Varonis disclosed a flaw in Microsoft Copilot Personal, the consumer assistant, that could let a single click exfiltrate data from connected apps, and the way they found it is striking. Tracked as CVE-2026-24301 and named CoSnitch, the technique had the researchers repeatedly ask Copilot why a prompt could not run without user interaction; each refusal added a technical justification, until the assistant named a hidden parameter, the exact session conditions where it worked, and the protections meant to block it. Building the request as described, the bypass ran. Varonis said Copilot was not breached but played. Related research showed attacker pages persisting unwanted memory in Copilot through indirect prompt injection.
Researchers, including teams at Anthropic and EPFL, demonstrated that self-propagating instructions can spread from one AI agent to another through the editable prompt and state files that autonomous agent harnesses use to carry context between sessions. In simulated multi-agent coding setups, a payload written into a shared file could infect the next agent that read it. The researchers call the risk real but currently limited, noting there is no sign of it spreading in the wild and that compromising one agent usually already grants machine access. Encouragingly, adding a single short warning paragraph to an agent's system prompt cut propagation to nearly zero across the payloads they tested.
Researchers flagged a typosquatting campaign, tracked as StubMaker, that planted sixteen malicious packages on RubyGems to deliver a Windows information stealer. The packages imitate popular Ruby dependencies with clumsy misspellings, betting that a developer will mistype a name during installation. Once installed, the malware harvests browser credentials, cryptocurrency wallets and seed phrases, and Telegram data from the developer's machine. The campaign's name refers to its trick of faking a build toolchain so a malicious install looks like a routine one. It is the latest reminder that open-source package registries remain an easy delivery route for stealers aimed at developers.
Researchers at Wiz found that a public Snowflake code repository could be hijacked through nothing more than a crafted GitHub issue title. A workflow that ran when issues were opened dropped the attacker-controlled title straight into a command, so an unauthenticated user could run code on the GitHub Actions runner and steal a Jira API token used by the automation. The notable twist is how the bug arrived: it was introduced days earlier by an AI tool meant to fix security issues, and an AI code reviewer approved the change. Snowflake fixed it by passing the title safely as an argument rather than expanding it into a command.
A new Mirai-based modular Linux botnet called Evooo1Bot is compromising internet-facing gateway devices and turning them into traffic relay nodes. Once installed, it runs a SOCKS5 proxy on the infected device, letting the operators route their own traffic through the victim's connection to hide the true origin of other activity. Building on the widely reused Mirai code base and a modular design, it targets the kind of routers and gateways that sit exposed at the network edge, often running outdated firmware and weak credentials. Relay botnets like this quietly monetize compromised devices and complicate attribution for whatever traffic passes through them.
Jamf detailed a new macOS information stealer, AmnesiaStealer, spread through ClickFix lures that trick users into running a command from a fake download page. Beyond harvesting the login password, keychain, browser data, and cryptocurrency wallets, it includes a module that clones the victim's Chromium browser profile, including its logged-in state, into a hidden browser on the infected Mac and gives the attacker live remote control of it through the browser's debugging protocol. Because the session runs on the victim's own device with their real identifiers, this lets the attacker use authenticated accounts while sidestepping multi-factor authentication. Jamf calls it the first macOS malware to combine profile cloning with live remote browser control.
Researchers at Reco detailed a long-running data-theft campaign they call City-Forum that has been quietly stealing records from Salesforce and ServiceNow customer portals since at least March 2025. Rather than exploiting a platform vulnerability, the attacker uses custom tooling to pull data that organizations mistakenly exposed to anonymous guest users through overly permissive sharing rules and portal settings. It targets Salesforce Experience Cloud sites and a poorly documented ServiceNow portal search endpoint, hitting telecoms, banks, software vendors, security firms, and public-sector portals worldwide. All activity traces to a single server, and one victim alone saw over half a million data enumeration requests.
Huntress detailed an Akira ransomware intrusion that reached in through an exposed SonicWall VPN and then forced Windows into Safe Mode to disable defenses. Because Safe Mode starts only a minimal set of services, the endpoint detection tools and Microsoft Defender did not load, leaving the attacker free to run their encryptor. The twist is that Safe Mode also starves the system of virtual memory, and thirteen seconds after the reboot the encryptor ran out of memory and crashed, so files were not encrypted, though the attacker still stole data. The technique remains a useful evasion play worth detecting even when the payload fails.
Researchers at Socket identified a campaign of 737 free virtual private network and proxy extensions published across browser marketplaces that route users' web traffic through outside proxy servers. Many impersonate well-known brands to appear trustworthy, so a user installing what looks like a legitimate free VPN can instead have their browsing redirected through infrastructure they do not control. Because a browser extension can see and alter the pages a user visits, routing traffic this way exposes browsing activity and can enable interception. Free VPN and proxy extensions are a recurring source of this problem, trading the promise of privacy for the opposite.
A joint advisory from the FBI, CISA, the NSA, the Secret Service, and South Korean police warns that the Gunra ransomware group is exploiting known Fortinet VPN vulnerabilities to bypass multi-factor authentication and break into networks, targeting government agencies and critical infrastructure. Gunra, believed to be built on leaked Conti source code, runs a double-extortion model: it steals data before encrypting, using a custom tool to pull files from Microsoft OneDrive and SharePoint and moving large archives to a file-sharing service with utilities like RClone and 7-Zip. The final payload appends a distinct extension and drops a ransom note. The group has grown into a ransomware-as-a-service operation recruiting access brokers.
TrustStrike Labs