--- title: ThreatsDay Roundup Covers AI Search Poisoning and One-Click Code Execution - Capstone Technologies Group description: ThreatsDay covers 16 stories: AI search poisoning of ChatGPT and Gemini results, RemControl Android trojan, and a VS Code Workspace Trust one-click flaw. canonical_url: https://captechgroup.com/threat-intelligence-center/threatsday-roundup-covers-ai-search-poisoning-and-4b5765 language: en-GB date: 2026-09-25T12:36:26Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/threatsday-roundup-covers-ai-search-poisoning-and-4b5765. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 5863 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/threatsday-roundup-covers-ai-search-poisoning-and-4b5765. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. The latest ThreatsDay bulletin collects 16 stories that share one property: the attack arrives through something your staff already trusts. A plugin update. A Google sign-in box. An AI-generated answer to a routine support question. A coding assistant. A link in an email. Details in this article come from analysis published by [The Hacker News](https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html "Source: The Hacker News"). The range is wide. Group-IB documented **RemControl**, a previously undocumented Android banking trojan first seen in July 2026, distributed through fake Google Play pages impersonating the TVTap IPTV app and pushed via Meta ads. It abuses Android's Accessibility Service to overlay [phishing](https://attack.mitre.org/techniques/T1566/ "MITRE ATT&CK: T1566") screens on legitimate banking apps, stream the device screen live, and log keystrokes, with campaign naming, Telegram dead-drop use, and affiliate tags suggesting a possible link to the **Medusa UNKN affiliate botnet**. On the AI side, Z.ai disabled features of its ZCode coding assistant after a default setting sent local code repositories to Alibaba Cloud servers in China without consent, following a similar finding against SpaceXAI's Grok Build. Separately, Vigilance Security's Ariel Simon described a campaign flooding the web with optimized posts, PDFs, and fake support pages so that ChatGPT, Gemini, and Google AI Overviews return fraudulent phone numbers and login pages for companies including Delta, Chase, Bank of America, and Airbnb. Then there is the one-click problem. Remedio detailed a Visual Studio Code issue that defeats Workspace Trust, the feature meant to decide whose code runs, giving an attacker execution on your developer's machine with access to files, SSH keys, cloud tokens, and source code every time the editor reopens. Individually these items look unrelated. Together they show where attacker effort is moving: toward default settings, update channels, and AI output that people accept without checking. What follows covers the mechanics of each item, then the exposure they create for your business, and finally the specific actions worth taking. ## AI Search Poisoning and How Attackers Manipulate Assistant Results The AI search poisoning campaign documented by Vigilance Security's Ariel Simon works on the retrieval layer, not the model. Attackers publish large volumes of optimized posts, PDFs, reviews, and fake support pages so that when an assistant answers a routine question, it pulls attacker-controlled content and presents it as a clean answer. The content is planted across surfaces that rank well and accept uploads from anyone: - Hosting platforms including Google Sites, GitHub Pages, WordPress, and Blogger - Fundraiser, job search, and event platforms such as Posh.vip, onecause.com, bebee.com, and raiselysite.com - Reviews on Yelp and Apple Maps - Social media and any site that allows file uploads What gets surfaced is fraudulent phone numbers, email addresses, and login pages for Delta, Lufthansa, Qatar Airways, Chase, Bank of America, Airbnb, TripAdvisor, and hundreds of other major brands. The assistant strips the URL context a user would normally evaluate, so a fake airline support line reads as an authoritative answer inside ChatGPT, Gemini, or a Google AI Overview. For a company, that means an employee calling a "Chase fraud line" is handing account details to an operator who never had to send a phishing email. The same trust shortcut applies when the assistant reads instead of answers. Z.ai's ZCode shipped with a default workflow that generated and uploaded snapshots of users' local code repositories to Alibaba Cloud servers in China without consent, and SpaceXAI's Grok Build CLI was found uploading entire Git repositories to a Google Cloud Storage bucket under its own control a couple of months earlier. A repository snapshot typically carries environment files, API keys, internal hostnames, and deployment logic, so the exposure is not limited to source code. Russia's MAX super-app shows the same pattern one layer down. Researchers from the University of Michigan, University of Calgary, Georgia Tech, and IIT Delhi found MAX injects JavaScript into running mini-apps for silent runtime modification, holds read and write access to all mini-app local storage, and controls the authentication tokens handed to each mini-app, which lets it impersonate any user to any service in the ecosystem. When the host application mediates traffic and issues session context, the security guarantees of the app running inside it stop being independently verifiable. One-click execution closes the loop. Remedio detailed a Visual Studio Code flaw that defeats Workspace Trust, the feature that decides whose code is allowed to run, by making that