ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories

Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor. Nothing here is especially mystical. Just ordinary systems trusting slightly too much, slightly too early. The full list follows. The threats change every week. Subscribe, and well alert you when each new ThreatsDay Bulletin is out. China-linked telecom risk Chinese Telcos Maintain U.S. Presence The U.S. Congress's bipartisan Select Committee on China has published a 49-page report named "Stranger Pings," highlighting the threat of China-controlled infrastructure in the U.S. telecommunications backbone. The Committee said the Salt Typhoon campaign could have been facilitated via a residual footprint that leaves open the door to future cyber operations against the U.S.: Chinese (aka People's Republic of China or PRC) telecom firms operating in the U.S. do not act independently and keep trusted positions inside U.S. communications infrastructure that Chinese threat actors can potentially abuse to preserve access and hide activity. "One PRC telecommunication provider included an 'Acceptable Use' Policy in contracts with U.S. companies," the Committee said . "This prohibited the broadcasting of political news against state laws of the PRC, the broadcasting of information in violation of PRC state security laws, and the broadcasting of information in violation of the 'social order and social stability.'" ClickOnce phishing chain SideWinder Deploys New Attack Chain The threat actor known as SideWinder has adopted a new multi-stage attack chain that abuses ClickOnce application files delivered via phishing PDF documents to deliver Rust-based backdoors. The implants can establish persistence via registry modification, collect host intelligence, and accept remote commands over external servers hosted on free serverless platforms such as Cloudflare Workers. npm supply chain attack Flooding Dropper Hits npm With 850 Malicious Packages An active malicious package campaign, dubbed "Flooding Dropper," has disclosed a large-scale campaign involving 846 software components. "The attacker appears to be automating parts of the npm account and package creation process, combining terms such as bigops and bnpl with other words and recurring version patterns, such as releases in the 35.x.y range," Sonatype said . "When installed, the packages download and execute a second-stage payload, using multiple delivery methods to improve the attack's chances of success. The packages also contain slightly modified payloads. While syntactically different, for example using different URL functions and variable names, the packages all execute the same behavior. Those changes can reduce the effectiveness of detections that depend on exact signatures, even when the underlying behavior remains closely related." The packages deliver a first-stage JavaScript loader that identifies the host operating system and delivers a compatible Windows, Linux, or macOS payload from a randomized set of hard-coded remote hosts and runs it as a detached background process. On Windows, the downloaded binary is another loader that performs checks for sandboxed and virtual environments, patches Event Tracing for Windows and Antimalware Scan Interface functions, establishes persistence via a scheduled task, and downloads and executes an encrypted payload. Coding agent execution risk Coding Agents Expose Pre-Prompt Code Execution Paths New research from Datadog has found that "Trusting a repository in a coding agent can allow repository-controlled code to run before you send the first prompt," causing seemingly harmless tasks like cloning a repository to be an attack vector. "Codex MCP configuration and Claude Code project environment settings created automatic code-execution paths without a model response or shell-command approval," Datadog said . "Treat project trust like running code. Open unfamiliar repositories in disposable environments without sensitive credentials, even if a quick manual review looks clean." Earlier this May, Datadog also highlighted the risks associated with Claude Code skills. "Agentic skills package instructions and context for coding agents," it said . "They are useful for repeatable workflows, but they also create a path for attacker-controlled instructions to enter a trusted agent session. The important detail is not only that a malicious skill can ask an agent to do something dangerous. It is that dynamic context commands run before the model sees the skill at all. When that happens, model-level prompt injection defenses never get a chance to intervene." AI-powered cyber attack Chinese Actor Weaponizes DeepSeek in Cyber Attack A DeepSeek AI agent attacked the network of Tel Aviv-based AI cybersecurity firm Jesta Security in early July 2026 as part of an LLM-managed