Ankura CTIX FLASH Update – July 2, 2026

Malware Activity

AI and Open-Source Supply Chains Become New Targets for Developer-Focused Attacks

Recent research highlights a growing trend in which threat actors are abusing trusted development tools, automation, and open-source ecosystems to compromise software developers and gain access to valuable systems. In one proof-of-concept attack, researchers demonstrated how AI coding assistants can be manipulated into executing malicious commands hidden behind seemingly legitimate GitHub projects, allowing attackers to gain remote access without placing malware directly in the repository. At the same time, cybersecurity researchers uncovered hijacked npm and Go packages that leveraged automatically executed Visual Studio Code tasks to deploy malware disguised as harmless project files. These attacks use deceptive techniques such as fake setup instructions, hidden payloads, blockchain-based command retrieval, and fraudulent job recruitment themes to bypass traditional security