⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.

This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to.

Some attacks were clever. Others were painfully simple. The full recap shows just how much can go wrong, and how little it sometimes takes.

⚡ Threat of the Week

ConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.

🔔 Top News

• BeyondTrust Remote Support Flaw Exploited as 0-Day — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance. According to Google-owned Mandiant, the attack involved the deployment of a lightweight PHP web shell codenamed SAWFLY for interactive remote access and a tunneling program called BARECLAW to route traffic through the device. Only a small number of organizations are assessed to be impacted.
• Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages — Microsoft says it has dismantled a criminal marketplace that sold three phishing kits, namely CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System, that were responsible for sending over 1 billion malicious messages to more than 75,000 organizations worldwide. Redmond said it took down Yam Store (aka Storm-3119), a coordinated underground network that offered commercial phishing-as-a-service (PhaaS) toolkits that allowed other threat actors to readily purchase and deploy phishing pages and steal data and credentials. The kits were also capable of advanced evasion, such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations. Yam Store functioned as an initial access broker, peddling not just phishing kits but also infrastructure built on compromised or fraudulently obtained Microsoft and Google cloud environments.
• Ledger Finds Unauthorized Hardware Implants — Cryptocurrency hardware maker Ledger temporarily paused sales of its products via CryptoBilis and other third-party resellers in Southeast Asia and Germany after a backdoor embedded into a handful of wallets led to the theft of an estimated $100 million in cryptocurrency. The implants are said to be an advanced version of a backdoor that hardware hacker Joe Grand found earlier this year and notified Ledger in March 2026. It's not clear how this occurred, but signs point to a compromise of Ledger's supply chain. One of the victims of the incident is a fraudster who engaged in a task scam and lost more than $4.8 million. "In this task scam, people were paid to fake sales and reviews of real items," Chainalysis said. "Then a 'negative balance' appeared, and they were told to add their own money in order to get paid. On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet." According to cybersecurity journalist Kim Zetter, Trezor wallet devices sold by third-party non-authorized sellers have also been found to contain implants that generated pre-determined seed phrases so as to allow the attackers to guess them easily and gain access to the accounts.
• Pwn2Own Ireland Demos 98 0-Days — The Pwn2Own Ireland 2026 hacking contest saw white-hat hackers exploiting 98 zero-day flaws, earning them a collective $1,262,000 in rewards. Ikotas Labs came first with 42.5 Master of Pwn points and $361,000 in cash after discovering 12 unique bugs. Xint and Team ZyGoat secured second and third spots. Ikotas Labs, Xint, and Mobile Hacking Lab broke into Google's Pixel 10, earning them $150,000, $300,000, and $112,500, respectively. Vendors are expected to patch the zero-days disclosed during the competition within 90 days before the details are publicly disclosed.
• OpenAI Disclosed New Misalignment Cases — OpenAI said internal models hacked more websites, bypassed browsing restrictions, and used cryptocurrency from a wallet it couldn't otherwise access, in the latest set of disclosures where its agents carried out unethical and likely illegal acts. In all, the company reported seven new incidents. The development came as the Indian Computer Emergency Response Team (CERT-In) said it received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation runs on the open internet, accessed personal data from Indian organizations. The agents found their way in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles. CERT-In did not name the providers or affected organizations.
• OpenAI Engineer Charged — The U.S. Department of Justice charged an OpenAI engineer, Abdulrahman Alfozan, with attempting to intercept oral communications after allegedly planting a recording device in an executive conference room. Prosecutors claimed company security staff found a second device in his bag. CCTV footage placed the defendant near the conference room on several dates. Alfozan allegedly had no authority to access or participate in meetings held in the room, which is often reserved for the highest-level discussions. In a subsequent filing, federal prosecutors revealed that Alfozan had booked a one-way ticket from San Francisco to Saudi Arabia with his wife and a third family member before his arrest on October 9, 2026.
• Attacks on French Refrigeration Systems — Cyber attacks on Danfoss- and Copeland-managed refrigeration systems pushed temperatures as high as 50°C (122°F) for roughly six hours, impacting over 700 French supermarkets and forcing them to discard food. French cybersecurity authorities advised supermarkets to disconnect them from the internet. The attacks targeted Intermarché and Netto, Coopérative U, Carrefour, Monoprix, and E.Leclerc. The affected systems are said to be internet-facing and running outdated firmware. "The username is admin and the password changes every day automatically to.. the current date," security researcher Kevin Beaumont said. "Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable." To make matters worse, the affected stores likely also failed to put the devices behind a VPN and create an allowlist of trusted IP addresses permitted to log in. "Two things would have changed the outcome," Pen Test Partners said. "Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor's own connection, change known and default credentials, and patch to a current release." Multiple vulnerabilities have been disclosed in the affected models, with Claroty warning that the issues could be exploited to "defrost the food."
• Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers — Threat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447 (CVSS score: 9.2), in the Collabora Online - Built-in CODE Server app for Nextcloud to backdoor servers. It has been patched in version 26.4.303. The attacks involve issuing a malicious request to the app's "proxy.php" endpoint to trigger command injection and plant a PHP web shell with the end goal of conducting reconnaissance and searching for password databases, password manager artifacts, and cryptocurrency wallets.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-9192, CVE-2026-85947, CVE-2026-85948, CVE-2026-85955, CVE-2026-85956, CVE-2026-9191 (Progress Software MarkLogic Server), CVE-2026-97229, CVE-2026-92883, CVE-2026-16301, CVE-2026-14814 (GitLab), CVE-2026-103521, CVE-2026-103522, CVE-2026-103523, CVE-2026-103524, CVE-2026-103526, CVE-2026-103527, CVE-2026-103528, CVE-2026-103529, CVE-2026-103535, CVE-2026-103537, CVE-2026-107248 (Thelia), CVE-2026-105445 (Docker), CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108, CVE-2026-89113 (SAP), CVE-2026-39919 (Ghostscript), CVE-2026-103849 aka BlockStrap, CVE-2026-92909, CVE-2026-91013, CVE-2026-100133, CVE-2026-92464, CVE-2026-105899, CVE-2026-106622, CVE-2026-105903, CVE-2026-106612, CVE-2026-106624, CVE-2026-75994, CVE-2026-106620, CVE-2026-90530, CVE-2026-106621, CVE-2026-106619, CVE-2026-90532, CVE-2026-48383, CVE-2026-48382, CVE-2026-105895, CVE-2026-103848, CVE-2026-75732, CVE-2026-90531, CVE-2026-83662, CVE-2026-106630, CVE-2026-106629, CVE-2026-106626 (Adobe), CVE-2026-110005 (Komodo Periphery Agent), CVE-2026-16753 (Lowcoder), CVE-2026-104937 (Shopware), CVE-2026-107656 (Fortinet FortiSandbox), CVE-2026-106173 (Fortinet FortiSIEM), CVE-2026-108184, CVE-2026-108185, CVE-2026-53420, CVE-2026-53418 (Zoom), CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819, CVE-2026-107814 (MariaDB), CVE-2026-78401, CVE-2026-78406, CVE-2026-16916, CVE-2026-16823, CVE-2026-19491 (IBM Verify Identity Access and Security Verify Access), CVE-2026-96951, CVE-2026-108398, CVE-2026-92707, CVE-2026-70242, CVE-2026-102866, CVE-2026-105016, CVE-2026-65674, CVE-2026-83498 (Microsoft Windows), CVE-2026-74580 aka Vghost, CVE-2026-99999 aka PwnEscape (Linux kernel), CVE-2026-110152, CVE-2026-110149, CVE-2026-110136, CVE-2026-110161, CVE-2026-110165, CVE-2026-110148, CVE-2026-110151, CVE-2026-110922 (Google Chrome), from CVE-2026-109704 through CVE-2026-109733 (Mozilla Firefox), CVE-2026-84419, CVE-2026-84420, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564 (Citrix), CVE-2026-93637, CVE-2026-93635, CVE-2026-73571, CVE-2026-10631, CVE-2026-50055 (Zimbra Collaboration Suite), CVE-2026-0322 (Palo Alto Networks PAN-OS), CVE-2026-76519 (Cisco Secure Email Gateway), CVE-2026-110447 (Collabora Online - Built-in CODE Server app), CVE-2026-39949 (Cacti), CVE-2026-0702 (VidShop – Shoppable Videos for WooCommerce WordPress plugin), CVE-2026-106126 (Tenable Identity Exposure), CVE-2026-103947, CVE-2026-103946 (Tenable Nessus), CVE-2026-105672, CVE-2026-105673, CVE-2026-105674 (TP-Link Tapo C325WB), CVE-2026-92392, from CVE-2026-86409 through CVE-2026-86415, from CVE-2026-87862 through CVE-2026-87866, from CVE-2026-92387 through CVE-2026-92391 (curl), CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629 (F5 NGINX), CVE-2026-100156, CVE-2026-96679, CVE-2026-96681 (Bisheng), CVE-2026-34073 (multiple TLS libraries), CVE-2026-44825 (Apache Solr), CVE-2026-104334, CVE-2026-97676, CVE-2026-97678, CVE-2026-97673, CVE-2026-97655, CVE-2026-97679, CVE-2026-88962, CVE-2026-93674, CVE-2026-93675 CVE-2026-104335, CVE-2026-85025, CVE-2026-79724, CVE-2026-81941, CVE-2026-81204, CVE-2026-81211, CVE-2026-81940, CVE-2026-78569, CVE-2026-78575, CVE-2026-76059, CVE-2026-79742, CVE-2026-78571, CVE-2026-105740 (Langflow), CVE-2026-94134, CVE-2026-94135 (Apache Airflow), CVE-2026-81983 (Adobe Acrobat), CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611 (Xen Project/Citrix XenServer), CVE-2026-70111 (Microsoft Windows Server), CVE-2026-23870 (React Server Components), CVE-2026-103059, CVE-2026-70357, CVE-2026-101027, CVE-2026-89430, CVE-2026-104632, CVE-2026-94205 (Gitea), CVE-2026-16516, CVE-2026-83540, CVE-2026-84897, CVE-2026-83540 (WolfSSH), GHSA-673q-mjm6-r5xr, CVE-2026-96889, GHSA-p3m5-59mp-jv5r (Next.js), CVE-2026-108097, CVE-2026-108099 (Drupal), CVE-2026-15911 (confluent-kafka), CVE-2026-102764 (BeyondTrust Remote Support), CVE-2025-61624 (Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager), CVE-2026-104935 (Ivanti Connect Secure), and multiple vulnerabilities in Google BoringSSL.

