This Week's Threat Intelligence Summary
The ThreatsDay Bulletin from The Hacker News for the week of June 11, 2026 covers one of the more eventful stretches in recent threat intelligence history. The headline stories involve supply chain attack infrastructure going public, sophisticated browser-hijacking malware, and a new attack class that specifically targets AI agents as an infiltration vector.
Top Stories
Worm Source Code Publicly Leaked
Source code for a worm previously used in supply chain attacks was published on GitHub, dramatically lowering the barrier for copycat campaigns. Security researchers observed the code being forked and modified within hours of publication, with several modified variants appearing in threat actor forums by end of week.
The leaked code includes:
- Self-spreading mechanisms targeting npm, PyPI, and GitHub Actions
- Credential harvesting payloads targeting CI/CD pipeline secrets
- Command-and-control infrastructure templates
This type of tooling democratizes advanced supply chain attacks — previously the domain of well-resourced nation-state actors or organized crime groups — and puts them in reach of script-level attackers.
AI Agent Phishing: A New Attack Class
Researchers demonstrated that AI coding agents and workflow automation tools can be successfully phished to leak credentials and perform unauthorized actions. The attack exploits the way AI agents handle ambiguous or spoofed instruction sources:
- Attackers inject malicious instructions into content the AI agent is processing (documents, web pages, code comments)
- The agent follows the injected instructions, believing they are legitimate
- Sensitive credentials, API keys, and session tokens are exfiltrated as part of "normal" agent activity
This is an evolution of prompt injection attacks, specifically engineered to exploit the autonomous, action-taking nature of modern AI agents rather than just extracting information.
Claude Code Security Patch
Anthropic issued a patch for Claude Code addressing a security vulnerability. The patch follows a disclosure period and addresses an issue in how Claude Code handles certain input scenarios that could have allowed unauthorized access or unexpected behavior in developer environments.
Details of the specific CVE and technical breakdown are covered in a separate advisory.
$5,000/Month Browser-Cloning RAT
A Remote Access Trojan (RAT) marketed at $5,000 per month subscription has been identified in active use. The malware's distinguishing capability is full browser session cloning — it doesn't just steal passwords but captures active authenticated sessions, cookies, and local storage, enabling attackers to impersonate victims across web services without triggering additional authentication challenges.
Key capabilities:
- Browser session export and remote import
- Clipboard monitoring and injection
- Screenshot and keystroke capture
- Persistence via scheduled tasks and registry modifications
The high subscription price targets organized fraud operations rather than casual attackers.
Additional Stories This Week (28 Total)
The full bulletin covers 28 stories including:
- Ransomware and extortion: New variants, victim disclosures, and law enforcement actions
- Critical infrastructure: ICS/OT targeting and utility sector incidents
- Cloud security: Misconfiguration exploitation and cloud-native malware
- Phishing campaigns: Novel lure techniques and infrastructure takedowns
- Vulnerability disclosures: Notable CVEs across enterprise software stacks
- Threat actor tracking: Attribution updates for active APT groups
Key Takeaways for Security Teams
-
Treat AI agents as privileged service accounts — they need the same security controls, least-privilege configurations, and audit logging as any high-privilege automated process
-
Monitor public repositories for leaked tooling — threat intelligence feeds should include GitHub and paste-site monitoring for newly published attack code
-
Browser session security goes beyond passwords — organizations should enforce re-authentication thresholds and session timeout policies to limit the impact of session-cloning malware
-
Supply chain hygiene: The week's events reinforce the importance of software bill of materials (SBOM) tracking, package integrity verification, and dependency pinning