Coverage: Last 24 hours

Today’s Highlights

AI-driven attacks, cloud exposures, and supply chain compromise feature prominently in this cycle. The exploitation of SSRF flaws in ML supply chain tools and actively abused vulnerabilities in distributed compute frameworks show attackers continue to follow the path of least resistance: open-source AI infrastructure. Multiple reports detail adversarial abuse of trusted SaaS platforms and package ecosystems to silently move data and credentials. Defensive prioritization must be laser-focused on visibility into emergent AI/ML-specific threats, SaaS telemetry, and tight control of software dependencies.

Defensive Actions

• Patch all MLflow and Ray instances urgently to remediate SSRF and RCE vulnerabilities observed in active exploitation.
• Restrict app permissions and tighten OAuth grants for AI assistants such as Microsoft Copilot Personal within SaaS environments.
• Audit API and download logs in Salesforce, ServiceNow, and developer endpoints for large-scale or automated scraping activity.
• Remove and blacklist all StubMaker-linked RubyGems, and implement typo alerting for package installs in development teams.
• Enable detailed behavioral analytics and anomaly detection within Microsoft 365 services, especially SharePoint Online and Teams.
• Rotate cloud secrets, credentials, and wallets if exposed through recent ML, Ray, or RubyGems incidents.
• Hunt for signs of single-click exfiltration from Copilot Personal and abnormal agent prompt propagation across AI orchestration platforms.
• Look for unsolicited post-breach communications from third-party extortionists, updating ransom negotiation playbooks accordingly.
• Review plugin access and authorization in customer-facing portals, and advise on phishing risks following vendor data exposures.

Table of Contents

1. Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
2. CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
3. Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
4. TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
5. One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
6. 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
7. SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers

Top Stories

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Source: The Hacker News | Risk: CRITICAL | Impacted: AI/ML engineers, Cloud infrastructure teams with MLflow deployments, Organizations integrating ML pipelines into public cloud

Summary: Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts. According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows –

Why it matters: Ongoing exploitation of MLflow’s SSRF vulnerability enables attackers to steal cloud metadata and embedded secrets, often resulting in full compromise of AI/ML pipelines and lateral access to sensitive data and compute resources.

Practitioner Perspective

MLflow is entrenched in AI/ML development pipelines and often misconfigured with overly permissive cloud permissions. Active exploitation of its SSRF flaw gives adversaries fast access to cloud credentials typically leading to API access or additional cloud resource takeover. The exploitation is not theoretical: scanning and intrusions are in progress. This forces defenders to treat exposed MLflow deployments as potentially compromised until proven otherwise. Assume any ML infrastructure facing the internet is a viable beachhead for deeper compromise.

Recommended Actions

• Patch all MLflow instances for SSRF flaws highlighted in watchTowr and VulnCheck advisories
• Isolate MLflow deployments from cloud metadata endpoints to block credential access
• Rotate secrets and cloud keys stored or accessible via MLflow servers
• Audit for unauthorized access to MLflow web UI and cloud account activity around MLflow hosts

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

Source: The Hacker News | Risk: CRITICAL | Impacted: Organizations running Ray for AI/ML workloads, Cloud and HPC environments, Data science and analytics teams

Summary: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than

Why it matters: Attackers actively exploiting a remote code execution vulnerability in Ray pose an elevated threat to organizations running distributed AI/ML workloads, enabling takeover and persistence within sensitive high-permission infrastructure.

Practitioner Perspective

Ray’s design as a distributed compute engine for AI/ML means RCE elevation can compromise sprawling cloud and on-prem data processing environments. Inclusion in CISA’s KEV list marks the exploit as widespread and observed in the wild. Unpatched Ray deployments present a pathway to both theft and tampering of models, data, and job schedules. Failing to address this immediately elevates the risk of silent, prolonged attacker footholds in critical research and analytics workflows.

