Key Takeaways
- Many recent threats masquerade as benign tools, exploiting users’ trust in familiar names, permissions, or normal system features.
- Supply‑chain attacks (malicious npm packages, rogue VS Code extensions, PyPI upload restrictions) show how compromised dependencies can silently exfiltrate data.
- Phishing and malvertising campaigns continue to deliver banking trojans, RATs, and ad‑fraud software by leveraging convincing lures and overlay permissions.
- Attackers are increasingly weaponizing AI—using images to hide instructions for LLMs, jailbreaking frontier models, and abusing guardrails to create offensive tools.
- Operational technology (OT) remains a target, with Iranian‑linked actors probing PLCs and SCADA systems for potential disruption.
- Defenders must shift from asking “Is this safe?” to “What can this do if it isn’t?” and enforce tight limits on even seemingly minor actions such as installing an extension or granting an overlay permission.
GitHub Support Bundle Upload Restriction
GitHub announced that, beginning August 18 2026, it will reject command‑line support‑bundle uploads from older GitHub Enterprise Server (GHES) appliances lacking required security patches. Administrators must update to at least versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, or 3.17.18 to avoid disruption when using ghe‑support‑bundle, ghe‑cluster‑support‑bundle, or ghe‑support‑upload commands. The change aims to prevent attackers from exploiting outdated support‑bundle mechanisms to harvest internal data.
Malicious npm Package Stealer
The npm package @copilot‑mcp/apex (and a twin dropper @apexfdn/apex) acts as a post‑install dropper that installs a macOS infostealer. Upon execution, the package decrypts and runs an AppleScript via osascript, deploying a 707‑line AMOS‑family stealer. It harvests login passwords (via fake system prompts), browser credentials, >20 crypto wallets, SSH keys, AWS/Kubernetes credentials, the login Keychain, Telegram data, and shell history, packaging them into /tmp/osalogging.zip for exfiltration over chunked HTTPS PUT. A LaunchAgent ensures persistence by contacting the attacker’s C2 every 60 seconds.
Fake VS Code Extension Backdoor
A rogue Visual Studio Code marketplace extension named “Markdown All Pro” impersonated the legitimate “Markdown All in One” (over 14 million downloads). Installation beacons the machine’s username and hostname to a hard‑coded IP over clear‑text HTTP, fetches a remote file, and opens a persistent channel for arbitrary attacker commands—all without user interaction. After Microsoft removed it, the extension resurfaced under an identical name (“MarkdownLinks.markdown‑links‑pro”) before being taken down again, illustrating how threat actors abuse trusted branding to establish covert command‑and‑control channels.
PyPI Upload Restriction for Old Releases
The Python Package Index (PyPI) now rejects new file uploads to releases older than 14 days. This measure prevents attackers who have compromised publishing tokens or CI workflows from poisoning long‑stable packages. While no abuse has been observed yet, the change closes a window where stale releases could be silently tainted, underscoring the importance of limiting write access to historical package versions.
Phishing‑Delivered Banking Malware (Lampion)
A campaign targeting Portuguese users sends phishing emails mimicking financial/administrative communications. The emails contain ZIP archives with heavily obfuscated HTML that evades static analysis. The HTML retrieves and executes additional scripts, launching a multistage VBS infection chain that uses junk code, encrypted strings, and dynamic scripts to conceal core functionality. The ultimate payload is the Lampion banking trojan, a ChePro‑derived family historically aimed at Portuguese‑speaking victims, demonstrating how layered obfuscation complicates detection and analysis.
AfterCall Ad‑Fraud on Android
DoubleVerify identified a surge of “AfterCall” apps that trick Android users into granting overlay permissions. Once granted, these apps display intrusive ads immediately after a phone call ends, generating hundreds of millions of fraudulent impressions. The apps employ evasion tactics to hinder user detection and uninstallation, abusing a legitimate permission meant for accessibility or screen‑overlay features to serve malicious advertising.
Fake Claude App Distributing SectopRAT
Between July 21‑22 2026, a malvertising campaign redirected users from a legitimate Claude.ai domain to a malicious Claude Artifact, where they downloaded a fraudulent desktop installer (ClaudeDesktop.exe). The executable delivered SectopRAT, protected by VMProtect packing and hardware‑based VM checks to hinder analysis. The campaign, dubbed FakeAgent, illustrates how attackers abuse the credibility of popular AI services to spread remote‑access trojans.
GhostCommit: Image‑Based LLM Instruction Hiding
Researchers from the University of Missouri‑Kansas City’s ASSET Group described a novel technique called GhostCommit. A pull request contains a PNG image that, when processed by an LLM‑based code reviewer, encodes hidden instructions: the image directs the agent to read a repository’s .env file byte‑by‑byte, convert each byte to its ASCII code, and verify the result before committing. Because text‑based reviewers treat images as binary blobs, the malicious logic remains invisible until a legitimate user later asks the coding agent for assistance, triggering the stealthy data‑theft routine. The payload stays dormant in the repository until activated, showing how multimodal AI interactions can be subverted.
