Amazon Aurora PostgreSQL now supports direct querying of Apache Iceberg and Parquet data in your data lake

This post was originally published on this site

Today, we’re announcing a new capability for Amazon Aurora PostgreSQL that you can use to directly query operational data together with data stored in your data lake in Apache Iceberg and Apache Parquet formats, using your existing PostgreSQL applications and tools. By eliminating the need to extract, transform, and load (ETL) structured data from data lakes into your operational database, you can reduce operational complexity and simplify application development. You can also use Aurora PostgreSQL to query data from data lakes managed in Iceberg REST Catalog (IRC)-compatible catalogs, giving you access to data across a breadth of analytics systems without moving or duplicating it. Whether you’re powering real-time dashboards, enriching transactions with historical context, or building AI agents that reason over both live and archived data, you can now do it all through a single, familiar interface.

Previously, if your application needed to combine recent transactional data in Aurora with historical records stored in Amazon S3, a common approach was to build reverse ETL pipelines that duplicated data, increased infrastructure costs, and required ongoing engineering effort to keep everything synchronized. This challenge only grows as you increasingly embed AI agents into your applications, where it is impractical to predict and pre-replicate every dataset an agent might need.

DuckLabs, the team that maintains the DuckDB project, recently joined Amazon, and this capability is an example of how the efficiency of DuckDB is being integrated into our services. DuckDB is now embedded directly within Aurora PostgreSQL, so you can query live operational data (including uncommitted writes) alongside your data lake in a single query. Query processing stays within Aurora, with no additional network hops and no ETL pipelines that duplicate data. You can query Apache Iceberg tables managed through the AWS Glue Data Catalog, as well as Parquet and Iceberg data stored in Amazon S3 and S3 Tables. You do all of this using familiar PostgreSQL syntax and your existing applications and tools.

We’re excited to bring the speed and simplicity of DuckDB directly into Aurora PostgreSQL, so you and your agents can query and combine operational and Iceberg data using the familiar PostgreSQL applications, tools, and endpoints already in use. By building this capability around DuckDB, future improvements to the open source engine can continue to bring performance and functionality gains to Aurora and other AWS services.

What is new

This capability is supported on two Aurora PostgreSQL major versions: 17 (starting with 17.11) and 18 (starting with 18.6). To use it, you create an Aurora PostgreSQL cluster, attach an IAM role with the AuroraAnalytics feature, and enable the aurora_analytics extension. The IAM role is what gives Aurora access to your data in Amazon S3 and the AWS Glue Data Catalog. You then create foreign tables that point to your Iceberg or Parquet data in the data lake, and query them using familiar PostgreSQL syntax. You can complete this setup through the Amazon RDS console, or with any PostgreSQL client such as psql. The process is well documented in the Aurora PostgreSQL documentation.

You can query data across external IRC-compatible catalogs through AWS Glue Data Catalog federation. You register the external catalog once with Glue, and then create foreign tables for the tables you want to query, the same way you would for any Glue-native table. A single query can then join data stored in Aurora with Iceberg tables registered across multiple catalogs, so applications get a unified view without moving data or replacing your existing catalog investments.

Aurora also applies optimizations such as predicate pushdown and column pruning so that only the relevant data is read. This keeps queries efficient even as the underlying data grows. Frequently accessed data is also cached in your Aurora instance, so subsequent queries against the same data return faster. You can inspect this behavior per query using aurora_analytics_stat_statements(), which reports metrics such as rows scanned, bytes read from Amazon S3, and cache hits.

To see how direct querying works, I connected to my Aurora PostgreSQL database using psql and created the extension:

CREATE EXTENSION aurora_analytics;

For my walkthrough, I set up a simple financial scenario. I have a recent_transactions table in Aurora with the last 7 days of customer transactions, and a Parquet file in Amazon S3 containing 5 years of historical transaction data. To make Aurora aware of the historical data, I created a foreign table pointing at the Parquet file in S3:

CREATE FOREIGN TABLE transaction_history ()
SERVER aurora_analytics_server
OPTIONS (
    location 's3://<my-bucket>/finance/transaction_history.parquet',
    format 'parquet'
);

Notice the empty parentheses in the CREATE FOREIGN TABLE statement. Aurora automatically reads the schema from the Parquet file metadata, so you do not need to define columns manually. For workloads with many tables, you can skip creating them one at a time: a single IMPORT FOREIGN SCHEMA statement bulk-creates foreign tables for every Iceberg or Parquet table in an AWS Glue Data Catalog database, inferring schemas automatically.

With both tables in place, I ran a single query that combines the recent operational data in Aurora with the historical data in S3:

SELECT merchant, category, amount, transaction_date, 'recent' AS source
FROM recent_transactions
WHERE customer_id = 'C-1001'
UNION ALL
SELECT merchant, category, amount, transaction_date, 'historical' AS source
FROM transaction_history
WHERE customer_id = 'C-1001'
  AND transaction_date >= CURRENT_DATE - INTERVAL '5 years'
ORDER BY transaction_date DESC
LIMIT 15;

The result shows both recent and historical transactions in a single result set. The 7 most recent rows come from Aurora, and the rest come directly from the Parquet file in S3. DuckDB handles the analytical scan of the Parquet data under the hood, while Aurora handles the operational data. That single query would have previously required a pipeline to move the historical data into the database first.

