[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv98m4U0LIp9KAsvdnnKpyjG4TXnUerhY9rq08FlXqA0":3},{"article":4,"iocs":55,"watch_terms":58,"solutions":59,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"b23ac87c-21cc-41f0-bcd6-42316830c3b5","ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories","threatsday-ai-search-poisoning-ai-coding-tool-leaking-repos-one-click-code-execu-37f6b0","This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts look real enough. And some attacks barely need an exploit at all — just","This week's threats include the RemControl Android banking trojan, which uses AI-assisted development and abuses accessibility services for phishing. AI coding assistant Z.ai had to disable features after it was found leaking user code repositories to Alibaba Cloud. Additionally, CISA and the FBI issued a fact sheet warning critical infrastructure operators about the risks of granting third-party ICS integrators excessive access.","AI tools leak code, banking trojans use AI, and critical infrastructure faces risks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fthreatsday-ai-search-poisoning-ai.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjQeh1uEFjgxcgPPJkrXkAnJxZRxA9_ZolFQXNONWmfMGLViusszn4KTiJ9-8_r-AV94NS5BQlZ5eOrFnTvinPXcJB_G4o_BEZdv7xXMdAqfvZPfiUzKjlE70q2V6C9ze8H58pqYh-suKm_Yu1q3LoevignMd7nfjbjV7qx_vEad6BEFKUHwV5UlTFW1-dh\u002Fs1600\u002Fthreatsday-sep.jpg","2026-09-24T17:52:43+00:00","2026-09-24T20:01:05.33313+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"RemControl","product",{"name":21,"type":19},"ZCode",{"name":23,"type":24},"Z.ai","vendor",{"name":26,"type":24},"SpaceXAI",{"name":28,"type":19},"Grok Build","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":31,"name":53,"slug":54},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[56],{"type":49,"value":18,"context":57},"Android banking trojan targeting Western Europe, Middle East, and Canada.",[23,26,18],{"controls":60,"vendors":145},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":91,"name":92,"problem":93,"products":94},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":133,"product_name":134,"url":135,"description":136},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":163},"ai-tools-excessive-third-party-access-and-banking-trojans-highlight-this-weeks-threat-landscape","AI Tools, Excessive Third-Party Access, and Banking Trojans Highlight This Week's Threat Landscape","Three distinct but interconnected threats emerged this week, each exposing gaps in how organizations vet and control access to sensitive systems and data. The RemControl Android banking trojan leverages AI-assisted development and abuses accessibility services, demonstrating that threat actors are actively weaponizing AI to accelerate and sophisticate attacks. The Z.ai coding assistant inadvertently leaked user code repositories to Alibaba Cloud, highlighting the data protection risks inherent in trusting third-party AI development tools with proprietary code. Finally, CISA and the FBI's warning about over-privileged ICS integrators underscores a persistent supply chain risk: third-party vendors with excessive access to critical infrastructure can become catastrophic attack vectors if compromised or negligent.",[151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 15 – Service Provider Management","NIST SP 800-82 – Guide to ICS Security","NIST AC-2 – Account Management","NIST AC-6 – Least Privilege","NIST SA-9 – External Information System Services","NIST SR-6 – Supplier Assessments and Reviews","GDPR Article 28 – Processor Obligations","GDPR Article 32 – Security of Processing","IEC 62443-2-1 – Security Management System for IACS","ITIL – Supplier Management Practice",{"NIST AC-6 – Least Privilege":164,"NIST AC-2 – Account Management":165,"CIS Control 5 – Account Management":166,"ITIL – Supplier Management Practice":167,"NIST SP 800-82 – Guide to ICS Security":168,"GDPR Article 28 – Processor Obligations":169,"GDPR Article 32 – Security of Processing":170,"CIS Control 6 – Access Control Management":171,"CIS Control 15 – Service Provider Management":172,"NIST SR-6 – Supplier Assessments and Reviews":173,"NIST SA-9 – External Information System Services":174,"IEC 62443-2-1 – Security Management System for IACS":175},"Requires least privilege, limiting both third party access and app permissions abused by RemControl.","Requires account management, including reviewing and removing unneeded third party accounts.","Asks for account management, including tracking third party accounts with access to sensitive systems.","Asks for supplier management, including governance of third party access.","Gives ICS security guidance, relevant where third parties have access to industrial systems.","Requires processor guarantees, relevant where third parties handle personal data.","Requires appropriate security for personal data, including protection from banking trojans and excessive access.","Asks for access control, limiting excessive third party access highlighted this week.","Asks for managing service providers, including reviewing the access they hold.","Requires assessing suppliers, including their access and security practices.","Requires managing external services, including the access they are granted.","Sets security management requirements for industrial automation, including governance of third party access."]