The Week Malware Wore a Friendly Face: Fake Extensions, Poisoned Packages and an Image That Talked to an AI
The payload wasn't the story this week. The disguise was.
Key points
- A malicious software package quietly stole data from developers who installed it, exposing how open-source supply chains are a soft target.
- A fake browser extension gave attackers remote access to victims' machines by mimicking a tool users already trusted.
- An Android app marketed as a personal safety utility was found harvesting data from the phones it claimed to protect.
- Researchers demonstrated an image carrying hidden instructions that an AI assistant read and obeyed, a technique called prompt injection.
- Open industrial systems and weak code rounded out the week's threats.
Most of this week's trouble didn't kick the door in. It knocked politely, holding a clipboard.
That's the thread running through the latest ThreatsDay roundup from The Hacker News. Attackers keep winning by looking useful: a code library, a browser add-on, a safety app, even a picture file.
What actually happened this week?
Several separate incidents, all built on disguise. A software package uploaded to a public code repository stole data from developers who installed it. A browser extension pretending to be a helpful tool opened a remote back door on victims' computers. An Android app sold as a personal safety utility was caught spying on its users. Researchers then showed an image file that, when fed to an AI agent, secretly told the AI what to do.
Different targets. Same trick. Wear the uniform, walk past the guard.
Why does a poisoned package matter to me?
The apps on your phone, the websites you bank with and the software your employer runs are almost all built partly from free, shared code written by strangers. Developers pull these building blocks, called packages, from public libraries the way a baker buys flour.
Slip a bad bag of flour into the warehouse, and every loaf downstream is suspect. That's what a poisoned package attack is. The developer who installs it might not notice a thing, and later the product they ship can be quietly rifled.
This isn't a new idea. It's the software version of tampering with a factory supply chain. What has changed is how routine it has become.
The fake extension and the fake safety app
Browser extensions sit inside your browser with permission to read what you type and see what you visit. A legitimate one is convenient. A malicious lookalike is a keylogger with a friendly icon.
We've tracked this pattern across 14 browser-extension stories since June, including our 13 July report on the ModHeader add-on pulled from Chrome and Edge after a hidden history collector was found inside it. The recurring lesson: store listing and icon are not a guarantee.
The Android safety app is the crueller version of the same joke. People installed it because they wanted to feel safer, and it collected their data instead. If you've downloaded an app that promised protection or location sharing, check the developer name, the reviews and the permissions it requested. An alarm app that wants your microphone and full contacts list deserves a second look.
An image that gave orders to an AI
This one's the headline-grabber, and it deserves a plain explanation. Modern AI assistants can look at pictures and act on what they see. Researchers showed that an attacker can hide instructions inside an image that the AI reads and obeys, while a human looking at the same image notices nothing.
Security people call this prompt injection. It's the AI-era cousin of cross-site scripting, an old web attack where a site is tricked into running code smuggled in by a visitor. Same shape of problem: the system can't tell data from commands. With 87 prompt-injection stories in our last 90 days of coverage, this isn't an emerging niche anymore; it's a standing category of risk.
The practical danger lands on people using AI agents that can open links or process files on their behalf. If your AI can act, an attacker only needs to whisper.
Should you worry?
Yes, proportionately. Stick to official app stores, and even there, read the permissions. Be wary of browser extensions you didn't go looking for. Treat anything an AI assistant fetches from the internet the way you'd treat an email from a stranger: possibly useful, not automatically trusted.
The disguises are getting better. Watching how they're built is the only way to start seeing through them.
