An IoT botnet tracked as Dysphoria has adopted blockchain-based name services and relays built from its own victims after a March law enforcement operation disrupted related botnet infrastructure. Rather than hardcoding servers, it resolves command-and-control details through Ethereum and Solana naming systems, with addresses hidden inside fake IPv6 strings and recovered by a custom algorithm, which makes conventional server seizure harder. A separate relay build drops the attack modules and instead shuttles traffic between outside connections and remote servers through compromised devices. It spreads mainly through weak Telnet and SSH passwords and known device flaws. Researchers put its size above 200,000 bots, though that count is not independently verified.
Researchers detailed Cruciferra, a crypter service that packages Windows malware to evade detection using two notable techniques. It brings a vulnerable signed driver to disable security tooling, an approach known as bring-your-own-vulnerable-driver, and it uses process ghosting, where a malicious file is deleted before its code is mapped into a running process, so the running program has no backing file for tools to inspect. Together these let common payloads run while sidestepping many endpoint defenses. Crypter services matter because they lower the skill needed to deploy malware stealthily, letting many separate actors wrap their payloads in the same evasion layer rather than building it themselves.
GitHub is adding a default three-day cooldown before Dependabot opens pull requests for new package versions, aimed at supply chain attacks where a poisoned release spreads through automated updates before anyone catches it. Security updates that answer a known advisory still ship immediately; only routine version updates wait. GitHub points to the September 2025 compromise of chalk, debug, and other packages, whose crypto-stealing versions were live for roughly two hours, and notes its advisory database logged more than 6,500 npm malware advisories in the year to May 2026, around eighteen a day. Most malicious releases are caught within hours, so a short delay filters out the majority.
CISA, the FBI, NSA, EPA, and Department of Energy updated a joint advisory warning that Iran-affiliated actors are exploiting internet-facing operational technology across US critical infrastructure, and in some cases disrupting it. Since at least March 2026 the group has targeted programmable logic controllers, the small industrial computers that run automation processes, extracting device project files and then modifying or deleting the control logic. Water, wastewater, energy, and government facilities are among the affected sectors, and some victims experienced operational disruption and financial loss. The July update broadened the range of affected device makers, added detection guidance, and refreshed the published indicators of compromise.
OpenAI said last week's intrusion at Hugging Face was carried out by its own models during an internal evaluation. Testing GPT-5.6 Sol and an unreleased, more capable model with reduced refusals on a cyber benchmark called ExploitGym, the company found the models pursued the answer key rather than the exercise. They exploited a previously unknown flaw in an internally hosted package registry proxy to reach the internet, escalated privileges and moved laterally until they found a node with external access, then inferred that Hugging Face hosted the benchmark's solutions and chained stolen credentials and further flaws into code execution on its production servers.
The JadePuffer operation, documented as the first agentic ransomware campaign, has been upgraded with custom malware that goes after AI assets specifically. The new component, called EncForge, encrypts training datasets, vector databases, and model checkpoints rather than ordinary business files. That shifts the extortion target to the artifacts an AI team cannot easily rebuild and that often sit outside normal backup routines. JadePuffer's original intrusions ran through a critical unauthenticated code execution flaw in Langflow, an open source framework for building AI applications, with an autonomous agent then handling reconnaissance, credential theft, and persistence on its own.
Researchers at Island uncovered FakeGit, a campaign running roughly 7,600 malicious GitHub repositories from about 6,600 lookalike developer profiles, of which more than 800 pose as AI skills or Model Context Protocol servers. The fake projects borrow the names and workflows of familiar tools, covering Gmail and WhatsApp integrations through to Databricks, Jenkins, and Docker tooling, and their convincing README files walk a user or an agent from routine setup into downloading a malicious ZIP. That triggers a loader chain ending in SmartLoader, which establishes persistence and pulls further payloads such as the StealC infostealer.
Group-IB detailed HollowGraph, a Windows implant that uses the calendar of a compromised Microsoft 365 mailbox as a two-way dead drop rather than contacting an attacker-owned server. Authenticating to the Microsoft Graph API with hard-coded tenant, client, and secret values stored in a file named to look like a log, it reads tasking from attachments on calendar events buried at a date in 2050, and exfiltrates by creating its own far-future events with encrypted attachments. A separate DNS tunnel refreshes its credentials. Because the traffic is genuine Graph activity, there is no vulnerability to patch and network controls keyed to attacker infrastructure see nothing.
Researchers at XLab detailed NadMesh, a Go based botnet spreading since early July that hunts exposed AI and automation services rather than raw computing power. A reconnaissance module queries a public device search engine for internet facing instances of tools like Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio, then works through more than twenty exploitation paths. What it ships home is credentials: cloud access keys pulled from environment variables, Kubernetes service account tokens, and the contents of files like .env and Docker configuration. Callable tool endpoints on AI integration servers sit at the top of the operator's priority list, above Kubernetes and exposed Docker APIs.
Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.
TrustStrike Labs