A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain security firm, first spotted the “testmetest” npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token, the security researchers noted. The new npm worm shares code with June’s Miasma Phantom Gyp worm, and adds Mini Shai-Hulud’s token-revocation wiper. As of October 22, however, SafeDep had found no compromised third-party packages or victims. “All observed activity belongs to the operator’s own test accounts,” the team wrote. As with most happy-ending security stories, that proved too good to be true. In a Monday report, supply chain security company JFrog said its analysis proved otherwise, and found the testmetest campaign operator “had already armed real repositories belonging to established developers and organizations.” This isn’t just about timing, either, according to JFrog researchers Guy Korolevski and Yair Benamou. “The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise,” they wrote. How the attacks worked The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor, and VS Code, alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload. Separately, the npm worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. The malware also uses a compiled native add-on to decrypt and launch a separate payload. Before executing, the loader checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis, exiting silently when it detects them to reduce the likelihood of detection by security scanners. The researchers also found a second build that skips the encrypted file. “It forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator’s own GitHub account,” they wrote. That account – CementBeetleSteeple – hosted 17 campaign repositories in total. JFrog connected this account to a shellpanel scanner, previously documented by Socket in a large-scale campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials. CVE-2026-41940 is an authentication bypass affecting cPanel and WHM. CISA added it to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions. “C2 infrastructure were previously reported by Socket; our findings connect them to the testmetest GitHub victim cluster through artifacts and workflows on the same hijacked owners,” the JFrog researchers wrote. They added that while they found 42 armed GitHub repositories and attempted internet-wide exploitation, they did not confirm any downstream cPanel compromises.®
Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI’s pros and cons, and ensure those deploying it own the risks.
Open-weight models from China have become very popular, but they’ve also raised some security suspicions. Cohere, a Canada-based biz that offers AI models to enterprises, says that when it was testing Alibaba’s Qwen3.8-Flash-Next in its evaluation sandbox, the model attempted to send data to China. “Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing,” the biz said in a blog post on Monday. Cohere was running the model through CTI-REALM, Microsoft’s security analyst benchmark, and gave Qwen the task of writing a detection rule to look for malicious file downloading and execution by watching for invocations of curl processing bash scripts to the /tmp directory that were accompanied by bash execution. The model’s “reasoning” output invented a prior conversation and asserted that no tools were used, output that a guardrail system reading chain-of-thought would accept. Nonetheless, the model issued a curl command to an Alibaba Cloud (aliyuncs.com) server. “The model listed everything in /tmp, checked which transfer tools were installed, read the machine’s DNS settings, then tried to upload a test string to an Alibaba Cloud storage bucket in Beijing and checked whether it worked,” Cohere said. “Our sandbox had no route out, so the request died at the container wall.” The Cohere team wonders aloud whether that behavior was intended, but has no answer. “The first issue is that it made a network call at all,” Ivan Zhang, co-founder of Cohere, told The Register via email. “The model was asked to write a detection rule, which doesn’t require external communication, and its reasoning trace said it wouldn’t use tools. The destination raises additional questions because the attempted upload was to an Alibaba Cloud storage endpoint that wasn’t part of the task. We don’t know why it appeared, and we don’t know the root cause.” Alibaba, the maker of the model, did not respond to a request to address Cohere’s concerns. Asked whether Cohere ran similar tests against US-made open-weight models, Zhang said, “We evaluate a broad range of models using the same framework our customers use in production: agents with access to real tools operating inside controlled environments. “The key point isn’t a comparison between providers. What made this noteworthy was that the model took actions unrelated to the task and those actions weren’t reflected in its reasoning trace. The behavior appeared in fewer than one in 100,000 calls, which is exactly why large-scale testing and monitoring matter.” There have been other unsubstantiated claims made about similar behavior from open-weight models, and such reports have suggested that “hallucination” – errors made by these models – may be the cause. Cohere has doubts that this behavior simply reflects memorized training data. “Every public sighting so far has involved fetching a file, while the one we caught was an attempted upload to a different bucket, this time in Beijing,” the biz said. Cohere described efforts to reproduce the suspect behavior and found that using a technique called prefilling – feeding the model its own reasoning output alongside the opening characters of the bash command so the model would complete the command – they could get it to reference