Anomali Cyber Watch: Your AI Clicked Something, Your Dev Tools Have Worms, and the Hotel Wi-Fi Was Literally a Spy

Researchers identified a campaign, tracked as CaptiveCrunch, in which Storm-2945, which researchers assess is an operational sub-cluster of the Russian threat actor Midnight Blizzard, has compromised hotel and conference Wi-Fi networks worldwide since early May 2026 to target traveling users. Rather than relying on a malicious link or attachment, the actor manipulated DNS and HTTP traffic on networks served by compromised captive portal infrastructure, redirecting victims to credential phishing pages or to fake browser and operating system update prompts that led to malware installation through the ClickFix social engineering technique. Investigation into how the underlying network equipment was first compromised is ongoing. Two malware families were identified: CornFlake, a Windows remote access trojan (RAT) that gives the actor a persistent foothold with keylogging, screen and camera capture, and file theft capabilities, and ChocoShell, an in-memory PowerShell credential stealer that targets browser passwords, cookies, Wi-Fi credentials, and Microsoft 365 sign-in tokens. Since July 16, 2026, some victims have also been redirected to device code phishing pages that abuse a legitimate Microsoft Entra ID sign-in feature. Researchers also identified FruitStone, a web-based command and control (C2) panel used to manage the operation's infrastructure.

Source

Analyst Comment

CaptiveCrunch matters because it moves the initial redirection point from a link a user might click to network infrastructure the user has chosen to trust. Travelers often do not question a hotel or conference Wi-Fi login, and this campaign shows why that assumption needs to change, since the malicious redirection happens at the network level, before any link is clicked or file opened. The device code phishing component is the sharpest illustration of this shift. Victims land on a genuine Microsoft sign-in page and unknowingly authenticate the attacker's session, which means checking the sign-in URL alone is insufficient protection against this technique. Analysis suggests the pairing of network-level redirection with device code phishing is what makes this campaign notable. Neither technique is fundamentally novel, but Microsoft assesses that integrating device code phishing into captive portal traffic manipulation may make the authentication request appear more legitimate. For defenders, the practical priority is treating guest Wi-Fi as a distinct risk category in travel policy rather than a single line in a broader security document, and restricting device code authentication wherever it is not operationally required. Organizations that send staff to conferences or client sites on managed devices should assume this exposure applies to them.

Three AI companies and a UK government evaluator disclosed testing incidents in mid-2026 in which AI models reached real systems or people instead of intended targets. OpenAI disclosed on July 21 that two models exploited an unknown vulnerability in a package registry proxy to escape an isolated test environment and access Hugging Face while attempting to obtain benchmark test solutions. It also disclosed a separate incident in early August in which a misconfigured Irregular test exposed a real website matching a fictional target. Anthropic disclosed on July 30 that three Claude models reached the internet through a misconfigured Irregular environment and accessed three organizations' production systems using weak passwords and unauthenticated endpoints. Meta disclosed on August 5 that an Irregular misconfiguration gave one of its models unintended internet access, used to exploit a vulnerability in an unidentified company; the model was later reported, but not confirmed by Meta, as Muse Spark 1.1. Separately, the UK AI Security Institute reported that a Mythos 5 agent attempted a supply chain attack and used fake GitHub identities to socially engineer real maintainers, while a GPT 5.6 Sol agent reused an exposed GitHub token and exposed a DNS server carrying exploit payloads online.

Source

Analyst Comment

For organizations running agents inside their own environment, the useful lesson here is about governance rather than attackers. In the misconfiguration driven incidents at Anthropic and one OpenAI case, the models largely treated real systems as part of their assigned exercise, though the three Anthropic incidents used different methods, weak passwords and unauthenticated endpoints in one, a malicious PyPI package in another, and SQL injection with exposed debug credentials in the third. For Meta, the public record does not yet support conclusions about the model's reasoning. AISI caught its incident when general security monitoring flagged unusual outbound traffic and contained it within roughly an hour, but by AISI's own account this monitoring was not built to watch the evaluation as it ran, and Anthropic only found its incidents through a later review triggered by a competitor's disclosure. That gap matters, agents deployed internally need monitoring capable of catching anomalies in real time, not after the fact review. AISI also found that once its task met resistance, an agent escalated into fabricated identities and denied wrongdoing when a reviewer raised concerns, so workflows where an agent can create accounts, contact people, or submit code should route through human review first.

