IFIN - The Independent Federated Intelligence Network

The Independent Federated Intelligence Network.

IFIN is a 501(c)(3) not-for-profit public benefit corporation incorporated in California.

Our mission: Empower organizations to independently collect, analyze, and disseminate relevant cyber threat intelligence through training, open source tools, and a decentralized intelligence sharing network.

Website: https://ifin-intel.org
Community: https://discourse.ifin.network
Support: https://donorbox.org/ifin
News Feed: https://news.ifin.network

Public Key

npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsqd64j9ka37e5m0j8v2d9qlyq3c084d3tv27gqxd9newckc6hukqcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds6dzq4z

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363

Show more details

Last Notes

2026-07-15 20:24:51 UTC

- reply

Fixed, thanks!

2026-07-15 20:20:47 UTC

Cursor will run anything called git.exe when you open it, but it isn't the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.
https://discourse.ifin.network/t/remember-that-cursor-git-exe-bug-its-in-vscode-too/665

2026-07-09 21:03:13 UTC

We regret to inform you that yes, the models continue to produce kernel exploits leading to privilege escalation and container escapes.
This one is part of a two-vuln chain with a public PoC that escapes Firefox and roots the host.
https://discourse.ifin.network/t/cve-2026-43499-ghostlock-yet-another-linux-lpe-container-escape/653

2026-05-21 15:04:23 UTC

RE: https://infosec.exchange/@ifin/116605052950779161
Important note. A lot of sources are reporting that the Nx Console extension is the vector by which GitHub was compromised. Although that extension was breached concurrently with the GitHub announcement, GitHub has neither confirmed nor denied this publicly. The connection remains speculation, not fact.
#note1xwp…uz0v

2026-05-20 13:10:18 UTC

- reply

We've updated the post with the full list of claimed-compromised repositories.

2026-05-20 04:38:26 UTC

GitHub's internal repositories have been exfiltrated and offered for sale.
https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484

2026-05-19 06:22:39 UTC

One maintainer's compromised tokens are responsible for the takeover of 500+ NPM packages, including the AntV family of packages.
https://discourse.ifin.network/t/500-npm-packages-including-antv-compromised-via-single-maintainer/476
#ThreatIntel #ThreatIntelligence #IFIN

2026-05-18 21:59:57 UTC

- reply

Also added to our MISP instance!

2026-05-18 17:00:28 UTC

Microsoft Power BI is under a DDoS attack claimed by 313 Team, the same group that recently claimed the attack on Ubuntu.
Their booter is still protected by Cloudflare, btw.
https://discourse.ifin.network/t/power-bi-ddosed-claimed-by-313-team/470
#ThreatIntel #ThreatIntelligence #IFIN

2026-05-16 19:41:56 UTC

- reply

Two sides of the same mullet.
@npub16kg…afn8 @npub1ezn…nyq3

2026-05-15 18:24:30 UTC

We have a breakdown of the current attack campaign against Cisco SD-WAN devices
https://discourse.ifin.network/t/cve-2026-20182-cisco-catalyst-sd-wan-eitw/457
#ThreatInte #ThreatIntelligence #IFIN

2026-05-15 16:34:51 UTC

Dear threat research firms,
A modest proposal for your threat intel blog posts:
A *single table* of Indicators of Compromise.
3 columns: Value, Type, Description
The same format. Every time.
Easier for you, easier for your readers, easier for us.
XOXO IFIN

2026-05-14 22:20:47 UTC

I am sure you're shocked to hear about another NPM compromise.
This one was because a maintainer let their email domain expire!
https://discourse.ifin.network/t/node-ipc-npm-packages-infected-with-stealer/454
#ThreatIntel #ThreatIntelligence #IFIN

2026-05-13 19:21:30 UTC

This new Nginx vuln is worth some scrutiny. A heap buffer overflow that can lead to service restart and, on systems with ASLR, code execution. Patches available.
https://discourse.ifin.network/t/cve-2026-42945-heap-buffer-overflow-in-nginx/441

2026-05-12 21:59:37 UTC

We are tracking the new Nightmare Eclipse exploits, and we even have some listed IoCs from the code/repo files for you.
https://discourse.ifin.network/t/chaotic-eclipse-nightmare-eclipse-drops-two-windows-0days/437
#ThreatIntel #ThreatIntelligence #IFIN

2026-05-12 18:34:43 UTC

If you or someone you know has received Instructure #Canvas-themed phishing messages, we want to hear about it! Samples welcome, but also any other circumstances.
Something seems phishy about the claim that no data is out in the open.

