A fake Web3 accelerator used malicious npm packages to drop stealers on macOS and Windows and reroute AI coding agent traffic to its servers. Related Posts: Ledger Supply Chain Attack Hits Europe via Tampered Wallets AI Agent Attack Turns One Exposed Endpoint Into a Full Server Takeover in Under 24 Hours Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data The post Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents ap

Plugin4Shell is a zero-click RCE hitting every major AI coding agent via a SHA pinning bypass. Claude Code and Codex are patched; Copilot and Gemini CLI are not. Related Posts: FomoPeek App Hides an iOS Kernel Exploit to Steal Crypto Critical IBM Guardium Vulnerabilities Need Immediate Patching Critical MongoDB Driver Vulnerabilities Require Immediate Patching The post Plugin4Shell: Zero-Click RCE Hits Four AI Coding Agents appeared first on Daily CyberSecurity.