If a query pattern needs single-digit-millisecond latency, you can materialize data from the data lake into a native Aurora PostgreSQL table using familiar commands such as CREATE TABLE AS SELECT, INSERT INTO ... SELECT, or MERGE INTO. The materialized table lives in Aurora and is queried like any other PostgreSQL table, giving you a low-latency path for hot data without operating a separate ingestion pipeline. The read queries can run on any Aurora PostgreSQL instance in your cluster, whether the writer or a read replica, so you can offload analytical scans from your operational workload. The materialization commands write data into Aurora, so they run on the writer instance.

Get started today

Direct querying of Apache Iceberg and Parquet data from Amazon Aurora PostgreSQL is available today in all commercial AWS Regions and AWS GovCloud (US) Regions, at no additional charge. You pay only for the incremental Aurora compute the queries consume and Amazon S3 request costs for reading data lake files.

To learn more, visit the Amazon Aurora features page, read the Aurora PostgreSQL documentation, or try it in the Amazon RDS console. We welcome your feedback through AWS re:Post or through your usual AWS Support contacts.

— Esra

Scans for Wordfence Protected Websites, (Tue, Sep 29th)

This post was originally published on this site

Starting yesterday, our sensors picked up a small number of scans for "wordfence-waf.php". This particular script is used by Wordfence, a solution to protect WordPress sites. During the Wordfence install, the wordpress-waf.php file will be created in the site's root directory [1].

The requests themselves are unremarkable, not including any headers like User-Agent. Just the bare minimum "Host" header, which is the IP address of the targeted site.

The file does not include any secrets or configuration parameters, but it includes other scripts intended to run before any WordPress code to assist with Wordfence's integration. My best guess is that attackers may attempt to enumerate Wordfence-protected sites to limit detection. Wordfence collects intelligence from the sites it protects and often publishes information about newly detected attacks. This, in turn, "burns" exploit techniques, as other sites will not be able to protect themselves as well. 

Another possible option is that these scans attempt to bypass Wordfence. By using the IP address instead of the hostname, the attacker may attempt to identify Wordfence-protected sites that are directly reachable. This could be used to bypass Wordfence protection and expose sites that rely on it to delays in patching. Web application firewalls and "virtual patching" are only temporary fixes; please follow Wordfence's guidance on preventing the bypassing of its protection. But wordfence-waf.php is part of the "Extended Protection" feature, which is designed to help prevent this type of bypass.

[1] https://www.wordfence.com/help/firewall/optimizing-the-firewall/

—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)

This post was originally published on this site

Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. Today's update for the current "27" branch does not address security issues, but fixes some functional issues that got caught after the release two weeks ago. A 27.1 version was also expected to support the new foldable iPhone and will likely include specific features geared to the soon to be available device.

AWS Weekly Roundup: GPT-6 Sol and Luna, Claude Opus 5.5 on Amazon Bedrock, Strands harness, and more (September 28, 2026)

This post was originally published on this site

If there’s one theme that defined last week, it’s choice. The frontier models keep arriving, and the interesting question is no longer just “how smart is it?” but “which model fits this step, at this cost, at this latency?” That’s exactly what landed on Amazon Bedrock over the past few days: GPT-6 Sol and GPT-6 Luna from OpenAI, giving you two new points on the intelligence-versus-efficiency curve, and Claude Opus 5.5 from Anthropic, the first of the Claude 5.5 family.

GPT-6 Sol is built for the demanding, recurring work of development and operations, while GPT-6 Luna makes focused, repeatable tasks practical at high volume, and both ship at significantly lower pricing than their GPT-5.6 predecessors. Claude Opus 5.5, meanwhile, does more with fewer tokens than Opus 5 and is tuned for agentic coding and long-running tasks. What I like about all three is that they push toward the same idea: match the model to the job instead of reaching for the biggest one every time. The other thread was observability catching up to this agentic world, including a launch I had the pleasure of writing about myself.

Now, let’s get into this week’s AWS news…

Last week’s launches

Here are some launches and updates from this past week that caught my attention:

  • Introducing Amazon CloudWatch Omni – You can now observe your applications and AI agents together in a single, collaborative experience. Amazon CloudWatch Omni is built on OpenTelemetry, so your existing telemetry shows up with nothing to reconfigure, and your whole team reaches it through one URL with enterprise SSO — no console access required. It auto-discovers your services, maps dependencies, and brings AWS DevOps Agent into investigation sessions to correlate signals and trace root causes. There’s a companion post on the agent-observability side, a deeper dive on the AWS Cloud Operations blog on what observability for the AI era looks like, and the announcement on What’s New with the specifics. If you want the bigger picture, Matt Wood’s Wrong, not broken is a great read on why correctness now has to be measured at the level of the run.
  • Enhanced custom event buses in Amazon EventBridge – Amazon EventBridge now offers an enhanced custom event bus purpose-built for organizations scaling event-driven applications across teams and accounts. You can now deploy a single centralized bus shared across every account in your organization through AWS RAM, with optional event ordering, a simplified Subscriber resource that bundles filtering, targets, and retries, content-based deduplication, and synchronous invocation for targets like AWS Lambda. A new ingress/egress pricing model replaces the compounding cross-account routing charges of multi-bus setups, and your existing buses keep working unchanged as “classic.”
  • Amazon SageMaker HyperPod Inference Gateway – You can now front your LLM inference on Amazon SageMaker HyperPod with a Kubernetes-native, GPU-aware routing layer that deploys as a single Amazon EKS managed add-on with zero application changes. Instead of round-robin load balancing, it routes on real-time inference signals — KV cache utilization, queue depth, prefix cache hits, predicted latency, and more — cutting first-token latency by up to 82% in mixed-hardware and bursty scenarios. It works with any OpenAI-compatible model server, including vLLM and SGLang.
  • AI agent skills for AWS End User Messaging and Amazon SES – You can now build and send messages by asking your AI coding agent in plain language. Amazon SES and AWS End User Messaging publish AI agent skills for the AWS MCP Server, giving your agent step-by-step, validated guidance for tasks like verifying a sending identity, sending a production email, or building a branded RCS agent with cards and buttons. The skills work with Claude Code, Codex, Cursor, and Kiro, so you can complete messaging workflows without hopping between docs and console screens.

