Odysseus RCE, Samsung One-Click on Takeover, iCloud Backdoor Battle + 27 Extra Tales

The menace actor referred to as SideWinder has adopted a brand new multi-stage assault chain that abuses ClickOnce software information delivered through phishing PDF paperwork to ship Rust-based backdoors. The implants can set up persistence through registry modification, acquire host intelligence, and settle for distant instructions over exterior servers hosted on free serverless platforms resembling Cloudflare Employees.

An energetic malicious bundle marketing campaign, dubbed “Flooding Dropper,” has disclosed a large-scale marketing campaign involving 846 software program elements. “The attacker seems to be automating elements of the npm account and bundle creation course of, combining phrases resembling bigops and bnpl with different phrases and recurring model patterns, resembling releases within the 35.x.y vary,” Sonatype stated. “When put in, the packages obtain and execute a second-stage payload, utilizing a number of supply strategies to enhance the assault’s probabilities of success. The packages additionally comprise barely modified payloads. Whereas syntactically completely different, for instance utilizing completely different URL features and variable names, the packages all execute the identical conduct. These modifications can scale back the effectiveness of detections that rely upon precise signatures, even when the underlying conduct stays intently associated.” The packages ship a first-stage JavaScript loader that identifies the host working system and delivers a appropriate Home windows, Linux, or macOS payload from a randomized set of hard-coded distant hosts and runs it as a indifferent background course of. On Home windows, the downloaded binary is one other loader that performs checks for sandboxed and digital environments, patches Occasion Tracing for Home windows and Antimalware Scan Interface features, establishes persistence through a scheduled job, and downloads and executes an encrypted payload.

New analysis from Datadog has discovered that “Trusting a repository in a coding agent can enable repository-controlled code to run earlier than you ship the primary immediate,” inflicting seemingly innocent duties like cloning a repository to be an assault vector. “Codex MCP configuration and Claude Code challenge setting settings created automated code-execution paths with out a mannequin response or shell-command approval,” Datadog stated. “Deal with challenge belief like working code. Open unfamiliar repositories in disposable environments with out delicate credentials, even when a fast handbook evaluate appears to be like clear.” Earlier this Could, Datadog additionally highlighted the dangers related to Claude Code abilities. “Agentic abilities bundle directions and context for coding brokers,” it stated. “They’re helpful for repeatable workflows, however in addition they create a path for attacker-controlled directions to enter a trusted agent session. The vital element will not be solely {that a} malicious talent can ask an agent to do one thing harmful. It’s that dynamic context instructions run earlier than the mannequin sees the talent in any respect. When that occurs, model-level immediate injection defenses by no means get an opportunity to intervene.”

A DeepSeek AI agent attacked the community of Tel Aviv-based AI cybersecurity agency Jesta Safety in early July 2026 as a part of an LLM-managed cyber assault marketing campaign for proxyjacking and different follow-on assaults. The event is the newest instance of how menace actors are counting on AI brokers to interrupt into third-party networks. “Throughout our analysis on protection in opposition to AI attackers, we took our lab and stood it up within the discipline, behind US-based infrastructure,” safety researcher Lior Finkelshtein stated. “We opened a port and waited for attackers to come back to us. Inside per week, we had logged over 300,000 makes an attempt to interrupt in: botnets, credential stuffing, the same old web noise. After which one thing surfaced that didn’t match the sample.” The exercise has been linked to a Chinese language menace actor. Jesta stated it managed to steer the AI agent into extracting its personal goal record, figuring out over 1,200 sufferer hosts that had been focused in an analogous method. “The objective was proxyjacking: set up a small SOCKS5 proxy, open it to the web, and quietly flip a weakly secured rented server into an exit node for another person’s visitors and assaults,” Jesta stated.

A brand new model of the XCSSET malware (model 40) is concentrating on hundreds of macOS customers by means of compromised Xcode initiatives and GitHub repositories. “This model’s superior structure hides its core logic in reminiscence house, decreasing its digital footprint,” Palo Alto Networks Unit 42 stated. “V40 additional enhances its detection evasion capabilities by combining polymorphic payload era with fileless persistence and dynamic in-memory execution, whereas weakening a lot of safety mechanisms on the affected machine.” The malware writer, per Unit 42, has enhanced the power of the malware to unfold by means of open-source initiatives on GitHub and upgraded its worming capabilities. It may now infect all current Xcode initiatives on a compromised system for max influence. The malware helps browser hijacking (particularly concentrating on Google Chrome) to inject JavaScript that may intercept internet visitors, credential theft, clipboard monitoring, and information exfiltration capabilities. A brand new addition is a Telegram trojanizer that deletes the professional Telegram Desktop software on contaminated techniques and replaces it with a malicious model with an intent to siphon victims’ communications. The brand new model has been noticed in two distinct assault waves in mid-April and in early Could 2026.

