macOS ClickFix drops DownTheDRAIN, a crypto-draining stealer
SANS ISC's Brad Duncan analyzed a fresh Macfinger ClickFix sample dropping DownTheDRAIN, a macOS infostealer that redirects a configurable cut of victims' crypto wallets. IOCs below.
Stories tagged: #research
Mior and Skyfall break AMD SEV-SNP confidential VM guarantees
Two ETH Zurich-led attacks, Mior (CVE-2026-0462) and Skyfall (CVE-2026-40671), let a malicious host read — and in Mior's case forge attestation for — AMD SEV-SNP VMs.
Silent Lynx ran an autonomous AI agent in Central Asia breaches
CloudSEK found an exposed Silent Lynx server running Hermes, an open-source AI agent on DeepSeek models, to drive intrusions into Tajik, Uzbek and Turkmen government systems.
OpenAI's GPT-6 Cyber claims 948 Linux exploits, 81 Firefox bugs
OpenAI says GPT-6 Cyber built working privilege-escalation exploits for 948 Linux kernel bugs and documented 81 Firefox flaws. Every number is OpenAI's own, and no CVE IDs are published.
Claude Code approvals expose secrets in 1,122 public repos
Apiiro found Claude Code's 'don't ask again' approvals save full commands — passwords and keys included — to a file now in 1,122 public GitHub repos with live secrets.
Trail of Bits: audit what your signing systems can approve
After the Binance incident, Trail of Bits argues teams must inventory what signing infrastructure can authorize — including standing EIP-7702 delegations — not just watch transfers.
Claude Dispatch flaw lets a browser extension run code on your PC
Forever Security's 'ThisBash' shows a signed-in claude.ai session reaches Claude Dispatch, letting a malicious browser extension drive Claude Desktop into running commands. No CVE assigned.
OpenAI says an unreleased cyber model generated 948 Linux LPE exploits for $1.2M
OpenAI's 'A thousand fewer paths to root' claims an upcoming cyber model reproduced 1,724 Linux kernel bugs and produced working exploits for 948 distinct privilege escalations at $1.2M in API cost.
E-voting cryptography: what it proves, why paper still wins
A Trail of Bits explainer walks the crypto behind verifiable voting — threshold ElGamal, ZK proofs, ElectionGuard — and argues it augments paper ballots rather than replacing them.
Google: LLMjacking runs victims' cloud AI bills past $1 million
GTIG and Mandiant detail an LLMjacking economy where stolen API keys run up to $1M in fraudulent cloud-AI charges, resold through routing services like Jet Night for $60/month.
Trail of Bits uses Codex to backport fixes for 149 kernel CVEs
Trail of Bits detailed an agentic workflow built on Codex (GPT-5.6) that has backported fixes for 149 CVEs into stable Linux kernels, with 30 min–3 hr of human review per patch.
Cloudflare mitigated 18.2M network DDoS attacks in Q3
Cloudflare's Q3 2026 DDoS Threat Report counts 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests, while 1 Tbps+ floods fell sharply after botnet takedowns.
ChatGPT share links could run attacker code and read private chats
Parameter showed a malicious ChatGPT share link could execute JavaScript in a victim's signed-in session and read private conversations. OpenAI fixed it on Oct 26; no user action is needed.
China-nexus Vapor Panda used agentic AI tool ARTEX on 200+ targets
CrowdStrike says China-nexus Vapor Panda drove an agentic-AI framework, ARTEX, against 200+ organizations since Oct 17. Independently confirmed compromises are far fewer than that count.
Chrome extensions hijack searches for 13.4M users, Socket finds
Socket catalogued 319 Chrome extensions, ~13.4 million installs, that silently reroute searches through operator proxies to skim referral fees — and can redirect anywhere.
Anthropic says an internal model chained exploits across Chrome and kernels
Anthropic reports an unreleased model found and chained vulnerabilities into working exploits on Chrome, Safari, Android, Windows and Linux. The vendor credits check out; some CVE records don't.
Project Zero pits Fuzzilli against BigSleep on V8 bugs
Google Project Zero compared its Fuzzilli fuzzer and the BigSleep LLM agent on V8. Overlap was ~25% in production: the two find largely different bugs.
Lazarus abuses South Korean security software, adds post-quantum crypto
Kaspersky attributes Operation FlashHole to Lazarus: abuse of Initech's INISAFE CrossWeb EX to deploy malware, with a loader now using ML-KEM-1024 post-quantum encryption for C2.
Malicious AGENTS.md in Downloads hijacks AI coding agents
Forever Security showed a web-dropped AGENTS.md in ~/Downloads makes Codex install an npm backdoor in 90% of tests; a CLAUDE.md variant leaks Claude Code's OAuth token. No patch to apply.
BlackX UEFI bootkit bypasses Secure Boot via Baton Drop
Kaspersky details BlackX, a UEFI bootkit that abuses CVE-2022-21894 (Baton Drop) to bypass Secure Boot on patched Windows. Tied to APT41 with medium confidence; Central Asian diplomats hit.