watchlisted hosts up to 23 percent of the time. This still doesn’t clarify intent, and Cohere allows that there’s a case to be made that the behavior is just bad training data sanitization – logs from development that got swept into the model’s training data set. At the same time, the company argues that isolating a suspect model so it can’t exfiltrate data doesn’t entirely fix everything because these models can still write vulnerable code – accidentally or as a result of model poisoning. Cohere points to research from other organizations that suggests Chinese AI models can produce vulnerable code. The biz, for example, cites a report from Booz Allen (which does a lot of business with the US defense industry) that found “three of four Chinese coding models wrote more vulnerable code for a government customer, with Qwen3-Coder roughly 130 percent worse.” “From the outside, it’s very difficult to determine the root cause with confidence. We don’t have evidence that would allow us to conclude this was deliberate, and we’re not making that claim,” said Zhang. “For security teams, though, intent doesn’t fundamentally change the response. Whether it’s a training artifact, a mistake, or something else, the controls are largely the same: restrict unnecessary egress, monitor tool use, and don’t treat a reasoning trace as a security boundary. “We strongly support open-weight models and release many of our own. The lesson here is really about trust. Sovereign AI is about more than where a model runs. It’s about understanding how it was built, how it was tested, and having confidence in how it behaves inside your environment.” ®
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised version contained an infostealer and a remote access trojan capable of executing arbitrary code on infected machines. While the trojanized package was available on PyPI for less than two hours before being quarantined, it received about 49,000 downloads during that time, according to Wiz. On Friday, LiteLLM detailed the attack chain behind the compromised release and traced it back to May 27, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. The key belonged to an open source tool used internally by LiteLLM to orchestrate AI agents. The project’s developers quickly spotted the error and removed the exposed commit, but failed to revoke the master key. “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token,” according to Friday’s postmortem. “From this point onwards, the threat actor had owner-level access to all repositories in our GitHub.” This is especially serious because GitHub CLI tokens are “post-2fa,” meaning that they don’t trigger GitHub’s sudo mode authentication flows typically required to perform high-impact repository actions. The token allowed the attacker to author malicious commits into branches on other internal repos – including workflows designed to steal any tokens and secrets configured to be available during the continuous integration development process. And this allowed them to steal other GitHub CLI OAuth tokens linked to two engineers with maintainer privileges. Plus, they acquired tokens for several other internal systems, we’re told. “Reviewing the actor’s activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens,” LiteLLM noted. Having now stolen several privileged identities, the miscreant could make changes to GitHub repositories without raising any suspicion because the actions and approvals all appeared to come from legitimate, credentialed engineers. In response, LiteLLM’s developers are revoking every token associated with every internal system and vendor platform. “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key,” they wrote. The infostealers hidden inside the compromised package were designed to hoover up a ton of sensitive information, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials, Google Cloud Platform service account keys and application default credentials, and Microsoft Azure tokens. It also swiped API keys for OpenAI, Anthropic, Cohere, and other LLM providers. So if you installed and ran version 1.107.0, assume any credentials accessible to the affected system may have been stolen. Investigate affected systems, change passwords, and rotate exposed keys. A quick prayer to the patron saint of supply chains wouldn’t hurt, either. ®
Proton, the company behind ProtonMail and other privacy-focused products, told staff on Monday it would be ‘re-interviewing’ staff across the company about how they use AI in their jobs, with the implication that the interviews may decide whether staffers have “continued employment,” according to an internal Proton email obtained by 404 Media.
When a handful of university students first spilled onto the streets two years ago to protest the deadly collapse of a railway station canopy, Serbia’s state-run media dismissed them as unruly kids merely looking for an excuse to cut class.
They were grieving the 16 people crushed to death and demanding accountability for what they condemned as lethal state corruption and crony contracting, bearing banners that read: “Corruption kills” and “Your hands are bloody.”
But those scattered demonstrations soon swelled into a generational revolt. Over two relentless years, the students slept in occupied lecture halls, barnstormed rural strongholds where state television branded them foreign mercenaries, and punctured a pervasive climate of fear with biting wit and viral banners.
On Sunday, the kids actually did it.
In a stunning ballot-box upset that shattered Aleksandar Vučić’s 14-year grip on power, Serbia’s student-led movement defeated the Balkan country’s formidable ruling machine, clinching a triumph so historic that even its young architects were left reeling in disbelief.
