الدومينات

Mobile financial fraud, Android/device takeover, account takeover, payment-fraud mechanisms, Jordan & MENA

ACRIP-MFI-20261101T181300Z-7A41C9E2 CLOSED/PASS. Five active MFI Topics; latest CY-TOP-MFI-7A41C9E2. Zero-rating free-riding mechanism and current Android FreeNet/SNI tooling ecosystem verified; current Jordan/MENA carrier applicability, vendor-config efficacy, community-file validity and enforcement prevalence remain bounded. MFI SSOT/Central/Commit Journal/Hot-Start readback PASS; protected Core unchanged.

Malware families, campaigns, loaders, RATs, mobile/desktop threats; piracy/InfoStealer exposure; VOLTA/NIK AI-enabled threads; Yoba; MDaemon/HELLAGE; WardenStealer/CallbackBeaver AI-agent credential theft

Six active MCI topics. Latest CY-TOP-MCI-D2A9F4C7: Warden/CallbackBeaver operational-scale AI-agent credential theft; >130k SpyCloud recaptured infections and direct Claude Code/Codex OAuth/API/MCP credential collection verified. Downstream reuse, active-victim denominator, dominant delivery route and operator economics remain gated. ACRIP-MCI-20261101T143400Z-D2A9F4C7 CLOSED/PASS; Commit + Hot-Start v1.4 readback PASS.

CVEs, KEV, active exploitation, zero-days, exploit chains, vendor patches, exposed attack surfaces and defensive forensics

ACRIP-VEI-20261101T143100Z-5E8A14C3 CLOSED/PASS. Siemens CVE-2026-58115 Topic committed and Hot-Start read back; unauthenticated maximum-privilege RCE + late-Oct VulnCheck exploitation delta verified; success/exposure/OT-impact/attribution gaps preserved.

OAuth/OIDC, SSO/federation, MFA, session/token theft, identity-provider abuse, certificate-based authentication, privileged remote-access identity brokers, AD/Entra identity attack paths and identity control-plane security.

ACRIP-IAS-20261101T130700Z-D4B81F63 CLOSED/PASS. Third IAS Topic active; canonical/Method Yield/IAS SSOT/Commit Journal/Hot-Start readback passed. Prior IAS Topics preserved separately; protected Core unchanged.

Cloud/SaaS control-plane abuse, IAM/workload identities, trusted application/OAuth abuse, cloud breaches, API/key exposure, tenant isolation, third-party SaaS compromise and cloud secrets

Three active CSS topics. Latest CY-TOP-CSS-B0C70C26: Black October AI credential economy/platform-chain correlation confirmed; target/economic convergence and downstream LLMJacking/resale are high-confidence, while cross-vendor RCA, denominator and single-actor attribution remain gated.

Agent security, prompt injection, MCP/tool abuse, AI application/model security, agentic misuse, AI supply chain, data/secret exfiltration, model theft and defensive controls.

Cross-domain run adds Anthropic GTG-50020 precursor and stolen-AI-access-as-loot/compute/cover finding. AIS active topics remain ARTEX and Load/Mine; GTG-50020 is an archetype, not a Black October identity merge.

Software supply chain, package ecosystems, CI/CD/release pipelines, signing/provenance, maintainer compromise, build artifacts and downstream exposure

Cross-domain run records strict dedupe boundary: LiteLLM, Cursor and Gheist remain distinct supply-chain identities; adjacency to AI credential economy is contextual unless shared upstream lineage emerges.

Threat actors, infrastructure provenance, C2/controllers/proxies, vendor aliases, campaign-cluster identity, temporal correlation and cross-campaign linkages

Cross-domain run adds Black October credential-validator/resale infrastructure graph (momo/Xingjiabi/key-checker nodes) with strong identity guard. TAI active topics remain ARTEX, TraderTraitor/Binance and PHP2Shell; static IOC overlap is not actor identity.