ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories

Summary

This week's ThreatsDay bulletin highlights multiple cybersecurity threats, including potential Chinese telecom infrastructure risks in the US facilitated by Salt Typhoon, SideWinder's new ClickOnce phishing attack chain delivering Rust backdoors, and a large-scale npm supply chain attack dubbed 'Flooding Dropper' with 846 malicious packages. Additionally, research reveals coding agents can execute code before the first prompt, posing a significant risk.

Full text

ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories Ravie LakshmananAug 06, 2026Hacking News / Cybersecurity News Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor. Nothing here is especially mystical. Just ordinary systems trusting slightly too much, slightly too early. The full list follows. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. China-linked telecom risk Chinese Telcos Maintain U.S. Presence The U.S. Congress's bipartisan Select Committee on China has published a 49-page report named "Stranger Pings," highlighting the threat of China-controlled infrastructure in the U.S. telecommunications backbone. The Committee said the Salt Typhoon campaign could have been facilitated via a residual footprint that leaves open the door to future cyber operations against the U.S.: Chinese (aka People's Republic of China or PRC) telecom firms operating in the U.S. do not act independently and keep trusted positions inside U.S. communications infrastructure that Chinese threat actors can potentially abuse to preserve access and hide activity. "One PRC telecommunication provider included an 'Acceptable Use' Policy in contracts with U.S. companies," the Committee said. "This prohibited the broadcasting of political news against state laws of the PRC, the broadcasting of information in violation of PRC state security laws, and the broadcasting of information in violation of the 'social order and social stability.'" ClickOnce phishing chain SideWinder Deploys New Attack Chain The threat actor known as SideWinder has adopted a new multi-stage attack chain that abuses ClickOnce application files delivered via phishing PDF documents to deliver Rust-based backdoors. The implants can establish persistence via registry modification, collect host intelligence, and accept remote commands over external servers hosted on free serverless platforms such as Cloudflare Workers. npm supply chain attack Flooding Dropper Hits npm With 850 Malicious Packages An active malicious package campaign, dubbed "Flooding Dropper," has disclosed a large-scale campaign involving 846 software components. "The attacker appears to be automating parts of the npm account and package creation process, combining terms such as bigops and bnpl with other words and recurring version patterns, such as releases in the 35.x.y range," Sonatype said. "When installed, the packages download and execute a second-stage payload, using multiple delivery methods to improve the attack's chances of success. The packages also contain slightly modified payloads. While syntactically different, for example using different URL functions and variable names, the packages all execute the same behavior. Those changes can reduce the effectiveness of detections that depend on exact signatures, even when the underlying behavior remains closely related." The packages deliver a first-stage JavaScript loader that identifies the host operating system and delivers a compatible Windows, Linux, or macOS payload from a randomized set of hard-coded remote hosts and runs it as a detached background process. On Windows, the downloaded binary is another loader that performs checks for sandboxed and virtual environments, patches Event Tracing for Windows and Antimalware Scan Interface functions, establishes persistence via a scheduled task, and downloads and executes an encrypted payload. Coding agent execution risk Coding Agents Expose Pre-Prompt Code Execution Paths New research from Datadog has found that "Trusting a repository in a coding agent can allow repository-controlled code to run before you send the first prompt," causing seemingly harmless tasks like cloning a repository to be an attack vector. "Codex MCP configuration and Claude Code project environment settings created automatic code-execution paths without a model response or shell-command approval," Datadog said. "Treat project trust like running code. Open unfamiliar repositories in disposable environments without sensitive credentials, even if a quick manual review looks clean." Earlier this May, Datadog also highlighted the risks associated with Claude Code skills. "Agentic skills package instructions and context for coding agents," it said. "They are useful for repeatable workflows, but they also create a path for attacker-controlled instructions to enter a trusted agent session. The important detail is not only that a malicious skill can ask an agent to do something dangerous. It is that dynamic context commands run before the model sees the skill at all. When that happens, model-level prompt injection defenses never get a chance to intervene." AI-powered cyber attack Chinese Actor Weaponizes DeepSeek in Cyber Attack A DeepSeek AI agent attacked the network of Tel Aviv-based AI cybersecurity firm Jesta Security in early July 2026 as part of an LLM-managed cyber attack campaign for proxyjacking and other follow-on attacks. The development is the latest example of how threat actors are relying on AI agents to break into third-party networks. "During our research on defense against AI attackers, we took our lab and stood it up in the field, behind US-based infrastructure," security researcher Lior Finkelshtein said. "We opened a port and waited for attackers to come to us. Within a week, we had logged over 300,000 attempts to break in: botnets, credential stuffing, the usual internet noise. And then something surfaced that did not fit the pattern." The activity has been linked to a Chinese threat actor. Jesta said it managed to steer the AI agent into extracting its own target list, identifying over 1,200 victim hosts that had been targeted in a similar manner. "The goal was proxyjacking: install a small SOCKS5 proxy, open it to the internet, and quietly turn a weakly secured rented server into an exit node for someone else's traffic and attacks," Jesta said. macOS malware upgrade New XCSSET Malware Version Spotted A new version of the XCSSET malware (version 40) is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. "This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint," Palo Alto Networks Unit 42 said. "V40 further enhances its detection evasion capabilities by combining polymorphic payload generation with fileless persistence and dynamic in-memory execution, while weakening a number of security mechanisms on the affected machine." The malware author, per Unit 42, has enhanced the ability of the malware to spread through open-source projects on GitHub and upgraded its worming capabilities. It can now infect all existing Xcode projects on a compromised system for maximum impact. The malware supports browser hijacking (specifically targeting Google Chrome) to inject JavaScript that can intercept web traffic, credential theft, clipboard monitoring, and data exfiltration capabilities. A new addition is a Telegram trojanizer that deletes the legitimate Telegram Desktop application on infected systems and replaces it with a malicious version with an intent to siphon victims' communications. The new version has been observed in two distinct attack waves in mid-April and in early May 2026. LLM pentesting lessons Training LLMs on Long-Horizon Pentesting Tasks Novee Security has published its learnings from training large language models (LLMs) for pentesting. This includes handling silent failures, having a weight-sync strategy, and how prefix breaks can cascade into performance drops in AI workloads. "An RL [Reinforcement Learning] pipeline is a complex system with many moving pa

Indicators of Compromise

• malware — Rust-based backdoors
• malware — JavaScript loader

Entities