Recommended Actions

• Deploy the vendor patch for Ray addressing CISA KEV-listed RCE vulnerability to all relevant compute nodes
• Scan for indicators of compromise related to Ray exploitation including unauthorized job submissions
• Restrict network exposure of Ray clusters to trusted management endpoints only
• Rotate credentials and validate integrity of ML models and data processed by previously exposed Ray instances

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Source: The Hacker News | Risk: HIGH | Impacted: Microsoft Copilot Personal users, SaaS environments integrated with M365, Organizations permitting bring-your-own-AI tools

Summary: Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim’s Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

Why it matters: Single-click compromise of Microsoft Copilot Personal accounts enables adversaries to silently extract sensitive data from all user-connected SaaS and productivity apps, raising the risk of large-scale data leaks via social engineering or phishing campaigns.

Practitioner Perspective

Organizations allowing Microsoft Copilot Personal in their environments face a high-fidelity phishing and exfiltration risk where user interaction with a crafted URL is enough to pull data from connected cloud apps. This is a significant departure from typical phishing as it abuses the trusted assistant channel and an undocumented parameter surfaced within Copilot itself. The risk profile is acute for sectors sharing sensitive data through M365 and linked SaaS tools. Controls built for web phishing detection or standard CASB monitoring may not reliably surface this attack flow. You need to redefine what ‘least privilege’ and monitoring means in the context of generative AI integrations.

Recommended Actions

• Apply Microsoft guidance and updates addressing CoSnitch vulnerabilities in Copilot Personal
• Review and restrict app permissions granted to Copilot Personal in Azure AD and SaaS tenant consoles
• Enable detailed audit logging for all Copilot Personal access to SaaS connectors
• Test user awareness on risks of interacting with unexpected Copilot-driven URLs
• Hunt for single-click exfil patterns originating from Copilot Personal endpoints

Emerging Signals

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Source: The Hacker News | Risk: HIGH | Impacted: Microsoft 365 tenants, Organizations using SharePoint Online or Teams, Large enterprises with federated Microsoft environments

Summary: Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. “TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services,” Ontinue said in a technical report shared with The Hacker News. “Tasking flows through SharePoint Online file

Why it matters: Covert abuse of Microsoft SharePoint and Teams as command-and-control infrastructure allows attackers to move laterally and steal credentials within the boundaries of trusted cloud collaboration platforms.

Practitioner Perspective

The TWINLOOT framework uses widely whitelisted Microsoft cloud traffic to mask C2 and exfiltration, rendering traditional network IOC-based detection nearly useless. Attackers can operate using benign file flows in SharePoint Online and Teams chat, bypassing most perimeter and CASB rules that allow Microsoft cloud communications. This is especially dangerous for organizations lacking deep behavioral analytics inside their SaaS estate. Analysts need to elevate detection focus from simple application blocklists to suspicious internal cloud activity.

Recommended Actions

• Hunt for known TWINLOOT artifacts and PyArmor-obfuscated Python code in SharePoint Online and Teams logs
• Strengthen behavioral analytics on lateral movement and credential access within Microsoft 365 cloud services
• Review cloud access policies and revoke overly broad SharePoint and Teams permissions
• Monitor and alert on abnormal file/tasking flows between Microsoft cloud services

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Source: The Hacker News | Risk: HIGH | Impacted: Salesforce customers, ServiceNow users, Regulated organizations using SaaS portals

Summary: A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker’s IP address, traces back to one server: 158.220.87.79,

Why it matters: Long-term unauthorized data extraction from Salesforce and ServiceNow exposes critical business and customer information, impacting compliance and eroding trust in SaaS portal security.

Practitioner Perspective

A single actor able to scrape data from both Salesforce and ServiceNow portals for a year underscores foundational weaknesses in SaaS access management and monitoring. This level of persistence implies that detection controls for legitimate user portals are consistently bypassed or insufficiently instrumented. It is likely that attackers are harvesting sensitive records from multiple industries using the same infrastructure. Security teams must urgently increase the granularity of access logging for high-value SaaS applications and review portal configurations for legacy exposures.

