ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

Support uploads face cutoff

GitHub has announced an upcoming security change that may affect GitHub Enterprise Server (GHES) support bundle uploads. “Beginning August 18, 2026, GitHub will start rejecting command-line support bundle uploads from older GHES appliances that have not been updated with the required security patches,” GitHub said. “To avoid any disruption when submitting support bundles with ghe-support-bundle, ghe-cluster-support-bundle, or ghe-support-upload commands, please update your GHES instance to the latest patch release available for your current version line.” At minimum, the required patch versions are: 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18.

Npm install triggers stealer

An npm package named @copilot-mcp/apex has been found to act as a postinstall dropper that installs a macOS infostealer on any machine that runs npm install or npx @copilot-mcp/apex. The same payload is said to have been distributed via another dropper named @apexfdn/apex. “On macOS, the dropper’s second stage decrypts and runs an AppleScript payload through osascript,” SefeDep said. “The decrypted payload is a 707-line AMOS-family stealer: it phishes the login password through a fake system prompt, then harvests browser credentials, 20+ crypto wallets, SSH keys, AWS and Kubernetes credentials, the login Keychain, Telegram, and shell history into /tmp/osalogging.zip and uploads it over chunked HTTPS PUT to attacker infrastructure.” The malware also sets up a LaunchAgent that polls the attacker’s command-and-control server every 60 seconds to ensure that the infection outlives the initial exfiltration.

Fake extension opens backdoor

A Microsoft Visual Studio Code (VS Code) marketplace extension called “Markdown All Pro” (“markdown.markdown-all-pro”) has been found to impersonate the legitimate “Markdown All in One” extension with over 14 million downloads. Installing the rogue extension allows the machine’s details to be shipped to the attacker and opens a channel through which the operator can send any additional commands without having to touch the extension again. “On install, these beacon the machine’s username and hostname to a hardcoded IP over cleartext HTTP and fetch a remote file to disk, with no user interaction required,” Manifold Security said. “This one is small, but it deliberately misrepresents itself as a trusted tool, and the remote fetch it performs is a live delivery channel whose payload the operator can change at any time.” After the extension was removed by Microsoft, it reappeared under an identical name (“MarkdownLinks.markdown-links-pro”). The second extension has since been taken down as well.

Old releases locked down

The Python Package Index (PyPI) has made a new security change that rejects new files being uploaded to releases that are older than 14 days. “This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised,” PyPI said. “As far as we are aware, this has not yet been abused, but there is no technical reason beyond that attackers weren’t aware it was possible.”

Phishing delivers banking malware

A new malware campaign is targeting Portuguese users through phishing emails impersonating financial and administrative communications to deliver the Lampion banking malware. First publicly documented in December 2019, the Brazilian banking malware family is derived from the ChePro lineage, and has consistently targeted Portugal and other Portuguese-speaking users. “Initial payloads are delivered through ZIP archives containing heavily obfuscated HTML files designed to evade static detection and analysis,” Acronis said. “The HTML stage retrieves and executes additional scripts from attacker-controlled infrastructure, leading to the deployment of a multistage VBS infection chain. Each stage employs extensive obfuscation techniques, including junk code, encrypted strings and dynamically generated scripts, significantly inflating file sizes while concealing core functionality. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis and reducing the visibility of malicious activity.”

Call endings trigger ads

DoubleVerify has uncovered a growing wave of “AfterCall” apps that trick users into granting special permissions, which then display intrusive ads immediately after Android users end a phone call. The ad fraud scheme is assessed to be responsible for hundreds of millions of ad impressions. “The fraud works by tricking users into granting overlay permissions, allowing malicious apps to display ads outside their normal context,” DoubleVerify said. “The apps also use evasion techniques that make them difficult for users to identify and uninstall.”

Fake Claude app drops RAT

Huntress disclosed that between July 21 and July 22, 2026, at least 29 organizations fell victim to a malvertising campaign that redirected them to a malicious Claude Artifact publicly hosted on the legitimate Claude.ai domain. “The malicious Claude Artifact redirected users to an attacker-controlled domain, where they downloaded what looks like a legitimate Claude desktop app (ClaudeDesktop.exe),” Huntress said. “In reality, the executable led to the download of SectopRAT. The attackers used an array of anti-analysis techniques, including packaging the malware with VMProtect to make it difficult to reverse engineer and checking the graphics hardware on systems before deciding whether to actually execute the malicious payload as a way to suss out VMs.” The public Claude Artifact has been removed as of July 22, 2026. The campaign has been codenamed FakeAgent.

Image hides agent instructions

A new attack technique called GhostCommit employs a pull request that can steal a repository’s secrets by hiding the malicious instruction inside a PNG image that’s processed by an LLM reviewer. “The text rendered in that image names .env, tells the agent to read it byte-by-byte, to encode each byte as its ASCII codepoint, and ends with a self-check that must pass before commit: the decoded numbers have to equal the real .env,” the University of Missouri-Kansas City’s ASSET Research Group said. “The image is the only place in the entire pull request where any of this appears. Unfortunately, for a text-based reviewer, an image is a binary blob, so there is nothing to read.” Once the change is committed and merged, the payload just sits in the repository, dormant, until the trap springs itself when a victim prompts the coding agent in an unrelated session. “The developer asks the coding agent for something ordinary, say a token-tracking module,” the researchers said. “The agent reads the merged AGENTS.md at startup, follows the pointer to build-spec.png, reads the procedure rendered inside, opens .env, and writes the requested module with a provenance constant near the top.”

