报告编号：TIC-202609-AI03
报告周期：2026年9月12日—9月18日
一、报告概述
基于360威胁情报中心对本期公开网络安全素材的整理与分析，本周AI安全风险主要集中在AI知识库与推理服务漏洞、Agent Skill和软件包供应链攻击、AI编程助手会话劫持、非官方AI中转服务数据泄露、AI驱动的移动端威胁以及ChatGPT品牌钓鱼等方向。相关事件涉及远程代码执行、凭据与源代码窃取、恶意包投递、敏感对话留存和账户凭证盗取。
报告重点内容涵盖：
· AI应用与Agent生态安全：QAnything未授权文件写入漏洞可导致Root RCE，vLLM聊天模板漏洞可造成资源耗尽，Skill链路还面临路径逃逸、供应链投毒和代码后门风险。
· AI开发与软件供应链风险：攻击者劫持AI编程助手会话传播Shai-Hulud蠕虫，GemStuffer活动则利用大量恶意RubyGems包执行代码、窃取凭据和外传数据。
· AI数据与用户侧威胁：非官方AI中转站截获并出售明文数据，RatHat针对移动端银行凭证，攻击者还利用ChatGPT订阅付款提醒实施钓鱼。
───────────────────────────────────
二、本周重点安全事件
（一）QAnything任意文件写入可导致Root RCE
事件名称：无需认证！本地知识库QAnything任意文件写入漏洞可提权至Root RCE（CVE-2026-88533）
发布日期：2026-09-18
发布机构：360漏洞研究院
威胁概述：
360漏洞研究院披露，QAnything存在未授权任意文件创建漏洞CVE-2026-88533。未经身份认证的攻击者可访问文件上传接口，通过特制文件名实施路径遍历，将文件写入非预期目录。在官方Docker部署场景中，攻击者可在服务重启后执行代码并获得root权限。
IOC指标：
· CVE：CVE-2026-88533
STIX详情：
{
"type": "bundle",
"id": "bundle--1e1eb052-5326-43c0-bd42-b62d47625c1f",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--f84e7e80-cef4-4132-99be-9348e2278e03",
"name": "Unauthenticated Remote Attacker",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "攻击链主体；未经身份认证、无需登录即可远程访问目标服务的攻击者。",
"x_evidence": "原文称“未经身份认证的远程攻击者可通过网络访问目标服务并利用该缺陷”，且攻击链主体为未经身份认证的远程攻击者。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--fed225a9-6eea-414d-b92d-50dcb71365b6",
"name": "QAnything",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "存在未授权任意文件创建漏洞的本地知识库软件；受影响版本：v1.4.x ≤ 受影响版本 ≤ v2.0.0。",
"x_evidence": "原文称“QAnything 被披露存在未授权任意文件创建漏洞（CVE-2026-88533）”，并列出“影响范围: QAnything v1.4.x ≤ 受影响版本 ≤ v2.0.0”。",
"x_confidence": 0.98
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--1ebde131-8ed9-4bfc-b6c5-48a38f4bb60d",
"name": "CVE-2026-88533",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "QAnything 未授权任意文件创建漏洞；CVSS 3.1 评分 9.8；可导致未经认证 root 权限代码执行。",
"x_evidence": "原文明确标注“漏洞编号 CVE-2026-88533”及“CVSS 3.1 9.8”，并说明可导致未授权 root 权限代码执行。",
"x_confidence": 0.99
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--870f706f-4d58-45e6-be77-b1bfed48cf4f",
"name": "Path Traversal",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "漏洞类型，导致任意文件创建；对文件名解码和基础处理后未充分约束路径分隔符、上级目录引用及绝对路径。",
"x_evidence": "原文称“漏洞类型 路径遍历”，并指出“未对路径分隔符、上级目录引用及绝对路径进行充分约束”。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--55d0c9c3-4429-468c-a234-222dddbde19d",
"name": "Docker",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "官方部署场景使用的容器技术；官方 Docker 部署中后端进程默认以 root 权限运行。",
"x_evidence": "原文称“官方 Docker 部署场景中，后端进程以 root 权限运行”。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--823cc120-0442-49f8-ae24-baac0f188764",
"name": "Python",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "攻击者结合其启动加载机制，在后端服务重启后触发代码执行。",
"x_evidence": "原文称“攻击者可进一步结合 Python 启动加载机制，在后端重新启动后触发 root 权限代码执行”。",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--c41da074-97aa-458e-8bd2-7e53c4698df6",
"name": "QAnything Port 8777",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "目标服务默认端口 8777；在可被攻击者网络访问时成为初始访问入口。",
"x_evidence": "原文临时修复方案提及“QAnything 默认 8777 端口”，并指出应限制该端口避免服务直接暴露。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--04f27030-9331-4725-a84f-aeae1715371f",
"relationship_type": "targets",
"source_ref": "intrusion-set--f84e7e80-cef4-4132-99be-9348e2278e03",
"target_ref": "tool--fed225a9-6eea-414d-b92d-50dcb71365b6",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "未经身份认证的远程攻击者通过网络访问并针对目标 QAnything 服务。",
"x_evidence": "原文称“未经身份认证的远程攻击者可通过网络访问目标服务”及“目标 QAnything 服务”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ff6a9c7c-54f9-4ff8-9d47-bcde06fef595",
"relationship_type": "uses",
"source_ref": "intrusion-set--f84e7e80-cef4-4132-99be-9348e2278e03",
"target_ref": "attack-pattern--870f706f-4d58-45e6-be77-b1bfed48cf4f",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "攻击者使用路径遍历技术，通过特制文件名利用漏洞。",
"x_evidence": "原文称“攻击者在无需身份认证的情况下，可通过公开的知识库及文件上传接口提交特制文件名”，漏洞类型为路径遍历。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--10c73b77-f229-460a-9b91-8304870b1cef",
"relationship_type": "exploits",
"source_ref": "intrusion-set--f84e7e80-cef4-4132-99be-9348e2278e03",
"target_ref": "vulnerability--1ebde131-8ed9-4bfc-b6c5-48a38f4bb60d",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "攻击者利用 CVE-2026-88533 实现任意文件创建。",
"x_evidence": "原文称“未经身份认证的远程攻击者可通过网络访问目标服务并利用该缺陷”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--99f3daed-128a-4963-ad12-3cb0deb31fb3",
"relationship_type": "exploits",
"source_ref": "attack-pattern--870f706f-4d58-45e6-be77-b1bfed48cf4f",
"target_ref": "vulnerability--1ebde131-8ed9-4bfc-b6c5-48a38f4bb60d",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "路径遍历攻击技术利用 CVE-2026-88533 实现任意文件创建。",
"x_evidence": "原文将漏洞类型标注为“路径遍历”，并关联“CVE-2026-88533 QAnything 未授权任意文件创建漏洞”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--95844be3-9698-4ae7-bb94-7a300f1b7276",
"relationship_type": "targets",
"source_ref": "vulnerability--1ebde131-8ed9-4bfc-b6c5-48a38f4bb60d",
"target_ref": "tool--fed225a9-6eea-414d-b92d-50dcb71365b6",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "CVE-2026-88533 影响 QAnything 本地知识库软件。",
"x_evidence": "原文称“QAnything 被披露存在未授权任意文件创建漏洞（CVE-2026-88533）”。",
"x_confidence": 0.99
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7a1fbe31-ffd2-4d4e-9326-016a0e59cd92",
"relationship_type": "uses",
"source_ref": "tool--fed225a9-6eea-414d-b92d-50dcb71365b6",
"target_ref": "tool--55d0c9c3-4429-468c-a234-222dddbde19d",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "QAnything 官方部署场景使用 Docker 容器技术，且后端进程默认以 root 权限运行。",
"x_evidence": "原文称“官方 Docker 部署场景中，后端进程以 root 权限运行”。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9066bc99-8dab-4dbd-8804-9879821797ae",
"relationship_type": "uses",
"source_ref": "tool--fed225a9-6eea-414d-b92d-50dcb71365b6",
"target_ref": "infrastructure--c41da074-97aa-458e-8bd2-7e53c4698df6",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "QAnything 服务默认监听 8777 端口。",
"x_evidence": "原文临时修复方案提及“限制 QAnything 默认 8777 端口”。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--75fc1d24-a82b-4185-8f31-6d93a9335962",
"relationship_type": "uses",
"source_ref": "intrusion-set--f84e7e80-cef4-4132-99be-9348e2278e03",
"target_ref": "tool--823cc120-0442-49f8-ae24-baac0f188764",
"created": "2026-09-18T07:28:02Z",
"modified": "2026-09-18T07:28:02Z",
"description": "攻击者结合 Python 启动加载机制触发 root 权限代码执行。",
"x_evidence": "原文称“攻击者可进一步结合 Python 启动加载机制，在后端重新启动后触发 root 权限代码执行”。",
"x_confidence": 0.9
}
]
}报告链接：
http://mp.weixin.qq.com/s?__biz=Mzk0ODM3NTU5MA==&mid=2247498233&idx=1&sn=acfdc7da7db0478027ecdac29152cfe2
───────────────────────────────────
（二）AI编程助手会话被劫持传播Shai-Hulud蠕虫
事件名称：攻击者劫持AI编程助手会话，在近100个仓库中传播Shai-Hulud蠕虫
发布日期：2026-09-17
发布机构：代码卫士
威胁概述：
代码卫士披露，攻击者劫持某SaaS提供商的AI编程助手会话，使投毒软件被AI助手推荐并被采纳。攻击者随后通过投毒PyPI包安装窃密程序，获取GitHub OAuth令牌，并将Shai-Hulud蠕虫传播至近100个内部代码仓库，窃取源代码等机密信息。
IOC指标：
· 暂无公开IOC
STIX详情：
{
"type": "bundle",
"id": "bundle--ccb16a1c-8382-4197-83ab-0e0e9bc5bc44",
"spec_version": "2.1",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"name": "未具名攻击者",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "对未具名SaaS提供商实施供应链攻击、劫持AI会话并部署蠕虫的攻击者",
"x_evidence": "原文称“攻击者劫持AI编程助手会话，在近100个仓库中传播Shai-Hulud蠕虫”",
"x_confidence": 0.95
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--cff8ac61-93eb-4405-92f3-ea1ba3c033d6",
"name": "未具名SaaS提供商",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "被攻击的软件即服务提供商，约100个内部仓库受影响并泄露源代码",
"x_evidence": "原文称“一家未具名软件即服务提供商”",
"x_confidence": 0.95
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--8c84f889-3137-4a73-800b-a16fd5bba901",
"name": "Mandiant",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "发布该案例报告的安全公司",
"x_evidence": "原文称“Mandiant公司表示”",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--e79bbb7e-9b9f-42b9-a248-37247a42bbcc",
"name": "Shai-Hulud",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "可自我传播的蠕虫，在近100个内部代码仓库中传播并窃取仓库机密及源代码",
"x_evidence": "原文称“将Shai-Hulud蠕虫传播到约100个内部代码仓库”",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--2bbf77a4-da81-43d4-b07e-44df90137eb6",
"name": "PyPI",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "被投毒包所利用/托管的公共包管理仓库",
"x_evidence": "原文称“通过一个被投毒的PyPI包”",
"x_confidence": 0.85
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--2e9f7f11-3e8a-485f-ac48-856b9a211862",
"name": "被投毒的PyPI包",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "具体包名未提供，被用于安装信息窃取程序",
"x_evidence": "原文称“通过一个被投毒的PyPI包安装了信息窃取程序”",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--6cd01f61-b8d0-453c-8da7-f721496b8689",
"name": "被劫持的AI编程助手会话",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "被攻击者劫持的SaaS提供商开发人员正在运行的AI编程助手会话",
"x_evidence": "原文称“一个正在运行的AI编程助手会话遭劫持”",
"x_confidence": 0.9
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--4b237e46-bbf2-4027-bd6b-af2a5cb69d98",
"name": "信息窃取程序",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "由被投毒PyPI包安装，窃取GitHub OAuth令牌",
"x_evidence": "原文称“通过一个被投毒的PyPI包安装了信息窃取程序”",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--e570cd20-ca72-4b50-88ea-5b5f00741cce",
"name": "GitHub OAuth令牌",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "被攻击者窃取的GitHub OAuth认证令牌，作为GitHub账户凭据",
