grammarly

The amount of sensitive enterprise data which employees uploaded to AI and machine learning applications has almost doubled in the last year, putting organizations at increased risk of data breaches and cyber espionage, a new report has warned. Published on June 17, the Zscaler 2026 AI Threat Report said that there has been a 93% year-over-year increase in employees transferring enterprise data to AI tools. Over half of these data transfers were driven by staff using two tools in particular: Grammarly (38%) and ChatGPT (21%). Other tools included OpenAI, Codium, GitHub Co-Pilot, Perplexity, Microsoft Co-Pilot, Google Gemini and Claude. According to Zscaler, a total of 18,033 TB of data was transferred to AI and machine learning applications during the last year. The report stated that this is roughly equivalent to 3.6 billion digital photos. Employees Putting Sensitive Data in ChatGPT Zscaler identified over 410 million Data Loss Prevention (DLP) policy violations related to ChatGPT, representing an increase of 99% year-over-year. These violations were related to sensitive information such as financial records, personally identifiable information (PII), source code, healthcare data, and other regulated content. Employees are not typically acting with malice, rather they are attempting to transfer data to AI models to help them be more efficient at work. However, uploading this information to AI models could have potentially significant data privacy implications. “The riskiest AI applications tend to be those that employees use without thinking—writing assistants, coding helpers, or AI features layered into collaboration suites. Their convenience is exactly what makes them higher risk; they see the same sensitive content employees do, often at the moment it’s created,” warned the report. The AI coding assistant Codium also represented a significant vector for DLP violations, with over 242 million detected by Zscaler. This represented a 100% year-over-year increase, suggesting increased leakage risk for source code and proprietary logic, something which could be highly damaging to businesses. To counter the potential cybersecurity risks around the increased use of AI by employees, Zscaler has made several recommendations: Inventory all GenAl apps and apps with embedded AI functionality: Create a continuously updated catalog of every standalone GenAl tool and every SaaS or internal app that includes AI functionality or features Disable risky AI defaults: Turn off auto-enabled AI functionality in SaaS and productivity apps until they have been reviewed and configured to match your risk posture Apply zero trust to all model interactions: Implement least-privilege access for every user, service, and system that interacts with an AI model Enforce AI guardrails with inline inspection: Ensure inline inspection across all AI/ML traffic to prevent external malicious activity from compromising AI systems and stop sensitive data from being exposed via prompts or in outputs The findings in the report are based on analysis of 989.3 billion total AI and ML transactions in the Zscaler cloud from January 2025 through December 2025.

Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. "Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate the implications of running unknown and obfuscated terminal commands," Sophos researchers Jagadeesh Chandraiah, Tonmoy Jitu, Dmitry Samosseiko, and Matt Wixey said. It's currently not known if the campaigns are the work of the same threat actor. The use of ClickFix lures to distribute the malware was also flagged by Jamf Threat Labs in December 2025. The details of the three campaigns are as follows - November 2025: A campaign that used OpenAI's ChatGPT Atlas web browser as bait, delivered via sponsored search results on Google, to direct users to a fake Google Sites URL with a download button that, when clicked, displayed instructions to open the Terminal app and paste a command to it. This action downloaded a shell script, which prompts the user to enter the system password and runs MacSync with user-level permissions. December 2025: A malvertising campaign that leveraged sponsored links tied to searches for queries like "how to clean up your Mac" on Google to lead users to shared conversations on the legitimate OpenAI ChatGPT site to give the impression that the links were safe. The ChatGPT conversations redirected victims to malicious GitHub-themed landing pages that tricked users into running malicious commands on the Terminal app. February 2026: A campaign targeting Belgium, India, and parts of North and South America that distributed a new variant of MacSync delivered through ClickFix lures. The latest iteration supports dynamic AppleScript payloads and in-memory execution to evade static analysis, bypass behavioral detections, and complicate incident response. The shell script launched after running the Terminal command is designed to contact a hard-coded server and retrieve the AppleScript infostealer payload, while simultaneously taking steps to remove evidence of data theft. The stealer is equipped to harvest a wide range of data from compromised hosts, including exfiltrating credentials, files, keychain databases, and seed phrases from cryptocurrency wallets. The latest findings suggest the threat actors are adapting the formula to stay one step ahead of security tools, while weaponizing the trust associated with ChatGPT conversations to convince users to run malicious commands. The new variant observed in the most recent campaign "likely represents the malware developer adjusting to OS and software security measures to maintain effectiveness," Sophos said. "Refinements to the typical ClickFix social engineering tactics are therefore one way in which such campaigns may continue to evolve in the future." In recent months, ClickFix campaigns have used legitimate platforms like Cloudflare Pages (pages.dev), Squarespace, and Tencent EdgeOne to host bogus instructions for installing developer tools like Anthropic's Claude Code. The URLs are distributed via malicious search engine ads. The instructions, as before, deceive victims into installing infostealer malware like Amatera Stealer instead. The social engineering attack has been codenamed InstallFix or GoogleFix. According to Nati Tal, head of Guardio Labs, similar infection chains lead to the deployment of Alien infostealer on Windows and Atomic Stealer on macOS. The PowerShell command executed after pasting and running the supposed installation command for Claude Code fetches a legitimate Chrome extension package within a malicious HTML Application (HTA) file, which then launches an obfuscated .NET loader for Alien in memory, per Tal. Guardio has described GoogleFix as a malvertising campaign that takes advantage of sponsored Google search results to redirect users looking for solutions to common macOS problems to malicious pages hosted on various platforms like Grammarly, Coda, Kimi, Medium, Squarespace, and Writesonic. The result is a "turnkey, industrialized pipeline" for malware delivery, it added. "While traditional ClickFix attacks need to manufacture a reason for the user to run a command: a fake CAPTCHA, a fabricated error message, a bogus system prompt — InstallFix doesn't need any of that," Push Security said. "The pretext is simply the user wanting to install legit software." According to Pillar Security, there have been at least 20 distinct malware campaigns that have targeted artificial intelligence (AI) and vibe coding tools between February and March 2026. These include code editors, AI agents, large language models (LLM) platforms, AI-powered browser extensions, AI video generators, and AI business tools. Of these, nine have been found to target both Windows and macOS, with another seven exclusively affecting macOS users. "The reason is clear: AI/vibe coding tool users skew heavily toward macOS, and macOS users tend to have higher-value credentials (SSH keys, cloud tokens, cryptocurrency wallets)," Pillar Security researcher Eilon Cohen said. "The ClickFix/InstallFix technique (tricking users into pasting commands into Terminal) is uniquely effective against developers because curl | sh is a legitimate installation pattern. Homebrew, Rust, nvm, and many other developer tools use this exact pattern. The malicious commands hide in plain sight." Needless to say, the advantage posed by ClickFix (and its variants) has led to the tactic being adopted by multiple threat actors and groups. This includes a malicious traffic distribution system (TDS) named KongTuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124), which uses compromised WordPress websites and fake CAPTCHA lures to deliver a Python-based trojan called ModeloRAT. The attackers inject malicious JavaScript into legitimate WordPress websites that prompt users to run a PowerShell command responsible for initiating a multi-stage infection process to deploy the trojan. "The group continues to use this method alongside the newer CrashFix technique, which tricks users into installing a malicious browser extension to initiate infection," Trend Micro said. "The malware specifically checks whether a system is part of a corporate domain and identifies installed security tools before continuing, suggesting a focus on enterprise environments rather than opportunistic infections." That's not all. KongTuke campaigns have also been spotted using DNS TXT records in their ClickFix script. These DNS TXT records stage a command to retrieve and run a PowerShell script. Other ClickFix-style pastejacking attacks that have been detected in the wild are listed below - Using compromised websites to display lures for ClickFix pages that mimic Google's "Aw Snap!" error or browser updates to distribute droppers, downloaders, and malicious browser extensions. Using ClickFix decoys served via malvertising/phishing links to direct users to malicious pages that lead to the deployment of Remcos RAT. Using a fake CAPTCHA verification lure on a phony website promoting a $TEMU airdrop scam to trigger the execution of a PowerShell command that runs arbitrary Python code retrieved from a server. Using a bogus website advertising CleanMyMac to trick users into running a malicious Terminal