“Fantastic. I can’t believe it,” Ilija Ratković, 30, told OCCRP. “A regime that ruled for 14 years, was corrupt, and killed people in Serbia is out.” He admitted he never expected Vučić to yield quietly: “I expected him to fight to the end.”
The movement’s slogan, “Students are winning” (Studenti pobeđuju), mobilized Serbians at home and abroad to vote for the “Students’ List”—a slate of candidates chosen by activists to replace Vučić’s state apparatus. Though convinced the regime would try to manipulate the count, organizers aimed to counter fraud through overwhelming turnout, operating on a simple premise: elections can be stolen, but not in a landslide.
“The higher the turnout, the less chance he has to steal it,” one voter who identified himself as David told OCCRP ahead of the poll.
Then came Sunday. Even after Serbia’s Ministry of Foreign Affairs adjusted overseas polling hours to align with Belgrade’s time zone, thousands of diaspora Serbs lined up outside embassies and consulates in Australia and the United States in the dead of night. Some traveled thousands of kilometers from Brisbane to Sydney. In New York, voters showed up at 2:00 AM singing defiant songs, with several wearing pajamas, bathrobes, and sleep masks to mock a rule they viewed as blatant voter suppression.
Inside Serbia, queues at polling stations stretched around city blocks. Voters brought sandwiches and flasks of tea and coffee, waiting patiently for hours to cast their ballots.
A video circulating on social media on Monday perhaps best captured that determination: just one minute before polls were set to close, a man was filmed carrying a woman wearing house slippers toward a polling station entrance. “She delivered a baby two days ago!” he shouted to the people at the door, as another bystander rushed over to help carry her inside. She was the final voter admitted to the station.
“Change requires participation. Citizens who do not participate in the democratic process – not in the public square through protest and engaged debate, nor through the ballot box – will achieve nothing,” political analyst Jasmin Mujanovic wrote in a commentary.
With turnout approaching 70 percent—nearing a historic record—Vučić did the unthinkable roughly an hour and a half after polls closed at 8:00 PM. Preempting the official election commission tally, he conceded defeat from party headquarters, announcing that based on his party’s samples, the youth-led Students’ List had won decisively, projecting roughly 2.2 million votes for the “List” compared to 1.72 million for his party.
His admission unleashed an immediate explosion of jubilation across the country. Car horns blared, red flares illuminated squares, and crowds of weeping, laughing students spilled into the autumn night, dancing well past dawn.
Asked how she felt as the news broke, Ana Novak, 54, said she was “relieved, very happy, ecstatic.” She, too, had doubted Vučić would concede.
“I’m really hoping for a change—for a normal state, for a normal life in Serbia,” said Novak, who lives in Belgium with her family and is now considering moving back.
As morning arrived, the magnitude of the shift began to sink in across the capital. During a live news broadcast from Belgrade downtown, a passerby interrupted a reporter who in her report mentioned the movement’s signature battle cry: “Students are winning!”
“No,” the man interjected with a smile before walking away. “Students have won.”
To address a vulnerability in Google’s Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update “as soon as possible” after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects. Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft’s advisory, could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or elevation of privilege. Microsoft’s own advisory for the vulnerability, which some are referring to as Broccoli2Shell or Node2Shell, confirms that while experts have cobbled working exploits together, there is nothing to suggest that criminals are using them in successful attacks. However, its exploitability assessment reads: “Exploitation More Likely.” Broccoli2Shell was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery, but failed to mention why it was only recognized as a security flaw and disclosed properly in October, despite the underlying bug having been fixed in Brotli’s source code in February. OpenAI filled in the gap with a Xeet: “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli. “Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software.” Attackers can exploit vulnerable systems by providing them with malicious Brotli-compressed data via a specially crafted request. The vulnerability went slightly under the radar due to the disclosure timing closely aligning with that of PHP2Shell, although fixing the critical flaw should be a priority due to the range of technologies that are affected. In addition to .NET, Node.js, and Python, Bun, Envoy, and Istio have all released patches, and JFrog has worked up an exploit affecting FFmpeg using a specially crafted JPEG XL image, extending the exploit path beyond HTTP. It said that FFmpeg reaches Brotli through libjxl, which it uses to decompress metadata stored in brob boxes within the image format. The same researchers said the vulnerability affects Apache Arrow too, with attackers able to cause a denial of service. Merav Bar, threat researcher at Wiz, added that cloud users are exposed extensively, noting that 91 percent of cloud environments rely on components vulnerable to the Brotli flaw and that 82 percent of cloud environments have publicly exposed Node.js instances. She said: “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.” “Successful exploitation could enable attackers to compromise application workloads, access sensitive information, disrupt service availability, or execute malicious code within affected containers or runtime environments,” Bar added. In an advisory published through its Patch the Planet initiative, OpenAI recommended blocking untrusted Brotli-compressed data where practical until patches can be applied. It also advised maintainers to rebuild affected deployments and restart services to ensure the fixes take effect. ®
AI agents are moving deeper into offensive cyber operations. In a campaign highlighted in September reporting, a Chinese-speaking operator reportedly deployed multiple open-source AI agent frameworks to find and exploit vulnerabilities across several targets, automating work that would ordinarily require hands-on effort from an attacker.
