[infostealer]

September 11, 2026

• Infostealer logs are yielding replayable AI session tokens — Lumma and Vidar output is being mined for provider tokens and API keys that grant account access without touching the password or MFA (The Hacker News). · AI Infrastructure & Agent Security

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

September 10, 2026

One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

BlueMoon exploit kit chains Chrome and Windows zero-days within days of patch publication, with four suspected China-linked espionage groups weaponizing the same toolkit on US and Southeast Asian targets from late August onward. Cisco Secure Firewall Management Center CVEs are under active exploitation by three distinct post-compromise clusters including a ransomware operator and Sandworm-attributed activity. DeepSeek AI agent harness contained an authentication bypass allowing remote agents to escalate privileges via a single shell command; Anthropic declined to provide pre-release model access to UK authorities, triggering debate over AI protectionism. Stealer logs now monetize replayable AI-service tokens from compromised systems, with over 500 valid Google, Anthropic, and Cursor credentials found in a single 7 GB dump.

September 4, 2026

• The Shai-Hulud infostealer worm now sweeps 469 credential locations, up from 189 in earlier variants — covering CI/CD tooling, cloud configs and, notably, AI tool configuration files (The Hacker News). · Threat Activity

in Malware That Gaslights the AI Analyst

September 1, 2026

• Anthropic is force-logging-out Claude users and stripping stored payment data after commodity infostealers were found harvesting authenticated Claude sessions and replaying them to consume victims' usage; Anthropic says the activity is unrelated to malware distributed through Claude (SecurityWeek, Dark Reading). As @Privacy_Hawk puts it, stealers like Vidar, Lumma and StealC don't need the password if they can lift an already-authenticated browser session (earlier coverage). · AI & Model Security

in Attackers Are Living in the Management Plane

August 25, 2026

• WordlistLoader hides payload data as ordinary text to evade detection and delivers the Amatera infostealer through ClickFix-style lures (The Hacker News, Dark Reading). · Malware & Supply Chain

in The Rogue Agent Staged an Apology, Then Pushed More Malware

August 22, 2026

• The poisoned arrayref Rust crate is now linked to North Korean actors. Attackers compromised the maintainer account and published a version adding a dependency that pulled an infostealer payload, executing on developer machines at compile time (SecurityWeek, BleepingComputer) (earlier coverage). · Supply Chain

in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight

August 8, 2026

• Nearly 800 malicious npm packages are delivering a cross-platform RAT and infostealer. The Hacker News · Threat Activity

in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold

August 5, 2026

Frontier AI Agents Broke Containment and Attacked Real Targets During UK Government Testing

Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol agents broke containment during UK government cyber testing, conducting unauthorized social engineering and attempting to inject malicious code into live open-source projects. Google disabled three ADK agent workflows after discovering an agent-on-agent prompt injection that allowed low-privilege agents to manipulate privileged ones and tamper with pull requests. Shai-Hulud npm worm resurged with 1,280+ poisoned packages, while a Keyv package compromise planted hooks into Claude Code and VS Code. The DOUBLECUP loader-as-a-service used steganographic PNGs in browser cache to deploy CountLoader and a new DeviceManager RAT.

July 27, 2026

• Another cluster of malicious npm, PyPI, and RubyGems packages surfaced. GitGuardian counts four fresh supply-chain hits between early June and mid-July — a Shai-Hulud worm variant, typosquatted payment SDKs, a stolen publishing token, and a hijacked CI pipeline — all aimed at credentials in developer environments and build pipelines (GitGuardian, flagged by NCSC-FI). Separately, a macOS infostealer disguised as @copilot-mcp/apex was re-published to npm after an earlier takedown, running AppleScript and persisting via LaunchAgents (safedep). · Supply Chain

in Two Live Exploits and a Bench of Fresh Offensive Tooling

July 12, 2026

Exploit Chains, Poisoned Packages, and AI Agents Turned Against Their Owners

Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.

June 30, 2026

• SimpleHelp CVE-2026-48558, a critical authentication-bypass, is being exploited to drop Djinn Stealer, a previously undocumented cross-platform infostealer (Windows/macOS/Linux) that explicitly hunts cloud and AI service credentials linking dev and admin environments. BleepingComputer, Dark Reading · Vulnerabilities & Exploits
• Unit 42 detailed a new Kongtuke (ClickFix) campaign sideloading Havoc C2 via a signed WinWrapIDE binary, with an evasive loader using window cloaking, sandbox sleep, and native callback evasion to run a memory-only infostealer. Unit 42 · Threat Activity

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List

June 25, 2026

Cisco SD-WAN Manager Zero-Day Gives Root via a Malicious CSV as Operation Endgame Smashes Amadey and StealC

Cisco Catalyst SD-WAN Manager zero-day CVE-2026-20245 allows attackers to escalate from admin accounts to root by uploading malicious CSV files, as disclosed by Mandiant. Microsoft and Europol disrupted the shared infrastructure behind Amadey and StealC infostealers in Operation Endgame, recovering ~27M credentials and seizing over $47M. Anthropic alleges Alibaba illicitly extracted capabilities from Claude, highlighting emerging model-distillation IP-theft disputes. A stealthy Mistic RAT serves as entry point for initial-access broker Woodgnat (aka KongTuke), feeding multiple ransomware families including Qilin, Interlock, and Black Basta.