Notifications
Clear all
Topic starter
02/08/2026 12:07 pm
TL;DR: Multiple intrusion patterns, including a Windows malware campaign using text-only staging and living-off-the-land execution, BitB phishing that mimics real login prompts, and a supply chain intrusion against n8n community nodes, are highlighted in Anomali’s weekly watch. The common thread is attacker tradecraft that exploits trust, not just vulnerabilities.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on Remcos RAT, BitB phishing, Linux malware, and supply chain intrusion
Questions worth separating out
Q: What breaks when attackers can hide inside trusted scripts and build tools?
A: File reputation and signature-based controls lose much of their value because the malicious logic is assembled or executed through legitimate tooling.
Q: Why do phishing kits that imitate browser login windows still work?
A: They work because many users still rely on visual cues and URL checks that disappear when the prompt is rendered inside the webpage itself.
Q: What do security teams get wrong about workflow automation and secrets?
A: They often treat integrations and community nodes as convenience features rather than privileged execution paths.
Practitioner guidance
- Harden script execution telemetry Log and alert on VBS, PowerShell, and MSBuild execution chains, especially when scripts launch other scripts or rebuild fragments in memory.
- Require phishing-resistant authentication for critical accounts Move high-value users and administrators to phishing-resistant methods and treat browser-embedded login prompts as unsafe by default.
- Review trusted automation for credential exposure Inventory workflow nodes, plugins, and integrations that can decrypt or access stored OAuth credentials and API keys.
What's in the full analysis
Anomali's full Cyber Watch covers the source details this post intentionally leaves at the pattern level:
- MITRE ATT&CK mappings for each campaign and the specific technique sequence used by the malware.
- Original source links for the Remcos, BitB, and supply chain items so analysts can trace each report back to primary evidence.
- The analyst commentary around why these threats matter operationally for defenders.
- The broader weekly context that ties these stories to the current threat landscape.
👉 Read Anomali's Cyber Watch on Remcos RAT, BitB phishing, and supply chain intrusion →
Remcos RAT, BitB phishing, and supply chain intrusion: what stands out?
Explore further
02/08/2026 1:11 pm
Trust abuse is now the common denominator across modern intrusion paths. The article spans malware staging, fake browser login flows, and malicious workflow packages, but the shared issue is not technical novelty. Attackers are exploiting trusted mechanisms that defenders still over-assume are safe because they are familiar. That makes trust, not only vulnerability, the primary security boundary that must be governed.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations respond when trusted access becomes the attack path?
A: Organisations should tighten the scope of every credential, prioritise attack-path analysis for crown-jewel systems, and unify governance across human, machine, and delegated identities. The key question is not who logged in. It is what the identity could do once trust was inherited, because that determines the true containment boundary.
👉 Read our full editorial: Anomali Cyber Watch spotlights malware delivery, phishing, and supply chain risk
