Anomali Cyber Watch: Industrial IoT Attacks & Calendar Phishing

Aoki (aka Aokigahara) is a recently identified, sparsely documented infostealer, first observed in 2026, whose capabilities are actively expanding. Newer versions have added targeted theft of credentials and session files from AI coding assistants, including Claude, OpenAI’s Codex, Cursor, Codeium, and Gemini, a capability absent from earlier samples. The newest analyzed sample specifically targeted .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files, and also stole tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant, and Kiro, along with Amazon Web Services (AWS) credentials. Stolen API keys and session tokens allow attackers to operate as the legitimate developer, bypassing trust-based access controls and potentially exposing connected repositories, cloud services, and continuous integration and continuous delivery (CI/CD) pipelines. Keys can also be monetized directly by reselling access or consuming the victim’s API quota, a practice sometimes called LLMjacking. Beyond AI tooling, Aoki collects data from dozens of browsers, cryptocurrency wallets, password managers, messaging platforms, gaming clients, VPN clients, and FTP tools, sending everything to a command-and-control (C2) server via a /gate endpoint. No threat group has been attributed. The breadth of cryptocurrency targeting indicates a financial motive.

Source

Analyst Comment

The more consequential risk is not LLMjacking, though that remains a real harm. A compromised AI coding assistant token may provide entry into connected repositories, cloud services, and CI/CD pipelines. Stolen tokens may bypass safeguards that assume requests originate from a trusted user, potentially without triggering credential-based controls. The financial motive behind Aoki appears to derive from its broader cryptocurrency targeting, which predates the AI credential additions. Whether the AI targeting is a strategic decision or opportunistic expansion cannot be determined from available evidence. Taken alongside separate findings from other researchers in September 2026, this may represent an early converging signal of broader targeting interest in this credential category, though the evidence is not sufficient to assert a category shift. For defenders, the practical starting point is visibility: knowing which developers are using which AI coding tools, on which devices, and whether those devices fall within endpoint security coverage. In many organizations AI tool adoption may have outpaced IT governance, and that gap may represent an attack surface not currently visible to security teams. Organizations with that visibility should apply the same rotation, monitoring, and access controls to AI coding tool credentials as cloud credentials and service account tokens.

Anthropic’s Frontier Red Team has published research warning that small AI models may be months away from spreading autonomously across cheap, poorly secured Internet of Things (IoT) devices such as off-brand TV boxes, without needing a data center to operate from. The concept was demonstrated by running Gemma4-26B-A4B, an open-weight model from Google DeepMind, distributed across 15 Android TV boxes costing approximately $55 each. A 9-billion-parameter model, Qwen3.5-9B, successfully configured itself to run on eight of nine unfamiliar hardware types tested, the step considered most likely to block real-world replication. In controlled end-to-end testing on eight emulated Android devices, only GLM-5.2 completed the full replication cycle, reaching all eight nodes in four of five runs. The barrier preventing this today is that models capable enough to complete the full chain remain too large to fit on cheap target hardware. Anthropic projects that gap will close by end of 2026, based on the historical rate of small model improvement, with small self-replicating worms assessed as possibly viable shortly after. Replication would be slow, estimated at 28 to 51 hours for a 9-billion-parameter model and 71 to 150 hours for the 26-billion-parameter demo model, but the absence of centralized infrastructure makes the threat persistent and hard to fully eradicate. Large inter-device file transfers and sustained unusual traffic between devices would be detectable through ISP-level network monitoring. No functional self-replicating AI worm currently exists.

Source

Analyst Comment

The research is notable less for what it demonstrates than for what it measures. No small model currently combines reliable hardware adaptation with end-to-end replication: those capabilities sit in different models of very different sizes, and the gap between them is the reason this threat is not immediate. Anthropic’s projection that the gap will close by end of 2026 is grounded in a credible methodology but remains a trend-based extrapolation. With that projected threshold now weeks away rather than months, defenders should treat this as an active preparedness priority rather than a distant scenario to monitor, while recognising the timeline is not guaranteed. If convergence does occur, the more significant defensive challenge is structural: a worm carrying its own model weights and operating without centralised command-and-control infrastructure removes the primary disruption option that conventional botnet response relies on. Response would fall primarily to ISPs and device manufacturers rather than to individual organisations. For defenders, the near-term value of this research is as a preparedness signal. Assessing whether devices in the relevant class exist on any network segment under management, and evaluating what visibility currently exists for anomalous large inter-device transfers, are reasonable steps that are justified regardless of whether this specific threat materialises, and achievable for any organisation with existing network flow visibility in place. The learning-across-generations behaviour observed in testing, where replication success improved across generations within the same controlled environment, merits attention as a characteristic that would complicate response over time, though that finding comes from constrained testing and should not be overstated.

