Security
Top Security: NetNut, AI Ransomware, Apple Patch & More
FBI and Google dismantle NetNut botnet; AI agent runs first fully autonomous ransomware; Apple accelerates patches after AI finds WebKit flaws.
Pegasus Spyware Infects MEP Investigating Spyware
Former Member of the European Parliament Stelios Kouloglou was repeatedly infected with NSO Group’s Pegasus spyware while serving as a substitute member of the European Parliament’s Committee of Inquiry to investigate the use of Pegasus (PEGA Committee). The infections occurred on or around October 21, 2022, and on March 6 and 7, 2023, using a zero-click exploit named PWNYOURHOME. Citizen Lab forensic analysis found the device was running iOS 15.5 and was hacked via a crafted NSKeyedArchive sent to HomeKit, followed by malicious content in MessagesBlastDoorService. The October 21 attack aligned with intense PEGA committee activity, and the March infections occurred during final drafting of the PEGA report. This is the first time a PEGA committee member has been publicly identified as a Pegasus victim while serving on the committee. The Citizen Lab does not attribute the infections to a specific NSO Group customer and found no indications the Greek government was responsible. The lab urged the European Parliament, European Commission, and national parliaments to open investigations and conduct spyware screening of MEPs.
FBI and Google Takedown NetNut Botnet Enrolling 2 Million Home Devices
The FBI and Google’s Threat Intelligence Group (GTIG) jointly dismantled NetNut, a residential proxy botnet that secretly enrolled an estimated 2 million consumer devices and served 316 distinct cybercriminal and espionage clusters in a single week in June 2026. The operation cut off Google accounts and services NetNut used for command-and-control, shared technical intelligence about its hidden SDKs, and updated Google Play Protect to automatically detect and block any Android app containing NetNut’s proxy code. The FBI simultaneously seized hundreds of domains, including netnut.com. NetNut is operated by Alarum Technologies, an Israeli company listed on Nasdaq. The botnet populated itself by embedding SDKs in ordinary-looking apps, primarily IPTV and streaming utilities, without meaningful user consent. Once installed, devices silently became exit nodes for paying customers, allowing password spray attacks and other malicious traffic to appear as legitimate household connections. Google acknowledged the limits of the takedown, noting that competitors have rebuilt quickly in the past. Consumer guidance: treat offers to share unused bandwidth as a warning sign, keep Google Play Protect active, and avoid uncertified Android TV devices.
FBI and Google Disrupt NetNut Botnet That Rented 2 Million Home Devices to Spies →
North Korean npm Packages Impersonate Rollup Polyfill Tools
JFrog security researchers uncovered six malicious npm packages mimicking Rollup polyfill tools, linked to North Korean threat actors. The packages, named rollup-packages-polyfill-core and rollup-runtime-polyfill-core, impersonated the legitimate rollup-plugin-polyfill-node project in description, repository metadata, and package structure. All six have been removed from the npm registry. The attack used a layered delivery chain: first-stage packages installed hidden second-stage dependencies disguised as SVG utilities, which fetched a JSON object from a remote hosting service and executed the embedded payload. JFrog stated the structure, lookalike names, and environment checks were consistent with previous Lazarus-linked npm campaigns. Once executed, the malware stole data from web browsers and cryptocurrency wallets, captured clipboard content, harvested files matching specific extensions, and targeted developer tool configurations for VS Code, Windsurf, and Cursor, along with credentials for AWS, Azure, Google Gemini, Anthropic Claude, and SSH keys. The packages shared features with OtterCookie, including a forked keyboard and mouse control library enabling interactive remote terminal sessions. The disclosure was published July 3, 2026.
North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets →
Ransomware Gangs Vect and TeamPCP Form Unprecedented Partnership
Ransomware groups Vect and TeamPCP announced a partnership in March, combining TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure. Sophos described the collaboration as an unprecedented model of industrialized ransomware deployment, involving supply chain credential theft, a maturing RaaS operation, and mass underground forum mobilization. The alliance has the potential to significantly lower the barrier to entry for emerging cyber criminals. Vect’s RaaS operation first appeared at the end of 2025 and claimed its first victims a month later. TeamPCP appears to be an offshoot of The Com, a global confederation of cyber criminals, and between March and May 2025 carried out high-profile supply chain attacks, including one on Trivy, an open-source vulnerability scanner by Aqua Security. Sophos reported at least one verified Vect ransomware deployment using TeamPCP-sourced credentials, indicating the pipeline is already operational. The report advises organizations to maintain an up-to-date inventory of open-source tools and verify the integrity of third-party updates before deploying them across environments.
