CyberSecurity news
FlagThis
@gbhackers.com
//
The rise of AI-assisted coding is introducing new security challenges, according to recent reports. Researchers are warning that the speed at which AI pulls in dependencies can lead to developers using software stacks they don't fully understand, thus expanding the cyber attack surface. John Morello, CTO at Minimus, notes that while AI isn't inherently good or bad, it magnifies both positive and negative behaviors, making it crucial for developers to maintain oversight and ensure the security of AI-generated code. This includes addressing vulnerabilities and prioritizing security in open source projects.
Kernel-level attacks on Windows systems are escalating through the exploitation of signed drivers. Cybercriminals are increasingly using code-signing certificates, often fraudulently obtained, to masquerade malicious drivers as legitimate software. Group-IB research reveals that over 620 malicious kernel-mode drivers and 80-plus code-signing certificates have been implicated in campaigns since 2020. A particularly concerning trend is the use of kernel loaders, which are designed to load second-stage components, giving attackers the ability to update their toolsets without detection.
A new supply-chain attack, dubbed "slopsquatting," is exploiting coding agent workflows to deliver malware. Unlike typosquatting, slopsquatting targets AI-powered coding assistants like Claude Code CLI and OpenAI Codex CLI. These agents can inadvertently suggest non-existent package names, which malicious actors then pre-register on public registries like PyPI. When developers use the AI-suggested installation commands, they unknowingly install malware, highlighting the need for multi-layered security approaches to mitigate this emerging threat.
ImgSrc: blogger.googleu
References :
Kernel-level attacks on Windows systems are escalating through the exploitation of signed drivers. Cybercriminals are increasingly using code-signing certificates, often fraudulently obtained, to masquerade malicious drivers as legitimate software. Group-IB research reveals that over 620 malicious kernel-mode drivers and 80-plus code-signing certificates have been implicated in campaigns since 2020. A particularly concerning trend is the use of kernel loaders, which are designed to load second-stage components, giving attackers the ability to update their toolsets without detection.
A new supply-chain attack, dubbed "slopsquatting," is exploiting coding agent workflows to deliver malware. Unlike typosquatting, slopsquatting targets AI-powered coding assistants like Claude Code CLI and OpenAI Codex CLI. These agents can inadvertently suggest non-existent package names, which malicious actors then pre-register on public registries like PyPI. When developers use the AI-suggested installation commands, they unknowingly install malware, highlighting the need for multi-layered security approaches to mitigate this emerging threat.
ImgSrc: blogger.googleu
Share:
References :
- Cyber Security News: Signed Drivers, Silent Threats: Kernel-Level Attacks on Windows Escalate via Trusted Tools
- gbhackers.com: New Slopsquatting Attack Exploits Coding Agent Workflows to Deliver Malware
Classification:
- HashTags: #AISecurity #SignedDrivers #CodeSecurity
- Target: Developers
- Feature: AI and Signed Drivers
- Type: AI
- Severity: Medium