⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Tenable reveals that attackers now target configuration files for AI coding assistants, such as settings.json and .cursorrules, to inject persistent malware. This new worm class evades AI-based scanners and propagates through organizational repositories by leveraging developer workflows.
The article describes how attackers are poisoning AI coding assistant configuration files to achieve silent persistence and spread across organizations. The Mini Shai-Hulud worm targets config files of tools like Claude Code, Copilot, and Cursor.
Tenable reveals that attackers now target configuration files for AI coding assistants, such as settings.json and .cursorrules, to inject persistent malware. This new worm class evades AI-based scanners and propagates through organizational repositories by leveraging developer workflows.
In June 2026, Kaspersky researchers identified a new module within the Project CAV3RN framework, a sophisticated cyberespionage tool targeting Israeli entities. This module, designed to replace the previous HTTP/WebSocket communication component, leverages Microsoft Outlook calendar events accessed via Microsoft Graph for command-and-control (C2) operations.
The article reports on a new communication module for Project CAV3RN that abuses Outlook calendar events for command-and-control. It also uses DNS AAAA records to recover configuration.
Project CAV3RN cyberespionage framework abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery.