FlagThis — Daily Cybersecurity Intelligence Briefing

North Korean state-sponsored actors, associated with the PolinRider operation and Contagious Interview campaign, are executing a multi-vector supply chain offensive targeting the developer ecosystem. By compromising GitHub maintainer accounts and utilizing package impersonation, the actors injected malicious code into npm, Packagist, and Go ecosystems. The campaign specifically targets modern toolchains, including Claude Code and GitHub CLI, to deploy Windows Remote Access Trojans (RATs), Linux native C rootkits, and credential stealers aimed at SSH keys and developer tokens. With over 108 unique malicious packages and extensions identified, the operation seeks persistent high-level access to DevOps environments and AI-assisted coding workflows.

Attackers are leveraging Indirect Prompt Injection (IPI) to hijack AI agents from OpenAI, Anthropic, and Google by weaponizing the Retrieval-Augmented Generation (RAG) process. Through SEO poisoning, malicious sites are prioritized in agent grounding searches, delivering hidden payloads via CSS (display:none, opacity:0) and zero-width characters. These invisible instructions override system prompts to execute unauthorized tool-use functions, enabling cryptojacking via WebAssembly and the exfiltration of sensitive session data to attacker-controlled endpoints. This vulnerability shifts the primary attack vector from direct user input to external, untrusted data sources utilized for agentic autonomy.

APT28 has deployed "LameHug," a novel infostealer that integrates Large Language Models (LLMs) to generate malicious Windows commands dynamically. By shifting from hardcoded C2 scripts to AI-driven prompt sequences, LameHug adapts attack commands in real-time to the victim's environment, significantly bypassing signature-based EDR and antivirus detection. The malware utilizes dedicated exfiltration modules to steal credentials and sensitive data from NATO, EU, and US targets. This workflow represents a strategic pivot toward "AI-as-a-weapon," reducing the manual research time required for target-specific exploitation and increasing the scalability of state-sponsored espionage operations.

The Anubis Ransomware group is executing high-velocity exploitation of CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC/Gateway appliances, colloquially known as "Citrix Bleed 2." This vulnerability permits session token and memory disclosure, allowing attackers to bypass authentication and hijack active sessions. By targeting edge-facing infrastructure, Anubis circumvents traditional perimeter defenses to gain initial access, facilitating lateral movement and the subsequent deployment of ransomware payloads. This campaign marks a strategic shift toward leveraging N-day vulnerabilities in critical network appliances to conduct large-scale extortion and enterprise-wide encryption.

The convergence of the Vect Ransomware-as-a-Service (RaaS) operation and the TeamPCP threat actor marks a strategic shift toward a vertically integrated cybercrime model. Vect provides high-volume initial access and credential harvesting, while TeamPCP specializes in ransomware orchestration and the development of cloud-native worms. This alliance targets the software development lifecycle through industrialized supply chain compromises of CI/CD pipelines and developer tools. By leveraging stolen OAuth tokens and API keys, the actors facilitate lateral movement across AWS, Azure, and GCP environments. The campaign focuses on cloud-native extortion, utilizing exfiltration of S3 buckets and database snapshots to maximize leverage against enterprise targets.

Russian state-sponsored actors Turla and Gamaredon are deploying AI-augmented malware and custom toolsets to target critical infrastructure and diplomatic entities in Ukraine, Italy, Taiwan, and Indonesia. The campaign utilizes SharkLoader to deliver Cobalt Strike Beacons and a .NET-based backdoor, StockStay, which employs secure WebSocket connections for C2 and the Windows Forms framework for persistence. Initial access is frequently achieved via WinRAR vulnerabilities. Notably, the integration of AI-driven "dynamic payload adaptation" enables real-time modification of malware signatures to bypass traditional EDR and AV detections, shifting the defensive requirement from static IOC blocking to anomaly-based behavioral detection.

Researchers at Cato Networks have identified "DuneSlide," a pair of critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI IDE. These flaws enable prompt-injection-driven sandbox escapes, escalating from LLM interactions to full operating system-level Remote Code Execution (RCE). Attackers can leverage malicious Model Context Protocol (MCP) servers or poisoned web search results to manipulate the run_terminal_cmd tool and bypass path canonicalization logic via symbolic links. Successful exploitation allows unauthorized file writes outside the project root, enabling attackers to overwrite the cursorsandbox executable, modify shell configurations, or establish persistence via macOS LaunchAgents, resulting in total system compromise.

