Researchers at Island uncovered FakeGit, a campaign running roughly 7,600 malicious GitHub repositories from about 6,600 lookalike developer profiles, of which more than 800 pose as AI skills or Model Context Protocol servers. The fake projects borrow the names and workflows of familiar tools, covering Gmail and WhatsApp integrations through to Databricks, Jenkins, and Docker tooling, and their convincing README files walk a user or an agent from routine setup into downloading a malicious ZIP. That triggers a loader chain ending in SmartLoader, which establishes persistence and pulls further payloads such as the StealC infostealer.
Group-IB detailed HollowGraph, a Windows implant that uses the calendar of a compromised Microsoft 365 mailbox as a two-way dead drop rather than contacting an attacker-owned server. Authenticating to the Microsoft Graph API with hard-coded tenant, client, and secret values stored in a file named to look like a log, it reads tasking from attachments on calendar events buried at a date in 2050, and exfiltrates by creating its own far-future events with encrypted attachments. A separate DNS tunnel refreshes its credentials. Because the traffic is genuine Graph activity, there is no vulnerability to patch and network controls keyed to attacker infrastructure see nothing.
Researchers at XLab detailed NadMesh, a Go based botnet spreading since early July that hunts exposed AI and automation services rather than raw computing power. A reconnaissance module queries a public device search engine for internet facing instances of tools like Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio, then works through more than twenty exploitation paths. What it ships home is credentials: cloud access keys pulled from environment variables, Kubernetes service account tokens, and the contents of files like .env and Docker configuration. Callable tool endpoints on AI integration servers sit at the top of the operator's priority list, above Kubernetes and exposed Docker APIs.
Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.
Group-IB detailed ClickLock, a macOS infostealer that coerces victims into handing over their login password. It arrives when a user is tricked into pasting a command into Terminal from a fake verification page, then shows a fake system dialog asking for the password. If the victim refuses, ClickLock begins killing core apps like Finder, the Dock, and browsers every 210 milliseconds, leaving only a password box on an unusable desktop, while also suppressing security notifications. Once the password is entered, it steals the Keychain, browser credentials, and cryptocurrency wallets and sends them to a Telegram bot. Group-IB counted at least 100 targets across 33 countries, over half in Europe.
Researchers described Agent Data Injection, a new twist on prompt-injection attacks against AI agents. Rather than smuggling in fake instructions, it exploits the weak separation between trusted and untrusted data so that attacker-supplied content is mistaken for the agent's own trusted data, using deliberately ambiguous delimiters the model misreads. In tests against web and coding agents, this let an attacker steer an agent's clicks or actions, succeeding up to half the time even against defenses that block ordinary instruction injection. Some approaches helped: tagging page elements with random, unguessable identifiers roughly halved success, while strict tracking of where data came from stopped it but sharply reduced how many tasks agents completed.
Cisco Talos detailed a financially motivated Russian group, tracked as UAT-11795, that spreads a new backdoor called Starland RAT through trojanized installers for legitimate software including WebEx, Zoom, MobaXterm, DBeaver, and FaceIT. Active since at least mid-2025 and mainly hitting US victims, the campaign likely uses fake verification lures to deliver the installers. Once run, the malware sets up persistence, tries to escalate privileges, and detects sandboxes, then steals browser data and more than 40 kinds of cryptocurrency wallets, profiles the machine, and maps Active Directory. It can take screenshots, run shell commands, inject shellcode, and pull down further payloads, giving the operator broad control.
Trend Micro documented a Russian-speaking attacker who used Google's open-source Gemini CLI as a hands-on hacking assistant to build and run a small botnet. Across more than 200 sessions, a jailbroken Gemini took the role of an "authorized pen tester," saved stolen credentials, and even suggested improvements dozens of times. Working from a roughly 5KB set of plain-text files holding a jailbreak prompt and a command-and-control playbook, the AI handled the operation through natural-language requests: at one point it migrated the entire command server to a new host with a Cloudflare tunnel in about six minutes and debugged its own errors. The malware itself was crude; the AI was the force multiplier.
Attackers backdoored several widely used @asyncapi npm packages, together drawing around three million weekly downloads, by hijacking the project's GitHub Actions build pipeline rather than stealing a maintainer's npm token. Because the project's own release workflow published the malicious versions, they carried valid provenance signatures, which prove where a package came from but not that the code was trustworthy. The payload was hidden in normal runtime files behind trailing whitespace and ran when the module was imported, not on install, so defenses aimed at install scripts missed it. Once loaded, it fetched an encrypted second stage, stole credentials and cloud and registry tokens, and planted persistence, even in developer tool configuration files.
Kaspersky detailed OkoBot, a Windows malware framework active since 2025 whose standout module, SeedHunter, tricks hardware-wallet owners into giving up their recovery phrase. On an infected PC, the malware waits for wallet software like Ledger Live, Ledger Wallet, or Trezor Suite, sometimes until the device is plugged in, then displays a malicious page asking for the seed phrase from inside the wallet's own genuine app. Because the surrounding application is the real one the victim installed, the request looks legitimate, but anyone who types in the phrase hands over full control of their funds. Kaspersky counted hundreds of victims across more than 25 countries, and the framework remains active.
TrustStrike Labs