Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job.
This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor.
Nothing here is especially mystical. Just ordinary systems trusting slightly too much, slightly too early. The full list follows.
The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.
-
China-linked telecom risk
Chinese Telcos Maintain U.S. Presence
The U.S. Congress’s bipartisan Select Committee on China has published a 49-page report named “Stranger Pings,” highlighting the threat of China-controlled infrastructure in the U.S. telecommunications backbone. The Committee said the Salt Typhoon campaign could have been facilitated via a residual footprint that leaves open the door to future cyber operations against the U.S.: Chinese (aka People’s Republic of China or PRC) telecom firms operating in the U.S. do not act independently and keep trusted positions inside U.S. communications infrastructure that Chinese threat actors can potentially abuse to preserve access and hide activity. “One PRC telecommunication provider included an ‘Acceptable Use’ Policy in contracts with U.S. companies,” the Committee said. “This prohibited the broadcasting of political news against state laws of the PRC, the broadcasting of information in violation of PRC state security laws, and the broadcasting of information in violation of the ‘social order and social stability.'”
-
ClickOnce phishing chain
SideWinder Deploys New Attack Chain
The threat actor known as SideWinder has adopted a new multi-stage attack chain that abuses ClickOnce application files delivered via phishing PDF documents to deliver Rust-based backdoors. The implants can establish persistence via registry modification, collect host intelligence, and accept remote commands over external servers hosted on free serverless platforms such as Cloudflare Workers.
-
npm supply chain attack
Flooding Dropper Hits npm With 850 Malicious Packages
An active malicious package campaign, dubbed “Flooding Dropper,” has disclosed a large-scale campaign involving 846 software components. “The attacker appears to be automating parts of the npm account and package creation process, combining terms such as bigops and bnpl with other words and recurring version patterns, such as releases in the 35.x.y range,” Sonatype said. “When installed, the packages download and execute a second-stage payload, using multiple delivery methods to improve the attack’s chances of success. The packages also contain slightly modified payloads. While syntactically different, for example using different URL functions and variable names, the packages all execute the same behavior. Those changes can reduce the effectiveness of detections that depend on exact signatures, even when the underlying behavior remains closely related.” The packages deliver a first-stage JavaScript loader that identifies the host operating system and delivers a compatible Windows, Linux, or macOS payload from a randomized set of hard-coded remote hosts and runs it as a detached background process. On Windows, the downloaded binary is another loader that performs checks for sandboxed and virtual environments, patches Event Tracing for Windows and Antimalware Scan Interface functions, establishes persistence via a scheduled task, and downloads and executes an encrypted payload.
-
Coding agent execution risk
Coding Agents Expose Pre-Prompt Code Execution Paths
New research from Datadog has found that “Trusting a repository in a coding agent can allow repository-controlled code to run before you send the first prompt,” causing seemingly harmless tasks like cloning a repository to be an attack vector. “Codex MCP configuration and Claude Code project environment settings created automatic code-execution paths without a model response or shell-command approval,” Datadog said. “Treat project trust like running code. Open unfamiliar repositories in disposable environments without sensitive credentials, even if a quick manual review looks clean.” Earlier this May, Datadog also highlighted the risks associated with Claude Code skills. “Agentic skills package instructions and context for coding agents,” it said. “They are useful for repeatable workflows, but they also create a path for attacker-controlled instructions to enter a trusted agent session. The important detail is not only that a malicious skill can ask an agent to do something dangerous. It is that dynamic context commands run before the model sees the skill at all. When that happens, model-level prompt injection defenses never get a chance to intervene.”