Threat actors are deploying the AMOS Stealer on macOS by adapting the "ClickFix" social engineering technique. The attack leverages browser-based lures masquerading as AI tool errors (e.g., ChatGPT, Grok), prompting users to manually copy and execute a malicious command in the macOS Terminal. This sequence bypasses browser security and Gatekeeper by utilizing curl or wget to download a DMG file, which is then silently mounted via hdiutil. The primary objective is the exfiltration of browser passwords, session cookies, and cryptocurrency wallets.

Forensic analysis by Citizen Lab confirmed that Stelios Kouloglou, a member of the EU's PEGA Committee, was twice infected with NSO Group's Pegasus spyware. The campaign utilized advanced mobile exploitation to compromise a device specifically tasked with investigating commercial surveillance abuses. This breach resulted in the potential exfiltration of sensitive European Parliament communications and internal PEGA Committee investigative strategies. The attack demonstrates a targeted retaliatory pattern where commercial spyware is deployed by government customers to monitor and intimidate democratic oversight bodies, compromising the integrity of legislative deliberations and diplomatic security.

The FBI and Google Threat Analysis Group (TAG) have dismantled the NetNut residential proxy platform and the associated Popa botnet, which compromised approximately two million home IoT devices, including Smart TVs. The operation leveraged malicious SDKs embedded in legitimate software to transform residential hardware into a for-hire relay network, masking malicious traffic and supporting broader cyber operations. This disruption involved the seizure of hundreds of command-and-control (C2) and proxy domains. The infrastructure was managed by Alarum Technologies, a publicly traded company, highlighting a sophisticated abuse of the residential proxy business model to facilitate botnet-scale traffic obfuscation.

Security researcher Armadin has identified a multi-step attack chain capable of executing a sandbox escape within Anthropic's Claude Cowork for Windows. The vulnerability exploits two distinct weaknesses to bypass the application's Windows-specific isolation layer, enabling an AI agent or malicious input to interact directly with the host operating system. This exploit includes a network sandbox bypass, facilitating unauthorized external communication and the silent exfiltration of sensitive host data, including API keys and filesystem contents. While Anthropic disputes the practical risk and severity, the findings highlight critical boundary failures in AI agent architectures, where functional deployment speed may compromise essential host-level security controls.

The Payouts Kings ransomware group has deployed "Edgecution," a malicious Microsoft Edge extension that leverages AI-synthesized attack blueprints from DeepSeek to achieve host-level compromise. The attack vector utilizes social engineering via Microsoft Teams to trick users into installing the extension. By abusing the Native Messaging API, the malware executes a browser sandbox escape, enabling the installation of persistent backdoors and ransomware overlays on Windows and Android platforms. Payloads include keyloggers, credential stealers, and webcam capture tools, marking a critical shift from theoretical AI-generated concepts to operational, cross-platform exploitation.

The U.S. Department of State has announced a $10 million reward for actionable intelligence identifying Russian-linked threat actors UNC5792 and UNC4221. These actors focus on bypassing end-to-end encryption (E2EE) on Signal and WhatsApp through sophisticated account takeover (ATO) workflows. By utilizing advanced social engineering, credential harvesting, and session hijacking, the groups compromise mobile identities of high-value targets, including military and diplomatic personnel. The campaign targets the application layer to circumvent cryptographic protections, facilitating large-scale intelligence exfiltration from mobile endpoints. This shift toward identity-centric exploitation bypasses traditional network perimeter defenses, necessitating enhanced hardware-backed authentication and mobile-specific threat intelligence.

Modern phishing campaigns are deploying adaptive kits that utilize client-side JavaScript fingerprinting (User-Agent, OS, screen resolution) to serve device-specific HTML/CSS templates, increasing social engineering success rates. These kits employ Browser-in-the-Middle (BitM) frameworks, such as BlueKit, and OAuth/OIDC Device Code phishing to intercept real-time session cookies and MFA tokens, effectively bypassing traditional multi-factor authentication. Attackers utilize DNS query manipulation and environment-aware checks to evade automated sandboxes and security crawlers. The impact is a significant reduction in MFA efficacy and increased detection difficulty for legacy indicator-based security tools.