command to deploy a macOS stealer named SHub Stealer and backdoor cryptocurrency wallets such as Exodus, Atomic Wallet, Ledger Wallet, and Ledger Live to steal the seed phrases. Using a fake CAPTCHA verification lure on compromised websites to run a PowerShell script that delivers an MSI dropper, which then installs the Deno JavaScript runtime to execute obfuscated code that ultimately installs CastleRAT in memory by means of a Python loader named CastleLoader. In a report published last week, Rapid7 revealed that highly trusted WordPress websites are being compromised as part of an ongoing, widespread campaign designed to inject a ClickFix implant impersonating a Cloudflare human verification challenge. The activity has been active since December 2025. More than 250 infected websites have been identified in at least 12 countries, including Australia, Brazil, Canada, Czechia, Germany, India, Israel, Singapore, Slovakia, Switzerland, the U.K., and the U.S. The websites have been identified as regional news outlets and local businesses. The end goal of these lures is to compromise the Windows systems with different stealer malware families: StealC Stealer, an improved version of Vidar Stealer, a .NET stealer dubbed Impure Stealer, and a C++ stealer referred to as VodkaStealer. The stolen data can then act as a launchpad for financial theft or follow-on attacks. The exact method by which the WordPress sites are hacked is presently not known. However, it's suspected to involve the exploitation of recently disclosed security flaws in WordPress plugins and themes, previously stolen admin credentials, or publicly accessible wp-admin interfaces. To counter the threat, site administrators are advised to keep their sites up-to-date, use strong passwords for administrative access, set up two-factor authentication (2FA), and scan for suspicious administrator accounts. "The best defense for individuals browsing the web is to stay cautious, maintain a zero-trust mindset, use reputable security software, and keep themselves up to date with the latest phishing and ClickFix tactics used by malicious actors," Rapid7 said. "An important takeaway from this report should be that even trusted websites can be compromised and weaponized against unsuspecting visitors."

AI adoption is accelerating faster than enterprise oversight, creating a rapidly widening attack surface across all sectors, said Zscaler in its ThreatLabz 2026 AI Security Report. The annual report, published on January 27, 2026, analyzed 989.3 billion AI and machine learning transactions across the Zscaler Zero Trust Exchange platform between January and December 2025. The cybersecurity firm found that despite a 91% AI usage growth across an ecosystem of more than 3400 AI applications, many organizations still lack a basic inventory of AI models and embedded AI features. Finance and insurance remain the most AI-driven sectors by volume, together accounting for 23% of all AI/ML traffic, while the technology and education sectors recorded explosive year-over-year growth in AI transactions (202% and 184%, respectively). Departments that used AI the most were engineering, which represented 48.9% of all AI usage, followed by IT (31.8%) and marketing (6.9%). Enterprise AI activity observed by Zscaler was largely concentrated in the US, which accounted for 38% of transactions, followed by India (14%) and Canada (5%). OpenAI services was the top LLM vendor recorded every month of 2025, followed by Codelium and Perplexity. Alongside the uptick in AI usage, Zscaler analysts found critical vulnerabilities in 100% of AI systems and applications observed, with 90% of systems compromised in under 90 minutes. The median time to first critical failure was just 16 minutes, with some of these AI flaws in a single second. Enterprise AI Apps Drive Data Privacy Violations Additionally, in parallel with a surge in AI usage, Zscaler reported a staggering 18,033 TB of enterprise data transferred to AI/ ML applications, a 93% year-over-year rise. “The massive influx has transformed tools like Grammarly (3,615 TB) and ChatGPT (2,021 TB) into the world’s most concentrated repositories of corporate intelligence,” said the report. The scale of this risk is quantified by 410 million data loss prevention (DLP) policy violations tied to ChatGPT alone, including attempts to share social security numbers, source code and medical records. “These findings signal that AI governance has transitioned from a policy discussion to an immediate operational necessity,” noted the Zscaler analysts in the report. Finally, the report anticipates autonomous and semi‑autonomous “agentic” AI will increasingly automate cyber-attacks in the near future, with AI agents assuming responsibility for reconnaissance, exploitation and lateral movement. “Defenders must assume that attacks can scale and adapt at machine speed, not human speed,” warned the report. Deepen Desai, EVP for cybersecurity at Zscaler, said that AI can no longer be considered as a simple productivity tool “but a primary vector for autonomous, machine-speed attacks by both crimeware and nation-state.”

