Persistence

Claude Code VS Code Extension Trojanized with SSH Backdoor

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Oct 30, 2026

The official Anthropic Claude Code extension on the Cursor IDE marketplace was compromised with a malicious 66-line JavaScript loader that installs a persistent SSH backdoor, affecting up to 5,000 users. The malware establishes reverse tunnels to an attacker-controlled server, harvests environment variable names (including cloud credentials and API keys), and installs cross-platform persistence mechanisms. Anthropic has since released a clean version 2.1.314, but all users of the compromised version remain at risk of persistent access even after removal.

RatHat Android Malware Uses Generative AI to Control Devices

ATLAS OWASP HIGH ▲ 6.2 The Hacker News Sep 18, 2026

RatHat is a sophisticated Android RAT attributed to China-based threat actors that abuses Android Debug Bridge (ADB) to maintain persistent shell access even after the malware is uninstalled. Notably, the malware integrates a generative AI assistant to parse on-screen accessibility trees and autonomously direct device interactions, representing an emerging class of AI-augmented mobile threats. Its layered anti-analysis techniques and persistence mechanisms make it a significant threat to Android users targeted via smishing and malvertising campaigns.

AI Gateways Targeted: LiteLLM, RAGFlow, Kestra Compromised

ATLAS OWASP HIGH ▲ 8.5 Microsoft Security Blog Aug 27, 2026

Microsoft Security Research documented active intrusions targeting three distinct AI infrastructure components — a LiteLLM gateway, a RAGFlow retrieval platform, and a Kestra workflow orchestrator — revealing a pattern of attackers treating AI control planes as high-value targets for credential theft and compute abuse. Across all three cases, attackers converged on the same objectives: stealing model-provider API keys, establishing persistence, and monetising compromised compute resources. The findings signal that AI-specific middleware and orchestration layers require the same security rigour as traditional enterprise critical infrastructure.

DPAPI Abuse in Claude Code and Cursor Triggers EDR

ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jul 09, 2026

Sophos telemetry from June 2026 reveals that AI coding agents including Claude Code, Cursor, and OpenAI Codex are triggering endpoint detection rules designed to catch human attackers, performing actions such as DPAPI-based credential decryption, Windows Credential Manager enumeration, and persistence via startup folder writes. The behaviour is not malicious in intent, but the agents exhibit attacker-like pivot-when-blocked logic and abuse legitimate Windows utilities in ways indistinguishable from living-off-the-land intrusions. This blurring of the line between benign automation and attack tradecraft creates significant noise for defenders and may erode confidence in high-fidelity detection rules.

CVE-2026-44112: OpenClaw Sandbox Escape and RCE

ATLAS OWASP CRITICAL ▲ 8.9 The Hacker News May 15, 2026

Researchers at Cyera disclosed four vulnerabilities in OpenClaw, an AI agent runtime platform, that can be chained to achieve credential theft, privilege escalation, and persistent backdoor access. The attack chain, dubbed 'Claw Chain', exploits sandbox escapes, allowlist bypasses, and a spoofable ownership flag in the MCP loopback runtime to weaponise the agent's own privileges against the host environment. All four CVEs have been patched in OpenClaw version 2026.4.22 and users should update immediately.

CVE-2026-45321: Supply Chain Worm Targets Mistral AI

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News May 13, 2026

The TeamPCP threat actor has executed a broad supply chain campaign dubbed Mini Shai-Hulud, injecting credential-stealing malware into npm and PyPI packages from major AI and developer tooling ecosystems including Mistral AI, Guardrails AI, and TanStack. The malware profiles execution environments, exfiltrates cloud, CI, and AI tool credentials, and establishes persistence inside Claude Code and VS Code IDEs. The TanStack compromise alone affected 42 packages and 84 versions, exploiting a chained GitHub Actions attack to inject malicious payloads without stealing npm tokens directly.