Botnets in Your Living Room, Ransomware in Your Browser, and AI That Follows the Wrong Orders: This Week in Security
A streaming box sitting under your TV should not be a geopolitical problem. A GitHub repo full of security research should not steal your passwords. A browser permission prompt should not be the start of a ransomware infection. And yet, here we are.
The through-line this week was not sophistication. It was misplaced trust. Legitimate features, familiar-looking tools, and ordinary infrastructure were the attack surface. That is, frankly, harder to defend against than a zero-day.
Threat of the Week: Google and the FBI Go After NetNut's Botnet
Google, working alongside the FBI, Lumen, and others, moved against NetNut, a residential proxy network also going by the name Popa. The operation built on an earlier takedown of IPIDEA back in January 2026. Google disabled NetNut-linked accounts and services, updated Play Protect, and pulled apps known to embed the NetNut SDK.
The network is estimated at upwards of two million devices, many of them smart TVs and streaming boxes sitting in people's homes. NetNut recruits these devices either by pre-installing malware before the product ships, or by bundling proxy code into apps users download without any idea what they're getting. The purpose is straightforward: route traffic through residential IPs to make malicious activity look like it comes from ordinary households. Google also connected NetNut infrastructure to BADBOX 2.0, which is not a reassuring association.
WhatsApp Usernames Sound Good in Theory
WhatsApp has started rolling out username reservations globally, letting people connect with each other without handing out their phone numbers. The opt-in feature is aimed at the platform's three billion-plus users and is expected to reach general availability later this year.
India, WhatsApp's biggest market, is already raising concerns. The worry is impersonation, specifically that someone could register a username close enough to a government department, bank, or public figure to cause real harm. Meta says it reserves names tied to prominent entities so only legitimate parties can claim them. What remains unclear is exactly how that works in practice, and who decides which lookalike variations get blocked and which slip through. That gap matters.
Fake PoC Repositories Are Targeting Security Researchers
If you spend time hunting for proof-of-concept exploit code on GitHub, pay attention. A campaign distributing a remote access trojan called ChocoPoC has been hiding malware not in the PoC itself, but inside a dependency it pulls in, a package called "skytext." The PoC code looks clean on inspection. The nastiness arrives quietly via the dependency chain.
Once running, ChocoPoC is fully capable: it pulls passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox. It also grabs text files, notes, local databases, shell history, network configuration, and a list of active processes, and supports remote command execution. Researchers who test random GitHub repos in anything less than an isolated environment are doing it wrong.
Scattered Spider Suspect Extradited from Finland
Peter Stokes, 19, dual US-Estonian citizen and alleged Scattered Spider affiliate, was extradited from Finland to face charges in the United States. Finnish police picked him up in April 2026. He is accused of involvement in at least four Scattered Spider intrusions, including a breach of an unnamed luxury jewellery retailer in May 2025. The group demanded eight million dollars in cryptocurrency. The victim company sustained at least two million dollars in losses from disruption, response costs, and recovery. Stokes faces fraud, conspiracy, and computer intrusion charges.
Ousaban Goes After Spanish and Portuguese Banking Users
A Brazilian banking trojan named Ousaban has been observed running campaigns targeting users in Spain and Portugal. The infection chain starts with a fake PDF that links to a malicious page. If the visitor's environment matches the target profile, a VBS file downloads, which drops and executes a final EXE payload. From there, Ousaban activates when the victim visits a banking site, capturing keystrokes and screenshots, meddling with the clipboard, and opening a remote control channel for the attacker.
Browser Ransomware Generated by DeepSeek
This one is worth reading slowly. Researchers at Check Point found a malware sample that appears to have been built with assistance from DeepSeek. What it does is use the File System Access API, a legitimate browser capability available in Chrome and other Chromium-based browsers, to implement ransomware that runs entirely inside the browser. No traditional payload, no disk-level installer. It works across Windows, macOS, Linux, and Android.
There is no evidence of this being used in active attacks yet. The significance is not the specific sample, but what it demonstrates: an AI model independently identifying a realistic attack path from a legitimate platform feature, one that human researchers had only sketched out theoretically. Whether the person who built this even knew the API existed is an open question. Check Point suggests they did not. That is the uncomfortable part.
AI Agents Following the Wrong Instructions
Zscaler documented a category of attacks using indirect prompt injection, where hidden instructions are embedded in websites that AI agents visit. By combining SEO poisoning with CSS and HTML tricks to conceal the injected content from human eyes, attackers can manipulate what an AI agent perceives as legitimate. When the agent misclassifies a malicious site as trustworthy, that bad data can propagate into retrieval-augmented generation pipelines and corrupt downstream decisions. The practical risks here include misdirected payments and traffic driven toward scam or typosquatting domains.
Separately, a webinar highlighted in this week's roundup makes the same point from a different angle: AI agents operating with excessive privilege and no meaningful oversight are a new internal attack surface. The recommended controls are not exotic, least-privilege access, short-lived secrets, proper logging, and visibility into what shadow AI tooling your organisation is actually running.
Entra Conditional Access Bypass Found and Fixed
NetSPI disclosed a bypass affecting Microsoft Entra Conditional Access Policies, exploiting Nested App Authentication flows to obtain Microsoft Graph API access tokens regardless of what conditional access rules were in place. The researcher described it primarily as a persistence mechanism, since it required a successful phish to get an initial refresh token first. Microsoft has since patched it. If your environment relies heavily on conditional access for security posture, it is worth confirming you are running current.
