SecuriTricks

CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours

A critical vulnerability in Langflow, an open-source visual framework for AI agents and RAG pipelines, was disclosed on March 17, 2026. The vulnerability, CVE-2026-33017, allows unauthenticated remote code execution on exposed Langflow instances. Within 20 hours, exploitation attempts were observed…

vulnerability

exploitation

Published: March 20, 2026

Linked vulnerabilities : CVE-2025-3248 (CVSS 9.8), CVE-2026-33017 (CVSS 9.3)

Downloadable IOCs: 1

Analyzing the Current State of AI Use in Malware

Unit 42 researchers investigated the use of large language models (LLMs) in malware creation and functionality. They examined two samples: a .NET infostealer incorporating OpenAI's GPT-3.5-Turbo model via API, and a Golang-based malware dropper leveraging an LLM for environment assessment. The info…

Published: March 19, 2026

Linked vulnerabilities : CVE-2026-0628 (CVSS 8.8)

Downloadable IOCs: 4

SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains

An active supply chain worm campaign, dubbed SANDWORM_MODE, is spreading through typosquatting and AI toolchain poisoning across at least 19 malicious npm packages. The worm exhibits Shai-Hulud characteristics, incorporating GitHub API exfiltration with DNS fallback, hook-based persistence, SSH pro…

Published: February 23, 2026

Downloadable IOCs: 2

Cryptocurrency Sector Targeted with New Tooling and AI-Enabled Social Engineering

North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The at…

Published: February 9, 2026

Downloadable IOCs: 15

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The at…

Published: February 9, 2026

Downloadable IOCs: 15

AI Waifu RAT: A Ring3 malware-like RAT based on LLM manipulation is circulating in the wild

A niche LLM role-playing community is being targeted by a sophisticated social engineering attack disguised as an AI character enhancement tool. The 'AI Waifu RAT' is a Remote Access Trojan marketed as a feature allowing AI characters to interact with users' computers. The RAT, distributed under th…

Published: September 1, 2025

Downloadable IOCs: 7

AI brings back real trojan horse malware

Trojan horses, once rare, are making a resurgence due to AI and Large Language Models (LLMs). These new trojans, disguised as legitimate applications like recipe apps or AI-powered image search tools, are evading traditional security measures. They appear professional, pass VirusTotal scans, and ex…

Published: August 13, 2025

Downloadable IOCs: 0

Cybercriminals camouflaging threats as AI tool installers

Cybercriminals are exploiting the popularity of AI by distributing malware disguised as AI solution installers. Three threats have been identified: CyberLock ransomware, Lucky_Gh0$t ransomware, and a newly discovered destructive malware called Numero. CyberLock, developed using PowerShell, encrypts…

Published: June 5, 2025

Downloadable IOCs: 20

Malicious attack method on hosted ML models now targets PyPI

A new malicious campaign has been discovered targeting the Python Package Index (PyPI) by exploiting the Pickle file format in machine learning models. Three malicious packages posing as an Alibaba AI Labs SDK were detected, containing infostealer payloads hidden inside PyTorch models. The packages…

Published: May 26, 2025

Downloadable IOCs: 2

New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms

As artificial intelligence (AI) surges into mainstream adoption, millions of users turn daily to AI-powered tools for content creation—from generating art and music to transforming photos into videos. But amid this excitement, cybercriminals have uncovered a potent new lure: fake AI platforms promi…

Published: May 12, 2025

Downloadable IOCs: 32

Real-Time Anti-Phishing: Essential Defense Against Evolving Cyber Threats

Phishing remains a prevalent cybersecurity threat, causing financial loss, data theft, and malware deployment. Attackers are expanding targets across platforms and using AI to refine techniques, making detection more challenging. Real-time anti-phishing (RTAP) solutions using AI and machine learnin…

real-time anti-phishing

employee awareness

Published: March 21, 2025

Downloadable IOCs: 11

Fake AI video generators infect Windows, macOS with infostealers

Threat actors are using fake AI image and video generators to distribute Lumma Stealer and AMOS information-stealing malware on Windows and macOS. These malicious programs masquerade as an AI application called EditProAI, targeting users through search results and social media advertisements. The m…

Published: November 16, 2024

Downloadable IOCs: 0

Inside Iran's Cyber Playbook: AI, Fake Hosting, and Psychological Warfare

Iranian cyber group Emennet Pasargad, operating as Aria Sepehr Ayandehsazan (ASA), has been linked to targeting the 2024 Summer Olympics and compromising a French display provider. The group, part of Iran's Islamic Revolutionary Guard Corps, used AI software, fictitious hosting resellers, and psych…

psychological tactics

information warfare

Published: November 1, 2024

Downloadable IOCs: 0

The Emerging Dynamics of Deepfake Scam Campaigns on the Web

Researchers have uncovered dozens of scam campaigns utilizing deepfake videos featuring public figures like CEOs, news anchors, and government officials. These campaigns target victims in multiple countries using various languages. The scams promote fake investment schemes and government giveaways.…

infrastructure analysis

Published: September 2, 2024

Downloadable IOCs: 428

Growing Number of Threats Leveraging AI

Symantec has observed a rise in attacks using Large Language Models (LLMs) to generate malicious code for delivering payloads like Rhadamanthys, NetSupport, CleanUpLoader, ModiLoader, LokiBot, and Dunihi. The campaigns involve phishing emails with attachments that execute LLM-generated scripts to d…

ai

2024-07-25

llm

Published: July 25, 2024

Downloadable IOCs: 37

SugarGh0st RAT Used to Target American Artificial Intelligence Experts

This intelligence report provides details about a SugarGh0st RAT campaign conducted by an unattributed threat actor, tracked as UNK_SweetSpecter, targeting organizations in the United States involved in artificial intelligence (AI) efforts across academia, private industry, and government. The camp…

Published: May 16, 2024

Downloadable IOCs: 9

Tag: ai

Attack reports

CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours

Analyzing the Current State of AI Use in Malware

SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains

Cryptocurrency Sector Targeted with New Tooling and AI-Enabled Social Engineering

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

How AI Is Fueling a New Wave of Black Friday Scams

AI-Driven Deepfake Military ID Fraud Campaign

From summer camp to grind season

AI Waifu RAT: A Ring3 malware-like RAT based on LLM manipulation is circulating in the wild

AI brings back real trojan horse malware

Cybercriminals camouflaging threats as AI tool installers

Malicious attack method on hosted ML models now targets PyPI

New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms

Real-Time Anti-Phishing: Essential Defense Against Evolving Cyber Threats

Fake AI video generators infect Windows, macOS with infostealers

Inside Iran's Cyber Playbook: AI, Fake Hosting, and Psychological Warfare

The Emerging Dynamics of Deepfake Scam Campaigns on the Web

Growing Number of Threats Leveraging AI

SugarGh0st RAT Used to Target American Artificial Intelligence Experts