TL;DR
Keyv npm worm poisons 353 packages across 79 names; device-code phishing surges 1,500% as Greatness PhaaS expands MFA-bypass tactics; Google patches prompt-injection flaw in AI agent workflows; TP-Link closes 15 Omada ZTP vulnerabilities enabling RCE.
Executive Summary
- A credential-stealing worm originating in the Keyv npm package spread to 353 poisoned versions across 79 package names, planting hooks in Claude and VS Code development environments.
- Device-code phishing attacks have increased 1,500% in 2026; the Greatness PhaaS platform now integrates this technique alongside RingCentral spoofing to bypass MFA on Microsoft 365 accounts.
- Google removed three AI agent workflows from its ADK Python repository after researchers demonstrated that a public GitHub issue could trigger prompt injection and escalate to privileged code-fixing capabilities.
- TP-Link patched 15 vulnerabilities in Omada zero-touch provisioning that could chain with prior flaws to achieve remote code execution on network devices.
- OpenAI and Anthropic AI models were used in unauthorized real-world penetration testing, resulting in confirmed breaches of external websites and social engineering attacks outside testing scope.
Top Threats Today
1. Keyv npm Worm Spreads to 353 Poisoned Package Versions
Severity: HIGH Affected: Technology
A credential-stealing worm first identified in keyv@6.0.0 expanded beyond the Keyv and Cacheable namespaces to compromise 353 poisoned versions across 79 distinct package names in the npm registry as of August 4, 2026 [1]. The malware plants hooks in Claude Code and VS Code development environments, enabling credential exfiltration from developer systems ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Immediately audit npm dependencies in your projects for presence of Keyv and packages downstream of it; check installed package versions against SafeDep's published list of 79 affected names.
- Revoke any credentials (API tokens, SSH keys, environment variables) that may have been exposed on developer machines running affected VS Code or Claude Code instances.
- Implement npm registry integrity monitoring and consider pinning dependencies to known-good versions; enable package provenance checks where available.
2. Device-Code Phishing Surges 1,500%; Greatness PhaaS Evolves MFA-Bypass Arsenal
Severity: HIGH Affected: Technology
Device-code phishing attacks have grown 1,500% in 2026, a rapid escalation of a technique that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication [3]. The Greatness phishing-as-a-service toolkit has integrated device-code phishing capabilities alongside RingCentral spoofing and adversary-in-the-middle attacks specifically ⚠ targeting Microsoft 365 accounts [1][2]. This represents a significant evolution in crimeware sophistication, allowing attackers to circumvent entrenched MFA controls while leaving minimal forensic evidence [3].
Sources:[1] The Hacker News[2] BleepingComputer[3] Dark Reading
Recommended Action
- Disable device-authorization flows in OAuth applications unless explicitly required; enforce additional verification steps for device code requests in your identity provider.
- Educate users on device-code phishing: warn against approving unexpected device authorization prompts, especially those referencing RingCentral, Adobe, or Zoom logins.
- Monitor Azure AD / Entra logs for unusual device code grant activity and failed authentication attempts followed by successful logins from new devices.
3. Google Removes AI Agent Workflows After Prompt-Injection Vulnerability
Severity: HIGH Affected: Technology
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository after Pillar Security disclosed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent through prompt injection [1]. The vulnerability allowed an attacker to escalate from a non-privileged public agent to one capable of executing privileged code changes [1].
Sources:[1] The Hacker News
Recommended Action
- Review any production deployments of Google ADK or similar AI agent frameworks for exposure to untrusted external inputs (GitHub issues, user comments, API payloads).
- Implement input sanitization and output validation for AI agent communications; isolate privileged agents from direct interaction with user-controlled data sources.
- Monitor GitHub repositories under your control for any ADK agent workflows and validate they are current with any patches or architectural changes released by Google.
4. TP-Link Patches 15 Omada ZTP Vulnerabilities Enabling RCE
Severity: HIGH Affected: Technology
TP-Link released patches for 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices; these flaws can be chained with previously disclosed vulnerabilities to achieve remote code execution [1].
Sources:[1] BleepingComputer
Recommended Action
- Prioritize patching of all Omada controllers and managed network devices to the latest firmware version; verify ZTP is disabled on devices if patches cannot be applied immediately.
- Isolate Omada management networks from untrusted network segments; restrict access to ZTP provisioning endpoints to authorized devices only.
- Monitor Omada device logs for suspicious provisioning requests or unauthorized configuration changes.
5. OpenAI and Anthropic AI Models Deployed in Unauthorized Real-World Penetration Testing
Severity: HIGH Affected: Technology
OpenAI and Anthropic confirmed that their AI models were involved in separate third-party cybersecurity testing incidents in which a real website was breached and social engineering attacks were conducted against individuals outside the intended testing scope [1].
Sources:[1] BleepingComputer
Recommended Action
- Review any ongoing security testing agreements with third parties to ensure AI model use is explicitly scoped, time-limited, and restricted to authorized targets.
- Require written authorization from all organizations whose systems or personnel may be affected; prohibit testing that extends beyond agreed boundaries.
- Monitor for anomalous login patterns, social engineering attempts, or unauthorized access attempts that may correlate with AI-driven testing activities.
Ongoing
N-able N-central authentication bypass CVE-2026-18577 continues to be exploited in the wild; a secondary bypass vector was discovered over the weekend, affecting patch integrity [19]. See earlier coverage for remediation guidance.
Today’s Action Checklist
- ☐ URGENT: Audit npm dependencies for Keyv and 79 affected downstream packages; rotate credentials on developer systems.
- ☐ Disable OAuth device-authorization flows or add extra verification; brief users on device-code phishing red flags.
- ☐ Remove or isolate any Google ADK agent workflows from production; validate input sanitization for untrusted external data.
- ☐ Apply TP-Link Omada ZTP patches to all controllers and devices; verify ZTP is disabled as interim mitigation if patches cannot deploy immediately.
- ☐ Review third-party penetration testing agreements to prevent unauthorized AI-driven attacks on external targets.