TrendAI™
Security Blog

Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More

TrendAI™ Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. This analysis covers the full chain, from the pixel data that hides the first stage, through a flexible shared loader to deliver multiple payloads, revealing how adversaries are standardizing their delivery mechanisms.

August 27th, 2026 30 min read Ahmed Mohamed Ibrahim, Ashish Verma, Deep Patel

Read Article

TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure

The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework.

August 26th, 2026 20 min read Deep Patel, Ashish Verma

Read Article

Ranked First on CyberGym: TrendAI™ Agentic Exploit-Remediation Engine Scores 97% on the Top Exploit Benchmark

The TrendAI™ agentic exploit-remediation engine, code name AESIR, ranks first on CyberGym at 97% — more than 12 points ahead of both GPT-5.6 Sol and Claude Mythos 5. AI system architecture beats raw model capability.

August 26th, 2026 3 min read Peter Girnus

Read Article

UK Power Facility Cyberattack Shutdown: What Critical-Infrastructure Operators and Defenders Need to Know

A reported cyberattack on a UK power-generation facility in July 2026 shows that even disruptions at a single site can raise broader questions about critical infrastructure resilience.

August 24th, 2026 6 min read TrendAI™ Research

Read Article

The Architecture Behind $1B: How Customers Run TrendAI Vision One™ on AWS, and Secure Their AI Workloads

August 23rd, 2026 TrendAI™ Research

Read Article

Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant

TrendAI™ Research provides a comprehensive analysis of the RedC2 Linux Implant, a sophisticated threat recently discovered in the npm open-source ecosystem. 

August 20th, 2026 Aliakbar Zahravi

Read Article

Living Off Trusted Software: ScreenConnect Abuse Across Phishing, Search, and RMM Chains

In this blog entry, researchers at TrendAI Vision One™ Services – Managed Detection and Response (MDR) walk through how attackers deliver, install, and operate a reconfigured ScreenConnect client, and why it slips past defenses built to catch conventional malware.

August 17th, 2026 15 min read Buddy Tancio, Allixon Kristoffer Francisco, Fe Cureg, Aira Marcelo…

Read Article

How AiTM Phishing Bypassed MFA to Hijack a Microsoft 365 Mailbox in BEC Scheme

One click on a targeted lure handed an attacker live Microsoft 365 session tokens, enough to impersonate a vendor and reroute payments. TrendAI Vision One™ Services – Managed Detection and Response (MDR) tracks the attack to its root cause.

August 14th, 2026 20 min read Jovit Samaniego

Read Article

The Speed of AI Is Changing the Vulnerability Landscape. Our Commitment to CISA KEV Isn’t.

TrendAI™ is deepening its focus on the CISA KEV Catalog as a proven signal of active risk. With AI, TrendAI™ combines TrendAI™ ZDI research, exploit intelligence, exposure context, and business risk to drive continuous, AI-assisted prioritization, helping security teams make better decisions and act faster.

August 6th, 2026 5 min read Rachel Jin

Read Article

How TrendAI™ Research Helped Close an Open Redirect in Dify's Post-Login Flow

TrendAI™ Research uncovered an open redirect in Dify's post-login flow that could have handed a freshly authenticated session, token and all, to an attacker, and worked with the vendor to close it across every sign-in path before the details went public.

August 4th, 2026 David Fiser, Alfredo Oliveira

Read Article