ThreatsDay Roundup: AI Compute Hijacking, Apple Email Flaw and BlueHammer Exploitation
Summary
This week’s roundup covers ransomware phishing, a Claude Cowork sandbox escape, a reported Apple Hide My Email flaw, RAT activity, prompt-injection research, and CISA-confirmed ransomware exploitation of Microsoft Defender’s BlueHammer flaw.
Key points
- Bitdefender reported fake law-enforcement phishing emails that use password-protected archives and Proton Drive-hosted files to deliver custom ransomware to small businesses across multiple regions.
- Armadin described a Windows Claude Cowork attack chain that can let an attacker with existing local code execution run root commands in the sandbox and bypass network restrictions; Anthropic said it did not consider the issue a security vulnerability.
- Researcher Tyler Murphy said a flaw in Apple Hide My Email can expose real email addresses and remains unpatched more than a year after it was reported; limited tests with volunteers found all tested addresses exploitable.
- Reports describe BeepRAT, a customized DCRat variant with persistence and extensive remote-control features, and Millennium RAT, which Group-IB says has infected 62,289 devices.
- Researchers reported that the CoT Forgery prompt-injection attack achieved 60% success against frontier models. Separately, Sysdig observed attackers using a misconfigured Ollama server to power an automated offensive-security tool.
- CISA confirmed that the patched Microsoft Defender BlueHammer vulnerability, CVE-2026-33825, was exploited in ransomware attacks; the responsible group is unknown.
- Opera announced Paste Protect to warn about suspicious clipboard activity associated with ClickFix attacks, while Microsoft described new Teams controls for identifying and restricting meeting bots.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering phishing, ransomware, vulnerability exploitation, malware activity, and abuse of AI resources.
- Impact
- Reported activity includes ransomware delivery through fake law-enforcement emails; phishing that steals messaging and email credentials; RAT infections enabling remote commands, surveillance, and data theft; and an AI-resource hijacking incident in which a misconfigured Ollama server was used to scan and attempt to exploit a victim environment. CISA confirmed that the patched Microsoft Defender vulnerability BlueHammer (CVE-2026-33825) was exploited in ransomware attacks, but the ransomware group was not identified. Tyler Murphy reported that Apple’s Hide My Email flaw exposed real email addresses and remained unpatched; he said all addresses tested in a limited volunteer sample were exploitable.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe phishing operation involving UNC1151 reportedly exfiltrated harvested credentials to attacker-controlled infrastructure.T1053.005 · Scheduled TaskBeepRAT reportedly establishes persistence through scheduled tasks.T1056.001 · KeyloggingBeepRAT and Millennium RAT are reported to support keystroke logging.T1059.001 · PowerShellBeepRAT can launch PowerShell sessions.T1059.003 · Windows Command ShellBeepRAT can launch interactive command prompt sessions.T1071.004 · DNSBeepRAT reportedly resolves its command-and-control infrastructure using DNS-over-HTTPS requests.T1090 · ProxyBeepRAT is reported to launch a proxy.T1105 · Ingress Tool TransferBeepRAT can download and run .NET assemblies in memory; Millennium RAT can download and run executables.T1113 · Screen CaptureBeepRAT and Millennium RAT are reported to capture screenshots.T1125 · Video CaptureBeepRAT is reported to record through a webcam.T1566.002 · Spearphishing LinkPhishing emails directed recipients to links used to steal account credentials or deliver ransomware.
CVE
People
Bert-Jan PalsSecurity researcher who commented on ClickFix as an initial-access method relying on social engineering and legitimate system functionality.Chaotic EclipseAnonymous researcher credited with disclosing the BlueHammer zero-day; the article gives Nightmare-Eclipse as an alternate name.Christopher MufarrigeDirector of the FTC’s Bureau of Consumer Protection who described the agency’s claims about Amazon’s handling of identity-theft victims and their records.Michael ClarkSysdig representative who described the use of access to an AI tool in an automated offensive-security pipeline.Nightmare-EclipseAlternate name given in the article for Chaotic Eclipse, the anonymous researcher credited with disclosing the BlueHammer zero-day.Thariq ShihiparAnthropic representative who described the purpose and planned removal of code in Claude Code intended to detect unauthorized distillation and reseller activity.Tyler MurphyResearcher who found the Hide My Email vulnerability and reported it to Apple; he said the issue remained unpatched and that all addresses in a limited volunteer test were exploitable.
