Google's threat-intelligence team reported that a financially motivated attacker used an autonomous, multi-agent AI framework to compromise thousands of third-party credentials in under six hours, a pace that would take a human far longer. It is part of a broader shift in which criminals fold autonomous and coding-focused AI agents into operations, using them to get past defenses, reverse-engineer software, and sift stolen data. Google also found infostealer malware now specifically targeting AI developer configurations and credentials, and actors running open-weight models on compromised machines to sidestep restrictions on commercial services. The takeaway is that AI is collapsing attack timelines from days to hours, and AI access itself is now worth stealing.
Toshiba and Muji have warned website visitors that suspicious sign-in screens appearing on their sites could harvest credentials, advising anyone who entered login data to change their passwords. The pop-ups were generated by the external polyfill[.]io service, which injected malicious code via its CDN after the domain was bought by a Chinese entity in 2024 - an incident that affected more than 100,000 websites. Japanese outlets report Zojirushi, FiNC Technologies, Ishiyaku Publishers, and Hobonichi were also hit, and a researcher observed Samsung Smart TVs and sites showing the prompt on June 1. Polyfill is a JavaScript compatibility CDN for legacy browsers; affected sites should remove all polyfill[.]io references immediately.
TrustStrike Labs