Loading story…
Researchers disclosed multiple serious security issues affecting AI tooling, led by critical vulnerabilities in Ollama that can expose systems and data. Wiz reported CVE-2024-37032 (Probllama), an easy-to-exploit remote code execution flaw caused by improper validation of model manifests from private registries, allowing path traversal, arbitrary file read/write, and code execution—especially in Docker deployments running as root and listening on 0.0.0.0 without authentication. A separate disclosure described CVE-2026-7482 (Bleeding Llama), which can leak heap memory through Ollama’s GGUF model creation and quantization workflow and exfiltrate the resulting artifact via the /api/push endpoint, while CVE-2026-42248 and CVE-2026-42249 affect the Windows updater and can be chained for persistent code execution through missing signature checks and unsafe ETag handling.
The disclosures landed alongside a software supply chain incident on Hugging Face, where a malicious repository impersonating OpenAI’s Privacy Filter reportedly climbed to the platform’s trending list and drew more than 240,000 downloads before removal. The fake package used cloned documentation and likely inflated engagement metrics to appear legitimate, then delivered a multi-stage Windows infection that gained SYSTEM-level persistence, disabled security controls, and deployed the Rust-based stealer sefirah to collect wallet data, Discord tokens, developer credentials, browser secrets, screenshots, and sensitive files for exfiltration. Together, the incidents show how exposed AI infrastructure, weak authentication defaults, and trust in popular model and code repositories are creating high-impact attack paths; defenders were urged to upgrade Ollama to fixed versions, avoid direct internet exposure, use authenticated reverse proxies, and scrutinize third-party AI packages before deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Analysis of the campaign found infrastructure overlaps with prior ValleyRAT/Winos 4.0 activity associated with the Silver Fox threat group. The findings suggested an expansion of software supply chain attacks into the AI and machine learning ecosystem.
The fake repository was found to deploy a multi-stage Windows infection that established SYSTEM-level persistence, disabled security controls, and installed a Rust-based stealer called “sefirah.” The malware stole wallet data, Discord tokens, developer credentials, browser secrets, screenshots, and sensitive files for exfiltration to attacker-controlled infrastructure.
A malicious Hugging Face repository impersonating OpenAI’s Privacy Filter reportedly reached the platform’s trending list and amassed more than 240,000 downloads before removal. The project used cloned documentation and likely inflated engagement metrics to appear legitimate.
Striga and CERT Polska disclosed CVE-2026-42248 and CVE-2026-42249 affecting the Ollama Windows desktop updater, where missing signature verification and unsafe ETag handling could be chained for persistent code execution via the Startup folder. The issues were reported as still unpatched more than 90 days after disclosure, and users were advised to disable auto-updates and update manually.
A vendor fix was made available for CVE-2026-7482, with guidance to upgrade to at least Ollama v0.23.2; versions below 0.17.1 were described as vulnerable. The disclosure noted that widespread unauthenticated internet exposure increased the flaw’s potential impact.
Researchers disclosed CVE-2026-7482, nicknamed “Bleeding Llama,” a flaw in Ollama’s GGUF model creation and quantization pipeline that enables unauthenticated heap memory exfiltration and artifact exfiltration via the /api/push endpoint. The issue could reportedly be exploited in as few as three HTTP requests.
Wiz published technical details for CVE-2024-37032 and reported finding more than 1,000 internet-exposed Ollama servers, many without authentication and hosting numerous models, including private ones. The disclosure also recommended avoiding direct internet exposure and using authenticated reverse proxies.
After responsible disclosure, Ollama quickly fixed the Probllama vulnerability and advised users to upgrade to version 0.1.34 or newer. The risk was especially severe for Docker deployments running as root and listening on 0.0.0.0 by default.
Wiz Research identified CVE-2024-37032, dubbed “Probllama,” an input-validation flaw in Ollama’s model manifest handling that could lead to path traversal, arbitrary file read/write, and remote code execution. The issue was responsibly disclosed to Ollama before public release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcethecybersecguru.com
Open sourcewiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers running a global honeypot network reported active scanning and exploitation of Internet-facing AI inference and agent services, including **Ollama**, **LiteLLM**, **OpenClaw**, and **LangServe**. Attackers first profiled exposed endpoints to identify available models and capabilities, then exploited recently disclosed **LiteLLM** flaws to gain remote code execution and steal environment variables and access tokens. Between March and May 2026, three separate operators were observed taking over exposed Ollama and LiteLLM instances and repurposing them for offensive activity, including use of **Strix**, **HexStrike**, and an **OpenAI Codex** agent configured to suppress safety refusals. The compromised AI infrastructure was then used as backend capacity for attacks against downstream victims, while the exposed services also served as a source of stolen credentials and tokens. Researchers said they blocked attempted attacks on live targets and privately notified affected parties, warning that unauthenticated AI endpoints are now being abused both for credential theft and as operational infrastructure for malicious campaigns.
Jul 6, 2026
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026