12 stories · 3 sources · 4 high · ~15 min read

Coverage: Last 24 hours

Today’s Highlights

A surge of AI-driven threats and automation is reshaping both the attack landscape and defensive playbooks: npm malware powered by large language models (LLMs), persistent Android backdoors, self-rewriting agentic pentesting, and industry-wide moves towards standardizing AI incident reporting all demand that defenders adapt quickly to stay ahead of adversaries and their tools. Today’s top stories examine the PhantomRaven npm info-stealer, China-based RatHat Android malware exploiting the Android Debug Bridge, and the rapid escalation of Oracle vulnerabilities. Automation and the push for governance, including OpenAI’s incident-disclosure framework, signal how defenders should adjust governance and response.

Table of Contents

1. Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
2. RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
3. ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
4. Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
5. CISO’s Expert Guide to Agentic Pentesting for Websites
6. Andrew Hastie says AI advised him to reply ‘congratulations!’ to man who planned to end life with assisted dying
7. ‘Brutal’: thousands of T-shirt designs stolen and listed on Temu, Sydney label claims
8. Inside the scramble for trusted AI cops

Critical   High   Medium   Low

Top Stories

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

Source: The Hacker News | Published: Sep 18 | Risk: HIGH | Impacted: JavaScript developer environments, npm supply chain users, CI/CD infrastructure, Organizations using open source dependencies | Topics: Malware / Vulnerability

What happened: A threat actor, claiming to be a bug bounty hunter, developed the PhantomRaven JavaScript information stealer using a large language model (LLM). This malware was distributed through npm packages to steal authentication tokens and credentials from developers. The actor has been active since November 2022, claiming bounties from multiple sectors.

Why it matters: Unmonitored AI-assisted malware tooling enables low-barrier credential theft campaigns at scale, threatening the integrity of software development pipelines and exposing sensitive tokens to broader compromise.

How it works: PhantomRaven is a JavaScript-based information stealer, distributed via npm packages, that uses code likely generated or augmented by large language models (LLMs) to exfiltrate credentials and authentication tokens from developer systems.

Practitioner Perspective

Developers using npm and related JavaScript packages are facing a rapidly evolving threat as attackers weaponize large language models (LLMs) to generate sophisticated info-stealing malware. This shift means defenders must prepare for an onslaught of polymorphic, AI-tailored threats entering supply chains that bypass traditional signature-based controls. Routine monitoring for abnormal npm package behaviors and robust credential hygiene are now mandatory. Supply chains with weak review mechanisms or indirect dependency risks are especially exposed. The top priority: ensure every entry point for developer credentials, tokens, or secrets in build processes is tightly monitored and verified even for seemingly benign packages.

Recommended Actions

• Hunt for PhantomRaven npm stealer IOCs in developer endpoints and CI/CD logs
• Regularly audit third-party npm packages for abnormal reachout or credential harvesting behaviors

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Source: The Hacker News | Published: Sep 18 | Risk: HIGH | Impacted: Enterprise Android fleets, BYOD environments, Organizations allowing sideloading or developer access, Mobile device management teams | Topics: Ai / Malware

What happened: RatHat is a China-based Android malware that uses AI to control infected devices. Distributed via smishing and malvertising, it abuses Accessibility and ADB to gain shell-level privileges, deploy native daemons, and maintain access even after uninstallation.

Why it matters: Malware abusing Accessibility and Android Debug Bridge (ADB) can gain persistent high-privilege access to mobile devices, bypassing traditional uninstall and reimaging practices and putting organizational data at ongoing risk.

How it works: RatHat is an Android malware family that leverages Accessibility permissions and Android Debug Bridge (ADB) to gain shell access, drop native code, and survive app removal, giving persistent and privileged control to attackers.

Practitioner Perspective

Android fleets, especially those exposed to smishing and malvertising, now face threat actors maintaining long-term access by deploying native daemons via ADB, even after the original malicious app is removed. This creates an environment where mobile device management (MDM) is no longer enough and endpoint visibility must extend into post-uninstall persistence mechanisms. Standard controls like antivirus and user-initiated reimaging may be rendered ineffective. Emphasize pre-deployment device hardening and forensic readiness for post-compromise containment and recovery. If you rely on Android in any critical workflows, assume ADB abuse is now a viable and persistent attack vector.