For a full list of AWS announcements, be sure to keep an eye on the What’s New with AWS page.

Other AWS news

Here are some additional posts and resources that you might find interesting:

  • Introducing Strands harness – The Strands Agents team released Strands harness, a fully assembled, general-purpose agent harness you can run locally or deploy anywhere, under Apache 2.0. It takes one line of Python or TypeScript to wire up your model of choice across Amazon Bedrock, Anthropic, OpenAI, Google, or a local Ollama model, and it ships with sensible defaults for prompt caching and context management (truncating bulky tool results, compacting when the context window fills up, and keeping memory across runs). The team reports it costs about 28% less than comparable harnesses on the same models while holding accuracy steady.
  • Announcing the new AWS Reimagine report on AI – The AWS Executive in Residence team spent nine months interviewing 154 leaders across 27 countries about what separates organizations that turn AI into value from those that don’t. The report is candid (including where AI hasn’t worked at Amazon), and the recurring insight is that once building gets fast, the bottleneck moves to deciding, funding, and governing the work. Well worth a read if you’re thinking about how your teams adopt AI in practice.

For a full list of AWS blog posts, be sure to keep an eye on the AWS Blogs page.

Upcoming AWS events

Check your calendar and sign up for upcoming AWS events:

  • AWS re:Invent – AWS re:Invent returns to Las Vegas from November 30 to December 4, and session times, locations, and speakers are live. Reserved seating opens October 6, so register now and be ready to claim your spot in chalk talks, workshops, and builders’ sessions.
  • AWS Summits – With re:Invent on the horizon, the Summits are wrapping up for the year. The last stop is Dubai (September 30) at the Dubai World Trade Center, with 60+ sessions, an AWS Village, and hands-on workshops.

Join the AWS Builder Center to connect with builders, share solutions, and access content that supports your development. Browse here for upcoming AWS-led in-person and virtual events and developer-focused events. That’s all for this week. Check back next Monday for another Weekly Roundup!

— Daniel Abib

A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

This post was originally published on this site

Introduction

My previous post on Macfinger ClickFix was two days ago, and this campaign remains active. The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer as originally reported. There are too many differences between what I've documented with recent AMOS Stealer activity and what I'm now seeing with this malware. The data collection and method of exfiltration is different between these two malware families. The persistence mechanism is different. Finally, AMOS Stealer uses an installer with a combined arm64/x86_64 architecture, but this malware uses either an arm64 or an x86_64 Mach-O binary depending on the architecture of the victim's host. There are too many differences with this malware.

The malware delivered by Macfinger ClickFix is indeed an information stealer. I just don't know what to call it.

In an attempt to find out, this diary examines an infection from the Macfinger ClickFix campaign on Thursday, 2026-09-24. This infection was on a physical host running macOS 27.0 (Golden Gate).


Shown above: Example of a fake CAPTCHA/verification page generated in the Macfinger ClickFix campaign.

The Macfinder Domain and ClickFix Text

On Thursday 2026-09-24, the Macfinder domain for the fake verification page was hollow-badger-moasfraum[.]life. The clipboard-injected text was similar to what I reported in my previous diary, and I pasted it into a Terminal window.


Shown above: Clipboard-injected text from the Macfinger ClickFix campaign pasted in a Terminal window.

I saw the same message in my Terminal window after running the ClickFix text as the message noted in the Ransom-ISAC blog.


Shown above: Terminal window after running the ClickFix text.

Loader Activity

The ClickFix text retrieved a loader from hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1. This loader is a shell script, and it saves a binary under the user's /Library/Caches/com.apple.securityd/ directory as com.apple.periodic.

If com.apple.periodic already exists and is running, the script will kill that running process.


Shown above: The initial downloaded shell script showing a location of a binary.

The script checks the system's architecture using uname -m and will download the appropriate payload depending on the architecture. Apple silicon is arm64, while systems using an Intel processor are x86_64. The corresponding URLs are:

  • arm64 Mach-O binary: hxxp[:]//45.131.215[.]56/a7a11f95?force=1
  • x86_64 Mach-O binary: hxxp[:]//45.131.215[.]56/4e04813226b1b93?force=1


Shown above: A later section of the downloaded shell script showing URLs for the follow-up malware.

A string of base64 text shown in the above image translates to a URL for the C2 server: hxxp[:]//95.163.153[.]80:8133/api/t

Post-Infection C2 Traffic

The post-infection C2 traffic on Thursday 2026-09-24 went a different IP address than I reported in my previous diary. But the URL patterns remained the same.


Shown above: Traffic from the infection filtered in Wireshark.

After retreiving the Mach-O binary, the infected macOS host reported to the C2 server that the download from the arm64 URL was good.


Shown above: The infected host reporting to the C2 server.

The infected host also reported to the server when the malware was exexuted (exec_start) and if it ran successfully (exec_ok). Then through more POST requests to the same /api/t URL, the infected host started reporting more information, and I started seeing the User-Agent string as Go-http-client/1.1.


