"Most of this week's trouble came dressed as something useful," the ThreatsDay bulletin observed — and the incidents it catalogs show how ordinary tools, familiar names, and routine features became attack channels across code repositories, desktop tooling, mobile apps, OT networks, and AI agents.
GitHub support-bundle cutoff and PyPI release restriction
GitHub announced a security policy change that will begin rejecting command-line support bundle uploads from older GitHub Enterprise Server (GHES) appliances starting August 18, 2026. GitHub warned administrators to update GHES instances to a required patch level — at minimum 3.21.3, 3.20.5, 3.19.9, 3.18.12, or 3.17.18 — to avoid disruption when using ghe-support-bundle, ghe-cluster-support-bundle, or ghe-support-upload commands.
At the same time, the Python Package Index (PyPI) implemented a rule blocking new files from being added to releases older than 14 days. PyPI said the restriction is aimed at preventing "old and long-stable releases" from being poisoned if publishing tokens or workflows are compromised.
Supply-chain impostors: npm droppers and a rogue VS Code extension
Supply-chain deception surfaced in multiple places. Security researchers at SefeDep reported that an npm package named @copilot-mcp/apex acts as a postinstall dropper that installs a macOS infostealer; a second dropper, @apexfdn/apex, distributed the same payload. On macOS, the dropper's second stage decrypts and runs an AppleScript through osascript that expands into a 707-line AMOS-family stealer. According to SefeDep, the malware phishes the login password via a fake system prompt, harvests browser credentials, more than 20 crypto wallets, SSH keys, AWS and Kubernetes credentials, the login Keychain, Telegram data, and shell history into /tmp/osalogging.zip, then uploads the archive over chunked HTTPS PUT. The malware also installs a LaunchAgent that polls the attacker's command-and-control server every 60 seconds to maintain persistence.
Manifold Security disclosed a similarly deceptive tactic in the Visual Studio Code marketplace: an extension named "Markdown All Pro" impersonated the legitimate "Markdown All in One" extension (the legitimate tool has more than 14 million downloads). On install, Manifold said, the rogue extension beaconed the machine's username and hostname to a hardcoded IP over cleartext HTTP, then fetched a remote file to disk — a live delivery channel the operator could update at will. Microsoft removed the extension, but Manifold noted it reappeared under an identical name, "MarkdownLinks.markdown-links-pro," and was taken down again.
Mobile surveillance, ad fraud, and nation-nexus RATs
Several mobile threats used trusted brands and user urgency as cover. Dream reported an Android app posing as a Bahraini Civil Defense "BH Alert" siren app that deployed OctagonPanel, a four-stage surveillance platform. Dream said the malicious app was pushed through look-alike domains cloning Google Play and official government sites and could harvest lockscreen credentials, SMS and one-time codes, contacts, screenshots, run banking overlays, and take full remote control.
Recorded Future attributed distribution of MarkiRAT to an Iran-nexus actor tracked as TAG-182. The vendor said TAG-182 likely targets Iranians inside and outside the country using lures such as fake VPNs and media tools, with operations active on social platforms like Instagram.
DoubleVerify uncovered a large ad-fraud wave from "AfterCall" apps that trick users into granting overlay permissions; those apps then display intrusive ads immediately after users end phone calls. DoubleVerify assessed the scheme to be responsible for hundreds of millions of ad impressions and noted the apps used evasion techniques that made them difficult for users to identify and uninstall.
AI agents and malvertising: GhostCommit, Fake Claude, and jailbreaking frontier models
AI tooling and agent workflows proved vulnerable to stealthy manipulation. University of Missouri–Kansas City's ASSET Research Group described GhostCommit, a method in which a pull request hides malicious instructions inside a PNG image processed by an LLM reviewer. The image's rendered text tells the agent to read .env byte-by-byte, encode each byte as an ASCII codepoint, perform a self-check, and — when triggered later by a coding agent — exfiltrate secrets and write back modules with poisoned provenance.
Huntress documented a malvertising campaign between July 21 and July 22, 2026, that redirected users to a malicious "Claude Artifact" hosted on the legitimate Claude.ai domain. Huntress said the artifact led victims to download what appeared to be a legitimate Claude desktop app (ClaudeDesktop.exe) that in turn retrieved SectopRAT. The campaign used anti-analysis techniques including VMProtect and graphics-hardware checks; Huntress reported at least 29 organizations were impacted and that the public Claude Artifact was removed on July 22, 2026.
Cato Networks described a Russian-speaking actor known as Trim who has been "dismantling the guardrails" on frontier models and repurposing them as offensive tools. Cato summarized six jailbreaking techniques Trim outlined — including Context Warming, Black Box Principle, Ghost Reset, Model Cascading, Local Uncensored Models, and Gray-Market API Access — illustrating how persistence and creativity can neutralize model safety layers.
CISA advisory update on PLCs and TrickBot's DNS tunneling
The U.S. government's Cybersecurity and Infrastructure Security Agency (CISA) updated an April 2026 advisory to warn of ongoing Iranian-affiliated activity targeting internet-connected operational technology devices. CISA said the update adds guidance to detect malicious changes in reusable code modules used in Rockwell Automation PLC programs, expands the manufacturer scope to include Schneider Electric and Siemens, and emphasizes restricting direct internet access for OT owners and operators. The authoring agencies reported attempts to download malicious project files and manipulate HMI and SCADA displays across Water and Wastewater Systems, Energy, and Government Services and Facilities.
Separately, Fortinet observed a new TrickBot variant using DNS tunneling to conceal command-and-control communication. Fortinet reported TrickBot wrapped C2 request packets in encrypted DNS query packets and hid malicious data inside the IP addresses returned in DNS responses while maintaining persistence via the Windows Task Scheduler.
What this means for security teams, end users, and regulators
- Security teams: Expect threats that exploit trusted channels — package managers, extensions, and AI agents — and prioritize patching GHES to the listed minimums, scanning artifacts for hidden binaries or images with embedded instructions, and monitoring for unusual outbound fetches and overlay permission grants.
- End users and administrators: Be wary of look-alike app stores and cloned government sites, avoid granting overlay or other powerful permissions without verification, and treat unusual install prompts or post-install network activity as potential indicators of compromise.
- Policymakers and OT operators: The CISA update underscores the need to restrict direct internet exposure of PLCs and to review reusable code modules in automation projects for unauthorized changes; regulators will likely track how vendor-specific guidance (Rockwell, Schneider Electric, Siemens) is implemented.
As the bulletin concluded, "The common thread was not advanced hacking. It was borrowed trust." The week's incidents underline a blunt question for defenders and buyers alike: if installs, permissions, names, and images can be weapons, how tightly must the ordinary be policed before ordinary use becomes safe again?
https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html
