Open Cyber Threat Intelligence

Google removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after Pillar Security demonstrated a supply chain attack vector. A malicious GitHub issue could trigger a prompt injection in a triage agent, leading to execution of a privileged code-fixing agent via a trusted bot account. This allowed arbitrary code execution on the CI runner and exfiltration of sensitive credentials, including a bot personal access token (PAT), a Google API key, and a Google Cloud service-account credential. Although no in-the-wild exploitation was observed, the attack chain exploited overly broad permissions and insufficient isolation between automation components.

Manifold Security discovered a campaign involving 77 malicious extensions on the Open VSX marketplace that impersonated legitimate developer tools to harvest system and development environment metadata. These 'evil twin' extensions exfiltrated information such as hostnames, workspace paths, Git metadata, CI/CD environment details, and developer identifiers to a common infrastructure at mangorbit[.]com. While source code and credentials were not accessed, the collected data could be used to profile organizations and private repositories. The extensions used tracking identifiers, supported fallback communication via DNS TXT records, and were removed from Open VSX by August 3, 2026, though manual removal from developer systems is required.

A new variant of the XCSSET malware, version 40, is targeting macOS developers by compromising Xcode projects and GitHub repositories. The malware spreads when developers build infected projects, enabling it to propagate across systems and deploy 17 modules for credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. This variant includes new capabilities such as a Chrome hijacker that enables real-time web traffic interception and a Telegram trojanizer that replaces the legitimate Telegram Desktop app with a malicious version. The malware employs advanced evasion techniques, disables macOS security features, and uses encrypted, build-unique ciphers to avoid detection.

Threat actors are leveraging legitimate cloud platforms such as Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to host phishing infrastructure and bypass multi-factor authentication (MFA). The attack uses a multi-stage adversary-in-the-middle (AitM) technique involving contact harvesting, transparent proxy initialization via service workers, and browser-in-the-browser (BitB) spoofing to intercept credentials and session tokens. Phishing pages are hosted on trusted domains with good reputations, making detection difficult and enabling large-scale, low-cost deployment of malicious sites.

The Greatness PhaaS (Phishing-as-a-Service) platform has added device code phishing capabilities to bypass Multi-Factor Authentication (MFA) by abusing the OAuth 2.0 Device Authorization Grant. This enables attackers to steal authentication tokens without presenting fake login pages, making detection more difficult. The service supports multiple phishing methods including adversary-in-the-middle (AiTM) attacks, OAuth consent abuse, and phishing for iCloud, Yahoo, and Google Workspace. Post-compromise, attackers use stolen tokens to access Microsoft 365 resources via Microsoft Graph API and establish persistence by registering new devices to obtain Primary Refresh Tokens (PRTs).

A massive supply-chain attack dubbed ChainDrop has compromised over 1,300 npm packages with a combined 2 billion monthly downloads. The attack began with the compromise of the Keyv maintainer's GitHub account, allowing the threat actor to push malicious code directly to main branches and publish poisoned versions through legitimate CI/CD workflows. The malware, named ChainDrop and based on the Shai-Hulud worm, includes a dropper (setup.mjs) and an obfuscated infostealer (Math_Symbol.js) that collects developer and cloud credentials, encrypts them, and exfiltrates them to a public GitHub repository. The attack spreads laterally by self-propagating to other packages maintained by developers whose environments were infected.

On August 4, 2026, a worm compromised several high-profile npm packages, including keyv, file-entry-cache, and flat-cache, each with around 150 million monthly downloads. The malicious commit (174f6a5) in the keyv package introduced a backdoor designed to propagate to adjacent npm packages, indicating a supply chain attack aimed at widespread distribution. The campaign represents a significant open-source software supply chain compromise with potential for broad impact due to the popularity of the affected packages.

A self-propagating worm dubbed ChainDrop is actively compromising npm packages by publishing malicious versions using stolen maintainer credentials. The malicious packages include heavily obfuscated files such as setup.mjs and math_init.js, which execute during installation via preinstall scripts, enabling credential harvesting in CI/CD environments. The worm uses Ethereum-based dead-drop command-and-control infrastructure, and over 435 packages with more than 1,550 compromised versions have been identified since August 4, 2026. Organizations using affected packages should assume compromise and rotate all associated credentials and secrets.

A significant portion of malware samples bypass DNS by communicating directly to IP addresses, evading DNS-based security controls. Analysis of 4 million dynamic reports shows 45.32% of malware with command-and-control (C2) activity used direct-to-IP (D2IP) connections, accounting for 23.17% of all C2 attempts. Threats identified include Phorpiex ransomware droppers, a data exfiltration campaign using obfuscated \GET requests, SectopRAT deployments targeting educational institutions, and IoT botnets like Mozi and a new Mirai variant named Boatnet. These threats leverage hard-coded IP addresses and custom HTTP methods to avoid detection and maintain persistence.

cPanel has patched a critical vulnerability, CVE-2026-58048 (CVSS 4.0: 9.4), that allows an authenticated hosting customer to execute SQL commands with full administrative database privileges, effectively crossing the privilege boundary into the server's root database context. The flaw resides in the database-renaming process, where SQL mode is not preserved, leading to execution in root context. This could lead to full operating system compromise depending on configuration. Two additional vulnerabilities were patched in the same release: CVE-2026-58047, an HTTP request-smuggling issue in cpsrvd, and a local privilege escalation in Exim via unsafe string expansion in .forward files.