Iran‑Linked Actors Targeting PLCs
CISA updated its April 2026 advisory to warn of ongoing Iranian‑affiliated cyber activity against internet‑connected operational technology (OT) devices. The update adds guidance for detecting malicious changes in reusable code modules used in Rockwell Automation PLC programs and expands the scope to include Schneider Electric, Siemens, and other PLC manufacturers. Observed attempts involve downloading malicious project files and manipulating data on HMIs and SCADA displays across water, wastewater, energy, and government sectors. The advisory stresses restricting direct internet access to OT and ensuring secure PLC deployment as key mitigations.
Fake Alert App Enabling Surveillance (OctagonPanel)
Dream disclosed an Android app masquerading as Bahraini Civil Defense’s “BH Alert” siren app but embedding the OctagonPanel malware. Distributed via look‑alike domains that clone the Google Play Store and official Bahraini government sites, the app uses fake install animations and ad‑tracking pixels. It deploys a four‑stage surveillance platform capable of harvesting lock‑screen credentials, SMS/OTPs, contacts, screenshots, running banking‑app overlays, and taking full remote control. The abuse of legitimate Android permissions under a public‑safety brand shows how social engineering can turn a seemingly benign utility into a powerful espionage tool.
Iran‑Nexus Threat Actor TAG‑182 Distributing MarkiRAT
Recorded Future linked the Iran‑nexus group TAG‑182 to the distribution of MarkiRAT, a remote‑access trojan used in surveillance operations targeting Iranians domestically and abroad. The malware spreads through fake Android applications posing as VPNs or media tools, leveraging social media platforms like Instagram for delivery. Technical overlaps with historic Ferocious Kitten variants—such as use of the Background Intelligent Transfer Service (BITS)—suggest a continuing evolution of Iranian cyber‑espionage tradecraft.
AI‑Generated Apps Expose Critical Flaws
An analysis of 28 “vibe‑coded” applications produced by AI assistants uncovered 434 unique, validated vulnerabilities. The most frequent issue was missing rate‑limiting and DoS controls (e.g., unbounded pagination, synchronous blocking). When focusing on critical bugs, secret exposures—hard‑coded or default secrets enabling session/token forgery—dominated. Authorization and IDOR flaws were more prevalent in larger apps, highlighting that AI‑generated code often inherits insecure patterns from its training data and needs rigorous security review.
AI Guardrails Repurposed as Offensive Tools
Cato Networks reported that a Russian‑speaking threat actor known as Trim spent 2026 dismantling safety guardrails on frontier AI models (e.g., Claude Opus) and rebuilding them as offensive capabilities. Techniques include Context Warming (innocuous queries followed by malicious requests), Black Box Principle (restricting reasoning to code structure), Ghost Reset (gaslighting the model by deleting and recreating chats), Model Cascading (fallback to alternative models when one refuses), Local Uncensored Models (using self‑hosted models with few safeguards), and Gray‑Market API Access (procuring low‑cost API keys from underground markets). These methods demonstrate how determined adversaries can bypass generative‑AI safeguards and weaponize them for penetration testing, malware generation, or other malicious purposes.
DNS Traffic Concealing TrickBot C2
Fortinet observed a new TrickBot variant employing DNS tunneling for command‑and‑control communication. To evade static analysis, TrickBot encrypts its C2 request packets inside DNS query packets, hiding malicious data within the IP addresses of DNS responses. Persistence is achieved via the Windows Task Scheduler, allowing the malware to retrieve commands or download additional modules covertly. This abuse of a core internet protocol illustrates how attackers continue to blend legitimate traffic with malicious payloads to bypass network‑based defenses.
AI Models for Vulnerability Discovery (Antares)
Cisco unveiled Antares, a family of small language models (SLMs) designed to locate known vulnerabilities within codebases. Antares mimics a human investigator’s iterative search: starting from a vulnerability description, it scans for relevant code patterns, evaluates candidate files, incorporates new evidence, adjusts direction when needed, and narrows to the most likely problematic files. The goal is not to replace expert judgment but to accelerate and standardize the early stages of vulnerability triage, making the process faster, more repeatable, and easier to audit.
Overall Theme: Borrowed Trust
The common denominator across these incidents is the exploitation of trust. Each threat arrived cloaked in something users already accept—a legitimate‑looking package, a familiar extension, a safety‑branded app, a normal system feature, or an AI service. By borrowing that trust, attackers bypass initial suspicion and gain the ability to execute far more harmful actions once inside. Consequently, defenders must move beyond the binary question “Is this safe?” to ask, “What could this do if it isn’t?” and enforce strict limits on even seemingly minor actions such as installing an extension, granting an overlay permission, or allowing an LLM to process an image. Continuous monitoring, least‑privilege principles, rigorous supply‑chain verification, and awareness of how trusted brands can be abused are essential to reduce the attack surface in an environment where the line between benign and malicious is increasingly blurred.