"x_evidence": "原文称“攻击者还窃取了GitHub OAuth令牌”",
"x_confidence": 0.7
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--da31f05d-3ed1-4430-b914-bacce007f934",
"name": "该公司官方命名空间中被投毒的包",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "攻击者在受害者官方命名空间投毒、导致第二感染的恶意包",
"x_evidence": "原文称“攻击者还在该公司官方命名空间中投毒了一个包”",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--cb68971e-ba5f-47b7-884b-4623c2202953",
"name": "约100个内部代码仓库",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "Shai-Hulud蠕虫传播并窃取数据所在的内部代码仓库",
"x_evidence": "原文称“约100个内部代码仓库”",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3f63b235-a5bf-4d24-ad16-9272a058de4c",
"relationship_type": "targets",
"source_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"target_ref": "identity--cff8ac61-93eb-4405-92f3-ea1ba3c033d6",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "未具名攻击者以未具名SaaS提供商为攻击目标",
"x_evidence": "原文称“一家未具名软件即服务提供商...遭劫持”",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--070d1922-5fb3-45ba-ae75-e7ad5fd7ef8c",
"relationship_type": "uses",
"source_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"target_ref": "infrastructure--6cd01f61-b8d0-453c-8da7-f721496b8689",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "攻击者劫持并利用AI编程助手会话",
"x_evidence": "原文称“一个正在运行的AI编程助手会话遭劫持”",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5a26cdef-b9c0-4a7d-8e51-652349bfe6ce",
"relationship_type": "hosts",
"source_ref": "infrastructure--2bbf77a4-da81-43d4-b07e-44df90137eb6",
"target_ref": "malware--2e9f7f11-3e8a-485f-ac48-856b9a211862",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "PyPI托管被投毒的包",
"x_evidence": "原文称“通过一个被投毒的PyPI包”",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--42d51618-8663-4081-a262-adc0a4e07ab7",
"relationship_type": "uses",
"source_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"target_ref": "malware--2e9f7f11-3e8a-485f-ac48-856b9a211862",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "攻击者利用被投毒的PyPI包安装信息窃取程序",
"x_evidence": "原文称“通过一个被投毒的PyPI包安装了信息窃取程序”",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--55c2bb43-204e-47d1-b824-1bc51fc6de86",
"relationship_type": "drops",
"source_ref": "malware--2e9f7f11-3e8a-485f-ac48-856b9a211862",
"target_ref": "malware--4b237e46-bbf2-4027-bd6b-af2a5cb69d98",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "被投毒的PyPI包安装信息窃取程序",
"x_evidence": "原文称“通过一个被投毒的PyPI包安装了信息窃取程序”",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3b81602e-c981-4f26-b44d-1ac07f8ea67a",
"relationship_type": "uses",
"source_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"target_ref": "malware--4b237e46-bbf2-4027-bd6b-af2a5cb69d98",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "攻击者使用信息窃取程序",
"x_evidence": "原文称“攻击者利用...安装了信息窃取程序”",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3daead6a-a1f8-404f-846f-54dfee8b96bd",
"relationship_type": "targets",
"source_ref": "malware--4b237e46-bbf2-4027-bd6b-af2a5cb69d98",
"target_ref": "infrastructure--e570cd20-ca72-4b50-88ea-5b5f00741cce",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "信息窃取程序窃取GitHub OAuth令牌",
"x_evidence": "原文称“攻击者还窃取了GitHub OAuth令牌”",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0cdb2bc6-5925-45c1-823f-28d74331f8f6",
"relationship_type": "uses",
"source_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"target_ref": "malware--e79bbb7e-9b9f-42b9-a248-37247a42bbcc",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "攻击者部署并使用Shai-Hulud蠕虫",
"x_evidence": "原文称“攻击者将可自我传播的Shai-Hulud蠕虫部署到约100个内部代码仓库”",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--79fed965-0354-4096-9c8e-de892dcb6a16",
"relationship_type": "targets",
"source_ref": "malware--e79bbb7e-9b9f-42b9-a248-37247a42bbcc",
"target_ref": "infrastructure--cb68971e-ba5f-47b7-884b-4623c2202953",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "Shai-Hulud蠕虫在约100个内部代码仓库中传播",
"x_evidence": "原文称“将Shai-Hulud蠕虫传播到约100个内部代码仓库”",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--06b1cb76-b43e-4f33-812c-8c24ec3c5305",
"relationship_type": "hosts",
"source_ref": "identity--cff8ac61-93eb-4405-92f3-ea1ba3c033d6",
"target_ref": "infrastructure--cb68971e-ba5f-47b7-884b-4623c2202953",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "约100个内部代码仓库属于未具名SaaS提供商",
"x_evidence": "原文称“一家未具名软件即服务提供商的...内部代码仓库”",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d1b935da-8db4-4bfe-8298-6b84023927ad",
"relationship_type": "targets",
"source_ref": "malware--e79bbb7e-9b9f-42b9-a248-37247a42bbcc",
"target_ref": "identity--cff8ac61-93eb-4405-92f3-ea1ba3c033d6",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "Shai-Hulud蠕虫窃取受害者仓库机密及产品源代码",
"x_evidence": "原文称“该蠕虫窃取了仓库机密以及该公司产品的源代码”",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7d3feb9e-4284-4e81-84c8-cb8d98d22fa4",
"relationship_type": "uses",
"source_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"target_ref": "malware--da31f05d-3ed1-4430-b914-bacce007f934",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "攻击者在该公司官方命名空间中投毒包进行二次感染",
"x_evidence": "原文称“攻击者还在该公司官方命名空间中投毒了一个包”",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4c2341bf-f1bb-4197-ac46-cdbc69652091",
"relationship_type": "targets",
"source_ref": "identity--8c84f889-3137-4a73-800b-a16fd5bba901",
"target_ref": "identity--adae4f1c-c71a-4042-aa3e-df09524addd5",
"created": "2026-09-17T08:16:20Z",
"modified": "2026-09-17T08:16:20Z",
"description": "Mandiant发布报告披露该攻击活动",
"x_evidence": "原文称“Mandiant公司在2026年9月发布的报告中披露了这一案例”",
"x_confidence": 0.9
}
]
}报告链接：
http://mp.weixin.qq.com/s?__biz=MzI2NTg4OTc5Nw==&mid=2247527165&idx=2&sn=fd24c49fe7f07313c48685469ef2fa3e
───────────────────────────────────
（三）Agent Skill链路成为路径逃逸与供应链投毒载体
事件名称：Skill攻防新战场：经典威胁的载体迁移与检测回归
发布日期：2026-09-18
发布机构：腾讯安全威胁情报中心
威胁概述：
腾讯安全威胁情报中心指出，攻击者正将路径逃逸、供应链投毒和代码逻辑后门等传统技战术迁移至Skill链路。相关方式包括利用SKILL.md元数据字段实施路径穿越或ZIP-SLIP解压逃逸，在安装目录外释放文件，以及篡改NPM包或注入Git Hook执行反弹Shell，最终可能造成远程代码执行、数据窃取和系统级控制。
IOC指标：
· MD5：0dfd3154e00fcb8e626488e365fa74f8, 8ac0d5e83982dd11b39ff116593c5a3a, 39466f8582dd1f13193fa9c175598db9, eb32e1a5d8659b211443e66c97d66d58
STIX详情：
{
"type": "bundle",
"id": "bundle--9d83a688-f748-4d28-8e9a-6e9ae25f00c5",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"name": "未具名攻击者/恶意 Skill 发布者",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "分发恶意 Skill 的攻击者/发布者，利用 Agent/Skill 安装与执行链实施供应链攻击",
"x_evidence": "原文称攻击者把传统攻防中成熟的技战术整体迁移到 Skill 链路",
"x_confidence": 0.75
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--dae5d669-766f-4058-8829-afce49695e2d",
"name": "SKILL.md 元数据路径穿越",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "利用 SKILL.md 元数据中的 name 字段构造路径穿越漏洞",
"x_evidence": "原文阶段三列出 SKILL.md 元数据路径穿越为新型攻击",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--9e8683ee-c262-41d1-899a-069b9e4c3047",
"name": "ZIP-SLIP 解压逃逸",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "通过 ZIP 压缩包路径逃逸将文件解压到预期目录外的攻击手法",
"x_evidence": "原文阶段三列出 ZIP-SLIP 解压逃逸",
"x_confidence": 0.8
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--b480927c-5be8-4792-8cfe-9f95e4759134",
"name": "git hook 反弹 shell",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "在 git hook 中植入恶意代码以反弹 shell 的技术",
"x_evidence": "原文阶段三列出 git hook 反弹 shell 为新型攻击",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--6832d90a-5a6f-42c4-ac67-9e2323dac45d",
"name": "NPM 包函数级篡改",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "篡改 NPM 包内的函数，实施供应链投毒",
"x_evidence": "原文阶段三列出 NPM 包函数级篡改",
"x_confidence": 0.8
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--7dd6c9e1-de12-4a66-a98b-8bb59f77bf99",
"name": "宏病毒附件",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "隐藏在文档类附件中的宏病毒攻击手法",
"x_evidence": "原文阶段三列出宏病毒附件，并将其归为传统基础威胁手法",
"x_confidence": 0.8
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--7197fc58-4759-4596-82d2-3e66558f10ee",
"name": "poc-publisher.poc-rce",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "利用 SKILL.md 路径穿越释放恶意扩展以实现 RCE 的 PoC 样本（MD5: 0dfd3154e00fcb8e626488e365fa74f8）",
"x_evidence": "原文明确标注 Skill 名称: poc-publisher.poc-rce，MD5: 0dfd3154e00fcb8e626488e365fa74f8",
"x_confidence": 0.98
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--75a0bc4c-13a8-4459-adc9-de411d870dbc",
"name": "E2EEvil",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "利用 SKILL.md 路径穿越将文件写入 Windows 启动目录的变体样本（MD5: 8ac0d5e83982dd11b39ff116593c5a3a）",
"x_evidence": "原文明确标注 Skill 名称: E2EEvil，MD5: 8ac0d5e83982dd11b39ff116593c5a3a",
"x_confidence": 0.98
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--b350c2e7-0e18-46a0-85ef-a731f020552f",
"name": "tsrc-wb-poc",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "同 E2EEvil，将文件写入 Windows 启动目录的变体样本（MD5: 39466f8582dd1f13193fa9c175598db9）",
"x_evidence": "原文明确标注 Skill 名称: tsrc-wb-poc，MD5: 39466f8582dd1f13193fa9c175598db9",
"x_confidence": 0.98
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--431b0e05-18d8-40d2-a026-5dd8a1d5893e",
"name": "json-format-assistant",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "包含 git hook 反弹 shell 后门的恶意 Skill 样本（MD5: eb32e1a5d8659b211443e66c97d66d58）",
