Hanu — detection engineering https://hanu.taksham.org Hanu runs in your own cloud, correlates signals from cloud, identity, CI/CD, certificate and AI surfaces into compound attack chains, and shows the evidence behind every finding. Self-hosted, source-available (Elastic License 2.0). en The October 2026 attack cluster https://hanu.taksham.org/incidents/october-2026-attack-cluster https://hanu.taksham.org/incidents/october-2026-attack-cluster Five campaigns from 23 Sep to 23 Oct 2026 shared one mechanism: trust that was already granted. The mechanics, the signals, and the named gaps. Fri, 23 Oct 2026 00:00:00 GMT EvilTokens: phishing that never asks for the password https://hanu.taksham.org/incidents/eviltokens https://hanu.taksham.org/incidents/eviltokens EvilTokens used device-code phishing to take 12,000 inboxes without passwords, then had an AI read them for fraud. What Hanu catches, and what it does not. Thu, 22 Oct 2026 00:00:00 GMT eMudhra: when the certificate authority is the supply chain https://hanu.taksham.org/incidents/emudhra-ca-compromise https://hanu.taksham.org/incidents/emudhra-ca-compromise Eight eMudhra intermediate CA keys were weak enough to recover — one was the integer 4. What that means for your certificates, and what Hanu checks. Tue, 20 Oct 2026 00:00:00 GMT GhostAction: the build robots became the exfiltration channel https://hanu.taksham.org/incidents/ghostaction https://hanu.taksham.org/incidents/ghostaction GhostAction pushed a workflow named security-audit.yml into 340+ repositories and took 3,325 secrets. The mechanism, the signals, and what a cloud scanner cannot see. Mon, 19 Oct 2026 00:00:00 GMT Correlating CI tampering: the pair is the finding https://hanu.taksham.org/blog/correlating-ci-tampering https://hanu.taksham.org/blog/correlating-ci-tampering A changed workflow file is an ordinary Tuesday. A changed workflow in a repository that holds a deploy credential is a finding. How the join works. Fri, 23 Oct 2026 00:00:00 GMT Detecting LLMjacking: validate, enumerate, invoke https://hanu.taksham.org/blog/detecting-llmjacking https://hanu.taksham.org/blog/detecting-llmjacking Cost anomalies cannot tell a busy week from a hijacked key. The kill chain can: first-ever credential validation, model enumeration, then invocation. Thu, 22 Oct 2026 00:00:00 GMT Why the detection path has no LLM in it https://hanu.taksham.org/blog/why-detection-has-no-llm https://hanu.taksham.org/blog/why-detection-has-no-llm A model in the scoring path costs you reproducibility, an explainable queue and regression tests. What it is genuinely good for, and where the line is. Mon, 19 Oct 2026 00:00:00 GMT Proving a finding six months later https://hanu.taksham.org/blog/proving-a-finding-six-months-later https://hanu.taksham.org/blog/proving-a-finding-six-months-later Detection is the easy half. What has to be true at detection time for a finding to still be defensible in a review six months later. Sun, 18 Oct 2026 00:00:00 GMT