Armored Likho (also provisionally identified as Eagle Werewolf) is conducting a sophisticated dual-purpose campaign combining cyber espionage with financially motivated theft. The actor targets government agencies and the electric power sector, alongside private individuals, primarily in Russia, Brazil, and Kazakhstan. The technical execution involves spear-phishing and the use of AI-generated loaders to deploy BusySnake Stealer, a novel Python-based malware. By integrating the PolitePaul service into its delivery chain, the group demonstrates an ability to blend high-stakes APT tactics with commodity-style credential theft to maximize impact across both strategic and financial domains.

GuardFall is a systemic architectural flaw affecting 91% of tested open-source AI coding agents, including Aider, Open Interpreter, and OpenHands. The vulnerability arises from the agents' reliance on superficial safety filters to block "dangerous" shell commands. Attackers can bypass these filters using classical shell injection metacharacters via prompt injection, leading to arbitrary command execution. Because these agents typically operate with the full privileges of the host user, exploitation enables the theft of environment secrets, API keys, and the full compromise of CI/CD pipelines and host systems.

The People's Republic of China (PRC) is systematically exploiting the UK's open academic environment via Military-Civil Fusion (MCF) strategies, utilizing BUPT and Beihang University as primary conduits for intellectual property acquisition. These institutions leverage joint research laboratories and PhD placement programs to illicitly transfer dual-use technologies in AI, 5G/6G telecommunications, and aerospace propulsion to the People's Liberation Army (PLA). This activity frequently bypasses export controls through "deemed exports," posing a critical risk to the UK's National Security Strategy. MI5 and the NCSC have issued briefings to over 70 universities to mitigate these foreign interference vectors and the systemic risk created by institutional financial dependence on Chinese funding.

Phantom squatting is a novel attack vector that exploits the deterministic nature of Large Language Model (LLM) hallucinations. Unlike traditional typosquatting, attackers identify non-existent but plausible domains and package names generated by LLMs and pre-register them. This enables two primary exploitation paths: directing users to malicious phishing landing pages via hallucinated URLs and compromising developer environments through the installation of rogue software packages on repositories like npm and PyPI. Because these domains lack a legitimate predecessor, they effectively evade conventional brand-protection and lookalike-domain monitoring tools, leveraging the inherent authority bias users place in AI-generated technical guidance.

Current Large Language Model (LLM) safety paradigms utilize reactive, single-turn message filtering, leaving them vulnerable to "salami-slicing" attacks. These attacks decompose malicious intent across multiple dialogue turns to evade detection. The Cognitive Firewall framework addresses this through a proactive, stateful, multi-gate Zero-Trust architecture. By employing independent oversight agents—specifically Intent, Zero-Trust Context, Consistency, and Output Risk gates—the framework monitors the evolution of user objectives and treats all asserted roles as unverified evidence. This approach shifts defense from isolated scoring to escalation-based blocking, successfully reducing attack success rates (ASR) to <2% on standard benchmarks and 14% against complex, human-authored adversarial prompts.

The report identifies "AI-Driven Vulnerability Inflation," a phenomenon where AI-augmented threat actors and automated discovery tools have doubled the volume of critical CVE discoveries. This surge has significantly degraded the signal-to-noise ratio within Security Operations Centers (SOCs), as fewer than 8.3% (1 in 12) of reported critical vulnerabilities require immediate remediation. The disconnect between high-level AI security governance and actual technical enforcement capabilities is widening a critical "exposure gap," overwhelming frontline defenders with low-priority alerts and high-velocity exploit payloads generated via Large Language Models (LLMs).

The Australian Security Intelligence Organisation (ASIO) has identified a strategic pivot in nation-state cyber operations from traditional espionage to "preparation for sabotage" within Australia's critical infrastructure. Intelligence indicates that state-sponsored actors have successfully compromised critical infrastructure networks by harvesting credentials from high-privilege IT professionals. Rather than immediate data exfiltration, these actors are employing persistence-based TTPs to pre-position for future kinetic or disruptive actions. This activity is part of a widespread regional campaign across the Asia-Pacific, posing significant risks to national security, strategic AUKUS interests, and public safety through potential cascading service failures.