When you launch the attack yourself

A lot of attacks let the victim, or the victim's own tools, do the work. The ClickFix campaign talks Mac users into pasting a command into Terminal themselves, which launches an infostealer that drains crypto wallets and the Keychain. Metabase had to patch a CVSS 10.0 zero-day that attackers were using to steal customer data.

There was good news too. One of the main actors in the Snowflake case pleaded guilty to attacks that hit more than 100 million people. Black Hat showed how AI coding tools and agents open a path to CI secrets and corporate data. And someone uploaded nearly 800 malicious packages to npm at once, targeting Windows, macOS, and Linux.

A trap the victim springs themselves

Companies often have no idea this now happens on Macs too. Researchers described a new wave of so-called ClickFix attacks aimed at macOS users, and it rests on one thing, a false sense of safety. A spoofed page shows a prompt like "verify you are not a robot" or "fix your display", along with instructions: copy this command and paste it into Terminal. The victim does it themselves, which triggers a download of Go-based malware built for their specific CPU architecture.

The payload then steals cryptocurrency, browser-stored passwords, iCloud Keychain data, and cached credentials. Try to look at it through the attacker's eyes. They do not need to break any defense, they only need to convince the user to bypass it for them. And to stay hidden, the operation runs across more than 250 front-end domains that fingerprint the visitor first and show the malicious page only to selected Mac users. Crawlers and sandboxes get harmless content. A Russian loader-as-a-service called DOUBLECUP works in the same spirit, using ClickFix to hide malware inside PNG images cached by the browser.

What to do:

• Teach people a clear rule. No legitimate site asks you to paste commands into Terminal or PowerShell. That is almost always an attack.
• macOS is not immune. Put endpoint protection and detection on Macs too, not just on Windows.
• On endpoints, watch for a shell launched from the browser and payloads fetched by CPU architecture. That is this campaign's pattern.

Attackers exploited a Metabase zero-day before the patch arrived

This is the kind of risk you usually do not see, because it does not sit in your own house. The business intelligence platform Metabase warned of a maximum-severity flaw that attackers were exploiting as a zero-day. The bug, rated CVSS 10.0, lets an unauthenticated attacker inject arbitrary SQL into the application database and gain administrator access.

It did not stay a lab finding. Customer data leaked through compromised Metabase cloud instances. Among those affected is laptop maker Framework, whose customers' names, emails, phone numbers, and addresses got out. If you use Metabase or any other BI and data platform exposed to the internet, this is exactly the scenario that concerns you too. Someone else's SaaS in your chain is your risk.

What to do:

• Update Metabase to the patched version as a priority, and check whether the instance was needlessly exposed to the internet.
• Review logs for unusual SQL queries and administrator actions from before the patch.
• Map which vendors and SaaS platforms hold your data, and watch their security advisories.

One of the main Snowflake attackers pleaded guilty

Good news for a change. Twenty-six-year-old Connor Moucka of Kitchener, Canada, pleaded guilty to computer fraud and conspiracy over a series of 2024 attacks on customer accounts of the cloud platform Snowflake. The intrusions hit at least 165 organizations and exposed records of at least 100 million people. He personally took at least 495,000 dollars according to the charges.

You would think to blame Snowflake. In reality the technology did not fail, the process did. The attacks relied on no exotic vulnerability, the attackers got in through stolen credentials for accounts that had no multi-factor authentication enabled. That is a typical management failure, not a product one. The investigation is still ongoing, but it shows that cross-border cooperation can catch such actors.

What to do:

• Enforce multi-factor authentication on every account tied to cloud data platforms. Its absence is exactly what enabled this wave.
• Monitor and rotate credentials for SaaS and data warehouses, especially service and integration accounts.
• Turn on detection for bulk exports and access from unusual locations over sensitive data.

AI tools and agents open new doors for attackers

Black Hat USA brought several pieces of work showing that AI tools and agents open a path an attacker would not otherwise reach. Picture what happens when you run a coding agent in the default configuration the vendor ships. With Claude Code and Gemini CLI, simply opening a GitHub issue from an account with no repository privileges was enough to run code on the CI runners behind these agents.

On top of that came flaws in agent infrastructure from AWS, Google, and Vercel, where untrusted or forged instructions reached an agent's tools without a model turn ever running. System prompts and filters never got a chance to intervene. And the Atlassian Rovo assistant could be steered into collecting Jira and Confluence data and sending it to an attacker. It is a new layer, and with it a new attack surface that grows in companies faster than anyone keeps watch over it.

What to do:

• Treat AI agents as an identity with privileges. Give them least privilege, separate tokens, and do not run them against production with full access.
• Review the default configuration of coding agents and CI pipelines. External input, such as a GitHub issue, must not reach secrets.
• Assume prompt injection. Content an agent reads is attacker input, not a trusted command.

Nearly 800 malicious packages uploaded to npm at once

Someone uploaded nearly 800 malicious packages to the npm registry as part of a single campaign targeting Windows, macOS, and Linux. The names look like randomly generated typos or so-called AI slopsquatting, but they all deliver the same cross-platform RAT and infostealer. The dangerous part is that this is an invisible problem. One planted package in your build that you do not know about, and it is on your developers' machines.

What is also telling is how the attacker thinks about hiding. They encode the command server's IP address into the made-up destination address of an empty Ethereum transfer, so at first glance you see no classic connection to a suspicious server. The developer ecosystem stays an attractive target, because a single package lands straight in the build and onward.

What to do:

• Pin dependency versions and use a lockfile. Do not install packages just by a similar-looking name.
• Deploy dependency scanning and a dependency firewall that catches newly published and suspicious packages.
• Isolate build environments and limit where their network traffic can go.

What to take away from all of this

• Today's most effective trick is getting a person to run the damage themselves. "Copy and paste this command" is an attack, whether you are on a Mac or on Windows.
• Macs and developer machines need the same protection and detection as ordinary corporate Windows. A sense of safety is itself a risk.
• Do not wait on critical patches like Metabase, TeamCity, or Kemp LoadMaster. Several of them are already being actively exploited.
• Multi-factor authentication on cloud and data platforms is not a nice-to-have. Its absence is what stood behind the Snowflake case affecting 100 million people.
• AI agents and tools are a new identity with privileges. Give them minimal access and assume their input can be forged.
• The supply chain is yours. Someone else's SaaS like Metabase and someone else's npm package can both seep into your data and your build.
• Ransomware rolls on. The Qilin group is among the most active with 38 published victims, most of the targets in the US.

What we would do at Cyber Rangers

With clients we see one thing again and again. It is not that they lack the technology, it is that no one looks at these scenarios systematically. So in practice we solve it together. We drill your team on how to spot ClickFix and other social engineering before anyone pastes a foreign command into Terminal. We check from an attacker's view what is visible about your company and its SaaS integrations from the outside, and we go through whether you have multi-factor where it belongs. We also look at how your AI tools and CI pipelines are set up, so external input cannot reach secrets. And we help with dependency inventory and the patching process, so critical holes like Metabase or TeamCity do not stay open longer than they must.