Grammarly and QuillBot are among widely used Chrome extensions facing serious privacy questions A new study shows that some of the most widely used AI-powered browser extensions are a privacy risk. They collect lots of data and require a high level of browser access. The research was conducted by Incogni, which analyzed 442 AI-powered Google Chrome extensions for its 2026 privacy risk report. The study reviewed extensions across eight categories and assessed their permissions, declared data collection practices, and security risk scores. High-impact access is common Every extension in the study needed some level of permission to work. In many cases, that meant being able to read what was happening on websites, track activity inside browser tabs, or even inject scripts directly into pages. With that kind of access, these tools can see far more than users might realize, including email, internal dashboards, cloud applications, and collaboration platforms. 52% of the extensions collected some form of user data. Many collected personally identifiable information, including personal communications, location data, or detailed website content. These practices appeared across both niche tools and widely used products. The most common sensitive permission was scripting. This permission allows an extension to run code inside web pages, which can alter content or capture input. From a security perspective, scripting access creates long-term exposure when extensions change ownership, update code, or become compromised. Popular tools rank high for potential damage Among extensions with millions of downloads, Grammarly and QuillBot ranked as the most potentially privacy-damaging. Both tools collected multiple categories of user data and required permissions that allowed deep interaction with browser content. Incogni researchers note that Grammarly collected website content, personal communications, and user activity data. User activity can include interaction patterns such as keystrokes, scrolling behavior, and navigation events. QuillBot collected similar categories of content and communication data. Both extensions required scripting and activeTab permissions. ActiveTab allows temporary access to the current browser tab, while scripting enables code injection into web pages. Security risk scoring showed a low likelihood of malicious use for both tools. The study still ranked them high due to the breadth of access and the scale of their installed base. “AI-powered extensions can be genuinely useful, but most users have very little visibility into how much access they’re granting when they install them,” said Darius Belejevas, head of Incogni. “Some of these tools can read everything you type, see every page you visit, or inject code directly into websites. That level of access deserves far more attention than it typically gets.” Categories with the highest exposure When extensions were grouped by function, programming and mathematical helpers ranked highest for average privacy risk. Tools in this category often requested broad permissions and interacted with sensitive environments such as code repositories, cloud notebooks, spreadsheets, and learning platforms. They required access to active tabs and scripting permissions to provide inline assistance or perform calculations in real time. These extensions often handled content users treat as internal or confidential, including proprietary code, credentials embedded in scripts, and unpublished research. Even when declared data collection remained limited, the access required to operate increased overall exposure. Meeting assistants and audio transcribers ranked close behind. These tools often operated during live meetings and recordings, where sensitive conversations, shared screens, and internal documents are common. Their permission sets reflected this role, with access tied to active tabs, audio streams, and meeting interfaces. Extensions in this category frequently combined broad permissions with larger volumes of collected data. That combination raised their average risk scores, particularly when conversations or transcripts were processed outside the local device. Writing assistants ranked next. These tools usually required access across websites so they could operate wherever users type. That access often included the ability to read and change page content on all URLs, which expanded exposure across email clients, collaboration tools, and internal portals. Personal assistants and general-purpose tools followed a similar pattern. They focused on automation and workflow support, which led to permission requests spanning tabs, browsing activity, and background processes. Even when data collection disclosures were limited, the access profile increased risk. Translators combine access with low misuse signals Translator extensions stood out for a different reason. Tools in this category scored high on potential impact because they required permissions that allowed them to read and change content across websites. These permissions enabled real-time translation and also provided broad visibility into browsing activity. Risk likelihood scores for translators remained low across the group. This placed them in a category where extensive access exists without strong indicators of misuse. Google Translate, eJOY AI Dictionary, and Immersive Translate ranked highest due to permission depth or data collection practices. Several translator extensions stated that they did not collect user data. Researchers noted that these claims rely on developer disclosures and cannot be verified without access to the source code.

