In partnership with

💻 7 Features MSPs Need in Compliance Software

For MSPs, the right compliance management software is the difference between chaotic, spreadsheet-driven audits and a scalable, profitable compliance-as-a-service offering. This list breaks down seven core features that help providers reduce manual work, deliver consistent outcomes across clients, and stay audit-ready year round.

Win AI Search Without a Big Team

92% of VCs use AI to find companies. 58% of buyers start there, too. If you're not showing up in AI answers, you're invisible before the conversation even starts. Join HubSpot for Startups, Anthropic, and Marketing Against the Grain on July 30 (11 am ET) for a live AEO teardown. Real startup. Real recs. Register and unlock the free Startup Visibility Bundle.

Register Now

⚠️ Threat Updates

🔴 NadMesh Botnet Uses Shodan to Hijack Exposed AI & MCP Infrastructure (7/19/26)

A newly observed Go-based botnet tracked as NadMesh has been rapidly spreading since early July 2026, marking a sharp shift from indiscriminate worms to industrial-grade, ROI-driven attack platforms aimed squarely at exposed Artificial Intelligence (AI) and Model Context Protocol (MCP) infrastructure. NadMesh delegates reconnaissance to a dedicated ai_harvest.py module that programmatically queries the Shodan API for live AI and automation services — ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — then injects the discovered IPs into a high-priority scan queue focused on AI service ports such as 8188 (ComfyUI), 11434 (Ollama), 5678 (n8n), and 7860 (Gradio). MSPs and AI platform operators should immediately audit internet-facing AI and MCP endpoints via Shodan and similar services. » More Info

🔴 ClickLock macOS Stealer Uses App-Kill Loop to Coerce Passwords and Drain Wallets (7/17/26)

A newly documented macOS infostealer dubbed ClickLock has been abusing ClickFix-style social engineering and a brutal app‑kill loop to force victims into surrendering their system password, then quietly draining browsers, password managers, and cryptocurrency wallets. First analyzed by Group‑IB, ClickLock reaches users via fake Cloudflare or verification pages that instruct them to paste a bash command into Terminal; once executed, the script installs LaunchAgents and begins terminating foreground applications (Finder, browsers, Activity Monitor, System Settings, Dock, Terminal) roughly every 210 milliseconds, effectively locking the machine into a password-only loop that can persist for up to 83 hours. » More Info

🗨️ Parting Words

“Many of life’s failures are people who did not realize how close they were to success when they gave up.” – Thomas Edison

Are you a vCISO or MSP looking to operationalize security programs? Let’s discuss how Blacksmith Infosec proves that compliance is an opportunity, not a struggle that has to be packaged in FUD!