🎥 Cybersecurity Webinars

• How to Find Hidden AI Agents on Employee Devices and Bring Them Under Control → AI agents are quietly becoming a new insider threat, gaining access to company data, credentials, and internal systems without adequate security oversight. Join this webinar to learn how to uncover hidden AI agents on employee devices, detect malicious agent skills, identify risky permissions, and put practical controls in place before they lead to a security incident.
• How to Find Security Gaps and Build Faster Defenses Against AI-Powered Cyberattacks → AI-powered cyberattacks are evolving faster than traditional defenses can keep up. Join this webinar to learn how to assess your organization's AI threat readiness, uncover critical security gaps, strengthen detection and response capabilities, and build a practical defense strategy against emerging AI-driven threats.

📰 Around the Cyber World

• Meta said it addressed an issue after reports emerged that some Ray-Ban Meta smart glasses were recording people's conversations without the wearer knowing. The recordings occurred without users saying the "Hey, Meta" prompt phrase. "This issue has been resolved," Meta told Android Authority. "People can manage, review, and delete voice logs of their interactions with Meta AI via settings at any time." Meta did not say what caused the smart glasses to record people without user consent, or how many of them were affected.
• Fortra said it's tracking a 12-fold increase in emails using requests for quotation, project invitations, and procurement inquiries as phishing lures from October 2025 to September 2026. "These messages impersonate prospective buyers seeking pricing, availability, or project participation," Fortra said. "Their purpose is not to obtain a legitimate quote, but to persuade a recipient to access an attacker-controlled file-sharing, document-viewing, or procurement portal."
• A fake download site for the WatchGuard Mobile VPN with SSL ("watchguard-vpn[.]net") has been observed using a browser pop-up prompt to steal the victim's VPN server address, username, and password. As of October 13, the domain was offline. "In a unique twist, after collecting credentials twice (the first attempt gets rejected as 'incorrect' in a likely attempt to collect multiple credentials), the site then downloads the genuine, validly signed WatchGuard installer directly from WatchGuard's own content delivery network (CDN), meaning there is no malicious file for endpoint security tools to flag," Huntress said. "Meanwhile, unbeknownst to the victim, the threat actor now has access to their credentials, giving them access to victims' networks."
• A set of 42 malicious RubyGems packages has used typosquatting, brandjacking, and plausible utility names to target cryptocurrency and Web3 developers. The packages are designed to spawn a reverse shell and download a crypto theft kit capable of rerouting cryptocurrency transactions by replacing the destination address with an attacker-controlled wallet and harvesting wallet material, such as seed phrases and private keys. The names of some of the packages are: lightinng-invoice, cryoto-toolbox, etheremu.rb, bitcoin-rpc-lite, web3-sign-helper, and crypto-mnemonic-tools. The activity has been codenamed Ghost Dev by Open Source Malware.
• GreyNoise said it has observed a spike in scanning and exploitation attempts targeting Digital Video Recorders (DVRs) in Ukraine between September 21 and October 1, 2026. The majority of the activity attempts to exploit CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products.
• A series of email campaigns have been targeting the accommodation industry with fake guest complaints or reviews that deliver blockchain technology-abusing malware. "These emails appear to likely be a continuation of a prior series of predominantly Booking.com-spoofing emails that were seen delivering various remote access trojans (RAT) via ClickFix fake CAPTCHA websites," Cofense said. The activity leveraged the Ethereum and TON blockchains, a technique called EtherHiding, to deliver EtherRAT and TONResolver malware.
• As AI agents increasingly are being used to automate coding workflows, it increases the risk associated with credential exposure, Trellix warned. "Agents constantly take credentials out of the safe places your operating system keeps them, and put them somewhere far more exposed," Trellix said. "This happens as a normal side effect of everyday work. And even good security telemetry has a hard time distinguishing this from a developer doing their job -- or from an attacker who is already inside."
• MITRE released version 20 of its ATT&CK framework, adding entries that cover AI abuse, MFA bypass, and recent attacks on water utilities. This includes nine new Techniques and Sub-Techniques under the Enterprise domain for prompt injection, AI-enabled exfiltration, AI result poisoning, attacks on AI-assisted defenses, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) evasion, and application-specific password theft. For Mobile, MITRE also un-deprecated a technique for delivering malicious apps outside official app stores, last included in v11.
• Fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands are being used to plant infostealers on compromised systems using ClickFix lures. Some of the prominent targets include the U.S. and India. "The attacks share one trait: the employee performs the decisive step," ANY.RUN said. "They paste an 'install command,' run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations."
• An official OpenAI skill, render-deploy, suffered from a first-of-its-kind supply-chain vulnerability which instructed production apps to send their tokens to an unregistered domain ("render-internal[.]com"). "It builds apps that trust a domain nobody owns, so any attacker could register it and start receiving tokens from real production apps," AIR Security said. "Vulnerable servers in the wild sent tokens to the domain, users are advised to update to the patched version of the skill."

• The U.S. Federal Bureau of Investigation (FBI) warned that scammers could exploit the 2026 U.S. midterm election to perpetrate financial fraud schemes. "As previously reported, scammers use the names, images, logos, and slogans of candidates to fraudulently solicit campaign contributions, sell merchandise that is never delivered, or steal personally identifiable information (PII) that can be used for other fraud," the FBI said. "Scammers also exploit artificial intelligence (AI) tools to generate highly realistic voices, images, and written messages that impersonate candidates, campaigns, government entities, and trusted contacts."

Conclusion

If there's one thing this week made clear, it's that small gaps can lead to big problems. A weak password, an old bug, a trusted connection, or a device that wasn't checked properly. None of these sounds unusual on its own. But attackers keep finding ways to turn them into something much worse.

The lesson isn't to worry about every new threat. It's to pay closer attention to the things we already know can go wrong. Check what's exposed, question what you trust, fix what you can, and don't assume something is safe just because it's been working fine. Sometimes the simplest checks prevent the biggest headaches.

from The Hacker News https://ift.tt/e2qBzJx
via IFTTT

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software

In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together, they produce this path:

public internet → email → case record → agent prompt → agent action → case comment → outbound reply

An unauthenticated outsider now has a route into an internal agent's instructions, and the agent's reply leaves through the same door. Nothing was misconfigured. The finding, documented by researchers in August 2026, is a clean example of how agents that arrive inside existing platforms fail: through the application around them, not the model inside them.

The risk is in the application, and the application is the thing nobody re-reviewed

Which intake features are enabled, which triggers fire, which objects are exposed to guest users, which automation passes untrusted data where, and which model version the agent is quietly calling underneath: these are the variables that decide whether the Agentforce chain is a support-queue nuisance or a data exposure. A vendor risk review performed once at procurement sees none of them, because the agent did not exist at procurement. A prompt filter watching the agent's inputs does not know that a particular input originated from a stranger, because prompt filters do not understand Email-to-Case.

Securing an inherited agent therefore means understanding its host application at the depth its own admins do. That depth is the one thing a questionnaire and a scanner both lack. The City-Forum campaign, an active worldwide data-theft operation against Salesforce and ServiceNow instances running since March 2025, was found in exactly this territory: the gap between platform features and the configurations enterprises actually run.

Builders are multiplying, and some of them are agents

The platforms have made agent creation as accessible as making a slide deck. Marketing operations builds an agent to pull pipeline reports. Finance builds one to reconcile invoices. Each rides its creator's permissions, because that is what makes it useful. Shadow AI was an employee pasting data into a chatbot. Shadow agents are that employee's access, running unattended, multiplied across everything they were ever granted.

Increasingly, agents also build agents. A coding agent tagged into a chat channel can scaffold and deploy another agent as easily as it opens a pull request; an orchestration platform spins up sub-agents to divide a task, each with its own connections and none with its own review. Any governance model that assumes a human requested each agent is quietly obsolete.

Why governance keeps producing a document

Ask a large enterprise about agent governance and the answer is usually a document: an acceptable-use policy, a monthly committee, a set of principles nobody disputes and nothing enforces. Ask the operational question, how many agents are running right now, what can they reach, and who owns each one, and the document does not know.

The OWASP Agentic Skills Top 10 now describes the sharpest version of this gap under its "No Governance" category: a skill deployed and managed inside a third-party platform is unreachable by external scanners (OWASP Agentic Skills Top 10 whitepaper, ast10-top10-whitepaper-2, published at owasp.github.io). The tools an enterprise points at the problem from outside cannot see inside the venues where most agents live. Governance fails most often because the rules get written before the security team can see the things the rules apply to.

The stack, bottom-up, with a test for each layer

The working order is bottom-up, and each layer is the precondition for the one above it. A practical way to check whether a program is real is to apply an operational test at each level.

Layer	What it has to produce	The operational test
Discovery	A continuously refreshed population across app configs, OAuth grants, network, endpoint, email metadata, and browser	Is the discovered count several multiples of the list IT keeps? If not, discovery isn't reaching where agents live.
Posture	Every platform's agent-relevant settings, measured against how they should be configured	Can the team list the intake features and guest-user exposures wired to agent triggers on its top three platforms?
Identity and ownership	An identity and a named owner per agent, with a lifecycle	Pick an agent at random. Does a human raise a hand within a day when asked "whose is this?"
Usage	Who is building what, through which surface, with what data	Is there a sanctioned path that ships a business team's agent with secure defaults, or only a block?
Agent controls	Least privilege against observed need, approval and quarantine for new agents, risk tiering that reflects each agent's full context	Does the same finding on a sandboxed dev agent and a customer-facing one show different severities?
Runtime	Live inspection and intervention	Is it fed by the five layers above, or deployed first and enforcing blind?

The cost of paper compliance

The EU AI Act's penalties carry GDPR-level weight: up to €35 million or 7% of global annual turnover for prohibited practices, up to €15 million or 3% for other violations. Every framework converging on it assumes the stack above exists. GDPR already showed what happens when it does not. British Airways (£20 million) and Marriott (£18.4 million) were not fined for having imperfect policies. Everyone has imperfect policies. They were fined because compliance existed on paper and could not be evidenced operationally when regulators asked. A governance practice built bottom-up generates that evidence as a byproduct: the inventory, the owners, the configurations, the review history.

Some platforms are designed to produce exactly that record. One leading example is Reco, which discovers agents across multiple vantage points, including the ones that never touch SSO, and assigns each a risk profile before any policy can be applied to it.

The Agentforce chain at the top of this article is not an exploit. It is a configuration, and configurations are governable, provided someone can see them. Chapters 1 to 3 of Into the Expanse cover the shift, the three launch vectors, and the governance practice in full: https://www.reco.ai/agent-ecosystem-security

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/IEAJQab
via IFTTT

Agents are your newest insiders. Security must move at their speed.

Agents are rapidly becoming part of how work gets done. They can support a range of activities from writing code and researching products to analyzing revenue, processing expenses, and acting across the systems that run the business. To be most useful, they often need access to company data, applications, tools, and other agents. That access is what makes agents more capable. With that capability can come insider risk.

This does not mean agents are inherently malicious. It means they are capable tools that can be granted access to important systems by users. They can make mistakes, be manipulated, or be compromised. Their models can produce variable outputs, their context can change, and their plans can evolve as they work. An agent that operates as intended when a task begins may respond differently as context or inputs change. Depending on how they are designed and deployed, agents can operate continuously, at machine speed and scale.

Satya Nadella, Chairman and Chief Executive Officer of Microsoft, recently described the trust architecture this new era requires: we must separate the supply of intelligence from the authority over it. We should not ask a model to be its own security authority. The controls that determine what it can access, what actions it can take, and whether it should continue operating must sit outside the model, where the model cannot bypass or tamper with them.

“The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”

Satya Nadella

Project Perception—Securing your agentic insider

We introduced Project Perception and the Microsoft cyber stack to help organizations defend with agents. Today, we are extending Perception to secure the agentic insider. Guardian Agents help security teams operate continuously, at machine speed and scale, while sensors, context, and actuators across the cyber stack help understand changing agent risk and continuously adapt protection in response. Project Perception and Microsoft Agent 365 share signals, context, and a unified registry giving IT and security teams a consistent view of agents and risk, with the controls each needs.

This builds on a simple security principle: surround non-deterministic intelligence with deterministic controls, independent evidence, and containment boundaries. Assume an agent can fail or be compromised. Observe it continuously. Minimize and tailor its authority before it acts. And continuously adjust that authority as risk changes.

This requires protection across identity, permissions, data, endpoints, network, cloud, and runtime. The system has four continuous responsibilities:

• Know which agents exist, who owns them, why they exist, and what they are doing.
• Contain what each agent can access and do before it acts.
• Protect the data, tools, runtime, resources, and systems in the agent’s path.
• Adapt protection continuously as behavior, context, and risk change.

These are not four products or sequential phases. They operate together. Evidence changes risk. Risk changes policy. Policy changes what the agent is allowed to do. Consider an expense-approval agent. It may need to read expense submissions, check policy, and approve routine reimbursements, but it should not inherit every permission of the employee who sponsors it. Its identity, runtime, access paths, and task-scoped authority should be explicit from the start. If it later encounters a prompt injection or attempts an action outside that task, the system should respond proportionately: preserve safe reads while blocking writes, narrow the resources it can reach, require provable human approval for a consequential step, or isolate and stop the agent when the risk warrants it. This is what continuous containment looks like in practice.

Know every agent and give it an accountable identity

You cannot secure what you cannot see. Agents can be created through Microsoft platforms, integrated through partner platforms and software development kits (SDKs), or introduced locally without a central deployment process. Microsoft Security uses native integrations, connectors, and sensors across the cyber stack to discover more of the agent estate.

We are expanding discovery to 35 additional types of local agents, bringing the total to 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Organizations can bring these agents into a unified registry, regardless of how they were discovered, to understand ownership, activity, and risk.

Discovery tells you that an agent exists. Identity gives security and governance systems a durable anchor for controlling it.

Every agent should have a first-class identity distinct from the person using or sponsoring it. We are extending Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors. This means an agent can become a policy target even when it was not originally integrated with Microsoft Security. Agent identity anchors attribution, ownership, lifecycle, risk, permissions, authorization, and policy, so the enterprise can distinguish what a person did from what an agent did on that person’s behalf.

Contain what the agent can do before it acts

Being able to find and identify an agent is necessary, but it is just the start. We need to understand the potential impact the agent can have in the enterprise environment. The next step is to bound the agent across its runtime, its paths to tools and resources, and the authority it can exercise.

Contain the runtime

The model and harness should execute inside a controlled environment rather than inherit fully-privileged access to the device. Sandboxes such as Microsoft Execution Container (MXC) provide policy-controlled access to resources the agent needs to complete its task. They also create an enforcement boundary where security controls and observability can operate outside the agent’s reach. If the agent or harness is compromised, it should not be able to disable the controls watching it.

Control the action space

An agent should not be free to call any tool, API, Model Context Protocol (MCP) server, resource, or other agent it can find. Local and network and data controls must mediate those paths, observe the calls, and enforce enterprise policy. Controlling the destination alone is not enough. Security must also understand the content flowing into and out of the agent, including its sensitivity, provenance, and whether untrusted data may be influencing the agent’s behavior.

Start with no permissions, or least privilege

We have spent decades applying Zero Trust and least privilege to people. Agents make those principles even more important. An agent should not automatically inherit all the standing access of its user. It should begin with no authority and receive only what it needs for the approved task, for only as long as the task requires.

To enable this, we are introducing Dynamic Permissions. Organization-wide policy sets the outer boundary, including preventing an agent from obtaining authority its user does not have. Permissions can then be scoped to the task, made time-bound, and contracted or removed as the task changes or completes. Higher-impact actions can require verified human approval.

The employee retains the employee’s access. The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only.

Adapt protection as agent risk changes

Least privilege reduces exposure, but it does not eliminate risk. An expense-approval agent may begin a task with the right access and then encounter a prompt injection in an external document. Its configuration has not changed, but its behavior and risk have.

For human users, a delay between detection and response may be manageable. For an agent operating at machine speed, it can be the difference between containment and impact. The security system must be able to understand what changed and act before a person can manually investigate every signal.

That is why we are introducing Dynamic Agent Risk and Dynamic Conditional Access for agents.

Dynamic Agent Risk

Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity. It considers how securely the agent is configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are drifting from the user’s or organization’s intent.