OpenAI's Atlas and Perplexity's Comet browsers are vulnerable to attacks that spoof the built-in AI sidebar and can lead users into following malicious instructions. The AI Sidebar Spoofing attack was devised by researchers at browser security company SquareX and works on the latest versions of the two browsers. The researchers created three realistic attack scenarios where a threat actor could use AI Sidebar Spoofing to steal cryptocurrency, access a target's Gmail and Google Drive services, and hijack a device. Atlas and Comet are agentic AI browsers that integrate large language models (LLMs) into a sidebar for users to interact with while browsing: ask to summarize the current page, execute commands, or perform automated tasks. Comet was released in July, while ChatGPT Atlas became available for macOS earlier this week. Since its release, Comet has been the target of multiple research [1, 2, 3] showing that it comes with security risks under certain circumstances. Injecting a rogue AI agent SquareX found that in both Comet and Atlas, it is possible to draw a fake sidebar over the genuine one using a malicious extension that injects JavaScript into the web page the user sees. The fake sidebar would be identical to the one in the agentic browser, creating a deceptive element that appears to be part of the standard user interface. Since the counterfeit overlays the real one and intercepts all interactions, users would be completely unaware of the fraud. By using an extension, the injected JavaScript can render the malicious sidebar overlay on every site the user visits. SquareX notes that such an extension would only require 'host' and 'storage' permissions, which are common for productivity tools such as Grammarly and password managers. "Since there is no visual and workflow difference between the spoofed and real AI sidebar, the user will likely believe that they are interacting with the real AI Browser sidebar," the researchers say. SquareX used Google's Gemini AI in the Comet browser to demonstrate their findings. The researchers used specific parameters that responded with malicious instructions to specific prompts. Three examples SquareX highlights in the report are: Leading users to phishing pages when they ask cryptocurrency-related questions. Performing OAuth attacks via fake file-sharing apps, hijacking users' Gmail/Drive. Giving users seeking to install software a reverse shell installation command instead. Real attacks could use a lot more "trigger prompts," frequently pushing users to a broad range of risky actions. At the time of the research, OpenAI had not released the Atlas browser, and SquareX tried the AI Sidebar Spoofing attack only on Comet. However, they also tested the attack on OpenAI's Atlas browser when it launched, and confirmed that AI Sidebar Spoofing works on it, too. The researchers have contacted both Perplexity and OpenAI about the issue, but neither responded. BleepingComputer has also reached out to the companies but received no response by publishing time. Users of agentic AI browsers should be aware of the many risks these tools pose and restrict their use to non-sensitive activities, avoiding tasks that involve email, financial information, or other private data. Although new security safeguards are added with each release in response to emerging attacks, these browsers have not yet reached the level of maturity needed to reduce their attack surface to an acceptable level for anything beyond casual browsing. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Employees race to build custom AI apps despite security risks The latest Netskope findings show a 50% increase in GenAI platform usage among enterprise end-users, driven by growing employee demand for tools to develop custom AI applications and agents. Top LLM interfaces by percentage in organizations (source: Netskope) Despite an ongoing shift toward safe enablement of SaaS GenAI apps and AI agents, the growth of shadow AI, unsanctioned AI applications in use by employees, continues to compound potential security risks, with over 50% of all current app adoption estimated