Newsletter 2026-04-13

Another week another round

itm4n took a closer look at Windows’ implementation for collecting Bitlocker information. Maybe a pretty interesting topic if you want to dive into the depths of disk encryption.

• https://itm4n.github.io/bitlocker-little-secrets-the-undocumented-fve-api/

Something a bit different. Unlocking features in an Audi.

• https://blog.zsec.uk/audi-carplay-2026/

Something else again. A Mastodon discussion around the latest Windows zero-day Bluehammer. The discussion goes into the functionality a bit. Plus the repo.

• https://infosec.exchange/@wdormann/116358064691025711
• https://github.com/Nightmare-Eclipse/BlueHammer/tree/main

Talos analyzes LucidRook, a Lua-based stager that provides stripped Rust elements.

• https://blog.talosintelligence.com/new-lua-based-malware-lucidrook/

Gen Threat Labs found and dissected a new 64-bit variant of the Lumma Stealer.

• https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer

According to Talos, more SaaS platforms are apparently being used for so-called Platform-as-a-Proxy (PaaP) attacks where the actual notifications from GitHub and Co. are used to send messages from trusted origins.

• https://blog.talosintelligence.com/weaponizing-saas-notification-pipelines/

A North Korean TA has now spread 1,700 malicious packages across various platforms (PyPI, crates.io, npm…) with Contagious Interview and primarily relies on infostealers.

• https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems

Amazon provides an environment for AI agents with the AWS AgentCore Sandbox, but Unit42 immediately found a way to break out.

• https://unit42.paloaltonetworks.com/bypass-of-aws-sandbox-network-isolation-mode/

Classic overflow bug in macOS with interesting consequences.

• https://core-jmp.org/2026/04/the-49-day-macos-time-bomb-how-a-tcp-timer-overflow-breaks-the-network-stack/

Quarkslab disassembled a telematic unit from a crashed car. They read out the firmware and travel data and were able to trace the car’s journey.

• https://blog.quarkslab.com/tearing-down-a-car-telematic-unit-and-finding-an-accident-on-facebook.html​​​​​​​​​​​​​​​​

Read you next week.