Shown above: More traffic to the C2 server.

For C2-traffic, the biggest difference I've seen from AMOS Stealer is that this stealer uses websocket traffic.


Shown above: Request to switch protocol to websocket traffic.

In addition to websocket traffic, the infected host continued to send other HTTP POST requests. The next three images show an example of data exfiltration consisting of two HTTP requests in a single TCP stream.

These POST requests for data exfiltration used /api/credentials in the URL.


Shown above: Start of one of the HTTP POST requests for data exfiltration.


Shown above: End of one of the HTTP POST requests for data exfiltration.


Shown above: Follow-up HTTP POST request in the same TCP stream reporting "upload_session_ok."

Before exfiltrating various types of data, my infected macOS host asked to allow access to different folders and applications.

Permissions Requested By the Malware

The following images show the pop-ups I saw on my infected macOS host for access to various applications and folders.


Shown above: The first two access request pop-ups on my infected macOS host.


Shown above: The next four access request pop-ups on my infected macOS host.

The last pop-up requests were for my administrator password and my macOS Keychain password. The pop-up for the macOS Keychain password would not accept the administrator password, and I had not set up a separate password for it on the macOS host.


Shown above: The final pop-ups on my infected macOS host for passwords.

The pop-up messages were:

  • "bash" wants access to control the "Notes.app".
  • "Terminal.app" would like to access files in your Documents folder.
  • "Terminal.app" would like to access files in your Desktop folder.
  • "Terminal.app" would like to access files in your Downloads folder.
  • Allow "Terminal.app" to access your music, video activity, and media library in Apple Music?
  • Allow "Terminal.app" to access your photo library?
  • System Error pop-up requesting administrator password
  • macOS Keychain requires a separate password to protect your saved credentials.

Persistent Malware

A copy of the malware binary was made persistent through the following .plist file:

  • /Users/[username]/Library/LaunchAgents/com.apple.softwareupdated.plist

The above .plist file runs a copy of the Mach-O binary at:

  • /Users/[username]/Library/Caches/com.apple.softwareupdate/SoftwareUpdate

Notably, copies of the Mach-O binary were different from each other. They had slightly different file sizes and different SHA-256 hashes.

  • 33,492,336 bytes – Initial Mach-O arm64 binary from hxxp[:]//45.131.215[.]56/a7a11f95?force=1
  • 33,297,728 bytes – First saved binary at /Users/[username]/Library/Caches/com.apple.securityd/com.apple.periodic
  • 33,297,760 bytes – Persistent binary at /Users/[username]/Library/Caches/com.apple.softwareupdate/SoftwareUpdate

They all appear to be copies of the same binary but with some relatively slight differences from each other.

Indicators of Compromise

SHA-256 hash: c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912
Description: Shell script loader from 45.131.215[.]56

SHA-256 hash: 457ed02b0a63ccf872e8459c91e2d1d6844a75414358849333f518cc538055b7
Description: x86_64 Mach-O binary from 45.131.215[.]56

SHA-256 hash: 5a2242b862ef52fe7a08af596198412a7676c948bcd64a25ce5d2e6d4b35c6fb
Description: arm64 Mach-O binary from 45.131.215[.]56

SHA-256 hash: 3e26e006210ed398f98c090e9f1c982e76b3b73f1ce3e04ee1bf8d45c56e1a89
Description: arm64 Mach-O binary first saved to disk com.apple.periodic

SHA-256 hash: 4a5952849232691849ed900609d7ff271ce296fe3cee4a81b58c28f2839fb5b6
Description: Persistent arm64 Mach-O binary SoftwareUpdate.bin

Location of files retrieved from the infected macOS host:

  • /Users/[username]/Library/LaunchAgents/com.apple.softwareupdated.plist
  • /Users/[username]/Library/Caches/com.apple.securityd/com.apple.periodic
  • /Users/[username]/Library/Caches/com.apple.softwareupdate/SoftwareUpdate

Macfinder ClickFix domain:

  • hollow-badger-moasfraum[.]life

Malware hosting URLs:

  • hxxp[:]//45.131.215[.]56/4e04813226b1b93?force=1
  • hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1
  • hxxp[:]//45.131.215[.]56/a7a11f95?force=1

Post-infection C2 URLs:

  • hxxp[:]//95.163.153[.]80:8133/api/credentials
  • hxxp[:]//95.163.153[.]80:8133/api/shell/agent
  • hxxp[:]//95.163.153[.]80:8133/api/t

Final Words

As noted earlier, I don't think the malware is a variant of AMOS Stealer. However, I still don't know what to call it, and I could still be wrong. I suspect people more experienced with macOS malware can confirm what, exactly, this malware from the Macfinder ClickFix campaign is.

A packet capture (pcap) of the infection traffic and copies of the associated malware are available here.

Bradley Duncan
brad [at] malware-traffic-analysis.net

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Introducing enhanced custom event buses in Amazon EventBridge for enterprise-scale event-driven applications

This post was originally published on this site

Organizations building event-driven applications on Amazon EventBridge typically start with a single custom event bus in one account. This works well when a single team owns the architecture. As adoption grows across the organization, though, things get complicated. AWS best practices recommend a multi-account structure, which means each team runs in its own account. To route events between them, teams create multiple event buses connected through cross-account rules or bus-to-bus configurations. This workaround reintroduces the operational complexity that serverless architectures are meant to eliminate. Platform teams lose visibility into who is subscribing to which events, cross-account and bus-to-bus routing charges compound quickly, and teams that need capabilities like event ordering are forced to build complex workarounds or adopt entirely different technologies.