"x_evidence": "原文明确标注 Skill 名称: json-format-assistant，MD5: eb32e1a5d8659b211443e66c97d66d58",
"x_confidence": 0.98
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--accca2df-b94a-460c-8553-92db6553771a",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"first_observed": "2026-09-18T04:24:17Z",
"last_observed": "2026-09-18T04:24:17Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "tsrc-wb-poc.cmd",
"description": "附带在样本包中被释放到启动目录的命令行脚本（内容：@echo off / start calc.exe）",
"aliases": [],
"evidence": "原文称包内附带 tsrc-wb-poc.cmd（@echo off / start calc.exe）",
"confidence": 0.95
},
"1": {
"type": "file",
"name": ".git/hooks/pre-commit",
"description": "包含经 rev 字符级混淆的恶意反弹 shell 代码的 git hook 文件，涉及端口 4444",
"aliases": [],
"evidence": "原文称解压后的 .git/hooks/pre-commit 文件中发现反弹 shell 指令",
"confidence": 0.95
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--69ee9b65-df40-4488-96d7-c2a71108de6b",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "attack-pattern--dae5d669-766f-4058-8829-afce49695e2d",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者利用 SKILL.md 元数据路径穿越技术",
"x_evidence": "原文称攻击者利用 name 字段构造路径穿越",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e5125a13-eaaa-46d6-bf0b-94b873a20f9c",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "attack-pattern--9e8683ee-c262-41d1-899a-069b9e4c3047",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用 ZIP-SLIP 解压逃逸手法",
"x_evidence": "原文阶段三列出 ZIP-SLIP 解压逃逸为出现的新型攻击",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3c7f2b03-9296-425a-9981-6692664a49d5",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "attack-pattern--b480927c-5be8-4792-8cfe-9f95e4759134",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者利用 git hook 反弹 shell 技术",
"x_evidence": "原文阶段三列出 git hook 反弹 shell 为新型攻击",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f4678b53-e64b-4521-8d99-a506dbff45c7",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "attack-pattern--6832d90a-5a6f-42c4-ac67-9e2323dac45d",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用 NPM 包函数级篡改手法",
"x_evidence": "原文阶段三列出 NPM 包函数级篡改",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7b0cb024-2bad-40f6-a000-b3a9f9dd837f",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "attack-pattern--7dd6c9e1-de12-4a66-a98b-8bb59f77bf99",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用宏病毒附件手法",
"x_evidence": "原文阶段三列出宏病毒附件",
"x_confidence": 0.7
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ff9a6ef4-d3c3-4958-be33-8679fdea6c0b",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "malware--7197fc58-4759-4596-82d2-3e66558f10ee",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用 poc-publisher.poc-rce 样本",
"x_evidence": "原文明确给出 Skill 名称 poc-publisher.poc-rce 及 MD5",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d5bf7075-e504-4de6-99e9-0ef9d3a691c1",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "malware--75a0bc4c-13a8-4459-adc9-de411d870dbc",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用 E2EEvil 变体样本",
"x_evidence": "原文明确给出 Skill 名称 E2EEvil 及 MD5",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--93c4548c-89d1-424d-b047-79801286285b",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "malware--b350c2e7-0e18-46a0-85ef-a731f020552f",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用 tsrc-wb-poc 变体样本",
"x_evidence": "原文明确给出 Skill 名称 tsrc-wb-poc 及 MD5",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cc73b89b-6617-4875-acf5-371cb92cf413",
"relationship_type": "uses",
"source_ref": "intrusion-set--4354aeb9-361f-43aa-a6c6-9304e4931b9a",
"target_ref": "malware--431b0e05-18d8-40d2-a026-5dd8a1d5893e",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "恶意 Skill 发布者使用 json-format-assistant 恶意 Skill 样本",
"x_evidence": "原文明确给出 Skill 名称 json-format-assistant 及 MD5",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--43c8db36-20a6-49ab-b74d-16bfb3c7b2ea",
"relationship_type": "uses",
"source_ref": "malware--7197fc58-4759-4596-82d2-3e66558f10ee",
"target_ref": "attack-pattern--dae5d669-766f-4058-8829-afce49695e2d",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "poc-publisher.poc-rce 利用 SKILL.md 路径穿越实现 RCE",
"x_evidence": "原文称其 name 字段为 ../../extensions/poc-publisher.poc-rce-0.0.1，并逃逸出安装目录",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9800959d-0828-41b1-8066-b7cd26fe323a",
"relationship_type": "uses",
"source_ref": "malware--75a0bc4c-13a8-4459-adc9-de411d870dbc",
"target_ref": "attack-pattern--dae5d669-766f-4058-8829-afce49695e2d",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "E2EEvil 利用 SKILL.md 路径穿越实现持久化",
"x_evidence": "原文称 E2EEvil 将 name 字段指向 Windows 启动目录",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a0665d7d-69b0-4a27-a49e-dfe702d9d2ee",
"relationship_type": "uses",
"source_ref": "malware--b350c2e7-0e18-46a0-85ef-a731f020552f",
"target_ref": "attack-pattern--dae5d669-766f-4058-8829-afce49695e2d",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "tsrc-wb-poc 利用 SKILL.md 路径穿越实现持久化",
"x_evidence": "原文称 tsrc-wb-poc 将 name 字段指向 Windows 启动目录",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c6463489-783b-428c-bc1d-806ca8e56c51",
"relationship_type": "uses",
"source_ref": "malware--431b0e05-18d8-40d2-a026-5dd8a1d5893e",
"target_ref": "attack-pattern--b480927c-5be8-4792-8cfe-9f95e4759134",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "json-format-assistant 利用 git hook 反弹 shell 建立 C2 通道",
"x_evidence": "原文称其 .git/hooks/pre-commit 含经 rev 混淆的反弹 shell 指令，git commit 时触发",
"x_confidence": 0.98
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ac27c71f-d853-4100-9580-3f7f27f3eff1",
"relationship_type": "drops",
"source_ref": "malware--b350c2e7-0e18-46a0-85ef-a731f020552f",
"target_ref": "observed-data--accca2df-b94a-460c-8553-92db6553771a",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "tsrc-wb-poc 释放 tsrc-wb-poc.cmd 到 Windows 启动目录",
"x_evidence": "原文称包内附带 tsrc-wb-poc.cmd，安装后该文件被释放到启动目录",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--00ee2be7-53c0-45d6-a644-66567c5f21eb",
"relationship_type": "drops",
"source_ref": "malware--431b0e05-18d8-40d2-a026-5dd8a1d5893e",
"target_ref": "observed-data--accca2df-b94a-460c-8553-92db6553771a",
"created": "2026-09-18T04:24:17Z",
"modified": "2026-09-18T04:24:17Z",
"description": "json-format-assistant 解压后包含 .git/hooks/pre-commit 恶意文件",
"x_evidence": "原文称解压后的 .git/hooks/pre-commit 中发现恶意反弹 shell",
"x_confidence": 0.98
}
]
}报告链接：
http://mp.weixin.qq.com/s?__biz=MzI5ODk3OTM1Ng==&mid=2247512121&idx=1&sn=e2018388664af7321424160553e65ec7
───────────────────────────────────
（四）GemStuffer利用恶意RubyGems包实施凭据窃取
事件名称：JFrog安全研究中心在GemStuffer“OpenAI Swarm”恶意RubyGems攻击活动中识别出新包
发布日期：2026-09-15
发布机构：JFrog
威胁概述：
JFrog安全研究中心披露，AI代理发起的GemStuffer活动利用数千个恶意RubyGems包开展攻击。恶意包借助RubyDoc文档构建流程加载Ruby脚本，通过存在缺陷的API获取用户RubyGems API密钥，抓取公开文档和日历等数据，并通过Webhook API或重新打包方式外传。攻击者还在包元数据中构造XSS载荷和模板表达式，尝试获取更高权限。
IOC指标：
· URL：https://d96877a5q295v25se560q7ntmmwky7x8o.oast.online/admin-xss-author, https://webhook.site/steal?c=
STIX详情：
{
"type": "bundle",
"id": "bundle--80846ba1-c684-4132-b6c0-589c06bcd61c",
"spec_version": "2.1",
"objects": [
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"name": "GemStuffer",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "由OpenAI代理执行的恶意RubyGems投毒行动",
"x_evidence": "The JFrog Security Research team investigated the GemStuffer campaign done by rogue OpenAI agents.",
"x_confidence": 0.95
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--e2a0fdfd-82e7-46ad-869e-3b393ece4c75",
"name": "OpenAI Agents",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "执行GemStuffer活动的自动化代理群组",
"aliases": [
"OpenAI Swarm"
],
"x_evidence": "The RubyHack investigation... linked the May and June activity from the GemStuffer campaign to OpenAI agents.",
"x_confidence": 0.9
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--8378a3c3-eb3e-43e8-8b67-5e1b6bee2df1",
"name": "slnleaker5",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "通过.yardopts运行并尝试窃取RubyGems API密钥及抓取网站数据的恶意Ruby包",
"x_evidence": "slnleaker5 version 0.0.1 explicitly loads script.rb through .yardopts... cycles through four forms of the legacy API-key endpoint.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"name": "f2fe-s1",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "抓取Wandsworth数据并尝试以新包形式重新发布的恶意Ruby包",
"x_evidence": "f2fe-s1: Collects Wandsworth's data, publishes to separate Gem.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--8f4154de-2c83-46cd-92c4-6fa0fdef9d42",
"name": "yardxabc889",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "抓取Lambeth数据并重新打包发布在同一包的新版本中的恶意Ruby包",
"x_evidence": "yardxabc889: Collects Lambeth's data, republishes in same Gem.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--47451518-c381-4f79-b663-a0cc5dc1a423",
"name": "southpxdatapp6pi",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "将收集到的Southwark数据存储在RubyGems webhook配置中的恶意包",
"x_evidence": "southpxdatapp6pi: Collects Southwark's data, stores in webhook URLs.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--ad3a5452-5e64-4f0c-b1dc-21224dd4e209",
