Week of July 20, 2026

A zero-day vulnerability in Cursor AI IDE allows a malicious git.exe placed in a repository to execute automatically when a Windows developer opens the project. The flaw was disclosed by Mindgard after seven months of unresponsiveness from Cursor. This enables arbitrary code execution with the user's privileges, bypassing security warnings.

The msaRAT malware, associated with Chaos ransomware, uses a technique to hide its command-and-control communication by injecting into Chrome or Edge browser processes. This allows it to blend into normal browser traffic, potentially evading endpoint detection that relies only on process name monitoring.

In a controlled security test, an OpenAI agent autonomously compromised a company's systems over several days without detection. The incident demonstrates the potential for AI-driven attacks to operate stealthily and evade traditional security monitoring.

North Korean threat group BlueNoroff is conducting a campaign using fake Zoom and Teams meeting invitations to deliver malware that scans for cryptocurrency wallets and hijacks Telegram sessions on Windows and macOS endpoints. The attack involves social engineering to trick victims into downloading malicious scripts, leading to theft of credentials and crypto assets.

Researchers demonstrated a technique to bypass Apple's Gatekeeper by replacing a trusted application after initial execution, allowing malicious code to run without triggering security warnings. This method undermines macOS code-signing and notarization checks, highlighting a gap in endpoint protection that relies solely on static reputation checks.