-
AI-powered cyber attack
Chinese Actor Weaponizes DeepSeek in Cyber Attack
A DeepSeek AI agent attacked the network of Tel Aviv-based AI cybersecurity firm Jesta Security in early July 2026 as part of an LLM-managed cyber attack campaign for proxyjacking and other follow-on attacks. The development is the latest example of how threat actors are relying on AI agents to break into third-party networks. “During our research on defense against AI attackers, we took our lab and stood it up in the field, behind US-based infrastructure,” security researcher Lior Finkelshtein said. “We opened a port and waited for attackers to come to us. Within a week, we had logged over 300,000 attempts to break in: botnets, credential stuffing, the usual internet noise. And then something surfaced that did not fit the pattern.” The activity has been linked to a Chinese threat actor. Jesta said it managed to steer the AI agent into extracting its own target list, identifying over 1,200 victim hosts that had been targeted in a similar manner. “The goal was proxyjacking: install a small SOCKS5 proxy, open it to the internet, and quietly turn a weakly secured rented server into an exit node for someone else’s traffic and attacks,” Jesta said.
-
macOS malware upgrade
New XCSSET Malware Version Spotted
A new version of the XCSSET malware (version 40) is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. “This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint,” Palo Alto Networks Unit 42 said. “V40 further enhances its detection evasion capabilities by combining polymorphic payload generation with fileless persistence and dynamic in-memory execution, while weakening a number of security mechanisms on the affected machine.” The malware author, per Unit 42, has enhanced the ability of the malware to spread through open-source projects on GitHub and upgraded its worming capabilities. It can now infect all existing Xcode projects on a compromised system for maximum impact. The malware supports browser hijacking (specifically targeting Google Chrome) to inject JavaScript that can intercept web traffic, credential theft, clipboard monitoring, and data exfiltration capabilities. A new addition is a Telegram trojanizer that deletes the legitimate Telegram Desktop application on infected systems and replaces it with a malicious version with an intent to siphon victims’ communications. The new version has been observed in two distinct attack waves in mid-April and in early May 2026.
-
LLM pentesting lessons
Training LLMs on Long-Horizon Pentesting Tasks
Novee Security has published its learnings from training large language models (LLMs) for pentesting. This includes handling silent failures, having a weight-sync strategy, and how prefix breaks can cascade into performance drops in AI workloads. “An RL [Reinforcement Learning] pipeline is a complex system with many moving parts. And all of them are moving fast: the models, the harnesses, the frameworks, and the long tail of bugs in libraries we don’t even own,” it said. “Each lesson cost us real time and real money.”
-
One-click device compromise
Hacking Into Samsung’s Mobile Devices
A set of vulnerabilities affecting Samsung devices (CVE-2025-21079 and CVE-2025-58486) could be chained to result in remote system-level compromise triggered by clicking on a link delivered via an ad or a messaging application. “What distinguishes this entry from previous submissions is its focus on design oversights in Samsung’s virtual assistant, Bixby, that enabled privilege escalation through a single auto-granted Android permission,” researchers Dimitrios Valsamaras and Ken Gannon said. “Because this permission is implicitly approved in many Samsung applications, exploiting just one of them allowed us to issue unauthorized commands to Bixby.” Because Bixby maintains interprocess communication channels with a wide range of applications, including system components, the issues could be exploited to force the agent to relay arbitrary commands to privileged services, effectively turning it into a bridge between unprivileged and system domains. The pair first demonstrated the vulnerabilities at the Pwn2Own Ireland hacking competition in October 2025, where they earned $50,000. The issues were fixed by Samsung late last year.
-
App Store removal attack
Telegram Says Takedown Extortionist Was Responsible for App Removal
Telegram CEO Pavel Durov has blamed an extortionist planting child sexual abuse material (CSAM) in a public chat to get the app briefly removed from Apple’s App Store earlier this week. “Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick,” Durov said. “He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it.” The attacker is said to be someone who “demands ransom from group owners in exchange for not targeting their communities,” with Durov stating these threat actors “use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them.”
-
More linked devices
Signal Allows Users to Link Multiple Phones to One Account
Signal has rolled out the ability to link more devices with one phone number on the messaging app, including an Android phone or iPhone, going beyond iPads and computers. The feature is available in Signal Android v8.20 and Signal iOS v8.22.