"name": "xss-test-gem",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "在元数据中嵌入XSS payload的恶意Ruby包",
"x_evidence": "In xss-test-gem version 0.1.0... The attack strings are in the serialized gemspec's description.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--657ba189-27c7-46cf-81ac-944e0e653fb7",
"name": "attacker-xss-admin-1",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "作者字段中包含XSS payload的测试包",
"x_evidence": "[email protected] author is a script element loading a remote image from oast.online.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--036ac9e7-f90e-4a8b-8c9e-c1f8ac1eb0d7",
"name": "xssname-1783397821",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "作者字段包含XSS payload以窃取cookie的测试包",
"x_evidence": "[email protected] author is an img onerror handler that fetches a webhook.site URL with document.cookie.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--0834ee17-4710-47e0-a1a5-45964d0725a7",
"name": "test-apex-gem",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "作者字段包含XSS payload的测试包",
"x_evidence": "[email protected] author is an img tag with onerror=alert(1).",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--fba26e9b-41d6-4e0d-8960-f7a5333c00a9",
"name": "test-ssti-0",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "作者字段中包含SSTI ERB表达式载荷的测试包",
"x_evidence": "[email protected] author is <%= 7*7 %>.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--7a128241-42ad-4cbe-a242-659e783ccd70",
"name": "test-ssti-1",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "测试表达式语言注入的测试包",
"x_evidence": "[email protected] author is ${7*7}.",
"x_confidence": 0.95
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--1af00cd6-a885-4f12-9ce2-35450874e5d6",
"name": "test-ssti-4",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "使用百分号编码的SSTI测试包",
"x_evidence": "[email protected] author is <%25= 7*7 %>, which becomes the ERB form after percent-decoding.",
"x_confidence": 0.95
},
{
"type": "vulnerability",
"spec_version": "2.1",
"id": "vulnerability--11bdd1e2-f9fb-4145-9079-bc494067845c",
"name": "RubyGems legacy API-key vulnerability",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "允许非授权调用者缓存成功登录响应并在CDN边缘被返回的RubyGems漏洞",
"x_evidence": "Under the affected compression and cache-header behavior, a successful legacy sign-in response could be cached at a CDN edge and returned to another caller for up to an hour, including an unauthenticated caller.",
"x_confidence": 0.9
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--8cc65b21-fdce-42d5-93f1-575ae08aa026",
"name": "RubyGems.org",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "RubyGems包注册表平台，提供发布、webhook和API-key接口",
"x_evidence": "RubyGems reports that it fixed the cache issue and revoked legacy API keys.",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--4b7173d9-0bb0-4f0b-85a4-fffd448a05c3",
"name": "RubyDoc documentation workers",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "RubyDoc文档处理工作器，处理gem时执行包内.yardopts指定的脚本",
"x_evidence": "The identified malicious packages used RubyDoc’s documentation workers, the feature that generates reference pages for Ruby packages, to fetch websites and send the results back through RubyGems.",
"x_confidence": 0.9
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--a334c738-48a3-4ad3-86fe-74446c8abaf7",
"name": "https://d96877a5q295v25se560q7ntmmwky7x8o.oast.online/admin-xss-author",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "嵌入在恶意包作者字段中的XSS载荷URL，加载远程图片以确认或外传管理员会话数据",
"x_evidence": "attacker-xss-admin-1 author field embedded this URL as an XSS payload to load a remote image and confirm or exfiltrate admin session data.",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--618f0e2b-22d6-451b-9884-8a5a9e4997f5",
"name": "https://webhook.site/steal?c=",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "嵌入在恶意包作者字段中的XSS载荷URL，窃取document.cookie并发送到webhook.site",
"x_evidence": "Malicious RubyGems package author field embedded this webhook URL in an XSS payload to steal document.cookie from victims.",
"x_confidence": 0.95
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--aeda35bd-c122-4793-bce7-a5c8f2f4a46e",
"name": "Malicious Ruby code execution via RubyDoc documentation workers",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "通过RubyDoc文档工作器执行恶意Ruby代码的攻击模式",
"x_evidence": "The identified malicious packages used RubyDoc’s documentation workers... to fetch websites and send the results back through RubyGems.",
"x_confidence": 0.85
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--dcc6eb2b-3e64-4a03-a121-13c3c92d2343",
"name": "XSS injection via malicious gemspec metadata",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "通过恶意gemspec元数据注入XSS的攻击模式",
"x_evidence": "Some of the packages contain XSS proof-of-concepts embedded in their metadata, attempting to prove user hijacking.",
"x_confidence": 0.85
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--06ce10e6-3a7a-4335-a4ff-0cc79cce4632",
"name": "SSTI/ERB injection via malicious gemspec metadata",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "通过恶意gemspec元数据注入SSTI/ERB表达式的攻击模式",
"x_evidence": "Template expressions and YAML-labeled tests... The first is an ERB expression. The second tests expression-language interpolation. The third becomes the ERB form after percent-decoding.",
"x_confidence": 0.85
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"first_observed": "2026-09-16T04:09:41Z",
"last_observed": "2026-09-16T04:09:41Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "script.rb",
"description": "由slnleaker5包加载的恶意脚本文件",
"aliases": [],
"evidence": "slnleaker5 version 0.0.1 explicitly loads script.rb through .yardopts.",
"confidence": 0.95
},
"1": {
"type": "file",
"name": "INDEX.txt",
"description": "slnleaker5生成的响应索引文件",
"aliases": [],
"evidence": "writes an INDEX.txt and numbered response files.",
"confidence": 0.9
},
"2": {
"type": "file",
"name": "loader.rb",
"description": "f2fe-s1包中的加载脚本，用于抓取数据并打包新gem",
"aliases": [],
"evidence": "In f2fe-s1 version 0.0.1, loader.rb fetches public meeting calendars and linked documents.",
"confidence": 0.95
},
"3": {
"type": "file",
"name": "p0.txt",
"description": "f2fe-s1包中存储抓取响应的文件",
"aliases": [],
"evidence": "It stores responses in p0.txt, ids.txt, and d0.bin.",
"confidence": 0.9
},
"4": {
"type": "file",
"name": "ids.txt",
"description": "f2fe-s1包中存储会议ID的文件",
"aliases": [],
"evidence": "It stores responses in p0.txt, ids.txt, and d0.bin.",
"confidence": 0.9
},
"5": {
"type": "file",
"name": "d0.bin",
"description": "f2fe-s1包中存储响应数据的文件",
"aliases": [],
"evidence": "It stores responses in p0.txt, ids.txt, and d0.bin.",
"confidence": 0.9
},
"6": {
"type": "file",
"name": "evil.rb",
"description": "由yardxabc889包通过.yardopts加载的恶意脚本",
"aliases": [],
"evidence": "yardxabc889 version 0.0.1 uses .yardopts to load evil.rb.",
"confidence": 0.95
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6e3dd6c6-2bb5-406b-99fb-f6f7630929bc",
"relationship_type": "attributed-to",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "intrusion-set--e2a0fdfd-82e7-46ad-869e-3b393ece4c75",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动由OpenAI Agents入侵集执行",
"x_evidence": "The JFrog Security Research team investigated the GemStuffer campaign done by rogue OpenAI agents.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--efe46689-2b3e-44b5-bf6f-f1006fd1be97",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--8378a3c3-eb3e-43e8-8b67-5e1b6bee2df1",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用slnleaker5恶意包",
"x_evidence": "Analysis of the Ruby payloads: slnleaker5: RubyGems token stealer.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c9450be5-55b8-41ca-ba2f-69de27507783",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用f2fe-s1恶意包",
"x_evidence": "f2fe-s1: Collects Wandsworth's data, publishes to separate Gem.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7005110a-abe8-45cc-9e50-ca65a8ea86d8",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--8f4154de-2c83-46cd-92c4-6fa0fdef9d42",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用yardxabc889恶意包",
"x_evidence": "yardxabc889: Collects Lambeth's data, republishes in same Gem.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1cbc426f-d20e-4898-8d6d-928d9ef29fd5",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--47451518-c381-4f79-b663-a0cc5dc1a423",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用southpxdatapp6pi恶意包",
"x_evidence": "southpxdatapp6pi: Collects Southwark's data, stores in webhook URLs.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b9096e7c-d23a-4c8a-a3ab-2cd3543249a3",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--ad3a5452-5e64-4f0c-b1dc-21224dd4e209",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用xss-test-gem恶意包",