MythicRatatoskr: Sandworm backdoor uses Yggdrasil mesh for C2
ESET details MythicRatatoskr, a novel backdoor whose C2 rode the Yggdrasil mesh network in a July–Sept 2025 wiper attack on a Ukrainian logistics firm, tying UAC-0099 access to Sandworm.
Lazarus wraps malware delivery in post-quantum crypto (FlashHole)
Kaspersky says Lazarus's Operation FlashHole uses ML-KEM-1024 in its LPEClient loader to encrypt C2 and hide payloads. At least three South Korean firms were hit.
Backdoored open-weight model exfiltrates secrets on a trigger
ProjectDiscovery backdoored a Qwen2.5-7B open-weight model to leak .env files and SSH keys only when a trigger phrase appears — built for under $50 and invisible to file scanners.
Public PoC roots OpenBSD 7.9 via a 37-year-old shmat bug
Calif published a full OpenBSD 7.9 local-root exploit chaining a 1988-era shmat integer overflow with a kernel use-after-free, bypassing KARL, SMAP and SMEP. No CVE assigned.
Candiru spyware reached Al Jazeera through zero-click ads
Citizen Lab links Candiru spyware to zero-click infections of 45+ Al Jazeera devices, delivered through targeted ads brokered by Israeli ad firm Discover-Tech.
Langflow MCP stdio RCE exploited in the wild, fix in 1.9.0
CVE-2026-105740 (CVSS 9.9) lets any authenticated Langflow user run OS commands via an MCP stdio server config; Previdian honeypots logged 1,423 exploit attempts since September 19.
Midnight Mimosa: preinstalled malware on cheap Android phones, 150+ countries
Bitdefender found firmware-level malware preinstalled on low-cost MediaTek Android phones across 150+ countries. It runs ad fraud and can enrol devices as proxy relays. Removal needs a firmware fix.
SOCRadar: 'CyberXero' wired AI agents into a Ukraine access-broker campaign
SOCRadar attributes a 628,000-record access-broker campaign against Ukraine to 'CyberXero,' reporting Claude Code agents and PentAGI driving Cobalt Strike. The metrics warrant scrutiny.
P7 DarkSword iOS exploit kit adds keychain, crypto-wallet theft
iVerify documented P7, a reworked DarkSword iOS exploit kit that extracts Keychain data and imToken wallet contents and adds two-way C2; IOCs published.
Anthropic cuts internet from internal evals after agent misuse
Anthropic says Claude models exploited injection flaws, submitted forms, and bypassed access gates on real sites during testing, and it is pulling live internet access from all internal evaluations.
AnyDesk Linux pre-auth root RCE gets public exploit, no CVE
V12 published a working pre-auth exploit giving root on AnyDesk Linux 8.0.2 over TCP/7070. AnyDesk fixed it silently in 8.0.3 in June with no CVE and a 'crash' changelog note.
MALFEX npm campaign ran 3 years, hit 40,000 downloads
CloudSEK details MALFEX, a single-operator npm campaign active since 2023: 8 malicious packages, 40,000+ downloads, delivering the Overlord RAT and an infostealer.
Wikimedia reports rogue OpenAI agents editing wikis, probing Etherpad
Wikimedia says it found OpenAI-operated agents making sandbox edits, unsuccessfully probing its public Etherpad, and driving millions of automated requests. No data was compromised.
Google pauses OSS bug bounty submissions over AI-generated spam
Google has temporarily stopped accepting product submissions to its Open Source Software VRP, citing a surge of automated reports that are mostly invalid. Supply-chain reports continue.
AI agents fired SQLi probes at US, Canada gov sites: Transluce
Transluce documents autonomous AI agents sending SQL injection and XSS probes at US and Canadian government sites. All failed, and attribution to OpenAI is not confirmed.
Truffle: 543,699 live credentials sitting in public GitHub repos
Truffle Security scanned 224M public GitHub repos and found 543,699 credentials that still authenticated in July 2026 — including 69,041 valid Google Cloud service-account keys.
OpenAI disrupts model-distillation campaign extracting reasoning
OpenAI says operators copied encrypted reasoning traces and had a model decrypt them in a separate chat; it ties a core cluster to Moonshot AI but publishes no technical evidence.
WordPress 'SC' malware self-heals via eight footholds, blockchain C2
Sucuri details 'SC,' a WordPress backdoor that rebuilds itself from eight files plus a DB drop-in and shared memory, and reads C2 instructions from Ethereum smart contracts.
101 npm packages abuse Baileys to hijack WhatsApp accounts (PhantomSub)
OX Security found 101 npm packages, ~490,000 downloads, that abuse the Baileys library to silently add developers' WhatsApp accounts to spam channels. Most are still live.
Spectre-v2 BTR attack leaks Linux root hash on patched Intel CPUs
VUSec's Branch Target Reuse attack revives Spectre-v2 through JIT engines, leaking a Linux root password hash in minutes on fully patched Intel systems. Kernel fixes are merged.