[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

operational guidance (Microsoft Threat Intelligence, Nov 3)

Tip: treat cracked-software and unofficial game Inno installers as hostile, and alert on new WorldProxyPool scheduled tasks

  • Enable cloud-delivered and reputation-based protection / PUA blocking; consider ASR rules that block low-prevalence executables.
  • Alert on creation of WorldProxyPoolAgent, WorldProxyPoolWatchdog or WorldProxyPoolUpdater, and on sdk-agent.exe under Program Files\WorldProxyPool.
  • Software inventory: flag WorldProxyPool, CharityEngine, unexpected BOINC/VirtualBox on endpoints that are not known research hosts.

Sources: Microsoft Security Blog: fake-download monetization campaign (Nov 3)