ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.
The ThreatsDay bulletin leads with Unit 42's disclosure of CL-CRI-1171, a pay-per-install marketplace using YouTube channels and SEO-poisoning funnels to push trojanized software and the OfferLoader loader, which delivered Docro Hijacker, ARKTunnel and the cross-platform Insomnia RAT between July 2025 and April 2026. Oasis Security reported that 230 of 243 unauthenticated LocalAI instances were exploitable, with root command execution confirmed on 23 servers, theft of 127 AWS credential records, and exfiltration from a Thai military workstation. The roundup also covers Irregular's research on agentic self-modification, an AEPD-notified breach executed with an AI agent, CISA's warning that ransomware gangs exploit VMware vCenter CVE-2026-59310, and Oracle's September 2026 CPU fixing over 800 flaws.
- CL-CRI-1171 PPI marketplace uses YouTube channels and SEO funnels to deliver trojanized software
- OfferLoader delivered Docro Hijacker, ARKTunnel and Insomnia RAT from July 2025 to April 2026
- 23 of 243 exposed LocalAI instances showed root command execution; Thai military data stolen
- CISA warns ransomware crews now exploit VMware vCenter CVE-2026-59310; China-nexus APT also abused it
- Oracle's September 2026 CPU fixes 800+ flaws, none flagged as actively exploited
- CVEs
- CVE-2026-59310
- Tags
- ai-agentsinsomnia-ratlocalaiofferloaderoracle-patch-updatepay-per-installseo-poisoningvmware-vcenter
- Threat actors
- CL-CRI-1171
- Countries
- Thailand
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 62% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | luciferus.io | r month and claims to support three models on its website ("luciferus[.]io"). "The emergence of Luciferus aligns with a broader tren |
From the original article
13 min read at thehackernews.com
Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.