ThreatsDay: Stealthy Loaders, LLM Chatbot Gaps, Docker AI Bug—and 15 More Cybersecurity Stories

Attackers are increasingly blending into everyday tech, exploiting legitimate tools and AI-driven interfaces to avoid detection, according to this week’s ThreatsDay roundup. Researchers reported a surge in stealthy loaders and commodity RATs, abuses of open-source monitoring software, and advances in mobile fraud—particularly NFC-enabled Android schemes that coax users into handing over card data and PINs. Multiple teams detailed flaws across the AI stack: a public chatbot at Eurostar was susceptible to prompt injection through chat history handling, while Docker patched an injection risk in its Ask Gordon assistant that could have exposed developer data via tainted repository metadata.
Cloud and infrastructure risks widened with fresh zero-days found in container runtimes, AI frameworks, and popular databases, including a Linux container-escape issue that challenges multi-tenant isolation. Campaign activity spanned Europe and Asia, from phishing loaders aimed at manufacturing and government entities in Italy, Finland, and Saudi Arabia to Israeli firms targeted by a Western Asia–based cluster using Python- and Rust-built implants. North Korea’s ScarCruft resurfaced with RokRAT via Hangul documents, while a Russian influence network scaled AI-powered content farms. On defense, Microsoft is turning on stricter Teams protections by default and moving BitLocker toward hardware acceleration. The thread running through it all: attackers are patient, precise, and adept at hiding in trusted workflows—pressuring enterprises to raise detection fidelity at the intersection of AI, cloud, and user trust.

Read more