AI agents targeted via router flaws that enable code injection and data theft
Since routers sit between users and AI systems, they can see all unencrypted data like API keys and user prompts.
The attack involves an Open VSX extension disguised as the popular time-tracking tool WakaTime.
Since routers sit between users and AI systems, they can see all unencrypted data like API keys and user prompts.
The flaw, tracked as CVE-2026-34621, could allow attackers to execute malicious code on affected systems.
Attackers gained access to a secondary API linked to CPUIDu2019s website and redirected users to trojanized versions of software disguised as legitimate tools.
In brief: Fortinet fixes a zero-day flaw, authorities disrupt the FrostArmada botnet operated by Russian APT28, and more.
In some cases, the attackers had directly contacted internal IT support and helpdesk staff to manipulate them into granting system access.
Masjesu is capable of infecting a wide range of system architectures, including i386, ARM, MIPS, and AMD64.