Threat Brief — 2026-07-09 — AI Agents Under Siege

Executive Summary

Today's intelligence is dominated by a wave of research exposing systemic security weaknesses in AI coding assistants — from symlink bypass tricks to hallucination-driven malware delivery — signaling that the developer tooling stack is now a primary attack surface. Meanwhile, Microsoft patched the public RoguePlanet Defender zero-day (CVE-2026-50656) that grants SYSTEM privileges, and the GodDamn ransomware operation is actively abusing a Microsoft-signed malicious kernel driver (PoisonX) to kill endpoint defenses. On the identity front, multiple vishing and phishing-as-a-service campaigns (Forg365, Helix, Entra passkey enrollment) are converging on Microsoft 365 and SharePoint environments.

Top Items

• Microsoft Defender RoguePlanet zero-day patched (CVE-2026-50656) — A Windows Defender privilege escalation flaw publicly disclosed in June now has a patch. CVSS 7.8; grants SYSTEM. A PoC was published by researcher "Nightmare-Eclipse." Patch immediately if not already deployed. Source

• GodDamn ransomware leverages Microsoft-signed PoisonX kernel driver — A new ransomware family uses a Bring-Your-Own-Vulnerable-Driver (BYOVD) approach with a Microsoft-signed malicious kernel driver to disable security software before encrypting. Targeting US companies. This follows the pattern of signed-driver abuse and underscores the risk in driver signing trust chains. Source

• GigaWiper destructive Windows backdoor discovered — Microsoft dissected a backdoor bundling disk wiping, fake ransomware, and spyware into one operator-selectable toolkit. Represents a convergence of destructive and espionage capabilities in a single payload. Source

• GhostApproval symlink flaws in 6 AI coding assistants — Wiz researchers found that booby-trapped repositories can hijack permission prompts in popular AI coding assistants via symlinks, tricking agents into executing arbitrary code on developer machines after a single approval. Source

• HalluSquatting attack weaponizes AI hallucinations — Attackers register malicious packages matching names that AI coding assistants hallucinate when asked to fetch tools, tricking agents into installing botnet malware. Exploits the fundamental unreliability of LLM-suggested package names. Source

• AI security-scanning agents tricked into executing malicious code — AI Now Institute PoC shows that AI agents tasked with scanning open-source code for vulnerabilities can be manipulated into running the attacker's code locally instead. Source

• Ubiquiti patches critical UniFi flaws across multiple products — Critical privilege escalation and arbitrary command execution vulnerabilities patched in UniFi Connect, Talk, Access, Protect, and OS. Update all Ubiquiti infrastructure. Source

• Vidar Stealer campaigns targeting SMBs via malvertising — Two overlapping campaigns using cracked-software lures to deliver Vidar infostealer alongside XMRig miners. Unit42 details DLL sideloading via a Go-compiled fake MpClient.dll and code-signing abuse. Source

• Forg365 PhaaS platform with AI-assisted lures — New phishing-as-a-service operation combining adversary-in-the-middle and device code phishing to steal Microsoft 365 credentials. Uses AI for lure generation. Source

• Helix vishing group targeting SharePoint environments — New data-extortion group using vishing, device code phishing, and MFA abuse to steal SharePoint data. Represents the growing trend of identity-centric data extortion. Source

• Entra passkey enrollment vishing — Active campaign targeting Microsoft 365 users across sectors with voice-based fake security requests to enroll attacker-controlled Entra passkeys. Source

• GitHub "verified" commits can be rewritten into new hashes — Research demonstrates that signed Git commit hashes are not unique identifiers; attackers without signing keys can mint second commits with identical files and signatures, undermining supply-chain integrity assumptions. Source

• Supply-chain: Injective SDK npm package compromised — Attackers compromised the Injective Labs GitHub repo to publish a malicious npm package stealing crypto wallet private keys and seed phrases. Separately, fake Paysafe/Skrill SDKs on npm and PyPI are delivering stealer malware. Source

• SCMBANKER malware targets Mexican banking via ClickFix lures — Elastic Security Labs tracks a new banking fraud operation (REF6045) hitting Mexican banks, fintechs, and crypto exchanges using ClickFix social engineering. Source

• Fake 7-Zip installers build residential proxy botnet — Threat actor "Lurking Lizard" operating 230+ lookalike domains distributing trojanized 7-Zip installers that turn victim devices into residential proxy nodes. Source

• Roundcube exploitation against academic researchers — China-linked threat cluster exploiting vulnerable Roundcube servers at US and Canadian universities for credential theft and backdoor deployment. Patch Roundcube instances. Source

Themes

AI coding assistants are the薄弱环节 of the week. At least five distinct findings — GhostApproval symlink exploits, HalluSquatting, AI agents running malicious code instead of scanning it, Copilot bypassing chat safety via code-step decomposition, and Sophos data showing AI coding agents triggering endpoint detection rules — collectively paint a picture of an emerging attack surface that most organizations have not yet instrumented or governed. Treat AI agents as a new identity class, not service accounts.

Identity-focused attacks are converging on Microsoft 365. Forg365 (PhaaS), Helix (vishing + SharePoint extortion), and Entra passkey enrollment vishing all target the same identity stack. The verification step — not the password — is now the primary ATO battleground. Ensure service-desk verification workflows are resilient to AI-powered impersonation.

Supply-chain integrity remains under sustained pressure. npm package compromise, fake payment SDKs, GitHub verified-commit hash collisions, dormant GitHub account enumeration of corporate orgs, and npm 12's decision to disable install scripts by default all point to a maturing attacker playbook targeting developer trust pathways.

Destructive malware is rebranding as ransomware. GigaWiper's bundling of wiper, fake ransomware, and spyware — alongside GodDamn's driver-based defense evasion — suggests financially motivated actors are increasingly comfortable with destructive payloads, blurring the line between extortion and sabotage.