decision for the user without prompting. There is no exploit chain, no memory corruption, and no zero-day dropper involved, just a normal-looking link (MITRE T1204.001, User Execution via malicious link). Code then runs as the signed-in developer with access to files, SSH keys, cloud tokens, and source, and it re-executes every time the editor reopens. Process Parameter Poisoning attacks the recording of that activity. Detailed in July 2026 by Max Hirschberger and Ogulcan Ugur and now published as a Rust proof-of-concept by Flashpoint, it combines process parameter spoofing with thread execution hijacking, hiding the payload inside standard process initialization structures at creation time rather than calling memory-writing APIs into a live target (MITRE T1055, Process Injection, alongside T1036, Masquerading). Because API-hooking [EDR](https://captechgroup.com/services/cybersecurity-services "Cybersecurity Services | Protect Your Business with Capstone Technologies") agents watch for the allocate-and-write pattern, the initial stages of execution produce no hook to fire on, and the command line your logging tools record may not match what actually ran. Your investigation timeline then starts after the interesting part is over. AI search poisoning: retrieval-layer attack chain 1 Attackers publish optimized posts, PDFs, reviews, and fake support pages on hosting platforms that accept uploads from anyone.Google Sites, GitHub Pages, WordPress, Blogger 2 The same content is mirrored onto fundraiser, job, and event platforms plus review listings so it ranks for routine queries.Posh.vip, onecause.com, bebee.com, Yelp, Apple Maps 3 When a user asks a routine support question, the retrieval layer pulls the attacker-controlled page into the answer.ChatGPT, Gemini, Google AI Overview 4 The answer presents fraudulent phone numbers, email addresses, and login pages without the source domain a user would normally evaluate.High 5 An employee calling what reads as a bank or airline support line hands account details to the attacker, with no phishing email sent.Delta, Lufthansa, Chase, Airbnb, TripAdvisor ## Medusa Ransomware, Botnet Activity, and the RemControl and TVTap Threads ### The Medusa UNKN affiliate link Group-IB stopped short of firm attribution on RemControl, but the overlaps it lists are specific: matching campaign naming conventions, shared delivery mechanisms, the same Telegram dead-drop technique, and similar affiliate tags. Those affiliate tags matter because they are how botnet operators split revenue among the crews renting access. The Medusa UNKN botnet runs on that affiliate structure, meaning the people writing the malware and the people distributing it are usually different groups. Victim selection then follows whoever buys in rather than any central targeting plan, which is why one codebase shows up against retail banking customers in Italy, France, Spain, Poland, and Portugal alongside targets in the Middle East and Canada. ### Global Group and the broker-fed extortion model Cofense tracked payment plan themed phishing emails that start a multi stage chain ending in **Global Group ransomware**. Global Group is a rebrand of the older Black Lock and Mamona families, inheriting their backend infrastructure and reusing core code artifacts, which let the operators launch an extortion business that was scalable on day one. Their affiliates buy pre-compromised corporate credentials from Initial Access Brokers instead of breaking in themselves, so the intrusion often begins with a valid login and no perimeter event to investigate. Global Group runs double extortion with public leak threats used as negotiation pressure, which means encryption downtime and data disclosure become two separate costs in the same incident. ### Exvicy, distribution sold as a subscription Sekoia documented **Exvicy**, a ClickFix distribution framework advertised on Exploit.in by a Russian speaking actor since May 26, 2026. It opened at $1,200 per month and rose to $2,000 in mid-August, with the operator telling buyers that "detections are becoming daily." Exvicy is a direct copy of ErrTraffic, reusing the injected JavaScript, the ClickFix HTML, and the C2 communication logic. **Key Insight:** The delivery path is compromised WordPress sites serving a fake Cloudflare CAPTCHA that instructs the visitor to paste a command into the Windows Run dialog, so the malware arrives through user action rather than an exploit. ### RemControl's control layer and dead-drop C2 RemControl resolves its command server dynamically through an encrypted Telegram dead-drop. The operator can rotate infrastructure by updating the dead-drop rather than recompiling and redistributing the APK, so blocking a single C2 address buys very little time. On the device, the operator gets real time screen streaming and full remote control, which produces bank sessions that originate from the customer's own handset with the customer's own device fingerprint. For a bank, that removes most of the signals fraud teams normally rely on to separate a legitimate session from a fraudulent one. ### TVTap impersonation and the artifacts left behind The campaign's overlay HTML files contain Russian language code comments, pointing to at least one Russian speaking developer. The same files carry signs of AI assisted development, including a complete AI assistant response left verbatim inside a phishing page that was being served to live banking victims. That sloppiness is a usable identifier. Phishing overlays with stray assistant text, duplicated boilerplate, and inconsistent