to be shadow AI. The rise of GenAI platforms GenAI platforms, which are foundational infrastructure tools that enable organizations to build custom AI apps and AI agents, represent the fastest growing category of shadow AI given their simplicity and flexibility for users. GenAI platforms expedite direct connection of enterprise data stores to AI applications with the popularity in usage creating new enterprise data security risks that place added importance on data loss prevention (DLP) and continuous monitoring and awareness. Network traffic tied to GenAI platform usage also increased 73% over the prior three month period. In May, 41% of organizations were already using at least one GenAI platform. Approximately 29% of organizations are utilizing Microsoft Azure OpenAI, followed by Amazon Bedrock (22%), and Google Vertex AI (7.2%) respectively. “The rapid growth of shadow AI places the onus on organizations to identify who is creating new AI apps and AI agents using GenAI platforms and where they are building and deploying them,” said Ray Canzanese, Director of Netskope Threat Labs. “Security teams don’t want to hamper employee end users’ innovation aspirations, but AI usage is only going to increase. To safeguard this innovation, organizations need to overhaul their AI app controls and evolve their DLP policies to incorporate real-time user coaching elements.” Growing deployment of on-premises generative AI From deploying GenAI locally through on-premises GPU sources, to developing on-premises tools that interact with SaaS GenAI applications or GenAI platforms, organizations are evaluating many options to innovate quickly using AI, and, increasingly, they are turning to LLM interfaces. However, on-premises deployment also means the organization is solely responsible for the security of its GenAI infrastructure. 34% of organizations are using LLM interfaces, with Ollama the current adoption leader, and others such as LM Studio and Ramalama just scratching the surface. Meanwhile, employee end-users are experimenting with AI tools and visit AI marketplaces. For example, users are downloading resources from Hugging Face at 67% of organizations. The promise of AI agents is driving this behavior as the data shows there is now a critical mass of users across organizations building AI agents and leveraging agentic AI features of SaaS solutions. GitHub Copilot is now used in 39% of organizations and 5.5% have users running agents generated from popular AI agent frameworks on-premises. Furthermore, on-premises agents are retrieving more data from SaaS services and are doing so by accessing more API endpoints other than browsers. 66% of organizations have users making API calls to api.openai.com and 13% to api.anthropic.com. Continuing SaaS GenAI app growth Netskope is now tracking more than 1,550 distinct GenAI SaaS applications, up from just 317 in February, indicating the pace at which new apps are being released and adopted throughout the enterprise. Organizations are now using approximately 15 GenAI apps, up from 13 in February. Additionally, the amount of data uploaded to GenAI apps each month has increased from 7.7 GB to 8.2 GB quarter over quarter. Enterprise users are beginning to consolidate around purpose-built tooling, such as Gemini and Copilot, as more security teams work to safely enable these applications and solutions across their business as these chatbots are now better integrated into their productivity suites. ChatGPT saw its first decrease in enterprise popularity since Netskope started tracking the popular GenAI app in 2023. Of the top 10 most popular GenAI apps per organization, ChatGPT was the only one to see a decrease since February, while other popular apps, including Anthropic Claude, Perplexity AI, Grammarly, and Gamma, all saw enterprise adoption gains. Additionally, Grok’s gain in popularity has seen it enter the top 10 most-used applications for the first time. While it does remain in the top 10 most-blocked apps list, its blockage rates have been trending downward as more organizations evaluate and opt into granular controls and monitoring.