[vidar]

September 11, 2026

• Infostealer logs are yielding replayable AI session tokens — Lumma and Vidar output is being mined for provider tokens and API keys that grant account access without touching the password or MFA (The Hacker News). · AI Infrastructure & Agent Security

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

September 1, 2026

• Anthropic is force-logging-out Claude users and stripping stored payment data after commodity infostealers were found harvesting authenticated Claude sessions and replaying them to consume victims' usage; Anthropic says the activity is unrelated to malware distributed through Claude (SecurityWeek, Dark Reading). As @Privacy_Hawk puts it, stealers like Vidar, Lumma and StealC don't need the password if they can lift an already-authenticated browser session (earlier coverage). · AI & Model Security

in Attackers Are Living in the Management Plane

July 12, 2026

Exploit Chains, Poisoned Packages, and AI Agents Turned Against Their Owners

Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.

July 10, 2026

• Factory-v3, tracked by Unit 42, is a financially-motivated framework pairing unique per-build Go binaries with DLL search-order hijacking to bypass security filters, distributing both the Vidar stealer and the XMRig miner. Unit 42 (X) · Malware & Endpoint Evasion

in Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0

July 9, 2026

• Vidar infostealer is hitting SMBs through malvertising for cracked/pirated software, bundling data theft with cryptomining. Dark Reading · Threat Activity

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro