The Week Malware Wore a Friendly Face: Fake Extensions, Poisoned Packages and an Image That Talked to an AI

Key points

• A malicious software package quietly stole data from developers who installed it, showing again how open-source supply chains are the soft underbelly of modern software.
• A fake browser extension gave attackers remote access to victims' machines, mimicking a legitimate tool users trusted.
• An Android app marketed as a safety utility was found behaving as spyware, harvesting data from the phones it was meant to protect.
• Researchers demonstrated a picture that carried hidden instructions to an AI assistant, a technique known as prompt injection.
• Weak code, exposed industrial systems and ordinary-looking network traffic rounded out the week's threats.

Most of this week's trouble did not kick the door in. It knocked politely, holding a clipboard.

That is the thread running through the latest ThreatsDay roundup from The Hacker News, and it is worth pulling on. Attackers keep winning by looking useful. A code library. A browser add-on. A safety app. Even a picture file.

What actually happened this week?

Several separate incidents, all built on disguise. A software package uploaded to a public code repository stole data from developers who installed it. A browser extension pretending to be a helpful tool opened a remote back door on victims' computers. An Android app sold as a personal safety utility was caught spying on its users. And researchers showed an image file that, when fed to an AI agent, secretly told the AI what to do.

Different targets. Same trick. Wear the uniform, walk past the guard.

Why does a poisoned package matter to me?

Because the apps on your phone, the websites you bank with and the software your employer runs are almost all built partly from free, shared code written by strangers. Developers pull these building blocks, called packages, from public libraries the way a baker buys flour.

If someone slips a bad bag of flour into the warehouse, every loaf downstream is suspect. That is what a poisoned package attack is. The developer who installs it might not notice a thing. Their laptop, and later the product they ship, can be quietly rifled.

This is not a new idea in security. It is the software version of tampering with a factory supply chain. What is new is how routine it has become.

The fake extension and the fake safety app

Browser extensions sit inside your browser with permission to read what you type and see what you visit. A legitimate one is convenient. A malicious lookalike is a keylogger with a friendly icon.

The Android safety app is the crueller version of the same joke. People installed it because they wanted to feel safer. It collected their data instead. If you have downloaded any app recently that promised personal safety, panic buttons or location sharing, check the developer name, the reviews and the permissions it asked for. If it wants your microphone and contacts to sound an alarm, something is off.

An image that gave orders to an AI

This one is the headline-grabber, and it deserves a plain explanation. Modern AI assistants can now look at pictures and act on what they see. Researchers showed that an attacker can hide instructions inside an image, invisible or near-invisible to a human, that the AI reads and obeys.

Security people call this prompt injection. It is the AI-era cousin of an old web attack called cross-site scripting, where a website is tricked into running code smuggled in by a visitor. Same shape of problem: the system cannot tell data from commands.

For now, the risk lands mostly on people using AI agents that browse the web, read email or process files on their behalf. If your AI can act, an attacker only needs to whisper.

What can ordinary people do?

Stick to official app stores, and even there, read the permissions. Be wary of browser extensions you did not go looking for. If you use an AI assistant that can open links or read attachments, treat anything it fetches from the internet the way you would treat an email from a stranger. Useful, maybe. Trusted, no.

The threats change every week. The disguises are the interesting part.