Microsoft Tightens SSPR Authentication
Starting 7 September 2026, Microsoft's Entra self-service password reset will only accept authentication methods that users have explicitly registered. Until now, SSPR could verify identity using directory-sourced contact information such as mobile numbers or alternate emails that users never intentionally enrolled as security factors. That created a quiet trust gap. The change is part of Microsoft's Secure Future Initiative. The company is also adding jailbreak and root detection to the Authenticator app, blocking Entra credentials from working on compromised devices.
Blockchain as Command-and-Control
Two separate campaigns this week used public blockchain infrastructure to host C2 configuration, making takedowns considerably more difficult. One, documented by Palo Alto Networks Unit 42, is a ClickFix-style operation that queries the Polygon blockchain to retrieve the current C2 server address. Over 130 compromised websites have been identified. When a victim visits one, injected JavaScript performs the blockchain lookup, displays a fake CAPTCHA, injects clipboard content, and ultimately deploys a Ruby-based infostealer.
The second campaign, reported by Trend Micro, targets hotel staff at Booking.com partner companies in Japan using phishing emails disguised as guest complaints. These leverage a scheduling tool's notification system to pass email authentication checks. The payload, called TONResolver, uses the TON blockchain as its dead drop resolver. The infection chain involves a ZIP archive, a shortcut file disguised as a photo, PowerShell execution, and a Node.js-based malware calling home via TON.
Laravel Livewire RCE Exploited at Scale
A critical unauthenticated remote code execution vulnerability in Laravel Livewire, tracked as CVE-2025-54068, has been actively exploited across more than 6,100 applications. The attacker's credential stealer targets database configurations, Stripe keys, SMTP passwords, Google OAuth secrets, JWT secrets, and AWS IAM credentials from environment files. Imperva's analysis of the exfiltration infrastructure found over 1,800 database dumps and email lists containing more than 26 million addresses. Attribution points toward an Indonesian-origin threat actor, and the campaign appears to have been running for several months.
CVE Volume Is Accelerating
ProjectDiscovery reports that 30,550 CVEs have been published in 2026 so far, a pace that looks set to surpass 2025's total of 49,458. For context, the entire year of 2023 produced around 30,361. Of this year's count, nearly 3,000 are rated critical. The median time from disclosure to active exploitation is now measured in days, sometimes negative, meaning exploitation preceded public disclosure. A 55-day remediation cycle, which is not unusual for enterprise environments, is not a process at that point. It is just a delay.
Patch Priorities This Week
The full CVE list is long. Notable targets include multiple Adobe ColdFusion flaws, a Linux kernel bug dubbed Bad Epoll, Progress Kemp LoadMaster, Microsoft Exchange Server, WinRAR, Apache Tomcat, Apache ActiveMQ, WatchGuard Fireware OS, Google Chrome (a run of 15 CVEs), Langflow, JetBrains, ClamAV, Webmin, pgAdmin, QNAP QTS and related platforms, Synology MailPlus Server, and Gitea. Work through your exposure and prioritise anything internet-facing or already flagged as exploited in the wild.
Briefly
Dropping Elephant (also known as Patchwork) is running a campaign using energy-sector contract lures to deploy an in-memory RAT via DLL side-loading with a legitimate Microsoft binary. Detection is made harder by control-flow flattening and runtime API reconstruction.
Mamont, an Android trojan distributed through fake dating apps, has a second variant serving phishing overlays inside WebView, initiating calls, and suppressing notifications, all while awaiting remote instructions.
AsyncRAT is being distributed through two separate campaigns: one using Dropbox links, the other using macro-laced spreadsheets targeting sales and procurement staff.
Clubfoot Wolf and Fluffy Wolf are targeting Russian organisations with spear-phishing delivering NetSupport RAT, PureLogs Stealer, PureRAT, and Pay2Key ransomware respectively.
At least five PhaaS toolkits have been identified in active use this week: CodeStorm, ARToken, Console, Mirage2FA, and Bluekit. Tycoon 2FA has also resurfaced post-takedown with new infrastructure. Chinese-language PhaaS communities are expanding into territory historically dominated by Russian-speaking groups, with the Darcula platform now using AI-generated phishing pages that clone legitimate sites dynamically, defeating signature-based detection.
Two Venezuelan nationals received 78-month prison sentences for deploying Ploutus malware against ATMs across the US and forcing unauthorised cash withdrawals.
Researchers from Tokyo Metropolitan University and NTT Security Holdings published PhishLumos, an approach to detecting cloaking-based phishing campaigns by pivoting to infrastructure evidence when page content is unavailable or deceptive.
Tools Worth Knowing About
T3MP3ST is an open-source offensive security framework that connects to an AI coding agent and runs authorised security tests against web apps, CTF challenges, and source code, with a browser-based War Room and CLI for recon, exploit testing, and reporting. Authorised use only.
NOX is an open-source Go tool for attack surface management and vulnerability scanning, with 299 built-in modules covering OSINT, DNS, port scanning, web fingerprinting, and more. Active scans make real network requests. Same caveat applies.
The Pattern This Week
Most of these incidents did not require a sophisticated attacker. They required a trusted device, a trusted package, a trusted browser feature, or a trusted reset flow. The word "trusted" carried a lot of weight it had not earned.
Patch your stack, read your dependencies, and perhaps stop treating the mundane parts of your infrastructure as automatically safe just because nobody has bothered to exploit them yet. Someone has now.