A critical OS command injection vulnerability in Langflow, an open-source platform for building AI-powered applications and workflows, is under active exploitation. Tracked as CVE-2026-105740 (CVSS: 9.9, CWE-78), the flaw affects version 1.8.3 and earlier and is patched in 1.9.0. Langflow’s Model Context Protocol (MCP) stdio transport passes an attacker-supplied command field directly to a bash shell with no validation, allowlisting, or sandboxing. Any authenticated user, including non-administrators, can submit a malicious configuration via POST to /api/v2/mcp/servers/{server_name}. Execution triggers automatically when the MCP settings page is loaded, requiring no further attacker interaction. Malicious configurations persist across retrievals and are stored in project settings rather than the flow editor, reducing detection visibility. Attackers authenticated using common credentials after auto-login was blocked, then targeted the platform’s secret key and superuser password for exfiltration and used Docker commands to read /etc/passwd. Exploitation began September 19, 2026, nine days after the GitHub advisory was published and sixteen days before the formal CVE was issued. Sensors have recorded 2,310 attempts from 30 unique IP addresses across 17 countries. At least one involved IP has been observed exploiting vulnerabilities in Flowise and multiple earlier Langflow CVEs, suggesting possible systematic targeting of internet-exposed AI workflow platforms, though no attribution has been made. Mitigations include patching to 1.9.0, disabling auto-login, enforcing strong credentials, and monitoring authentication logs and requests to the MCP server configuration endpoint.

Source

Analyst Comment

CVE-2026-105740 arrived in active exploitation before it had a CVE number. The GitHub advisory was public September 10; attackers were in honeypot sensors by September 19; the formal CVE was not issued until October 5. Organisations running mature, CVE-driven patch workflows were not negligent during that window; they were structurally blind to it. CVE publication is a lagging indicator of actual risk exposure, and monitoring upstream disclosure channels including vendor advisories and repository-level notifications is increasingly necessary alongside traditional vulnerability feeds. On the authentication boundary: valid credentials are not a strong control when an application is internet-exposed and credential hygiene is poor. Attackers moved from blocked auto-login to successful authentication using common credentials, consistent with weak or default credential abuse. The barrier held only where it was maintained. The most consequential detail here may not be the code execution itself but what attackers prioritised once inside: the platform’s JWT signing key and superuser password. Exfiltration of either extends impact well beyond Langflow, enabling token forgery or administrative access that could pivot into broader infrastructure. Defenders should treat credential compromise as the primary post-exploitation concern. One IP observed in this activity also targeted Flowise and earlier Langflow CVEs; a single data point, but consistent with systematic scanning of internet-exposed AI workflow tooling as a category. External exposure should be treated as a priority independent of any specific CVE.

Cyberattacks targeting remotely managed refrigeration controllers disrupted cold storage at approximately 700 supermarkets across France, with attackers forcing defrost cycles that raised temperatures to as high as 50°C (122°F) at some locations, spoiling perishable food, with reported fires and fire-alarm activations among the damage being investigated by the Paris prosecutor’s office. Affected retailers include Les Mousquetaires (300 Intermarché and Netto stores), Carrefour (80 stores), Coopérative U (80 stores), approximately 30 Monoprix locations, and several E.Leclerc stores. France’s national computer emergency response team (CERT-FR) confirmed numerous compromises across four controller families: Danfoss AK-SM and AK-SC series, Copeland xweb, and Dixell xweb, and warned that attacks targeting this equipment were probably still ongoing. Security researchers documented three vulnerabilities in the Danfoss AK-SM 800A web management interface in August 2026, including a hidden date-derived authentication mechanism (CVE-2025-41450) that could be chained with a post-authentication command-injection flaw (CVE-2025-41451) to achieve remote code execution. Danfoss had fixes available for all three AK-SM 800A flaws by August 2025, but confirmed most affected systems were older end-of-life products no longer receiving security updates. No authority has confirmed the exploitation method used in the attacks. Researchers identified 2,765 internet-accessible Danfoss AK-SM 800A management interfaces during their research.

Source

Analyst Comment

The documented AK-SM 800A vulnerabilities had been patched for over a year and the technical research was public for two months before these attacks, illustrating that patch availability does not guarantee protection. Many affected systems were end-of-life with no update possible, while outdated firmware presented an additional concern across the broader affected estate. Refrigeration systems operate continuously, making patching operationally sensitive, and where it is impractical, compensating controls become essential: removing direct internet exposure, restricting remote access through secure VPNs, and segmenting management networks. These measures can often be implemented without taking refrigeration equipment offline, though they require coordination with maintenance providers. CERT-FR’s confirmation of compromises across four controller families spanning Danfoss and Copeland products is consistent with broader targeting of exposed refrigeration infrastructure, although the attack vector and target-selection method remain unconfirmed. The wider concern for defenders is third-party management of operational technology. Refrigeration controllers, building management systems, HVAC platforms, and access control interfaces may be remotely accessible, externally managed, and outside routine security visibility. Organisations should identify which systems are remotely accessible on their behalf, establish clear responsibility for their security, and ensure supplier contracts address remote access controls, patching obligations, and incident response.

