#Subscribe to CyberDesserts

What is a JA3 Fingerprint? How TLS Client Fingerprinting Works

Recognise the software behind any encrypted connection from its TLS handshake alone. How JA3 fingerprinting works, how to read one, and what a single hash reveals about shared attacker tooling.

CyberDesserts·May 24·10 min read

AndroxGh0st and the limits of TLS fingerprinting

May 2026 The same scanner toolkit AWS attributed to Interlock ransomware in March 2026 also runs AndroxGh0st credential theft and two other cybercrime campaigns in CyberDesserts research, showing TLS…

CyberDesserts·May 23·15 min read

JA3 fingerprint Subscribe to CyberDesserts the credential pipeline research CISA Joint Advisory AA24-016a

Is npm Safe? A Practitioner Guide to npm Security in 2026

May 2026 Is npm safe to use in 2026? Yes, but the threat model has shifted. The risk in 2025-2026 is no longer the obvious malicious package, it is the trust-flow exploit: attackers compromise the de…

CyberDesserts·May 17·16 min read

Subscribe to CyberDesserts npm supply chain maintainer attacks reference axios npm supply chain attack case study npm audit fix not working

AI Agent Security Risks in 2026: The Incident Landscape and Hardening Framework

In February 2026, the supply chain threat model arrived in AI agent infrastructure all at once. The Model Context Protocol is the connective tissue across every major incident. Here's what practitione…

CyberDesserts·Mar 1·22 min read

Gartner supply chain retrospective Subscribe to CyberDesserts plaintext agent config should be treated as potentially compromised and rotated now jailbreak

Notepad++ Compromised for 6 Months: Check Your Version Now

Updated May 2026 Notepad++ update servers were compromised from June through December 2025 by a Chinese state-sponsored threat group. The attackers hijacked the hosting infrastructure to deliver cust…

CyberDesserts·Feb 4·6 min read

Subscribe to CyberDesserts Notepad RCE attackers exploited npm security threats