Bhavesh Verma

substack.comIdentity is the New ‘Perimeter’: Why Modern Attackers Prefer Log-In Over Break-In?A technical deep dive into stolen credentials, session hijacking, adversary-in-the-middle phishing, passkeys, and what a truly identity-centric defense looks like in practice.

19 May

The cyber attacks are evolving, are your defenses still the same? Read my latest article at: substack.com/@alphacyberl...

23 July

Over 80% of breaches now involve stolen credentials rather than exploited vulnerabilities. Attackers simply log in using valid usernames and passwords, bypassing firewalls, EDR, and encryption entirely.

23 July

This shifts defense from "blocking attacks" to "detecting anomalous logins" a fundamentally different problem.

Just as "shift-left" transformed application security, organizations now require AI security testing at design time including prompt injection testing, training data poisoning checks, and model output validation before any AI agent or LLM-powered feature reaches production.

This is baked into the ML pipeline, not bolted on after deployment.

Chief Information Security Officers (CISOs) are adopting cyber risk quantification (CRQ) frameworks that express exposure in financial terms (e.g., "expected annual loss from ransomware is $12M").

This allows boards to prioritize investments based on ROI rather than fear, fundamentally changing security budgeting.

With commercial satellite internet expanding, attackers are probing ground station APIs, satellite telemetry, and user terminals. A successful compromise could disrupt global communications or manipulate navigation data. Space cybersecurity is now a dedicated practice area.

As enterprises invest in virtual collaboration spaces, attackers are targeting avatar impersonation, virtual meeting eavesdropping, and digital asset theft. Security teams are extending identity verification and session monitoring into immersive 3D environments.

Privacy-enhancing computation specifically fully homomorphic encryption (FHE) is now commercially viable for specific use cases like healthcare analytics and financial fraud detection. Organizations can compute on encrypted data without decryption, eliminating data exposure during processing.

Regulators now demand evidence of continuous compliance, not just yearly snapshots. Automated tools map controls to live cloud configurations, generate audit ready reports on demand, and alert when drift occurs turning compliance from a point-in-time exercise into a real-time operational metric.

substack.comBhavesh Verma (@alphacyberlabs)On May 22, Anthropic published an initial update on Project Glasswing, the company’s restricted cybersecurity research program that gives roughly 50 vetted partner organizations controlled access to C...

A brief reading on Anthropic’s Project Glasswing: substack.com/@alphacyberl...

Following major cross-border attacks, regulators in the EU and US now require real-time threat indicator sharing between critical infrastructure operators and government agencies. Non-compliance carries fines, and organizations are building automated STIX/TAXII feeds to meet obligations.

APIs now account for over 70% of internet traffic, and attackers have noticed. Automated scanners target GraphQL and REST endpoints with field-level brute force, enumerating every possible query combination to extract sensitive data that would require multiple separate calls.

Rate limiting at the field level has become essential.

Organizations are moving beyond static "zero trust" models to dynamically issued, time-bound privileges that expire immediately after a task. This minimizes the blast radius of credential theft, as attackers can only use stolen privileges within a narrow window of minutes.

substack.comBhavesh Verma (@alphacyberlabs)Microsoft patched CVE-2026-41089 in the May 12 Patch Tuesday release as one of 118 vulnerabilities addressed that month. The flaw is a stack-based buffer overflow in the Windows Netlogon RPC interface...

Microsoft patched CVE-2026-41089 in the May 12 Patch Tuesday release as one of 118 vulnerabilities addressed that month. A quick read: substack.com/@alphacyberl...

open.substack.comArtificial Intelligence: A double edged sword in the Cybersecurity spaceArtificial intelligence has fundamentally transformed the cybersecurity landscape, creating what experts now recognize as the ultimate technological paradox.

Machine learning models trained on historical attack data can predict potential vulnerabilities and attack vectors before they’re exploited. Read more at: open.substack.com/pub/alphacyb...

Attackers are no longer exploiting cloud misconfigurations they're stealing cloud access keys and service account tokens directly from developer workstations, CI/CD logs, and exposed environment variables.

Once obtained, these credentials provide unfettered access to storage buckets, databases, and compute instances, often with no MFA protection.

An evaluation of 100 commercial AI agents found that 98% suffer from a "Lethal Trifecta": they simultaneously have access to private data, exposure to untrusted external content, and the ability to execute outbound actions.

This means a single malicious document or email can trigger unauthorized agent behavior, with many agents failing basic security benchmarks.

The Check Point report highlights that AI incidents are up 67% in 2026. Beyond direct attacks, attackers are increasingly hijacking AI agents, using their legitimate access and permissions to move laterally and execute malicious actions while blending in with normal activity.

Microsoft is using AI to find more zero-day vulnerabilities, warning customers to expect a surge in security updates. Their multi-model agentic scanning harness (MDASH) is discovering flaws at scale,

meaning defenders are finding more issues but the volume of patches is also becoming a significant operational challenge.

Gartner also highlighted the compromise of AI applications as a critical threat. The attack surface is widening through internally developed AI agents, third-party integrations, and employee-facing AI tools, increasing the risk of sensitive data exposure.

substack.comBhavesh Verma (@alphacyberlabs)Password manager maker Dashlane disclosed that hackers obtained at least a dozen encrypted vaults used for storing customer passwords during a weekend cyberattack. Dashlane said hackers brute-forced t...

