Meta's Muse AI can be hijacked

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🎙️ Meta's Muse AI can be hijacked

🔓 WordPress flaw enables site takeover

🇰🇵 North Korean hackers weaponize fake job recruiters

📦 Backdoor infects 65 GitHub repos

🕵️ Z.ai tool secretly uploaded dev files

Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.

🎙️ Meta's Muse AI can be hijacked LINK

A zero-day flaw in Meta's Muse AI agent for macOS lets malware already running under a user account hijack the assistant, intercept dictated prompts, inject malicious instructions, and steal authentication material tied to the victim's account.

Researcher Patrick Wardle released a proof-of-concept named "not-a-mused" showing an unprivileged local process can change an undocumented setting to redirect Muse's dictation traffic to an attacker-controlled server, enabling prompt injection and session hijacking through the trusted workflow.

The bug gives no remote code execution on a clean Mac, attackers must already run code as the local user, but it amplifies access by abusing Muse's delegated authority over files, email, purchases and linked devices; Meta had not responded, and users should pause the app.

🔓 WordPress flaw enables site takeover LINK

A WordPress flaw called Click2Shell, fixed in version 7.1.1 released on September 17, 2026, lets attackers run PHP code and fully take over a site after tricking a logged-in administrator into clicking a crafted link.

Researchers at PWNAI showed the bug abuses the theme-preview workflow: the browser-side JavaScript keeps the raw URL value in a jQuery selector, letting an attacker inject selector syntax that silently triggers the Install button using the admin's session and nonce.

Chained with a vulnerable inactive theme (the proof of concept used Mobile Repair Zone 2.5.4, whose AJAX plugin-install function lacked nonce and capability checks), attackers can load their own plugin as server-side code; the 7.1.1 fix escapes the URL-derived slug.

🇰🇵 North Korean hackers weaponize fake job recruiters LINK

North Korean hacking group WaterPlum, also tracked as Contagious Interview, posed as job recruiters to infect at least 30,000 devices across more than 100 countries and route roughly $10.7 million in stolen cryptocurrency to Pyongyang.

Between December 2025 and July 2026, the group approached developers and crypto specialists on job boards and freelance sites, then during fake interviews or coding tasks told them to download malicious files that installed a backdoor stealing browser and wallet logins, keystrokes, screenshots, and ID documents.

The malware drained funds or credentials from over 7,000 crypto wallets and let attackers use victims' machines as a foothold into corporate networks; a joint advisory from Japan, the US, Australia, and Germany also linked WaterPlum to North Korea's fake IT worker scheme through overlapping IP addresses.

📦 Backdoor infects 65 GitHub repos LINK

Attackers ran a software supply-chain campaign called GHAPPIER that abused npm's trusted publishing to hide a backdoor inside a legitimate package, reaching at least 65 public GitHub repositories, 73 infected files, and 22 accounts.

The attackers hijacked a maintainer account for about 105 minutes on September 9, changed the release workflow so any push triggered automatic publishing, and pushed version 0.2.21, which stayed the latest release for 35 minutes before being pulled.

The loader hid in a single line of a 99 KB file and ran only when the MCP server launched, delivering a self-deleting remote shell; a second payload matched the PolinRider campaign, so teams should replace lockfile references to 0.2.21 with 0.2.22.

🕵️ Z.ai tool secretly uploaded dev files LINK

Z.ai, China's second-largest AI company also known as Zhipu AI, admitted its ZCode coding assistant silently uploaded users' local files and data to online servers without consent, prompting a public apology and fixes on Friday.

The tool's upload mechanism was enabled by default with no way to turn it off; one developer, Ferstar, found ZCode compressed and encrypted 313MB of his files, tried 564 times to send them to Alibaba Cloud storage, and succeeded in siphoning a 15KB file.

Z.ai says it fixed the unauthorized uploading, destroyed any data sent to its cloud, and plans to open-source ZCode's codebase for third-party review, though there is no indication how long the behavior existed or whether project contents were exposed beyond visible filenames.

💡 Strategies & Tactics

> Context Bombs Trick Autonomous Qwen AI Agents Into Stopping Cyberattacks: Defenders can hide fake operator commands in decoy cloud secrets that trick attacking AI agents into halting their own intrusions.

> Transforming Bedrock Guardrails events into OCSF with CloudWatch: Convert Bedrock guardrail blocks into a standard security format so analysts can query them alongside login and network data to spot coordinated attacks.

> Simulation highlights OWASP LLM Top 10 risk of unbounded consumption: Set hard spending caps and automatic stop-limits on AI agents, since attackers can poison their inputs to trigger endless tool calls and huge bills.

> Dump Encoding Library: Attackers can hijack a trusted Microsoft crash-dump encryption file to hide their malware, but defenders can catch it by watching which programs load that file.

> Package Manager Threat Model, Revisited: Auditing package managers by attacker goals rather than dangerous code patterns catches ownership and feature-seam bugs that generic scanners miss entirely.

> Understanding Prompt Injection In Order to Contain It - Julie Brunias - ASW #401: Contain prompt injection by limiting what an AI agent can reach after a breach, since agents will eventually go off-path and expose leaked credentials.

Other news you might like

• Aikido releases open-weight AI cybersecurity model, AltarLINK

• CISA orders feds to patch Zyxel flaw exploited for data theftLINK

• Public PoC Exposes Critical Veeam Agent Privilege EscalationLINK

• The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business filesLINK

• AWS Automatically Quarantines Exposed IAM Keys Within 10 Seconds of GitHub LeakLINK

• D-Link Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without AuthenticationLINK

• Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day ExploitsLINK

• Vidar Malware Rewrites Its Obfuscation With Every Build to Make Detection HarderLINK

🧰 Trending tools

Halo: an API-first platform that detects deepfakes and synthetic media across text, image, and audio, helping fraud and trust teams block attacks.LINK

qsa.sh: scans your public IP for open ports and known vulnerabilities using naabu, nmap, and nuclei, streaming results to your terminal via one curl command.LINK

Cynative Security Research Agent: open-source AI CLI that answers plain-language security questions across code, cloud, and Kubernetes using read-only, IAM-enforced production access.LINK

Aegisora: an open-source proxy that secures LLM agents with least-privilege API access, PII masking, prompt-injection blocking, and audit logging for production.LINK

Agent Chaperone: screens AI agent tool calls and results, blocking risky, off-task, or secret-leaking actions and detecting prompt injections before execution.LINK

Prized: builds secure internal tools with AI for ops, support, and finance teams, featuring pre-connected data, access audit trails, and one-click deploy behind company sign-in.LINK

📚 Trending papers & reports

Security agents can teach themselves to hunt software bugs better by rewriting their own instructions from what worked, without retraining the underlying model or needing scarce expert examples.LINK

Coding checklists cut serious security flaws in AI-written backend code from 53 to 11 across five leading models, showing a short upfront spec beats the instruction files teams already use.LINK

Memory-poisoning defenses for AI agents mostly cost nothing on normal traffic, except one reranking method that wrongly blocks legitimate memories in ~34% of cases and shaves ~4 points off accuracy.LINK

Electromagnetic snooping can catch a malicious hidden chip circuit tampering with a computer's core memory in real time by spotting the abnormal software behavior it triggers, without adding hardware or damaging the device.LINK

Quantum-safe encryption runs nearly as fast inside lightweight virtual containers on embedded devices as on bare hardware, though picking the wrong algorithm can swing energy per secure connection by up to a thousandfold.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!