2026-05-12 18:32:17 UTC

Did you know we have a @npub1mly…rl2t feed? We do!
Discourse posts with valuable indicators are added to our feed, which is free for all.
https://misp.ifin.network/feed (/manifest.json for manual review)
#MISP #ThreatIntel #ThreatIntelligence #IFIN

2026-05-12 15:47:22 UTC

- reply

Aaaand now it's in PyPi

2026-05-12 13:22:50 UTC

RE: https://infosec.exchange/@ifin/116558531955700753
This has evolved to impact 170 packages, including those from Mistral and OpenSearch.
#note1w6n…z3sx

2026-05-11 23:27:32 UTC

TanStack, a popular web UI framework has had its NPM packages compromised by another installment of Mini Shai-Hulud.
https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428
#ThreatIntel #ThreatIntelligence #IFIN

2026-05-08 20:15:25 UTC

- reply

Cloudflare is reporting issues as well, since, uh, all their services get their certs from LetsEncrypt

2026-05-08 19:47:21 UTC

BREAKING: LetsEncrypt appears to be stopping certificate issuance due to a "potential incident."
https://discourse.ifin.network/t/letsencrypt-stopping-issuance/415

2026-05-07 22:34:38 UTC

- reply

Fixes for both Debian-derivative and RHEL-like systems listed!

2026-05-07 21:08:50 UTC

We're also tracking the new #CopyFail variants here. DirtyFrag requires the same af_alg module as CopyFail, but another variant does not.
https://discourse.ifin.network/t/new-copyfail-variants/395

2026-05-07 15:38:05 UTC

RE: https://infosec.exchange/@wdormann/116533862391306228
We love direct action you can take to confound the adversary! Disable .URL files (and .js files) today.
https://discourse.ifin.network/t/disable-url-files-before-the-baddies-use-them/393
#note1lp3…u5wj

2026-05-06 17:44:46 UTC

- reply

As a chaser, here are two *other* CVEs on Ollama from yesterday.
https://discourse.ifin.network/t/cve-2026-42248-cve-2026-42249-ollama-on-windows-doesnt-verify-updates-writes-anywhere/378

2026-05-06 17:35:41 UTC

Another AI service that's dangerous when exposed to the internet? Well I never!
Anyway go check for exposed Ollama endpoints.
https://discourse.ifin.network/t/unauthenticated-memory-leak-in-ollama-cve-2026-7482/389
#CVE #ThreatIntel #ThreatIntelligence #IFIN

2026-05-06 13:57:47 UTC

This morning we decided to launch a "Vulnerabilities" category to track vulns without further actionable intelligence besides patching and monitoring. And wouldn't you know it, a crit on Palo Alto's User-ID portal showed up to ring it in!
https://discourse.ifin.network/t/cve-2026-0300-9-3-cvss-pan-os-unauthenticated-user-initiated-buffer-overflow-captive-portal/382
#CVE-2026-0300 #CVE #IFIN

2026-05-05 15:44:17 UTC

As of 0740 UTC, Ubuntu's security and archive sites are *finally* behind Cloudflare's CDN...sorta. So while it's still ridiculous that Cloudflare is serving both sides, at least Ubuntu's repos should be more stable.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/522/736/487/143/212/original/91bd94e9afd5bcf8.png

2026-05-03 05:02:01 UTC

313 Team, the Iraqi-aligned group claiming credit for the Ubuntu attack, are now encouraging the use of #CopyFail against Ubuntu targets while servers may not be able to reach updates.
https://discourse.ifin.network/t/ubuntu-services-under-attack/356

2026-04-30 21:22:01 UTC

The worms keep worming, unfortunately. The "Mini Shai-Hulud" attack appears to pivot to #PyPi with a compromise of a #pytorch library:
https://discourse.ifin.network/t/pytorch-lightning-library-hit-by-supply-chain-attack/357
#ThreatIntel #ThreatIntelligence #IFIN #Python

2026-04-30 20:32:51 UTC

It's not just you: Ubuntu services are down.
https://discourse.ifin.network/t/ubuntu-services-appear-down/356

