[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guide (based on Europol's Nov 12, 2026 Operation Endgame notice)

After the Endgame takedown: check your domains in HIBP and Shadowserver, rotate anything stealer-exposed, and check WordPress sites for Gootloader

  • Credentials: watch HaveIBeenPwned domain search and Shadowserver reports for your domains; for any hit, reset the password, revoke sessions and tokens, and check the device it came from for an infostealer, since StealC/CastleRAT take cookies and saved logins too.
  • WordPress owners: Europol urges updating credentials, enabling MFA and patching; Gootloader injects pages offering fake legal documents (agreements, contracts) on hacked sites.
  • Endpoints: users who downloaded a 'legal agreement' ZIP from a search result are the classic Gootloader path; review proxy logs for such downloads.

Sources: Europol: Operation Endgame Nov 12, 2026 notice