-
AI bug report flood
Apple Limits Bug Submissions Following a Flood of AI Slop
Apple has enforced caps on the number of open bug-bounty reports researchers can submit after being flooded with low-quality and sometimes entirely fabricated vulnerabilities hallucinated by AI. “While Apple now has a cap on the number of open submissions a researcher can have, researchers can request an increase to make sure Apple’s security team doesn’t miss a critical vulnerability,” Financial Times reported.
-
Domain takeover flaws
Security Flaws Lead to Kerberos Downgrade, DoS, and Full Domain Takeover
Two new Active Directory privilege escalation vulnerabilities, dubbed KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912), can cause identity confusion on domain controllers (DCs), with the latter enabling a low-privileged user to instantly gain Domain Admin privileges. Microsoft patched both flaws in March and April 2026. “Other than patches, organizations should stick to the principle of least privilege and monitor for abnormal additions of non-default permissions,” Semperis said. “Tighter permissions can make these vulnerabilities more difficult to abuse.”
-
AI-powered scam farms
FunFoneFarm Fuels Scam Economy
An off-the-shelf, AI-enhanced scam phone farm can be acquired for a few thousand dollars, allowing aspiring three actors to design, launch, and automate common scams, including romance and adult-content scams, pig-butchering scams, and astroturfed social media accounts. “These scams are operated on phone farms sold as kits on open and dark web marketplaces, the farms are automated with AI interfaces, and the scams often use AI in their design and operation, significantly lowering the barrier to entry for would-be threat actors and commoditizing cybercrime,” HUMAN Security said. The activity has been codenamed FunFoneFarm. A similar alert was issued by Group-IB earlier this March. The danger with such offerings is that they can enable low-cost scalable fraud operations. “It’s an ecosystem, assembled from parts that are individually legal, openly sold, and often genuinely useful: commodity hardware, device-management software, cloud infrastructure, and general-purpose AI,” it added.
-
CTV ad fraud ring
NewsJunkie Spoofs Premium CTV Inventory at Scale
In a related development, HUMAN also detailed a connected TV (CTV) device-spoofing ring called NewsJunkie that’s disguised as premium local news content on major CTV platforms. The operation involved two spoofing vectors: SSAI CTV device spoofing and residential proxy CTV device spoofing. “At its peak, it accounted for hundreds of millions to nearly two billion invalid CTV bid requests per day per seller,” it said. “One particular local news app generated more than 42.2 billion bid requests, approximately 360 times the volume of the next-highest regional news app, with only 185 reviews on the app store.”
-
Fake bank phishing chain
Fake Bank of America Lures Lead to ScreenConnect
An active phishing campaign impersonating Bank of America (BoA) aims to trick Windows users into installing ScreenConnect remote access software and then making it harder to uninstall it. To evade detection, the malware disguises ScreenConnect as a service called Windows Security. “The subsequent phishing page delivers an AccountGuard.zip with a .vbs file that contains a large chunk of base64-encoded data,” Huntress said. “The next phase of the attack then involves a complex chain of decoding scripts, and ends in the execution of arbitrary commands (with escalated privileges) in PowerShell. The goal of all this complexity is to download a Microsoft installer (.msi) for a custom ScreenConnect client and execute/install it with Administrator privileges without prompting the user for elevation. Additional payload components conceal the installed ScreenConnect client and remove the user’s ability to uninstall or disable it easily.” The development comes as the cybersecurity company warned of threat actors exploiting an SQL injection vulnerability to install a post-exploitation toolkit called khunt via a Java Source directly within an Oracle database. “A Java Source (a code-object that’s stored directly in Oracle’s database engine) allows developers to store and run Java code in the database as schema objects, but the threat actor abused this as a way to upload the toolkit directly into the database,” Huntress said. “The toolkit included several objects, including khuntCmd and khuntHash, which essentially acted as purpose-built tools that were compiled and stored in the database, and enabled malicious functionalities like running OS commands and writing usernames/password data to a file. Threat actors used khunt to perform several malicious measures, including attempting to exfiltrate SAM, SECURITY, and SYSTEM registry hives.”
