ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

Summary

This week's ThreatsDay bulletin highlights a variety of cyber threats, including a macOS infostealer distributed via npm packages, a malicious VS Code extension impersonating a legitimate tool to steal data and execute commands, and a new banking malware targeting Portuguese users. Additionally, PyPI and GitHub Enterprise Server have implemented new security measures to prevent supply chain attacks and ensure support integrity.

Full text

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Ravie LakshmananJul 23, 2026Hacking News / Cybersecurity News Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. The danger was easy to miss because it looked ordinary. Here is the full list: Support uploads face cutoff GitHub Announces GHES Security Change GitHub has announced an upcoming security change that may affect GitHub Enterprise Server (GHES) support bundle uploads. "Beginning August 18, 2026, GitHub will start rejecting command-line support bundle uploads from older GHES appliances that have not been updated with the required security patches," GitHub said. "To avoid any disruption when submitting support bundles with ghe-support-bundle, ghe-cluster-support-bundle, or ghe-support-upload commands, please update your GHES instance to the latest patch release available for your current version line." At minimum, the required patch versions are: 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18. Npm install triggers stealer Npm Dropper Delivers macOS Infostealer An npm package named @copilot-mcp/apex has been found to act as a postinstall dropper that installs a macOS infostealer on any machine that runs npm install or npx @copilot-mcp/apex. The same payload is said to have been distributed via another dropper named @apexfdn/apex. "On macOS, the dropper's second stage decrypts and runs an AppleScript payload through osascript," SefeDep said. "The decrypted payload is a 707-line AMOS-family stealer: it phishes the login password through a fake system prompt, then harvests browser credentials, 20+ crypto wallets, SSH keys, AWS and Kubernetes credentials, the login Keychain, Telegram, and shell history into /tmp/osalogging.zip and uploads it over chunked HTTPS PUT to attacker infrastructure." The malware also sets up a LaunchAgent that polls the attacker's command-and-control server every 60 seconds to ensure that the infection outlives the initial exfiltration. Fake extension opens backdoor Counterfeit VS Extension Steals Machine Data A Microsoft Visual Studio Code (VS Code) marketplace extension called "Markdown All Pro" ("markdown.markdown-all-pro") has been found to impersonate the legitimate "Markdown All in One" extension with over 14 million downloads. Installing the rogue extension allows the machine's details to be shipped to the attacker and opens a channel through which the operator can send any additional commands without having to touch the extension again. "On install, these beacon the machine's username and hostname to a hardcoded IP over cleartext HTTP and fetch a remote file to disk, with no user interaction required," Manifold Security said. "This one is small, but it deliberately misrepresents itself as a trusted tool, and the remote fetch it performs is a live delivery channel whose payload the operator can change at any time." After the extension was removed by Microsoft, it reappeared under an identical name ("MarkdownLinks.markdown-links-pro"). The second extension has since been taken down as well. Old releases locked down PyPI Rejects New Files After 14 Days The Python Package Index (PyPI) has made a new security change that rejects new files being uploaded to releases that are older than 14 days. "This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised," PyPI said. "As far as we are aware, this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible." Phishing delivers banking malware Lampion Malware Targets Portuguese Users A new malware campaign is targeting Portuguese users through phishing emails impersonating financial and administrative communications to deliver the Lampion banking malware. First publicly documented in December 2019, the Brazilian banking malware family is derived from the ChePro lineage, and has consistently targeted Portugal and other Portuguese-speaking users. "Initial payloads are delivered through ZIP archives containing heavily obfuscated HTML files designed to evade static detection and analysis," Acronis said. "The HTML stage retrieves and executes additional scripts from attacker-controlled infrastructure, leading to the deployment of a multistage VBS infection chain. Each stage employs extensive obfuscation techniques, including junk code, encrypted strings and dynamically generated scripts, significantly inflating file sizes while concealing core functionality. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis and reducing the visibility of malicious activity." Call endings trigger ads New AfterCall Android Ad Fraud Scheme Exposed DoubleVerify has uncovered a growing wave of "AfterCall" apps that trick users into granting special permissions, which then display intrusive ads immediately after Android users end a phone call. The ad fraud scheme is assessed to be responsible for hundreds of millions of ad impressions. "The fraud works by tricking users into granting overlay permissions, allowing malicious apps to display ads outside their normal context," DoubleVerify said. "The apps also use evasion techniques that make them difficult for users to identify and uninstall." Fake Claude app drops RAT Claude Desktop Malvertising Campaign Targets 29 Organizations with SectopRAT Huntress disclosed that between July 21 and July 22, 2026, at least 29 organizations fell victim to a malvertising campaign that redirected them to a malicious Claude Artifact publicly hosted on the legitimate Claude.ai domain. "The malicious Claude Artifact redirected users to an attacker-controlled domain, where they downloaded what looks like a legitimate Claude desktop app (ClaudeDesktop.exe)," Huntress said. "In reality, the executable led to the download of SectopRAT. The attackers used an array of anti-analysis techniques, including packaging the malware with VMProtect to make it difficult to reverse engineer and checking the graphics hardware on systems before deciding whether to actually execute the malicious payload as a way to suss out VMs." The public Claude Artifact has been removed as of July 22, 2026. The campaign has been codenamed FakeAgent. Image hides agent instructions GhostCommit Hides Prompt Injection in Images to Trick AI Agents A new attack technique called GhostCommit employs a pull request that can steal a repository's secrets by hiding the malicious instruction inside a PNG image that's processed by an LLM reviewer. "The text rendered in that image names .env, tells the agent to read it byte-by-byte, to encode each byte as its ASCII codepoint, and ends with a self-check that must pass before commit: the decoded numbers have to equal the real .env," the University of Missouri-Kansas City's ASSET Research Group said. "The image is the only place in the entire pull request where any of this appears. Unfortunately, for a text-based reviewer, an image is a binary blob, so there is nothing to read." Once the change is committed and merged, the payload just sits in the repository, dormant, until the trap springs itself when a victim prompts the coding agent in an unrelated session. "The developer asks the coding agent for something ordinary, say a token-tracking module," the researchers said. "The agent reads the merged AGENTS.md at startup, follows the pointer to build-spec.png, reads the procedure rendered inside, opens .env, and writes the requested module with a provenance constant near the top." Iran-linked actors target PLCs CISA Issues Alert About Iran-Affi

Indicators of Compromise

• malware — AMOS-family stealer

Entities