Malware threats evolve: AI baiting, typosquatting and stealthy C2 channels
Cybersecurity researchers are warning of increasingly sophisticated malware campaigns that weaponize AI tools, abuse trusted software ecosystems, and hide command-and-control traffic in everyday platforms. A new roundup highlights how threat actors are targeting developers, enterprises, and even critical infrastructure with evasive techniques that blend into legitimate workflows.
The rise of AI-powered malware delivery
Threat actors are now exploiting the AI ecosystem itself, deploying over 800 malicious AI skills and MCP servers to deliver malware through seemingly benign tools. This "AgentBaiting" approach preys on developers seeking productivity enhancements, turning trusted platforms into entry points for compromise. Meanwhile, the Thai Ministry of Finance faced a Hermes AI agent campaign that staged the Hades implant, underscoring how AI-driven threats are moving beyond proof-of-concept to real-world financial targeting.
Stealth operations in the cloud and supply chains
Malware authors are also abusing widely used platforms to establish covert communication channels. A new technique called HOLLOWGRAPH turns Microsoft 365 Calendars into command-and-control infrastructure, allowing attackers to blend malicious traffic with legitimate business communications. Supply-chain risks are escalating too, with a NuGet typosquatting campaign rigging a betting platform by pushing malicious packages disguised as legitimate dependencies.
Evasion and persistence in the crosshairs
Other campaigns demonstrate how malware evades detection and maintains persistence. Chaos ransomware’s msaRAT abuses browser processes to build covert C2 channels, while the UAC-0099 group has updated its MATCHBOIL.V2 malware to hide within a fake Notepad++ plugin, targeting Ukrainian organizations. These tactics reflect a broader trend: attackers are leveraging trusted software and cloud services to fly under the radar.
Why it matters
The convergence of AI exploitation, supply-chain abuse, and cloud-based command-and-control signals a shift toward more covert, harder-to-detect attacks. For developers, security teams, and enterprises, this means traditional defenses are no longer sufficient. Vigilance in vetting third-party tools, monitoring cloud services, and scrutinizing AI integrations is now critical. The stakes are clear: as threat actors refine their tactics, the window for detection and response is shrinking.
Source: Security Affairs. AI-assisted editorial synthesis — TechnoExpress.