Elastic Security Labs documents a technique where coding agents create reverse tunnels and LaunchAgents to expose local admin applications to the internet, potentially providing remote access despite benign appearances. Security teams should treat this activity as high severity even when it resembles legitimate development operations rather than confirmed malware, as the outcome—exposing privileged services—represents significant risk regardless of intent.
Read full article at Elastic Security Labs ↗Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Three banking trojans are currently active threats: Manic, which incorporates spyware capabilities; Grandoreiro, which maintains persistent campaigns targeting victims in Latin America and Europe; and ToxicPanda 2.0, an expanded variant of the ToxicPanda malware. Security professionals should monitor these banking trojans as they demonstrate ongoing development and geographic targeting sophistication.
Researchers at KnowBe4 have identified a new variant of Agent Tesla malware employing innovative emoji-based code obfuscation techniques to bypass security detection systems. This v4 iteration represents an advancement in the malware's evasion capabilities, demonstrating attackers' ongoing efforts to stay ahead of traditional threat detection methods.
Threat actors are leveraging the popularity of AI tools by impersonating well-known brands like Perplexity, Claude, ChatGPT, and Copilot to distribute malware including information stealers, backdoors, and malicious browser extensions. According to Sophs' analysis of 12 months of managed detection and response cases, 34 confirmed instances of malicious AI-related activity were identified, demonstrating the effectiveness of AI brand impersonation as a social engineering vector.