A threat actor assessed with medium confidence to have a Kazakhstan nexus conducted sustained espionage activity against government organizations across the Commonwealth of Independent States (CIS) from June 2025 through August 2026. Observed victims and lure themes spanned Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus, targeting institutions responsible for diplomacy, economic development, agriculture, and environmental management. Decoy documents and artifacts indicated interest in water resources and energy. Researchers identified four infection chains: macro-enabled Word documents, PS2EXE-packaged PowerShell downloaders creating scheduled tasks for persistence, malicious RAR-delivered shortcut files retrieving GitHub-hosted PowerShell scripts, and from April 2026, RAR archives exploiting CVE-2025-8088, a WinRAR path-traversal vulnerability that abuses extraction to write files outside the intended destination, marking the first vulnerability exploit observed in this actor’s malware delivery. The toolkit includes reverse shells, FoalShell, Chvost, Laplas, and PickleShell, with PickleShell placed in the Windows Startup folder to execute on user login. The actor frequently sends spearphishing emails from compromised government accounts using official-looking documents. Also recovered from exposed staging infrastructure were Linux-compatible tooling and a proof-of-concept exploit for CVE-2025-25257, a FortiWeb SQL injection flaw, suggesting potential expansion toward Linux hosts and internet-facing appliances, although active deployment has not been confirmed.

Source

Analyst Comment

While UAT-6275’s documented targeting centers on CIS government entities, its techniques have broader defensive relevance. CVE-2025-8088 has been actively exploited by multiple threat actors beyond this campaign, including espionage and financially motivated groups, and WinRAR does not auto-update. Organizations should update WinRAR to the latest supported version, noting that CVE-2025-8088 was addressed in version 7.13, released on July 30, 2025. Defenders should also monitor for unexpected PowerShell execution following archive extraction, payload downloads from public hosting services such as GitHub, unauthorized Windows Startup folder modifications, and suspicious scheduled task creation. Phishing sent from compromised government accounts can pass sender authentication checks, reinforcing the need for layered email inspection and behavioral detection rather than reliance on sender legitimacy alone. Recovered Linux-compatible tooling and a publicly available exploit for CVE-2025-25257, a FortiWeb SQL injection vulnerability, suggest potential expansion of this actor’s capabilities, although active deployment remains unconfirmed. FortiWeb administrators should verify remediation of CVE-2025-25257 independently, as exploitation by other actors is confirmed. The actor’s adoption of vulnerability exploitation alongside established social engineering techniques demonstrates diversification of its delivery methods and represents a development in its approach worth monitoring.

Researchers have documented several large-scale phishing campaigns abusing calendar invitations to harvest Microsoft account credentials, with a significant surge observed from September 25, 2026. Attackers use two delivery methods: phishing .ics calendar attachments and fake Microsoft meeting invitations containing deceptive links. The .ics method abuses legitimate calendar functionality rather than exploiting a software vulnerability. A dedicated detection layer flagged more than 302,386 unique phishing emails within the researchers’ customer environment, sent to more than 40,000 organizations, from more than 247,270 sender addresses across more than 33,890 domains, averaging more than 8,319 emails per active day. Overall campaign volume grew from a few thousand emails in April 2026 to more than 118,000 in September and exceeded 740,000 in the first two weeks of October, with October 8 recording almost 200,000 emails in a single day. Independent telemetry projected an approximately 33,000% increase in calendar-based attacks between May and September 2026, providing separate evidence of wider adoption. The scale and diversity of sender infrastructure, alongside independent reporting of other calendar-based phishing operations, indicate broader adoption of the technique; available research does not establish whether separate threat actors are responsible. Activity was confirmed as recently as October 15, 2026.

Source

Analyst Comment

These campaigns exploit a documented gap between email security coverage and calendar security coverage, and the defensive response needs to reflect that distinction. Research has demonstrated that standard quarantine and soft delete operations can leave calendar entries intact, allowing phishing lures to remain accessible after the original email has been removed. Microsoft Defender for Office 365’s Hard Delete action does now remove calendar entries linked to meeting invite-based phishing, but it does not extend to events created from .ics attachments, which require separate remediation. Defenders should audit three areas: whether incident response (IR) playbooks include calendar event removal as a remediation step, whether email security tooling has any visibility into calendar objects beyond the inbox, and whether transport-level controls for external .ics attachments are appropriate for their environment. That last measure should be assessed carefully, as a blanket block on external .ics files will also intercept legitimate calendar invitations and may disrupt normal business workflows. With nearly 34,000 distinct sender domains observed, IOC-based blocking is not a viable primary defense; structural controls and updated response procedures are the more defensible approach.