MUT-4831: Trojanized npm packages deliver Vidar infostealer malware securitylabs.datadoghq.com/articles/mut...

A runtime security approach to detecting supply chain attacks securitylabs.datadoghq.com/articles/sup... by Lorenzo Susini, Detection Engineer

Datadog threat roundup: Top insights for Q3 2025 securitylabs.datadoghq.com/articles/202...

Learnings from recent npm supply chain compromises securitylabs.datadoghq.com/articles/lea...

The October edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/...

CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing securitylabs.datadoghq.com/articles/cop... by @siigil.bsky.social

Our State of Cloud Security 2025 study is out! www.datadoghq.com/state-of-clo... • On AWS, 40% of organizations leverage data perimeters • 11% of Google Cloud GKE and 23% of Google Cloud VMs are overprivileged • On Azure, 1.3% of storage containers are public, 58% proactively block public access

The September edition of the Datadog Security Digest is out: securitylabs.datadoghq.com/newsletters/...

In case you missed it, the August edition of the Datadog Security Digest went out last week! securitylabs.datadoghq.com/newsletters/...

CVE-2025-52882: WebSocket authentication bypass in Claude Code extensions (patched) securitylabs.datadoghq.com/articles/cla... Zander Mackie

MCP vulnerability case study: SQL injection in the Postgres MCP server. Comes with a full reproducible proof-of-concept securitylabs.datadoghq.com/articles/mcp... by Santiago Mola

Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer by @frichetten.com securitylabs.datadoghq.com/articles/enu...

The July edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... • Cloud image investigator by @sethsec.bsky.social • Our top picks for Black Hat / DEF CON • A benchmark for LLM coding accuracy and security • Malicious Homebrew installation campaign .. and more

Datadog guide to Hacker Summer Camp 2025, amd the top 50 talks we're excited about securitylabs.datadoghq.com/articles/hac...

Beyond Mimo’lette: Tracking Mimo's Expansion to Magento CMS and Docker securitylabs.datadoghq.com/articles/bey...

I SPy: Escalating to Entra ID's Global Admin with a first-party app securitylabs.datadoghq.com/articles/i-s... by @siigil.bsky.social

Kubernetes security fundamentals, part 7: Public Key Infrastructure (PKI) securitylabs.datadoghq.com/articles/kub... by @mccune.org.uk

CVE-2025-48384: Git vulnerable to arbitrary file write on non-Windows systems securitylabs.datadoghq.com/articles/git...

Stratus Red Team AWS attack techniques are now mapped to the Threat Technique Catalog for AWS Stratus Red Team AWS attack techniques: stratus-red-team.cloud/attack-techn... Threat Technique Catalog by AWS: aws-samples.github.io/threat-techn...

fwd:cloudsec is around the corner! Don't miss these 3 talks from Datadog researchers Seth Sec, Katie Knowles, Greg Foss, and Anthony Randazzo. fwdcloudsec.org/conference/n... @sethsec.bsky.social @siigil.bsky.social @gregfoss.com

The obfuscation game: Threat actor targets Solidity developers via malicious VS Code extensions securitylabs.datadoghq.com/articles/mut... (published May 21, 2025)

"Tales from the cloud trenches: The Attacker doth persist too much, methinks" securitylabs.datadoghq.com/articles/tal... New tactics observed include: • Persistence-as-a-service with an external facing API Gateway • Persistence through AWS SSO • ConsoleLogin events from Telegram IP addresses

RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale securitylabs.datadoghq.com/articles/red...

My colleague, Sebastian Obregoso, and I had the privilege of writing a guest post for OpenSSF's blog on how we detect malicious open source packages at @securitylabs.datadoghq.com using GuardDog. Check it out here: openssf.org/blog/2025/03...

The March edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... • New MITRE ATT&CK coverage matrix in Stratus Red Team • Compromised GitHub actions • Malicious Maven packages • Exploitation of SSRF vulnerabilities on the rise • ... and more

Interested in malicious software packages? Our open-source dataset just hit over 5,000 samples of malicious npm and PyPI packages! github.com/DataDog/mali...

The February edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... featuring @sethsec.bsky.social, @mccune.org.uk, @karimscloud.bsky.social, @jcfarris.bsky.social, and more

Last May we shared our research on using AWS non-production endpoints for a variety of attack scenarios against AWS environments. These endpoints are easy to find and provide options for an adversary to evade detection. More recently, we have partnered with AWS to find 1/x

The Datadog Security Digest is a monthly, practitioner-focused newsletter. Don't miss our February edition going live tomorrow! securitylabs.datadoghq.com/newsletters/...

Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name.

We discovered a pattern in the way many projects retrieve Amazon Machine Images (AMIs), allowing attackers to publish AMIs with specially crafted names and gain code execution within vulnerable accounts. securitylabs.datadoghq.com/articles/who... by @sethsec.bsky.social

Kubernetes security fundamentals: Networking by @mccune.org.uk securitylabs.datadoghq.com/articles/kub...

Threat insights from Datadog Security Labs for Q4 2024 securitylabs.datadoghq.com/articles/202...

The January edition of the Datadog Security Digest newsletter is out! securitylabs.datadoghq.com/newsletters/...

"Escalating privileges to read secrets with Azure Key Vault access policies" by @siigil.bsky.social securitylabs.datadoghq.com/articles/esc...

In-depth investigation by Datadog security researchers into a threat actor dubbed MUT-1244, which targets other malicious actors as well as security practitioners and academics. securitylabs.datadoghq.com/articles/mut...

"Tales from the cloud trenches: Unwanted visitor" securitylabs.datadoghq.com/articles/tal... This post describes an attacker that we've observed in the wild, including a malicious AWS account ID used to create a backdoor IAM role.

Watch Andrew Krug and Zack Allen's (@techy.detectionengineering.net) talk at re:Invent 2024 on software supply-chain security, featuring our open-source projects Guarddog and SCFW, along with insights on real-world malicious packages www.youtube.com/watch?v=1b0R...

Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages securitylabs.datadoghq.com/articles/int... by @ikretz.bsky.social New open-source tool designed to transparently block known malicious PyPI and npm packages. github.com/DataDog/supp...

Stratus Red Team v2.20.0 is now available, with great contributions from @flekyy90.bsky.social allowing you to reproduce AWS TTPs seen in the wild! ➔ Use GetFederationToken to generate temporary credentials ➔ Use SendSerialConsoleSSHPublicKey to pivot to EC2 instances github.com/DataDog/stra...

My Blackhat MEA arsenal presentation: "Detect Malicious Packages with Guarddog" drive.google.com/file/d/11SAN...

We're now officially on Bluesky! Expect: ➔ New articles on Security Labs about cloud, container and application security ➔ OSS projects for cloud security practioners ➔ Conference talks at community conferences See also our starter pack bsky.app/starter-pack... with our authors and researchers!

Exploring Google Cloud Default Service Accounts: Deep Dive and Real-World Adoption Trends securitylabs.datadoghq.com/articles/goo... by @christophetd.fr