The result is not a one-time score assigned at onboarding. It is a continuously updated understanding of the agent’s current risk and whether its current authority still matches that risk. The question is not simply whether the agent should run or stop. It is what the agent should be allowed to read, change, invoke, or approve at that moment.

Dynamic Conditional Access

Dynamic Conditional Access extends Microsoft Entra Conditional Access for agents so a change in risk can drive coordinated action across multiple enforcement points. The response is graduated, not binary. Policy can reduce permissions, preserve reads while blocking writes, narrow the data and resources the agent can reach, restrict network paths, shorten or revoke time-bound access, or require provable human approval before a consequential action proceeds. At the highest levels of risk, it can isolate the runtime or stop execution entirely.

Return to the expense agent. It begins with narrowly scoped permission to review and approve expenses within policy. When it encounters untrusted content and attempts an unrelated action, new evidence raises its Dynamic Agent Risk. Policy responds proportionately: it can preserve read access while removing the ability to approve or write, block access to sensitive resources, and require cryptographically provable human approval for a high-impact step. If the risk continues to rise, the system can isolate the runtime or stop execution. The employee remains productive. The agent is constrained without treating every risk change as a kill-switch event.

Secure agentic systems at scale with Guardian Agents

As organizations deploy thousands or hundreds of thousands of agents, manually triaging every alert and coordinating every response will not scale. Securing agents must itself become agentic, while remaining inside boundaries people set.

That is why we are introducing new Playbooks and a team of Guardian Agents in Project Perception. People define policy, approval boundaries, and delegation rules. Playbooks define the desired security outcome and coordinate protective actions. Guardian Agents carry out the work at machine speed, adapting as agent activity, risk, security context, and organizational policy change.

Guardian Agents can help teams understand why risk changed, investigate the relevant evidence, recommend or apply containment, and use what they learn to harden policy. This is not about outsourcing judgment. People retain control over objectives and consequential decisions. The system carries the continuous work that does not scale through manual operations.

Agents will only be adopted at scale if they can be trusted at scale. At Microsoft, we are already operating in a world of hundreds of thousands of agents. As Customer Zero, we have learned that securing agents requires continuous visibility into agent activity, proactive protection of access and data, and adaptive protection that keeps pace with evolving threats. Those lessons directly inform the innovations we are delivering to help every organization adopt agents with confidence.”

—Terrell Cox, Corporate Vice President (CVP) and Deputy Chief Information Security Officer (CISO), Customer Security, Microsoft

Extending containment to the model

As model transparency increases, it creates a new source of security evidence. Chain-of-thought and other model-level signals can help identify intent drift, understand whether untrusted information is influencing reasoning, and detect when an agent’s planned actions are diverging from the task it was given.

We are bringing this deeper evidence into Dynamic Agent Risk, together with signals from across the cyber stack. This builds on Satya Nadella’s principle: increase transparency into the model while keeping security decisions and enforcement independent of it.

Greater model transparency gives security systems deeper evidence to detect suspicious behavior and inform Dynamic Agent Risk. But the core security principle does not change: the model cannot be its own security boundary. Independent systems must observe every layer, including the model itself, and ultimately determine and enforce what the system is allowed to do.

These are not separate pillars. They make the same containment architecture stronger: better evidence, stronger assurance, more accurate risk, and more effective protection.

Confidence to move faster

Organizations are adopting agents to serve customers better, solve problems faster, and give people more time for the work that matters most. The goal is not to make every model perfectly predictable before it can be useful. The goal is to build systems that remain secure even when the model is not.

That requires a clear division of responsibility. Models supply intelligence. People and organizations retain authority. Independent controls establish identity, limit privilege, protect data, preserve evidence, and contain unsafe action. Security continuously reassesses risk and adapts protection as the agent works.

You should not have to choose
between innovation and safety.

That is what we are working toward: an agentic world where organizations can put intelligence to work with confidence because security can observe it, govern it, and contain it at the same speed.

Learn more here and join us at Microsoft Ignite.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post Agents are your newest insiders. Security must move at their speed.  appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/KQZANsj
via IFTTT

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.

"The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said. "The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings."

The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It's being tracked under the moniker REF8801. The names of the npm packages, each of which targets both Windows and macOS machines, are listed below -

• @apexacc/cli (Apex Copilot CLI — AI advisor for Web3 founders) -
• @apexacc/audit (Web3 Security Scanner — 18 tools for DYOR and smart contract auditing)

While both the packages and their associated GitHub repositories are no longer accessible, "@apexacc/cli" was advertised as an "AI advisor for Web3 founders" that's powered by Claude Fable 5 and Gemini 2.5 Flash.

"@apexacc/audit," on the other hand, claimed to be a Model Context Protocol (MCP) server exposing 18 security tools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named "apexaccelerator" and linked to a GitHub account called "apexaccs" and an entity referred to as the Apex Foundation.

Interestingly, the campaign itself is not new. In late July 2026, SafeDep detailed three other npm packages linked to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family -

• @apexfdn/apex
• @copilot-mcp/apex, which features the same package description as "@apexacc/cli"
• @apexfdn/copilot-mcp, which claims to be an Apex Copilot and MCP server for "portfolio diligence and operator tools"

Artifacts captured by Socket show that the Apex Foundation has been linked to at least two distinct domains since April 2026

• apexaccs[.]org
• apexfdn[.]xyz

According to Internet Archive snapshots dating back to March 19, 2026, the foundation states: "The Apex Foundation offers $235,000 investments, grants, and partnerships, and connects projects with VCs, angels, and private equity if they don't meet our criteria."

Posts shared on X show the accelerator approaching developers of cryptocurrency wallets and market intelligence tools for traders with offers of direct investment and instructions to run their due diligence tool ("@apexacc/cli"). In the case of the latter, the npm package has been found to drop an encrypted malware loader disguised as an Apple app ("com.apple.system.loader").

"The group also sought to build credibility through its presence at TOKEN2049 in Singapore and other in-person events it has hosted in the past," Elastic said. "The group attempts to manufacture legitimacy by appearing at widely attended conferences, indirectly lending credibility to the project."

Once installed, neither of the npm packages provides the promised functionality. The 18 security tools part of the @apexacc/audit package generate fabricated findings, while @apexacc/cli's scoring test returns an unsupported assessment of a fictitious project.

Instead, their primary responsibility is to propagate a macOS backdoor called CloudSyncD and a custom Windows information stealer that exfiltrates data through Telegram. The platform-specific executables are retrieved from the projects' GitHub releases.