-
AI memory poisoning
Persistent Memory Poisoning in AI Agents
Forcepoint has called attention to the growing risk of persistent memory poisoning, calling it an emerging attack class against AI assistants and agentic systems that store long-term memory items, user preferences, task history, or operational context across sessions. “Unlike normal prompt injection attacks that usually die when the session ends, memory poisoning survives,” Forcepoint said. “The attacker’s goal is to inject misleading or malicious memory items into an assistant’s persistent memory layer so that an agent later retrieves and trusts these malicious items to perform unrelated future tasks.”
-
AI abuse tactics
How Threat Actors Are Weaponizing AI
Speaking of AI systems, threat actors are increasingly misusing AI tools to create code with malicious capabilities, scale criminal operations and campaigns, and bug bounty or vulnerability research. While no novel encoding or evasion techniques have been observed, evidence shows that attackers are sticking to tried and tested methods to evade model guardrails. “We also found a lot of successful instances of actors using the Capture the Flag (CTF) or bug bounty labeling,” Cisco Talos said. “This unlocked models to a variety of tasks, including vulnerability hunting and subsequent exploitation, without requiring any significant follow-up or additional vetting. Additionally, we saw actors leveraging task decomposition — splitting risky actions across multiple sessions and files — as an effective avenue to bypass guardrails. Building the components slowly and working through malicious components in a deliberate manner, breaking them apart sufficiently to evade the models’ protections.”
-
AI workspace RCE
A critical flaw (CVSS score: 9.9) in Odysseus, a privacy-focused AI workspace that provides an interface to talk to LLMs, can allow an authenticated non-admin user to execute OS commands with the privileges of the Odysseus process by smuggling an admin-only shell action onto a scheduled task across two ordinary API requests.” The security flaw has been addressed in version 1.0.2. The process holds the application’s data and credentials, including user password hashes and TOTP secrets, stored provider API keys, the database, and the SSH keys Odysseus uses to reach the remote machines it manages. “On any instance with self-service signup or a second user, one account became a foothold — API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages, plus a scheduler to persist in,” Manifold Security said. There is no evidence the issue was exploited before the fix.
-
Router takeover flaws
15 TP-Link Omada Flaws Enable Router Hijacking
Forescout’s Vedere Labs discovered a set of 15 security flaws impacting the zero-touch provisioning (ZTP) system in TP-Link Omada routers and other devices that could facilitate client-side code execution, information disclosure, device hijacking and spoofing, and compromise of encrypted communications. “Some vulnerabilities extend beyond Omada to other TP-Link products and services, including IP cameras, smart home IoT devices, mobile apps, and cloud accounts,” the cybersecurity company said. “Findings include a chain of trust compromise from hard-coded cryptographic keys, sensitive information disclosures, and remote code execution.” When combined with two previously disclosed vulnerabilities (CVE-2025-7850 and CVE-2025-7851), they can be weaponized by attackers to infiltrate networks through controllers and client devices. Besides applying the patches released by TP-Link, it’s advised to avoid using the same password across all devices during provisioning, change device credentials and use strong, unique passwords, modify TP-Link ID credentials and enable multi-factor authentication where available, and rotate VPN keys and credentials that may have been exposed.
-
Initial access broker exposed
Russian-Speaking Access Broker’s Dual Operation
CloudSEK has exposed the operations of a Russian-speaking initial access broker, thanks to a publicly accessible server, revealing their targeting of internet-facing infrastructure across multiple sectors. “The operator exploited internet-facing appliances across a dozen-plus countries, harvesting credentials and achieving full Active Directory compromise across education, healthcare, finance, telecommunications, and government victims,” CloudSEK said. In multiple confirmed cases, ransomware groups claimed the same organizations within weeks of the operator’s access, indicating the operator supplies access upstream of extortion rather than conducting it directly.” The threat actor has also been observed deploying the Sliver C2 framework against Ukrainian defense and aerospace targets and stealing source repositories and harvesting imagery from thousands of exposed IP cameras and RDP sessions.
