SANS Stormcast Friday, August 28th, 2026: Broken Polymorphic Phishing; Router Implants; llms.txt exploits; Papercut 0-Day
Summary
Jan discusses polymorphic phishing pages using obfuscated JavaScript that sometimes fail to load. Jacob Baines reveals unauthenticated backdoors in Chinese CBT routers, likely for government surveillance. Elon Hertz highlights risks in LLMs.txt files where AI agents trust malicious instructions. Finally, Papercut issues an advisory for an actively exploited, unpatched vulnerability requiring network isolation.
Topics discussed
Introduction and sponsor announcement
Polymorphic phishing pages with obfuscated JavaScript
Backdoors found in Chinese-made CBT routers
Security risks in AI agent instructions via llms.txt
Critical unpatched vulnerability in PaperCut software
Listen ad-free on Castria