The Watch

Three fires. Patching closes none of them cleanly. Two carry compromise windows that predate your patch. jscrambler first: the operator moved from preinstall hooks to import-time self-execution in 8.18.0 and 8.20.0. The reason is scanner evasion. The payload is a Rust infostealer after build-agent tokens, cloud keys and secrets. Socket flagged 8.14.0 in six minutes. Weekly dependency scans do not.

Joomla next. iCagenda (CVE-2026-48939, CVSS 10/10) is an unauthenticated file-upload RCE. Automated mass exploitation has run since June 15. That is a month of web-shell runway, and it runs alongside the Balbooa Forms anonymous-upload RCE. Zimbra's Classic Web Client adds a crafted-email RCE that fires on view.

For jscrambler and Joomla, work from assume-compromise. Purge-and-pin the npm package. Rotate every credential reachable from the affected pipelines. That is the remediation. Patch Joomla, then hunt the upload directories for shells. The patch shuts the door. It does not evict a resident.

The actor is FSB-linked. The scope is what matters: pre-positioning across defense, energy, finance, government and healthcare using Cisco Smart Install and in-the-box credentials. The entry point is network gear nobody scans. Smart Install, enabled and internet-reachable, hands over configuration access without authentication. It ships enabled by default. It is rarely disabled.

Two CVEs anchor the campaign. The age gap tells the story.

The advisory flags credential monitoring, not just scanning. That is the tell: the 13 governments behind it expect existing footholds. Two data points support that reading. The EU attributed the December 2025 Poland energy-grid attack to this group. The UK sanctioned 24 Russia-linked individuals in July 2026. This is pre-positioning with intent, not opportunistic scanning.

Treat it as a configuration audit, not a patch cycle. The fix is a settings change on gear already owned. There is no budget excuse. Hunt device auth logs for anomalous logins before assuming the config change closed the door. If Smart Install was reachable, assume it was found.

Start with the named case. xAI's Grok Build CLI uploaded entire repositories — private source, hardcoded secrets — to a Google Cloud bucket. The vendor response was a /privacy command to disable retention. That is an admission: non-ZDR users had their full repos synced. Delete-after-the-fact does nothing for harvested keys. rotation, not deletion is the only response that matters. We said the same thing about every exposed-credential incident last quarter, and the finding was the same then: attackers copy first.

Grok Build is a category warning, not an outlier. Claude Code transmits roughly 33k tokens of context before a prompt runs. OpenCode transmits 7k. Token volume is a proxy for how much of the codebase leaves the perimeter per invocation. Codex is past 7M users. 62% of leaders ship AI code without line-by-line review. These agents are already deployed at scale, sanctioned or not.

The sharper item is a disclosed flaw across Amazon, Anthropic, Google and Cursor. The agent can present false information to the human approver. That collapses the human-in-the-loop control most AI governance leans on. Four vendors hit at once points to a shared design pattern, which means swapping vendors likely does not close it. The working control: verify any AI-generated merge against the raw git diff and CI logs. Those are artifacts the agent cannot doctor. Its own summary is not.

The through-line is one we have flagged on this beat since the first coding-agent rollouts. These are privileged, autonomous actors with broad read access and an outbound pipe to third parties. Most SOCs have zero detection engineering pointed at them. It is also a live GDPR and SOC 2 data-residency finding waiting to be written.

Two detection heuristics failed this cycle. Neither carries a CVE. ChatGPT's voice mode now produces conversational fillers — ums, likes, ohs — and GPT-Live runs full-duplex with natural cadence. Years of awareness training told help-desk and finance staff to listen for robotic pacing. That tell is now actively misleading. Real-time detection of voice-cloned CEO fraud, MFA-reset pretexting and help-desk impersonation gets harder from here.

On documents, GenAI forges payslips, bank statements and tax records that pass standard income verification. This is operating at fraud-ring scale. Australian banks are probing billions in suspected fraudulent loans. When forgery is instant and indistinguishable to legacy OCR, an uploaded document is no longer a trust anchor.

The correction for both is to trust the source, not the artifact. For voice, that means out-of-band, non-voice verification — callback to a known number, signed ticket, or app-based approval — for any sensitive request, with voice-only approval paths removed. For documents, migrate identity, income and asset verification to consent-based source feeds: payroll aggregators, open banking, government data, instead of uploads. Both are quarter-scale programs. The training fix is same-day. The 'listen for a robotic voice' guidance is now a liability in every script that still carries it.