cyber attack campaign for proxyjacking and other follow-on attacks. The development is the latest example of how threat actors are relying on AI agents to break into third-party networks. "During our research on defense against AI attackers, we took our lab and stood it up in the field, behind US-based infrastructure," security researcher Lior Finkelshtein said . "We opened a port and waited for attackers to come to us. Within a week, we had logged over 300,000 attempts to break in: botnets, credential stuffing, the usual internet noise. And then something surfaced that did not fit the pattern." The activity has been linked to a Chinese threat actor. Jesta said it managed to steer the AI agent into extracting its own target list, identifying over 1,200 victim hosts that had been targeted in a similar manner. "The goal was proxyjacking: install a small SOCKS5 proxy, open it to the internet, and quietly turn a weakly secured rented server into an exit node for someone else's traffic and attacks," Jesta said. macOS malware upgrade New XCSSET Malware Version Spotted A new version of the XCSSET malware (version 40) is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. "This versions advanced architecture hides its core logic in memory space, reducing its digital footprint," Palo Alto Networks Unit 42 said . "V40 further enhances its detection evasion capabilities by combining polymorphic payload generation with fileless persistence and dynamic in-memory execution, while weakening a number of security mechanisms on the affected machine." The malware author, per Unit 42, has enhanced the ability of the malware to spread through open-source projects on GitHub and upgraded its worming capabilities. It can now infect all existing Xcode projects on a compromised system for maximum impact. The malware supports browser hijacking (specifically targeting Google Chrome) to inject JavaScript that can intercept web traffic, credential theft, clipboard monitoring, and data exfiltration capabilities. A new addition is a Telegram trojanizer that deletes the legitimate Telegram Desktop application on infected systems and replaces it with a malicious version with an intent to siphon victims' communications. The new version has been observed in two distinct attack waves in mid-April and in early May 2026. LLM pentesting lessons Training LLMs on Long-Horizon Pentesting Tasks Novee Security has published its learnings from training large language models (LLMs) for pentesting. This includes handling silent failures, having a weight-sync strategy, and how prefix breaks can cascade into performance drops in AI workloads. "An RL [Reinforcement Learning] pipeline is a complex system with many moving parts. And all of them are moving fast: the models, the harnesses, the frameworks, and the long tail of bugs in libraries we don't even own," it said . "Each lesson cost us real time and real money." One-click device compromise Hacking Into Samsung's Mobile Devices A set of vulnerabilities affecting Samsung devices (CVE-2025-21079 and CVE-2025-58486) could be chained to result in remote system-level compromise triggered by clicking on a link delivered via an ad or a messaging application. "What distinguishes this entry from previous submissions is its focus on design oversights in Samsung's virtual assistant, Bixby, that enabled privilege escalation through a single auto-granted Android permission," researchers Dimitrios Valsamaras and Ken Gannon said . "Because this permission is implicitly approved in many Samsung applications, exploiting just one of them allowed us to issue unauthorized commands to Bixby." Because Bixby maintains interprocess communication channels with a wide range of applications, including system components, the issues could be exploited to force the agent to relay arbitrary commands to privileged services, effectively turning it into a bridge between unprivileged and system domains. The pair first demonstrated the vulnerabilities at the Pwn2Own Ireland hacking competition in October 2025, where they earned $50,000. The issues were fixed by Samsung late last year. App Store removal attack Telegram Says Takedown Extortionist Was Responsible for App Removal Telegram CEO Pavel Durov has blamed an extortionist planting child sexual abuse material (CSAM) in a public chat to get the app briefly removed from Apples App Store earlier this week. "Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick," Durov said . "He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the groups members, preventing them from seeing/reporting it." The attacker is said to be someone who "demands ransom from group owners in exchange for not targeting their communities," with Durov stating these threat actors "use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them." More linked devices