MikeGPT CyberSecurity

# Actionable Guidance for Island # Generated: 2026-03-16 11:01:02 # Step 1: Navigate to Island Management Console → Policies → Browser Policies → Permissions # Purpose: Address AI-assisted phishing by restricting web application permissions # Expected: Automatic blocking of unauthorized requests for sensitive browser permissions (e.g., clipboard, camera, microphone, location) across all non-essential domains, preventing malicious sites from exploiting browser capabilities. # Step 2: Navigate to Island Management Console → Policies → Data Protection → Create Rule # Purpose: Govern access and prevent data exfiltration from sensitive ERP and financial systems # Expected: Enforcement of strict DLP controls (disabling copy/paste, screen capture, printing, and unauthorized downloads) specifically scoped to the URLs of your ERP and financial applications. # Step 3: Navigate to Island Management Console → Policies → Device Posture → Browser Version # Purpose: Mitigate critical Chrome/Chromium security flaws # Expected: Establishment of a minimum required Island browser version. Users running outdated, vulnerable versions will be blocked from accessing corporate applications and prompted to update immediately. # Verification Steps: # - Log into the designated ERP system using the Island browser and attempt to copy text, download a report, or take a screenshot. # Expected: The action is actively blocked by the browser, an Island policy violation notification is displayed to the user, and the event is recorded in the Island Audit Logs. # - Review the Island Management Console → Audit Logs → Security Events # Expected: Visibility into blocked permission requests, blocked outdated browser access attempts, and prevented DLP actions, confirming the policies are actively mitigating threats.

rule Detect_AI_Phishing_And_Malware_Artifacts { meta: description = "Detects artifacts related to the edgeone.app AI-assisted phishing campaign and associated malware indicators" author = "Threat Rundown" date = "2026-03-16" reference = "https://cyble.com/?p=114708" severity = "high" tlp = "white" strings: $s1 = "edgeone.app" ascii wide $s2 = "Malware" ascii wide $s3 = "User" ascii wide $s4 = "Health Fund AI" ascii wide $s5 = "Telegram ID Freezing" ascii wide condition: any of ($s*) }

index=security sourcetype="web_proxy" OR sourcetype="edr_events" url="*edgeone.app*" OR file_name="*Malware*" OR user="*User*" OR process_name="*AppleChris*" OR process_name="*MemFun*" | eval risk_score=case( url LIKE "%edgeone.app%", 100, process_name LIKE "%AppleChris%" OR process_name LIKE "%MemFun%", 100, file_name LIKE "%Malware%", 75, user LIKE "%User%", 25, 1==1, 10) | where risk_score >= 50 | table _time, src_ip, dest_ip, url, file_name, process_name, user, risk_score | sort -_time

$computers = "localhost", "SERVER01", "WKSTN01" foreach ($computer in $computers) { if (Test-Connection -ComputerName $computer -Count 1 -Quiet) { Write-Host "Checking $computer for vulnerable Chrome installations..." # Check Chrome version in Windows Registry Invoke-Command -ComputerName $computer -ScriptBlock { $chromePath = "HKLM:\SOFTWARE\Google\Chrome\BLBeacon" if (Test-Path $chromePath) { $version = (Get-ItemProperty -Path $chromePath).version Write-Host "Chrome Version Found: $version - Verify against latest secure build." } else { Write-Host "Chrome not found in HKLM." } } -ErrorAction SilentlyContinue } else { Write-Host "$computer is offline or unreachable." } }