I climbed my own mountain this weekend.
Well, not really. I just share the same first name as the man Mount Whitney is named after. Josiah Whitney mapped this stretch of California. I spent two days on his peak. Night one at Trail Camp around 12,000 feet, then an early push to 14,505, the tallest point in the contiguous United States.
As a founding engineer at a startup, that life never really leaves your head, even at altitude. Long stretches of trail leave a lot of room to think about the mountains we are actually trying to climb at DeepTempo. And about the ones attackers keep putting in front of the industry.
From Trail Camp the 99 switchbacks look like a wall. Inside any one of them you only see the next ten feet of trail. From the summit at 14,505 you can see the whole range at once. Weather thirty miles out. Ridgelines that never show from down below.
That is the climb. Attackers are building taller peaks out of trusted channels, valid looking sessions, and agents that move faster than a human can review. A lot of security stacks still live inside the switchbacks. Local view. Local rules. A named playbook for a named threat. You can work hard at that altitude and still miss what is forming farther out.
The mountain we are climbing at DeepTempo is different. Altitude. A view wide enough that novel behavior shows up before it has a CVE string or a malware family name. LogLM reads the tempo of the network the way a summit reads a range. Cadence, reach, and deviation from what normal looks like from up high. That is how we attack the mountains attackers build. We stop waiting for a name and start reading the wire.
The week that hit while I was offline made that hard to ignore.
Branch61G Weekly. Here is what actually hit over the past seven days.
ChainDrop worm spreads through the npm registry
The most pressing story this week is ChainDrop, a self propagating worm that hit the npm registry starting from a compromised GitHub account belonging to the maintainer of Keyv and Cacheable, two widely used caching packages. Aikido put the count at 868 packages across 1,381 versions. SafeDep's registry-backed count later grew to 1,684 poisoned versions across 420 package names tied to nine organizations, and the firm said the worm moved between organizations every two to seven minutes and finished a cross organization publishing burst in roughly half an hour. Affected packages touched projects tied to Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
The mechanism is specific. The poisoned releases added a "preinstall": "node setup.mjs" entry to package.json. Running npm install against an affected version executes setup.mjs automatically, which downloads the Bun JavaScript runtime from its official GitHub release, hands off to a compiled payload named Math_Symbol.js, then deletes the temporary runtime directory to clean up after itself. The payload validates every token in real time against registry.npmjs[.]org/-/whoami before stealing it, then harvests GitHub PATs and workflow tokens, GitHub Actions secrets, AWS credentials pulled from SSM Parameter Store and Secrets Manager, Kubernetes secrets, database credentials, and Stripe, Slack, Twilio, Azure, and GCP keys. Stolen material gets encrypted and sent to a public GitHub repository titled "Shai-Hulud: Here We Go Again," and Wiz flagged npm-cache[.]com as a second exfiltration domain. Researchers counted 546 fresh public repositories carrying that same description created the same day, which look like staging or exfiltration artifacts rather than confirmed victims.
The Keyv repository carried a second, quieter execution path. A .claude/settings.json SessionStart hook and a .vscode/tasks.json task with runOn: folderOpen were both wired to call setup.mjs, meaning simply opening the checked out repo in Claude Code or VS Code under a trusted workspace could trigger the payload without anyone running npm install at all.
ChainDrop provenance vs behavior
The dodge here is provenance. The poisoned Keyv release passed through the project's own legitimate GitHub Actions workflow, so it carried valid OIDC and SLSA attestation. The attestation correctly verifies the build pipeline. It says nothing about whether the source that entered that pipeline was safe. A stack that treats signed and provenance checked as a proxy for safe waves this straight through.
Same problem I kept turning over on the climb. Looking real is not the same as being on the right path. Provenance told defenders the build pipeline was real. The tempo of what left that runner would have told a different story.
And in a separate incident, the trusted channel doing the damage was not a build pipeline. It was a remote support session.
N-able N-central auth bypass reaches managed endpoints
CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog this week, CVSS 8.2, and gave federal agencies until August 6 to patch. The flaw is an incomplete fix for an earlier authentication bypass, CVE-2026-18556, in N-able N-central, a remote monitoring and management platform MSPs and IT teams use to administer large clusters of customer endpoints. N-able patched the first flaw in version 2026.2, then found attackers had located a second path past the same authentication check, which became CVE-2026-18577 and stayed open until hotfix 2026.3.1.7 shipped on August 2.
