Typosquatting nearly cost him his Keychain — he reverse-engineered the malware with an AI agent (50-min writeup)
rchardkovacs · x · 2026-10-27
IT-security veteran Richard Kovacs recounts a close-call attack and his AI-assisted forensics (50-min read):
- The chain: he typo'd admin.atlassion.com instead of atlassian.com — a typosquatting domain the attacker registered — and was served a suspicious fake captcha that walked him step by step toward entering his MacBook password. At the final step he realized one keystroke away from handing over every Keychain secret and sensitive config key.
- Evasion: the payload was downloaded from an attacker server whose domain rotated every few days, dodging blocklists.
- AI forensics: instead of manual RE, he set his AI agent loose on the sample — behavioral analysis, deobfuscation, locating C2 logic — and documents the agent workflow and findings step by step.
- Lessons: type URLs directly or use bookmarks, avoid storing high-privilege credentials in browsers, distrust captcha-style interactions.
A concrete, reproducible playbook for anyone using agents in security forensics.
More from coding & agent
- Open-Duet: Self-Hosted Open-Source Alternative to Claude Duet Hits 6.2k Stars — matchaman11 · 2026-10-27
- Agentic AI Costs Are Scaling Faster Than Value—FinOps to the Rescue — DavidLinthicum · 2026-10-27
- Dev claims Claude Opus 5.5 is smarter than every developer he knows — GabGarrett · 2026-10-27
- Consumer AI agents found inside 6 major banks; 77% of users won't grant money-transfer access — focusTrevor · 2026-10-27
- HarborRL open-sources agentic RL: 200+ tasks, 40+ harnesses, one reproducible pipeline — Dear_Treat3688 · 2026-10-27
- Voxel-city demo shows how to prompt Ling-3.1-flash for orbit, zoom, hover and focus interactions — Mrs-Grumpy23 · 2026-10-27