Today, we are announcing an enhanced custom event bus in Amazon EventBridge, purpose-built for organizations scaling event-driven applications across teams and accounts. With the new enhanced custom event bus, you can deploy a single, centralized event bus shared across all AWS accounts in your organization, with ordering guarantees, a simplified Subscriber resource, and a new pricing model that delivers improved economics at scale and cost allocation for publishers and subscribers.

Let’s try it out

To get started with an enhanced custom event bus, I navigated to the EventBridge console in the AWS Management Console and opened the Create custom event bus page. I selected Custom event bus, the recommended option labeled New. The page also offered Custom event bus – classic, which continues to receive events and route them with rules and targets. Below the selection, EventBridge showed how the new bus works. One shared bus serves every team in the organization. Publishers send events, subscribers consume only what they need, and EventBridge handles ordering, retention, routing, and delivery.

The Create custom event bus page. Custom event bus is the recommended new option, with ordered delivery, filter patterns, event replay, and sharing across your AWS organization. Custom event bus – classic remains available for existing workloads.

Next, I configured resource sharing. I turned on Enable event bus sharing and selected Allow sharing only within your organization. I chose AWS account ID as the principal type. I could also share with an organization, an organizational unit, or an AWS Identity and Access Management (IAM) role or user. Sharing uses AWS Resource Access Manager (AWS RAM), so I did not have to set up cross-account permissions or bus-to-bus routing myself.

Resource sharing on the new custom event bus. I enabled sharing within my organization through AWS RAM and selected an AWS account as the principal, which is how teams publish and subscribe on the same bus without extra routing.

Organization-wide sharing

With the new enhanced custom event bus, you can create a single event bus and share it across all AWS accounts in your organization. Platform teams deploy one bus and establish it as the central event backbone, eliminating the need to configure cross-account permissions or bus-to-bus routing. Application teams across your organization can publish and subscribe to events on the same bus without waiting for infrastructure provisioning.

Publishers send events without needing to know which teams consume them, and subscribers create their own Subscriptions independently. Platform teams maintain visibility into all event flows and fine-grained control over who can publish and consume events. The new enhanced custom event bus has a default quota of 10,000 Subscribers per bus, and you can request a higher quota. That reduces the fragmentation that occurs when subscriber limits force you to split across multiple buses.

Event ordering

Event-driven architectures work best when consumers are designed around asynchronous patterns, where the order of events does not matter. There are a few cases where order does matter. In a logistics application, driver location updates must arrive in sequence. Out-of-sequence events cause routing algorithms to make decisions based on stale data.

The enhanced custom event bus supports both patterns on the same bus. Publishers can include an EventGroupId when sending events. EventBridge delivers events that share the same EventGroupId in sequence to Subscribers that chose ordered delivery. Other subscribers on that bus can receive the same events without ordering. You can keep events for each driver in the correct order without building complex workarounds, while the rest of your consumers stay fully asynchronous.

To support ordered processing, the enhanced custom event bus includes synchronous invocation for targets like AWS Lambda. Synchronous mode confirms successful processing before acknowledging the event, eliminating the common pattern of placing Amazon Simple Queue Service (Amazon SQS) between an event bus and Lambda to ensure reliability.

Subscriptions

The enhanced custom event bus introduces the Subscriber resource, which combines event filtering, target configuration, retry policies, and dead-letter destinations into a single, manageable unit. Today, achieving the same outcome with EventBridge requires configuring separate rules, targets, and retry settings across multiple resources. Subscribers simplify this by giving each consumer one resource that defines what events they want, where to deliver them, and how to handle failures.

Subscribers also include variable start time options, making it easier for teams to onboard new consumers or replay events to recover from application errors or hydrate new applications.

Event evaluation

Publishers can turn on content-based deduplication so EventBridge detects and drops retries of the same event from the payload itself. You do not have to generate and track a deduplication ID when a timeout or a partial failure sends the same event twice. EventBridge hashes the meaningful parts of the event and collapses matches that arrive within five minutes, which gives those retries exactly-once delivery semantics instead of EventBridge’s usual at-least-once model. If you already stamp your own idempotency token, keep using it. Content-based deduplication is for sources that cannot reliably identify the same event on a retry.

Subscribers can use JSONata expressions to reshape an event before it reaches a target, extracting fields, renaming them, or computing new values when a downstream API expects a different shape. If you already produce Apache Avro or Protocol Buffers events, EventBridge can deserialize those payloads to JSON, allowing subscribers fine grained filtering and routing on the full event payload without having to consume, deserialize, and match or discard on their own.

New pricing model

The enhanced custom event bus uses a new ingress and egress throughput pricing model. Publishers pay for events ingested, and subscribers pay for events delivered. This replaces the per-event model where cross-account and bus-to-bus routing charges compound in multi-bus architectures. For pricing details, visit the EventBridge pricing page.

Existing EventBridge custom event buses continue to work as they do today with no changes required. They now appear as Custom event bus – classic. The enhanced custom event bus is a new resource that you adopt at your own pace. In the console, it appears as Custom event bus.

Now available

The enhanced custom event bus is available today in the US East (N. Virginia, Ohio), US West (Oregon), Europe (Ireland, Frankfurt, Stockholm, Spain), and Asia Pacific (Hong Kong, Malaysia, Mumbai, Singapore, Sydney, Thailand, Tokyo) Regions. You can create your first enhanced custom event bus through the AWS Management Console, AWS Command Line Interface (AWS CLI), or EventBridge APIs. To get started, visit the EventBridge documentation or try it out directly in the EventBridge console.