A password manager breach is the security industry’s worst-case scenario it is the one product whose entire value proposition is protecting everything else. Read more: substack.com/@alphacyberl...

A password manager breach is the security industry’s worst-case scenario it is the one product whose entire value proposition is protecting everything else. Read more: substack.com/@alphacyberl...

Gartner identified deepfakes as one of the top four critical threats for 2026. Real-time deepfake generation now enables identity impersonation across multiple channels, threatening biometric authentication and enabling sophisticated social engineering against employees and recruitment processes.

open.substack.comThe AI Havoc: How AI is Making Social Engineering Attacks Undetectable?The human element has long been considered the weakest link in cybersecurity, but artificial intelligence is transforming this vulnerability into an existential threat.

The democratization of voice cloning technology has created unprecedented opportunities for social engineering attackers. Read more: open.substack.com/pub/alphacyb...

The "ClickFix" social engineering technique has evolved beyond fake CAPTCHA pages. Attackers are now using AI-themed help pages and browser extensions to trick users.

A new variant, ConsentFix, combines this with OAuth abuse to hijack cloud accounts by tricking users into granting permissions, bypassing credentials and MFA.

Security researchers identified PromptSpy, the first known Android malware to use generative AI in its execution flow. While guardrails limit current abuse, this illustrates a future where malware gains unprecedented flexibility by leveraging LLMs.

The "green premium" is collapsing. Renewable energy is now cheaper than fossil fuels in most of the world. The economic excuse for inaction is gone. What remains is political inertia, legacy infrastructure, and the entrenched power of oil states.

substack.comBhavesh Verma (@alphacyberlabs)Klue became a target of an OAuth attack orchestrated by the Icarus ransomware group, enabling the group to steal Salesforce CRM data from multiple organizations including HackerOne, Gong, OneTrust, Ta...

A quick snapshot on the latest ICARUS RANSOMWARE group assault: substack.com/@alphacyberl...

Attackers are now targeting the functional components of AI agents themselves. ESET analyzed nearly 900,000 AI skills and identified thousands of malicious instances.

These skills, which instruct agents on performing tasks and accessing data, are being used to incorporate hacking tools like Mimikatz into AI workflows.

Ransomware is becoming industrialized through formalized criminal partnerships. The Vect ransomware group partnered with the supply chain attack specialists TeamPCP to combine large-scale credential theft with ransomware deployment.

The FBI issued a warning about this collaboration, which has already led to verified ransomware deployments.

For the first time, a ransomware attack was planned and executed entirely by an autonomous AI agent. The JadePuffer group used an LLM to manage every stage from intelligence gathering and credential theft to lateral movement, data encryption, and ransom demands.

The agent demonstrated real-time adaptability, fixing its own errors (like resolving a login error in 31 seconds). It marked a leap from AI as a tool to AI as an autonomous threat actor.

11 July

Employees use unauthorized AI tools or sanctioned AI features like Copilot with no governance policies creating a blind spot where data can surface outside its access boundaries. Cloud misconfigurations and overly broad access policies remain leading causes of data exposure.

11 July

77% of organizations have adjusted cloud security strategies for AI, but only 26% can effectively enforce them. Misaligned infrastructure, limited visibility, and fragmented policy enforcement leave significant exposure.

substack.comBhavesh Verma (@alphacyberlabs)A new Linux kernel vulnerability dubbed “Fragnesia” has been disclosed, allowing local root privilege escalation on fully patched systems. Linux underpins the vast majority of cloud infrastructure, c...

The ‘Fragnesia’ mess in LINUX kernel, read here: substack.com/@alphacyberl...

Climate change is rewriting the rules of warfare. Militaries are now planning for resource wars over water, arable land, and shipping routes exposed by melting ice. The Pentagon calls climate a "threat multiplier" it's also a driver of conflict that could spiral beyond control.

Attackers impersonate real cargo vessels in phishing emails to target shipping companies and downstream supply chain partners. Specific vessel names appear in subject lines to establish credibility, with 90% of global products shipped by sea making this a serious threat.

57% of employees use personal GenAI accounts for work, and 33% admit inputting sensitive information into unapproved tools. Traditional security awareness training is failing, demanding adaptive behavioral programs instead.

substack.comBhavesh Verma (@alphacyberlabs)Multinational pharmaceutical company Novo Nordisk maker of Ozempic and Wegovy has confirmed a breach from March that reportedly extracted some 1.3TB of clinical trial data including drug research, sou...

A short description about Novo Nordisk breach. Read here: substack.com/@alphacyberl...

The cyberattack on Tata Electronics, a key Apple and Tesla supplier, exposed 630 GB of data including alleged confidential component designs. This demonstrates how attackers increasingly target third-party suppliers to breach larger enterprises downstream.

9 July

Forests are becoming carbon sources, not sinks. The Amazon, the Congo Basin, and even parts of Siberia are now emitting more CO2 than they absorb due to fires, drought, and dieback. The planet's lungs are failing, and we're still clearing what remains.