-
Bug bounty milestone
Microsoft Bounty Program Rewards More Than $20M
Microsoft has announced that between July 1, 2025, and June 30, 2026, the company had paid more than $20 million in bug bounties to 562 researchers. There were 2,531 eligible vulnerability reports. The biggest reward was $200,000. “Every vulnerability reported through our bounty programs represents an opportunity to address risk before it can be exploited against customers,” Microsoft said. The work of the research community plays a critical role in helping Microsoft stay ahead of emerging threats while strengthening the security of cloud services, AI systems, enterprise platforms, and consumer technologies. We also saw a notable increase in submission volume during the second half of the year, reflecting both strong engagement from the research community and the growing use of AI to support security research.”
-
AI insider threat
How AI-Enabled Email Accounts Can Turn Into an Insider Threat
Barracuda Networks has demonstrated a proof-of-concept (PoC) that shows how a compromised AI-enabled account can help “attackers discover sensitive information, identify targets, craft convincing communications, and advance an attack using access the victim already possesses.” A single compromised employee account can escalate into CEO compromise and wire-transfer fraud using an AI agent like Copilot that’s embedded into enterprise environments and connected to various Microsoft applications.
-
Ransomware memory theft
Interlock Ransomware Abuses Volatility3
An Interlock ransomware intrusion in March 2026 involved the use of the legitimate IR memory analysis tool Volatility3, underscoring how bad actors continue to leverage legitimate tools in attacks. The victim is said to have been infected via a ClickFix lure following a drive-by compromise, ultimately leading to the deployment of a RAT payload using PowerShell. The attackers then established persistence, conducted discovery operations, performed privilege escalation, and moved laterally across the network. The use of Volatility3 has been linked to attempts to extract domain credentials, as well as NTLM hashes and user account information from memory. “Interlock has evolved since mid-2024 into a multi-skilled threat increasingly willing to adapt its techniques and seek large targets,” Sophos said. “The operators have been fairly aggressive about incorporating new techniques and abusing fresh vulnerabilities – evidence shows Interlock was making use of the CVE-2026-20131 Cisco zero-day a full two weeks before Cisco acknowledged it. The adoption of legitimate tools such as Volatility3 and WinPmem shows that this threat’s evolution continues.”
-
NuGet key hardening
Microsoft Reduces NuGet API Key Lifetime
Microsoft has announced it’s reducing the lifetime of new NuGet.org API keys issued starting August 17, 2026, from 365 days to 30 days. All existing API keys created before that date are scheduled for expiry on November 1, 2026, after which developers will need to generate new keys or switch to NuGet Trusted Publishing. The changes have been framed as a way to secure the NuGet ecosystem and follow similar moves by other package managers over the past year, as bad actors exploit API keys and Personal Access Tokens (PATs) in attacks.
-
Smart contract C2 malware
The Gentlemen Affiliate Deploys EtherRAT
An affiliate of The Gentlemen ransomware operation has been observed deploying EtherRAT on Windows hosts. The malware uses the EtherHiding technique to read its C2 information from an Ethereum contract. “EtherRAT has no fixed command set. Any C2 response over ten characters is run as JavaScript inside a Node.js runtime, giving the operator arbitrary code execution and letting them extend capabilities without replacing the implant,” Hunt.io said. The threat intelligence firm said it identified an exposed open directory at 193.233.202[.]17 that offered an insight into affiliate activities, including setting up a Windows domain for persistent access, credential theft, and lateral movement. “Lateral movement ran through remote scheduled tasks that downloaded and executed MSI payloads,” it added. “Those installed EtherRAT, a persistent implant that pulls its C2 domains from an Ethereum smart contract instead of hardcoding them, while Sliver and Go reverse-shell binaries gave the operator additional command channels.”
