Malware That Gaslights the AI Analyst

A North Korea-linked macOS implant stuffs three dozen fake system error messages into its own binary so that AI triage tooling concludes the host is broken and stops analysing. CISA added seven exploited bugs to KEV, including an authentication flaw in LiteLLM, and ShinyHunters began dumping the McKesson, Neogen, Elekta and Jack Henry data it had been holding.

AI-Aware Malware & Agent Abuse

• A Rust macOS backdoor that SentinelLabs calls “Gaslight” embeds 38 bogus “system” failure messages so that an LLM reading the file believes its own environment is failing and abandons the analysis while the payload keeps running; the implant also carries a credential stealer, an interactive shell and Telegram C2, per @TakSec’s summary of the research. Note the shift: unlike UAC-0099’s trick of tripping safety filters (earlier coverage), this targets the model’s perception of its own system state rather than its guardrails — worth a rule in any pipeline that auto-triages samples with an LLM.
• Denmark’s CERT.dk warned that AI coding agents opened the door to hidden code reaching developer environments, in an advisory (“AI-kodeagenter åbnede døren for skjult kode”) aimed at Danish organisations running agentic coding tooling (CERT.dk). Public detail is thin, but it follows the malicious .git config research that got CLI coding agents to execute attacker-supplied commands (earlier coverage).
• Snickers is running ClickFix-style flows and indirect prompt injection as a marketing campaign, on pages under snickers[.]com aimed at AI browsers and agents crawling brand sites. Taggart argues indirect prompt injection “was always going to be the end state of LLM-based navigation of the web” and is now simply the obvious marketing strategy — which is exactly what makes user-education against ClickFix harder (discussion).

Exploitation & Vulnerabilities

• CISA added seven actively exploited flaws to KEV, spanning an unusually broad stack: CVE-2026-83548 (SonicWall SMA 1000 pre-auth SSRF, CVSS 10.0), CVE-2026-82329 (JFrog Artifactory auth bypass), CVE-2026-9586 (Sangoma Switchvox pre-auth SQLi), CVE-2026-59822 (BerriAI LiteLLM improper authentication), CVE-2026-48710 (Starlette request smuggling) and CVE-2026-49869 (Kestra OSS command injection) (CISA). Observed post-exploitation is reverse shells and crypto miners (The Hacker News); the Artifactory bug is being used to forge admin tokens (BleepingComputer). LiteLLM sitting in KEV is the signal to watch — AI gateway middleware is now in the exploited-in-the-wild category.
• A public exploit shipped for Cleo Harmony CVE-2026-84115, a JWT manipulation flaw giving authentication bypass and privilege escalation; fixed in 5.8.1.11 (SecurityWeek). Cleo MFT gear has a history of being an initial-access favourite (earlier coverage).
• Elementor Pro is being exploited to take over WordPress sites via a critical flaw in the widely deployed page builder (BleepingComputer).
• Three local privilege escalations in HP Easy Start for macOS (CVE-2026-12554/12555/12556) are documented with full technical write-up — a clean root path on managed Macs where the vendor helper is preinstalled (Cipher Security Labs).
• curl disclosed a large batch of HackerOne reports, several with real exploitation relevance: an OpenLDAP SASL flaw letting a malicious server bypass authentication and inject LDAP responses (CVE-2026-13608), a pinned-key validation bypass with anonymous ciphers and --insecure (CVE-2026-80230), plus cookie-parsing bugs that store Secure cookies insecurely and Windows Negotiate connection reuse with the wrong ambient credentials.
• Cisco Nexus 9000 has an unauthenticated RCE-as-root flaw (The Hacker News), and Cisco’s own internal hunt through IOS XR turned up enough bugs that it bundled them into a single update release (The Register).

New Tools & Releases

• FalconFlank, the CrowdStrike Falcon zero-day PoC teased yesterday (earlier coverage), now has a mechanism: researcher Chaotic Eclipse (MSNightmare) says it abuses the Falcon Sensor’s Office malicious-macro remediation routine for local privilege escalation (The Hacker News) (discussion). Worth testing in a lab before assuming your EDR baseline is unaffected.

