Weekly Threat Intelligence Summary
Top 10 General Cyber Threats
Generated 2026-10-05T05:00:05.476793+00:00
- September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs (www.crowdstrike.com, 2026-09-08T05:00:00)
Score: 8.2 - Malwarebytes earns another Top Product award in independent testing (www.malwarebytes.com, 2026-10-01T10:51:52)
Score: 7.574
Three independent labs, three standout results: a perfect score, top certification, and every threat stopped before it ran. - Using Threat Intelligence to Stop Ransomware Attacks (www.recordedfuture.com, 2026-09-25T00:00:00)
Score: 7.499
Learn how ransomware threat intelligence empowers your team to actively follow adversary infrastructure, monitor dark web chatter and prevent attacks. - Tajin Group: Guarantee Marketplace Vendor Involved in Phishing and Chinese Money Laundering Group (www.recordedfuture.com, 2026-09-15T00:00:00)
Score: 7.332
Analyze Tajin Group's role in phishing and Chinese money laundering. Discover how this Telegram-based vendor exploits payment gateways and adapts its financial fraud operations. - Update your iPhone, iPad, or Mac: Flaw could run attackers’ code (www.malwarebytes.com, 2026-09-29T10:35:16)
Score: 7.239
A malicious file could trigger the vulnerability. Apple says it may already have been used against iPhone users. - Kothamine malware uses Tailscale’s tailcat to evade network detection (www.malwarebytes.com, 2026-09-25T14:57:29)
Score: 6.602
Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain to block. - The Lure Isn't The Malware. It's Your Logo. (www.recordedfuture.com, 2026-09-23T00:00:00)
Score: 6.465
Recorded Future's Insikt GroupⓇ has been tracking ClickFix, a social engineering technique that turns a familiar logo or verification prompt into the entry point for an attack. Here's what that research reveals about catching it, and why it's now running inside Malicious Site Monitoring, part of our newly launched Digital Risk Protection solution. - Fake xStocks, Pendle, and other sites bait crypto users with rewards votes (www.malwarebytes.com, 2026-10-01T17:08:54)
Score: 5.618
More than 70 fake crypto sites promise extra rewards for casting a vote, then prompt visitors to connect their wallets. - Shadow AI explained: The work shortcut that could leak your company’s secrets (www.malwarebytes.com, 2026-10-01T14:05:37)
Score: 5.596
An AI shortcut can send confidential work data beyond your company’s control. Here’s how to get the benefits without taking unnecessary risks. - Convincing Free Mobile phishing emails appear after data breach (www.malwarebytes.com, 2026-10-01T11:30:30)
Score: 5.579
Free Mobile customers received very convincing phishing emails after major data breach.
Top 10 AI / LLM-Related Threats
Generated 2026-10-05T06:00:21.977950+00:00
- Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations (arxiv.org, 2026-10-05T04:00:00)
Score: 21.78
arXiv:2610.02432v1 Announce Type: new
Abstract: Large language models (LLMs) in production systems face prompt injections, trojans (backdoors), and manipulation of automatic quality metrics. This thesis develops models, methods, and algorithms for evaluating and improving LLM robustness to adversarial input sequence variations. We propose R_stab(f), a generative robustness metric based on the Jensen-Shannon divergence between per-step output distributions under small input perturbations. For lo - Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes (arxiv.org, 2026-10-05T04:00:00)
Score: 21.78
arXiv:2610.02861v1 Announce Type: new
Abstract: Large language model (LLM) agents are moving from chat interfaces into infrastructure operations, where they read telemetry, call tools, generate and execute code, and change the state of production Kubernetes clusters. This collapses a boundary that conventional cloud-native security assumes: the boundary between data and control. Content that an agent merely reads (a log line, a ticket, a tool description) can redirect what it does. This paper a - Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks (arxiv.org, 2026-10-05T04:00:00)
Score: 20.78
arXiv:2610.02302v1 Announce Type: new
Abstract: Recent work has shown that large language models (LLMs) can be vulnerable to jailbreak attacks in which harmful intent is obscured through composition with benign tasks. A harmful request refused in isolation may elicit a different response when embedded within a larger, seemingly benign query. We study these compositional intent-hiding jailbreaks from an information-theoretic perspective. Our formulation associates each task with an estimated pro - Mitigating Private Data Leakage in LLMs with Whiteout (arxiv.org, 2026-10-05T04:00:00)
Score: 19.78
arXiv:2610.02418v1 Announce Type: new
Abstract: Modern large language models (LLMs) are trained on massive, largely unfiltered datasets, including content scraped from nearly every accessible website and user inputs. As a result, LLMs often memorize and reproduce personally sensitive information (PSI) such as birth dates, phone numbers, and home addresses. This leads to significant privacy risks, particularly for high-profile individuals such as executives, politicians, and judges. Existing mit - Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems (arxiv.org, 2026-10-05T04:00:00)
Score: 18.78
arXiv:2610.03434v1 Announce Type: new
Abstract: Large language model-based agents are increasingly deployed to perform domain-specific tasks by interacting with enterprise knowledge, tools, and external services. Existing runtime guardrails primarily target prompt injection and other attack-specific behaviors under a black-box threat model, but provide limited guarantees that agents operate within their intended functionality. As a result, production agents remain vulnerable to malicious reques - CITADEL: CWE-Guided Insertion of Hardware Trojans via Analysis of DFG-Enabled LLMs (arxiv.org, 2026-10-05T04:00:00)
Score: 17.78
arXiv:2610.02544v1 Announce Type: new
Abstract: The increasing sophistication of Hardware Trojans (HTs) and system-level vulnerabilities poses significant risks to modern integrated circuits. However, constructing realistic HT scenarios, remains a substantial burden: researchers must manually analyze complex RTL structures, identify plausible weaknesses, and craft stealthy, synthesizable insertions that preserve functional correctness. This paper introduces CITADEL CWE-Guided Insertion of Troja - RMCW: A Deletion-Robust Watermark Based on Reed–Muller Codes for Language Models (arxiv.org, 2026-10-05T04:00:00)
Score: 17.78
arXiv:2610.02817v1 Announce Type: new
Abstract: Large Language Model (LLM) watermarking provides a lightweight mechanism for identifying text generated by a specific model, but its robustness remains fragile under post-processing attacks. Deletion attacks are particularly challenging because they shift token positions and break the alignment between observed tokens and their original watermark positions. We propose Reed–Muller Code Watermarking (RMCW), an LLM watermarking method based on Reed- - PrivDev: Mapping Static-Analysis Data Types to DPV (arxiv.org, 2026-10-05T04:00:00)
Score: 17.78
arXiv:2610.03518v1 Announce Type: new
Abstract: Static-analysis scanners can identify personal-data types in source code, but they lack mechanisms to connect these findings to standardized privacy vocabularies. PrivDev maps 122 Bearer CLI data types to Data Privacy Vocabulary Personal Data (DPV-PD) categories and links them to potentially relevant GDPR provisions. Our approach combines deterministic mapping for 43 exact-label matches with a retrieval-grounded Large Language Model (LLM) to resol - Understanding Gaps in LLM Pipelines Towards Scalable Fuzzing Harness Generation: An Empirical Study and Enhancement (arxiv.org, 2026-10-05T04:00:00)
Score: 17.78
arXiv:2512.03420v5 Announce Type: replace
Abstract: Large language model (LLM)-based techniques have achieved notable progress in fuzz harness generation. However, applying them to arbitrary functions \textit{at scale} remains difficult—generated harnesses often fail to compile or, worse, compile but remain logically ineffective. What factors drive success and what limitations hinder current methods remain unclear.
To answer these questions, we conduct an empirical study on state-of-the-art - Securing Computer-Use Agents Against Branch Steering Attacks (arxiv.org, 2026-10-05T04:00:00)
Score: 17.48
arXiv:2610.03089v1 Announce Type: new
Abstract: Modern Computer Use Agents (CUAs) directly interact with graphical user interfaces and execute third-party web tools, exposing them to indirect prompt injection across every rendered page and tool response. While the Dual-LLM pattern is the primary system-level architecture offering formal security guarantees – using an isolated Planner LLM (P-LLM) to fix execution paths before processing untrusted inputs via a Quarantined LLM (Q-LLM) – these guar - CorrectGuard: Eyes-Off Correctness Estimation for Black-Box Security Guardrails (arxiv.org, 2026-10-05T04:00:00)
Score: 15.48
arXiv:2610.03470v1 Announce Type: new
Abstract: AI services increasingly rely on black-box security guardrails, yet privacy-preserving model auditing regimes often cannot measure how well these systems perform in both a human eyes-off production setting, which disallows human inspection of user input, and a machine eyes-off setting, which disallows model inspection of such input. We introduce CorrectGuard, an eyes-off correctness estimation framework for both settings, which involves an indepen - MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2610.02349v1 Announce Type: new
Abstract: Inter-agent communication is central to Large Language Model Multi-Agent Systems (LLM-MAS), but it introduces an underexplored vulnerability: Agent-in-the-Middle (AiTM) attacks that manipulate messages in transit without compromising the agents themselves. Prior work reports Attack Success Rates (ASR) approaching 100% on structured tasks. Existing defenses rely on semantic validation, which requires additional inference and can block benign output - Digital Twin-Assisted Mapping of ICS Telemetry to ATT&CK for ICS with Evidence-Driven Dependency Reasoning (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2610.02955v1 Announce Type: new
Abstract: Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry is difficult because process observations reveal physical changes more directly than the actions that produced them. This paper presents a Digital Twin (DT)-assisted framework that extracts synchronized state changes, converts them into evidence-preserving descriptions, maps them to ATT&CK for ICS through retrieval-augmented Large Language Model (LLM) reasoning, - Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2610.03014v1 Announce Type: new
Abstract: Large language model (LLM)-based agents increasingly connect model-generated decisions to security-sensitive software capabilities such as command execution, filesystem access, network communication, browser control, and external tools. Existing analyses often use predefined sensitive operations as anchors, but operation identity alone is insufficient to determine security implications.
We present AgentSecGraph, a security-aware static analysis - The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2610.03124v1 Announce Type: new
Abstract: Open-weight language models can be downloaded, modified, and deployed beyond their developers' control, limiting the effectiveness of centrally enforced safeguards. Recent work has therefore proposed \emph{trigger-tag} mechanisms that produce a detectable signal when a model is used under a target condition, such as generating phishing contents. Although these mechanisms borrow from established techniques, their use for conditional misuse det - EvoRiskBench: An Evolving Benchmark for Runtime Security Risks in Workspace Agents (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2610.03153v1 Announce Type: new
Abstract: Workspace agents combine large language models with execution harnesses to perform stateful, multi-step tasks that access or modify external resources. Existing benchmarks leave gaps in executable coverage of their runtime security risks, while evolving model capabilities, harnesses, tools, and threats motivate benchmark evolution. We introduce EvoRiskBench, an evolving benchmark organized around the EP-Path-EF framework, which links an initial ri - Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2610.03319v1 Announce Type: new
Abstract: Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement - Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study (arxiv.org, 2026-10-05T04:00:00)
Score: 14.78
arXiv:2607.24893v2 Announce Type: replace
Abstract: Multi-agent LLM systems can be attacked by a payload that no single agent ever holds in full: several poisoned tools each hide one encrypted fragment, spreading them across several agents, and an external step reassembles and executes them after the run. Per-step safety checks that judge each action in isolation may fail to recognize the complete distributed payload. We investigate how early such an attack can be detected while the run is stil - Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM (arxiv.org, 2026-10-05T04:00:00)
Score: 12.48
arXiv:2610.02373v1 Announce Type: new
Abstract: GraphRAG pipelines construct auxiliary structures during offline indexing–semantic summaries, hierarchical edges, and pre-computed scores–that determine how retrieval is prioritised at query time. Prior attacks target only instance-level components (nodes, edges, triples), overlooking these schema-level structures. We formalise Auxiliary Schema-Level Entity as a novel attack surface and propose the 3S Framework (Semantics, Structure, Scoring) fo - Fast Models, Slow Evidence: A Paired and Self-Audited Evaluation of System-1 Decision Models for LLM Agent Harnesses (arxiv.org, 2026-10-05T04:00:00)
Score: 12.48
arXiv:2610.02267v1 Announce Type: cross
Abstract: Agent harnesses make many small, typed decisions per task: which model to call, which tool to use, whether retrieved text is relevant, whether an input carries an injection. System-1 decision models answer such questions in a single forward pass with class probabilities, promising large cost and latency savings over LLM calls. We present a paired evaluation of an open-weight (Laya) and a hosted (Jev) System-1 model on 11 agent decision points bu - Counterfactual Evidence Audits Predict LLM-Agent Susceptibility to Ranked Context (arxiv.org, 2026-10-05T04:00:00)
Score: 12.48
arXiv:2606.00914v2 Announce Type: replace-cross
Abstract: LLM agents increasingly decide from evidence assembled by upstream systems: retrievers choose documents, recommenders choose posts, and memory systems choose prior events. Existing evaluations usually hold this evidence fixed, missing failures in which individually ordinary items form a systematically one-sided context. We introduce a counterfactual evidence audit: expose an agent to two mirrored sets of five documents, measure the diffe - Interrupting the Chain: Human Perception of AI-Generated Disinformation Through a Kill Chain Lens (arxiv.org, 2026-10-05T04:00:00)
Score: 12.48
arXiv:2608.21389v2 Announce Type: replace-cross
Abstract: Generative AI enables customized misinformation at scale, yet defenses remain largely reactive. We present empirical findings from a human-subject study (n=504 participants, n=2,438 judgments) in which users classified news fragments by origin (human vs. machine) and veracity (real vs. fake). We organize results using an adapted cybersecurity kill chain as a taxonomy for intervention, mapping perception data onto stages of a cognitive at - Frequency Is Not Sensitivity Identifying Safety-Sensitive Experts in Sparse MoE LLM (arxiv.org, 2026-10-05T04:00:00)
Score: 11.78
arXiv:2610.02910v1 Announce Type: cross
Abstract: Suppressing a small set of routed experts can weaken the safety behavior of a sparse Mixture-of-Experts (MoE) language model without retraining. Which experts to suppress is therefore a security question, and the usual answer is activation frequency, but frequency measures use, not influence. We test an alternative: router-gradient sensitivity, the sensitivity of the sequence loss to the gate weights that select an expert. Across five MoE archit - Why Backdooring Neural Networks is so Easy? (arxiv.org, 2026-10-05T04:00:00)
Score: 11.78
arXiv:2609.36117v2 Announce Type: replace-cross
Abstract: Securing modern AI systems against backdoor attacks remains an open challenge and requires fundamentally principled estimates of the adversary's budget — the poison fraction $\pi$ and trigger strength $\alpha$ needed to construct successful yet stealthy attacks. Motivated by recent empirical evidence that poisoning large language models can require a nearly constant number of malicious samples even as clean datasets grow, we derive - Cocoon: A System Architecture for Differentially Private Training with Correlated Noises (arxiv.org, 2026-10-05T04:00:00)
Score: 11.48
arXiv:2510.07304v2 Announce Type: replace-cross
Abstract: Machine learning (ML) models memorize and leak training data, causing serious privacy issues to data owners. Training algorithms with differential privacy (DP) have been gaining attention as a solution. However, these algorithms add noise at each training iteration and degrade accuracy, limiting their real-world adoption. To improve accuracy, a new family of approaches adds carefully designed correlated noises, so that noises cancel out
Auto-generated 2026-10-05