Cyber experts issue alert after two ransomware groups team up on ‘unprecedented’ threat campaign →
AI Agent Conducts First Fully Autonomous Ransomware Attack
Security firm Sysdig documented what it calls the first ransomware attack run from start to finish by an AI agent, with no human at the keyboard. Researchers named the attacker JADEPUFFER and said a large language model handled the entire job. The agent broke in, stole credentials, moved deeper into the network, planted a backdoor, then encrypted and destroyed a company’s production database. It exploited a year-old, already-patched flaw in Langflow, an open-source tool for building AI apps. Inside, the agent swept for secrets, raided a storage server with a default password, set up a backdoor pinging the attacker’s server every 30 minutes, and pivoted to a separate database server. It encrypted 1,342 settings, wiped originals, and left a ransom note demanding Bitcoin. The agent generated a random encryption key, printed it once, and never saved or sent it, making data recovery impossible even if paid. Sysdig counted more than 600 separate, purposeful actions. The agent narrated its steps in plain English, a sign of machine origin. The fixes: patch the flaw, stop exposing admin systems, and keep cloud keys away from web-facing machines. Sysdig calls JADEPUFFER a warning sign, not a crisis, but expects volume to rise as agentic tools mature.
LLM Reverse-Engineers Palo Alto Cortex XDR Detection Mechanisms
Using GPT-5.5-Cyber running in a harness called Day Shift, SpecterOps reverse-engineered Palo Alto Cortex XDR’s local endpoint detection mechanisms. The LLM identified cyinjct.dll as Cortex’s user-mode hook DLL, which installs early inline hooks. The report noted that clean ntdll remapping, direct syscalls, manual mapping, or restoring patched prologues are the highest-value user-mode bypass points. Cortex ships YARA rules locally encrypted with AES-128-ECB using an embedded key. The LLM recovered the decryption method and extracted 6,358 rule entries. Behavioral detection rules were also recovered: 8,856 effective DSE rules and 3,989 effective BIOC rules on the test host. Seven local-analysis ML models were extracted, including a PE model with 22,977 features and threshold 0.88. The LLM also created a Windows execution harness to run the model. Cortex uses CLIPS for rule logic, which was also decrypted. SpecterOps built a simulation environment that correctly identified detection and produced evasion suggestions. The post concludes that LLM-assisted EDR evasion is no longer theoretical, and endpoints security vendors must adapt, though telemetry and remote analysis remain important.
How LLM-driven EDR evasion works | SpecterOps →
Critical Amazon Q Extension Vulnerability Allows Code Execution via Malicious Repo
Wiz Research discovered a high-severity vulnerability (CVE-2026-12957) in the Amazon Q Developer Extension for Visual Studio Code. The vulnerability allowed attackers to achieve arbitrary code execution and cloud credential theft simply by having a developer open a malicious repository. Amazon Q automatically loaded MCP server configurations from workspace files without user consent, and spawned processes inherited the user’s complete environment, including AWS credentials, cloud CLI tokens, API keys, and SSH agent sockets. No dialog asked the user to approve the MCP servers, and no workspace trust check prevented execution in untrusted folders. Amazon remediated the issue in language server version 1.65.0 by adding a consent prompt that displays before loading MCP servers from workspace configurations, allowing users to review and reject untrusted commands. AWS stated that the language server updates automatically unless prevented by network configuration. The vulnerability was discovered by Maor Dokhanian on April 17, 2026, reported to Amazon Security on April 20, fixed on May 12, assigned CVE on June 23, and publicly disclosed on June 26, 2026.
Amazon Q Vulnerability: Compromise via MCP Auto-Execution | Wiz Blog →
Seiko SkyBridge IoT Routers Have Permanent OS Injection Flaw – No Patch
Seiko Solutions SkyBridge MB-A100 and MB-A110 enterprise IoT routers have a high-severity OS command injection vulnerability, CVE-2026-50043, disclosed by JPCERT/CC and Japan’s Information-Technology Promotion Agency on July 1, 2026. The vendor confirmed no firmware patch will ever be released because the product line is end-of-support. The flaw (CWE-78) resides in the web administration interface; an attacker who authenticates with administrator credentials can inject arbitrary OS commands via semicolons, pipes, or double ampersands, gaining full control of the underlying operating system. All firmware versions of both models are affected. The advisory carries a CVSS 4.0 base score of 8.6. This is the third serious vulnerability disclosure on the same hardware, following CVE-2022-36556 and multiple other issues disclosed in March 2023. Mitigations in order of priority: disable WebUI access entirely, restrict WAN-side access to specific external IP addresses, change the default admin password, and place the device on a closed network. Disabling WebUI is the most effective. The longer-term response is replacement with Seiko’s current-generation MB-A200 or MB-A130.