Once an attacker gets administrative access to an N-central server, they can abuse the platform's built in Take Control feature to pivot straight into every managed endpoint underneath it. Huntress observed the post exploitation pattern at one self hosted N-central instance inside a single partner account: high level reconnaissance targeting domain controllers, enumeration of running processes on a compromised host before disconnecting, and lateral movement into other hosts. In at least one case the malicious connection came in through "MSP Support," a default username tied to legitimate Take Control sessions, from an IP address later identified as a Mullvad or NordVPN exit node. On the endpoints reached through Take Control, N-able found attackers registering a service named Cloudflared, the legitimate Cloudflare tunneling utility, to open an outbound only connection that needs no inbound firewall rule and survives a reboot. N-able confirmed the tunnels kept working even after the compromised route through N-central itself was cut off.
N-able Take Control to Cloudflared persistence
The dodge is that every step looks like something that is supposed to happen on this platform. Take Control sessions are the product's core feature. "MSP Support" is a real support identity. Cloudflared is a legitimate tool plenty of admins run on purpose. None of it trips a signature built to catch malware, because there is no malware here, just a trusted RMM channel doing exactly what it was built to do for the wrong operator.
Different attack, same week, and the trusted channel this time was a network nobody in the building owns. It was the Wi-Fi at the hotel.
CaptiveCrunch hijacks hotel Wi-Fi for Microsoft 365 tokens
Microsoft linked a hospitality Wi-Fi campaign it calls CaptiveCrunch to Storm-2945, an operational sub-cluster of Midnight Blizzard, also tracked as APT29 or Cozy Bear and attributed by the US and UK governments to Russia's Foreign Intelligence Service. The campaign has been running since at least early May, and the actor has run device code and OAuth phishing since February. On the networks ReliaQuest investigated, the captive portal gateway also served as the DNS resolver handed to every connected device, which let the attackers forge DNS answers and redirect anyone's automatic connectivity check.
From there victims land on one of three paths. Fake Microsoft 365 login pages. Device code phishing pages that abuse Microsoft Entra ID's device authorization flow, where entering an attacker supplied code on the real Microsoft sign in page hands the attacker an MFA satisfied session with no password needed. Or, disclosed for the first time this week, fake browser and operating system update pages using ClickFix prompts that walk the victim through running an attacker supplied command themselves.
The ClickFix path delivers CornFlake, a Go based RAT that shows a fake progress window disguised as a Windows update or a Defender scan while it copies itself to %AppData%\svchost32\svchost32.exe and registers a service called svchost32 under the display name Cloud Sync Service. Persistence runs through service registration, registry run keys, scheduled tasks, and a watchdog that restores any piece defenders remove. Once running, CornFlake takes idle triggered screenshots, logs clipboard contents with the active window title, steals browser cookies and saved passwords including cookies protected by Chrome App-Bound Encryption, scans removable media, and can open a remote shell. A second payload, ChocoShell, runs entirely in memory and pulls Microsoft 365 and Azure AD access and refresh tokens, plus Web Account Manager tokens, straight out of .tbres files in the Token Broker cache. Those tokens let the attacker replay a session without ever touching a browser cookie. Microsoft also found an unprotected web panel called FruitStone that the actor used to browse victim files, run PowerShell commands, and capture screenshots and keystrokes across infected machines, and assessed from the code's comments that AI tools likely helped write both CornFlake and ChocoShell.
CaptiveCrunch token replay vs trusted session
The dodge is session replay. A stolen Azure AD or WAM token lets the attacker resume a session that already passed MFA once, so nothing about the traffic afterward looks like a login attempt. It looks like the same user coming back.
Three stories in and the pattern is a trusted channel getting quietly repurposed. The fourth story did not need a channel to hijack. It needed a Telegram message.
A DeepSeek powered agent ran the exploitation alone
Palo Alto Networks' Unit 42 tracked a Chinese speaking actor, using the aliases knaithe and KnYuan and assessed to be based in Zhuhai, who ran DeepSeek as the reasoning model inside the open source Hermes Agent framework and pointed it at more than 460 targets. After one initial Telegram instruction, the researchers recovered no further operator input in the session. The agent found internet facing systems on its own, selected public exploits, checked target versions, downloaded proof of concept code, abandoned paths that were not working, and picked its next move based on severity, deployment scale, and apparent exploitability.