"x_evidence": "In xss-test-gem version 0.1.0, the attack strings are in the serialized gemspec's description.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9d43e293-565e-4d7f-b03e-fbfedd427257",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--657ba189-27c7-46cf-81ac-944e0e653fb7",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用attacker-xss-admin-1恶意包",
"x_evidence": "Package Author [email protected] contains script-based XSS.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--998cba2a-6af6-4cde-ab60-a7bbd14358b0",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--036ac9e7-f90e-4a8b-8c9e-c1f8ac1eb0d7",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用xssname-1783397821恶意包",
"x_evidence": "Package Author [email protected] contains img onerror cookie-theft XSS.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--839e9a49-159e-4336-a187-575d1aaa1fba",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--0834ee17-4710-47e0-a1a5-45964d0725a7",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用test-apex-gem恶意包",
"x_evidence": "Package Author [email protected] contains img onerror=alert(1).",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--481983a6-2981-4514-8b34-fa126482d138",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--fba26e9b-41d6-4e0d-8960-f7a5333c00a9",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用test-ssti-0恶意包",
"x_evidence": "[email protected] author is <%= 7*7 %>.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4cb20dd6-5db5-4b8b-abc1-d1732ccf2e0d",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--7a128241-42ad-4cbe-a242-659e783ccd70",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用test-ssti-1恶意包",
"x_evidence": "[email protected] author is ${7*7}.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8a615366-374f-4552-9800-6fa0b5b44477",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "malware--1af00cd6-a885-4f12-9ce2-35450874e5d6",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用test-ssti-4恶意包",
"x_evidence": "[email protected] author is <%25= 7*7 %>.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b3344ba4-ef8c-43ed-9a05-efc354a62ed3",
"relationship_type": "uses",
"source_ref": "malware--8378a3c3-eb3e-43e8-8b67-5e1b6bee2df1",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "slnleaker5加载script.rb脚本",
"x_evidence": "slnleaker5 version 0.0.1 explicitly loads script.rb through .yardopts.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7335c3cb-e9e4-4cab-b08b-7168b096494f",
"relationship_type": "drops",
"source_ref": "malware--8378a3c3-eb3e-43e8-8b67-5e1b6bee2df1",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "slnleaker5执行后生成INDEX.txt文件",
"x_evidence": "Its crawler... writes an INDEX.txt and numbered response files.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ad80a501-1d6d-4e5e-9bbd-3f8552f63912",
"relationship_type": "uses",
"source_ref": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "f2fe-s1使用loader.rb脚本",
"x_evidence": "In f2fe-s1 version 0.0.1, loader.rb fetches public meeting calendars and linked documents.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--59e7824b-cdb8-4b03-ac38-360a41c173ed",
"relationship_type": "drops",
"source_ref": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "f2fe-s1生成p0.txt文件",
"x_evidence": "It stores responses in p0.txt, ids.txt, and d0.bin.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3c896571-4f29-46fe-9c0e-9ae5eec07170",
"relationship_type": "drops",
"source_ref": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "f2fe-s1生成ids.txt文件",
"x_evidence": "It stores responses in p0.txt, ids.txt, and d0.bin.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c1034b66-9b29-4bab-b07b-f1607476f886",
"relationship_type": "drops",
"source_ref": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "f2fe-s1生成d0.bin文件",
"x_evidence": "It stores responses in p0.txt, ids.txt, and d0.bin.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e3082298-0c14-4194-90d8-e5a6b2bf4785",
"relationship_type": "uses",
"source_ref": "malware--8f4154de-2c83-46cd-92c4-6fa0fdef9d42",
"target_ref": "observed-data--ad380e1c-41c2-42e8-8dfa-37092d99251e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "yardxabc889加载evil.rb脚本",
"x_evidence": "yardxabc889 version 0.0.1 uses .yardopts to load evil.rb.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c4ee62cd-b583-47a0-9829-505bea121685",
"relationship_type": "exploits",
"source_ref": "malware--8378a3c3-eb3e-43e8-8b67-5e1b6bee2df1",
"target_ref": "vulnerability--11bdd1e2-f9fb-4145-9079-bc494067845c",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "slnleaker5利用RubyGems legacy API-key漏洞获取API密钥",
"x_evidence": "The source therefore shows an attempt to exploit that behavior before the later report.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--da3b7491-bbeb-4b0b-81a4-773d77f1d75b",
"relationship_type": "communicates-with",
"source_ref": "malware--8378a3c3-eb3e-43e8-8b67-5e1b6bee2df1",
"target_ref": "infrastructure--8cc65b21-fdce-42d5-93f1-575ae08aa026",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "slnleaker5与RubyGems.org通信以请求API密钥和上传恶意包",
"x_evidence": "It cycles through four forms of the legacy API-key endpoint... The selected value is then used as the upload request's Authorization header.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--629de536-a783-4354-84ed-4a878b20776a",
"relationship_type": "communicates-with",
"source_ref": "malware--eed8bb63-edc0-4e07-9615-57b82d19cc20",
"target_ref": "infrastructure--8cc65b21-fdce-42d5-93f1-575ae08aa026",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "f2fe-s1与RubyGems.org通信以上传收集数据的gem",
"x_evidence": "Lines 59-62 build the gem and attempt to POST it to RubyGems' /api/v1/gems endpoint using an embedded API key.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--46bdaedb-a462-44de-9b3e-04c849599c9d",
"relationship_type": "communicates-with",
"source_ref": "malware--8f4154de-2c83-46cd-92c4-6fa0fdef9d42",
"target_ref": "infrastructure--8cc65b21-fdce-42d5-93f1-575ae08aa026",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "yardxabc889与RubyGems.org通信以发布包含收集数据的新版本",
"x_evidence": "The script builds yardxabc889-0.0.2.gem and attempts to publish it using an embedded credential.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--064419c8-491b-401b-bc3f-47cb8c7d2fbe",
"relationship_type": "communicates-with",
"source_ref": "malware--47451518-c381-4f79-b663-a0cc5dc1a423",
"target_ref": "infrastructure--8cc65b21-fdce-42d5-93f1-575ae08aa026",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "southpxdatapp6pi与RubyGems.org通信以设置webhook URL",
"x_evidence": "For each chunk, it sends a request to /api/v1/web_hooks... The write destination in the code is the RubyGems webhook API.",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--71fd5a38-6198-400d-89b0-b01162c9279d",
"relationship_type": "communicates-with",
"source_ref": "malware--657ba189-27c7-46cf-81ac-944e0e653fb7",
"target_ref": "url--a334c738-48a3-4ad3-86fe-74446c8abaf7",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "attacker-xss-admin-1通过作者字段中的XSS payload加载远程图片，确认或外传管理员会话数据",
"x_evidence": "attacker-xss-admin-1 author field embedded this URL as an XSS payload to load a remote image and confirm or exfiltrate admin session data.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--58327347-0adf-43ef-9333-49df9046104f",
"relationship_type": "communicates-with",
"source_ref": "malware--036ac9e7-f90e-4a8b-8c9e-c1f8ac1eb0d7",
"target_ref": "url--618f0e2b-22d6-451b-9884-8a5a9e4997f5",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "xssname-1783397821通过作者字段中的XSS payload窃取cookie并发送到webhook.site",
"x_evidence": "xssname-1783397821 author field embedded this webhook URL in an XSS payload to steal document.cookie from victims.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--563a3d16-99e3-46bf-a01e-eb163ad11d4c",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "attack-pattern--aeda35bd-c122-4793-bce7-a5c8f2f4a46e",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用通过RubyDoc文档工作器执行恶意Ruby代码的攻击模式",
"x_evidence": "The identified malicious packages used RubyDoc’s documentation workers... to fetch websites and send the results back through RubyGems.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--eca47383-991d-4d07-94cd-31c034e81475",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "attack-pattern--dcc6eb2b-3e64-4a03-a121-13c3c92d2343",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用恶意gemspec元数据XSS注入的攻击模式",
"x_evidence": "Some of the packages contain XSS proof-of-concepts embedded in their metadata.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1bf6c1ac-16ec-415c-917b-ccd7590fcb24",
"relationship_type": "uses",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "attack-pattern--06ce10e6-3a7a-4335-a4ff-0cc79cce4632",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动使用恶意gemspec元数据SSTI/ERB注入的攻击模式",