One URL, Three Different Tricks, (Thu, Sep 24th)

This post was originally published on this site

Yesterday, we received a phishing email with an interesting link. At first sight, it looks like garbage, but every piece of it has been carefully crafted to confuse basic security controls. Here is the defanged link:

hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc.sans.edu

Let's break it down…

The first trick is the old "userinfo" field. According to RFC 3986[1], everything between the scheme and an "@" inside the authority is treated as credentials ("user:password@host"). Browsers silently ignore it, but it has two advantages for the attacker. The random string ("YKZjqa7A") makes every URL unique, which defeats exact-match blocklists and URL reputation lookups. It probably also acts as a tracking token per victim or campaign. As a side effect, the whole thing now looks like an email address to any tool that doesn't parse URLs strictly.

The second trick is the hostname itself: "gynd–.koncar-hr.com". Per the classic hostname rules (RFC 952/1123[2]), a label can't start or end with a hyphen. DNS doesn't care, and browsers happily resolve and visit it. However, strict validators, regex-based URL extractors, and some link-rewriting or sandboxing solutions may consider it invalid and simply skip it. A URL that is never extracted is never scanned. The random subdomain also suggests wildcard DNS, so each victim gets a brand-new hostname that no blocklist knows. The parent domain is a lookalike of the legitimate "koncar.hr" (a Croatian industrial group), with the ccTLD turned into a hyphenated ".com".

The last trick is the victim's email address, appended in the path. This is common with phishing kits: the page reads the path, pre-fills the login form with the victim's address, and sometimes adapts the branding to the email domain. There is another benefit, though. A poorly written parser that splits the string on the last "@" will conclude that the host is "isc.sans.edu", the recipient's own trusted domain! Per the WHATWG[3] URL standard, the authority ends at the first "/", so the browser correctly connects to the attacker's server.

The result is a single string that tells three different stories. A naive filter sees two email addresses or a link to your own domain. A strict validator sees an invalid hostname and drops it. The browser sees a perfectly valid URL and takes the victim straight to the phishing page. Attackers aren't exploiting a vulnerability here but the differences between parsers.

Tip: If you want to hunt for this kind of link, look for URLs with more than one "@", hostname labels starting or ending with a hyphen, and paths containing the recipient's own email address.

[1] https://www.rfc-editor.org/info/rfc3986/
[2] https://www.rfc-editor.org/info/rfc952/
[3] https://url.spec.whatwg.org

Xavier Mertens (@xme)
Senior ISC Handler | SANS Principal Instructor | Freelance Consultant
Xameco | PGP Key

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Macfinger ClickFix campaign, (Tue, Sep 22nd)

This post was originally published on this site

Introduction

I've found several legitimate websites with injected script for a campaign using the ClickFix social engineering technique. This particular ClickFix campaign was documented earlier this month on the Ransom-ISAC Blog, but it doesn't appear to have a nickname yet. Since this campaign is targeting macOS environments through a fingerprinting process, I'm calling it the "Macfinger ClickFix" campaign. No, this is not related to the MacFinger utility from decades ago. Instead, think of the movie Goldfinger, but with macOS malware and the internet instead of James Bond and Miss Galore.


Shown above: An image I created to represent the Macfinger ClickFix campaign.

Today's diary presents indicators from the Macfinger ClickFix campaign that I saw on Tuesday, 2026-09-22.

Images From the Infection


Shown above: First part of the Macfinger injected script in a page from a legitimate website.


Shown above: Second part of the Macfinger injected script in a page from a legitimate website.


Shown above: Fake bot protection page caused by the injected Macfinger script.


Shown above: ClickFix instructions from fake verification pop-up caused by the injected Macfinger script.

While displaying the fake bot protection page with the verification instructions, the Macfinger domain receives frequent POST requests from the victim host. These report information on the user and track the user actions. Here's an example of a POST request through HTTPS traffic after the user has clicked on the page. In this case, the user abandoned the page without following the instructions.


Shown above: POST request over HTTPS to the Macfinger domain reporting the user information.

I had tested one of the Macfinger-infected sites on Monday, 2026-09-21 which had the same post-infection traffic that I saw the next day on Tuesday, 2026-09-22. The image below shows an example of the infection traffic, with the malware files retrieved from 45.150.33[.]128 and the post-infection C2 traffic on 95.163.153[.]80 over TCP port 8133.


Shown above: Traffic from an infection filtered in Wireshark.

Indicators of Compromise

The following are indicators from Tuesday, 2026-09-22.

Traffic to the Macfinger domain:

  • hxxps[:]//velvet-otter-glagceis[.]life/t.js?site=4f0529f47320472732961318d7d0dfd1
  • hxxps[:]//velvet-otter-glagceis[.]life/t.4b1009ff6c3f.js
  • hxxps[:]//velvet-otter-glagceis[.]life/ext-b.4f9db6afd06a.js
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect
  • hxxps[:]//velvet-otter-glagceis[.]life/collect

ClickFix text from the Macfinger domain, saved to a text file:

SHA-256 hash: 6606a5f18184b224a56c9cb658fa26f7fce45099da548a30a8db2c5f2c70377c

  • File size: 581 bytes

Initial download:

SHA-256 hash: 9d87b41c2b29ccbeac851b98f1a7dce4ab4781fec0cbc55fa6f93a6299a3d564

  • File size: 4,674 bytes
  • File type: Bourne-Again shell script text executable, ASCII text, with very long lines
  • File location: hxxps[:]//45.150.33[.]128/92961f75b259df2?force=1