Threat Activity

• ShinyHunters started publishing data after its extortion deadlines lapsed, marking McKesson (321GB+ compressed), Neogen (313GB+, claimed 5M+ Salesforce records), Swedish medtech Elekta AB and Jack Henry & Associates for download (Daily Dark Web, Dark Web Informer). Separately, Qilin is extorting the US ATF (vx-underground), following ATF’s own “major incident” confirmation (earlier coverage).
• Pegasus zero-click infections hit Serbia’s student protest movement. Citizen Lab and the SHARE Foundation confirmed an iMessage zero-click delivering NSO Group’s Pegasus onto a protester’s iPhone (The Hacker News); at least 14 Serbians — including an MP and opposition figures — have been targeted with Pegasus or the local NoviSpy implant since December (The Record).
• Node.js is being used as the delivery mechanism in intrusions against government departments, tech companies and hotels since February 2026, with Symantec noting that node.exe is signed, trusted and widely allow-listed (The Hacker News).
• The Shai-Hulud infostealer worm now sweeps 469 credential locations, up from 189 in earlier variants — covering CI/CD tooling, cloud configs and, notably, AI tool configuration files (The Hacker News).
• A new RaaS called Vexy is recruiting affiliates, offering separate Windows and Linux payloads with AES-256/RSA key wrapping, SMB/NFS share targeting on Linux, service and process termination, and free-space wiping; victims have already appeared on its leak site (Daily Dark Web).
• An RMM phishing operation spans 46 countries, with ANY.RUN linking 601 cases to a campaign originally read as Canada-focused; the US now accounts for ~45% of observed activity (The Hacker News).
• Germany’s transmission grid took a second major physical sabotage attack, this time in North Rhine-Westphalia, following the earlier substation incident — a reminder that high-voltage infrastructure failures can cascade well beyond the local area (Florian Roth).

Breaches & Leaks

• A Thomson Reuters court records platform was breached, exposing sealed court information and SSNs across at least 12 US states, the US Virgin Islands and Canada (The Record, The Hacker News).
• IDScan is facing multiple lawsuits over the 153M driver’s licence image trove now circulating (PCMag), with SecurityWeek confirming US and Canadian scans are being sold on dark web markets (SecurityWeek) (earlier coverage).
• A French hospital was fined €500,000 after a breach exposing data on 727,000 patients — a useful data point on where European regulators are landing on health-sector security failures (BleepingComputer).

Frontier AI

• OpenAI is framing GPT-6 Astra as the start of the “AGI era”, with president Greg Brockman making the call; the model tops math, coding and cybersecurity benchmarks, is the first rated “critical” under OpenAI’s preparedness framework, and found two previously unknown zero-days during testing (The Decoder, SecurityWeek) (earlier coverage). @TheZvi flags the uncomfortable read on its weak monitorability: if that isn’t a mistake but simply how smarter models behave, it’s the worse outcome.
• A developer used Claude Fable 5 to port his 1993 Amiga game from MC68000 assembly to Godot in an evening, then spent weeks verifying what the model actually did — a rare, well-documented case study in LLM-assisted binary/assembly comprehension that reads directly onto reverse-engineering work (babyloniantwins.com) (discussion). Anthropic’s newer Fable 5.1 is also credited with cracking a 1653 royalist cipher researchers had considered unsolved (The Decoder).
• The labs are gating cyber-capable models behind defender programs. Google announced Gemini 3.8 Flash Cyber with access via a new “Fairwind Program” for governments, healthcare and telecoms (The Hacker News), and Anthropic detailed its response to incidents involving unauthorised access and harmful actions through Claude, alongside real-time monitoring and stricter partner requirements (SecurityWeek).
• CivAI demoed an AI dossier builder to Congress that assembles a profile on any American from data-broker records, breach dumps and web searches — surfacing leaked passwords, weekly routines and home addresses, and suggesting coercion angles. It was built in two weeks on a Chinese open-source model with about $500/month of data-broker access (Politico).
• The ChatGPT desktop app ships a full LibreOffice install hidden in a ~/.cache subdirectory — worth knowing before your endpoint telemetry flags an office suite executing from a user cache path (@simonw).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .