Emerging Threats

Researchers at SentinelOne have identified a new macOS malware family, attributed with high confidence to a North Korean-linked threat actor, that contains a trick security researchers have not seen before, according to Bleeping Computer.

The malware — named Gaslight — embeds 38 fake system messages inside its code. These mimic crash reports, memory dumps, token expiry warnings, and build errors. They are written in the formatting style that AI analysis tools are trained to read. The goal is not to evade a sandbox (an isolated environment where security teams safely detonate malware), but to confuse the AI assistant reading the output — making it think its own analysis session has broken down and should be abandoned.

It is the software equivalent of telling the security camera operator that the monitor is broken. SentinelOne notes the technique did not demonstrably bypass any specific platform, but the intent is clear: attackers are now designing malware with AI defences specifically in mind.

What to do: If your organisation uses AI-assisted security tooling, ask your vendor how their platform handles prompt injection (attempts to manipulate AI behaviour through embedded instructions) in analysed samples.

Researchers at SentinelOne have uncovered a new piece of macOS malware, named Gaslight, attributed with high confidence to North Korea-aligned attackers, as detailed in The Hacker News.

Gaslight steals credentials, browser data, and system information in the usual way. What makes it unusual is a built-in attack against AI-assisted security analysis. Hidden inside the malware is a block of fake system error messages — fabricated warnings about memory failures, disk errors, and token expiry — designed to confuse an AI triage tool into thinking analysis has crashed or should stop. It targets the analyst's AI assistant, not the sandbox it runs in.

Think of it as a malicious footnote that whispers to the reader: "nothing to see here, the document is corrupted."

macOS users should ensure their security software is current, and security teams using AI-assisted tools should treat unexpected analysis failures as a reason to investigate further, not a reason to move on.

Security firm AIR built a malicious AI agent skill (a bundle of instructions that an AI agent loads and executes with roughly the same authority as a direct user command), published it to a marketplace, ran an Instagram ad, and watched it reach approximately 26,000 agents — including corporate ones. Every scanner it was tested against rated it clean, according to The Hacker News.

The trick was structural. Scanners examine what ships inside the skill package. AIR's skill contained nothing suspicious — it pointed to an external URL for setup instructions. That URL was clean at scan time. After widespread installation, AIR swapped the page to deliver a script instead.

The payload in this case only collected email addresses. A real attacker could read files, exfiltrate data, or pivot into internal systems.

What to do: Treat AI agent skills like software installs, not app store downloads. Vet every external URL a skill references, and restrict agent permissions to the minimum required for the task.

Security researcher and SANS Institute author Ismael Valenzuela has published an analysis on agentic AI — systems that do not just assist attackers but act autonomously on their behalf — and the picture is unsettling. According to The Hacker News, the shift from AI-as-assistant to AI-as-agent means an attacker no longer needs to carry out each step of an attack manually. They set an objective; the agent walks the path.

The practical consequence: attackers with little to no technical skill can now run sophisticated, multi-step campaigns. The Canadian Centre for Cyber Security has already warned that AI-driven exploitation may outpace vendors' ability to release patches.

For defenders, there is a narrow silver lining. Because unskilled attackers using similar AI models tend to produce similar attack patterns, those patterns become recognisable — and detectable. The organisations that learn those patterns now will be ahead of the ones that do not.

State-sponsored group Sapphire Sleet — also known as BlueNoroff — hijacked the Mastra NPM package ecosystem on 17 June. Mastra is an open-source TypeScript framework developers use to build AI agents and automated workflows.

In a 45-minute window, the attackers compromised a legitimate package maintainer account and pushed 141 modified packages, each containing a malicious dependency that masqueraded as a popular date library. The affected packages have roughly 8 million weekly downloads.

Any developer who ran npm install during that window — even on a build server, not a personal machine — may have executed the malicious payload. The malware collected system information and targeted over 160 cryptocurrency browser extensions.

This is a supply chain attack (where the compromise happens upstream, inside a trusted tool, before it reaches you). Cybersecurity firms Aikido, Ox, Socket, Sonatype, and StepSecurity have published indicators of compromise. If you use Mastra, check their advisories and rotate all credentials immediately.

The Mastra AI supply chain attack is worth examining as an emerging threat pattern, not just a one-off breach. Sapphire Sleet did not hack developers directly. Instead, according to Bleeping Computer, they compromised a single package maintainer account and used it to push malicious code into 140+ packages that developers were already trusting and installing automatically.

AI development frameworks are a particularly attractive target here. Developers building AI tools frequently install large numbers of third-party packages, often in automated pipelines that run without human review at each step. The attackers exploited exactly that trust. Once inside a developer's machine, they went specifically for cryptocurrency wallets and API keys — a financially motivated choice consistent with Sapphire Sleet's broader campaign history.

What to do: If your team uses npm packages in AI or any other development work, consider enabling package integrity checks and auditing install logs for unexpected post-install script execution.

The Mastra AI supply chain attack is worth examining as an emerging threat pattern, not just a one-off breach. Sapphire Sleet did not hack developers directly. Instead, according to Bleeping Computer, they compromised a single package maintainer account and used it to push malicious code into 140+ packages that developers were already trusting and installing automatically.

AI development frameworks are a particularly attractive target here. Developers building AI tools frequently install large numbers of third-party packages, often in automated pipelines that run without human review at each step. The attackers exploited exactly that trust. Once inside a developer's machine, they went specifically for cryptocurrency wallets and API keys — a financially motivated choice consistent with Sapphire Sleet's broader campaign history.

What to do: If your team uses npm packages in AI or any other development work, consider enabling package integrity checks and auditing install logs for unexpected post-install script execution.

Microsoft researchers detailed an exploit chain called AutoJack that turns an AI browsing agent (software that surfs the web and takes actions on your behalf) into a delivery mechanism for an attacker to run their own code on your machine, according to The Hacker News.

Here's the chain: get the agent to open a malicious web page, and that page's code can reach a privileged local service running on the same computer and launch a process. No password prompt, no extra click needed once the page loads. Getting the agent there just takes a planted link or even a hidden instruction buried in a webpage that the agent reads and follows without you seeing it.

The flaw lives specifically in AutoGen Studio, an open-source interface for building AI agents, in its default installed version.

What to do: If you or your team experiment with AI browsing agents, avoid pointing them at unfamiliar or untrusted websites, and check whether your setup has been updated past the flawed version before letting an agent browse unsupervised.

Researchers at Aikido Security found 15 malicious plugins on the JetBrains Marketplace, a store where developers download add-ons for their coding tools, according to The Hacker News. The plugins posed as AI coding assistants built on DeepSeek and other AI models, and they worked exactly as advertised: chat, code review, bug-finding, the works.

The catch was hidden underneath. Each plugin asked users to enter their own API key, a private password-like code that lets software talk to an AI provider on your behalf, then quietly sent that key to a server controlled by the attacker. Two of the plugins had more than 25,000 downloads each. Once attackers have your API key, they can run up usage charges on your account or access whatever data that key is connected to.

What to do: Only install developer plugins from the official publisher of the AI tool you actually use, and revoke any API key you entered into a third-party plugin you cannot fully verify.

A ransomware operation called DragonForce has found a way to disguise its command-and-control traffic — the communications channel between attackers and malware on a victim's machine — inside Microsoft Teams' own relay infrastructure.

Their custom malware, Backdoor.Turn, abuses the TURN protocol (a networking standard Teams uses to route messages when a direct connection isn't possible) by obtaining an anonymous Teams visitor token and routing attacker traffic through Microsoft's own legitimate relay servers. To a defender watching network traffic, it looks like ordinary Teams activity.

The technique was used in an attack against a major US services company, according to researchers at Symantec. The implication for defenders is serious: traffic filtering tools that trust Microsoft infrastructure by default may not catch this. Security teams should not treat Teams-associated traffic as inherently safe.