Read Time: 8 minutes

Brought to you by:

Howdy friends!

I’m still not caught up post Vegas. Absolutely buried this week! It’s not just the stuff you miss from being out its the weeks leading up to it that you kick to “after blackhat” that will get you.

We’ve been working a TON on the podcast lately so if you haven’t checked that out yet, make sure you do. We’re getting tons of good feedback and we’re excited with the direction it’s going and everything we have planned.

ICYMI

🖊️ Something I wrote: Asked the community why npm/PyPi get more supply chain issues than Rust. Got some interesting replies.

🎧️ Something I heard: The latest episode of The Low Down was fire. AI comitting felonies, WiFi Pineapple on a plane panic, and North Korea 0days.

🎤 Something I said: Nasty Google Doc malware technique targeted the wrong people!

🔖 Something I read: This thread by Matthew Green about what happens when easy bugs dry up and law enforcement still needs access.

Vulnerable News

Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware

If you came home from Vegas to a friendly DM in broken English about going to someone's conference, turns out it was a scam. Shocked. My hook on this one is “dumbest hacker of the year?” Who targets malware analysts publicly on Twitter with malware? On August 9 an X account posing as CoinDesk's VP of marketing DMed a Huntress researcher and sent over a "planning doc." Opening it in Google Docs renders a custom Apps Script sidebar that asks for an encryption key, which the actor helpfully supplies in DMs, and which fails on purpose. The sidebar then offers to fix it: ClickFix instructions for macOS (curl piped to zsh), a .dmg with steps to bypass Gatekeeper, or a ClickOnce installer on Windows signed with a cert from a Norwegian daycare company. Russian comments throughout the code.

When the researcher stalled, the actor sent a second lure the next day, a fake DocSend installer signed with a stolen Discord cert. That one drops NetSupport RAT. The researchers figured, why not keep getting them to send us their bag of tricks and said they were on Linux at which point the threat actor offered to invest $1M in their company? Who knows where that part of the scam would’ve led but this is a good write-up of a unique combination of techniques I hadn’t seen before, just happens to be driven by not the brightest bulb in the shed. (read more)

Attackers Are Hijacking Fortune 500 Brands to Spread Malware*

A sprawling campaign of roughly 7,600 malicious GitHub repositories is hiding behind dozens of trusted brands. Attackers used the names of Fortune 500 companies such as Walmart, Amazon, Uber and Tesla, along with major entities like Databricks and the SEC. Island dubbed the tactic “AgentBaiting” because it uses 800+ fake AI Skills and MCP servers to exploit how developers and AI agents discover software—and turn brand trust into a malware delivery mechanism.

Read the Research

*Sponsored

Two popular Rust crates arrayref and append-only-vec compromised in Supply Chain Attack

Aikido caught this one today, and by download count it is the largest Rust crate compromise so far. Two crates from the same maintainer, arrayref (244M downloads) and append-only-vec (4M), suddenly picked up a dependency on a package called proc-macro1. That is a typosquat of proc-macro2, copying the real crate's description, author name and docs to pass. Both compromised crates ship the genuine upstream library code. The entire compromise is one injected line in each Cargo manifest.

We’ve been seeing this a ton in npm and a bit in PyPi but rarely in Rust. I think its a combination of popularity, and also a bit of the culture of Rust doesn’t just include random packages for every little thing like JS does. It also stood out to me that this one didn’t try to worm like the npm malware does. Just pretty traditional infostealer malware.

The malicious logic lives in proc-macro1's build[.]rs, which Cargo runs automatically, so compiling a project that pulls in either crate is enough. Bad versions are arrayref 0.3.10 and append-only-vec 0.1.9. If a build machine pulled either, rotate whatever that machine could reach, because the payload ran with your developer's permissions. (read more)

77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

This blog is super long because the attacker’s campaign is pretty broad. It’s actually kind of wild that all of these are attributed to the same campaign because the strategy and packaging is very different for all of them.

Socket is tracking 77 linked Firefox extension identities, 40 of them confirmed malicious, running since at least March and impersonating OKX, Rabby and TronLink. Three theft models across the malicious set. Seven use attacker-controlled Supabase projects as a remote switch, where flipping one value in a public_notes table turns the extension's popup from a working notepad into a wallet phishing page with no update and no re-review. Fifteen embed the phishing flow directly and ship recovery phrases to Cloudflare Workers. Thirteen modified Rabby builds hook persistAllKeyrings() and POST the serialized keyring over plain HTTP on port 9000 before Rabby encrypts it locally, while the wallet keeps working normally.