Follow-up malware from the above shell script:

SHA-256 hash: b68cdb1b46502fbce67ce3f8110682936d06afd2116af096e30abd4c8376b6dc

  • File size: 33,285,040 bytes
  • File type: Mach-O 64-bit executable arm64
  • File location: hxxps[:]//45.150.33[.]128/d4c8083a7d97?force=1

SHA-256 hash: 1a3765e8cb0055ec31693b8f82ce9744106dee08368259661600b072c6805af4

  • File size: 34,118,904 bytes
  • File type: Mach-O 64-bit executable x86_64
  • File location: hxxps[:]//45.150.33[.]128/2286de55f9afd?force=1

Post-infection Traffic:

  • 2026-09-21 23:12:58 UTC – hxxp[:]//45.150.33[.]128 – GET /92961f75b259df2?force=1
  • 2026-09-21 23:12:59 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:12:59 UTC – hxxp[:]//45.150.33[.]128 – GET /d4c8083a7d97?force=1
  • 2026-09-21 23:13:04 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:05 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:05 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:08 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:08 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:11 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:14 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:15 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:20 UTC – ipinfo[.]io – HTTPS traffic
  • 2026-09-21 23:13:21 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:21 UTC – hxxp[:]//95.163.153[.]80:8133 – GET /api/shell/agent
  • 2026-09-21 23:13:21 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:21 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:22 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:22 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:23 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:23 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:23 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:24 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:26 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:30 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:30 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:30 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:30 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/credentials
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • 2026-09-21 23:13:31 UTC – hxxp[:]//95.163.153[.]80:8133 – POST /api/t
  • And so on…

Final Words

The Ransom-ISAC article on this activity calls the final malware a variant of Atomic macOS (AMOS) Stealer. The indictors I found here don't fully align with the AMOS Stealer activity I've previously reported from a different (non-ClickFix) campaign, so this is a different variant than the AMOS Stealer I've looked into.

For mitigation and protection against Macfinger and other ClickFix campaigns, see guidance from the Microsoft Security Blog.

Macfinger ClickFix seems like a fairly widespread campaign, but I haven't found much about it because 1) it seems relatively new and 2) it's only targeting macOS hosts.

Bradley Duncan
brad [at] malware-traffic-analysis.net

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Introducing Amazon CloudWatch Omni: AI-powered observability for generative AI and agentic workloads

This post was originally published on this site

Today, Amazon CloudWatch introduces CloudWatch Omni, a unified observability experience for application and AI workloads that is app-centric, AI-powered, built on open standards, and delivered off-console. CloudWatch Omni is a purpose-built observability, evaluation, and experimentation solution for AI agents. It helps teams design, evaluate, and operate AI agents across any model provider, framework, or runtime, with an eval-driven workflow, support for the tools you already use, and observability delivered where you work: directly in your IDE and through a standalone web experience, separate from the AWS Management Console.

Organizations deploying agentic AI systems face observability challenges that traditional monitoring can’t address. Agent behavior is non-deterministic: a prompt change can degrade response quality even when standard metrics show no errors. Teams spend hours manually reviewing logs across multiple systems, unable to pinpoint what changed or why. Existing tools force teams to choose between siloed generative AI monitoring or fragmented solutions requiring constant context-switching between their coding environment and browser-based dashboards.

CloudWatch Omni captures every trace and includes built-in evaluators for correctness, coherence, retrieval quality, and tool selection, among others. You can compare prompt versions side by side in the playground, build test datasets from production traffic, run experiments across different configurations, and detect regressions automatically.

Two surfaces for development and operations

CloudWatch Omni delivers observability through two complementary surfaces. Developers get a native extension inside VS Code and Kiro (the currently supported IDEs), where traces appear as you run your agent with a playground and evaluators a click away. Operators get a standalone web experience, separate from the AWS Management Console to monitor the fleet, accessible through SSO with no AWS console needed. Both share the same data: the trace a developer debugs is the trace an operator investigates.

The Cloud Login feature connects your local IDE environment to your AWS account, enabling you to send telemetry data to Amazon CloudWatch for persistent storage, share traces with your team, and access production dashboards. This connection is optional. You can use CloudWatch Omni entirely locally during development, then connect to the cloud when you are ready to monitor agents in production.

Getting started

CloudWatch Omni offers two ways to get started: through the IDE extension (for VS Code and Kiro) or directly through the cloud experience, where you can start sending telemetry data to CloudWatch without installing any IDE extension. In this walkthrough, I install the extension, create an agent, run it, and explore the traces and evaluation tools from my IDE.

After installing the CloudWatch Omni extension from the VS Code Marketplace, the CloudWatch Omni icon appears in the Activity Bar. From the welcome screen, I selected Get started with Sample Project to load a pre-configured agent with sample trace data or use shortcut to Command Palette using Command + Shift + P (on macOS) or Ctrl + Shift + P (on Windows/Linux) and select Omni: Create a new Project

CloudWatch Omni welcome screen and create new project in VS Code

Figure 1. CloudWatch Omni welcome screen & create new project in VS Code

The sample project comes with an agent implementation and example datasets. Part of the getting-started experience is adding OpenTelemetry instrumentation, and CloudWatch Omni guides you through each step. You can also create a new agent from scratch. CloudWatch Omni walks you through the process using an interactive chat where you define the agent’s purpose, select a model provider, and configure tools. All data is stored locally by default. You can optionally connect to AWS to send data to Amazon CloudWatch.

