Malware Hiding in Plain Sight

Security firm Socket found spyware targeting bioinformatics and MCP developers that embeds fake system instructions and weapons-related text in comment blocks, betting that LLM triage tools will refuse or misclassify the file before the obfuscated payload is examined. Separately, StepSecurity reported that the Shai-Hulud worm shipped in a compromised Tensorlake npm release, tensorlake@0.5.144 on October 8, carrying a credential stealer that writes editor and Claude Code configs to re-execute on repo open and, per StepSecurity, wipes the home directory when the stolen token is revoked. October's Patch Tuesday fixed more than 1,400 flaws, including CVE-2026-96951 (CVSS 8.8), an already-exploited Windows Shell zero-day that bypasses Mark of the Web.

What We're Watching Malware used to have the decency to hide. A note for the LLMSchneier on Security https://www.schneier.com/blog/archives/2026/06/embedding-forbidden-text-in-spyware-to-discourage-ai-analysis.html Spyware hides behind nuclear and bioweapons text Socket found worms aimed at bioinformatics and MCP developers that open with a comment block of fake system instructions and weapons-related text. JavaScript ignores the comment. An LLM triage tool may not, and can refuse or misclassify the file before anyone looks at the obfuscated payload underneath. Revoke the token, lose ~/StepSecurity https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm Shai-Hulud worm ships in a compromised Tensorlake release On October 8, tensorlake@0.5.144, an npm package for AI agent sandboxes, shipped with a credential stealer. It writes editor and Claude Code configs so it runs again whenever the repo is opened. According to StepSecurity, revoking the stolen token triggers a wipe of your home directory. The warning never showsBleepingComputer https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/ An exploited Windows Shell zero-day bypasses Mark of the Web October's Patch Tuesday fixed more than 1,400 flaws. One of them, CVE-2026-96951 CVSS 8.8 , is already being exploited: a crafted file bypasses Mark of the Web, so Windows doesn't flag it as downloaded. Our Take This worm wraps an ordinary payload in fake system instructions and weapons-related text, betting that a language model reading the file will refuse or misclassify it. It isn't a real bypass. YARA, entropy checks, and a human with a deobfuscator still catch it. It only works on a pipeline that asks the model first and checks nothing after. That setup is more common than it should be. A lot of teams added an LLM to triage, code review, or an agent workflow this year without deciding what happens when the content it reads contains instructions. Three things to check: Is file content passed to the model as untrusted data? When the model refuses or times out, does the file go to a human instead of being marked clean? And do deterministic checks still run regardless of what the model says? If you don't know the answers, test it. Feed your tooling a file like this one, see where it ends up, and fix whatever let it through. Updates from Casco A new guide on the blog and two upcoming events. Mozilla confirmed that eMudhra intermediate certificates were compromised, and Go shipped an urgent update 1.26.10 and 1.27.3 that stops trusting the affected keys. Go binaries also show up in places teams don't track, like CLIs, container images, and tools bundled inside Python or JavaScript packages, so you can be affected without writing any Go. René wrote up how to find those binaries and confirm the patched versions are the ones actually running, not just downloaded. The post also includes a prompt you can give a coding agent to do the inventory. Check out the full post https://casco.com/blog/cve-2026-111943-go-remediation Happy hour in Minneapolis. If you're in town for BSides Twin Cities, join us this Friday, October 23, from 6 to 8 PM at Day Block Brewery 1105 Washington Ave S . Pints and slices are on us. Registration needs host approval. Request to join https://luma.com/la124evn Archil's first hackathon, at our office. Archil is hosting Agents Need Solid Ground at Casco's SoMa office on Tuesday, November 10, from 6 to 10 PM PT, with $50K in prizes. It celebrates Archil's new $10/month plan for individual developers. RSVP for the hackathon https://luma.com/t9hsthtk A practical next step Can a single file steer your AI tooling? Casco tests whether your models, agents, and copilots can be manipulated by the inputs they're meant to analyze. Explore AI pentesting https://casco.com/solutions/ai-pentesting Casconaut Highlight One small recommendation from the people behind Casco. This issue's Casconaut Eleanor Sigel Security Architect Currently recommending Protomartyr https://protomartyr.bandcamp.com I recommend Protomartyr, a post-punk band from Detroit. The singer sounds like he has read every incident report ever filed and was not surprised by any of them. Start with The Agent Intellect . It holds up on a long run and on a long day of reading patch notes.