OAuth Traps, AI Platform Hacks, and EDR Killers: The Evolving Threat Landscape

The cybersecurity landscape continues to evolve at a rapid pace, with attackers refining old techniques while developing novel methods to bypass defenses. This week's security developments reveal several concerning trends that organizations should address proactively.

OAuth Consent Abuse: The Legitimate-looking Threat

Cloud security firm Wiz has highlighted a dangerous trend involving malicious OAuth applications that exploit "consent fatigue" to gain unauthorized access to sensitive data. These applications impersonate well-known brands like Adobe, DocuSign, and OneDrive, creating a legitimate appearance that tricks users into granting access.

"Once 'Accept' is clicked, the sign-in process is complete," explains Wiz. "But instead of going to a normal landing page, the access token is sent to the attacker's Redirect URL. With that token, the attacker now has access to the user's files or emails without ever needing to know their password."

This attack vector is particularly concerning because it bypasses traditional authentication mechanisms. Organizations should implement strict OAuth application validation processes and consider additional authentication steps for third-party integrations.

Messaging App Takeovers: Social Engineering Triumphs

Russian-linked hackers have developed sophisticated campaigns targeting Signal and WhatsApp accounts of government officials, journalists, and military personnel. Rather than attempting to break encryption, these attackers employ clever social engineering tactics.

"The most frequently observed method used by the Russian hackers is to masquerade as a Signal Support chatbot in order to induce their targets to divulge their codes," according to the Netherlands Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD).

This attack pattern demonstrates that even encrypted communication platforms remain vulnerable to social engineering. Organizations should implement additional verification protocols for support communications and train employees to recognize sophisticated impersonation attempts.

Cloud Breaches via Third-Party Flaws

Google's cloud security team has observed a troubling trend: threat actors are increasingly exploiting vulnerabilities in third-party software to breach cloud environments. The time between vulnerability disclosure and exploitation has collapsed dramatically.

"The window between vulnerability disclosure and mass exploitation collapsed by an order of magnitude, from weeks to days," Google reported. "While software-based exploits increased, initial access by threat actors using misconfiguration, which accounted for 29.4% of incidents in the first half of 2025, dropped to 21% in H2 2025."

This shift indicates that attackers are becoming more sophisticated, targeting specific software vulnerabilities rather than relying on common misconfigurations. Organizations should maintain rigorous vulnerability management programs for all third-party software and implement robust network segmentation to limit lateral movement.

Advanced Evasion Techniques: Zombie ZIP and EDR Killers

Security researchers have uncovered several novel evasion techniques that allow attackers to bypass security controls. The "Zombie ZIP" technique, tracked as CVE-2026-0866, involves creating malformed ZIP files that can bypass antivirus and EDR solutions while still being properly extracted by some software.

"Malformed ZIP headers can cause antivirus and endpoint detection and response software (EDR) to produce false negatives," according to the CERT Coordination Center (CERT/CC). "Despite the presence of malformed headers, some extraction software is still able to decompress the ZIP archive, allowing potentially malicious payloads to run upon file decompression."

More concerning is the "BlackSanta" EDR killer module, which specifically targets endpoint security software. This sophisticated attack begins with a resume-themed ISO file delivered through phishing emails and employs legitimate but vulnerable kernel drivers to disable security protections.

"BlackSanta acts as a dedicated defense-neutralization module that programmatically identifies and interferes with protection and monitoring processes prior to the deployment of follow-on stages," explains Aryaka researchers. "By targeting endpoint security engines alongside telemetry and logging agents, it directly reduces alert generation, limits behavioral logging, and weakens investigative visibility on compromised hosts."

Organizations should implement multi-layered security approaches and consider memory scanning capabilities to detect these advanced evasion techniques.

AI Platform Security: New Frontier for Attacks

The security of AI platforms has come under scrutiny with researchers demonstrating how easily these systems can be compromised. In a concerning demonstration, an AI agent successfully hacked McKinsey's internal AI platform Lili, gaining full read and write access in just two hours.

"This enabled access to the entire production database, including 46.5 million chat messages about strategy, mergers and acquisitions, and client engagements, all in plaintext, along with 728,000 files containing confidential client data, 57,800 user accounts, and 95 system prompts controlling the AI's behavior," according to researchers at CodeWall.

The agent discovered over 200 exposed endpoints, with 22 being completely unprotected. One endpoint contained an SQL vulnerability that could have allowed silent data access and system prompt modification.

This incident highlights the unique security challenges posed by AI systems. Organizations should implement rigorous security assessments for AI platforms, including proper input validation, access controls, and monitoring for unusual behavior.

Supply Chain and Third-Party Risks

The security of third-party software and services continues to be a major concern. A new campaign leverages GitHub Pages to distribute BoryptGrab information stealer through more than 100 public repositories that appear to offer legitimate software tools.

"The multi-stage infection chain begins when a ZIP file is downloaded from a fake GitHub download page," researchers note. "BoryptGrab can harvest browser data, cryptocurrency wallet information, and system information. It's also capable of capturing screenshots, collecting common files, and extracting Telegram information, Discord tokens, and passwords."

Similarly, signed malware continues to be a problem, with attackers abusing legitimate digital certificates to distribute remote monitoring and management (RMM) tools like ScreenConnect, Tactical RMM, and MeshAgent.

Organizations should implement strict third-party risk management programs and verify the integrity of all downloaded software, even when it appears to be from legitimate sources.

Practical Recommendations for Organizations

Based on these developments, organizations should consider implementing the following security measures:

1. Enhance OAuth Security: Implement strict validation for third-party OAuth applications and consider additional authentication steps for sensitive integrations.

2. Strengthen Social Engineering Defenses: Provide comprehensive training for employees on recognizing sophisticated impersonation attempts, especially targeting communication platforms.

3. Third-Party Vulnerability Management: Maintain rigorous vulnerability management programs for all third-party software and implement rapid patching processes.

4. Advanced Evasion Protection: Deploy multi-layered security approaches including memory scanning and behavioral analysis to detect sophisticated evasion techniques.

5. AI Platform Security: Implement rigorous security assessments for AI systems, focusing on input validation, access controls, and behavioral monitoring.

6. Supply Chain Security: Verify the integrity of all third-party software and services, even those with legitimate appearances.

The cybersecurity landscape continues to evolve, with attackers adapting to defensive measures and developing novel techniques. Organizations must remain vigilant, continuously updating their security postures to address these emerging threats.