Recommended Actions

• Restrict and monitor ADB (Android Debug Bridge) access on managed devices, especially fleet-wide
• Hunt for native daemons and root-level processes left after uninstalls, focus on RatHat indicators

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Source: The Hacker News | Published: Sep 17 | Risk: HIGH | Impacted: Oracle users, Large enterprises with legacy technology stacks, Environments exposed to new malware families (Settra, VectraRAT), Teams lacking automated vulnerability management | Topics: Cloud / Vulnerability

What happened: The Hacker News reports on recent cybersecurity developments, including self-modifying AI agents, over 800 Oracle vulnerabilities patched, insider SIM swap incidents, and the emergence of new malware like Settra and VectraRAT.

Why it matters: Rapidly scaled Oracle patch sets and the emergence of self-rewriting AI agents drastically shorten defender patch windows and create gaps for exploitation before legacy processes can adapt, increasing the likelihood of compromise.

How it works: Oracle platforms often form the backbone of enterprise databases and applications. Self-rewriting agents refer to autonomous AI systems that can modify their own code or behavior, potentially evading traditional security monitoring and controls.

Affected / Fix: Over 800 Oracle vulnerabilities patched, update immediately; other fix statuses not stated in source

Practitioner Perspective

Patch management and threat monitoring demands have escalated. The disclosure of over 800 Oracle vulnerabilities means enterprises relying on Oracle for critical workloads are at substantial risk if updates are not prioritized and validated. The emergence of self-rewriting AI agents and new malware families (Settra, VectraRAT) further shortens detection and response cycles. Legacy patch cadence or incomplete vulnerability management can now expose organizations to rapid exploitation. Treat large-scale Oracle patch cycles as crisis points for your environment and focus on automation and cross-team coordination to accelerate remediation.

Recommended Actions

• Prioritize patch deployment for the >800 Oracle vulnerabilities disclosed this cycle
• Conduct targeted hunts for Settra and VectraRAT activity in endpoint telemetry

Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar

Source: The Hacker News | Published: Sep 17 | Risk: HIGH | Impacted: Vulnerability management teams, SOC/blue teams, Asset owners with internet exposure, Organizations dependent on rapid patch cycles | Topics: Vulnerability / Exploit

What happened: The Hacker News announced a webinar on September 17, 2026, focusing on validating the exploitability of new CVEs before attackers can exploit them. The session, led by Ishak Celikkanat of Picus, aims to demonstrate how security teams can map vulnerabilities to attack techniques and validate them against existing controls, even when direct exploitation isn’t feasible. The goal is to provide defenders with actionable insights promptly, addressing the time gap between vulnerability disclosure and exploitation.

Why it matters: The initial disclosure-to-exploitation gap is where defenders are most likely to be blindsided, as attackers often move faster in validating and weaponizing newly released CVEs than enterprise patch programs.

How it works: Common Vulnerabilities and Exposures (CVEs) are publicly disclosed software vulnerabilities. Exploitability validation involves confirming whether a new CVE can be leveraged in an environment, often before public exploitation appears or full technical details are available.

Practitioner Perspective

When new CVEs drop, unpatched organizations are at peak exposure, and most teams lack in-house capability to quickly validate exploitability or map exposures to controls. This leads to delayed, and sometimes misguided, remediation prioritization. Understanding how to map vulnerabilities to MITRE ATT&CK or similar frameworks is essential for realistic threat modeling. Security teams should be ready to test controls against attack simulations even before complete proof-of-concept exploits appear. Tighten your validation and follow up with compensating controls where patching is delayed or unfeasible.

Recommended Actions

• Participate in or review takeaways from the Picus webinar on new CVE exploitability validation
• Align vulnerability management workflows to MITRE ATT&CK technique mapping for new CVEs

CISO’s Expert Guide to Agentic Pentesting for Websites

Source: The Hacker News | Published: Sep 17 | Risk: MEDIUM | Impacted: Web application owners, Security teams relying only on manual pentesting, Organizations deploying agentic AI security tools | Topics: Vulnerability / Exploit

What happened: The article discusses the limitations of traditional annual pentesting in the face of rapidly evolving cyber threats. It highlights the emergence of autonomous AI agents capable of continuous, agentic pentesting, which can identify and exploit vulnerabilities more swiftly than manual methods. The piece emphasizes the need for security leaders to implement robust governance and validation measures when integrating these AI-driven tools into production environments.

Why it matters: Autonomous AI pentesting systems can enumerate and exploit web application weaknesses much faster than traditional methods, forcing security teams to reevaluate testing frequency, coverage, and incident response preparation.

How it works: Agentic pentesting leverages autonomous AI agents that can crawl, test, and exploit web applications without direct human involvement, increasing both speed and potential coverage but also demanding mature oversight and governance.

Practitioner Perspective

For web application defenders, annual pentests have become inadequate as autonomous agentic tools now probe, adapt, and self-improve continuously. While these tools promise better coverage, they can introduce governance challenges and new risks if not tightly monitored and validated. Attackers are not bound by periodic testing schedules, so defenses must adapt to match their velocity. Begin with strong guardrails and validation frameworks when considering agentic AI tools in production, and ensure every finding is mapped back to a robust remediation process. Ultimately, continuous coverage matters more than annual compliance checkboxes.

Recommended Actions

• Pilot agentic AI pentesting platforms in a highly controlled pre-production environment
• Develop governance frameworks for monitoring agentic AI tool findings and actions

Andrew Hastie says AI advised him to reply ‘congratulations!’ to man who planned to end life with assisted dying

Source: The Guardian | Published: Sep 18 | Risk: MEDIUM | Impacted: Organizations using Microsoft Copilot or similar AI assistants, Public relations and legal departments, Highly regulated business units | Topics: Ai

What happened: Australian MP Andrew Hastie recounted that when a terminally ill constituent informed him of plans for voluntary assisted dying, Microsoft’s Copilot AI suggested responses like “congratulations!”. Hastie highlighted this as an example of AI’s shortcomings and advocated for AI systems operated by Australians.

Why it matters: Automated AI copilots may generate inappropriate or insensitive outputs, exposing organizations to reputational and potentially regulatory risk if not subject to suitable controls or human review in sensitive workflows.

How it works: Microsoft Copilot is an AI-based content suggestion and drafting tool that integrates into workplace applications. It generates text responses or suggestions that may not always account for context or appropriateness, creating potential for miscommunication.

Practitioner Perspective

Deploying generative AI systems like Microsoft’s Copilot in environments handling sensitive, regulated, or emotionally charged communications introduces reputational risk if outputs are not consistently reviewed before release. Content automation that fails to account for nuanced, context-driven scenarios can backfire at the scale of public communications or regulated business lines. Security, IT, and legal teams should collaborate to ensure output filters, escalation paths, and clear review workflows are in place. The pace of AI adoption is not an excuse for neglecting human-in-the-loop oversight. Leaders should regularly stress test AI outputs in high-risk communication scenarios and adjust risk acceptance guidelines accordingly.

Recommended Actions

• Implement mandatory human-in-the-loop review for AI-generated communication from Copilot or similar tools in regulated environments
• Review existing Copilot deployment scopes and restrict use in high-sensitivity workflows

‘Brutal’: thousands of T-shirt designs stolen and listed on Temu, Sydney label claims

Source: The Guardian | Published: Sep 18 | Risk: MEDIUM | Impacted: Digital creators and artists, Small e-commerce websites, Brands with unique digital IP | Topics: Ai / Data Breach

What happened: Warwick Levy, who runs Lonely Kids Club, says AI may have been used to scrape his entire website and replicate designs Get our breaking news email, free app or daily news podcast After 15 years running a small business making T-shirts, Warwick Levy says it was “brutal” when he first discovered an identical design for sale on Temu. It turned

Why it matters: Automated scraping and AI-powered copying of digital assets can drive large-scale intellectual property (IP) and copyright infringement, resulting in business losses and undermining digital brand security.

How it works: AI-driven scraping refers to the use of automated bots, often powered by machine learning models, to copy large volumes of website content, including images and designs, for unauthorized reuse or resale.

Practitioner Perspective

Small online businesses and digital creators are now easily targeted as attackers use AI-driven scraping tools to harvest and replicate website content, products, and copyrighted designs. Legal recourse is slow and uneven, so technical defenses, such as rate limiting, watermarking, and proactive monitoring of online marketplaces, are a must. Asset theft on digital storefronts can translate to direct loss of revenue and market trust, especially when counterfeits flood major e-commerce channels. Step up controls over how your content is served and monitor for large or anomalous web traffic patterns. If protecting unique digital IP is core to your business, expect that automated scraping is now a standing threat.

