ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories  Ravie Lakshmanan  Aug 13, 2026 Hacking News / Cybersecurity News Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods. The latest ThreatsDay Bulletin puts all of these short updates in one place, so you can quickly catch up on what happened, what changed, and what security teams should know. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. Guest Access Data Theft New City-Forum Campaign Targets Salesforce and ServiceNow Instances An ongoing campaign dubbed City-Forum has been observed targeting unauthenticated guest user access in both Salesforce Experience Cloud sites and ServiceNow (SNOW) Service Portals. "A single server is pulling records out of Salesforce Experience Cloud sites and ServiceNow (SNOW) Service Portals, from infrastructure that has been standing since March 2025," Reco said. "Except for Aura , the attacker reaches Salesforce Lightning Web Runtime ( LWR ) sites through the UI-API, a data layer we have not seen any public tool or write-up about, and it hammers a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open source tools." The IP address in question is 158.220.87[.]79, which resolves to the domain "city-forum[.]com," giving the campaign its name. The use of little known techniques in the activity points to an advanced threat actor. Data is exfiltrated from Salesforce LWR sites using GraphQL. Targets include telecoms, banks and financial-services firms, enterprise-software vendors including security and data-privacy companies, and public-sector portals. Per Reco, the busiest target recorded more than 560,000 events from the attacker's IP address, with nearly all of them related to guest Aura enumeration. Customer Data Exposed ShipMonk Suffers Data Breach ShipMonk, one of Trezor's shipping providers, has experienced a data breach that exposed sensitive customer order data, including full names, shipping addresses, phone numbers, and email addresses. "This data breach can potentially affect new customers who received an order from the following countries: the U.S., the U.K., Sweden, Colombia, Brazil, Italy, and Portugal between 10th of May and 8th of August 2026," Trezor said . Pre-Trust Code Execution Cursor CLI Runs Untrusted Repository Code Cursor has fixed an issue in its command-line (CLI) coding agent that allowed a cloned repository to run any command on a developer's machine before they were prompted if they trusted it, and outside the sandbox even when the sandbox had been explicitly enabled. "A repository could execute any command it chose on your machine, as you, the moment you started Cursor's CLI agent in it with -w," Manifold Security said . "It ran before the workspace-trust dialog, and fired even for users who had explicitly passed --sandbox enabled. The command sat in a normal tracked file, .cursor/worktrees.json, so it arrived with an ordinary git clone. Nothing on that path constrained it: reading ~/.ssh, taking cloud credentials from the environment, opening a reverse shell, writing persistence." Following responsible disclosure on July 20, 2026, a patch was released three days later. Vishing at Scale Inside Look at Worker Panel Okta has published details about Work Panel, an operator console that's used by threat actors running vishing campaigns targeting identity providers, including itself. "Work Panel is a multi-tenant platform that packages everything an operator needs to run a vishing-driven account takeover operation," the company said . "Registering a new phishing domain, cloning a target brand, and standing up a new isolated phishing site are each one-button operations. New campaigns can be launched in minutes." Work Panel is used by infrastructure owners, campaign managers, and outsourced callers, indicating a cybercrime ecosystem that supports such voice phishing campaigns at scale. One threat actor that uses Work Panel is UNC6671 (aka Cordial Spider and O-UNC-045). "It is a full web application designed to run a vishing-driven account takeover business," Okta added. "The console organizes the work into multiple sections covering target recon, voice-call routing, brand cloning, infrastructure provisioning, live session management, captured-credential review, and an audit log. Different roles see different tabs, and the access boundary is enforced on the server rather than hidden in the client." AI Agent Hijacking GhostJacking Uses Poisoned Logs to Turn AI Agents Bad A new attack called GhostJacking expands on Agentjacking to trick AI agents into running arbitrary code on developer machines, once again highlighting the need for securing the AI supply chain. The attack can leverage something as simple as a poisoned log or alert to make the agent act on the attacker's data, escalate privileges and pivot to enterprise cloud infrastructure, exfiltrate data to the attacker (in this case, using a now-patched sandbox escape in Anthropic's Claude Desktop), and establish persistence by leaving a backdoor in the agent's configuration. "Companies are handing AI agents the keys to their code, their monitoring, and their infrastructure," Tenet Security said . "An AI cannot tell a real instruction from a trap hidden in the data it reads. The usual defenses do not fire, because nothing breaks a rule. Every step is something the agent was already allowed to do." The findings underscore the need for guardrails around AI agents to protect against hijacking attacks that leverage their legitimate access and elevated privileges against their users. On-Device Scam Detection Meta Builds Scam Alert Feature Into WhatsApp Meta has announced a new optional feature called Scam Alert that makes use of an on-device machine learning model to alert a user about potential scam messages. "No message content leaves the device for classification or is auto-reported to WhatsApp, Meta, or anyone else," the company said . "The feature complements end-to-end encryption while enabling a user-controlled, optional scam alert when the model believes there's a likely scam." The model, Meta added, is trained on patterns observed in scam conversations from reports that users have sent to it. Meta said it has also built a privacy-preserving federated analytics pipeline that collects only two categories of data: counts of how often warnings were triggered and counts of what action users took afterward, such as blocking or marking a chat as trusted. Automatic Key Checks Signal Debuts Automatic Key Verification Messaging app Signal has announced a new automatic key verification feature that complements the existing safety number system to provide an "additional, streamlined way to confirm that there's no unexpected party between you and the other 'end' of an end-to-end encrypted session." Signal said : "It works through a system of verifications performed by you, your Signal connections, and third-party auditors that together provide the same assurance as manually verifying safety numbers. Unlike safety numbers, these verifications are done independently and do not require an in-person meeting or a secondary communication channel. This system of verifications ensures that the association between a phone number or username and its public encryption key is globally consistent and transparent to all participants in Signal's ecosystem." Users can enable automatic key verification in Signal by going to Settings > Privacy > Advanced and enabling the setting. Prompt Injection as Defense Embracing Prompt Injections for Defense A new approach devised by Tracebit has proven very effective at stopping AI agents from fully compromising targeted environments. While prompt injections have proven to be a thorny problem ailing AI systems, the technique, called Context Bombs, uses prompt injections not to hijack AI agents to defend against them. Using decoy resources as tripwires that alert defenders about potential unauthorized activity is not wholly novel. These are known as canaries , which are hidden inside real files or networks that trigger an alert the moment it is accessed. Only in this case, it is used to stop the AI agent from performing something malicious. "A context bomb is simply a string crafted to provoke that refusal for benign reasons rather than malicious ones," Tracebit said . "The defender plants it, and when the model or model provider encounters it, safety mechanisms are triggered which stops the agent from proceeding." The findings are significant in light of the fact that autonomous and semi-autonomous AI agents accelerate the pace and scale of attacks, while defenders have little time to react and counter them. Fake Cleaner, Real Spyware Fake CCleaner installs GhostDesk Chrome spyware A fake version of CCleaner delivered via a bogus lookalike page ("ccleanerwind[.]top") is being used to infect Windows users with a malicious Chrome extension called GhostDesk, which harvests sensitive data from the browser. "Once installed, the fake application launches an attack that modifies Chrome, installs malicious extension components, and gives attackers the ability to steal credentials, capture screenshots, and log keystrokes," Malwarebytes said . There is evidence to suggest that the same mechanism is being used to serve counterfeit versions of 7-Zip and Adobe Acrobat Reader. $150K PCC Bug Bounty Apple Pays $150K Bounty for PCC Flaw Apple has paid a $150,000 bug bounty to a security researcher who found a way to leak sensitive data from Private Cloud Compute ( PCC ), its secure AI inference environment. The vulnerability, rooted in a component called "darwin-init" and tracked as CVE-2026-20685 (CVSS score: 6.5), allows an attacker in