Signal Allows Users to Link Multiple Phones to One Account Signal has rolled out the ability to link more devices with one phone number on the messaging app, including an Android phone or iPhone, going beyond iPads and computers. The feature is available in Signal Android v8.20 and Signal iOS v8.22. AI bug report flood Apple Limits Bug Submissions Following a Flood of AI Slop Apple has enforced caps on the number of open bug-bounty reports researchers can submit after being flooded with low-quality and sometimes entirely fabricated vulnerabilities hallucinated by AI. "While Apple now has a cap on the number of open submissions a researcher can have, researchers can request an increase to make sure Apple's security team doesn't miss a critical vulnerability," Financial Times reported. Domain takeover flaws Security Flaws Lead to Kerberos Downgrade, DoS, and Full Domain Takeover Two new Active Directory privilege escalation vulnerabilities, dubbed KerberLoss ( CVE-2026-25177 ) and ResetNightmare ( CVE-2026-27912 ), can cause identity confusion on domain controllers (DCs), with the latter enabling a low-privileged user to instantly gain Domain Admin privileges. Microsoft patched both flaws in March and April 2026. "Other than patches, organizations should stick to the principle of least privilege and monitor for abnormal additions of non-default permissions," Semperis said . "Tighter permissions can make these vulnerabilities more difficult to abuse." AI-powered scam farms FunFoneFarm Fuels Scam Economy An off-the-shelf, AI-enhanced scam phone farm can be acquired for a few thousand dollars, allowing aspiring three actors to design, launch, and automate common scams, including romance and adult-content scams, pig-butchering scams, and astroturfed social media accounts. "These scams are operated on phone farms sold as kits on open and dark web marketplaces, the farms are automated with AI interfaces, and the scams often use AI in their design and operation, significantly lowering the barrier to entry for would-be threat actors and commoditizing cybercrime," HUMAN Security said . The activity has been codenamed FunFoneFarm. A similar alert was issued by Group-IB earlier this March. The danger with such offerings is that they can enable low-cost scalable fraud operations. "It's an ecosystem, assembled from parts that are individually legal, openly sold, and often genuinely useful: commodity hardware, device-management software, cloud infrastructure, and general-purpose AI," it added. CTV ad fraud ring NewsJunkie Spoofs Premium CTV Inventory at Scale In a related development, HUMAN also detailed a connected TV (CTV) device-spoofing ring called NewsJunkie that's disguised as premium local news content on major CTV platforms. The operation involved two spoofing vectors: SSAI CTV device spoofing and residential proxy CTV device spoofing. "At its peak, it accounted for hundreds of millions to nearly two billion invalid CTV bid requests per day per seller," it said . "One particular local news app generated more than 42.2 billion bid requests, approximately 360 times the volume of the next-highest regional news app, with only 185 reviews on the app store." Fake bank phishing chain Fake Bank of America Lures Lead to ScreenConnect An active phishing campaign impersonating Bank of America (BoA) aims to trick Windows users into installing ScreenConnect remote access software and then making it harder to uninstall it. To evade detection, the malware disguises ScreenConnect as a service called Windows Security. "The subsequent phishing page delivers an AccountGuard.zip with a .vbs file that contains a large chunk of base64-encoded data," Huntress said . "The next phase of the attack then involves a complex chain of decoding scripts, and ends in the execution of arbitrary commands (with escalated privileges) in PowerShell. The goal of all this complexity is to download a Microsoft installer (.msi) for a custom ScreenConnect client and execute/install it with Administrator privileges without prompting the user for elevation. Additional payload components conceal the installed ScreenConnect client and remove the user's ability to uninstall or disable it easily." The development comes as the cybersecurity company warned of threat actors exploiting an SQL injection vulnerability to install a post-exploitation toolkit called khunt via a Java Source directly within an Oracle database. "A Java Source (a code-object that's stored directly in Oracle's database engine) allows developers to store and run Java code in the database as schema objects, but the threat actor abused this as a way to upload the toolkit directly into the database," Huntress said . "The toolkit included several objects, including khuntCmd and khuntHash, which essentially acted as purpose-built tools that