Afternoon Review in IT Security — July 30, 2026

The cybersecurity landscape continues to evolve with sophisticated threat actors deploying advanced backdoors, exploiting trusted software, and targeting emerging AI platforms. Today's threat intelligence reveals campaigns spanning Central Asia, macOS systems, and South Korean financial infrastructure, alongside critical vulnerabilities in AI orchestration tools.

OctLurk and SilkLurk: Newly Identified Tailored Backdoors in Cyber-Espionage Campaign in Central Asia

Security researchers have uncovered two previously undocumented backdoors, OctLurk and SilkLurk, operating primarily in memory and targeting Central Asian entities. These sophisticated malware families employ plugin injection mechanisms to establish remote shells, conduct network reconnaissance, extract credentials, and perform keylogging activities. The campaign demonstrates advanced tradecraft typical of state-sponsored cyber-espionage operations focused on the region.

The identified infrastructure includes the domain dns.ssentialserv.xyz and the IP address 154.196.162.76, alongside multiple malware samples and associated tools including LurkProxy and PlugX variants. Source: OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Fake Claude Install Guide Delivers Six-Stage macOS Stealer and RAT, Huntress Finds

Huntress security researchers have identified a previously undocumented macOS malware family called MacSync, distributed through malicious sponsored advertisements impersonating installation guides for Anthropic's Claude AI assistant. The attack chain begins when users search for Claude installation instructions on Google and click poisoned sponsored results, triggering a sophisticated six-stage infection process that steals credentials and establishes remote access capabilities.

This supply-chain attack demonstrates the risks posed by malicious advertising targeting popular AI tools and highlights the vulnerability of users seeking legitimate software installation guidance. Source: Fake Claude Install Guide Delivers Six-Stage macOS Stealer and RAT, Huntress Finds

Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts

South Korean authorities and four security firms have disclosed a state-sponsored watering-hole campaign that compromised trusted domestic websites to exploit vulnerable AnySign4PC installations. The attackers leveraged a zero-day vulnerability in the locally installed financial-security software to silently deploy SIGNBT or COPPERHEDGE backdoors to targeted visitors without user interaction or prompts. This campaign exemplifies the persistent threat to critical financial infrastructure in the region.

The exploitation of trusted domestic websites combined with a zero-day in widely deployed software demonstrates the sophistication of state-sponsored actors targeting South Korean institutions. Source: Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts

Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms

A critical vulnerability in Ruflo, an AI orchestration platform, allows unauthenticated attackers to execute arbitrary commands within the MCP bridge container by sending HTTP requests to an exposed endpoint. The vulnerability, tracked as CVE-2026-59726, poses significant risks to organizations deploying Ruflo for AI agent management and could enable attackers to spawn unauthorized AI swarms and compromise downstream systems.

This vulnerability highlights the emerging security challenges in AI infrastructure and the importance of implementing proper authentication controls on exposed endpoints. Source: Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms

Today's threat landscape underscores the need for heightened vigilance across multiple attack vectors, from traditional backdoor campaigns to emerging threats targeting AI infrastructure. Organizations should prioritize patching critical vulnerabilities, validating sponsored search results, and implementing robust authentication mechanisms across all internet-facing systems.