Daily Drop (1334)
07-13-26
Monday, July 13, 2026 // Buy Bob a Coffee // Ghostwire
GhostCommit Attack Hides Prompt Injection in Images to Steal Developer Secrets
Bottom Line Up Front (BLUF): Security researchers at the University of Missouri–Kansas City’s ASSET Research Group demonstrated GhostCommit, a proof-of-concept software supply-chain attack that places malicious instructions inside a PNG image referenced by an apparently legitimate AGENTS.md file. AI code-review systems may approve the pull request because they inspect only its textual changes, while a vision-capable coding agent later opens the image, follows its instructions, reads the repository’s .env file, and writes the secrets into source code as an innocuous-looking tuple of integers.
Analyst Comments: The most important point is that GhostCommit is not traditional image steganography. The malicious instructions are rendered as readable text inside the PNG; they remain “hidden” only because the tested review systems do not inspect image contents. CodeRabbit’s default configuration excluded PNG files, while Cursor Bugbot returned no findings even when the image explicitly referenced prompt injection and instructed the agent to read .env.
READ THE STORY: Anquanke
Internet Scanners Probe MCP Servers and AI Assistant Credentials
Bottom Line Up Front (BLUF): A SANS Internet Storm Center review of 14 days of Apache and ModSecurity logs found automated scanners probing for exposed Model Context Protocol servers, AI-assistant configuration files, stored Claude credentials, and unauthenticated local language-model APIs. The most significant activity involved valid JSON-RPC initialization requests sent to /mcp, indicating that some scanners are no longer merely guessing filenames but are attempting to identify servers that actually speak the MCP protocol. The findings provide credible evidence that AI infrastructure has entered routine internet reconnaissance, although the limited dataset—one small web host—does not establish the total scale, ownership, or intent of the scanning activity.
Analyst Comments: The SANS data reportedly included roughly 200 requests associated with MCP, LLM, and AI-assistant reconnaissance. MCP handshakes originated from 49 distinct source IP addresses, more than any other reconnaissance category in the observed dataset. That distribution supports the assessment that the requests were not generated by a single researcher repeatedly testing one server. It does not, however, prove that the addresses were controlled by one coordinated campaign; they could represent several independent scanners, compromised systems, commercial exposure-monitoring services, research projects, or shared scanning infrastructure.
READ THE STORY: SANS
Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT
Bottom Line Up Front (BLUF): Genians Security Center identified a targeted spear-phishing campaign, named Operation Capsule Vault, that used materials from a real South Korean academic conference to deliver the RokRAT remote-access Trojan. The June 22, 2026, campaign directed researchers, policy specialists, and academics to a Dropbox-hosted ISO image containing a PIF executable disguised as a PDF; once opened, the loader displayed the expected conference document while decrypting shellcode, injecting an x64 RokRAT variant into explorer.exe, and establishing command-and-control communications through legitimate cloud-storage services. Genians assesses that APT37 was highly likely responsible, based on malware similarities, reused cloud infrastructure, persistent Yandex account activity, and overlapping tactics with earlier RokRAT operations.
Analyst Comments: Operation Capsule Vault demonstrates that the campaign’s strongest component was not a novel exploit but a carefully constructed social-engineering chain. The attackers reused information from the legitimate “Why Wonsan-Kalma Tourism Now?” conference held at Seoul COEX on June 12, presenting the phishing message as an ordinary distribution of event materials. Victims were shown what appeared to be an attached PDF booklet, but clicking it redirected them to Dropbox and downloaded an ISO image named to resemble the legitimate conference materials.
READ THE STORY: GBhackers
ReferenceError: WebSocket Is Not Defined in Node.js
Bottom Line Up Front (BLUF): A July 13, 2026, troubleshooting article explains how to resolve ReferenceError: WebSocket is not defined in Node.js by upgrading Node, installing the ws package, or importing WebSocket from Undici. The central advice is sound, but the article oversimplifies Node.js version support and pads the solution with generic debugging material containing several technical errors.
