Hackers compromised HBO Max's verified Reddit account and posted 108 malicious ads using ClickFix social engineering to distribute information-stealing malware to Windows and macOS users. The campaign, linked to a broader operation called PasteSwitch, tricked victims into pasting commands into their terminals to install fake applications, including counterfeit HBO Max apps and cryptocurrency wallets.
Researchers at UC Santa Barbara discovered that LLM API routers used for cost optimization can act as malicious intermediaries, with 9 routers actively injecting malware into AI responses and 17 stealing credentials. The risk is amplified when autonomous agents execute code without human approval, potentially allowing attackers to compromise systems through compromised routers or prompt injections.
ClickFix attacks are deceiving Mac and Windows users through fake ads on Reddit, including a compromised HBO Max account, by displaying fake CAPTCHA prompts that trick users into pasting malware code into their terminal, instantly installing info-stealing malware that can access passwords and crypto wallets.
Fake GitHub repositories with misleading names are distributing malware through PowerShell commands that execute multi-stage scripts. The attack uses DLL sideloading to deploy a stealer that harvests credentials from browsers, Discord, Steam, and gaming platforms while displaying fake installer progress messages.
A security researcher identified 40 malicious Chrome extensions collectively installed by approximately 21.9 million users, documenting capabilities including credential theft, traffic exfiltration, affiliate link injection, and undisclosed data collection. The analysis found 7 extensions actively transmitting data and 33 containing malicious code not observed firing during testing, with common offenses including full-URL exfiltration, fingerprinting, and unauthorized telemetry.
Snyk Agent Scan analyzed nearly 4,000 agent skills across major marketplaces and discovered credential theft, backdoors, and data exfiltration in publicly available skills. The company released Skill Inspector, a CLI tool that scans agent skills and MCP servers for malicious code and security vulnerabilities before installation, detecting risks like prompt injection, malicious code patterns, credential exposure, and supply chain attacks.
Anomalously high email open rates—exceeding 100%—can indicate compromised accounts rather than successful campaigns. Attackers exploit DKIM replay by sending one authenticated message through a legitimate account, then redistributing that signed message to thousands of recipients, causing the tracking pixel to fire far more times than the original recipient count, creating mathematically impossible open-rate metrics.
A research study systematically examines malicious intermediary attacks on LLM API routers, which operate as plaintext proxies between clients and model providers. Researchers found active code injection, credential theft, and token exfiltration across hundreds of routers, and developed Mine, a research tool demonstrating four attack classes and evaluating client-side defenses.
Deadbugz is a malicious MCP server that evades detection by behaving benignly during initial review, then activating malicious behavior after three tool calls to steal credentials. The attack targets GitHub repositories via pull requests modifying MCP configuration files, exploiting the fact that tool descriptions used to steer AI agents are invisible to human operators.