BragJack Lets Malicious Extensions Hijack Browser AI Assistants

SecurityWeek’s roundup highlights several developments involving ransomware, AI systems, supply chains and critical infrastructure. ShinyHunters claimed to have taken over Cl0p’s Tor leak site and stolen server logs, source code and private onion-service keys, demanding an eight-figure payment and a public apology. Researchers at Forever disclosed BragJack, flaws allowing malicious browser extensions to control built-in AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome.

Depending on the browser, attackers could read emails, access local files, capture screenshots or activate cameras and microphones without user interaction.

A malicious supply-chain implant called sckit was found in compromised MemTensor packages on npm and PyPI, including an OpenClaw plugin. It searches for developer and cloud secrets and contains mechanisms for spreading through package repositories and GitHub Actions, although Semgrep reported no evidence of propagation.

SpyCloud found infostealer exposure at 1,787 US water and wastewater organisations, with OT or remote-access credentials linked to 258; it stressed that these were potential access paths, not confirmed intrusions. Other findings included nearly 11,000 AI relay servers obscuring users connecting to Western model providers, and Cisco Talos’ CLOSEDQUORUM implant, which uses commercial LLMs to choose actions, though its use in the wild has not been confirmed.

The roundup also covers CARBONATO, a Docker botnet targeting unauthenticated daemons on port 2375 and prioritising AI API keys; Android banking trojan RemControl, targeting customers of more than 30 banks; and CVE-2026-42542, a pre-authentication denial-of-service flaw in TDengine versions 3.4.0.0 to 3.4.1.5. TDengine 3.4.1.6 fixes the vulnerability. Canonical said it will move to weekly kernel releases and provide workarounds or hardening guidance within 24 to 48 hours of public disclosure.