{"slug": "malware-hiding-in-plain-sight", "title": "Malware Hiding in Plain Sight", "summary": "Security firm Socket found spyware targeting bioinformatics and MCP developers that embeds fake system instructions and weapons-related text in comment blocks, betting that LLM triage tools will refuse or misclassify the file before the obfuscated payload is examined. Separately, StepSecurity reported that the Shai-Hulud worm shipped in a compromised Tensorlake npm release, tensorlake@0.5.144 on October 8, carrying a credential stealer that writes editor and Claude Code configs to re-execute on repo open and, per StepSecurity, wipes the home directory when the stolen token is revoked. October's Patch Tuesday fixed more than 1,400 flaws, including CVE-2026-96951 (CVSS 8.8), an already-exploited Windows Shell zero-day that bypasses Mark of the Web.", "body_md": "## What We're Watching\n\nMalware used to have the decency to hide.\n\n[A note for the LLMSchneier on Security](https://www.schneier.com/blog/archives/2026/06/embedding-forbidden-text-in-spyware-to-discourage-ai-analysis.html)\n\n### Spyware hides behind nuclear and bioweapons text\n\nSocket found worms aimed at bioinformatics and MCP developers that open with a comment block of fake system instructions and weapons-related text. JavaScript ignores the comment. An LLM triage tool may not, and can refuse or misclassify the file before anyone looks at the obfuscated payload underneath.\n\n[Revoke the token, lose ~/StepSecurity](https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm)\n\n### Shai-Hulud worm ships in a compromised Tensorlake release\n\nOn October 8, tensorlake@0.5.144, an npm package for AI agent sandboxes, shipped with a credential stealer. It writes editor and Claude Code configs so it runs again whenever the repo is opened. According to StepSecurity, revoking the stolen token triggers a wipe of your home directory.\n\n[The warning never showsBleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/)\n\n### An exploited Windows Shell zero-day bypasses Mark of the Web\n\nOctober's Patch Tuesday fixed more than 1,400 flaws. One of them, CVE-2026-96951 (CVSS 8.8), is already being exploited: a crafted file bypasses Mark of the Web, so Windows doesn't flag it as downloaded.\n\n## Our Take\n\nThis worm wraps an ordinary payload in fake system instructions and weapons-related text, betting that a language model reading the file will refuse or misclassify it. It isn't a real bypass. YARA, entropy checks, and a human with a deobfuscator still catch it. It only works on a pipeline that asks the model first and checks nothing after.\n\nThat setup is more common than it should be. A lot of teams added an LLM to triage, code review, or an agent workflow this year without deciding what happens when the content it reads contains instructions. Three things to check: Is file content passed to the model as untrusted data? When the model refuses or times out, does the file go to a human instead of being marked clean? And do deterministic checks still run regardless of what the model says?\n\nIf you don't know the answers, test it. Feed your tooling a file like this one, see where it ends up, and fix whatever let it through.\n\n## Updates from Casco\n\nA new guide on the blog and two upcoming events.\n\nMozilla confirmed that eMudhra intermediate certificates were compromised, and Go shipped an urgent update (1.26.10 and 1.27.3) that stops trusting the affected keys. Go binaries also show up in places teams don't track, like CLIs, container images, and tools bundled inside Python or JavaScript packages, so you can be affected without writing any Go.\n\nRené wrote up how to find those binaries and confirm the patched versions are the ones actually running, not just downloaded. The post also includes a prompt you can give a coding agent to do the inventory.\n\n### [Check out the full post](https://casco.com/blog/cve-2026-111943-go-remediation)\n\n**Happy hour in Minneapolis.** If you're in town for BSides Twin Cities,\njoin us this Friday, October 23, from 6 to 8 PM at Day Block Brewery\n(1105 Washington Ave S). Pints and slices are on us. Registration needs\nhost approval.\n\n### [Request to join](https://luma.com/la124evn)\n\n**Archil's first hackathon, at our office.** Archil is hosting Agents Need\nSolid Ground at Casco's SoMa office on Tuesday, November 10, from 6 to 10\nPM PT, with $50K in prizes. It celebrates Archil's new $10/month plan for\nindividual developers.\n\n### [RSVP for the hackathon](https://luma.com/t9hsthtk)\n\nA practical next step\n\n### Can a single file steer your AI tooling?\n\nCasco tests whether your models, agents, and copilots can be manipulated by the inputs they're meant to analyze.\n\n[Explore AI pentesting](https://casco.com/solutions/ai-pentesting)\n\n## Casconaut Highlight\n\nOne small recommendation from the people behind Casco.\n\nThis issue's Casconaut\n\n### Eleanor Sigel\n\nSecurity Architect\n\nCurrently recommending\n\n### [Protomartyr](https://protomartyr.bandcamp.com)\n\nI recommend Protomartyr, a post-punk band from Detroit. The singer sounds like he has read every incident report ever filed and was not surprised by any of them.\n\nStart with *The Agent Intellect*. It holds up on a long run and on a long day\nof reading patch notes.", "url": "https://wpnews.pro/news/malware-hiding-in-plain-sight", "canonical_source": "https://casco.com/newsletter/issue-05", "published_at": "2026-10-28 16:54:47+00:00", "updated_at": "2026-10-28 17:13:13.612235+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools"], "entities": ["Socket", "StepSecurity", "Tensorlake", "Shai-Hulud", "Claude Code", "Microsoft", "CVE-2026-96951", "Casco"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/malware-hiding-in-plain-sight", "markdown": "https://wpnews.pro/news/malware-hiding-in-plain-sight.md", "text": "https://wpnews.pro/news/malware-hiding-in-plain-sight.txt", "jsonld": "https://wpnews.pro/news/malware-hiding-in-plain-sight.jsonld"}}