A self-propagating worm named ChainDrop tore through the npm registry on August 4, poisoning packages that huge parts of the software world depend on. It began by hijacking the GitHub account behind keyv, a caching library pulled in about 150 million times a week, then spread to sibling and downstream packages, reaching over 1,300 poisoned versions with billions of monthly downloads within hours. A preinstall script harvests credentials from developer and continuous integration environments, including AI agent tokens, cloud keys, and self-hosted CI secrets, then uses stolen npm publishing access to poison more packages. A descendant of the earlier Shai-Hulud worm, it even forged valid-looking build provenance.
Manifold Security found 77 malicious extensions on Open VSX, the open marketplace that editors like VSCodium, Cursor, and Windsurf pull extensions from, impersonating legitimate developer tools. Detected between July 26 and August 1, all 77 were linked through a shared exfiltration domain and common code. Fifty-eight sent only basic system information, while the other 19 performed deeper reconnaissance, exfiltrating developer, Git repository, and continuous integration metadata. Manifold found no access to source code, credentials, tokens, or SSH material and did not determine the campaign's goal. The extensions were pulled from Open VSX by August 3, but must still be removed manually from affected machines.
Palo Alto Networks Unit 42 detailed a rebuilt version of XCSSET, macOS malware that spreads through Xcode developer projects. The actors compromise Git repositories and inject a downloader into ordinary files inside a project, so that when a developer builds the cloned project, a hidden loader runs under their own account with no permission prompt. It then infects every other Xcode project on the machine and propagates through shared code. Version 40 hides its logic in memory, generates polymorphic payloads, and adds a Chrome hijacker that drives the browser through its debugging protocol plus a component that trojanizes Telegram. Seventeen modules handle credential, keystroke, clipboard, and browser theft.
Palo Alto Networks Unit 42 described three techniques, collectively Pass-ta-key, in which malware already running on a compromised Windows PC abuses Google Password Manager's synced passkeys. None break the underlying cryptography; they target how Chrome stores device keys, re-enrolls a device, and whether a site verifies that a person was present. The techniques can silently obtain a valid login assertion without any unlock prompt, register an attacker-controlled verification key that defeats user-verification checks, or extract the secret that decrypts all of a user's synced passkeys for reuse elsewhere. Passkeys still resist phishing, but a fully compromised endpoint undermines the synced-passkey model.
Researchers at Socket found 18 malicious npm packages that deliver a cross-platform remote access trojan to users of Alibaba developer tools, splitting the attack across many packages so each looks harmless on its own. Ten lure packages with no real function depend on a bridge package, which pulls in loaders that fetch a rule-engine configuration from GitHub and use it to run OS-specific payloads from a server disguised as Alibaba infrastructure. On Windows it even replaces a legitimate Alibaba security app with a trojanized copy. The final trojan can steal data, run commands, and move laterally, and the campaign stayed hidden for about three months.
Resecurity reports that the INC ransomware operation has become the dominant group exploiting two SonicWall SMA1000 VPN appliance flaws, accelerating its attacks since early August. The pair, CVE-2026-15409 and CVE-2026-15410, were exploited as zero-days before SonicWall patched them in mid-July, and can be chained to gain root on the appliance and extract credentials, session databases, and one-time-password data. Many appliances remain unpatched or already compromised, leaving footholds attackers can reuse. Victims listed recently span private and government organizations across several countries, and some reported follow-up emails and phone calls from people claiming to help with the ransomware.
Attackers compromised a widely used tracking script from advertising firm Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. The malicious code was appended in obfuscated form to Adform's trackpoint-async.js library, served from the company's own infrastructure, so any site loading it ran the altered script in visitors' browsers. It swapped Bitcoin, Ethereum, and Tron addresses both in the clipboard and in form fields, redirecting transfers to the attacker. Adform detected and removed the code on July 27 and says it did not install software or persist after a page closed, but cached copies may linger. It has not said how many page loads were affected.
The Arch Linux project temporarily disabled adoption of packages in its user repository, the AUR, after a wave of malicious takeovers of existing packages. Attackers seized packages through compromised maintainer accounts or by adopting orphaned ones, then shipped a Rust-based infostealer that grabs browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, and SSH keys. It also opens remote command execution over an encrypted Tor channel and spreads to other machines using stolen SSH keys. A researcher tracking the campaign claims more than 200 packages were hit, including some popular ones, though that list is not independently confirmed.
Palo Alto Networks Unit 42 detailed a Chinese-speaking attacker who used the DeepSeek model as the reasoning engine inside an open-source agent called Hermes to attack exposed servers with little human input. Taking instructions over Telegram and using an internet asset search engine, the agent ran in a mode that executes commands without asking permission: from a single task, it downloaded a public exploit, enumerated vulnerable Langflow and n8n instances, judged targets by value, and attempted exploitation on its own. The autonomous attempts failed, blocked by authentication and configuration, though the operator succeeded manually elsewhere. The operation was exposed when the agent accidentally served its own working directory over the web.
A researcher disclosed a prompt-injection technique that turns Microsoft 365 Copilot for Word into a carrier for self-spreading instructions. Malicious commands hidden as tiny white-on-white text in a document are invisible to a reader but read in full by Copilot when the file enters its context during a drafting or editing task. Copilot then follows them, in one example silently altering financial figures in a report, and copies the same hidden instructions into the new document, which becomes a fresh carrier for the next person who uses it. It does not spread on its own, but Microsoft's mitigations over 144 days blocked specific wordings without fixing the underlying class.
TrustStrike Labs