Who actually uses a leaked AWS key? Tracing it with rotating canaries
Every honeypot write-up says the same thing about leaked cloud keys: put one on the internet and someone will try it within hours. That’s true. I watched it happen on day one. ...
Threat-Intel
Kali365: The Phishing-as-a-Service Platform Weaponizing Microsoft's Own Authentication Against You
If you think MFA is your safety net, Kali365 just cut it. In May 2026, the FBI issued Public Service Announcement I-052126-PSA warning organizations about a rapidly emerging Phishing-as-a-Service (PhaaS) platform called Kali365. First observed in April 2026 and distributed openly through Telegram, Kali365 doesn’t steal your password. It doesn’t even need to. It steals something more valuable: your OAuth token, and with it, persistent, credential-free access to your entire Microsoft 365 environment. ...
Wiring MISP Into a Self-Hosted AI Security Pipeline
The multi-agent security pipeline we built earlier produces useful reports — structured risk analysis, mitigations, recommendations. But it has a ceiling: every agent reasons from what the model learned during training. It doesn’t know about the domain that started hosting malware last week, the C2 infrastructure tied to a campaign your MISP instance just ingested, or the specific indicators your feeds have flagged today. ...