{"data":{"id":"c68dce8c-2a1b-43e5-80aa-767472311f14","title":"ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories","summary":"This weekly threat bulletin covers 15+ cybersecurity incidents, including malicious npm packages that steal credentials when installed, a fake VS Code extension that impersonates a legitimate tool to open a backdoor (remote access channel where attackers can send commands), and an AI image that can inject hidden orders into an AI agent. Most threats disguised themselves as useful software or blended into normal activity, making them easy to overlook.","solution":"GitHub: 'update your GHES instance to the latest patch release available for your current version line' with minimum required versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18. PyPI: implemented a new security change rejecting new file uploads to releases older than 14 days to prevent poisoning of stable releases. N/A -- no mitigations discussed for the npm stealer, fake VS Code extension, or AI image prompt injection incidents.","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html","publishedAt":"2026-07-23T15:02:07.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection"],"issueType":"news","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["GitHub Copilot"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-23T15:02:07.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.65,"researchCategory":null,"atlasIds":null}}