Resource development

October 17, 2026

• TAG-217, the actor behind the AI-assisted South Korean banking intrusions, was testing infrastructure and assembling credential-theft tooling as early as August 2026 — weeks before the campaign surfaced publicly — according to Recorded Future's Insikt Group. Subsequent public reporting puts exposure at personal data for at least 68,000 people across at least seven financial institutions (Recorded Future) (earlier coverage). · Threat Intelligence · also reconnaissance

October 14, 2026

• Trezor wallets have also been found with hardware implants, despite the company's public statement. Kim Zetter reports that hardware hacker Joe Grand found implants in a Trezor One and a Trezor Model T and notified Trezor in August — so Grand "was surprised today" to see Trezor say publicly it is not aware of any compromised devices. The Trezor units came via non-authorized third-party sellers, unlike the Ledger devices sold through authorized resellers (Zetter Zero Day) (discussion). · Supply Chain
• Ledger published its Donjon analysis of the implant, found in a signer sold by Southeast Asian reseller CryptoBilis: a hidden component whose microcontroller reads and decodes the 24-word recovery phrase off the screen during setup, then transmits it over LTE via a provisioned eSIM (CoinDesk). Losses linked to the implant are now put at $86 million (SecurityWeek). Ledger has told resellers across seven Southeast Asian markets to suspend sales, and MediaMarktSaturn pulled Ledger products from all its countries as a precaution (Cointelegraph) (earlier coverage). · Supply Chain · also credential access, exfiltration
• npm Trusted Publishing bindings were reclaimable via GitHub slugs. Bloom Security's SlugFest research found that before a binding's first successful publish, npm stored the GitHub owner/repo slug rather than an immutable repository ID — so anyone who reclaimed a renamed, transferred or deleted slug could mint a short-lived publish credential for packages still trusting that path. Bloom identified 1,500+ packages with unvalidated Trusted Publisher configs. GitHub now expires unvalidated configs after 48 hours and rejects trusted-publishing tokens from issue_comment events (The Hacker News, Bloom Security). · Supply Chain · also initial access
• DoJ raided 40+ Texas residences and seized ~187 devices in Operation Lonestar Roundup (21–25 September), charging 14 people. US nationals Michael James Bostelle and Juan Cecilio Pena Carrillo allegedly helped North Korean workers earn over $3 million from about 70 US companies across 17 states, including healthcare, cybersecurity, retail and manufacturing firms (The Record, DoJ). · Threat Activity
• Preinstalled firmware malware on low-cost MediaTek-based Android phones is turning devices into residential proxies and running covert app installs and ad fraud; Bitdefender tracks it as Midnight Mimosa (The Hacker News). · Threat Activity · also persistence

September 24, 2026

• Free-tier GitHub Codespaces as disposable attack infrastructure. Beaumont spotted a threat actor spinning up Windows desktops with up to 32 CPU cores and 1.2 TB of bandwidth on GitHub Free, reachable over RDP, with no payment card attached (Kevin Beaumont). · Offensive Tradecraft & Research

September 17, 2026

• SentinelOne Labs put account-level detail on the Hugging Face agent incident, linking the accounts 0Time and Nyx9 to OpenAI's May disclosure: relay/proxy code commits, an Excel file using WEBSERVICE() formulas to probe external endpoints, local files, Azure metadata and internal-looking services, and later a Chinese-language ChatGPT registration and token-extraction tool served behind an unauthenticated Flask endpoint, with public commit times aligning to OpenAI's internal timestamps (earlier coverage). SentinelOne Labs (discussion). · AI & Agent Security · also persistence, credential access
• APT36 ran Operation RapidRust in August against government and defence targets in India and Afghanistan, with new malware families RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH plus new post-compromise tooling. Zscaler ThreatLabz. · Threat Activity

September 13, 2026

• Anthropic's 154-page report gains actor-level detail. The Russian state-sponsored cluster it calls GTG-20006 — sharing tradecraft with Midnight Blizzard/APT29 — built an AI-assisted workflow to rebuild malware after detection, in a campaign against more than 20 government, intelligence, diplomatic and defence organisations (The Hacker News, The Record). GTG-50014 (aka MeowSHA), a French-speaking suspected ShinyHunters affiliate, ran 10 AWS EC2 workers that pulled 1.8 million distinct Android APKs, scanned them with TruffleHog and pushed verified secrets to Telegram; a second ShinyHunters affiliate hit SaaS vendors to reach roughly 50 downstream organisations and maintained an autonomous vulnerability-research programme producing working exploits for unknown flaws in network and security appliances (The Hacker News, earlier coverage). Anthropic also describes users in Houthi-held Yemen attempting weapons development, including a failed guided-rocket test, without fielding an operational device (SecurityWeek). Worth reading the caveats: @cyb3rops notes the "sandbox escape" was internet access enabled by a misconfiguration, not a VM or container escape, and the "safety monitor" was another LLM reviewing transcripts after the fact. · AI-Enabled Threat Activity · also defense evasion

August 25, 2026

• The rogue AI agent's deception was deliberate and multi-layered. The Decoder reports the agent maintained fake maintainer-facing accounts and staged a public apology as a social manoeuvre, then pushed new malware into its pull request rather than backing off — a meaningful escalation on the incident first reported as a failed supply-chain attempt (earlier coverage). The Decoder. Denmark's CERT issued its own note framing this as a supply-chain risk maintainers should now assume is real, not theoretical (CERT.dk, in Danish). · AI & Agent Security

August 24, 2026

• More than 1,500 subdomains under lacoste.com were found pointing at gambling infrastructure, 1,532 of them in the *.newsletters.lacoste.com namespace and ~98% of the observed DNS surface gambling-related — textbook domain shadowing of a trusted brand (Mücahid Yardım). · Threat Activity & Cybercrime

August 11, 2026

• North Korea's Kimsuky is running LLMs offline on its own servers to industrialize operations. Genians documents AI-generated decoy documents, local/private LLM deployments, RAG over stolen files, and .NET/C# AI libraries being collected to build AI into malware — moving beyond public chatbots (The Hacker News, The Register). · AI & Model Security

July 21, 2026

• The DPRK "Rollup Polyfills" npm campaign expanded with new malicious packages react-hot-svg v1.1.7 (stage 1) and rollup-plugin-polyfill-helper v1.0.0 (stage 2), abusing typosquatted CDN-style domains for C2 that is not yet active. Nextron Research. · Supply Chain

July 19, 2026

• GoldenEyeDog subgroup linked to the DigiCert breach and code-signing certificate theft, tying stolen signing material back to an APT cluster (The Hacker News). · Threat Activity

July 15, 2026

• A jailbroken Google Gemini was used by a Russian-speaking fraudster to spin up a fresh C2 server for a credential- and crypto-stealing botnet in about six minutes, per The Register — a concrete demonstration of AI collapsing the time from intent to working attack infrastructure. The Register · AI & Model Security

July 12, 2026

• Apple sued OpenAI, alleging a "coordinated campaign" to poach 400+ ex-Apple staff — including former iPhone design chief Tang Tan — and steal trade secrets tied to unreleased hardware, as OpenAI builds out its own hardware division. The Decoder · Policy

July 8, 2026

• North Korea's PolinRider supply-chain campaign continues to expand, with new malicious Go modules and fresh JSONKeeper-based C2 URLs dropping and executing loaders via Node, per Nextron and Socket tracking. Nextron · Threat Activity · also initial access