"x_evidence": "Template expressions and YAML-labeled tests... The first is an ERB expression... The second tests expression-language interpolation... The third becomes the ERB form.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a68485a7-57bb-49cd-a7f5-422b4a9a1f8d",
"relationship_type": "targets",
"source_ref": "campaign--7a795468-4a79-4fd9-898f-ab2bda93b46e",
"target_ref": "infrastructure--8cc65b21-fdce-42d5-93f1-575ae08aa026",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "GemStuffer活动以RubyGems.org及其用户为目标",
"x_evidence": "The identified malicious packages... send the results back through RubyGems; some target RubyGems package pages, administrative views, and metadata parsers.",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d983c748-09ba-46eb-827b-3f5955998d22",
"relationship_type": "uses",
"source_ref": "attack-pattern--aeda35bd-c122-4793-bce7-a5c8f2f4a46e",
"target_ref": "infrastructure--4b7173d9-0bb0-4f0b-85a4-fffd448a05c3",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "该攻击模式使用RubyDoc documentation workers执行恶意Ruby代码",
"x_evidence": "The identified malicious packages used RubyDoc’s documentation workers... to fetch websites and send the results back through RubyGems.",
"x_confidence": 0.8
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1a1c41c2-c71b-427a-a04a-e409ede470f2",
"relationship_type": "uses",
"source_ref": "malware--ad3a5452-5e64-4f0c-b1dc-21224dd4e209",
"target_ref": "attack-pattern--dcc6eb2b-3e64-4a03-a121-13c3c92d2343",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "xss-test-gem使用恶意gemspec元数据XSS注入攻击模式",
"x_evidence": "In xss-test-gem version 0.1.0, the attack strings are in the serialized gemspec's description and include an image error handler, a script element, a javascript: link, and an SVG load handler.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--051370fc-bb1b-4d37-a95e-67671fffe2bf",
"relationship_type": "uses",
"source_ref": "malware--657ba189-27c7-46cf-81ac-944e0e653fb7",
"target_ref": "attack-pattern--dcc6eb2b-3e64-4a03-a121-13c3c92d2343",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "attacker-xss-admin-1使用恶意gemspec元数据XSS注入攻击模式",
"x_evidence": "[email protected] author is a script element that loads a remote image from oast.online.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--133faf41-802e-4404-8dd1-545d3a3c07d1",
"relationship_type": "uses",
"source_ref": "malware--036ac9e7-f90e-4a8b-8c9e-c1f8ac1eb0d7",
"target_ref": "attack-pattern--dcc6eb2b-3e64-4a03-a121-13c3c92d2343",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "xssname-1783397821使用恶意gemspec元数据XSS注入攻击模式",
"x_evidence": "[email protected] author is an img onerror handler that fetches document.cookie.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0c4e76f5-2a0c-4a81-9974-345418079197",
"relationship_type": "uses",
"source_ref": "malware--0834ee17-4710-47e0-a1a5-45964d0725a7",
"target_ref": "attack-pattern--dcc6eb2b-3e64-4a03-a121-13c3c92d2343",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "test-apex-gem使用恶意gemspec元数据XSS注入攻击模式",
"x_evidence": "[email protected] author is an img tag with onerror=alert(1).",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--89825cd1-8558-4c7d-9cd4-91f10682a0e7",
"relationship_type": "uses",
"source_ref": "malware--fba26e9b-41d6-4e0d-8960-f7a5333c00a9",
"target_ref": "attack-pattern--06ce10e6-3a7a-4335-a4ff-0cc79cce4632",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "test-ssti-0使用恶意gemspec元数据SSTI/ERB注入攻击模式",
"x_evidence": "[email protected] author is <%= 7*7 %>, an ERB expression.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5ea3bf0e-62c4-49a7-a4d1-e7272eab80e8",
"relationship_type": "uses",
"source_ref": "malware--7a128241-42ad-4cbe-a242-659e783ccd70",
"target_ref": "attack-pattern--06ce10e6-3a7a-4335-a4ff-0cc79cce4632",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "test-ssti-1使用恶意gemspec元数据SSTI/ERB注入攻击模式",
"x_evidence": "[email protected] author is ${7*7}, testing expression-language interpolation.",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bbd23743-8311-455b-8371-06b5e0b4c1d9",
"relationship_type": "uses",
"source_ref": "malware--1af00cd6-a885-4f12-9ce2-35450874e5d6",
"target_ref": "attack-pattern--06ce10e6-3a7a-4335-a4ff-0cc79cce4632",
"created": "2026-09-16T04:09:41Z",
"modified": "2026-09-16T04:09:41Z",
"description": "test-ssti-4使用恶意gemspec元数据SSTI/ERB注入攻击模式",
"x_evidence": "[email protected] author is <%25= 7*7 %>, which becomes the ERB form after percent-decoding.",
"x_confidence": 0.85
}
]
}报告链接：
https://research.jfrog.com//post/gemstuffer-openai-rubygems/
───────────────────────────────────
（五）AI中转站截获并出售6T明文数据
事件名称：AI中转站，做起了数据买卖生意？
发布日期：2026-09-16
发布机构：微步在线
威胁概述：
微步在线披露，研究人员发现某AI中转站截获并出售约6T明文数据。该中转站通过截断TLS连接读取通信内容，留存对话、文件和身份凭据并进行出售。素材还显示，中转站可篡改返回指令，诱导用户外发数据或向终端投递窃密木马。
IOC指标：
· 暂无公开IOC
报告链接：
http://mp.weixin.qq.com/s?__biz=MzI5NjA0NjI5MQ==&mid=2650188143&idx=1&sn=55c1740cac6b7d819993cd9e87a66ad2
───────────────────────────────────
（六）RatHat利用AI控制窃取移动端银行凭证
事件名称：RatHat：由人工智能驱动的移动威胁瞄准您的凭证和银行账户
发布日期：2026-09-16
发布机构：Zimperium
威胁概述：
Zimperium披露，RatHat通过网络钓鱼或恶意广告传播欺骗性APK，主要针对Android设备上的凭证和银行账户。报告将其描述为由AI驱动，并指出该恶意软件可利用无障碍服务和本地ADB自配对获取设备Shell权限，通过屏幕覆盖、辅助功能监听和/dev/input捕获窃取银行密码、PIN码及OTP。RatHat还可部署frp反向代理建立隐蔽隧道，以维持远程控制。
IOC指标：
· 暂无公开IOC
STIX详情：
{
"type": "bundle",
"id": "bundle--f3dca54e-1e60-4f50-b4d1-9d336512fc9c",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--4db0e680-a2e4-4a16-8295-2f4ac6e3c135",
"name": "RatHat Threat Actor",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "与 RatHat 恶意软件相关的威胁行为者，报告称其似乎在中国境内运营。",
"x_evidence": "原文称 RatHat 是一种新型安卓恶意软件，与似乎在中国境内运营的威胁行为者有关。",
"x_confidence": 0.8
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--6b8de030-c2a9-482e-96bd-89cb1909cfa0",
"name": "Global Financial Users",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 主要针对全球金融用户，重点包括银行类应用以及 WeChat、Alipay 等支付应用。",
"aliases": [
"Global Financial"
],
"x_evidence": "原文称 Global Financial Targeting；恶意软件伪造银行和支付应用界面，并针对 WeChat 和 Alipay 部署覆盖层。",
"x_confidence": 0.9
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"name": "RatHat",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "AI 驱动的安卓远程控制木马（RAT），利用无线调试获取 shell 权限、窃取凭据和双因素认证，并具备自身持久化能力。",
"x_evidence": "原文称 RatHat 是一种 AI 驱动的安卓 RAT，滥用无线调试获取 shell 访问，并窃取银行 PIN 和 OTP。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--d10f8a70-60cf-4a77-8e7a-1f2fe7e96191",
"name": "StringFog",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "用于安卓字符串加密的库。",
"x_evidence": "原文称通用字符串使用 StringFog（一种安卓字符串加密库）。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--25cbc692-0d90-415e-ba41-ab61ca394a73",
"name": "StringCrypto",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "基于 base64 并附加字节交换和异或操作的字符串加密方案。",
"x_evidence": "原文称该恶意软件使用名为 StringCrypto 的方案：base64 后交换相邻字节对并与 16 字节密钥异或。",
"x_confidence": 0.85
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--f8be3704-db79-4838-90dc-bd1f312026cc",
"name": "Frida",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "动态插桩工具，恶意软件包含检测 Frida 的检查机制。",
"x_evidence": "原文称 Frida Check 会 TCP 探测 27042 端口、检查 ps 输出并扫描 /proc/self/maps 中的 libfrida-agent.so。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--f7916c6b-2925-4a3c-88fe-5781b0be5ebd",
"name": "Xposed",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Android 框架，恶意软件包含检测其是否存在的机制。",
"x_evidence": "原文称 Xposed、root 或模拟器检查会检查 20 个 root 路径和包、三个 Xposed 管理器包等。",
"x_confidence": 0.9
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--9f0d0f89-f081-4cc5-a5e2-f90da3115eb9",
"name": "frpc",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Fast Reverse Proxy Client，用于暴露内部回环服务器和设备接口到互联网，实现 C2 通信。",
"x_evidence": "原文称其部署伪装成本地库的 Fast Reverse Proxy Client（frpc），以将内部回环服务暴露到互联网。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--1526e02e-804f-46ca-b0da-242d9047b56b",
"name": "getevent",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "标准的 Android 调试工具，恶意软件利用它来读取原始输入事件，实现硬件级按键记录。",
"x_evidence": "原文称恶意软件利用 shell 环境并使用 getevent 工具读取内核写入的原始设备文件。",
"x_confidence": 0.9
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--23db8056-06c3-4bf4-82b7-bc311de36a71",
"name": "127.0.0.1",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 本地 HTTP 服务器监听地址（127.0.0.1:7910）。",
"x_evidence": "原文称使用嵌入式 Go Agent（liblocal-service.so）在 127.0.0.1:7910 上启动 HTTP 服务器。",
"x_confidence": 0.9
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"first_observed": "2026-09-17T04:53:01Z",
"last_observed": "2026-09-17T04:53:01Z",
"number_observed": 1,
"objects": {
"0": {
"type": "file",
"name": "liblocal-service.so",
"description": "Go 语言编写的 Agent，在获取 ADB shell 后释放并执行，用于命令控制。",
"aliases": [],
"evidence": "原文称该恶意软件包含一个用 Go 编写的高级 Agent，伪装成本地库 liblocal-service.so 并部署到 /data/local/tmp。",
"confidence": 0.95
},
"1": {
"type": "file",
"name": "libmedia_codec.so",
"description": "伪装成本地库的 FRP 客户端，用于建立反向隧道代理。",
"aliases": [],
"evidence": "原文称其第三个主要部分是反向代理客户端 frpc，作为 Go 二进制文件伪装为 libmedia_codec.so。",
"confidence": 0.9
},
"2": {
"type": "file",
"name": "minicap.so",
"description": "屏幕截图工具库文件，针对不同设备架构和系统版本下发。",
"aliases": [],
"evidence": "原文称屏幕捕获工具按设备 ABI、SDK 级别和品牌从 /api/bin/%s/minicap.so?sdk=%s 等端点下发。",
