ThreatsDay Bulletin: Stealth Loaders, AI Chatbot Flaws AI Exploits, Docker Hack, and 15 More Stories

ThreatsDay Bulletin for 25 December 2025 surveys a landscape where attackers blend into everyday tools, trusted apps and AI assistants, rather than shouting for attention. The roundup highlights Stealth Loaders, AI chatbot flaws, Docker prompt-injection risks, and a raft of other campaigns that rely on open-source tools, misused interfaces, and social engineering.

Notable items include the Docker patch for Ask Gordon prompt injection, and a campaign using a commodity loader to distribute multiple malware families such as PureLogs, XWorm and Remcos RAT, distributed via weaponised Office documents and ZIPs. The bulletin also notes weaknesses in AI-driven chat systems, AI exploits in blockchain, and a new Artemis operation linked to RokRAT, with analysis from Genians and others.

According to Pen Test Partners, Eurostar’s AI chatbot vulnerabilities illustrate how old web and API weaknesses persist even when a large language model is in the loop. The coverage concludes with a reminder that the most serious threats often hide in routine interactions and trusted tooling.