bank branding are cheap to mass produce, and the operators clearly shipped them without review. ## Where These Threats Intersect With Business Operations Two AI coding assistants have now been caught sending private source code off developer machines by default. Z.ai disabled several ZCode features after a default setting pushed local repositories to Alibaba Cloud servers in China without user consent, a couple of months after SpaceXAI's Grok Build coding CLI was found uploading entire Git repositories to a Google Cloud Storage bucket under its own control. If either tool landed on a work laptop in your organization, your proprietary code left the building without a change ticket, an approval, or a log entry you own. Test fixtures and config files routinely carry API keys, database strings, and sample customer records, so the exposure is rarely limited to the code itself. That is the governance gap in practice. Most acceptable-use policies were written before AI coding assistants and agentic browsing existed, so nothing in them says which repositories may be opened in an assistant, or whether a browser agent may act inside an authenticated session. The decision currently sits with whichever engineer installed the tool. The same gap extends to what your developers accept as a dependency. SafeDep found a malicious source dependency added to **Deep-Live-Cam**, a Python project with 96,600 GitHub stars, carrying a loader for a cryptocurrency clipboard hijacker that rewrites wallet addresses and registers itself to run at login. A separate npm package, `ulid-xyz`, typosquats the legitimate `ulidx` and uses a `postinstall` hook to launch a bundled cross-platform trojan that persists on Windows, macOS, and Linux under the name **MicrosoftSystem64**, an implant previously linked to North Korea. Every unvetted import your build pipeline resolves by name is a vendor relationship nobody in procurement reviewed. When an assistant suggests the package and the pipeline installs it, that relationship is established in seconds. Endpoint telemetry is the other assumption worth revisiting. **Process Parameter Poisoning**, now available as a Rust proof-of-concept from Flashpoint, hides a payload inside standard process initialization structures at creation time instead of calling the memory-writing APIs that EDR agents hook. Flashpoint describes the result as blinding traditional API-hooking EDR during the initial stages of code execution. For you, that changes what your incident records are worth. Consider what happens when your responders cannot confirm what ran: - Dwell time extends because the earliest execution stage produced no alert to anchor a timeline - Forensic reconstruction shifts to memory captures, network logs, and file artifacts, which takes longer and costs more in outside IR hours - Cyber insurance claims and regulatory notification both depend on stating what data was accessed and when, and gaps push you toward the broader assumption Broad assumptions mean wider notification scope, more legal review, and more customer communication than the incident may have actually warranted. Extortion exposure follows a similar pattern. Cofense describes **Global Group** ransomware, a rebrand of the Black Lock and Mamona families, buying pre-compromised corporate credentials from initial access brokers and running double extortion with threats of public data leaks. Restoring from backups addresses your downtime, and it does nothing about the copy the operators already hold. Personal devices sit underneath all of this. Fake app store pages pushing trojanized consumer streaming apps land on employee-owned Android phones that also hold corporate mail, SSO sessions, and MFA push approvals. When the compromised phone is also your account recovery path, an attacker who controls it controls the route back into your tenant. The question worth putting to your engineering and IT leads is which repositories and which authenticated sessions are currently reachable from tools that were never approved. ## Detection and Hardening Steps for AI Tooling, Endpoints, and Mobile Start by inventorying every AI assistant and agentic coding tool in use across your developer and analyst machines, then answer one question for each: can it execute code or read a repository without a human approving the action? Anything that answers yes belongs in change control, not on a laptop by default. Turn off auto-execution and one-click run features in editors. The Visual Studio Code issue Remedio documented defeats Workspace Trust, the feature that decides whose code is allowed to run, by making that decision without prompting. One click on an ordinary-looking link gives an attacker execution as the logged-in user with access to files, SSH keys, cloud tokens, and source, and it re-triggers every time the editor reopens. Restrict URL protocol handlers that open workspaces, and require a human to review AI-generated or freshly cloned code before it reaches a build. If you run Admin Menu Editor Pro on any WordPress property, check for `includes/wp-user-consent.php`, the file that installed a web shell in the malicious 2.35 build, and confirm you are on the maintainer's 2.37 release. Roughly 230 customers installed the bad update across about 1,500 sites, so plugin update servers deserve the same scrutiny you give any other software source. For short-term detection work, assume command-line strings are not enough. Process Parameter Poisoning, detailed by Max Hirschberger and Ogulcan Ugur and now published as a Rust proof-of-concept by Flashpoint, hides