Threat Actors
GhostwriterNamed in the article as an alias of UNC1151, which was assessed to have orchestrated credential-phishing activity.ShinyEnigmaIdentified as the developer behind Millennium RAT and DotStealer; the article attributes malware development to this name.UNC1151Assessed to have orchestrated a spear-phishing attack targeting Belarusian politician Yury Hubarevich as part of a broader credential-phishing operation. The article also names Ghostwriter as an alias.UNC4221The U.S. State Department described this group as malicious cyber actors working on behalf of Russian military services.UNC5792The U.S. State Department described this malicious cyber group as associated with the Russian Federal Security Service Border Guards and linked it to phishing campaigns targeting Signal and WhatsApp accounts.Y2K OperatorsThreat actor cluster reported to conduct social-engineering campaigns that trick users into executing malicious payloads, including Millennium RAT.
Malware
BeepRAT#ClaudeCoworkDCRatA customized version of the open-source DCRat framework dubbed BeepRAT has been identified as distributed via a Chinese phone number management utility packaged within a ZIP archive, per Rubrik Zero Labs.DotStealerThe malware is attributed to a developer named ShinyEnigma, who is also behind DotStealer and was first seen in September 2023.Itarian RATPhishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.Millennium RATBeepRAT and Millennium RAT show continued use of stealthy delivery, persistence, and rich remote-control features.
Vendors
AmazonFederal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.AnthropicFollowing responsible disclosure on May 29, 2026, Anthropic said it does not consider it to be a security issue because exploitation requires pre-existing local code execution on the host.AppleApple’s Hide My Email service has a flaw that may expose real email addresses.ConnectWisePhishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.GoogleThe activity involved sending emails from Gmail accounts claiming to have detected suspicious activity on targets’ Google accounts, urging them to click on a link to verify their account.MicrosoftMicrosoft said it discovered a malicious Chromium-based extension that impersonates the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it.OpenAIAn evaluation of OpenAI’s GPT-5.6 Sol on real-world offensive security benchmarks by AI security lab Irregular has found the model to perform slightly better than GPT-5.5, while continuing to struggle with well-defendedOperaOpera has introduced Paste Protect, a new security feature designed to block ClickFix-style attacks that deceive users into executing malicious commands through social engineering techniques.
Products
Claude CodeAnthropic said it plans to remove the hidden code it added to Claude Code several months ago to detect unauthorized distillation efforts.Claude CoworkA sandbox escape in Claude Cowork could let a local attacker run root commands and bypass network restrictions.Claude DesktopThe attack allows an attacker with local code execution to plant a malicious file in Claude Desktop’s application directory, hijacking a trusted process to communicate with Cowork’s underlying VM service.ConnectWisePhishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.GPT-5.5security benchmarks by AI security lab Irregular has found the model to perform slightly better than GPT-5.5, while continuing to struggle with well-defended targets and complete end-to-end attacks.GPT-5.6 SolAn evaluation of OpenAI’s GPT-5.6 Sol on real-world offensive security benchmarks by AI security lab Irregular has found the model to perform slightly better than GPT-5.5, while continuing to struggle with well-defendedHide My EmailApple’s Hide My Email service has a flaw that may expose real email addresses.Microsoft Defender Antimalware PlatformCybersecurity and Infrastructure Security Agency (CISA) has confirmed that the now-patched Microsoft Defender vulnerability known as BlueHammer (aka CVE-2026-33825) was exploited in ransomware attacks.Ollama#ClaudeCoworkPerplexityMicrosoft said it discovered a malicious Chromium-based extension that impersonates the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it.SignalUNC5792 has been linked to widespread phishing campaigns targeting Signal and WhatsApp accounts of U.S.Teams“That’s why we’re introducing a new Teams admin policy designed to give organizations more visibility and control over external bots in their meetings.Telegram Bot APIA remote access trojan (RAT) named Millennium RAT has undergone an architectural shift from .NET to native C++, while still relying on the Telegram Bot API for command-and-control (C2).WhatsAppUNC5792 has been linked to widespread phishing campaigns targeting Signal and WhatsApp accounts of U.S.
Tools
Ninite LoaderPhishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.VAPT frameworkThreat actors have been observed using a misconfigured Ollama model server as the reasoning engine for an automated, multi-stage offensive security tool called the VAPT framework, according to findings from Sysdig.
Countries
Industries
Governmentgovernment officials, military leadership, and allied personnel with an aim to gain unauthorized access.Military(FSB) Border Guards and UNC4221, a malicious group of cyber actors working on behalf of the Russian military services.Small businessesA phishing campaign is targeting small businesses across Europe, Asia, the Middle East, and the U.S.