were compiled and stored in the database, and enabled malicious functionalities like running OS commands and writing usernames/password data to a file. Threat actors used khunt to perform several malicious measures, including attempting to exfiltrate SAM, SECURITY, and SYSTEM registry hives." AI memory poisoning Persistent Memory Poisoning in AI Agents Forcepoint has called attention to the growing risk of persistent memory poisoning, calling it an emerging attack class against AI assistants and agentic systems that store long-term memory items, user preferences, task history, or operational context across sessions. "Unlike normal prompt injection attacks that usually die when the session ends, memory poisoning survives," Forcepoint said . "The attacker's goal is to inject misleading or malicious memory items into an assistant's persistent memory layer so that an agent later retrieves and trusts these malicious items to perform unrelated future tasks." AI abuse tactics How Threat Actors Are Weaponizing AI Speaking of AI systems, threat actors are increasingly misusing AI tools to create code with malicious capabilities, scale criminal operations and campaigns, and bug bounty or vulnerability research. While no novel encoding or evasion techniques have been observed, evidence shows that attackers are sticking to tried and tested methods to evade model guardrails. "We also found a lot of successful instances of actors using the Capture the Flag (CTF) or bug bounty labeling," Cisco Talos said . "This unlocked models to a variety of tasks, including vulnerability hunting and subsequent exploitation, without requiring any significant follow-up or additional vetting. Additionally, we saw actors leveraging task decomposition splitting risky actions across multiple sessions and files as an effective avenue to bypass guardrails. Building the components slowly and working through malicious components in a deliberate manner, breaking them apart sufficiently to evade the models' protections." AI workspace RCE Critical Flaw in Odysseus AI A critical flaw (CVSS score: 9.9) in Odysseus, a privacy-focused AI workspace that provides an interface to talk to LLMs, can allow an authenticated non-admin user to execute OS commands with the privileges of the Odysseus process by smuggling an admin-only shell action onto a scheduled task across two ordinary API requests." The security flaw has been addressed in version 1.0.2. The process holds the application's data and credentials, including user password hashes and TOTP secrets, stored provider API keys, the database, and the SSH keys Odysseus uses to reach the remote machines it manages. "On any instance with self-service signup or a second user, one account became a foothold API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages, plus a scheduler to persist in," Manifold Security said . There is no evidence the issue was exploited before the fix. Router takeover flaws 15 TP-Link Omada Flaws Enable Router Hijacking Forescout's Vedere Labs discovered a set of 15 security flaws impacting the zero-touch provisioning (ZTP) system in TP-Link Omada routers and other devices that could facilitate client-side code execution, information disclosure, device hijacking and spoofing, and compromise of encrypted communications. "Some vulnerabilities extend beyond Omada to other TP-Link products and services, including IP cameras, smart home IoT devices, mobile apps, and cloud accounts," the cybersecurity company said . "Findings include a chain of trust compromise from hard-coded cryptographic keys, sensitive information disclosures, and remote code execution." When combined with two previously disclosed vulnerabilities ( CVE-2025-7850 and CVE-2025-7851 ), they can be weaponized by attackers to infiltrate networks through controllers and client devices. Besides applying the patches released by TP-Link, it's advised to avoid using the same password across all devices during provisioning, change device credentials and use strong, unique passwords, modify TP-Link ID credentials and enable multi-factor authentication where available, and rotate VPN keys and credentials that may have been exposed. Initial access broker exposed Russian-Speaking Access Broker's Dual Operation CloudSEK has exposed the operations of a Russian-speaking initial access broker, thanks to a publicly accessible server, revealing their targeting of internet-facing infrastructure across multiple sectors. "The operator exploited internet-facing appliances across a dozen-plus countries, harvesting credentials and achieving full Active Directory compromise across education, healthcare, finance, telecommunications, and government victims," CloudSEK said . In multiple confirmed cases, ransomware groups claimed the same organizations within weeks of the operator's access,