Good morning. This is your security briefing for Sunday, January 18, 2026, covering 15 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
Tenzai published research comparing five popular AI coding agents including Cursor, Claude Code, OpenAI Codex, Replit, and Devin. While these tools successfully avoid common vulnerabilities like SQL injection and cross-site scripting, they frequently introduce critical security flaws in authorization, business logic, and server-side request forgery, with Claude Code generating the most vulnerabilities overall.
Sean Heelan released the Anamnesis framework demonstrating that advanced language models can automatically generate working exploits for vulnerabilities. In testing, GPT-5.2 successfully bypassed multiple security mitigations including control flow integrity, shadow stack, and seccomp sandboxing to exploit a use-after-free vulnerability in the QuickJS JavaScript engine.
Genians Inc. documented Operation Poseidon, a spear-phishing campaign by the Konni APT group targeting North Korean human rights organizations and South Korean financial institutions. The attackers abused Google DoubleClick and NAVER advertising redirection mechanisms to bypass security filters, delivering malware that loaded EndRAT directly into memory using LNK files and AutoIt scripts.
EvilBytecode released GhostVEH, a proof-of-concept tool that registers vectored exception handlers in Windows by directly manipulating internal structures in ntdll.dll rather than using standard APIs. This technique evades API call monitoring and security checks, potentially allowing malware to achieve persistence, function hooking, or data interception undetected.
InΓ©s MartΓn introduced Tangled, an open-source offensive security platform that weaponizes iCalendar features to conduct automated phishing campaigns. The tool exploits automatic event processing to inject spoofed meeting invites directly into victims' calendars in Microsoft Outlook and Google Workspace without requiring any user interaction.
Infoblox Threat Intel analyzed 57 million logs from a malicious push notification network that exploited the Sitting Ducks DNS vulnerability to hijack abandoned domains. The attackers intercepted unencrypted user data and delivered deceptive notifications for scams and brand impersonation, primarily targeting users in South Asia while generating approximately $350 daily through advertising.
Cornell University researchers identified promptware, a new malware category targeting LLM-based systems through evolved prompt injection attacks. These attacks follow a five-step kill chain and exploit the inability of language models to distinguish between instructions and data, enabling data exfiltration, unauthorized transactions, and remote code execution against chatbots and AI-integrated enterprise systems.
Security researchers documented a sophisticated WhatsApp phishing kit using fake WhatsApp Web login pages to hijack user sessions via malicious QR codes. The kit enables attackers to take over WhatsApp accounts and remotely activate surveillance features including camera, microphone, and geolocation tracking, with infrastructure hosted on dynamic DNS services.
LayerX exposed the GhostPoster campaign involving 17 malicious browser extensions downloaded over 840,000 times across Microsoft Edge, Firefox, and Chrome. The extensions use steganography to hide payloads in PNG files, weaken web security policies, hijack affiliate traffic, conduct click fraud, and employ delayed activation of 48 hours or more to evade detection, with some remaining active for up to five years.
Socket's Threat Research Team identified five coordinated malicious Chrome extensions targeting over 2,300 users to enable session hijacking in enterprise HR and ERP systems. The extensions, linked to a single threat actor, steal authentication tokens from platforms including Workday, NetSuite, and SuccessFactors while blocking security administration pages and using encrypted command and control communications.
Sekoia.io published research on using the Landlock Linux Security Module for detection engineering on server systems. The article details how Landlock's sandboxing capabilities can create behavior-based detection rules with low false positive rates, while noting that attackers are already aware of Landlock and may attempt to bypass it, referencing the XZ Utils supply chain attack as evidence.
The Open Threat Research Foundation introduced a framework for integrating AI agents into threat hunting planning processes. The methodology uses a Threat Hunter Playbook and Agent Skills to automate tasks including identifying data sources, generating analytics, and creating hunt blueprints through structured workflows with MCP servers like Tavily and Microsoft Sentinel.
Fr0gger released NOVA Claude Code Protector, an open-source security system designed to defend Claude Code sessions against prompt injection attacks. The system uses a four-hook architecture with three-tier scanning including keyword analysis, semantic machine learning, and language model analysis to actively block dangerous commands and detect malicious content.
Anomaly discovered a critical unauthenticated command execution vulnerability rated CVSS 8.8 in the opencode-ai npm package versions prior to 1.0.216. The package starts an HTTP server on port 4096 and above without authentication, allowing any local process or website to execute arbitrary shell commands, with exploitation possible through browser-based attacks in Firefox.
The United States Attorney's Office for the District of New Jersey announced that Jordanian national Faisal H. Al-Heimish pleaded guilty to conspiracy to commit wire fraud and computer fraud. Al-Heimish operated a scheme that sold unauthorized access credentials to approximately 50 company computer networks, demonstrating the ongoing black market trade in compromised credentials.
That concludes today's briefing.