Recommended Actions

• Deploy anti-scraping technologies and web application firewalls to detect and block bulk copying attempts
• Use digital watermarking on product images and catalog elements

Inside the scramble for trusted AI cops

Source: Axios | Published: Sep 18 | Risk: MEDIUM | Impacted: Organizations deploying third-party AI models, Compliance and audit teams, Vendors integrating OpenAI models | Topics: Ai Governance / Incident Reporting

What happened: Axios reports that OpenAI’s new incident-disclosure playbook and framework is part of an industry trend toward standardizing how model misalignment is reported and managed.

Why it matters: Standardizing misbehavior reporting allows defenders and regulators to benchmark misalignment across vendors and enforce controls consistently.

How it works: AI incident reporting frameworks provide standardized processes and metrics for organizations to disclose, analyze, and remediate issues when AI models behave unexpectedly or contradict organizational policies or ethical guidelines.

Affected / Fix: OpenAI disclosure framework is available; deployment recommended but not mandatory

Practitioner Perspective

As AI systems become widely integrated, the lack of industry-standard incident reporting has left organizations and regulators guessing about the nature and frequency of model misalignments or unsafe outputs. OpenAI’s new playbook and disclosure framework signal a move to harmonize reporting, giving security, compliance, and risk teams a clearer basis to evaluate both external models and their own deployments. This is vital for regulated sectors, procurement, and third-party risk management, as ad hoc disclosures create audit and policy gaps. Security leaders should begin adapting incident response and governance frameworks to account for AI-related disclosures and demand playbook transparency from all major model vendors. Consistent standards are the foundation for scalable model assurance.

Recommended Actions

• Evaluate current incident response workflows against OpenAI’s incident-disclosure playbook for AI model misalignment
• Request AI incident reporting frameworks from any external model vendors or partners

Defensive Actions

• Hunt for PhantomRaven npm stealer IOCs in developer endpoints and CI/CD logs
• Regularly audit third-party npm packages for abnormal reachout or credential harvesting behaviors
• Restrict and monitor ADB (Android Debug Bridge) access on managed devices, especially fleet-wide
• Prioritize patch deployment for the >800 Oracle vulnerabilities disclosed this cycle
• Participate in or review takeaways from the Picus webinar on new CVE exploitability validation
• Pilot agentic AI pentesting platforms in a highly controlled pre-production environment
• Implement mandatory human-in-the-loop review for AI-generated communication from Copilot or similar tools in regulated environments
• Deploy anti-scraping technologies and web application firewalls to detect and block bulk copying attempts
• Evaluate current incident response workflows against OpenAI’s incident-disclosure playbook for AI model misalignment

What We’re Watching

• Monitor for large-scale exploitation attempts against recently patched Oracle vulnerabilities across enterprise environments.
• Watch for further phishing and malvertising campaigns delivering RatHat and similar ADB-abusing Android malware.
• Assess incident response readiness and vendor reporting standards in light of industry adoption of OpenAI’s disclosure framework for AI misalignments.
• Track npm supply chain for evidence of new, obfuscated info-stealer packages similar to PhantomRaven.
• Follow updates from the Picus webinar for actionable techniques to validate and triage newly disclosed CVEs before exploitation gaps close.

Also Today

• Could AI really end humanity? Post your questions for our tech reporters now: The Guardian invites questions on AI’s existential threat for their live Q&A with technology reporters.
• Is Trump’s AI obsession walking the world into disaster? – podcast: The Guardian podcast discusses US AI policy, warnings from tech leaders, and President Trump’s unconventional approach.
• ‘If you build something vastly smarter than you, it better be on your side’: can we stop AI from deceiving us? – podcast: Researchers and journalists debate whether AI systems can intentionally deceive humans, and the race to develop safeguards.
• Artists boycotted this portrait prize over AI entries. Now they’re back to take them on: Several artists return to the Brisbane portrait prize after previously boycotting due to AI entries, highlighting evolving views on AI in art.

Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.

Categories: Artificial Intelligence, Cybersecurity Blog

Tags: AI Security, Android Security, cve, incident reporting, Malware, Supply Chain