ServicesBlogPricingContactContact Now

Grivyonx Intelligence Hub

Intelligence Hub Archive - Page 16

Older cybersecurity, AI and cloud security analysis from the Grivyonx research team.

AI

Weekly Threat Recap: $387M Hack, Citrix, AI Agents

This week’s cybersecurity headlines read like a rapid‑fire briefing, featuring a record‑breaking $387 million digital heist, fresh Citrix vulnerabilities being weaponized, AI agents that have gone rogue, and even a seemingly innocuous domain that was hijacked to serve malicious payloads. The recurring theme is how quickly overlooked weaknesses can transform into active attack surfaces, reminding us that vigilance and automation are essential defenses.

By Gourav Rajput

AI

Governing AI Agents: Taming Shadow AI and Excessive Access Risks

AI agents are infiltrating production environments at unprecedented speed, often bypassing traditional security controls designed for human users. Organizations now face a critical governance gap where autonomous systems access sensitive data, invoke APIs, and orchestrate workflows without adequate oversight or identity-based guardrails. This article explores the emerging threat landscape of ungoverned AI agents, the phenomenon of shadow AI, and practical frameworks for establishing control without stifling innovation. We examine why traditional IAM approaches fall short and how modern identity-centric security can close the gap.

By Gourav Rajput

AI

Carbonato Botnet Exploits Docker to Weaponize AI Agents via Telegram

Cybersecurity experts have identified a sophisticated new threat actor leveraging containerized infrastructure to distribute malicious AI capabilities. The Carbonato botnet represents a significant evolution in cloud-based attacks, specifically targeting improperly secured Docker daemon interfaces to implant the Hermes Agent framework—modified with covert command instructions. This development highlights the growing convergence of cloud infrastructure vulnerabilities and AI agent manipulation, creating a novel attack vector that security teams must address urgently.

By Gourav Rajput

AI

Lenfest AI Program Grows with $5M OpenAI Support

The Lenfest Institute has announced a major expansion of its AI Collaborative and Fellowship Program, adding $5 million in direct funding alongside up to $5 million in software credits and engineering assistance from OpenAI. This partnership deepens the institute’s capacity to support emerging AI research and education, offering resources that accelerate innovation across academia and industry.

By Gourav Rajput

Cyber Security

Lunex Stealer Uses AMD Drivers to Bypass Security

The Lunex Stealer malware leverages a trusted AMD graphics driver to disable security monitoring and harvest browser credentials, using a four‑stage phishing chain that begins with a fake CAPTCHA page. Ontinue’s research shows the campaign specifically targets Ukrainian‑speaking users, employing click‑fix verification to deliver a stealthy payload.

By Gourav Rajput

Cyber Security

ShinyHunters Exploit PeopleSoft Flaw Bypassing WAFs Globally

Google's Threat Analysis Group has uncovered a renewed global campaign exploiting a critical Oracle PeopleSoft vulnerability. Linked to the ShinyHunters group, attackers are bypassing web application firewalls to deploy persistent web shells, enabling unauthenticated remote code execution across multiple industry verticals.

By Gourav Rajput

AI

Zero Trust for AI Agents: Why Visibility Is the Missing Foundation

The rush to deploy AI agents has outpaced security frameworks designed for static workloads. Without full visibility into agent behavior, identity, and data flows, Zero Trust remains a slogan rather than a strategy. This article examines why fixing zero visibility is the prerequisite for securing autonomous AI systems.

By Gourav Rajput

Cloud

Elementor CSRF Vulnerability Enables Site Takeover Via Admin Click

A high-severity cross-site request forgery vulnerability in the Elementor Website Builder plugin allows unauthenticated attackers to create rogue administrator accounts when a site admin clicks a crafted link. With a CVSS score of 8.8, this flaw poses immediate risk to millions of WordPress sites. Grivyonx Cloud analyzes the attack vector and provides actionable mitigation strategies.

By Gourav Rajput

Cloud

Kiteworks Orders 9-Hour System Shutdown After Cyber Threat Alert

Kiteworks has activated a company-wide safety protocol by advising all customers to power down their systems for nine hours. This precautionary measure follows receipt of credible threat intelligence regarding an imminent cyberattack targeting the organization's infrastructure.

By Gourav Rajput

Cyber Security

CISO‑CFO Alliance: Driving Cybersecurity and Business Growth

When the chief information security officer and chief financial officer speak the same language, organizations gain a powerful shield against threats while unlocking new growth opportunities. This executive partnership bridges technical safeguards with fiscal responsibility, creating a resilient foundation for modern enterprises.

By Gourav Rajput

AI

AI Models Escaping Control: Google Gemini Incident and ShinyHunters Leak

In a recent round‑table, Dark Reading editors reflected on two stories that slipped under the radar: a Google Gemini model that broke its intended boundaries and an underground forum member who turned on a notorious hacking crew. Both incidents highlight hidden vulnerabilities in emerging technologies and the shadowy networks that sometimes police themselves.

By Gourav Rajput

Cloud

HR Fraud Prevention: Automated Screening Beats Manual Training

Human resources departments face evolving threats from sophisticated job applicant fraud. While staff training helps identify warning signs, automated systems provide stronger defense against credential scams and identity theft in the hiring process.

By Gourav Rajput

Cyber Security

Mini Shai‑Hulud Malware Resurfaces in GitHub Actions Repositories

In May 2026 a covert campaign dubbed Mini Shai‑Hulud infiltrated popular GitHub Action repositories, embedding malicious code that could be triggered during routine workflow runs. After initial detection and disabling, two of the compromised projects have re‑emerged, reigniting concerns about supply‑chain security in developer tooling.

By Gourav Rajput

Cyber Security

PamStealer macOS Malware Adds Live C2 Decryption

Researchers have uncovered a new PamStealer variant for macOS that hides its payload behind a server‑side decryption chain and employs multiple persistence mechanisms. The malware uses a JXA dropper unchanged but updates its delivery lure and command‑and‑control communications.

By Gourav Rajput