In a recovered May session, DeepSeek pulled a public exploit for the Langflow code injection flaw CVE-2026-33017, used the FOFA search engine to enumerate 84 internet facing Langflow instances, and found exactly one running the vulnerable 1.3.4 build. That attempt stopped because the target lacked auto_login and a usable public flow identifier. The agent pivoted on its own, surveyed ten other product families, searched GitHub for recent proof of concept repositories, and landed on n8n, chaining an unauthenticated file access flaw with a separate expression injection issue. FOFA returned 25,209 n8n systems inside China for that session alone. DeepSeek sampled about 100 of them, actively probed roughly 40, and found three running vulnerable versions, but none exposed a usable public form endpoint, so nothing got compromised on that run. In separate, manually operated activity the same actor pulled data from three organizations through a NetScaler memory overread flaw and got command execution on 11 Marimo notebook instances through another CVE. The operation exposed itself when Hermes Agent accidentally started an HTTP server on the operator's own machine, leaking its model configuration, API keys, exploit scripts, target lists, and full session logs to anyone who found it.
Hermes Agent recon at machine speed
There is no malware family name anywhere in this one. No hash for an EDR agent to match. What happened is a scan and probe cadence, tens of thousands of systems fingerprinted and dozens actively probed inside single sessions, at a pace no human operator works at and against systems the actor had never touched before.
On a mountain you move slow on purpose. Camp, sleep at altitude, summit when the body is ready. An agent that takes one instruction and then runs alone skips that whole cycle. Attack tempo is already climbing past human pace. That change in tempo is the signal.
What this week means
Supply chain trust, RMM trust, hospitality network trust, and finally an operator who did not even need a channel to hijack, just an instruction and unattended time. Four separate incidents, and the same shape underneath three of them. Trust that gets verified once and treated as good indefinitely is the door every one of these attackers walked through, and the fourth did not need a door at all.
This keeps happening because detections are broken for attacks that do not match a named playbook. A signature pack written for last week's CVE string, a malware hash list, or a blocklist of known bad IPs all assume the attacker repeats something already seen. None of these four incidents needed to. Sitting at Trail Camp and again on the summit, that felt like the real climb ahead for the industry. Get above the switchbacks. DeepTempo is already part of that ascent. LogLM is a foundation model built as an encoder trained on network metadata, not by memorizing attack signatures but by understanding normal deeply enough that a genuine deviation is legible on its own, with no label for that specific CVE or malware family required first.
LogLM wrap for this week
Walk those four back through the wire. On ChainDrop, a developer workstation or CI runner that starts sending encrypted blobs to a brand new public GitHub repository or to a domain like npm-cache[.]com is a destination and volume pattern that sits well outside that runner's normal build traffic, exfiltration LogLM is built to catch regardless of whether Shai-Hulud has a name yet. On N-able, process enumeration against a domain controller followed immediately by a Take Control session reaching hosts that account has never touched before is recon into lateral movement, a behavioral fingerprint independent of whether the connection came from a Mullvad exit node or a clean IP. On CaptiveCrunch, a session that replays a stolen Azure AD or WAM token still produces network behavior that deviates from that account's established access pattern, even though it skips the login step entirely. On the DeepSeek operation, a FOFA driven sweep against tens of thousands of hosts followed by focused probing of a few dozen in the same sitting is recon at a cadence no legitimate admin produces, and that cadence is exactly the kind of deviation LogLM reads without needing to know DeepSeek was behind the keyboard.
That is the generalizability. New attack, same behavioral grammar underneath it. DeepTempo's LogLM catches what the rulebook has never named yet.
AI SOCs are only as good as the detections that feed them. When a zero day or a novel sequence slips past those detections, the rest of the stack has nothing left to reason over.
From 14,505 feet the whole ridge is visible at once. I did not climb my own mountain. I climbed Josiah Whitney's. The mountain that actually has my name on it is the one DeepTempo is still ascending. Network level visibility, a model that knows the tempo of normal, and a team willing to keep climbing for the wider view.
Sources for this week include BleepingComputer and The Hacker News coverage of the ChainDrop / Keyv npm worm, the N-able N-central authentication bypass (CVE-2026-18577), the CaptiveCrunch hotel Wi-Fi campaign attributed to Midnight Blizzard / Storm-2945, and Unit 42's reporting on the DeepSeek powered Hermes Agent operation.