Both packages implement a distinct verification path for Windows and macOS by sending an HTTP POST request to "win32" or "darwin" to "vrf.apexaccs[.]org/api/v1/vrf" to initiate the appropriate next stage. The Windows and macOS infection chains are as follows -

Windows -

• The malware retrieves a Base64-encoded PowerShell command, which reaches out to another endpoint ("0auth-chromium[.]com/APIService") to fetch a second PowerShell script ("drop.ps1") that downloads an executable ("bludness.exe") from "ehegisnightmare[.]icu" and launches it in a hidden window.
• The PyInstaller executable is a Python loader that checks if it already has administrator privileges and, if so, downloads the next stage from "ehegisnightmare[.]icu," saves it as "%TEMP%\exegis.exe," and launches it. If not, it attempts to bypass User Account Control (UAC) using UACME's ucmDebugObjectMethod().
• The "exegis.exe" binary is another PyInstaller executable that collects system metadata, running processes, and performs anti-virtual-machine (anti-VM) checks before decrypting and launching a bundled loader as "%TEMP%\updater_loader.exe."
• The Golang executable patches Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), unhooks "ntdll.dll" to blind endpoint security tools, and loads the next-stage shellcode into its own memory.
• The shellcode is a native information stealer that examines for signs of a prior infection and then harvests system information, clipboard text, process listings, Wi-Fi profile names, screenshots, and data from wallets, browser extensions, messengers, remote-access and file transfer protocol (FTP) applications, virtual private network (VPN) clients, browsers (Google Chrome, Microsoft Edge, Mozilla Firefox, and Yandex), and game clients. The stealer can also bypass Chrome's app-bound encryption (ABE) protections to extract saved passwords, session cookies, browsing history, download records, and profile metadata. The collected data is exfiltrated through Telegram.

macOS -

• The malware downloads a remotely hosted bash script and executes it on the machine.
• The shell script downloads a GZIP-compressed archive from "verify.apexfdn[.]xyz/unix/," saves it as "package.tar.gz" in a temporary directory, and extracts its contents.
• The archive contains a dropper for CloudSyncD, which first phishes the victim's system login password using a fake authorization prompt and then uses it to launch an embedded payload with sudo privileges. The payload performs host discovery, collects hardware and operating-system details, and then contacts an external server ("ccmihr[.]com") to transmit the data and receive further tasks that allow the malware to download and run additional payloads.

It's worth noting that CloudSyncD was first documented by Jamf Threat Labs late last month, detailing its propagation via a fake Zoom installer. The malware was detected in the wild in mid-September 2026.

"Its behaviors illustrate how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk, while still depending on the oldest technique available: asking the user for their password," Jamf said.

Besides deploying a stealer and backdoor depending upon the infected operating system, the packages are capable of intercepting and redirecting OpenRouter large language model (LLM) traffic, as well as registering an MCP server under their control in the victim's agent configuration.

"These changes allow the attacker-controlled API to receive the prompts, conversation history, code snippets, and tool outputs included in the agent's LLM requests," Elastic researchers explained.

"The attacker's MCP server can also supply instructions that are added to the agent's prompt, along with tool names, descriptions, and accepted inputs that help the model decide which tools to invoke and how to use them. Together, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent's subsequent actions."

from The Hacker News https://ift.tt/79wGXOP
via IFTTT

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said.

Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without ever seeing the key.

The affected group is 1.4% of Console users, all of whom have an outside provider linked, and OpenCode has told them via email to revoke those keys with each provider and replace them.

The email went out on the morning of October 17 under the subject line "Action Required: Potential provider key breach." Anyone who did not get one was not affected, OpenCode said in a post on X later that day.

The keys at risk are the ones pasted into Console. The OpenCode command-line and desktop apps keep provider keys added on the machine in a SQLite database there. The breach involves "the OpenCode Console, not OpenCode itself," co-founder Dax Raad wrote in a reply on X, and those keys "never come to us."

A provider key is a bearer credential: whoever holds a copy can run billable requests against the owner's account until the provider revokes it. Deleting the key from Console does not revoke it, and a Console budget cannot cap that use either, because Console only sees requests that pass through its own gateway.

For a key that was saved in a Console workspace, OpenCode's email and the providers' own guidance give these steps:

1. Revoke the key in the provider's own dashboard and create a new one, following the instructions from OpenAI, Anthropic, or Google.
2. Update every application and script that used the old key.
3. Review usage and billing at the provider for requests you did not make, going back at least to October 16. OpenCode has not said when the unauthorized access began.
4. Set a spend limit or alert at the provider and give each tool its own key, so a copied key does less damage and its use is easier to trace.

Some users say they have already paid for usage they did not run. Dealroom reported that Colin Parsons wrote on X that his OpenAI key had been used for $281 and his Anthropic key for $168, and that Preston Zeller put his losses at $1,700.

Notebookcheck reported a Reddit user's claim of $400 of unauthorized usage on an Anthropic account, and another's of about €200 of Google usage, with the project then suspended.

Those are the users' own accounts. OpenCode's own wording is that the keys "may have been exposed," and it has not said that any key was copied or used.

OpenCode's October 17 post also called the incident ongoing, said the company was working with Anthropic, OpenAI and Google to fix it, and described the breach as "related to a large-scale distillation attack." The company has not named anyone or said how the two connect, what the legacy system was, how it was reached, how many keys it held, or how many users 1.4% represents.

Distillation is the term AI model providers use for campaigns that pull a model's answers in huge numbers to train a rival model. Anthropic said in September that the labs behind such campaigns reach its models through networks of fake accounts created with stolen credit cards, login credentials and harvested API keys. A stolen key has other uses too: criminal markets resell AI tokens and keys and use them to run up bills.

Attackers were still trying to get into OpenCode's systems on October 18, Raad wrote on X: they had been "non stop trying to attack our systems for the past 48 hours," and "a side effect is everything is getting hardened."

from The Hacker News https://ift.tt/sZVCfT8
via IFTTT

AI News - Mid-October 2026

Brian and Brandon open mid-October’s AI news of the month by asking whether a yes-or-no answer engine like Jev could have saved the Commanders from a clock-management meltdown, and why a binary classifier is worth a reported $7.5 billion. A six-month check-in on their May AI draft leaves the scorecard roughly even, with Anthropic the clear winner over Google. Then come the financial cracks. CoreWeave’s borrowing costs have reportedly jumped from around 7% to about 15%, adding to Oracle’s contract pullback as yellow flags for the neocloud and data center layer. Meanwhile, Anthropic and OpenAI keep pulling in revenue even as enterprise CIOs struggle to find ROI. Brandon weighs Andrej Karpathy’s claim that only a few thousand people have seen what AI can really do against the labs’ opposite storytelling styles. The pair also question why Meta keeps promoting its frontier models when its Muse personal agent looks like the real monetization story. They close on whether software fundamentally changed in the last two weeks. Brandon argues AI has put professional-grade app building within reach of millions, pointing to his upcoming PodEditor app, but says finding demand and building a business are as hard as ever. They see Bending Spoons’ model of running acquired apps with AI and a skeleton crew as a possible playbook for established vendors.