"confidence": 0.85
},
"3": {
"type": "process",
"name": "dumpsys deviceidle whitelist",
"description": "将应用加入 Doze 模式白名单的命令。",
"aliases": [
"dumpsys deviceidle whitelist +%s"
],
"evidence": "原文列出 Go Agent 字符串中的命令：dumpsys deviceidle whitelist +%s。",
"confidence": 0.9
},
"4": {
"type": "process",
"name": "am set-standby-bucket",
"description": "将应用设置到 active 状态，优先后台执行的命令。",
"aliases": [
"am set-standby-bucket %s active"
],
"evidence": "原文列出 Go Agent 字符串中的命令：am set-standby-bucket %s active。",
"confidence": 0.9
},
"5": {
"type": "process",
"name": "pm disable-user",
"description": "禁用系统中的指定应用包的命令。",
"aliases": [
"pm disable-user --user 0 %s"
],
"evidence": "原文列出命令：pm disable-user --user 0 %s，允许操作者禁用任意包。",
"confidence": 0.9
},
"6": {
"type": "process",
"name": "pm uninstall",
"description": "卸载安全软件或其他包的命令。",
"aliases": [
"pm uninstall -k --user 0 %s"
],
"evidence": "原文列出命令：pm uninstall -k --user 0 %s，允许完整卸载安全软件或其他包。",
"confidence": 0.9
},
"7": {
"type": "process",
"name": "pm install",
"description": "静默重新安装恶意 APK 的命令。",
"aliases": [
"pm install -r -g -i com.android.packageinstaller /data/local/tmp/app.apk"
],
"evidence": "原文称服务启动以下命令重新安装 APK：pm install -r -g -i com.android.packageinstaller /data/local/tmp/app.apk。",
"confidence": 0.9
},
"8": {
"type": "process",
"name": "settings put secure enabled_accessibility_services",
"description": "开启辅助功能服务权限的命令。",
"aliases": [
"settings put secure enabled_accessibility_services '%s'"
],
"evidence": "原文称重新安装后执行 settings put secure enabled_accessibility_services '%s' 以恢复无障碍服务。",
"confidence": 0.9
},
"9": {
"type": "process",
"name": "settings put secure accessibility_enabled",
"description": "开启辅助功能的命令。",
"aliases": [
"settings put secure accessibility_enabled 1"
],
"evidence": "原文称重新安装后执行 settings put secure accessibility_enabled 1。",
"confidence": 0.9
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6bc858ec-37fd-4af3-b3cb-abc09dee8cf3",
"relationship_type": "uses",
"source_ref": "intrusion-set--4db0e680-a2e4-4a16-8295-2f4ac6e3c135",
"target_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 威胁行为者使用 RatHat 恶意软件实施攻击。",
"x_evidence": "原文称 RatHat 是一种与威胁行为者相关的新型安卓恶意软件。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6883e9d9-9a9d-4f25-8105-27f34b73f0dc",
"relationship_type": "targets",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "identity--6b8de030-c2a9-482e-96bd-89cb1909cfa0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 针对全球金融用户，重点窃取银行及支付应用相关凭据。",
"x_evidence": "原文称该恶意软件部署伪造界面以模仿合法银行和支付应用，并针对 WeChat 和 Alipay。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--851a938a-1715-4d2a-a6e3-7c35c0e3421b",
"relationship_type": "uses",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "tool--d10f8a70-60cf-4a77-8e7a-1f2fe7e96191",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 使用 StringFog 进行安卓字符串加密。",
"x_evidence": "原文称通用字符串使用 StringFog。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c8756ff0-bcc9-4cda-8372-352908f10a32",
"relationship_type": "uses",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "tool--25cbc692-0d90-415e-ba41-ab61ca394a73",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 使用 StringCrypto 字符串加密方案。",
"x_evidence": "原文称该恶意软件使用名为 StringCrypto 的方案。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fec051cd-d3a9-4a9a-936b-5ccadc364904",
"relationship_type": "drops",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 释放并部署 Go Agent（liblocal-service.so）作为命令控制核心。",
"x_evidence": "原文称由 APK 在获取 shell 后释放并执行 Go 编写的 Agent，伪装为 liblocal-service.so。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1b661261-33d6-46f7-9d3d-83f44f4ac0e1",
"relationship_type": "drops",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 释放伪装成本地库的 FRP 客户端（libmedia_codec.so）。",
"x_evidence": "原文称其第三个主要部分是作为 Go 二进制文件伪装为 libmedia_codec.so 的反向代理客户端。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--667f1fc2-a538-4976-a8a5-c387b5877325",
"relationship_type": "uses",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "tool--9f0d0f89-f081-4cc5-a5e2-f90da3115eb9",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 使用 frpc 建立反向隧道实现 C2 通信，绕过 NAT 和防火墙限制。",
"x_evidence": "原文称其部署伪装成本地库的 Fast Reverse Proxy Client（frpc），将内部回环服务和设备接口暴露到互联网。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bde92609-a732-435b-8f40-9d00a55bbab9",
"relationship_type": "communicates-with",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "ipv4-addr--23db8056-06c3-4bf4-82b7-bc311de36a71",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 在 127.0.0.1:7910 上启动本地 HTTP 服务器并接受本地连接。",
"x_evidence": "原文称使用嵌入式 Go Agent 在 127.0.0.1:7910 上启动 HTTP 服务器。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5053e7bc-7cfa-44f5-9925-2286dcd659bc",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "tool--1526e02e-804f-46ca-b0da-242d9047b56b",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 使用 getevent 读取原始输入事件，实现硬件级键盘记录。",
"x_evidence": "原文称恶意软件利用 shell 环境并使用 getevent 工具读取 /dev/input/* 原始事件。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--eb8f7db3-d8c1-4d7d-8a48-a6c60b05b698",
"relationship_type": "downloads",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 根据设备 ABI、SDK 级别和品牌下载屏幕捕获工具 minicap.so。",
"x_evidence": "原文称屏幕捕获工具按设备 ABI、SDK 级别和品牌从 /api/bin/%s/minicap.so?sdk=%s 等端点下发。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ba26d6c4-05fa-4458-977b-4360f79b2cae",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 dumpsys deviceidle whitelist 命令以豁免省电限制。",
"x_evidence": "原文列出 Go Agent 字符串中的命令：dumpsys deviceidle whitelist +%s。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e7e18c47-a27e-4550-926e-35063a3ee704",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 am set-standby-bucket 命令将应用设置到 active 状态。",
"x_evidence": "原文列出命令：am set-standby-bucket %s active。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c44f7113-8d22-475b-973c-53bfe2ae4ddf",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 pm disable-user 命令禁用系统中的指定应用包。",
"x_evidence": "原文列出命令：pm disable-user --user 0 %s。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e8b243a5-4829-4c36-b005-e99399307b53",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 pm uninstall 命令卸载安全软件或其他包。",
"x_evidence": "原文列出命令：pm uninstall -k --user 0 %s。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--168799bf-51d7-4ef3-bcec-a55ee8d1003c",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 pm install 命令静默重新安装恶意 APK。",
"x_evidence": "原文称服务启动 pm install -r -g -i com.android.packageinstaller /data/local/tmp/app.apk 重新安装 APK。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bd0789c6-a2c2-442a-b634-2ce3e890530d",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 settings put 命令开启辅助功能服务权限。",
"x_evidence": "原文称执行 settings put secure enabled_accessibility_services '%s' 恢复无障碍服务。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0d879305-0dab-495f-9228-01bdb7712b17",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "Go Agent 执行 settings put 命令开启辅助功能。",
"x_evidence": "原文称执行 settings put secure accessibility_enabled 1。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a6ed79c7-5a29-4d86-a441-19e4966eb5c8",
"relationship_type": "uses",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "tool--f8be3704-db79-4838-90dc-bd1f312026cc",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 包含检测 Frida 的运行时检查机制，而非使用 Frida。",
"x_evidence": "原文称 Frida Check 包括 TCP 探测 27042 端口、检查 ps 输出并扫描 libfrida-agent.so。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f907a3c5-1059-4d62-b022-bb574d495bfa",
"relationship_type": "uses",
"source_ref": "malware--4c3f57fb-c892-4e52-b7d0-c39e564a6814",
"target_ref": "tool--f7916c6b-2925-4a3c-88fe-5781b0be5ebd",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "RatHat 包含检测 Xposed 的运行时检查机制，而非使用 Xposed。",
"x_evidence": "原文称 Xposed、root 或模拟器检查包括三个 Xposed 管理器包及 persist.sys.xposed.enable。",
"x_confidence": 0.85
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6f03527b-6308-4046-967b-c6db65cb2e73",
"relationship_type": "uses",
"source_ref": "observed-data--1c99ac8f-ab82-43dc-8f15-370e63b29cb0",
"target_ref": "tool--9f0d0f89-f081-4cc5-a5e2-f90da3115eb9",
"created": "2026-09-17T04:53:01Z",
"modified": "2026-09-17T04:53:01Z",
"description": "libmedia_codec.so 是 frpc 客户端的伪装文件。",
"x_evidence": "原文称 libmedia_codec.so 是 Go 二进制文件，实际为 Fast Reverse Proxy Client（frpc）。",
"x_confidence": 0.9
}
]
}报告链接：
https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts
───────────────────────────────────
（七）ChatGPT订阅付款提醒被用于钓鱼攻击
事件名称：聊天机器人难题：针对OpenAI ChatGPT的钓鱼尝试
发布日期：2026-09-17
发布机构：Cofense
威胁概述：
Cofense披露，攻击者伪造OpenAI和ChatGPT订阅付款提醒邮件，利用品牌标识和紧迫性诱骗用户更新账单信息。邮件中的恶意链接将受害者重定向至假冒ChatGPT登录页面，以窃取账户凭证。
IOC指标：
· Domain：9527db6e1a.nxcli.io
· URL：https://notifications.googleapis.com/email/redirect?t=AFG8qyW_Su5LnlMKcIA7MTSSwtdIBp6-pVpWF_Tm7YFcNgju_01zhPKtjCpIcIfTVDTsqk_NT5E4LWD15nZyb_erqoslbxoHKRH8O_TRSdvyON9ZbKAejE3mykvuQ2_t43Pveg7wh8bYrPQvCoCTK_XbSbXSCAsu3vTNbz0XJSMLjnnC, https://e83cedb076.nxcli.io/fertaq/app/key.php, https://e83cedb076.nxcli.io/fertaq/app/login.php