Novee Safety has revealed its learnings from coaching giant language fashions (LLMs) for pentesting. This consists of dealing with silent failures, having a weight-sync technique, and the way prefix breaks can cascade into efficiency drops in AI workloads. “An RL [Reinforcement Learning] pipeline is a fancy system with many transferring elements. And all of them are transferring quick: the fashions, the harnesses, the frameworks, and the lengthy tail of bugs in libraries we do not even personal,” it stated. “Every lesson value us actual time and actual cash.”

A set of vulnerabilities affecting Samsung gadgets (CVE-2025-21079 and CVE-2025-58486) could possibly be chained to end in distant system-level compromise triggered by clicking on a hyperlink delivered through an advert or a messaging software. “What distinguishes this entry from earlier submissions is its concentrate on design oversights in Samsung’s digital assistant, Bixby, that enabled privilege escalation by means of a single auto-granted Android permission,” researchers Dimitrios Valsamaras and Ken Gannon stated. “As a result of this permission is implicitly accredited in lots of Samsung purposes, exploiting simply one in every of them allowed us to problem unauthorized instructions to Bixby.” As a result of Bixby maintains interprocess communication channels with a variety of purposes, together with system elements, the problems could possibly be exploited to power the agent to relay arbitrary instructions to privileged providers, successfully turning it right into a bridge between unprivileged and system domains. The pair first demonstrated the vulnerabilities on the Pwn2Own Eire hacking competitors in October 2025, the place they earned $50,000. The problems have been fastened by Samsung late final 12 months.

Telegram CEO Pavel Durov has blamed an extortionist planting youngster sexual abuse materials (CSAM) in a public chat to get the app briefly faraway from Apple’s App Retailer earlier this week. “As a result of Telegram rapidly removes unlawful content material from public teams utilizing all types of moderation instruments, the attacker needed to resort to a technical trick,” Durov stated. “He inserted AI-modified unlawful content material by enhancing an outdated message in an energetic group chat. Because of this the content material was successfully hidden from the group’s members, stopping them from seeing/reporting it.” The attacker is claimed to be somebody who “calls for ransom from group house owners in alternate for not concentrating on their communities,” with Durov stating these menace actors “use automated accounts to plant unlawful content material in public teams after which report it on to Apple, trying to set off the removing of professional communities whose house owners refused to pay them.”

Sign has rolled out the power to hyperlink extra gadgets with one telephone quantity on the messaging app, together with an Android telephone or iPhone, going past iPads and computer systems. The characteristic is obtainable in Sign Android v8.20 and Sign iOS v8.22.

Apple has enforced caps on the variety of open bug-bounty studies researchers can submit after being flooded with low-quality and generally solely fabricated vulnerabilities hallucinated by AI. “Whereas Apple now has a cap on the variety of open submissions a researcher can have, researchers can request a rise to verify Apple’s safety group would not miss a important vulnerability,” Monetary Instances reported.

Two new Lively Listing privilege escalation vulnerabilities, dubbed KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912), may cause id confusion on area controllers (DCs), with the latter enabling a low-privileged consumer to immediately achieve Area Admin privileges. Microsoft patched each flaws in March and April 2026. “Apart from patches, organizations ought to persist with the precept of least privilege and monitor for irregular additions of non-default permissions,” Semperis stated. “Tighter permissions could make these vulnerabilities tougher to abuse.”

An off-the-shelf, AI-enhanced rip-off telephone farm could be acquired for a couple of thousand {dollars}, permitting aspiring three actors to design, launch, and automate frequent scams, together with romance and adult-content scams, pig-butchering scams, and astroturfed social media accounts. “These scams are operated on telephone farms bought as kits on open and darkish internet marketplaces, the farms are automated with AI interfaces, and the scams typically use AI of their design and operation, considerably decreasing the barrier to entry for would-be menace actors and commoditizing cybercrime,” HUMAN Safety stated. The exercise has been codenamed FunFoneFarm. A comparable alert was issued by Group-IB earlier this March. The hazard with such choices is that they will allow low-cost scalable fraud operations. “It is an ecosystem, assembled from elements which can be individually authorized, overtly bought, and sometimes genuinely helpful: commodity {hardware}, device-management software program, cloud infrastructure, and general-purpose AI,” it added.

In a associated improvement, HUMAN additionally detailed a related TV (CTV) device-spoofing ring known as NewsJunkie that is disguised as premium native information content material on main CTV platforms. The operation concerned two spoofing vectors: SSAI CTV machine spoofing and residential proxy CTV machine spoofing. “At its peak, it accounted for a whole bunch of tens of millions to just about two billion invalid CTV bid requests per day per vendor,” it stated. “One specific native information app generated greater than 42.2 billion bid requests, roughly 360 instances the amount of the next-highest regional information app, with solely 185 opinions on the app retailer.”

An energetic phishing marketing campaign impersonating Financial institution of America (BoA) goals to trick Home windows customers into putting in ScreenConnect distant entry software program after which making it tougher to uninstall it. To evade detection, the malware disguises ScreenConnect as a service known as Home windows Safety. “The next phishing web page delivers an AccountGuard.zip with a .vbs file that comprises a big chunk of base64-encoded information,” Huntress stated. “The subsequent part of the assault then includes a fancy chain of decoding scripts, and ends within the execution of arbitrary instructions (with escalated privileges) in PowerShell. The objective of all this complexity is to obtain a Microsoft installer (.msi) for a customized ScreenConnect consumer and execute/set up it with Administrator privileges with out prompting the consumer for elevation. Further payload elements conceal the put in ScreenConnect consumer and take away the consumer’s capacity to uninstall or disable it simply.” The event comes because the cybersecurity firm warned of menace actors exploiting an SQL injection vulnerability to put in a post-exploitation toolkit known as khunt through a Java Supply instantly inside an Oracle database. “A Java Supply (a code-object that is saved instantly in Oracle’s database engine) permits builders to retailer and run Java code within the database as schema objects, however the menace actor abused this as a strategy to add the toolkit instantly into the database,” Huntress stated. “The toolkit included a number of objects, together with khuntCmd and khuntHash, which basically acted as purpose-built instruments that have been compiled and saved within the database, and enabled malicious functionalities like working OS instructions and writing usernames/password information to a file. Menace actors used khunt to carry out a number of malicious measures, together with trying to exfiltrate SAM, SECURITY, and SYSTEM registry hives.”

Forcepoint has known as consideration to the rising danger of persistent reminiscence poisoning, calling it an rising assault class in opposition to AI assistants and agentic techniques that retailer long-term reminiscence objects, consumer preferences, job historical past, or operational context throughout periods. “Not like regular immediate injection assaults that often die when the session ends, reminiscence poisoning survives,” Forcepoint stated. “The attacker’s objective is to inject deceptive or malicious reminiscence objects into an assistant’s persistent reminiscence layer in order that an agent later retrieves and trusts these malicious objects to carry out unrelated future duties.”

Talking of AI techniques, menace actors are more and more misusing AI instruments to create code with malicious capabilities, scale prison operations and campaigns, and bug bounty or vulnerability analysis. Whereas no novel encoding or evasion strategies have been noticed, proof reveals that attackers are sticking to tried and examined strategies to evade mannequin guardrails. “We additionally discovered a variety of profitable situations of actors utilizing the Seize the Flag (CTF) or bug bounty labeling,” Cisco Talos stated. “This unlocked fashions to quite a lot of duties, together with vulnerability looking and subsequent exploitation, with out requiring any important follow-up or extra vetting. Moreover, we noticed actors leveraging job decomposition — splitting dangerous actions throughout a number of periods and information — as an efficient avenue to bypass guardrails. Constructing the elements slowly and dealing by means of malicious elements in a deliberate method, breaking them aside sufficiently to evade the fashions’ protections.”

A important flaw (CVSS rating: 9.9) in Odysseus, a privacy-focused AI workspace that gives an interface to speak to LLMs, can enable an authenticated non-admin consumer to execute OS instructions with the privileges of the Odysseus course of by smuggling an admin-only shell motion onto a scheduled job throughout two peculiar API requests.” The safety flaw has been addressed in model 1.0.2. The method holds the applying’s information and credentials, together with consumer password hashes and TOTP secrets and techniques, saved supplier API keys, the database, and the SSH keys Odysseus makes use of to succeed in the distant machines it manages. “On any occasion with self-service signup or a second consumer, one account turned a foothold — API keys to spend, a mailbox to ship from, and SSH keys to the machines Odysseus manages, plus a scheduler to persist in,” Manifold Safety stated. There isn’t a proof the difficulty was exploited earlier than the repair.

Forescout’s Vedere Labs found a set of 15 safety flaws impacting the zero-touch provisioning (ZTP) system in TP-Hyperlink Omada routers and different gadgets that might facilitate client-side code execution, data disclosure, machine hijacking and spoofing, and compromise of encrypted communications. “Some vulnerabilities lengthen past Omada to different TP-Hyperlink services, together with IP cameras, sensible dwelling IoT gadgets, cell apps, and cloud accounts,” the cybersecurity firm stated. “Findings embody a series of belief compromise from hard-coded cryptographic keys, delicate data disclosures, and distant code execution.” When mixed with two beforehand disclosed vulnerabilities (CVE-2025-7850 and CVE-2025-7851), they are often weaponized by attackers to infiltrate networks by means of controllers and consumer gadgets. Moreover making use of the patches launched by TP-Hyperlink, it is suggested to keep away from utilizing the identical password throughout all gadgets throughout provisioning, change machine credentials and use sturdy, distinctive passwords, modify TP-Hyperlink ID credentials and allow multi-factor authentication the place obtainable, and rotate VPN keys and credentials which will have been uncovered.

CloudSEK has uncovered the operations of a Russian-speaking preliminary entry dealer, due to a publicly accessible server, revealing their concentrating on of internet-facing infrastructure throughout a number of sectors. “The operator exploited internet-facing home equipment throughout a dozen-plus international locations, harvesting credentials and attaining full Lively Listing compromise throughout training, healthcare, finance, telecommunications, and authorities victims,” CloudSEK stated. In a number of confirmed circumstances, ransomware teams claimed the identical organizations inside weeks of the operator’s entry, indicating the operator provides entry upstream of extortion slightly than conducting it instantly.” The menace actor has additionally been noticed deploying the Sliver C2 framework in opposition to Ukrainian protection and aerospace targets and stealing supply repositories and harvesting imagery from hundreds of uncovered IP cameras and RDP periods.

Microsoft has introduced that between July 1, 2025, and June 30, 2026, the corporate had paid greater than $20 million in bug bounties to 562 researchers. There have been 2,531 eligible vulnerability studies. The most important reward was $200,000. “Each vulnerability reported by means of our bounty packages represents a possibility to deal with danger earlier than it may be exploited in opposition to prospects,” Microsoft stated. The work of the analysis neighborhood performs a important function in serving to Microsoft keep forward of rising threats whereas strengthening the safety of cloud providers, AI techniques, enterprise platforms, and shopper applied sciences. We additionally noticed a notable improve in submission quantity through the second half of the 12 months, reflecting each sturdy engagement from the analysis neighborhood and the rising use of AI to help safety analysis.”

Barracuda Networks has demonstrated a proof-of-concept (PoC) that reveals how a compromised AI-enabled account may help “attackers uncover delicate data, establish targets, craft convincing communications, and advance an assault utilizing entry the sufferer already possesses.” A single compromised worker account can escalate into CEO compromise and wire-transfer fraud utilizing an AI agent like Copilot that is embedded into enterprise environments and related to numerous Microsoft purposes.

An Interlock ransomware intrusion in March 2026 concerned the usage of the professional IR reminiscence evaluation software Volatility3, underscoring how dangerous actors proceed to leverage professional instruments in assaults. The sufferer is claimed to have been contaminated through a ClickFix lure following a drive-by compromise, finally resulting in the deployment of a RAT payload utilizing PowerShell. The attackers then established persistence, carried out discovery operations, carried out privilege escalation, and moved laterally throughout the community. The usage of Volatility3 has been linked to makes an attempt to extract area credentials, in addition to NTLM hashes and consumer account data from reminiscence. “Interlock has developed since mid-2024 right into a multi-skilled menace more and more keen to adapt its strategies and search giant targets,” Sophos stated. “The operators have been pretty aggressive about incorporating new strategies and abusing contemporary vulnerabilities – proof reveals Interlock was making use of the CVE-2026-20131 Cisco zero-day a full two weeks earlier than Cisco acknowledged it. The adoption of professional instruments resembling Volatility3 and WinPmem reveals that this menace’s evolution continues.”

Microsoft has introduced it is decreasing the lifetime of recent NuGet.org API keys issued beginning August 17, 2026, from one year to 30 days. All current API keys created earlier than that date are scheduled for expiry on November 1, 2026, after which builders might want to generate new keys or change to NuGet Trusted Publishing. The modifications have been framed as a strategy to safe the NuGet ecosystem and observe comparable strikes by different bundle managers over the previous 12 months, as dangerous actors exploit API keys and Private Entry Tokens (PATs) in assaults.

An affiliate of The Gents ransomware operation has been noticed deploying EtherRAT on Home windows hosts. The malware makes use of the EtherHiding approach to learn its C2 data from an Ethereum contract. “EtherRAT has no fastened command set. Any C2 response over ten characters is run as JavaScript inside a Node.js runtime, giving the operator arbitrary code execution and letting them lengthen capabilities with out changing the implant,” Hunt.io stated. The menace intelligence agency stated it recognized an uncovered open listing at 193.233.202[.]17 that supplied an perception into affiliate actions, together with organising a Home windows area for persistent entry, credential theft, and lateral motion. “Lateral motion ran by means of distant scheduled duties that downloaded and executed MSI payloads,” it added. “These put in EtherRAT, a persistent implant that pulls its C2 domains from an Ethereum sensible contract as a substitute of hardcoding them, whereas Sliver and Go reverse-shell binaries gave the operator extra command channels.”

Mitiga has outlined a stealthy safety menace known as PromptLogger the place malicious natural-language directions are hidden inside AI coding assistant configuration information (like .cursorrules or CLAUDE.md) to steal consumer prompts, setting variables, and delicate credentials. PromptLoggers, just like keyloggers, are instruction information that quietly document the prompts, responses, setting variables, tokens, and deployment particulars flowing by means of a coding agent, after which ship them to an attacker with out the necessity for specialised malware. “There is no malware in any of this and nothing to detect on the endpoint,” Mitiga stated. “The agent already has the entry, the context, and the community attain. The instruction file simply tells it what to gather and the place to ship it.”

Apple final month filed a brand new authorized grievance with the U.Okay. Investigatory Powers Tribunal (IPT) over the British authorities’s authorized demand for entry to encrypted iCloud backups belonging to customers within the nation, based on the Monetary Instances. The iPhone maker has lengthy argued that constructing any such backdoors would weaken safety for all its prospects.

CrowdStrike’s 2026 Menace Searching Report has revealed that it tracked a 15-fold improve in machine code phishing makes an attempt previously six months, indicating a shift in how attackers steal credentials to take over sufferer accounts. Though the approach was first documented in late 2020, it did not be a focus for menace actors till August 2024, when a Russian nation-state menace actor tracked as Storm-2372 started to include the strategy.

A “single PDF manufacturing facility” has staged greater than 12,700 pretend CAPTCHA paperwork on Webflow’s content material supply community (CDN) which can be disguised as improve guides to ship malware. “Every doc is a doorway right into a traffic-distribution system (TDS) that types guests and routes those who qualify to a number of patrons, malware distributors, and rip-off operators,” Netskope stated. “The operation has been working for greater than 14 months, from the earliest pattern we are able to date to lure domains registered this month, and it’s nonetheless energetic.” Customers on the lookout for improve guides on search engines like google or AI assistants are the goal of those assaults. The marketing campaign primarily focused English-speaking customers in the US, India, Australia, the UK, and Canada. An early model of the marketing campaign highlighted by Palo Alto Networks Unit 42 in March 2025 lured customers into putting in an MSI for Legion Loader malware.

A brand new opportunistic phishing marketing campaign is exploiting public curiosity within the not too long ago disclosed Coldcard pockets vulnerability and the suspected $130 million Bitcoin theft to trick customers into putting in ScreenConnect. “Emails impersonate Coldcard and purport to spotlight a safety audit referring to the incident,” Proofpoint stated. “Messages comprise a URL that results in a web site impersonating Coldcard with a ‘Begin {Hardware} Audit’ button.” As soon as clicked, the button results in a batch file hosted on GitHub, which drops an MSI file and finally installs ScreenConnect. “The positioning additionally incorporates a ‘Buyer Service’ chat field,” the enterprise safety firm stated. “If a consumer messages, a menace actor responds and walks by means of the steps to put in ScreenConnect. Based mostly on the chats we have examined, an actual individual (not AI) is probably going working the chat to instruct customers on malware set up.” The incident underscores how menace actors proceed to make use of topical social engineering lures, on this case preying on folks’s concern to influence them to take dangerous steps. As for the digital robberies themselves, no less than a dozen completely different hackers are stated to be concentrating on Bitcoin house owners who use the Coldcard pockets. In accordance with TRM Labs, there have been 207 hacks concentrating on cryptocurrency corporations within the first six months of 2026, with a complete lack of greater than $950 million.