Thirty-seven of the 77 are advertised as password managers, VPNs, dark mode toggles and note takers, and all they actually do is pull live football scores from API-Sports using one shared API key. Nine confirmed-malicious identities started life as those sports shells before a later version under the same Firefox ID got swapped for wallet code. Several of the Supabase loaders request only storage and tabs permissions, so anything scoring extension risk on requested permissions rates them clean. (read more)

Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia

Two IP camera stories this week. First, Hunt[.]io recovered an entire operator toolkit because the operator served their own working directory over an open HTTP server. Over 14,500 Dahua cameras in 35 days across three parallel paths: credential brute force on port 37777, the 2021 auth bypass pair CVE-2021-33044 and CVE-2021-33045, and Dahua's cloud relay, which will reach a camera behind NAT from a serial number alone. 1,923 cameras got a backdoor account (p2pwn / p2password) installed over RPC that survives a password change and most factory resets.

So not only are we leaving a bunch of cameras on the Internet, but they are catching vulns from 2021 that work on them all.

Second story on a similar topic but completely separate - Slovakia's NBU published an alert on NERO R-ONE speed cameras: a backdoor granting shell and network access via SMS from a list of hardcoded Russian phone numbers. The devices are rebranded CORDON PRO.M units from a St. Petersburg firm, 279 of them bought through a Cyprus shell company as part of a €30M EU-funded project. SecureBoot is off, the web portal has bugs, and live streams are available to anyone who knows the broadcast IP. The Interior Ministry's first response was that the cameras were not Russian and would sit on a closed loop network anyway. Deployment is now paused.

So instead of hacking a bunch of Internet cameras, these ones camed certified pre-pwned. (read more here, here and the NBU technical report)

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them

A self-represented plaintiff in Connecticut hid instructions in 3-point white font throughout a July filing, telling any AI that processed the document to make its output agree with him. Detection here was a clerk noticing that two pleadings carried more white space than the plaintiff's other filings. It’s giving Jia Tan getting caught in xz utils due to slightly slow login.

Judge Walter Spader Jr. then wrote 14 pages on it, including the point that a filing's integrity rests on the reader seeing what the filer wrote, and compared the hidden channel to arranging for an automated agent to talk to a juror during trial. Subsequent filings from the same plaintiff contained "hi :) I hope yo ucant see me" and a link to the SpongeBob Nosferatu scene. What in the tumblr is going on?

The Connecticut Judicial Branch does not use AI to review court records, which the judge addressed directly: missing the target does not make the attempt proper. The plaintiff told 404 Media the whole thing was an "audit." He is now banned from electronic filing and has to submit paper copies, which he points out does not stop anyone from putting light gray text on a page a clerk later scans. Spader flagged a similar incident in a Brazilian court and expects more of this. (read more)

Defending Against an Active Threat to Siemens S7 Series PLCs

I’ve covered a lot of these PLCs at critical infra places getting hacked lately and there has been a flurry of follow ups from scary 3 or 4 letter agencies about it all. TL;DR on all of it is don’t put PLCs on the f’n Internet to begin with.

The latest, five agencies (NSA, CISA, FBI, DOE and EPA) put this out on Wednesday, and the detail everyone is fixating on is that the advisory names AI-generated exploitation scripts as the tooling. The scripts wrap the open source snap7 / python-snap7 libraries, present themselves as legitimate OT monitoring tools, and give read and write access to PLC memory, configuration data and ladder logic over S7comm. Targets get found with Censys and ZoomEye. Sectors called out are critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with a note that S7 gear also sits in the defense industrial base.

Read past the AI framing and the exposure is the same one we have been writing about all summer: internet-reachable controllers on old firmware. The advisory's first instruction is to get S7 PLCs off the public internet, route any remote access through VPN with MFA, enable hardware key switches so logic cannot be changed remotely, and audit project files against known good ladder logic. It follows the 30-plus Minnesota water systems hit in late July and incidents in at least a dozen states. No attribution in this one, though the related July advisory pinned the broader PLC campaign on Iranian-affiliated actors. (read more here and here)

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Google is tracking three Russian espionage clusters going after academics, defense contractors, diplomats and think tanks across Europe and the US, and the tradecraft is all authentication abuse. App passwords, OAuth tokens, device codes, WhatsApp device linking. Every path ends with the victim approving something their provider treats as a normal action, so MFA holds and the mailbox gets read anyway. UNC6293 and UNC7005 look like APT29 sub-clusters handling initial access. UNC6293 runs quiet, fewer than five targets at a time, diplomatic lures. UNC7005 is louder and was behind July's hotel WiFi captive portal redirects that served device code phishing, plus VIDAR and ATOMIC delivered through fake conference sites.