SHOW: 1072

SHOW TRANSCRIPT: The Enterprise AI Show #1072 Transcript

SHOW VIDEO: https://youtu.be/Kp7AH_IdwIg

SHOW SPONSORS:

• NordLayer - Use ENTERPRISE10 for 10% off
• Palo Alto - Secure every identity with Idira by Palo Alto Networks 

FEEDBACK?

• Email: show @ the enterprise ai show dot com
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/t1YJsix
via IFTTT

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.

The disabled identities are listed below -

• ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae
• ConnectWise Cloud Management - 2399d300-6fca-4e6a-a686-399fefe75b83
• ConnectWise Cloud Management - MS Teams - 24205314-2b89-4e07-a2a4-579e898a5640
• ConnectWise Cloud Management - Exchange Online - b78f6a77-d4e5-46fb-87e5-d1648bd02519
• ConnectWise Cloud Management - MS Graph - 0de14c77-b9b0-4137-9360-34878a929827
• ConnectWise Cloud Management - Partner Center - 412dcf96-176d-4b3a-a1b0-4981ad66971e
• ConnectWise Cloud Management - SharePoint Online - b2b55f5b-7758-4719-8d8f-88ae172e6bdb

The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.

"Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant," it said.

"The affected shared Cloud Backup credentials are no longer valid. Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation."

ConnectWise also noted that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, it emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.

Out of an abundance of caution, the company said it has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.

Furthermore, the company revealed that it identified the issue on October 14, 2026, through its "advanced cybersecurity monitoring and diligence," prompting it to activate internal and external incident investigation and response actions.

"Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor," it said. "This finding does not establish the status of downstream customer environments, which, by design, we cannot directly observe."

At this stage, it's unclear if a product vulnerability contributed to the compromise of the application identities. The exact credential-exposure mechanism is the subject of an ongoing analysis, ConnectWise added.

The attack is particularly dangerous as it allows an attacker to abuse the application's credentials to access customers' Microsoft 365 environments without having to steal each customer's password individually. By using the stolen application credential to authenticate as that application, the attacker can request access tokens from Microsoft Entra ID based on the application's existing permissions.

Depending on the permissions assigned to the application, this could enable the attacker to potentially access other Microsoft services, including mailboxes, SharePoint documents, Teams messages, and directory information.

With ConnectWise's applications operating with extensive permissions to perform backups and management tasks, the theft of the credential allows the threat actor to authenticate as the application itself and expand their access by adding it to the Global Administrator role, adding client secrets to other trusted applications in the tenant, and creating new applications and granting them permissions.

By doing so, the client secrets offer a way to authenticate as that application and establish persistence, providing an alternative means to regain access to the compromised environment even if the original compromised credential is later revoked.

Second, Targeted Wave of Attempts Observed

"We last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day," Jon Semon, Principal Security Operations Analyst at Huntress, told The Hacker News.

"ConnectWise has said access to Cloud Backup is shut off, and if so, activity through that service should have stopped. However, if the threat actor was able to add credentials to applications in Microsoft tenants, those credentials would let them keep access and act as the application."

Huntress said it has not identified new malicious activity since October 15, but there is no evidence that the stoppage was the result of public disclosure.

"We have high confidence the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint, and we have confirmed abuse of the Teams app in one tenant," Semon said. "Those apps do not appear to have been disabled by ConnectWise, so additional activity could come from them, and we are actively investigating."

As of late Saturday, Huntress said it identified a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15. These efforts, which singled out a narrow scope of 16 tenants, were unsuccessful. The tenants are in the policy, national security, trade, and critical mineral sectors.

"For the new target set, the first sweep targeted Graph tokens from the SkyKick app and occurred on October 15 between 09:25:04 and 12:35:50 UTC," Huntress said. "The second sweep hit the same tenants on the same date, between 13:54:39 and 14:20:24 UTC. This sweep appeared to be manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs."

In all, the managed security service provider has identified almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity from the IP address in question, out of which 300 succeeded. Despite the successful sign-in, the absence of a service principal in some tenants is said to have prevented the threat actor from gaining access to those tenants.

Partners are advised to take the following actions -

• Review both their own Microsoft 365 tenant and each managed customer tenant, including environments with dormant SkyKick connections.
• Verify the status of the listed application connections and keep affected applications disabled until further notice.
• Review sign-ins across identities from October 13, 2026, through the current time, specifically for activity originating from the IP address "144.172.64[.]128."
• Preserve available sign-in and audit records before initiating containment steps.
• Review application and user authentication, application credentials and federation trusts, directory roles, owners, consent grants, and recent policy changes.
• Check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.
• Investigate any other identities changed or used during suspicious activity.

"Several Entra controls limit the damage if an application credential is stolen," Huntress said. "Application management policies can restrict or block client secrets on app registrations and cap credential lifetimes. Limiting who holds the Application Administrator and Cloud Application Administrator roles reduces who can add credentials to applications."

"Conditional Access for workload identities, which needs additional licensing, can restrict where an application is allowed to sign in from, and Microsoft Entra ID Protection can flag risky service principals. None of these replace reviewing credentials, but they make a planted secret harder to use or easier to spot."

from The Hacker News https://ift.tt/kSdiIRV
via IFTTT

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX.

The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of the package is 1.0.3.

"The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said. "Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process."

First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems. These packages were published across five npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4.

Of the eight identified packages, three were found to act as a loader for Overlord RAT, while three others ("cdn-img-fetch," "img-to-native," and "native-runner") worked together to download and run a Node.js stealer. A third infection pathway involved the use of a postinstall hook to execute JavaScript capable of contacting an external server and retrieving an unspecified next-stage binary.

Interestingly, the threat actor behind the campaign appears to be responding to public disclosures and npm removals by publishing replacements for "native-runner" and "img-to-native" within two days in the form of "runhelper" and "imgbundle." That same day, the first version of "imgdecode" was published. The timeline of events is as follows -

• September 26, 2026 - cdn-img-fetch, img-to-native, and native-runner 1.0.0 published
• September 28, 2026, at 4:06 p.m. UTC - npm removes native-runner and img-to-native
• September 30, 2026, at 3:29 a.m. UTC - imgbundle 1.0.0 published, replacing img-to-native
• September 30, 2026, at 3:37 a.m. UTC - runhelper 1.0.0 published, replacing native-runner
• September 30, 2026, at 4:13 p.m. UTC - runhelper unpublished
• September 30, 2026, at 10:32 p.m. UTC - imgdecode 1.0.0 published
• September 30, 2026, at 11:07 p.m. UTC - imgdecode 1.0.1 published
• October 1, 2026, at 5:48 p.m. UTC - imgdecode 1.0.2 published
• October 7, 2026, at 11:06 p.m. UTC - npm removes imgbundle
• October 8, 2026, at 1:03 p.m. UTC - npm removes cdn-img-fetch
• October 11, 2026, at 10:09 p.m. UTC - imgdecode 1.0.3 published

The Node.js stealer chain is notable for the fact that none of the packages featured an install hook. Instead, the malicious code runs when "native-runner" is loaded. The package lists "img-to-native" as its dependency, which, in turn, has "img-to-native" as a dependency.

