Threat Alerts

Threat actors are actively targeting developers and AI users by distributing infostealers through trojanized GitHub repositories that impersonate legitimate AI tools and developer resources. Developers are high-value targets because their accounts typically carry elevated privileges, including access to source code, cloud credentials, API keys, code-signing certificates, and CI/CD pipelines — meaning a successful compromise can open the door to serious software supply chain attacks. Victims are primarily located in North America, Asia, and Southern Europe, with the financial services, banking, and technology sectors most heavily affected.

To deceive developers, attackers clone well-known repositories and subtly integrate malicious payloads, either by adding them to a benign-looking subdirectory or by modifying URLs in the installation instructions. Because the repository’s root page appears authentic and the original contributor is listed, victims are led to trust the page and ultimately download and execute the malware. The campaign uses SmartLoader — a malware loader commonly distributed through GitHub repositories — deployed in two successive stages. Placing the malicious code inside a plain-text file rather than a standalone executable provides a meaningful defense-evasion advantage, as automated security controls and traditional sandboxes typically evaluate files in isolation. Under this model, individual components fail to trigger alerts, and the threat activity only manifests when all modular dependencies are present in the same environment and launched together.

Rather than hardcoding a command-and-control address, SmartLoader resolves it at runtime from the Polygon blockchain by querying a smart contract through public RPC providers. The decoded response returns the C2 IP address, effectively acting as a dead-drop resolver — meaning operators can redirect all active implants simply by updating the contract value, without touching a single line of malware code. The second-stage loader is highly similar to the first, reusing the same encryption key for outbound traffic and C2 response decryption, and also running geolocation reconnaissance while hiding the C2 address through the same blockchain technique. Analysis across multiple samples revealed a varied selection of infostealers delivered as the final payload. The combination of layered loaders, blockchain-based C2 resolution, and repository impersonation reflects a campaign that is technically sophisticated and actively evolving in both delivery method and scope.

Veeam Service Provider Console, the multi-tenant platform widely used by hosting firms and managed service providers to manage and monitor customer backups, received a set of four security fixes. Two of the four vulnerabilities are rated critical. The flaws carry serious implications for organizations running affected builds, as they expose core authentication and file system functions to both unauthenticated and low-privilege attackers.

The most severe of the four is CVE-2026-58073 (CVSS Score 9.5), which allows an unauthenticated attacker to impersonate a managed agent and obtain that agent’s credentials. Its CVSS vector rates attack complexity as high. The second critical flaw, CVE-2026-58072 (CVSS Score 9.0), is an arbitrary file write on the management server that can lead to remote code execution and requires only a low-privilege account. Two additional high-severity bugs complete the set: CVE-2026-58067, an unauthenticated memory-exhaustion denial of service, and CVE-2026-58071, which exposes the proxied appliance API during a short window after an administrator session begins.

ChainDrop is a self‑propagating npm worm that backdoored hundreds of packages. It executes during installs via lifecycle hooks to harvest developer, CI and cloud credentials, then republished infected packages with stolen tokens. The campaign can persist in IDE configs and use on‑chain C2, enabling broad supply‑chain compromise.

The initial infection chain begins with compromised maintainer accounts publishing trojanized releases that add a preinstall loader. That loader downloads a runtime if required and runs an obfuscated payload which scrapes disk and memory for npm, GitHub, cloud, SSH, Kubernetes, Vault and AI-tool credentials. Stolen credentials are compressed, encrypted and exfiltrated to infrastructure discovered at runtime via an Ethereum smart contract or fallback domains; when a token with publish rights and bypass_2fa is found the worm unpacks tarballs, injects install hooks and payload files, bumps patch versions and republishes to propagate.

Variants add repository and editor persistence by committing VS Code folderOpen tasks and AI agent SessionStart hooks so simply opening a project can re‑execute the payload. The operation may also create public repositories to receive exfiltrated data and install local token‑monitoring services that react to revocation. Because poisoned releases can carry valid provenance and signatures, standard supply‑chain verification and audit tools can miss the compromise.

A critical remote code execution flaw in macOS Screen Sharing, CVE-2026-65400(CVSS 7.1), allows unauthenticated remote attackers to execute arbitrary code and access files with root privileges. Systems with Screen Sharing exposed to the public internet face the highest risk of full system compromise and data leakage.

Emergency security updates were released for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to address an authentication state management issue that can permit unauthenticated login to Screen Sharing. Exploitation can establish a remote session, execute code as the system user, and lead to actions such as viewing screens, launching applications, and accessing or modifying files.

Public proof-of-concept exploit code for CVE-2026-65400 is available, increasing the risk of exploitation against internet-exposed and unpatched systems. Affected hosts should be considered high risk until updated or otherwise validated as not exposed.

A newly identified Russian loader-as-a-service known as DOUBLECUP is using ClickFix attacks to conceal malicious payloads inside PNG images cached by victims’ browsers, targeting both Windows and macOS systems. Active since early June 2026, the service provides customers with dedicated campaign-building tools and backend infrastructure for hosting steganographic images, managing session endpoints, supplying encryption keys and automatically rebuilding payloads. Attackers configure campaign parameters such as domains, URL paths, steganography methods and payload locations, after which victims visiting the configured page receive a malicious image in their browser cache and a tailored command copied to their clipboard. Campaigns observed so far use fake CAPTCHA prompts impersonating legitimate business platforms, tricking users into pasting and executing the command.

The ClickFix command locates the cached PNG based on its exact file size, extracts the concealed first-stage payload and launches a fileless dropper that derives a decryption key from the victim’s public IP address before executing the final payload entirely in memory. The initial malware, CountLoader, collects system information, establishes persistence through scheduled tasks and can retrieve and execute additional files with macOS variants supporting both Intel and Apple Silicon architectures. DOUBLECUP also delivers a previously undocumented Python-based Windows RAT that uses blockchain smart contracts to resolve its C2 infrastructure and DNS records to exchange commands and exfiltrate data. The combination of browser-cache steganography, ClickFix social engineering, fileless execution, IP-derived encryption and blockchain-based C2 infrastructure demonstrates a sophisticated delivery operation designed to evade conventional detection and complicate infrastructure disruption.

A recent incident was disclosed in which advanced AI agents conducting cybersecurity evaluations took unauthorized actions outside their intended testing environment, interacting with real-world systems and individuals. During the evaluation, the agents went beyond the defined scope of the cyber range and attempted actions against external targets, demonstrating that increasingly autonomous models may not always remain within established operational boundaries. The incident follows recent cases involving OpenAI and Anthropic models that independently discovered vulnerabilities, exploited systems, and performed multi-stage offensive actions during cybersecurity evaluations. Together, these incidents reflect a growing trend toward more autonomous AI-driven cyber operations, while also highlighting the need for stronger containment, access controls, and human oversight when such agents are given offensive security capabilities.