The WhatsApp operation is a fun one to hone in on for your teams. The target believes they are joining a secure call, links their account to the actor's device, and the page records their audio and video and ships it out. UNC5976 runs separately with heavier malware, focused on Ukrainian and Armenian defense through fake file-sharing OAuth phishing. All of it leans on personal accounts and encrypted messengers where corporate logging never reaches. Detection lives in consent grants, app password creation and device link events. (read more)

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490

Another pre-auth bypass on the appliance that fronts everyone's remote access. CVE-2026-19490 lets an unauthenticated attacker get past authentication on a NetScaler acting as a Gateway or AAA vserver, which is the entire job of the box. Rapid7 says it has not seen exploitation yet and still recommends treating this as emergency patching, and the track record backs that up. Twenty-two Citrix bugs have been exploited in the wild over the past five years, six of them in ransomware, and when the March pair dropped, attackers were on them within days and CISA gave federal agencies three days to patch. ShadowServer currently sees north of 22,000 ADC and 1,800 Gateway instances answering on the internet.

Recent builds are only affected when a SAML action is configured. Older builds are affected by any Gateway or AAA vserver configuration at all, so the further behind you are, the more likely you are already in scope regardless of how you do auth. Citrix published grep-able config strings for this and for the SIP ALG denial of service that shipped with it, so scoping is one pass over your running config rather than an afternoon with a version matrix. If you get a hit and cannot take an outage tonight, Global Deny List signatures through NetScaler Console are the stopgap. An auth bypass leaves behind activity that looks authenticated, so budget time to hunt after the upgrade. (read more here and here)

Pacing model development in an era of cyber-critical capabilities

OpenAI decided it’s models have committed too many felonies recently and paused reinforcement learning (RL) training on deployment-bound models for two weeks. They still have their largest planned frontier run on hold, after the Hugging Face incident and a preliminary finding on August 7 that its upcoming Astra model may hit the Critical cybersecurity threshold in their Preparedness Framework.

The rebuild looks a whole lot like a security engineering program to me: stronger sandboxes for anything executing model-generated or untrusted code, and network segmentation so one compromised workload cannot reach the internet or internal systems on its own. (AKA the thing we all said when we read that Hugging Face incident)

Activation classifiers inspect sampled tokens, anything flagged goes to automated investigators that review tool calls, available reasoning and the full action sequence, and the target is an alert within 30 minutes. If the safety, security and research teams cannot conclusively call it a false positive within another 30 minutes, they are expected to pause the activity. It applies to all tool-using RL training and evals at Sol capability or above, plus all Astra inference with tools, and OpenAI estimates it adds around 20% to inference compute on monitored workloads. A company voluntarily paying a fifth of its compute and pausing its biggest training run is a real signal about what they think these models can do. (read more)

The push to designate AI as the next critical infrastructure sector

A new report from Americans for Responsible Innovation argues AI should get formal critical infrastructure status with CISA as the lead agency for its cyber protection. Their scope is wide: frontier models, model weights, datacenters, AI chips, essentially the whole stack. The case is that AI is now embedded in everything, concentrated among a handful of companies, and that an attack on it cascades into other sectors. The physical side is no longer hypothetical either, with drones having hit datacenters, including Iranian strikes on Amazon facilities and Ukrainian hits on Russian infrastructure. Designation would open up federal threat intel, incident response support and tooling for AI companies.

The skepticism is mostly about bureaucracy. Former DHS officials point out that Commerce and Treasury are already competing for AI policy ownership, so getting agreement on CISA as lead means a turf fight. There is also a real question about whether this needs a new sector at all, or whether the handful of companies that matter get folded into existing ones. My question is does it really matter? It’s not like our current critical infrastructure is proving to be nailing security to begin with. Just look at what Iran is doing to our water plants. (read more)

Comcast turns your Xfinity WiFi into a home motion detector

What could go wrong? Comcast is pushing WiFi Motion as part of its new Xfinity Shield bundle. Your gateway watches how bodies disrupt the signal between it and stationary devices like smart speakers, and turns that into motion detection. The capability has been quietly available since at least mid-2024, so the news is the marketing push. Sensitivity is high enough to register a hand reaching for a remote or a cat crossing a room, and Comcast acknowledges it cannot reliably tell a small pet from a similarly sized child.

The privacy language though… Comcast says it does not monitor your motion data, while its own documentation says information generated by WiFi Motion may be handed to third parties or law enforcement under a court order or subpoena without further notice to you. The company has not said what it retains, how long it keeps it, or what exactly gets produced when it is compelled. So the household now generates a movement log that lives somewhere in Comcast's systems, with a disclosure framework already written and a retention policy nobody has published. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay