Emerging Threats

A China-aligned threat group called TA419 ran a targeted campaign in July impersonating US government officials to steal credentials from AI policy researchers at think tanks, universities, and law firms, according to Dark Reading.

The approach skips straight to a phishing link only after building apparent legitimacy first. Targets received emails from people who appeared to be real, credible contacts — including someone posing as a former White House science policy official — inviting them to join fictitious advisory committees. Once a reply came, a follow-up link led to a fake Microsoft OneDrive page using an adversary-in-the-middle (AiTM) attack (where attackers sit between the victim and a real login page, intercepting credentials in real time).

Proofpoint, who identified the campaign, notes TA419 has been running similar operations against US and Japan-based targets since at least April 2025, with an earlier February operation impersonating an Anthropic employee against a US think tank.

What you should do: If you work in policy, research, or government-adjacent roles, verify any unexpected professional invitation by contacting the supposed sender through a known, independent channel before clicking anything.

Security firm Huntress has identified a campaign where attackers built malicious Custom GPTs — customised ChatGPT instances that anyone can create for specific purposes — and used OpenAI's own domain to deliver malware, according to Dark Reading.

Victims reach the fake bot through the legitimate ChatGPT website, so the URL looks trustworthy. When a user types any prompt, the bot claims the service is unavailable and redirects them to a fake page with a ClickFix prompt — a social engineering (manipulation) technique that tricks users into copying and pasting a system command to "fix" a problem that does not exist. Executing that command installs a RAT (remote access trojan — malware that gives attackers persistent, hidden control of a device). Huntress has responded to at least 40 incidents tied to this campaign.

If you use Custom GPTs, be suspicious of any bot that redirects you elsewhere or asks you to run commands. Legitimate services never ask you to paste code into your own terminal to fix an access issue.

Researchers at ThreatDown have identified a new botnet called Carbonato, according to Dark Reading. Docker is software that lets developers run applications inside isolated containers on a server. Carbonato targets Docker installations where the remote management port (2375) has been left open and unprotected — something Docker explicitly advises against.

Once inside, the botnet installs an AI agent that takes instructions from an attacker-controlled Telegram chat, hunts for AI API keys (credentials that allow access to paid AI services), and then spreads to neighbouring servers doing the same thing. The agent is built on an open source framework, meaning the attacker assembled this from publicly available parts.

The fix is straightforward: if you manage any servers running Docker, verify that port 2375 is not exposed to the internet.

Poper Blocker, a Chrome extension with over two million active users and a 4.8-star rating, is spyware, according to research by Bay Area Labs shared exclusively with Dark Reading.

Despite carrying Google's "Featured" badge and "Established Publisher" status, the extension exfiltrates (secretly sends out) detailed browser histories, page screenshots, and full chat logs from Claude, ChatGPT, and Gemini — including prompts, responses, subscription tiers, and model choice. It also assigns users cross-device IDs to link activity across multiple machines. The extension uses code obfuscation (deliberately scrambled code designed to hide what a program is actually doing) to conceal its behaviour.

Bay Area Labs reported Poper Blocker to Google. The app remained live as of the article's publication. Two other extensions from the same developer, also "Featured," had been flagged as spyware years prior.

What to do: Open Chrome, go to Extensions, and remove Poper Blocker if it is installed. Review all your installed extensions — delete anything you do not actively use or recognise.

Researchers at Flashpoint have published analysis of "process parameter poisoning," a technique that slips malicious code past EDR (endpoint detection and response — software that monitors computers for signs of attack) tools on Windows machines, according to Dark Reading.

Most EDR products watch for a specific set of Windows system calls associated with process injection (inserting code into another running program). This technique bypasses that entirely — instead hiding a malicious payload inside the startup structures Windows automatically creates when launching a new process.

When Flashpoint combined the base technique with DLL unhooking (restoring Windows functions that security software has modified to monitor activity), the test produced no alerts and no blocks from the security platform under review. The technique has not yet been seen in real-world malware. Flashpoint recommends defenders shift focus to monitoring what processes actually do — watching for code running from unusual memory locations and unexpected changes to memory permissions — rather than relying solely on known API call patterns.

Researchers at Vigilance Security have identified a large-scale campaign, dubbed "Dark Sourcery," that is poisoning the results delivered by ChatGPT, Google Gemini, and Google AI Overview, according to Dark Reading.

Attackers are flooding the web with fake support pages, fraudulent phone numbers, and phishing login portals — then using SEO (search engine optimisation, the process of making web pages rank higher in results) to ensure AI chatbots scrape and repeat this content as fact. When you ask an AI for a customer support number for your bank, it may hand you a criminal's call centre instead. At least 374 companies have been swept up, including Delta, Chase, and Bank of America.

What makes this especially dangerous: a study found 91% of AI chatbot users do not verify the answers they receive. Treat AI-provided contact details the same way you would a random Google result. Look up phone numbers and support pages directly on the official website instead.

A newly discovered Android trojan called RatHat takes mobile malware further than most, according to SecurityWeek.

RatHat spreads through smishing (SMS-based phishing) and malicious ads. Once installed, it does the expected — stealing passwords and overlaying fake banking app screens — but it also connects to a generative AI assistant that reads what's on your screen and navigates the phone's interface automatically, without needing a human operator. It captures PINs by recording exactly where your finger touches the screen at the hardware level.

The part that makes removal particularly painful: even if you delete the app, a hidden background service left behind will silently reinstall it.

What to do: Only install Android apps from the official Google Play Store. If your phone begins behaving strangely — apps opening on their own, unfamiliar services running in the background — run a scan with a trusted security app and consider a factory reset.

Spain's data protection authority, the AEPD, this week described a confirmed incident in which a hacker used an AI agent (an autonomous AI system that can chain tasks together and act without step-by-step human instruction) to breach an unnamed organisation's internal systems, according to Dark Reading.

The attacker directed the AI to scan for exposed files belonging to the target. That sweep turned up corporate credentials. The AI then logged into an internal application and searched for further vulnerabilities inside it — finding one. The attacker used that access to modify personal data records and pull corporate invoices.

The concern here is speed. A human attacker pauses, thinks, and reacts. An AI agent runs continuously, adapting at machine speed. Incident response built around human-paced attacks is not designed for this.

What you should do: If you manage any corporate systems, audit what is publicly accessible — exposed configuration files and credential stores are exactly what these scans hunt for.

A newly disclosed proof-of-concept attack called BragJack can hijack the AI assistants built into five major browsers — Google Chrome with Gemini, Microsoft Edge with Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome — according to Dark Reading.

Researcher Gal Weizman at Forever Security found that each browser failed to properly isolate its AI agent from browser extensions. A malicious extension could cross that boundary and feed the AI a stream of instructions until it complied — taking screenshots, reading local files, and activating the camera or microphone, all without a user click. No prompt injection (hiding instructions in content for the AI to read) was needed; attackers could simply issue direct commands.

All five companies were notified, patches have been issued, and Google and Microsoft awarded CVEs for their respective flaws.

What you should do: Keep your browser updated. Only install extensions from sources you genuinely trust — every extension you add is a potential entry point.

The pro-Ukraine hacktivist group Hacking Cat has moved well beyond website defacements, according to a report by The Record. Researchers at Kaspersky identified two new malware families linked to the group: Gorilla RAT, a remote-access tool that lets attackers control a victim's machine from a distance by tunnelling network traffic inside corporate systems, and Monkey Ransomware, which encrypts files and appends a ".monkey" extension.

The group exploited vulnerabilities in Microsoft Exchange servers to gain an initial foothold before deploying these tools. Kaspersky noted the unusually rapid development of multiple ransomware variants across different programming languages, suggesting generative AI may have assisted in writing or modifying the code.

Several hacktivist groups appear to be sharing the same custom tools and infection chains — making it harder to pinpoint who is behind any individual attack.

What to watch for: Organisations using Microsoft Exchange should ensure all available patches are applied and monitor for unexpected outbound network connections.