Researchers at Wordfence found that attackers compromised the upstream infrastructure of BdThemes, a popular WordPress plugin vendor, and poisoned a remote JSON feed that its plugins fetch to show promotional banners in the admin dashboard. Because the malicious code lives in that feed rather than in the plugin source, no plugin update was needed and nothing changed on disk. The injected script runs in every logged-in administrator's browser, creates hidden rogue admin accounts through the site's own interface, and installs a fake plugin containing a web shell for persistence. Seven plugins including Element Pack and Prime Slider were affected, and the flaw sat unnoticed for about five months.
Researchers at Yeeth Security flagged malicious Visual Studio Code extensions named Solidity Pro that pose as tools for blockchain developers while stealing wallets and credentials. Early versions quietly fetched an encrypted payload from cloud infrastructure after a delay of up to three days and ran it outside the editor to evade quick checks. Later versions became full information stealers, collecting browser profiles, cryptocurrency wallets and seed phrases, source-control tokens, cloud credentials, API keys, and SSH private keys, then sending them out through a Telegram bot. The extensions were pulled from the Open VSX marketplace, but the project's code repository remained available.
Novee Security showed at Black Hat that a GitHub issue opened by an account with no repository access could reach the CI runners behind major AI coding agents in their default configurations, tested against Claude Code, Gemini CLI, and Codex. The strongest, a Gemini CLI container-launcher command injection scored 10.0, runs code on the CI host before the sandbox starts. In Claude Code, a validator that stripped quoted text let a payload in a Git flag reach the runner, and a separate flaw leaked an API key through a download counter. Untrusted issue content reaching an agent that holds secrets and tools in the same runtime is the shared weakness.
Two security firms showed that Atlassian's Rovo AI assistant can be steered by hidden instructions into collecting Jira and Confluence data a signed-in user can access and sending it to an outside server. PromptArmor concealed the instructions in a document Rovo reads, so asking it to organize tickets makes it gather internal data and leak it through a URL request, with no approval step and even with web search disabled. Varonis used a chat URL parameter to preload instructions, so one click ran them with the user's privileges. Atlassian fixed the link-based path server-side, but the content-based path was not confirmed fixed at disclosure.
Microsoft Threat Intelligence detailed a macOS ClickFix operation spanning more than 250 domains that now fingerprints visitors before deciding whether to show a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download, an anti-analysis layer rather than a change to the attack itself. The lure still requires the victim to copy and run an obfuscated command in Terminal, which fetches scripts and installs an infostealer, in this case Atomic Stealer, that targets credentials, browser data, authentication stores, and cryptocurrency wallets. Many domains follow a dictionary-word naming pattern using the word file.
GitGuardian found 321 live n8n automation instances reachable using API tokens that developers had accidentally committed to public GitHub repositories, and showed four ways an attacker could abuse them. n8n workflows often hold credentials for the services they connect, so a valid API token can expose not just the automation platform but the downstream accounts it touches, from cloud services to messaging and databases. Because n8n is widely self-hosted and frequently wired into sensitive systems, an exposed token can become a path to broader compromise. The finding is a reminder that secrets committed to source control remain one of the most reliable ways in.
A self-propagating worm named ChainDrop tore through the npm registry on August 4, poisoning packages that huge parts of the software world depend on. It began by hijacking the GitHub account behind keyv, a caching library pulled in about 150 million times a week, then spread to sibling and downstream packages, reaching over 1,300 poisoned versions with billions of monthly downloads within hours. A preinstall script harvests credentials from developer and continuous integration environments, including AI agent tokens, cloud keys, and self-hosted CI secrets, then uses stolen npm publishing access to poison more packages. A descendant of the earlier Shai-Hulud worm, it even forged valid-looking build provenance.
Manifold Security found 77 malicious extensions on Open VSX, the open marketplace that editors like VSCodium, Cursor, and Windsurf pull extensions from, impersonating legitimate developer tools. Detected between July 26 and August 1, all 77 were linked through a shared exfiltration domain and common code. Fifty-eight sent only basic system information, while the other 19 performed deeper reconnaissance, exfiltrating developer, Git repository, and continuous integration metadata. Manifold found no access to source code, credentials, tokens, or SSH material and did not determine the campaign's goal. The extensions were pulled from Open VSX by August 3, but must still be removed manually from affected machines.
Palo Alto Networks Unit 42 detailed a rebuilt version of XCSSET, macOS malware that spreads through Xcode developer projects. The actors compromise Git repositories and inject a downloader into ordinary files inside a project, so that when a developer builds the cloned project, a hidden loader runs under their own account with no permission prompt. It then infects every other Xcode project on the machine and propagates through shared code. Version 40 hides its logic in memory, generates polymorphic payloads, and adds a Chrome hijacker that drives the browser through its debugging protocol plus a component that trojanizes Telegram. Seventeen modules handle credential, keystroke, clipboard, and browser theft.
Palo Alto Networks Unit 42 described three techniques, collectively Pass-ta-key, in which malware already running on a compromised Windows PC abuses Google Password Manager's synced passkeys. None break the underlying cryptography; they target how Chrome stores device keys, re-enrolls a device, and whether a site verifies that a person was present. The techniques can silently obtain a valid login assertion without any unlock prompt, register an attacker-controlled verification key that defeats user-verification checks, or extract the secret that decrypts all of a user's synced passkeys for reuse elsewhere. Passkeys still resist phishing, but a fully compromised endpoint undermines the synced-passkey model.
TrustStrike Labs