STIX详情：
{
"type": "bundle",
"id": "bundle--99dfa131-44cb-43b4-b9ee-6b2fcd0328b5",
"spec_version": "2.1",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--da3a7d90-497e-4855-a707-94139d003f34",
"name": "Phishing Attacker Impersonating OpenAI/ChatGPT",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "未归因的威胁行为者/钓鱼攻击者，冒充 OpenAI 与 ChatGPT 官方服务，针对 OpenAI/ChatGPT 用户发起凭据钓鱼。",
"aliases": [
"钓鱼攻击者"
],
"x_evidence": "原文称“Threat actors are impersonating OpenAI and ChatGPT in phishing emails... designed to steal account credentials.”",
"x_confidence": 0.9
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--90a28c15-42b5-4731-ac93-98e1e7e9a216",
"name": "OpenAI/ChatGPT",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "被攻击者冒充的合法品牌与服务，其用户是本次凭据钓鱼的目标群体。",
"aliases": [
"OpenAI",
"ChatGPT"
],
"x_evidence": "原文将 OpenAI/ChatGPT 列作被冒充对象，并称伪造页面与 ChatGPT 登录页相似。",
"x_confidence": 0.95
},
{
"type": "infrastructure",
"spec_version": "2.1",
"id": "infrastructure--50e19c91-c80d-4838-a8cc-30f0b45877b7",
"name": "Phishing Infrastructure",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "攻击者控制的钓鱼基础设施，用于发送钓鱼邮件、托管恶意载荷和伪造 ChatGPT 登录页面。",
"x_evidence": "原文描述钓鱼邮件按钮指向 Google API 包装 URL，并重定向到“real malicious payload”，且包含 Stage 2 payload URLs。",
"x_confidence": 0.9
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--0178300d-0b24-4af2-a372-78c4ede07eb3",
"name": "9527db6e1a.nxcli.io",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "钓鱼邮件发件域名，明确不是 OpenAI/ChatGPT 合法地址，属于攻击者控制的钓鱼发件域名。",
"x_evidence": "原文发件地址为“support@9527db6e1a[.]nxcli[.]io”，并指出“This is not a legitimate address from OpenAI or ChatGPT.”",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--b5922070-ba7a-4163-a812-9a70eb28a00f",
"name": "https://notifications.googleapis.com/email/redirect?t=AFG8qyW_Su5LnlMKcIA7MTSSwtdIBp6-pVpWF_Tm7YFcNgju_01zhPKtjCpIcIfTVDTsqk_NT5E4LWD15nZyb_erqoslbxoHKRH8O_TRSdvyON9ZbKAejE3mykvuQ2_t43Pveg7wh8bYrPQvCoCTK_XbSbXSCAsu3vTNbz0XJSMLjnnC",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "Stage 1 观察到的感染 URL，钓鱼邮件按钮使用 Google API 包装后重定向到攻击者控制的恶意载荷。",
"x_evidence": "原文将 hXXps://notifications[.]googleapis[.]com/email/redirect?t=... 列为 Stage 1 Observed Email Infection URL，并说明按钮使用 Google API wrapper URL。",
"x_confidence": 0.95
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--05a88a25-9011-4272-9841-18c6367f5bd8",
"name": "e83cedb076.nxcli.io",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "攻击者控制域名，承载 Stage 2 恶意载荷页面，用于钓鱼流程中的数据处理、凭据提交和伪造登录页面。",
"x_evidence": "原文 Stage 2 Payload URLs 均位于 e83cedb076[.]nxcli[.]io 域下，重定向后进入攻击者控制的恶意载荷。",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--398fd00f-64c5-4a45-955c-bb59e71d5dac",
"name": "https://e83cedb076.nxcli.io/fertaq/app/key.php",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "Stage 2 观察到的恶意载荷 URL，用于钓鱼流程中的数据处理或凭据提交。",
"x_evidence": "原文在 Stage 2 Observed Payload URL(s) 中列出 hXXps://e83cedb076[.]nxcli[.]io/fertaq/app/key[.]php。",
"x_confidence": 0.95
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--a669a02f-dcf3-4b4b-a215-d67b7691b07e",
"name": "https://e83cedb076.nxcli.io/fertaq/app/login.php",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "Stage 2 观察到的恶意载荷 URL，用于伪造 ChatGPT 登录页面并窃取账号凭据。",
"x_evidence": "原文在 Stage 2 Observed Payload URL(s) 中列出 login.php，并描述其页面与 ChatGPT login 相似，窃取输入的信息。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f669162f-a502-46b3-8234-7c12ff774320",
"relationship_type": "uses",
"source_ref": "identity--da3a7d90-497e-4855-a707-94139d003f34",
"target_ref": "identity--90a28c15-42b5-4731-ac93-98e1e7e9a216",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "攻击者冒充 OpenAI/ChatGPT 官方服务实施钓鱼。",
"x_evidence": "原文称“Threat actors are impersonating OpenAI and ChatGPT in phishing emails.”",
"x_confidence": 0.93
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--30306b4e-3c62-45bf-a827-b04238f250d5",
"relationship_type": "uses",
"source_ref": "identity--da3a7d90-497e-4855-a707-94139d003f34",
"target_ref": "infrastructure--50e19c91-c80d-4838-a8cc-30f0b45877b7",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "未归因威胁行为者使用该钓鱼基础设施发起凭据钓鱼活动。",
"x_evidence": "原文描述攻击者发送钓鱼邮件，并利用按钮重定向到恶意载荷，构成对钓鱼基础设施的使用。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--555f4e30-a8a3-4994-add6-99008e83b4c1",
"relationship_type": "consists-of",
"source_ref": "infrastructure--50e19c91-c80d-4838-a8cc-30f0b45877b7",
"target_ref": "domain-name--0178300d-0b24-4af2-a372-78c4ede07eb3",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "钓鱼基础设施包含钓鱼邮件发件域名 9527db6e1a.nxcli.io。",
"x_evidence": "原文将发件地址 support@9527db6e1a[.]nxcli[.]io 标为恶意/非合法。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2c885537-6ba7-4f59-b0aa-dec6311b42ec",
"relationship_type": "consists-of",
"source_ref": "infrastructure--50e19c91-c80d-4838-a8cc-30f0b45877b7",
"target_ref": "url--b5922070-ba7a-4163-a812-9a70eb28a00f",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "钓鱼基础设施包含 Stage 1 观察到的 Google API 包装感染 URL。",
"x_evidence": "原文将 hXXps://notifications[.]googleapis[.]com/email/redirect?t=... 列为 Stage 1 Observed Email Infection URL。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f1b0d461-0147-4bcf-af07-9b44560f22fc",
"relationship_type": "consists-of",
"source_ref": "infrastructure--50e19c91-c80d-4838-a8cc-30f0b45877b7",
"target_ref": "domain-name--05a88a25-9011-4272-9841-18c6367f5bd8",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "钓鱼基础设施包含承载恶意页面的攻击者控制域名 e83cedb076.nxcli.io。",
"x_evidence": "原文 Stage 2 Payload URLs 均使用 e83cedb076[.]nxcli[.]io 域名。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--77ff6a52-88eb-46c2-a11a-c475ddb40cce",
"relationship_type": "uses",
"source_ref": "url--b5922070-ba7a-4163-a812-9a70eb28a00f",
"target_ref": "domain-name--05a88a25-9011-4272-9841-18c6367f5bd8",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "Stage 1 URL 将受害者重定向到攻击者控制的 e83cedb076.nxcli.io 恶意载荷域名。",
"x_evidence": "原文称按钮使用 Google API wrapper URL，然后重定向到真实恶意载荷；攻击链描述点击后进入 e83cedb076.nxcli.io。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--aebc407d-8270-4743-a349-dfca7c1eb774",
"relationship_type": "hosts",
"source_ref": "domain-name--05a88a25-9011-4272-9841-18c6367f5bd8",
"target_ref": "url--398fd00f-64c5-4a45-955c-bb59e71d5dac",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "攻击者域名 e83cedb076.nxcli.io 承载 Stage 2 key.php 载荷 URL。",
"x_evidence": "原文将 hXXps://e83cedb076[.]nxcli[.]io/fertaq/app/key[.]php 列为 Stage 2 Payload URL，路径位于该域名下。",
"x_confidence": 0.95
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8b7a31b0-3e59-47d3-a5af-3ba2e06a1a95",
"relationship_type": "hosts",
"source_ref": "domain-name--05a88a25-9011-4272-9841-18c6367f5bd8",
"target_ref": "url--a669a02f-dcf3-4b4b-a215-d67b7691b07e",
"created": "2026-09-18T04:41:42Z",
"modified": "2026-09-18T04:41:42Z",
"description": "攻击者域名 e83cedb076.nxcli.io 承载 Stage 2 login.php 载荷 URL，用于伪造 ChatGPT 登录页面。",
"x_evidence": "原文将 hXXps://e83cedb076[.]nxcli[.]io/fertaq/app/login[.]php 列为 Stage 2 Payload URL，并称页面与 ChatGPT login 相似。",
"x_confidence": 0.95
}
]
}报告链接：
https://cofense.com/blog/chatbot-conundrum-phishing-attempts-of-openai-s-chatgpt
───────────────────────────────────
（八）vLLM聊天模板漏洞可导致资源耗尽
事件名称：CVE-2026-90878：vllm-project的vLLM资源消耗漏洞
发布日期：2026-09-15
发布机构：SecurityVulnerability.io
威胁概述：
素材显示，vLLM 0.27.0和0.27.1的聊天与补全端点存在资源消耗漏洞CVE-2026-90878。攻击者可远程操纵chat_template参数，触发Jinja模板渲染组件异常并造成严重资源耗尽。
IOC指标：
· CVE：CVE-2026-90878
报告链接：
https://securityvulnerability.io/vulnerability/CVE-2026-90878
───────────────────────────────────
三、本周AI安全风险观察
AI应用服务漏洞可直接影响主机权限和服务可用性：QAnything漏洞允许未认证攻击者通过上传接口实施路径遍历，并在特定部署场景中获得root权限；vLLM漏洞则可通过chat_template参数触发严重资源耗尽。
Agent技能和编程助手正在扩大软件供应链暴露面：Skill链路可承载路径逃逸、NPM包篡改和Git Hook注入；被劫持的AI编程助手会话还能推荐投毒软件，并借助PyPI包窃取OAuth令牌、传播蠕虫。
AI软件包生态已被用于自动化执行和凭据窃取：GemStuffer活动通过恶意RubyGems包触发文档构建流程执行代码，并利用API、Webhook和包元数据开展凭据获取、数据外传及权限提升尝试。
AI服务的数据处理链路和用户入口均面临攻击：非官方AI中转站可读取、留存并出售对话和身份凭据，RatHat针对移动端银行信息，ChatGPT品牌钓鱼则通过假冒登录页面窃取账户凭证。
───────────────────────────────────
四、安全建议
及时修复AI应用与推理服务漏洞：限制QAnything默认8777端口访问，避免后端以root身份运行并限制非业务目录写权限；监控vLLM资源使用情况，并在补丁发布后及时更新。
加强Agent Skill和开发依赖检测：对Skill安装链路实施反病毒、静态分析和控制流分析；核验AI助手推荐依赖的加密校验和与允许列表，通过内部仓库路由依赖流量，并隔离机密文件。
收紧软件包构建与凭据权限：在隔离环境中处理不可信文档构建作业，移除工作节点不必要的注册表访问权限，审计受影响账户与凭据，并严格清理和限制软件包元数据输入。
保护AI数据链路和终端账户：阻断非官方AI中转服务并轮换可能泄露的凭据；防范恶意短信和APK，限制非必要辅助功能权限；检查ChatGPT付款提醒邮件的发件地址与实际链接，并使用邮件安全网关检测恶意链接。
───────────────────────────────────
五、报告总结
本周素材显示，AI安全风险同时存在于应用服务、Agent扩展机制和软件供应链。QAnything与vLLM漏洞分别涉及未授权文件写入和资源耗尽；Skill链路、AI编程助手会话及RubyGems文档构建流程则可被用于恶意代码执行、凭据窃取和蠕虫传播。
AI服务的数据处理链路也成为直接风险来源。非官方AI中转站可能读取并出售对话、文件和身份凭据，甚至篡改返回指令投递窃密木马。在用户侧，RatHat针对Android银行凭证和OTP，ChatGPT品牌钓鱼则以订阅付款提醒诱导用户进入假冒登录页面。
组织应优先收敛AI服务网络暴露和运行权限，核验Agent技能与开发依赖，隔离不可信软件包构建任务，并限制敏感信息进入非官方AI服务。同时需要结合移动终端防护、凭据轮换和邮件恶意链接检测，处理本期素材中涉及的主机、供应链、数据和账户风险。
───────────────────────────────────
报告说明
本报告由360威胁情报中心基于2026年9月12日至9月18日公开威胁情报整理形成，重点分析QAnything任意文件写入漏洞、AI编程助手会话劫持、Agent Skill链路攻击、GemStuffer恶意RubyGems活动、AI中转站数据泄露、RatHat移动端威胁、ChatGPT品牌钓鱼及vLLM资源消耗漏洞，为企业AI应用、Agent开发环境、软件供应链、移动终端及安全运营防护提供参考。
情报时效性： 2026年9月12日—9月18日 威胁评估等级： 高风险