Socket’s Threat Research Team has uncovered a sprawling phishing campaign—dubbed “Beamglea”—leveraging 175 malicious npm packages that have amassed over 26,000 downloads. These packages serve solely as hosting infrastructure, redirecting victims to credential-harvesting pages. Though randomly named packages make accidental developer installation unlikely, the download counts reflect security researchers, automated scanners, and CDN providers probing the […]
A critical vulnerability in GitHub Copilot Chat, rated 9.6 on the CVSS scale, could have allowed attackers to exfiltrate source code and secrets from private repositories silently.
The exploit combined a novel prompt injection technique with a clever bypass of GitHub’s Content Security Policy (CSP), granting the attacker significant control over a victim’s Copilot instance, including the ability to suggest malicious code or links. The vulnerability was reported responsibly via HackerOne, and GitHub has since patched the issue.
GitHub Copilot Vulnerability
The attack began by exploiting GitHub Copilot’s context-aware nature. The AI assistant is designed to use information from a repository, such as code and pull requests, to provide relevant answers.
Legit Security researchers found that they could embed a malicious prompt directly into a pull request description using GitHub’s “invisible comments” feature.
While the comment itself is hidden from view in the user interface, Copilot would still process its contents. This meant an attacker could create a pull request containing a hidden malicious prompt, and any developer who later used Copilot to analyze that pull request would have their session compromised.
Because Copilot operates with the permissions of the user making the request, the injected prompt could command the AI to access and manipulate data from the victim’s private repositories.
Bypassing Security With A URL Dictionary
A major hurdle for the attacker was GitHub’s strict Content Security Policy (CSP), which prevents the AI from leaking data to external domains.
GitHub uses a proxy service called Camo to securely render images from third-party sites. Camo rewrites external image URLs into signed camo.githubusercontent.com links, and only URLs with a valid signature generated by GitHub are processed.
This prevents attackers from simply injecting an <img> tag to send data to their own server. To circumvent this, the researcher devised an ingenious method.
They pre-generated a dictionary of valid Camo URLs for every letter and symbol. Each URL pointed to a 1×1 transparent pixel on a server they controlled, according to a legit Security report.
The final injected prompt instructed Copilot to find sensitive information in a victim’s private repository, such as an AWS key or a zero-day vulnerability description.
It would then “draw” this information as a sequence of invisible images using the pre-generated Camo URL dictionary.
When the victim’s browser rendered these images, it sent a series of requests to the attacker’s server, effectively leaking the sensitive data one character at a time.
The proof-of-concept demonstrated the successful exfiltration of code from a private repository. In response to the disclosure, GitHub remediated the vulnerability on August 14, 2025, by completely disabling all image rendering within the Copilot Chat feature, neutralizing the attack vector.
The SOC of 2026 will no longer be a human-only battlefield. As organizations scale and threats evolve in sophistication and velocity, a new generation of AI-powered agents is reshaping how Security Operations Centers (SOCs) detect, respond, and adapt.
But not all AI SOC platforms are created equal.
From prompt-dependent copilots to autonomous, multi-agent systems, the current market offers
Cybersecurity researchers have flagged a new set of 175 malicious packages on the npm registry that have been used to facilitate credential harvesting attacks as part of an unusual campaign.
The packages have been collectively downloaded 26,000 times, acting as an infrastructure for a widespread phishing campaign codenamed Beamglea targeting more than 135 industrial, technology, and energy
LLM-enabled malware poses new challenges for detection and threat hunting as malicious logic can be generated at runtime rather than embedded in code. Our research discovered hitherto unknown samples, and what may be the earliest example known to date of an LLM-enabled malware we dubbed “MalTerminal.” Our methodology also uncovered other offensive LLM applications, including […]
A critical weakness in GitHub Copilot Chat discovered in June 2025 exposed private source code and secrets to attackers. Rated CVSS 9.6, the vulnerability combined a novel Content Security Policy bypass with remote prompt injection. By embedding hidden prompts in pull requests, attackers could exfiltrate private repository data and control Copilot’s responses, including injecting malicious […]
Cybersecurity company Huntress said it has observed active in-the-wild exploitation of an unpatched security flaw impacting Gladinet CentreStack and TrioFox products.
The zero-day vulnerability, tracked as CVE-2025-11371 (CVSS score: 6.1), is an unauthenticated local file inclusion bug that allows unintended disclosure of system files. It impacts all versions of the software prior to and
A sophisticated Android spyware campaign dubbed ClayRat has emerged as one of the most concerning mobile threats of 2025, masquerading as popular applications including WhatsApp, Google Photos, TikTok, and YouTube to infiltrate devices and steal sensitive user data.
The malware demonstrates remarkable adaptability and persistence, with threat actors continuously evolving their tactics to bypass security measures and expand their reach across targeted regions.
ClayRat operates as a comprehensive surveillance tool capable of exfiltrating SMS messages, call logs, device notifications, and personal information while maintaining covert access to infected devices.
The spyware’s most alarming capability lies in its ability to capture photographs using the front-facing camera and weaponize the victim’s contact list by automatically sending malicious links to every saved contact, effectively transforming each compromised device into a distribution hub for further infections.
The campaign has demonstrated explosive growth over recent months, with security researchers documenting over 600 malware samples and 50 dropper variants within a three-month period.
Each iteration introduces new layers of obfuscation and packing techniques designed to evade detection systems, showcasing the operators’ commitment to maintaining persistence against evolving security defenses.
Attackers prompting victims to join Telegram channel (Source – Zimperium)
Zimperium analysts identified the malware’s sophisticated distribution network, which primarily leverages Telegram channels and carefully crafted phishing websites that closely mimic legitimate service pages.