Iran-linked actors target PLCs

The U.S. government has issued an update to an advisory published in April 2026 to warn organizations of ongoing Iranian-affiliated cyber activity targeting internet-connected operational technology (OT) devices. “The update provides new guidance to detect malicious changes in reusable code modules used within Rockwell Automation PLC programs and adds more recommended mitigations,” the Cybersecurity and Infrastructure Security Agency (CISA) said. “It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and possible other PLC manufacturers. The additional manufacturers being targeted emphasize the importance for OT owners and operators to restrict direct internet access and ensure secure PLC deployment.” The authoring agencies said the Iranian-affiliated activity has disrupted PLCs across several U.S. critical infrastructure sectors by attempting to download malicious project files and manipulate data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. Targets include Water and Wastewater Systems, Energy, and Government Services and Facilities. The federal advisory does not mention any specific hacking groups.

Fake alert app enables surveillance

Dream has disclosed details of an Android app that masquerades as a Bahraini Civil Defense “BH Alert” siren app but embeds a malware called OctagonPanel to hoover sensitive data from a compromised device. “It is distributed through a network of look-alike domains that clone the Google Play Store and official Bahraini government sites, complete with fake install animations and ad-tracking pixels, and it deploys a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots, running banking-app overlays, and taking full remote control of the device,” Dream said. “It relies on social engineering and the abuse of legitimate Android permissions, delivered under a public-safety brand at a moment when users are primed to install it.” Earlier this March, the cybersecurity vendor highlighted another phishing campaign that distributed a trojanized version of the Israeli “Red Alert” app to silently collect valuable data.

Fake apps deliver surveillance RAT

An Iran-nexus threat actor tracked as TAG-182 has been observed disseminating MarkiRAT malware in support of Iranian government surveillance operations. “It is highly likely that TAG-182 is targeting Iranians living inside and outside the country using different lures, including free download tools and fake VPN applications,” Recorded Future said. “The group’s operations are highly likely active across social media platforms like Instagram.” The malware is distributed through fake Android applications masquerading as legitimate services such as VPNs and media tools to collect intelligence from Iranian targets. “The MarkiRAT sample identified during this research shares notable tradecraft overlaps with historical variants, including the use of the Background Intelligent Transfer Service (BITS), suggesting a credible relationship between TAG-182 and activity previously attributed to Ferocious Kitten,” the cybersecurity company added.

AI-built apps expose critical flaws

An analysis of 28 vibe-coded apps has uncovered 434 unique and validated vulnerabilities. “The most common bug in AI-generated code overall is missing rate-limiting and DoS controls (such as unbounded pagination, no rate limits, or synchronous blocking work),” Xint said. “When we narrow our focus to the most critical bugs, a different picture emerges. Secret exposures made up the largest share of the most critical bugs in AI-generated code. These are hard-coded or default secrets that allow an attacker to forge sessions or tokens. Authorization and IDOR bugs – a type of flaw where a user gets access to data beyond their permissions – were more common in larger apps.”

AI guardrails become attack tools

An enterprising Russian-speaking threat actor known as Trim has “spent the better part of 2026 systematically dismantling the guardrails on publicly available frontier AI models and rebuilding them as offensive tools,” Cato Networks said. “What started in March as a knowledge-sharing post on a Russian cybercrime forum detailing how to break Claude Opus into writing malware, had evolved by June into a fully productized, commercially marketed AI-powered penetration testing platform.” Trim has also outlined six techniques for jailbreaking Claude Opus: Context Warming, which involves opening with innocent professional queries before slipping in a malicious request; Black Box Principle, which strips the model of the ability to reason by instructing it via system prompt to analyze only code structure; Ghost Reset, which involves gaslighting the model mid-session by deleting an ongoing chat, reopening it, telling Claude that the internet dropped, and feeding it a softened version of the refused request; Model Cascading, which falls back to alternative AI models if one refuses to comply; Local Uncensored Models, which uses self-hosted or locally run AI models with few or no safety guardrails when commercial models block requests; and Gray-Market API Access, which obtains low-cost API keys from underground resellers to access commercial AI models. The findings once again demonstrate that frontier AI safety controls can be bypassed by a determined and technically literate adversary, and how quickly threat actors can capitalize on generative AI.

DNS traffic conceals TrickBot C2

A new version of the TrickBot malware has been observed using DNS tunneling to communicate with its command-and-control (C2) servers. “To protect itself from static analysis, TrickBot employs several obfuscation techniques,” Fortinet said. “This TrickBot maintains persistence on the victim’s computer by leveraging the Windows Task Scheduler. TrickBot wraps its command-and-control request packets in encrypted DNS query packets.” While normal DNS response packets typically contain the IP addresses associated with the queried domain, TrickBot uses it to hide the malicious data within the IP addresses of these responses. This, in turn, allows the malware to fetch commands to be executed on the machine or download and run additional modules.

AI models pinpoint vulnerable code

Cisco has unveiled Antares, which it frames as a “family of security small language models (SLMs) purpose-built for one of the hardest, most time-consuming and expensive problems in security: pinpointing where known vulnerabilities exist within a codebase.” The network equipment company further noted that “Antares follows an iterative search pattern that resembles how a human investigator works through a repository. Each model starts from a vulnerability description, searches for relevant code patterns, reads candidate files, incorporates new evidence, changes direction when a path is unhelpful, and narrows toward the files most likely to matter. The goal is not to replace expert judgment, but rather to help make the first stages of source-code vulnerability triage faster, more repeatable, and easier to review.”