ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
- ID
- 28237
- Status
- summarized
- Published
- 25 Sep 2026, 1:52 AM
- Fetched
- 25 Sep 2026, 3:17 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.0
- Created
- 25 Sep 2026, 3:18 AM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
The Hacker News' weekly ThreatsDay roundup leads with RemControl, a previously undocumented Android banking trojan first observed in July 2026 that targets retail banking customers in Italy, France, Spain, Poland, Portugal, the Middle East and Canada, spread through fake Google Play pages impersonating the TVTap IPTV app and Meta ads, abusing Android's Accessibility Service for overlay phishing, screen streaming and full remote control, with C2 resolved through an encrypted Telegram dead-drop. Group-IB notes the operator panel docs and phishing overlays carry artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page. The roundup also flags that Z.ai disabled several features of its ZCode coding assistant after a default setting (the excerpt cuts off here), alongside items on AI search poisoning and one-click code execution.
Why it matters
The ZCode item is the one that touches your own stack: an AI coding assistant shipped a default that leaked repositories, so anyone using cloud-indexed coding assistants should check what those tools upload or index by default before assuming it's opt-in. The RemControl detail is a reminder that AI-assisted output now shows up in attacker infrastructure too, but it concerns Android banking users in specific regions, not the tooling this audience builds with — no Malaysia-specific angle appears in the text.
Discussion angle
The ZCode excerpt is truncated right at 'after a default setting' — pull the full story before the meet and ask: which AI coding assistants in your team's stack index or upload repo contents by default, and would you have noticed if one started?