CTI-2026-0526-KIMSUKY-PEBBLEDASH Kimsuky (APT43) — Analysis of the New PebbleDash ·...
CTI-2026-0526-KIMSUKY-PEBBLEDASH
Kimsuky (APT43) — Analysis of the New PebbleDash · AppleSeed Toolset
First Rust-based backdoor, abuse of VSCode · Cloudflare tunneling, and traces of LLM-generated code
Field
Value
Kimsuky used fake security tools and Webex pages in March-April 2026 to deploy HTTPSpy, enabling persistent espionage and data…
I Tested Kimi K3 on a Real Astro Codebase: Strong Cross-File Analysis, Unsafe First...
Kimsuky's phishing attacks get an AI boost
Amazon links the 2025 debug and chalk npm hijack to Sapphire Sleet with medium confidence, but does not show which evidence ties…
The British AI Security Institute and the U.S. Center for AI Standards and Innovation tested Moonshot AI's Kimi K3 on offensive…
AWS fixed a Kiro prompt injection chain that rewrote mcp.json and launched attacker-controlled code with developer privileges,…
