Cisco Talos published analysis on September 22 of CLOSEDQUORUM, a 16.4MB Go-based Windows implant that queries DeepSeek, Qwen, Mistral, and Google Gemini with identical host reconnaissance data and ex…
Cloudflare's Page Shield machine learning model detected all eight malicious JavaScript payloads across four client-side attacks on storefronts, while seven of the eight were entirely absent from Viru…
A developer building Auricle, an unsigned Rust and Slint Windows music player, investigated why VirusTotal flagged the Inno Setup installer as malicious while the application executable inside it was …
A developer built a Rust executable posing as a fake LLM token-metering bypass called "ZeroToken Engine" and submitted it to VirusTotal, collecting environment telemetry from the analysis services tha…
Magic Actions for YouTube, a Chrome extension with roughly 1 million users and 15+ years of operation, was force-disabled for all users after Chrome flagged its CRX package as containing malware, whil…
A benchmark of five OpenClaw skill scanners found that agent-based auditing dramatically outperforms static analysis, improving recall from 8% to 95% on a test set of 60 skills. The Trent AI team's Op…
Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found that only 12 (3.0%) appeared in production telemetry on Cortex XDR-protected endpoints, with approximately 97% existing onl…
A security researcher demonstrated a prompt injection attack against VirusTotal's Code Insights API, a Google-owned malware analysis service, that could trick the AI-powered code review tool into hidi…
Aeglix Mind has launched HAsH Guardian, a free URL threat scanner for users in Africa and the Gulf that combines seven global threat intelligence providers with a custom ML model trained on over 500,0…
A developer built a Python pipeline that uses an LLM to triage SIEM alerts, reducing noise by up to 80%. The system enriches alerts with threat intel context and outputs a structured verdict with seve…
Thousands of GitHub repositories have been distributing Trojans via ZIP archives for two years, according to an analysis by security researcher Orchid Files. The researcher found that repositories sha…
Researchers from Tracebit found that placing prompt injections alongside secrets stored on Amazon Web Services can shut down attacks from AI hacking agents by directing the LLM to perform a forbidden …
Palo Alto Networks Unit 42 identified a previously undocumented modular IoT botnet framework named TuxBot v3 Evolution, whose authors used an LLM to assist in code development but left a safety discla…
A security researcher narrowly avoided a nation-state-style attack after receiving a fake job interview email that led to a malicious TypeScript repository. The attacker used a fabricated persona and …
Unit 42 researchers discovered a malicious campaign between February and May 2026 targeting OpenClaw's ClawHub marketplace, where attackers published skills like 'tradingview-ai-indicator-assistant' t…
Palo Alto Networks Unit 42 researchers discovered five malicious skills on OpenClaw's ClawHub marketplace between February and May 2026, including infostealers, evasion techniques, and novel agentic t…
Engineering teams must treat AI systems as interconnected software supply chains, applying lifecycle-phase security controls like signed artifacts and zero trust to mitigate risks such as data poisoni…
NVIDIA open-sourced SkillSpector, a security scanner for AI agent skills, to address vulnerabilities like prompt injection and tool poisoning. Research shows 26.1% of 42,447 skills had vulnerabilities…
A campaign of roughly 10,000 GitHub repositories has been distributing Trojans for over a year by cloning legitimate projects, injecting malicious download links, and evading detection through commit-…
VirusTotal security check results for the Hugging Face website show that 1 out of 92 security vendors flagged the URL as malicious, indicating a low but present risk.…