Stop the Silos

Case 1: The Sality Botnet Takedown

A 20-year-old peer-to-peer botnet, finally dismantled on August 31, 2026, by CrowdStrike working with the DOJ, FBI, and international law enforcement. Sality survived two decades because it had no central command server to knock offline — every infected machine simply trusted whichever peers appeared on its list, with no way to independently verify a peer's legitimacy.

The takedown worked by exploiting that exact same blind trust: quietly inserting decoy nodes, controlled by defenders, into each bot's trusted peer list. Every infected machine now checks in with CrowdStrike instead of the original attacker.

The trust failure: blind peer trust, no independent verification — structurally the same weakness class as a Sybil attack, and the reason blockchain uses cryptographic consensus instead of blind peer trust.

Case 2: The Lennar Breach — Twice

Lennar Corporation detected unauthorized access on March 30, 2026 (intrusion window: March 24–30) — an employee trusted a convincing impersonator with no verification step in place. About two months later, on June 1, 2026, a second, entirely unrelated attacker breached a related entity, Lennar Mortgage, while the first incident's investigation was still ongoing (Lennar did not complete its assessment of the first breach until July 30, 2026).

A lawsuit against Lennar alleges the underlying weakness was never actually fixed between the two breaches — only documented. No phishing training, no simulated tests, no Zero Trust architecture requiring re-verification at every internal step.

The trust failure: human trust extended with no independent verification system — the human equivalent of Sality's peer-list problem.

Case 3: CaptiveCrunch's Device-Code Abuse

Disclosed by Microsoft on July 31, 2026: a campaign (Storm-2945) compromising hotel Wi-Fi gateways and abusing Microsoft's legitimate device-code authentication flow. Victims completed their own real multi-factor approval — but were unknowingly authenticating an attacker's session instead of their own, because the flow never verified which session was actually requesting approval.

No malware required for this path. The victim did the security check correctly; the check itself just wasn't checking the right thing.

The trust failure: a legitimate authentication mechanism trusted at the wrong point — the session, not the enrollment step, went unverified.

Case 4: iAuthFlow v2's Passkey Persistence

A commercially-sold phishing toolkit, disclosed by Abnormal AI in August 2026. A victim completes what looks like a normal login, but the attacker relays the session in real time and uses the authenticated window to enroll an attacker-controlled passkey — access that survives a subsequent password reset entirely, because passkey enrollment is a separate trust decision the standard incident-response playbook never re-checks.

The trust failure: the enrollment step of a legitimate auth feature, trusted without independent re-verification — structurally identical to CaptiveCrunch, different specific mechanism.