The exact functionality of each of these packages is below -

• cdn-img-fetch downloads "banner.png" from a GitHub repository ("cavecrew/proj") and extracts an encrypted blob.
• img-to-native decrypts the blob using the key "malfexteam2027" and writes the contents to disk as a Go executable ("%APPDATA%\Microsoft\Windows\node_runtime_helper.exe").
• native-runner executes the Go executable, which then downloads the stealer binary ("setup.exe" aka movinlike) from "104.234.65[.]75:700."

"Runhelper," advertised as a helper utility for "launching native binaries from Node.js projects," functions similarly to "native-runner" in that it's designed to run malicious code. Its primary responsibility is to locate a JPG file ("cdn-img-fetch/.runtime/rt.jpg"), extract shellcode from it, copy it into executable memory, and run it using Koffi, a Foreign Function Interface (FFI) module for Node.js.

"Six hours after runhelper was unpublished, the operator published imgdecode with a compiled DLL to run the shellcode," SafeDep said. "From version 1.0.1, the DLL also downloads and decrypts the payload. Versions 1.0.1 and 1.0.2 still call require('imgbundle') before loading the DLL. Version 1.0.3 removes that dependency and needs no other MALFEX package."

Like in the case of "runhelper," version 1.0.0 of "imgdecode" waits for "imgbundle" to write a file at the location "cdn-img-fetch/.runtime/" and, once it becomes available, reads its contents into memory, and passes them to a native Node.js addon for decoding the data.

The addon is a 64-bit Microsoft Visual C++ (MSVC) DLL that first checks if it's running in a developer's terminal, and then proceeds to fetch a JPG file ("banner.jpg") from the same repository ("cavecrew/proj"), decrypt the embedded payload using the key "nif-runtime-2027," and ultimately inject the output into "dllhost.exe."

"After decryption, the DLL checks the first bytes of the plaintext," SafeDep explained. "If they match a JPEG or PNG signature, the DLL stops. Inference: the operator could turn the loader off by serving encrypted content that decrypts to an image. Serving an ordinary image would instead generally cause decryption to fail before this check."

Although the GitHub account "cavecrew" is no longer accessible, an Internet Archive screenshot of the image file dated October 6, 2026, shows that it's the same Go-based downloader used for retrieving the Node.js stealer and remote access tool ("movinlike") from "104.234.65[.]75:700."

The Node.js application includes a .env file containing a command-and-control (C2) address ("104.234.65[.]75:7007") and a MALFEX license key, indicating the use of a malware builder or licensing system to craft such payloads.

The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft).

It can also establish a WebSocket connection to the C2 server, allowing it to accept commands for shell execution, file transfer, process control, clipboard access, screenshots, and mouse and keyboard input. For persistence, it adds a Registry Run key and creates a scheduled task named "MicrosoftEdgeUpdateService."

Developers who have installed any of the aforementioned packages should treat their Windows systems as potentially compromised, isolate them, check for persistence entries, rotate credentials, and transfer funds to new wallets if they seed phrases were stored in them,

from The Hacker News https://ift.tt/x5k8tTd
via IFTTT

UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes.

The activity is being tracked by Cisco Talos under the moniker UAT-11985, describing it as likely fueled by artificial intelligence (AI)-assisted content generation so as to quickly craft bespoke lures aimed at different targets within the confines of a common social engineering framework. The campaign was first observed in mid-2026.

"The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis.

"Beyond traditional email phishing, the actor incorporated QR code phishing (quishing) techniques by modifying legitimate event posters with malicious QR codes, expanding the attack surface beyond email recipients to secondary victims who may encounter printed materials."

Central to the operation is the use of legitimate or plausible public event information in spear-phishing emails and embedding within them a URL that points to attacker-controlled infrastructure, while hovering over the hyperlink displays a legitimate-looking Google Forms URL.

These invitation emails feature nearly identical syntactic structures despite the breadth of geopolitical topics being discussed, indicating the content was mass-produced from a reusable prompt template rather than painstakingly crafted for each target.

Specifically, the emails follow a three-part structure -

• The opening section offers a "polished (but overly elaborate) description" of the geopolitical or policy context.
• The second section is tailored to the recipient and paints them in a flattering light in an attempt to trigger engagement.
• The third and final section provides details of event logistics, including the topic, date, venue, and registration instructions.

The threat actor has been found to impersonate legitimate Taiwan-based institutions like the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, fabricating the sender identities to make the messages appear more convincing.

"Taken together, the reuse of an almost-identical narrative structure, rhetorical style, personalized flattery, institutional impersonation, and deceptive registration mechanism strongly suggests a coordinated and carefully targeted spear-phishing campaign rather than three independent invitations," Talos said.

In a subset of cases, the phishing emails incorporate legitimate event posters scraped from legitimate websites, but with the QR codes modified to trick victims into scanning the malicious QR code to "register" for the event.

The phishing site imitates the look of a legitimate Google Form, but the primary goal of the site is to serve a pop-up that prompts the victim to sign-in with their Google account to complete the form. Doing so takes them to a bogus site featuring a spoofed Google login panel to capture their credentials and authentication challenges.

The pixel-perfect replica site is an adversary-in-the-middle (AitM) proxy that uses obfuscated JavaScript to gather and exfiltrate the entered information in real-time over a WebSocket connection, while simultaneously forwarding it to legitimate Google authentication servers.

Prior to establishing the WebSocket connection, the JavaScript payload collects device and browser information, including the locale, user agent, screen dimensions, and mobile-device status, which are then reported to the command-and-control (C2) server via a "google_login_start" request.

When the victim submits the password, the phishing page transmits the password, along with the account identifier and browser user-agent information, to the actor's HTTP C2 server through a "google_login_check" request. The threat actor's server, placed in an AitM position, then forwards the credentials to the actual Google authentication service.

"The spoofed Google login panels only support Simplified Chinese (zh-CN), Traditional Chinese (zh-TW), and English locales, with region detection based on the victim's browser 'navigator.languages,' strongly suggesting targeting of Chinese-speaking users," Chen explained.

"By deliberately splitting one-shot uploads with POST requests from low-latency state updates with WebSocket connection, the threat actor has engineered a seamless credential-harvesting relay. This allows the threat actor to mirror Google's dynamic authentication state in real time, ultimately achieving full account takeover without raising the victim's suspicion."

from The Hacker News https://ift.tt/ZnGyFai
via IFTTT