Threat Brief — 2026-07-10 — AI Tooling Under Siege

Executive Summary: Today's intelligence is dominated by a tidal wave of research exposing AI coding assistants and agents as both attack vectors and noisy operational risks — from symlink escape flaws to hallucinated package squatting to agents tripping EDR rules. Active threats include a patched Windows Defender zero-day (RoguePlanet, CVE-2026-50656), the GodDamn ransomware family abusing a Microsoft-signed malicious kernel driver, and a surge in identity-focused attacks targeting Microsoft 365 via vishing and phishing-as-a-service. Supply-chain compromise continues with malicious npm/PyPI packages and a GitHub repo hijack.

Top Items

• Microsoft patches RoguePlanet Defender zero-day (CVE-2026-50656, CVSS 7.8) — A Windows Defender privilege escalation flaw granting SYSTEM privileges, disclosed publicly last month after a PoC was dropped by "Nightmare-Eclipse." Patch now available. MSRC / BleepingComputer / The Hacker News

• GodDamn ransomware uses BYOVD via PoisonX kernel driver — A new ransomware family leverages a Microsoft-signed malicious kernel driver to kill endpoint security tools. Demonstrates continued BYOVD (bring-your-own-vulnerable-driver) effectiveness against US companies. Dark Reading / The Hacker News

• GhostApproval symlink flaws in six AI coding assistants — Wiz researchers found that booby-trapped repos can exploit symlink handling in popular AI coding assistants (Claude Code, Cursor, Codex, and others) to silently execute code outside the approved file path. Developers using these tools on external repos are at immediate risk. The Hacker News

• HalluSquatting attack weaponizes AI assistant hallucinations — Researchers demonstrated that AI coding assistants can be tricked into recommending non-existent package names, which attackers pre-register to deliver botnet malware. A new software supply-chain attack surface. The Hacker News

• AI coding agents triggering endpoint security detection rules — Sophos observed Claude Code, Cursor, and OpenAI Codex routinely setting off EDR rules designed to catch human intruders (file access patterns, registry edits, process spawning). Not malicious, but creates alert fatigue and potential for real threats to hide in the noise. The Hacker News

• Entra passkey enrollment vishing targeting Microsoft 365 users — Active multi-sector voice-phishing campaign tricking users into enrolling attacker-controlled passkeys in Microsoft Entra ID. Represents an evolution of MFA-fatigue toward passkey-specific social engineering. BleepingComputer

• Forg365 PhaaS platform with AI-assisted lure generation — A new phishing-as-a-service operation combining AiTM and device code phishing to target Microsoft 365 accounts, with AI-generated lures. Lower skill barrier for M365 account takeover. BleepingComputer

• Vidar Stealer delivered via malvertising + Go loader DLL sideloading — financially motivated campaign targeting SMBs with lure of cracked/pirated software, using code signing abuse and a Go-compiled fake MpClient.dll for evasion. Combo payload includes XMrig miner. Unit42 / Dark Reading

• SolarWinds-style GitHub org enumeration via dormant accounts — Datadog reports overlapping campaigns systematically scraping corporate GitHub organizations, repos, and user accounts via the GitHub API using automated tools and dormant accounts for cover. The Hacker News

• Compromised Injective Labs GitHub repo → malicious npm package — Attackers hijacked the project's GitHub to publish a credential-stealing package on npm (crypto wallet private keys/seed phrases). Demonstrates that even trusted SDK maintainers can be compromised. BleepingComputer

• Fake Paysafe/Skrill/Neteller SDKs on npm and PyPI — Malicious packages impersonating legitimate payment SDKs to deliver stealer malware. Ongoing supply-chain trend. BleepingComputer

• npm 12 disables install scripts by default — A meaningful hardening milestone: install scripts disabled by default and granular access tokens deprecated for 2FA bypass. Reduces attack surface. The Hacker News

• Ubiquiti patches critical UniFi flaws across Connect, Talk, Access, Protect, OS — Multiple critical vulnerabilities allowing privilege escalation and arbitrary command execution across the UniFi ecosystem. Patch appliances promptly. The Hacker News

• China-linked threat cluster exploiting Roundcube at universities — Vulnerable Roundcube servers at US and Canadian academic institutions used for credential theft and backdoor deployment. Patch or isolate any remaining vulnerable instances. BleepingComputer

• "GitHub Verified" commits can be rewritten into new hashes without breaking signatures — New research undermines a core assumption about Git commit immutability and signature trust. Practical defense in depth implications for supply-chain security pipelines. The Hacker News

Themes

• AI tooling is both threat and victim (6+ findings): GhostApproval symlink escapes, HalluSquatting package-squatting via hallucinations, AI agents tripping EDR, AI agents tricked into running malicious "security scans," Forg365's AI-assisted phishing lures, and AI powering service desk impersonation. The rapid adoption of AI coding agents has outpaced security awareness — organizations should treat these tools as untrusted execution agents and constrain their runtime environments accordingly.

• Identity is the attack perimeter for Microsoft 365: Entra passkey enrollment vishing, Forg365 PhaaS target M365, and Helix vishing group stealing SharePoint data all signal a coordinated shift toward identity-focused attacks on Microsoft cloud — particularly the passkey/device-code enrollment flow. Verification steps and passkey enrollment processes are now the primary battleground, not passwords.

• Supply-chain: fake packages and repo hijacks continue: Injective SDK GitHub repo compromise, fake Paysafe/Skrill SDKs on npm/PyPI, and dormant GitHub account enumeration all point to persistent attacker focus on developer tooling and package repositories. npm 12's default-off install scripts is a notable step toward disruption.

• Defensive tools targeted by attackers: RoguePlanet (Defender bypass → SYSTEM), GodDamn ransomware's PoisonX driver killing security software, and the earlier revelation that Microsoft signed the malicious PoisonX driver. EDR/AV tools remain prime targets for neutralization in ransomware operations.