The reported activity illustrates how AI tools are being applied to increasingly complex stages of an attack, including tasks that traditionally require substantial technical expertise and hands-on effort.
Meanwhile, the volume of AI-related activity across illicit communities continues to climb.
In September 2026, Flashpoint analysts identified 8,837,186 posts discussing artificial intelligence in the context of illicit activity, up from 7,461,908 in August. That represents an approximately 18% increase in a single month.
Mentions of AI in conjunction with illicit advertisements and discussions in September 2026. (Source: Flashpoint)
Across forums, marketplaces, and chat services, threat actors continue to advertise AI services, exchange techniques, and explore ways to incorporate AI into fraud, identity verification bypass, social engineering, and offensive cyber operations.
To track these developments, Flashpoint’s monthly AI Threat Report analyzes primary source communities across forums, marketplaces, and chat services. This month’s intelligence highlights a sharp increase in AI-enabled identity verification bypass activity, continued demand for malicious AI capabilities, and emerging examples of AI agent tooling being used in offensive operations.
Where AI Activity Is Concentrated
Telegram remained the dominant source of observed AI service advertisements in September, with 6,309,872 posts, up from 4,899,407 in August. That represents an approximately 29% month-over-month increase.
Activity across other platforms was substantially lower. Flashpoint identified 20,361 posts on GitHub Gist, followed by Pastebin (6,288), Signal (6,123), and Reddit (5,882). Smaller volumes were observed across 4chan, BlackHatWorld, Discord, Mastodon, and other sources.
Posts selling AI services (in red) and posts seeking to purchase AI services (in blue) on Telegram in September 2026. (Source: Flashpoint)
As with previous months, these figures do not represent unique advertisements or services. Threat actors frequently repeat or distribute the same messages across multiple channels and platforms to maximize exposure.
Telegram’s continued dominance underscores its importance as a distribution channel for illicit AI services. Other platforms provide additional avenues for sharing technical material, advertising capabilities, and discussing methods.
The distribution of activity also reinforces why post volume requires context. Repeated advertisements can inflate overall counts, making it important to examine the underlying services and techniques being promoted alongside changes in activity.
AI-Enabled Fraud and Identity Verification Bypass
Discussions of AI-enabled identity verification bypass continued to accelerate in September.
Flashpoint analysts observed 1,171,914 posts advertising or discussing Know Your Customer (KYC) bypass methods using AI technology, including deepfake technology. That compares with 751,644 posts in August, representing an approximately 56% month-over-month increase.
The increase is particularly noteworthy given the growth already observed in August, when KYC-related activity nearly doubled from July. Across the past two months, the number of observed posts has nearly tripled, rising from 394,567 in July to more than 1.17 million in September.
These discussions are concentrated in Telegram channels advertising methods designed to circumvent identity verification controls through generative AI, including deepfake technology.
For financial institutions and other organizations that rely on digital identity verification, this activity warrants close attention. AI-enabled impersonation can create additional challenges for onboarding, account recovery, and other processes that depend on verifying a user’s identity.
The sustained increase in underground discussion also provides security and fraud teams with an important signal about where threat actor interest is concentrated, even when repeated advertisements contribute to the overall volume.
