry token in a dotfile.

Where the reports diverge, and why both fixes are needed

One set of reporting treats this as endpoint integrity: baseline the files, alert on modification by non-interactive processes. Another treats it as SDLC governance: put the paths under CODEOWNERS with mandatory security review. Same artifact class, described from opposite ends, because that class is simultaneously a persistence mechanism and an instruction channel. Fix one and the other stays open.

Every scanner in the pipeline inspects the code the agents write, and none of them inspect the files that tell those agents what to do.

Congress moved the Salt Typhoon post-mortem from devices to wiring

A US House committee concluded that telecom carriers connected their systems to data centers and related infrastructure in a way that exposed them, and that those connections potentially opened the door to Salt Typhoon, the campaign that breached several US mobile carriers roughly two years ago. That is Bloomberg's reporting. The committee is not naming an unpatched appliance. It is naming interconnection architecture, meaning the trust relationships built between carrier core networks and adjacent compute facilities. Those relationships have always been the least-examined part of carrier engineering, because they get approved once, at circuit turn-up, by staff who have moved on by the next audit cycle.

Calibrate honestly: this is a congressional finding characterizing a plausible access path, not a forensic attribution of initial access. It changes the work anyway, because the exposure is inherited. Consuming carrier private interconnect, sitting in a colo that peers with a carrier, or terminating a cloud on-ramp inside a shared facility each leaves a path whose far side was assumed trusted at turn-up and never re-reviewed. In ATT&CK terms the activity is lateral movement and internal traffic relay across a peering boundary. Where NetFlow collection stops at the internet edge, coverage for that scenario is zero.

TP-Link Omada: the structural failure of severity triage

Forescout chained 15 new zero-touch-provisioning flaws with CVE-2025-7850 and CVE-2025-7851. The result is an unauthenticated external attacker with no network access winning a race condition during cloud device adoption, seizing the cloud controller account, and reaching root-level command execution across every managed router, switch and access point. Firewalls, VPNs and segmentation of the devices do not mitigate it, because the compromise happens inside the vendor's cloud adoption flow.

The aggregation is the part worth reading twice. Individually low-severity flaws combined into a critical path, which is the same argument against CVSS-only triage that has been made after every provisioning-chain writeup for years. TP-Link has stated in writing that structural fixes may slip to late 2026 and that some items will never be fixed. That moves this off the patch backlog and into a documented risk exception with compensating controls attached.

Cosmos DB: the fix was a platform redesign

Microsoft closed a cross-tenant path through the Cosmos DB Gremlin API by redesigning the platform rather than shipping a patch. The distinction is the finding. An implementation bug gets a patch. An architectural isolation failure gets a rearchitecture. Secondary and legacy protocol APIs on hyperscaler managed services keep surfacing as the weak point in multi-tenant isolation, because they are bolted onto a model built for the primary API, and this one reportedly reached Microsoft's own internal services.

Publicly, two independent reports agree on the mechanism and the remediation approach. Neither establishes that exploitation occurred. Remediated is not the same as unexploited, which sets the ask precisely: an exploitation attestation from the provider, plus log-retention guidance for the exposure window. Notification-clock analysis depends on evidence nobody outside Microsoft currently holds.

What the three share

In each case the failing control is a trust assumption rather than a version number, and the missing artifact is evidence rather than a fix. The change queue has never handled items without a version number well. These belong on the risk register with named owners and expiry dates.

Concentration risk and inherited trust do not get patched. They get bounded, attested, and reported.