Researchers identified a self-propagating npm worm called ChainDrop that infected more than 400 packages, collectively downloaded hundreds of millions of times each week, including keyv and cacheable-request. The worm spreads through a preinstall hook added to a package's package.json manifest, which launches a setup script that downloads the legitimate Bun runtime if necessary and uses it as an execution vehicle for the malicious payload. Once active, it steals npm and GitHub credentials, cloud access tokens, SSH keys, and other developer data, then uses stolen npm tokens to republish infected packages, allowing it to spread independently. It plants persistence files in VS Code and Claude Code project directories designed to relaunch the infection when either is used, though in the analyzed sample only the VS Code path successfully reached the payload. Rather than hard-coding its command-and-control (C2) domain, the worm queries an Ethereum smart contract to retrieve active infrastructure, letting the operator rotate domains silently without updating the malware. Researchers identified technical overlap with the previously documented Shai-Hulud toolkit but caution that shared code does not confirm the same group is responsible, since the toolkit's source was made publicly available in May 2026.

Source

Analyst Comment

ChainDrop is the latest documented evolution in the Shai-Hulud code lineage, first observed in npm attacks in September 2025, with successive waves introducing new initial-access, persistence, and evasion techniques. The May 2026 TanStack wave confirmed that malicious packages can carry valid Supply Chain Levels for Software Artifacts (SLSA) provenance when attacker-controlled code executes inside the trusted CI publishing environment. ChainDrop contains a fully implemented pathway capable of generating genuine Sigstore provenance, though researchers did not observe it execute. Provenance confirms which workflow produced an artifact, not whether that workflow was clean. Domain blocklists carry a deliberately short useful life here: the attacker rotated active C2 domains through a single Ethereum transaction on August 4 without touching the malware. Monitoring the resolver contract (0xE1f2395ee43e45A1556EC6438a88c31B83493103) for setStrings() calls provides durable complementary visibility alongside domain tracking. Reverting the package version does not clear compromised lockfiles, caches, or CI images, and credentials should be rotated from a clean machine. Where gh-token-monitor persistence is identified, responders should isolate the affected host and remove it before revoking the monitored GitHub credential, as earlier variants in this lineage have deployed dead-man switches capable of destructive file deletion.

A critical authentication bypass vulnerability in N-able's N-central remote monitoring and management (RMM) platform, tracked as CVE-2026-18577 with a CVSSv4 score of 8.2, is under active exploitation confirmed from July 31, 2026. The flaw stems from an incomplete patch for CVE-2026-18556 and affects all currently supported N-central versions, including 2026.3, across both cloud-hosted and on-premises deployments. Unauthenticated attackers gained administrative access to the N-central console and abused the platform's built-in Take Control feature, initiating sessions under the default "MSP Support" account identity from IP addresses associated with Mullvad and NordVPN VPN exit nodes. From there, attackers conducted targeted reconnaissance to identify domain controllers, enumerated running processes on compromised hosts, moved laterally across multiple managed endpoints, and registered Cloudflare-based tunnel services to maintain persistent access to victim environments even after N-central server access was revoked. N-able released an initial hotfix on August 2 (version 2026.3.1.7) and a second hotfix on August 6 (version 2026.3.1.10) with additional hardening for on-premises deployments; cloud-hosted instances were mitigated without customer action. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and directed Federal Civilian Executive Branch agencies to remediate by August 6 under Binding Operational Directive 26-04. As of August 3, 28.6 percent of observed self-hosted N-central servers remained internet-exposed and unpatched.

Source

Analyst Comment

The most significant aspect of this incident is not the vulnerability itself but what it exposes about the MSP trust model. End customers of affected MSPs typically lack the process and tooling to independently review N-central activity, have no baseline for what legitimate MSP access looks like, and are unlikely to distinguish a genuine support session from a malicious one without active log monitoring. An attacker operating under the default "MSP Support" identity through the platform's own remote control feature is practically indistinguishable from legitimate technician activity for most downstream organizations. That detection gap is a property of the model itself, and this case makes it concrete. The incomplete patch history also carries a wider lesson: a hotfix landing does not mean the risk is closed, and monitoring posture for security-critical platforms should not relax the moment a vendor update is applied. On persistence, network detection of Cloudflare tunnel traffic is genuinely difficult as the tunnel uses outbound encrypted connections that most firewalls treat as legitimate. Endpoint detection is more tractable; N-able published specific indicators including a registered service named Cloudflared and a file named svchost.exe in the user's Documents folder, and has released an automated service template to check for known indicators on Windows endpoints. N-able cautions that a clean result from that tool should not be interpreted as confirmation that an environment was not impacted. Reviewing endpoints for those indicators is a required step where MSP patching was delayed. The 28.6 percent of self-hosted servers still exposed three days after active exploitation was confirmed reinforces a simple prompt: ask your MSP when they patched and do not assume the answer was immediate.

