This week’s ThreatsDay bulletin reveals a worrying trend in cyberattacks: threat actors are exploiting trusted systems, AI platforms, and simple user interactions to carry out increasingly sophisticated and low-effort attacks. From search poisoning in ChatGPT and Gemini to a visual studio code compromise via a single link, these incidents underscore how fragile security can be when trust is abused, defaults are weak, or access isn’t tightly controlled. Here are the major developments reshaping risk in cyber security as of late September 2026.
Major Threats Emerging From AI Search Poisoning, Code Leakage & Remote Exploits
One of the most alarming new campaigns involves “AI search poisoning,” where malicious content is flooding the web—fake support pages, PDFs, reviews, login images—so that AI assistants like ChatGPT, Gemini, and Google AI Overviews will surface false phone numbers, phishing traps, and login portals instead of legitimate information. Targets include major brands such as Delta, Lufthansa, Bank of America, Airbnb, TripAdvisor and others. Attackers are using hosting platforms, social media, embeddable event pages and review sites to spread convincingly polished disinformation. All to trick both AI models and users into misplacing their trust.
At the same time, coding assistants are showing concerning behavior around data privacy. One Chinese company, Z.ai, disabled features in its ZCode tool after it was discovered that local code repositories were being uploaded to Alibaba Cloud without explicit user consent. This mirrors an earlier incident involving SpaceXAI’s Grok Build CLI, which uploaded user repositories to Google Cloud’s infrastructure—showing that code leakage is becoming a recurring issue in AI code tooling.
Remote exploits and attacks with minimal user interaction are also on the rise. Visual Studio Code’s Workspace Trust feature can be bypassed: clicking a seemingly normal link is enough for an attacker to run arbitrary code in VS Code with the user’s own permissions. No zero-day, no memory corruption—just misplaced trust and a compromised setting. In addition, a Windows/macOS clipboard hijacker was secretly inserted into the supply chain of a popular Python face-swap app called Deep-Live-Cam. A similarly heavy threat came through a malicious “typo-squatted” npm package named ulid-xyz that quietly installs a remote access trojan during post-install, giving threat actors control over multiple platforms.
Other Threats & Protective Moves to Watch
An Android banking trojan named RemControl has surfaced across Europe, the Middle East, and Canada, delivered via fake Google Play Store pages spoofing a popular IPTV app. It uses Android’s Accessibility API to overlay phishing screens over banking apps, logs keystrokes, streams screens, and gives operators full remote access. The infrastructure is designed to rotate dynamically using Telegram as a dead-drop. Notably, Russian language artifacts in the phishing overlays suggest cross-border involvement.
Meanwhile, maintainers of the Admin Menu Editor Pro plugin for WordPress had to push out emergency updates after a malicious version emerged on September 14, 2026. That update installed a web shell via a newly added file, leaving thousands of sites at risk until cleanup and validation protocols could be fully applied.
On the defense front, GitHub now offers a new cache-mode in GitHub Actions that limits cache access at the workflow/job level, helping prevent cache poisoning attacks—especially those where one workflow artifact is read by another and used to inject malicious dependencies with privileges. Ubuntu’s parent, Canonical, is also speeding up its patch cycles, moving toward a unified two-week schedule for kernel security updates to respond faster to the surge in AI-driven CVEs.
Other issues include super-app threats: the Russian “MAX” app, which bundles messaging, e-commerce, and government services, has been found to silently capture screenshots, read/write local storage of mini-apps, inject JavaScript into them, and act as a proxy for network traffic—all without raising alarm. And phishing continues to exploit human psychology: a fake Claude Max giveaway used a browser-in-the-browser trick, imitating a Google-sign in window, to steal account credentials.
Also notable: fraud rings impersonating law enforcement have cost victims over $1.6 billion in losses since early 2025; new MaaS (malware-as-a-service) strains like Exvicy are scaling distribution via compromised WordPress sites; and low-noised, user-driven malware like DarkMe has returned, skipping technical exploits entirely in favor of social engineering.
On the policy and infrastructure side, U.S. agencies FBI and CISA issued guidance urging critical infrastructure operators to strictly limit third-party integrator access using least privilege. These warnings come as many exploits start not with advanced zero-days but with simple over-privileged access or weak defaults.
What This Means & What You Should Watch For
These attacks share common DNA: trust mis-placed, defaults badly configured, old software unpatched, and adversaries forgetting about flashy exploits—they’re just walking through the front door you left open. AI-powered tools don’t inherently create new risk; they expand the impact of known ones.
Enterprises and individuals alike must strengthen controls around AI tools—watch what code they upload, what they allow them to access, and where content originates. Tighten supply chain hygiene, enforce least privilege, maintain kernel patches, and harden trust boundaries in editors and digital workflow tools.
The race isn’t only for detection, it’s for prevention. The next week or two may reveal whether the security community can get ahead of AI-powered disinformation and exploitation campaigns before they become even harder to reverse. Security won’t get quieter until small gaps are welded shut.