Recommended Actions

• Review access and download logs in Salesforce and ServiceNow for automated scraping or suspicious API activity tied to 158.220.87.79
• Re-evaluate portal configuration for legacy or unauthenticated endpoints enabling mass data export
• Enable anomaly detection for customer portal access frequency and data volume spikes
• Work with SaaS vendors to enforce rate limiting and lockout on repeated large-scale access attempts

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Source: The Hacker News | Risk: HIGH | Impacted: Ruby on Rails developers, Windows-based developer workstations, CI/CD pipelines using RubyGems

Summary: Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below – ubnuler ubnlder ri18nr reaker rakier orakw joxn

Why it matters: Developers who install typosquatted RubyGems packages risk credential theft and crypto wallet compromise, showing that even established package ecosystems remain attractive vectors for supply chain attacks.

Practitioner Perspective

The StubMaker threat actor is exploiting mistakes and developer haste to deliver a Windows-targeting info-stealer via 16 malicious RubyGems packages. Widespread package manager reliance means a single typo can compromise development workstations and cascade further into CI/CD pipelines. Teams using RubyGems must assume attackers will continue to iterate and submit new variants, and cannot depend solely on automated package repository policing. Developers must know that copy-pasting install commands is now a supply chain risk.

Recommended Actions

• Remove and blacklist all StubMaker-linked RubyGems: ubnuler, ubnlder, ri18nr, etc. as disclosed on 2026-08-15
• Scan developer endpoints for the presence of any of the 16 known malicious RubyGems packages
• Revoke and reissue browser credentials and crypto wallets accessed from affected endpoints
• Implement allow-list based controls and typo alerting for RubyGems install workflow

SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers

Source: The Hacker News | Risk: MEDIUM | Impacted: SafePal customers, Cryptocurrency holders using hardware wallets, Crypto exchange partners of SafePal

Summary: SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. The hardware wallet maker said all affected customers were notified individually by email on August 16 from [email protected], with the subject line “[Important] Your SafePal Order

Why it matters: Exposure of nearly 40,000 customers’ personal and purchase information via an authorization bug in a hardware wallet vendor’s order-tracking plugin increases targeted phishing and social engineering threats against cryptocurrency holders.

Practitioner Perspective

SafePal’s disclosure confirms that hardware wallet vendors are not immune to supply chain or plugin-induced privacy incidents. Customer PII linked to device purchases creates high-value targeting data for cryptocurrency-focused threat actors. Security teams in the crypto/fintech sector must adapt incident response and customer notification procedures for fast-moving third-party plugin exposures. Hardware wallet owners are now on the radar for phishing aiming to compromise assets outside of SafePal’s platform.

Recommended Actions

• Verify receipt and contents of SafePal breach notification for affected users sent on August 16
• Monitor for phishing attempts referencing SafePal order or shipping details
• Review third-party plugin access and authorization controls for customer-facing portals
• Advise hardware wallet users on precautions for targeted social engineering

Exploits & CVEs

(See first two stories: MLflow and Ray vulnerabilities are under active exploitation and present critical SSRF and RCE risk, with public exploit activity reported. Both must be prioritized for emergency patching.)

What We’re Watching

• Surge in exploitation attempts of MLflow SSRF and Ray RCE flaws: monitor for vendor updates and active scanning for these CVEs.
• Increased attacker use of Microsoft 365 cloud services (SharePoint, Teams) as covert C2 and credential exfiltration channels.
• Persistence of ‘City Forum’ threat actor scraping Salesforce and ServiceNow: continued observation of scraped data use possible.
• Evolution of typosquatting campaigns targeting developer package managers, likely expanding beyond RubyGems.
• Risk of cross-vendor social engineering targeting SafePal-exposed PII among cryptocurrency holders in upcoming phishing campaigns.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AI Security, Cloud Security, cybersecurity, daily briefing, supply chain risk, Vulnerabilities