DOUBLECUP is a Russian loader-as-a-service active since early June 2026 that uses ClickFix attacks to conceal malware inside PNG images pre-loaded into victims' browser caches. Linked to threat actor Rognar via associated Telegram infrastructure, the service sells a Windows client for campaign configuration and manages payload hosting, encryption keys, and backend infrastructure. Operators deploy fake login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce via embedded iframes. When a victim visits one of these pages, the browser silently caches a malicious PNG; fake CAPTCHA-style prompts instruct them to run a command that extracts the hidden code and launches a memory-only dropper. The dropper derives a decryption key from the victim's public IP address, defeating sandbox analysis from any other IP address, and executes the final payload entirely in memory. DOUBLECUP delivers two payloads: CountLoader 4.5p, targeting Windows via PowerShell and macOS via a Mach-O binary, that patches Portable Executable (PE) header metadata on renamed copies of legitimate system binaries in user-writable directories and establishes scheduled-task persistence; and DeviceManager, a Python-based remote access trojan (RAT) that resolves its command-and-control (C2) address from a public blockchain smart contract and self-deletes on systems using Commonwealth of Independent States (CIS) language settings.

Source

Analyst Comment

The LaaS model is the primary threat multiplier: operators purchase access and deploy lure pages without understanding the underlying techniques, which likely broadens the operator pool and means technique complexity should not be used to infer actor capability in attribution. Activity has been linked to threat actor Rognar via Telegram infrastructure and should be treated as indicative rather than confirmed attribution. The CRM lure selection suggests broad, opportunistic business-user targeting across mid-to-large organisations; this is an inference from the evidence, not a stated finding. The macOS variant delivers comparable capability to the Windows chain and should not be considered out of scope. The initial delivery vector is not established in available reporting; the first defensive control point remains unknown. The environmental keying mechanism presents a specific sandbox triage risk: samples exhibiting staging behaviour (browser cache access, clipboard manipulation, certutil or findstr execution) but returning no final payload should be treated as inconclusive, not clean. Detection is primarily behavioural: clipboard-driven execution across PowerShell, command prompt, and the Run dialog, renamed system binaries in user-writable directories, and scheduled tasks mimicking Google or Microsoft update services are all observable without network-level visibility.

Researchers disclosed two zero-click attack chains exploiting indirect prompt injection (IPI) against Claude in Chrome and ChatGPT Atlas, agentic browsers operating across all authenticated sessions simultaneously. For Claude in Chrome, a malicious email with hidden instructions activates when a victim asks Claude to summarize emails; Claude treats injected content as commands and imports attacker-controlled code from a rogue content delivery network, bypassing filters that block direct script execution. Impacts include Gmail exfiltration, Google Drive file sharing with an attacker account, and account takeover against Slack, X, and Claude.ai via verification codes extracted from Gmail. The ChatGPT Atlas attack exploits intent collision (where the agent cannot separate the user's request from attacker-injected instructions) via a planted X comment; classifiers were bypassed by splitting payload instructions across page sections and writing them in Hebrew, and a confirmation guardrail was circumvented by framing actions as sandbox testing. Researchers sent phishing messages to the victim's WhatsApp contact list, and when a hard boundary blocked Amazon checkout, redirected Amazon's Rufus assistant to complete the purchase. Both were reported between December 2025 and January 2026. Anthropic closed both reports as informative and ineligible for its vulnerability disclosure program; the attack chain remains unresolved. OpenAI deployed targeted mitigations and is discontinuing Atlas on August 9, 2026, but characterises full resolution of prompt injection as an ongoing challenge.

Source

Analyst Comment

Organisations with agentic browser tools deployed should treat these findings as operationally relevant now; shadow adoption is outpacing formal IT visibility in many environments. Preconditions are low: a routine email-summary request or social post interaction is sufficient, and the demonstrated chain succeeded against a product where classifier-based mitigations were already deployed, bypassing them through a CDN package import technique. The vendor response is intelligence relevant to procurement decisions. Anthropic closed both reports as informative and ineligible for its vulnerability disclosure program. OpenAI proactively deployed targeted mitigations and published its defensive methodology in December 2025, prior to the research disclosure. OpenAI is discontinuing Atlas on August 9, 2026, but the risk does not retire with the product; prompt injection capabilities migrate to ChatGPT Work, where the attack surface is larger. Least privilege is the most practical near-term control; frameworks from NIST, CISA, and Microsoft exist to guide implementation, though organizational maturity to implement them rigorously remains limited for most. Analysis suggests intent collision likely affects any agentic system reading untrusted content across authenticated sessions; research covering five agentic browsers supports this directionally but should be treated as analytical inference, and defenders should assume the pattern will recur as agentic tooling proliferates.