Threats Day: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

Summary: This week's ThreatsDay bulletin rounds up thirteen-plus stories, including an npm package named @copilot-mcp/apex that acts as a postinstall dropper installing a 707-line AMOS-family macOS infostealer that harvests browser credentials, 20+ crypto wallets, SSH keys, AWS and Kubernetes credentials, the login Keychain, Telegram, and shell history. Other items include a fake VS Code extension impersonating 'Markdown All in One' (14 million downloads), a malvertising campaign that hit at least 29 organizations between July 21 and July 22, 2026 via a malicious Claude Artifact delivering SectopRAT, and a CISA update on Iranian-affiliated activity disrupting Rockwell, Schneider, and Siemens PLCs in U.S. water, energy, and government sectors.
Bottom line: The npm dropper's payload pulls AWS and Kubernetes credentials, SSH keys, and the login Keychain off any developer machine that runs a single install command, then sets a LaunchAgent polling attacker infrastructure every 60 seconds so the infection outlives the first exfiltration. And the Iranian-affiliated PLC activity has already disrupted operational technology across U.S. Water and Wastewater Systems, Energy, and Government Services - sectors where a manipulated HMI display is not an IT ticket.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026