Marina Simakov retweeted
Proud to see Zenity Labs and @simakov_marina leading the way in AI agent security in collaboration with MITRE ATLAS. 🤩
This milestone adds the first AI agent–focused attack techniques to the ATLAS framework, expanding the industry’s understanding of how real-world agents can be misused, misconfigured, or exploited. 🌐
➡️ zenity.io/blog/current-event…
We’re grateful to have her on the Zenity team helping define what safe, responsible agent adoption looks like. 💪
#MITREATLAS #AI #AIAgent #AgentSecurity
Marina Simakov retweeted
i am super excited about @wunderwuzzi23 's keynote
you've got material for an entire month of ai bugs conf lol 👾
ALT Johann's keynote at AI Agent Security Summit
Marina Simakov retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
Fascinating thread on how a malicious Cursor extension drained a crypto wallet.
With powerful tools like these, every dependency matters -- from connected MCPs to extensions.
Supply chain attacks in the AI era won’t just be dangerous, they’ll be inevitable
🚨 UPDATE: Full Post-Mortem On Cursor Security Incident
In yesterday’s thread I explained how I got drained after installing a malicious extension in @cursor_ai.
This is the deeper dive into what I found, what I did, and how you can avoid it.
🧵 👇
Marina Simakov retweeted
#blackhat2025 has spoken: AI security is so awful, it's like the '90s all over again! Comments from @beccalunch @wendynather @simakov_marina @mbrg0 @joe_carson @nathanhamiel @rharang @tamirishaysh
scworld.com/news/sloppy-ai-d…
Marina Simakov retweeted
💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773)
👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE
🔥 Bypasses all user approvals
🛡️ Patch is out today. Update before someone else does it for you
Marina Simakov retweeted
Apparently @cursor_ai's official position on MCP is "MCP servers, especially ones that connect to untrusted data sources, present a serious risk to users. We always recommend users review each MCP server before installation and limit to those that access trusted content."
Marina Simakov retweeted
next.
we hijacked cursor via jira mcp by submitting a support ticket
cursor harvests and exfiltrate all creds from your dev machine
and then reports back to the dev that "the 2-hour downtime that affected user transactions has been resolved"
#DEFCON #BHUSA @simakov_marina
Marina Simakov retweeted
we got a persistent 0click on ChatGPT by sharing a doc
that allowed us to exfiltrate sensitive data and creds from your connectors (google drive, sharepoint, ..) + chat history
+ future conversations
it gets worse. we deploy a memory implant
#DEFCON #BHUSA @tamirishaysh
Connect your powerful AI agent to an MCP server. Enable auto-run. What could possibly go wrong? 😈
Turns out, when using Cursor with a Jira MCP, any local secret - API keys, AWS creds, SSH keys - is up for grabs.
labs.zenity.io/p/when-a-jira…
Marina Simakov retweeted
Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard.
These techniques also work on victims logged on before the server was compromised.
research.ifcr.dk/pass-the-ch…
Marina Simakov retweeted
I've added the material from my Black Hat US talk yesterday to my blog. If you are interested in Azure AD security, love account hijacks, MFA bypass, persistence techniques and privescs, give it a read: dirkjanm.io/assets/raw/US-22…
1/2 Three years ago @YaronZi and I presented a generic NTLM relay detection at #BHUSA. Recently, we extended it to detect machine accounts relay, independent of the coercion tactic used (PetitPotam, ShadowCoerce, DFSCoerce, etc.)
crowdstrike.com/blog/how-to-…
2/2 Check out slides 48-50 (or the recorded talk) for more details on the detection
i.blackhat.com/USA-19/Wednes…
Marina Simakov retweeted
Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS?
Don't worry MS-DFSNM have your back ;)
github.com/Wh04m1001/DFSCoer…
Marina Simakov retweeted
We saw a lots of problem after KB5005565 patch (or others KB on September 2021 patch tuesday), thinking it was related to #printnightmare 4x branch fix
But don't forget a nightmare can hide another one ( CVE-2021-1678 ), and see: msrc.microsoft.com/update-gu…
Marina Simakov retweeted
Excited to share I'll be (virtually) in Vegas presenting in @defcon a talk titled: "Adventures in MitM-land: Using Machine-in-the-Middle to Attack Active Directory Authentication Schemes" with
@sagish1233 @eyal_karni.
We'll present cool new MitM attacks against NTLM and Kerberos
Marina Simakov retweeted
5 months ago @tifkin_ and I started looking into the security of Active Directory Certificate Services. Today we're releasing the results of that research- a blog post posts.specterops.io/certifie… + a 140-page whitepaper and defensive audit tool (links at the top of the post) [1/6]
Marina Simakov retweeted
NTLM relay refuses to die! A new blog is alive with details about the cool vuln in Print Spooler we have found!
It was patched by Microsft in the last Patch Tuesday. We also have a PoC we intend to release later.
The blog was written jointly with @aionescu crowdstrike.com/blog/cve-202…
