Threat IntelligenceOct 1, 2026

ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

ThreatsDay roundup: AI zero-day chains, 543K exposed secrets, blockchain malware, ATM jackpotting sanctions.

This week's security digest covers multiple converging threats: AI-powered zero-day exploitation chains, discovery of 543K live secrets in public systems, remote code execution via model inspection tools, and broader trends in malware concealment using blockchain dead drops. Key stories include U.S. Treasury sanctions against Tren de Aragua's ATM jackpotting operation ($40.73M stolen), surge in EtherHiding techniques exploiting public blockchains, AI safety bypass vulnerabilities in Moonshot's models, and defensive prompt injection techniques. The underlying theme: attackers exploit mundane system assumptions (caching, compilation, storage, trust) rather than requiring novel exploits.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Moonshot AI?

Get an email when a new story names Moonshot AI, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

This week's threat landscape reveals a dangerous pattern: attackers are not relying on exotic techniques but instead exploiting foundational assumptions baked into everyday systems — caching mechanisms, compilation pipelines, public storage, and implicit trust relationships. The discovery of 543,000 live secrets in public systems underscores chronic failures in secrets management and developer security hygiene. AI-powered zero-day chaining and model inspection RCE demonstrate that emerging technologies introduce attack surfaces faster than defenders can assess them. EtherHiding's abuse of public blockchains for malware command-and-control is particularly alarming because traditional blocklists and takedown mechanisms are ineffective against decentralized infrastructure. Together, these stories confirm that organizations are losing ground on basic hygiene while simultaneously onboarding high-risk technologies without adequate security controls.

What helps against this

How we list vendors

Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For examplePalo Alto Networks Idira Secrets Management HashiCorp Vault GitGuardian Secrets Detection all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleCrowdStrike Falcon Adversary Intelligence Dataminr Threat Intelligence Dataminr Agentic Threat Intelligence Platform all options
AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
For exampleBoomi Agentstudio HiddenLayer AI Security Platform Palo Alto Networks Prisma AIRS all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — Ploutus
malware — EtherHiding

Entities

Tren de Aragua (threat_actor)North Korean state operators (threat_actor)Iranian state operators (threat_actor)Moonshot AI (vendor)Kimi K2.6 (product)Kimi K3 Swarm (product)