Malicious LLM Usage and Prompt-Based Workflows
Malicious and unrestricted large language models (LLMs) remained part of the AI-related activity observed across Flashpoint Collections in September.
Threat actors continue to develop their own models or seek ways to bypass safeguards imposed by mainstream AI services. These capabilities can support phishing, social engineering, harmful code generation, and the creation of malicious or offensive content.
The top observed malicious LLMs mentioned within Flashpoint Collections in September 2026. (Source: Flashpoint)
The availability of malicious and unrestricted LLMs gives threat actors additional options for incorporating AI into existing workflows. Models designed or modified to circumvent safety restrictions can be used to generate content and technical material that mainstream services would ordinarily reject.
These tools also introduce challenges for security teams assessing how AI-enabled threats are evolving. Understanding which models are being discussed, how they are marketed, and the capabilities being sought by threat actors can provide insight into emerging areas of interest across illicit communities.
Notable AI-Related Activity Observed in September
Flashpoint identified several notable developments involving AI infrastructure and the growing use of AI in offensive cyber operations.
September reporting highlighted a Chinese-speaking operator reportedly using three open-source AI agent frameworks, including Strix and Cairn, to automate vulnerability discovery and exploitation across multiple targets, according to The Register, citing Gambit.
These developments highlight two areas of concern: the targeting of proprietary AI infrastructure and the potential for agent-based tools to accelerate offensive operations. For security teams, both reinforce the importance of protecting AI development environments and addressing exploitable weaknesses before attackers can capitalize on them.
What Security Teams Should Take Away
September’s intelligence points to continued growth in AI-related criminal activity, with particularly sharp increases in discussions surrounding identity verification bypass.
Flashpoint observed more than 8.8 million posts discussing AI and criminal activity, while KYC bypass discussions exceeded 1.17 million posts for the first time in the three-month period examined.
At the same time, reported activity involving AI agent frameworks illustrates how automation is extending into more complex offensive workflows. Threat actors are exploring ways to apply AI to vulnerability discovery and exploitation, alongside its established uses in fraud, impersonation, and social engineering.
For security teams, these developments reinforce the importance of maintaining visibility into the communities where new capabilities are discussed, advertised, and tested. Tracking changes in activity and understanding how tools are being applied can help organizations identify emerging risks and better prioritize their defenses.
To see how Flashpoint can help your team identify and respond to emerging threats, request a demo.
Frequently Asked Questions (FAQ)
What is the Flashpoint AI Threat Report?
The Flashpoint AI Threat Report is a monthly intelligence analysis tracking how threat actors use and discuss artificial intelligence across illicit communities. Built on Flashpoint’s primary source collection, the report provides visibility into underground forums, chat services, marketplaces, and other environments where AI-related criminal activity is discussed and advertised.
How are threat actors currently using AI in cybercrime?
Threat actors are using or exploring AI capabilities across a range of criminal activities, including identity verification bypass, phishing, social engineering, malicious code generation, and vulnerability discovery.
September reporting also highlighted the use of AI agent frameworks to automate elements of offensive cyber operations, including vulnerability discovery and exploitation.
How rapidly is illicit AI activity growing in cybercrime communities?
Flashpoint analysts identified 8,837,186 posts discussing AI and criminal activities in September 2026, compared with 7,461,908 in August. This represents an approximately 18% month-over-month increase.
Activity related to AI-enabled KYC bypass also grew substantially, reaching 1,171,914 posts in September, an increase of approximately 56% from August.
These figures measure observed posts, rather than unique threat actors, services, or confirmed attacks.
Which messaging platforms and forums host the most illicit AI chatter?
Telegram continues to account for the largest concentration of observed AI service advertisements. Flashpoint identified more than 6.3 million posts advertising AI services on Telegram in September.
Other sources included GitHub Gist, Pastebin, Signal, Reddit, 4chan, BlackHatWorld, Discord, and Mastodon.
What are malicious LLMs?
Malicious LLMs are AI models developed, modified, or marketed for purposes that mainstream AI services typically restrict. Threat actors may use these models to generate phishing content, assist with social engineering, create harmful code, or support other criminal activities.
Flashpoint continues to track discussion of these models across illicit communities to understand how their capabilities and use cases are evolving.
Table Of Contents