Seiko SkyBridge Enterprise IoT Routers Hit With Permanent OS Injection: No Fix →
Apple Compresses Patch Cycle After AI Uncovers Four WebKit Flaws
On June 29, 2026, Apple released iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, patching more than 30 security vulnerabilities. Four WebKit flaws were discovered using artificial intelligence: three by OpenAI Codex Security (CVE-2026-43707, CVE-2026-43716, CVE-2026-43745) and one by Anthropic researchers using Claude (CVE-2026-43715). The Anthropic-credited flaw is a high-impact use-after-free rated 8.8 HIGH on the CVSS scale with network attack vector, no privileges required, and complete impact on confidentiality, integrity, and availability. The other three are rated 6.5 MEDIUM with impact limited to availability. Apple explicitly stated it accelerated distribution much earlier than before because AI tools are drastically shrinking the window between disclosure and weaponization to hours. Apple described this as a publicly declared policy change. None of the four AI-credited flaws have been reported as actively exploited. Other patched vulnerabilities include kernel memory corruption and sandbox escapes, credited to various researchers.
Apple Compresses Patch Cycle After AI Uncovers Four WebKit Flaws | DeafNews →
Claude Code Can Be Tricked Into Reverse Shell via DNS Text Record
Researchers at Mozilla’s 0din team demonstrated that Claude Code can be manipulated into opening a hidden reverse shell on a developer’s device without any malicious code visible in the cloned project. The dangerous instruction arrived at runtime from a DNS text record that no scanner would inspect. The attack began with an unremarkable Markdown file explaining how to install a monitoring tool called Axiom. Running the tool without initializing it produced an error message instructing the user to execute a specific setup command. Claude Code, attempting to be helpful, automatically followed that instruction, triggering a hidden shell script that queried a DNS text record controlled by the attacker, which decoded into a base64 reverse shell command. Persistence was possible via SSH key or cron job. Regular security tools failed to detect the attack because each individual step appeared benign. 0din stressed that coding agents need to inspect what setup scripts will actually run before executing anything. The lesson extends beyond Claude Code: most agentic AI systems share similar blind spots toward indirect prompt injection, and developers should treat unfamiliar repositories as untrustworthy.
PamStealer: New macOS Infostealer Disguised as Clipboard Manager
Jamf Threat Labs identified a new Rust-based macOS infostealer named PamStealer that targets users searching for the open-source clipboard manager Maccy. A lookalike website distributes a disk image containing a malicious AppleScript file named Maccy.scpt. When opened, the file displays instructions telling users to run it in Apple’s Script Editor while hiding malicious code further down. The malware validates a victim’s login password through macOS Pluggable Authentication Modules (PAM) before stealing it. It then uses JavaScript for Automation and native macOS APIs to download a second-stage payload without common shell utilities. The second stage is a Rust binary designed for Apple Silicon Macs that disguises itself as Finder or Software Update. The dropper derives a key from host fingerprint to unlock an encrypted configuration. Once installed, it can steal browser credentials and Keychain data, monitor clipboard contents, establish persistence, and send stolen data to a remote C2 server. It can also display a fake Finder alert asking for Full Disk Access, appearing up to 40 minutes after infection, allowing access to Mail, Messages, and Time Machine backups. Jamf has not observed PamStealer active in the wild and notified Apple.
Fake Mac Clipboard App Delivers New Password-Stealing Malware →
Delhi High Court Ruling Threatens Domain Privacy Worldwide
A Delhi High Court ruling from December 24, 2025 in the case Dabur India v. Ashok Kumar imposed 14 obligations on domain registrars operating in India. Three central directives end privacy-by-default for WHOIS data, require registrars to disclose a domain owner’s name, address, phone number, and email to any party claiming legitimate interest within 72 hours, and ban registration of domain names that closely resemble protected trademarks. The ruling remains in effect while appeals are pending. GoDaddy, managing approximately 80 million domains worldwide, filed a formal appeal running more than 5,000 pages, arguing the directives unilaterally rewrite internet governance rules and conflict with India’s Digital Personal Data Protection Act. Namecheap and Hosting Concepts also filed challenges. The larger bench is scheduled to hear the case on July 16, 2026. Internet governance researchers warn that exposing WHOIS data will primarily affect journalists, activists, and private individuals, not brand impersonators who use fake registration details. The global standard under ICANN’s Registration Data Policy and RDAP makes privacy-by-default mandatory. Critics note that stronger identity verification at registration would be more effective than making all data public. The outcome of the July 16 hearing will test whether a single national court can override ICANN’s internationally negotiated frameworks.
India Court Order Puts Your Domain Registration Data at Risk Worldwide →