the payload inside standard process initialization structures at creation time rather than calling the memory-write APIs that hooking agents watch. Your detections need process-creation correlation instead: - Parent-child process relationships, especially browsers, mail clients, and Office spawning interpreters or unsigned binaries - Image hashes and signing status on every newly created process, not just the command line - Thread creation and execution hijacking in processes that were just spawned - Persistence entries using system-sounding names, such as the MicrosoftSystem64 implant delivered through the `ulid-xyz` npm typosquat In environments Capstone manages, SentinelOne's behavioral detection covers the creation-time injection path that blinds API-hooking agents, which matters because this technique is designed to produce clean-looking telemetry during the first seconds of execution. Pair that with `npm install --ignore-scripts` in CI so postinstall hooks cannot launch detached background processes during a build. On mobile, update your MDM policy to block sideloading outright and alert whenever an app requests Android's Accessibility Service. Overlay-and-screen-stream trojans depend on that permission, and a policy that flags every new grant gives you a detection point that does not require knowing the malware family in advance. Also block installs originating outside the official store, since the delivery pages impersonate legitimate apps closely enough that users will accept them. Before any intrusion reaches encryption, confirm your backups restore from offline copies and that flat network segments between user subnets and file servers have been closed. Test the restore, do not assume it. Longer term, write an acceptable-use policy for AI tooling that names which assistants may touch source code and what telemetry they send by default. Add AI supply chain questions to vendor review, including where repository snapshots are stored and whether uploads are opt-out. Then run a tabletop exercise built on one premise: your endpoint telemetry is incomplete, and you must scope the incident from network, identity, and build-system evidence. Mitigation sequence across AI tooling, plugins, and detections 1 List every AI assistant and agentic coding tool on developer and analyst machines. Ask whether each can execute code or read a repository without human approval.Medium 2 Turn off one-click run features in editors. The Visual Studio Code issue documented by Remedio defeats Workspace Trust by deciding without prompting, and it re-triggers when the editor reopens.High 3 Limit URL protocol handlers that open workspaces, and require human review of AI-generated or freshly cloned code before it reaches a build.Medium 4 On WordPress properties, look for the file that installed a web shell in the malicious build and confirm the maintainer's fixed release is in place.includes/wp-user-consent.php 5 Process Parameter Poisoning hides the payload in process initialization structures at creation time, so detections need parent-child relationships, image hashes and signing status, thread creation, and persistence entries using system-sounding names. Behavioral detection covers this creation-time injection path.ulid-xyz ## Priorities to Set This Week The week's through-line is trust in two directions. Attackers are targeting the trust your users place in AI-generated answers and tooling, and the trust your defenders place in endpoint telemetry. Process Parameter Poisoning, now with a public Rust proof-of-concept from Flashpoint, hides a payload inside standard process initialization structures at creation time instead of calling the memory APIs that hooked EDR agents watch. If your detection strategy assumes agent visibility during process startup, that assumption has a published counterexample. The action worth setting above the others is establishing ownership and review over AI-assisted code execution paths. Decide who approves an assistant that can run commands, open a workspace, or read a repository, and record where those tools are installed. Without that, you have an execution channel inside developer workstations that nobody in your organization is accountable for. The rest of the list is conventional risk that your existing controls already cover if they are enforced rather than documented. Global Group ransomware, a rebrand of the Black Lock and Mamona families, buys pre-compromised corporate credentials from initial access brokers and runs double extortion with public leak threats. DarkMe returned on August 31, 2026 without any exploit at all, relying on users running a .pif file linked from an email. Impersonation fraud sits in the same category. The FBI's IC3 logged nearly 61,000 law enforcement and government impersonation complaints between January 2025 and July 2026, with losses above $1.6 billion, driven by payment methods your finance team can already flag. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-09-25T12:36:26Z", "datePublished": "2026-09-25T12:36:26Z", "description": "ThreatsDay covers 16 stories: AI search poisoning of ChatGPT and Gemini results, RemControl Android trojan, and a VS Code Workspace Trust one-click flaw.", "headline": "ThreatsDay Roundup Covers AI Search Poisoning and One-Click Code Execution", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/threatsday-roundup-covers-ai-search-poisoning-and-4b5765" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/threatsday-roundup-covers-ai-search-poisoning-and-4b5765" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```