After verifying the configuration, I started the local dev server and sent a question to the agent. What makes this different from a typical chatbot interface is what happens next: selecting View Trace shows exactly how the agent processed the request.

CloudWatch Omni guides your AI code assistant to configure the development environment

Figure 2. CloudWatch Omni guides your AI code assistant to configure the local development environment for testing

CloudWatch Omni integrates with AI code assistants such as Kiro, Claude Code, and Codex to streamline the setup process. These assistants can configure the Dev Server, install dependencies, and set up instrumentation on your behalf, so you can go from installation to running your first traced agent session in minutes without manual configuration.

Interacting with the agent and viewing traces

Figure 3. Interacting with the agent and viewing traces

Traces are essential for understanding AI agent behavior. Unlike traditional request-response systems, agents make multiple decisions per invocation: choosing tools, composing prompts, and chaining sub-calls. Without full trace visibility, diagnosing why an agent produced an incorrect answer or took an unexpected path becomes guesswork. CloudWatch Omni records every step in a structured timeline so you can pinpoint exactly where behavior diverged.

The Trace Explorer shows a detailed breakdown of every step the agent took (LLM calls, tool invocations, and reasoning steps) in a structured, hierarchical timeline. I could drill into any span to inspect inputs, outputs, token usage, and latency.

Trace Explorer showing the agent execution timeline

Figure 4. Trace Explorer showing the agent’s execution timeline

The Trace Explorer also supports Compare mode, which places two traces side by side to see how different prompts or configurations affect behavior. Compare mode is especially helpful when debugging regressions. And with Ask Assistant, an AI agent analyzes your traces to surface patterns and anomalies, answering questions like “Why did the agent call this tool twice?”

Comparing two traces side by side

Figure 5. Comparing two traces side by side

Evaluation is what turns observability into actionable quality improvement for generative AI. Traditional metrics like latency and error rate cannot tell you whether an agent’s response was helpful, coherent, or factually correct. Evaluators score each response against quality dimensions, letting you measure what users actually experience and catch regressions that standard monitoring misses entirely.

CloudWatch Omni includes 17 built-in evaluators for metrics like coherence, helpfulness, faithfulness, and routing correctness. I selected traces from the Trace Explorer, chose evaluators, and ran an evaluation, getting per-example scores and aggregate metrics without building any custom evaluation framework.

Running evaluations on traces

Figure 6. Running evaluations on traces

From there, I used the Playground to test different system prompts side by side, comparing multiple model and prompt configurations in real time to see how each variation affects output quality before committing changes. With the Experiments view, I could run the same dataset against two agent variants and compare their evaluation scores, latency, and token usage side by side to pick the best-performing configuration.

Figure 7. Comparing evaluations across agent variants in the Omni Experiments console

With Prompt Management, you can version and track prompt configurations over time, making it easy to roll back when a new version underperforms.

CloudWatch Omni also provides a Session Explorer to review full conversation histories and understand how agents handle multi-turn interactions, along with an Agent Topology view that visualizes the architecture of your agent system, including sub-agents, tools, and their interconnections. You can drill into any node to inspect performance and identify bottlenecks.

CloudWatch Omni also offers a dedicated web experience accessible from any browser without an IDE. Teams can access all capabilities collaboratively, including application monitoring, analytics, agent observability, and AI-powered investigations.

CloudWatch Omni web experience with application monitoring, analytics, and agent observability

Figure 8. CloudWatch Omni web experience with application monitoring, analytics, and agent observability

I curated traces into golden datasets for structured experimentation. The Experiment function runs the agent against a dataset and automatically scores results, creating benchmarks for regression testing whenever prompts or agent logic change.

If you already have an agent built with a supported framework, CloudWatch Omni provides two paths to add instrumentation: Auto-instrument with Kiro, which detects your framework and configures tracing automatically, or manual instrumentation with ready-to-use code snippets for Python and TypeScript. For detailed instrumentation guides, see the CloudWatch Omni documentation.

Supported frameworks and open standards

The walkthrough above uses the sample project, but CloudWatch Omni works with the agent frameworks teams are already using: LangChain, LangGraph, CrewAI, OpenAI SDK, Strands, Vercel AI SDK, and more, in both Python and TypeScript. It also provides native observability for agents built with Amazon Bedrock AgentCore, and uses AgentCore’s evaluation capabilities to assess agent quality directly within the Omni workflow.

Instrumentation uses open standards (OpenInference and ADOT), whether your agents run on Lambda, ECS, EKS, or other clouds. For evaluation, Omni integrates with third-party evaluators including Braintrust, DeepEval, and Ragas, alongside built-in datasets, a playground, and batch experiments. No re-platforming required.

CloudWatch Omni brings agent observability and application observability together in a single experience. For the application observability experience, read the companion post Introducing Amazon CloudWatch Omni: collaborative AI-powered observability for your applications.

Pricing and availability

Amazon CloudWatch Omni is now generally available. The IDE extension is free to use. You don’t need an AWS account to get started. You only need AWS credentials for Amazon Bedrock models, or API keys for other providers like OpenAI or Anthropic. Get started today by installing the extension from the VS Code Marketplace.

To explore all capabilities and get started quickly, visit CloudWatch on AWS Builder Center.

If you want to call APIs, search documentation, find regional availability, and check troubleshooting about this feature, try using the AWS MCP Server and plugins with your preferred AI tool. Share your feedback on AWS re:Post or reach out through your usual AWS Support contacts.

Happy building!

— Daniel Abib