When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence has documented attacks targeting exposed AI workloads, with threat actors exploiting LiteLLM gateways to harvest credentials and establish persistence on compromised systems. The research highlights how attackers are leveraging these compromised AI infrastructure components for cryptomining and other malicious purposes, underscoring the need for organizations to secure their AI gateways and control points against emerging threats.
Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found that while AI may accelerate malware development cycles, only 12 samples successfully reached production endpoints, suggesting minimal impact on attack effectiveness. The research indicates that despite AI's capability to speed up creation, the actual success rate of AI-generated malware remains low, implying that traditional detection and prevention measures continue to provide meaningful protection.
Threat actors are impersonating employers on the Indeed job board to distribute malicious Android applications disguised as interview tools to unsuspecting job seekers. Once installed, these fake apps deliver spyware capable of compromising victim devices. This campaign exploits the trust job applicants place in legitimate recruitment platforms to gain initial access.
A previously unknown Windows backdoor called SLEEPWALKER has been discovered by an independent researcher, featuring a dormant-until-triggered mechanism that activates only upon receipt of a specially crafted network packet. Once activated, the unsigned 64-bit DLL executes commands using a custom 23-instruction bytecode language, designed for side-loading into legitimate processes. This stealthy approach allows the malware to remain undetected in memory until explicitly triggered by an attacker.