Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new backdoor named Pickai is exploiting ComfyUI vulnerabilities to spread and steal sensitive AI data. Developed in C++, Pickai offers remote command execution and reverse shell capabilities with strong persistence and evasion techniques. It uses multiple C2 servers for redundancy and has infected nearly 700 devices globally. The malware is hosted on Rubick.ai, an AI e-commerce platform serving major brands, posing significant supply chain risks. Pickai employs various obfuscation methods, including string encryption, process disguise, and multiple persistence mechanisms. Its network communication uses a three-tier timing strategy for C2 communication and device information reporting.

Pickai is a sophisticated backdoor malware developed in C++ that exploits vulnerabilities in ComfyUI, a user interface framework used in AI applications. The malware enables remote command execution and reverse shell capabilities, allowing attackers to gain persistent and stealthy control over infected systems. Pickai employs multiple advanced evasion and persistence techniques, including string encryption to obfuscate its code, process disguise to avoid detection by security tools, and multiple mechanisms to maintain persistence across system reboots. It communicates with its command and control (C2) infrastructure using a three-tier timing strategy, which helps evade network-based detection by varying communication intervals. The malware uses multiple C2 servers for redundancy, ensuring continued control even if some servers are taken down. Notably, Pickai has infected nearly 700 devices globally and is hosted on Rubick.ai, an AI e-commerce platform that serves major brands, indicating a significant supply chain risk. This supply chain vector could allow the malware to spread widely through trusted AI software components or updates. The malware's primary objective appears to be the theft of sensitive AI data, which could include proprietary models, training data, or intellectual property. Indicators of compromise include several file hashes, IP addresses, and URLs linked to the malware’s infrastructure. Despite the lack of a specific CVE or known exploits in the wild, the malware’s capabilities and infection scale suggest a well-developed threat targeting AI ecosystems through ComfyUI vulnerabilities.

Detailed information about Beware of AI Pickpockets: Pickai Backdoor Spreading Through ComfyUI Vulnerability. Get real-time updates, technical details, and miti

Beware of AI Pickpockets: Pickai Backdoor Spreading Through ComfyUI Vulnerability - Live Threat Intelligence - Threat Radar | OffSeq.com

Beware of AI Pickpockets: Pickai Backdoor Spreading Through ComfyUI Vulnerability

Threats Tagged 'comfyui'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'comfyui'

Lead Pen Test Professional