The attackers have registered domains that impersonate well-known services, creating convincing landing pages that redirect victims to Telegram channels where malicious APK files are hosted with accompanying installation instructions designed to bypass Android’s built-in security warnings.
Advanced Infection and Persistence Mechanisms
ClayRat employs several sophisticated techniques to establish persistent access on target devices, with its most effective strategy involving the abuse of Android’s default SMS handler role.
This privileged system role grants the malware extensive access to messaging functions without triggering standard runtime permission prompts, allowing it to read, store, and forward text messages at scale while remaining largely undetected by users.
The spyware utilizes session-based installation methods specifically designed to circumvent Android 13’s enhanced security restrictions.
Dropper variants present fake Google Play Store update screens to victims, displaying familiar installation interfaces while secretly deploying encrypted payloads stored within the application’s assets.
This approach significantly reduces user suspicion and increases installation success rates by mimicking legitimate system update procedures.
Session based installation used by the malware (Source – Zimperium)
Once successfully installed and granted SMS handler privileges, ClayRat immediately begins its surveillance operations by capturing photographs using the device’s front-facing camera and uploading them to command-and-control servers.
The malware supports an extensive range of remote commands including application enumeration, call log exfiltration, notification theft, and unauthorized SMS transmission from the victim’s device.
Communication with command-and-control infrastructure occurs through standard HTTP protocols, with the malware implementing Base64 encoding combined with marker strings such as “apezdolskynet” to obfuscate traffic patterns.
Advanced variants employ AES-GCM encryption for secure communications while utilizing dynamic payload loading from encrypted assets to further complicate analysis and detection efforts.
The malware’s self-propagation mechanism represents its most dangerous feature, automatically composing and transmitting malicious links to every contact in the victim’s phonebook, creating an exponential infection pattern that exploits social trust relationships for rapid campaign expansion.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The RondoDox campaign’s “exploit shotgun” method leverages over 50 vulnerabilities across more than 30 vendors to infiltrate network devices, highlighting the urgent need for rapid patching and continuous monitoring. The first detected RondoDox intrusion on June 15, 2025, reused a command‐injection vulnerability disclosed at Pwn2Own Toronto 2022: CVE-2023-1389, which targets the WAN interface of TP-Link […]
Cybersecurity researchers have identified what is believed to be the earliest known instance of malware that leverages a Large Language Model (LLM) to generate malicious code at runtime.
Dubbed ‘MalTerminal’ by SentinelLABS, the malware uses OpenAI’s GPT-4 to dynamically create ransomware code and reverse shells, presenting a new and formidable challenge for detection and threat analysis.
The discovery highlights a significant shift in adversary tradecraft, where the malicious logic is not hardcoded into the malware itself but is generated on-the-fly by an external AI model.
This approach can render traditional security measures, such as static signatures, ineffective, as the code can be unique for each execution. The findings were part of broader research into how threat actors are weaponizing LLMs.
A New Generation Of Adaptable Threats
Unlike other adversarial uses of AI, such as creating convincing phishing emails or using AI software as a lure, LLM-enabled malware embeds the model’s capabilities directly into its payload. This allows the malware to adapt its behavior based on the target environment.
SentinelLABS researchers established a clear definition for this threat, distinguishing it from malware simply created by an LLM, which they note remains immature.
The primary concern with LLM-enabled malware is its unpredictability. By offloading code generation to an LLM, the malware’s actions can vary significantly, making it difficult for security tools to anticipate and block its behavior.
Prior documented cases like PromptLock, a proof-of-concept ransomware, and LameHug (or PROMPTSTEAL), linked to the Russian APT28 group, demonstrated how LLMs could be used to generate system commands and exfiltrate data. These examples paved the way for hunting more advanced threats.
The breakthrough came from a novel threat-hunting methodology developed by SentinelLABS. Instead of searching for malicious code, researchers hunted for the artifacts of LLM integration: embedded API keys and specific prompt structures.
They wrote YARA rules to detect key patterns for major LLM providers like OpenAI and Anthropic. A year-long retrohunt on VirusTotal flagged over 7,000 samples with embedded keys, though most were non-malicious developer errors.
The key to finding MalTerminal was focusing on samples with multiple API keys, a redundancy tactic for malware, and hunting for prompts with malicious intent.
The researchers used an LLM classifier to score the maliciousness of discovered prompts. This strategy led them to a set of Python scripts and a Windows executable named MalTerminal.exe.
Analysis indicated that it utilized a deprecated OpenAI chat completion API endpoint, which was retired in November 2023. This suggests the malware was developed prior to that date, making it the earliest known sample of its kind.
MalTerminal prompts an operator to choose between deploying ransomware or a reverse shell, then uses GPT-4 to generate the necessary code.
“FalconShield: A tool to analyze suspicious Python files.”
Defe.py (1)
Defensive Tool
“FalconShield: A tool to analyze suspicious Python files.”
Defe.py (2)
Defensive Tool
“FalconShield: A tool to analyze suspicious Python files.”
Cyber Defensefor Threats
The emergence of malware like MalTerminal, PromptLock, and LameHug signals a new frontier in cyber defense. The primary challenge is that detection signatures can no longer rely on static malicious logic.
Furthermore, network traffic to legitimate LLM APIs can be difficult to distinguish from malicious use. However, this new class of malware has its own weaknesses. Its dependency on external APIs and the need to embed API keys and prompts within its code create new opportunities for detection.
If an API key is revoked, the malware can be neutralized. Researchers also discovered other offensive LLM tools, including vulnerability injectors and people search agents, by hunting for these artifacts.
While LLM-enabled malware is still in an experimental stage, its development gives defenders a critical opportunity to adapt their strategies for a future where malicious code is generated on demand.
.webp)
.webp)
.webp)
