AI Weekly Malaysia

This ThreatsDay roundup argues the week's attacks came from ordinary-looking operations that do more than expected: a model inspection step that can execute code, a cache that can mix up requests, and public secrets that stay usable for years. The concrete items given are OFAC sanctioning 10 targets tied to a Tren de Aragua ATM jackpotting scheme using Ploutus malware, with $40.73 million in reported losses across more than 1,500 U.S. attacks, and roughly $6.1 million in inflows to seven designated crypto wallets since March 2022. It also notes EtherHiding, where actors hide malware instructions on public blockchains so they cannot easily be seized or taken down, plus a claim of 543K live secrets and a model-inspection RCE that the excerpt does not name or detail.

Why: Two of the listed items sit directly in AI and dev workflows: 'a model check can run code' means loading or inspecting third-party model artifacts is a code-execution decision, not a read-only one, and 543K live secrets implies leaked keys stay valid long after the leak. The excerpt does not name the affected tool, CVE, or vendor, so you cannot patch from this alone - treat it as a prompt to check whether your model-loading path uses safe formats and whether your own repos are still leaking usable credentials. The ATM jackpotting and sanctions items have no practical bearing on most builders in this audience.