[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt idea from LNbits official warning and one operator report (Nov 8); no project-published IOC list yet

Hunt: new LNbits accounts followed by unexpected withdrawals on internet-facing instances

  • List LNbits user accounts created on Nov 8 (one reported window was 9:22 a.m. to 2:00 p.m. UTC) and any withdrawals those accounts made.
  • Check whether the LNbits web UI or API was reachable without an allowlist or VPN, and whether the Paywall extension was enabled before the first warning.
  • After you apply official patches, rotate API keys and node admin credentials the web app could read, then watch for further account-creation or withdrawal spikes.

Sources: LNbits shutdown notice (Nov 8) · Kevin Ravensberg operator report