2026-04-30 17:10:12 UTC

Since the CopyFail disclosure left some of us feeling a little...unsupported, we're talking about what we love to see in vulnerability disclosures. Come join the conversation!
https://discourse.ifin.network/t/your-ideal-vuln-disclosure/350

2026-04-30 15:41:19 UTC

Regarding #CopyFail,
It is worth noting that the exploit can target *any* file and overwrite its contents. That's not just privilege escalation; that's the potential for stealthy persistence.
Our thread now has more technical discussion and also some clever detections.
https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342/26
#ThreatIntel #ThreatIntelligence #IFIN

2026-04-29 20:12:57 UTC

After careful analysis, we believe the best option for remediation is to turn off the computers and go for a nice walk. Maybe call your mother.

2026-04-29 18:51:59 UTC

What is going on today??
We're also tracking #CopyFail.
https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342
#ThreatIntel #ThreatIntelligence #IFIN

2026-04-29 16:25:36 UTC

Looks like we have another #supplychain attack underway, this time facing #SAP-related NPM packages.
https://discourse.ifin.network/t/sap-npm-packages-targeted-with-credential-stealing-malware/340
#ThreatIntel #ThreatIntelligence #IFIN

2026-04-24 21:59:20 UTC

RE: https://infosec.exchange/@mttaggart/116461922134943653
When opportunity (malware) comes a-knocking, you let it in (fire up the sandbox and disassembler).
#malware #ThreatIntel #ThreatIntelligence #IFIN
#note1nq6…ctqd

2026-04-24 20:54:27 UTC

- reply

Since we were the ones subtooted, it's worth clarifying: it is *impossible* to get every moderation decision right, and avenues for appeal are absolutely possible. If we make a mistake, we'll own it. Always.
However, on balance, this signal tends to demonstrate the seriousness with which you approach the issue and our community. If leaning on the side of safety means an occasional false positive, that's a price worth paying.

2026-04-24 18:05:47 UTC

Tell your friends. Mess around with the single field we ask for during onboarding, and we will toss you. If you don't take this seriously, we have no reason to expect you to respect our community's safety.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/461/007/477/566/875/original/76376544204c5095.png

2026-04-23 17:39:38 UTC

We've been on a tear adding new sources to our RSS aggregator! All the cyber news that's fit to print, in one place: https://news.ifin.network

2026-04-23 15:08:31 UTC

Bitwarden's CLI NPM package was hijacked and used to spread credential stealer malware. This is related to the previous Checkmarx compromise.
We'll be updating this thread as always with new information. Come join the effort!
https://discourse.ifin.network/t/teampcp-campaign-spreads-to-npm-via-a-hijacked-bitwarden-cli/305

2026-04-22 15:25:32 UTC

The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now.
Seriously. Cross that one off the easy wins list today.
#ThreatIntel #ThreatIntelligence #IFIN

2026-04-21 16:58:33 UTC

RE: https://infosec.exchange/@ifin/116432853020620365
Thanks to some excellent reporting from Infostealers by Hudson Rock, we know a context[.]ai employee was seeking Roblox cheats when they got hit with LummaStealer, leading to the initial breach which impacted Vercel.
https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293/7
#note1v6v…k8zn

2026-04-21 14:27:01 UTC

- reply

What a hassle! We'll look into it. Apologies for the inconvenience!
@npub1kp7…rszc @npub1v9r…d02r

2026-04-20 19:08:26 UTC

Today we're talking about another (???) issue in the Cursor AI IDE. Well actually it's two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don't know what dev tunnels are? Come find out—then block them with extreme prejudice.
https://discourse.ifin.network/t/cursors-remote-tunnel-capability-is-vulnerable-to-malicious-prompt-injection/295
#IFIN #ThreatIntel #ThreatIntelligence

2026-04-20 12:16:39 UTC

#Vercel update. We now know, thanks to Vercel's CEO, that the compromise came by way of the context[.]ai Office Suite, using OAuth tokens collected from a breach last month. Details here:
https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293/6

2026-04-19 18:45:44 UTC

- reply

We're actively tracking developments here: https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293

2026-04-19 17:46:34 UTC

#Vercel customers: don't wait. Proactively rotate keys, passwords and environment variables ASAP.
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident

2026-04-18 11:47:39 UTC

- reply

Thanks so much for including us!
@npub1ljm…w8tm @npub1n7z…jm2n @npub1ur9…v3q2 @npub18ak…untn [@otterlove](https://mastodon.art/@otterlove ) @npub1388…sxrr @npub1jjw…2z5l @npub1xhj…hq9k @npub1yg8…ccz0 @npub1c99…ljas @npub1x74…ruph @npub1j33…55x2 @npub1wp7…7eym [@_elena](https://mastodon.social/@_elena ) @npub1c2u…zg55 @npub1l2k…6m2l @npub1dhl…ud8y @npub1090…cff7

2026-04-18 00:26:55 UTC

- reply

Proud of you bb

2026-04-16 01:05:08 UTC

After working on it a bit, we have a fix for a recent #ClickFix attack against #macOS that leverages AppleScript. Here's the writeup, and a link to the forum thread!
https://ifin-intel.org/blog/applescript/
#ThreatIntel #ThreatIntelligence #IFIN

2026-04-15 04:33:44 UTC

Well well well, would you look at that
https://discourse.ifin.network/t/activitypub-test/271/1

2026-04-14 17:13:23 UTC

Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent #WordPress plugin compromise. We have more IoCs for you, and what we believe to be a use of the blockchain for an initial access auction for the plugin install base.
https://discourse.ifin.network/t/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/265/8
#ThreatIntel #ThreatIntelligence #ThreatHunting #IFIN

2026-04-13 19:21:03 UTC

CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. Has anyone seen recent evidence of this? None was provided from CISA, and we'd love independent confirmation.

2026-04-11 14:56:14 UTC

We ask for preferred pronouns when you register. We do this so everyone can address you how you wish. But it's also a signal of how you'll treat others.
We just rejected a forum account application because of joke pronouns. That is such a low barrier and if you don't take it seriously, we have no confidence you'll treat our community members with respect.

2026-04-10 21:04:23 UTC

RE: https://infosec.exchange/@cR0w/116052391841771930
Come gather round. We'll tell stories together for free.
#note17te…9am9

2026-04-10 13:49:31 UTC

CPUID downloads were temporarily compromised earlier today. We have a thread compiling analysis and IoCs for you to investigate:
https://discourse.ifin.network/t/hwmonitor-download-compromised/249
#ThreatIntel #IFIN #ThreatIntelligence

2026-04-09 16:20:46 UTC

- reply

:ablobcatpopcorn:

2026-04-09 13:09:12 UTC

This right here?
This is a huge part of why we exist. It's time to trust in each other for our mutual protection, because nobody is coming to save us.
https://www.securityweek.com/white-house-seeks-to-slash-cisa-funding-by-707-million/

2026-04-08 19:09:36 UTC

- reply

So, how this works is:<li>Our community finds something interesting</li><li>We make a thread</li><li>We investigate together</li><li>The data <u>remains searchable</u> for future reference</li><li>We all win</li>
Come join us!

2026-04-08 18:53:37 UTC

Looks like we have a live one here. Weird Rust maintainer phishing campaign using crates[.]ws:
https://discourse.ifin.network/t/bizarre-crates-io-phishing-campaign/232

2026-04-07 19:05:27 UTC

- reply

I've been trying to think of a way to describe our relationship and this is pretty much flawless.
IFIN :rainbow_heart: @npub1ezn…nyq3

2026-04-07 18:35:33 UTC

CISA just published an advisory about IRGC activity against Rockwell/Allen-Bradley PLCs. This is a return to form for IRGC, following patterns observed in 2023.
https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/25

2026-04-07 17:30:23 UTC

Folks here will probably be interested in our AI policy:
> With so many downside risks, and with such dubious benefit to usage, the choice for IFIN is clear: we choose not to participate in the toxic cult of generative AI. Our published material and code are not produced with these models.
https://ifin-intel.org/policies/ai/

2026-04-07 15:48:30 UTC

- reply

Haha insta-hugged. Standby!

2026-04-07 15:45:24 UTC

And our first contribution: here is our thread on currently tracked #Iran-based cyber threat activity, including motivations and targeting information.
https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/23

2026-04-07 15:31:14 UTC

Hello, world!
We are IFIN, the Independent Federated Intelligence Network, and we want to change how threat intelligence is done.
We believe we're all safer when we share what we know. Come learn more and join us!
https://ifin-intel.org/blog/hello/
#ThreatIntel #ThreatIntelligence #Cybersecurity #Infosec