Threats Tagged 'python'

CAIRN is a research toolkit developed by Cisco Talos for hunting, classifying, and tracking AI-integrated malware by analyzing metadata artifacts left by attackers. It identifies malware that operationalizes or exploits AI systems by extracting cognitive artifacts such as prompt templates, API endpoints, and evasion strings without requiring binary execution. CAIRN uses acquisition filters, relationship graphing, YARA rules, and semantic discovery to detect and attribute AI-enabled malware families. This metadata-first approach enables scalable and fast detection of emerging threats that integrate AI functionality.

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

CVE-2026-0768 is a critical remote code execution vulnerability in the AI low-code platform Langflow. It allows unauthenticated attackers to execute arbitrary Python code as root via improper validation in the custom component editor's code validator. The flaw affects all Langflow versions up to 1.4.2. Exploitation has been observed in the wild, primarily for reconnaissance and credential harvesting, with notable attack activity originating from Russia. The vulnerability was reported in July 2025 and publicly disclosed as a zero-day in January 2026.

The TerminalFix campaign is a sophisticated multi-stage intrusion targeting organizations via compromised websites that display fake Cloudflare CAPTCHA overlays. Victims are tricked into executing malicious PowerShell commands that download and execute a signed legitimate binary alongside a malicious DLL for sideloading. This leads to steganographic payload extraction, extensive Active Directory reconnaissance, and deployment of a Python-based reverse-tunnel implant providing persistent network-level proxy access. The campaign enables attackers to pivot within the network, conduct domain enumeration, and maintain stealthy persistent access. Although no direct downstream actions were observed, the access gained could facilitate privilege escalation, data exfiltration, and ransomware deployment. The campaign combines advanced evasion techniques and persistent network access, posing a serious threat to enterprise environments.

This report presents statistical analysis of compilers and linkers used to generate malicious Portable Executable (PE) files, based on a large dataset of malware samples collected from Malware Bazaar between 2020 and 2026. The analysis leverages metadata extracted from PE headers, including the Microsoft Rich Header, .NET CLR metadata, and heuristic string scans for non-Microsoft compilers. The data reveals that 32-bit PE files remain prevalent in malware, with a significant portion of samples lacking identifiable compiler signatures. Microsoft toolchains and Borland compilers are among the most common identified, while newer languages like Go and Rust are less frequently used. The study highlights the utility of PE metadata for malware clustering and attribution but cautions that metadata can be tampered with.

In this article AI workloads are becoming high-value control points Case study 1: LiteLLM gateway compromise Case study 2: RAGFlow compromise Case study 3: Kestra compromise Mitigation and protection guidance MITRE ATT&CK techniques observed References Learn more AI is creating a new layer of enterprise infrastructure. Gateways, retrieval platforms, orchestration services, and containerized runtimes now sit between users, applications, data, and models. These systems concentrate credentials, data access, model connectivity, and execution privileges, making them some of the most powerful components in the AI stack. That concentration of trust is also creating new opportunities for attackers. In recent investigations, Microsoft observed activity targeting three distinct AI workloads: a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. The intrusion paths varied, but the objectives were strikingly similar. Attackers sought to steal credentials, establish persistence, and monetize compromised compute resources. The individual techniques matter, but the broader pattern matters more. Across these cases, attackers treated AI infrastructure as a control plane where credential theft, host compromise, and downstream data access can converge. As organizations continue to deploy AI systems, these platforms are becoming high value targets that deserve the same security scrutiny as other critical enterprise infrastructure. AI workloads are becoming high-value control points The campaign-level signal extends beyond one product. The targeted workloads served different functions, but each exposed assets that could support follow-on abuse, including model-provider keys, proxy-issued virtual keys, database connection strings, tenant configuration, workflow execution, or host compute. Post-compromise behavior varied by workload role. Defenders should inventory exposed AI management surfaces, restrict administrative access, and monitor for gateway-originated execution and secret access. Three observed compromises across AI workloads AI workload Observed activity Attacker objective LiteLLM Observed attacker activity : Python droppers, runtime secret harvesting, PostgreSQL collection, miner deployment, and persistence activity from the LiteLLM gateway context. Microsoft assessment: Initial access likely occurred through exploitation of the exposed LiteLLM gateway surface, consistent with the vulnerability chain involving CVE-2026-42271 and CVE-2026-48710. Credential theft, backend database access, durable host access, and compute monetization. RAGFlow Observed attacker activity : Possible SSRF-style reconnaissance followed several days later by code execution, application-path modification, and placement of a Python hook in the TenantLLM credential-configuration flow. Public research: Describes multiple RAGFlow execution paths; Microsoft does not attribute this intrusion to a specific vulnerability. Intercept newly configured LLM provider credentials and model metadata. Kestra Observed attacker activity : Workflow-origin shell execution, Docker and container-environment discovery, XMRig deployment, and follow-on data collection. Microsoft assessment: Initial access likely involved exploitation of the exposed Kestra orchestration surface, with CVE-2026-49869 providing relevant public vulnerability context. Secret discovery, container-level access, data collection, and rapid compute monetization. Case study 1: LiteLLM gateway compromise Framework role and affected runtime context LiteLLM is commonly deployed as a proxy or gateway between applications and model providers. In that position, the service may hold or retrieve model-provider keys, LiteLLM master keys, virtual-key records, database connection strings, routing configuration, and tenant policy data. Command execution in the gateway runtime therefore exposed a process context close to AI routing and credential material. Figure 1. LiteLLM gateway compromise – attack chain…

CVE-2026-78379 is a critical vulnerability in Amazon Strands Agents Tools prior to version 0.8.5. It involves improper neutralization of input used for large language model (LLM) prompting in the python_repl tool. This flaw allows remote attackers to execute arbitrary Python code on the host running the agent by bypassing the human consent mechanism through a crafted prompt. The issue is mitigated by upgrading to version 0.8.5 or later.

Multiple ClickFix malware campaigns have been identified using three delivery methods: MSI packages with DLL sideloading, NodeJS-executed JavaScript, and Python 3.5 payload execution. These campaigns use aggressive social engineering, including phone calls directing victims to compromised WordPress sites. Post-compromise activities include extensive system discovery and Active Directory enumeration. The campaigns share infrastructure and tactics linked to the Lorem Ipsum malware family and Vanilla Tempest adversary, with potential ransomware deployment as a final goal.

Bulletin ID: 2026-065-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/23/2026 13:00 PM PDT Description: The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. We identified CVE-2026-16796, an improper neutralization of argument delimiters in the install_packages() method that might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. Impacted versions: bedrock-agentcore version <1.18.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.