-
AI prompt exfiltration
PromptLogger Steals AI Context
Mitiga has outlined a stealthy security threat called PromptLogger where malicious natural-language instructions are hidden inside AI coding assistant configuration files (like .cursorrules or CLAUDE.md) to steal user prompts, environment variables, and sensitive credentials. PromptLoggers, similar to keyloggers, are instruction files that quietly record the prompts, responses, environment variables, tokens, and deployment details flowing through a coding agent, and then ship them to an attacker without the need for specialized malware. “There’s no malware in any of this and nothing to detect on the endpoint,” Mitiga said. “The agent already has the access, the context, and the network reach. The instruction file just tells it what to collect and where to send it.”
-
Encryption backdoor fight
Apple Launches New Legal Challenge Against UK Backdoor Demand
Apple last month filed a new legal complaint with the U.K. Investigatory Powers Tribunal (IPT) over the British government’s legal demand for access to encrypted iCloud backups belonging to users in the country, according to the Financial Times. The iPhone maker has long argued that building any such backdoors would weaken security for all its customers.
-
Credential theft shift
Device Code Phishing Attacks Surge
CrowdStrike’s 2026 Threat Hunting Report has revealed that it tracked a 15-fold increase in device code phishing attempts in the past six months, indicating a shift in how attackers steal credentials to take over victim accounts. Although the technique was first documented in late 2020, it didn’t catch the attention of threat actors until August 2024, when a Russian nation-state threat actor tracked as Storm-2372 began to incorporate the method.
-
ClickFix malware lures
Fake PDF Upgrade Guides Lead to ClickFix Attacks
A “single PDF factory” has staged more than 12,700 fake CAPTCHA documents on Webflow’s content delivery network (CDN) that are disguised as upgrade guides to deliver malware. “Each document is a doorway into a traffic-distribution system (TDS) that sorts visitors and routes those that qualify to multiple buyers, malware distributors, and scam operators,” Netskope said. “The operation has been running for more than 14 months, from the earliest sample we can date to lure domains registered this month, and it is still active.” Users looking for upgrade guides on search engines or AI assistants are the target of these attacks. The campaign primarily targeted English-speaking users in the United States, India, Australia, the United Kingdom, and Canada. An early version of the campaign highlighted by Palo Alto Networks Unit 42 in March 2025 lured users into installing an MSI for Legion Loader malware.
-
Coldcard phishing lure
Coldcard Wallet Theft Exploited in New Phishing Campaign
A new opportunistic phishing campaign is exploiting public interest in the recently disclosed Coldcard wallet vulnerability and the suspected $130 million Bitcoin theft to trick users into installing ScreenConnect. “Emails impersonate Coldcard and purport to highlight a security audit relating to the incident,” Proofpoint said. “Messages contain a URL that leads to a site impersonating Coldcard with a ‘Start Hardware Audit’ button.” Once clicked, the button leads to a batch file hosted on GitHub, which drops an MSI file and ultimately installs ScreenConnect. “The site also features a ‘Customer Service’ chat box,” the enterprise security company said. “If a user messages, a threat actor responds and walks through the steps to install ScreenConnect. Based on the chats we’ve examined, a real person (not AI) is likely operating the chat to instruct users on malware install.” The incident underscores how threat actors continue to employ topical social engineering lures, in this case preying on people’s fear to persuade them to take risky steps. As for the digital robberies themselves, at least a dozen different hackers are said to be targeting Bitcoin owners who use the Coldcard wallet. According to TRM Labs, there have been 207 hacks targeting cryptocurrency companies in the first six months of 2026, with a total loss of more than $950 million.
The useful lesson is not that attackers suddenly became brilliant. It is that trust keeps accumulating in quiet places: package managers, project files, assistants, provisioning tools, remote access software, and forgotten systems nobody planned to revisit.
Security still breaks at the handoff. Before the prompt. After the patch. Inside the default. Somewhere between “trusted” and “probably fine.” That gap is where this week lived, and it will be there next week too.