Analyst Comments: The error means the runtime cannot locate a variable or global named WebSocket. In this context, it usually occurs because the application is running on an older Node.js version, browser-oriented code is being executed in Node, or a third-party WebSocket library was not imported. Node’s browser-compatible WebSocket client was introduced experimentally in Node 20.10.0 and 21.0.0, enabled by default in Node 22.0.0, and marked stable in Node 22.4.0. Therefore, the article’s claim that Node 21 and earlier always require ws or Undici is too broad.
READ THE STORY: IT Source Code
VEXAIoT AI Agents Autonomously Exploit IoT Vulnerabilities With 95% Success Rate
Bottom Line Up Front (BLUF): Researchers developed VEXAIoT, a two-agent framework that uses a large language model and established offensive-security tools to automate reconnaissance, vulnerability correlation, exploit selection, execution, validation, and retries against vulnerable IoT environments. The framework achieved a 95% overall success rate across 260 controlled attack trials—94.5% against OWASP IoTGoat and 96.7% against Metasploitable2—but the results demonstrate reliable automation against deliberately vulnerable test systems, not the ability to compromise arbitrary real-world IoT devices.
Analyst Comments: VEXAIoT divides the attack process between a vulnerability-detection agent and an attack-execution agent. The first uses Nmap to identify exposed ports, services, and protocols before using SearchSploit to associate detected software with known vulnerabilities and public exploits. That information is provided to GPT-5.1 Thinking, which creates an ordered attack plan. The second agent chooses tools or scripts, generates commands, executes them, and returns the results for validation or another attempt. The system logs its plans, commands, and outputs, allowing optional human intervention even though the workflow can run autonomously.
READ THE STORY: GBhackers
VeriChat AI Assistant Checks Hardware Designs for Hidden Trojans
Bottom Line Up Front (BLUF): University of Florida researchers developed VeriChat, a specialized conversational assistant that combines retrieval-augmented generation with electronic design automation tools to help engineers assess register-transfer-level hardware designs for security weaknesses. In a controlled demonstration, VeriChat analyzed an AES substitution-box design containing a researcher-planted hardware Trojan, identified seven suspicious flip-flops, triggered the implant through simulation, and formally proved that it could leak an encryption key through a status output. The results show that agentic AI can coordinate established hardware-verification tools, but they do not demonstrate reliable detection of unknown implants in fabricated chips or arbitrary third-party designs.
Analyst Comments: VeriChat is more accurately described as an AI-assisted pre-silicon verification interface than an autonomous chip-backdoor detector. It analyzes uploaded RTL source code, such as Verilog, rather than inspecting finished physical processors. The system connects a conversational interface to Icarus Verilog for syntax checking and simulation, Yosys for synthesis and structural analysis, and SymbiYosys with the Z3 solver for formal verification.
READ THE STORY: HNS
Items of interest
From Prompt Engineering to Intent Engineering: AI Workflows Shift From Instructions to Outcomes
Bottom Line Up Front (BLUF): Daniel Miessler argues that users should stop prescribing step-by-step methods to advanced AI systems and instead define the outcome they want. He calls this shift “Intent Engineering”—a prompting approach that gives capable models room to determine the best way to complete a task rather than constraining them with increasingly outdated human workflows.
Analyst Comments: The argument tracks with Sutton’s Bitter Lesson: as general-purpose AI systems improve, handcrafted rules and elaborate prompting frameworks are likely to become less useful—and may actively degrade performance. Detailed instructions still matter when a task has hard constraints, compliance requirements, or a specific operating procedure. But for open-ended analysis, research, coding, and content generation, excessive scaffolding can narrow the model’s reasoning and lock it into a weaker approach. Organizations should review existing prompt libraries and separate genuine requirements from legacy instructions that merely describe how a human would perform the task.
READ THE STORY: Dan Miessler
Prompt Engineering Full Course (Video)
FROM THE MEDIA: Tech with Tim explains what it is, why it's important, how to do it faster. The top techniques and methods and advanced strategies to get the most out of loops.
You SUCK at Prompting AI (Here's the secret) (Video)
FROM THE MEDIA: You’re probably using AI wrong. Don’t worry, it’s not your fault. Most people suck at prompting, but today I’m showing you real prompting techniques I learned from top Coursera prompting courses, official docs from Anthropic/Google/OpenAI, and advice from some of the best prompt engineers in the world.
The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don’t hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.