Weekly Cybersecurity Roundup: AI-Targeted Malware, Supply Chain Attacks, and Major Crypto Convictions

SecurityWeek’s weekly cybersecurity news roundup offers a concise yet comprehensive overview of vital developments that may not receive full standalone coverage, yet remain profoundly relevant to the broader threat landscape. As the digital ecosystem expands and adversaries adopt increasingly sophisticated techniques, staying informed about shifting tactics across various sectors is paramount for security professionals, enterprise leaders, and defenders alike.

This curated summary highlights key stories spanning vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers navigate the evolving cybersecurity environment. From novel botnets leveraging artificial intelligence services to landmark prison sentences for dark web operators and crypto hackers, this week’s developments underscore the relentless nature of modern cyber threats and the ongoing efforts by global law enforcement and security researchers to mitigate them.

PoeLLM Malware Finds Its C&C Server Hidden in a GitHub Poem

Among the most intriguing emerging threats detailed this week, Black Lotus Labs published an extensive analysis of PoeLLM, a novel malware active since at least April 2026. This sophisticated threat specifically targets exposed artificial intelligence and open-source services—primarily focusing on LiteLLM, Ollama, Gotenberg, and Gitea—with the primary objectives of mining cryptocurrency and systematically expanding a malicious botnet.

What sets PoeLLM apart is its unique command-and-control (C&C) infrastructure. Infected machines extract four specific keywords from a poem hosted publicly on GitHub and dynamically convert them into the IP address of the current C&C server. This clever mechanism allows the operator to switch servers effortlessly simply by altering those words in the repository. According to threat intelligence assessments, the operator behind the campaign is believed to be Italian-speaking, and they have already updated the poem 11 times to cycle their infrastructure, demonstrating a high degree of operational security and adaptability.

GhostAction Secret Theft Spreads to 772 More GitHub Repositories

Supply chain security remains a critical concern for software developers, as highlighted by a recent update from GitGuardian regarding the GhostAction campaign. Between August 31 and September 30, the threat actor behind GhostAction pushed its secret-stealing GitHub Actions workflow to 772 additional public repositories, affecting 373 distinct users and organizations.

The campaign systematically targeted 2,577 sensitive secrets, including vital SSH keys as well as database, AWS, and Azure credentials. While the attackers utilized a new exfiltration server for this latest wave, researchers noted that they heavily reused their 2025 playbook. GitGuardian’s comprehensive data indicates that this destructive supply chain campaign never truly stopped, continuously probing and exploiting automated workflows to harvest organizational credentials.

Jury Convicts Uranium Finance Hacker Over Multi-Million Dollar Exploits

In a significant legal victory for federal prosecutors and the cryptocurrency community, a federal jury has convicted 36-year-old Jonathan Spalletta of Maryland on charges of computer fraud and money laundering. The conviction stems from two devastating 2021 hacks targeting decentralized cryptocurrency exchange Uranium Finance.

Spalletta exploited severe smart contract flaws to siphon roughly $1.4 million in the initial attack, followed by a staggering $53.3 million in a secondary exploit that ultimately forced the exchange to shut down operations permanently. Following the thefts, he laundered the stolen funds through a complex series of cryptocurrency transactions involving privacy-enhancing services like Tornado Cash. He then used the illicit proceeds to purchase high-value collectibles, including rare Pokémon and Magic: The Gathering cards alongside antique Roman coins. Spalletta now faces up to 10 years in prison on the fraud count and an additional 20 years on the money laundering count.

CISA Narrows Cyber Retention Pay Criteria Following Review

In policy news, the Cybersecurity and Infrastructure Security Agency (CISA) has announced that it will maintain its Cybersecurity Retention Incentive program—which provides bonuses worth up to 25% of base salary—through fiscal year 2027. However, the agency is tightening the qualifying criteria significantly.

Under the overhauled guidelines, staff members must hold an "exceeds expectations" performance rating or higher and spend at least 51% of their working time performing dedicated cyber duties within one of three designated job series. Personnel outside of those specific series who spend 75% or more of their time on cyber work will now be required to apply through a formal review board. This strategic adjustment follows a Department of Homeland Security inspector general finding that the previous retention program had been mismanaged and applied far too broadly across the agency.

Coalition Maps Out Proposed CISA Directive for Federal OT Security

Addressing critical infrastructure vulnerabilities, the Operational Technology Cybersecurity Coalition (OTCC) has published a detailed proposal outlining what a CISA Binding Operational Directive (BOD) focused exclusively on operational technology (OT) within federal civilian agencies should require. Federal civilian agencies currently rely on more than 8,000 General Services Administration-managed facilities that incorporate complex building automation, power management, HVAC, and physical access control systems.

To secure these environments, the coalition urges that any upcoming directive mandate agencies to designate a specific senior official or dedicated office fully accountable for OT security. Furthermore, the proposal recommends that agencies strictly apply relevant existing requirements and prioritize CISA’s established Cybersecurity Performance Goals to protect vital federal facilities from physical and digital compromise.

Domino’s Resets Customer Accounts Hijacked via Credential Stuffing

Consumer-facing brands continue to grapple with automated credential abuse. Fast-food giant Domino’s recently began notifying a small group of customers that their online accounts had been accessed by unauthorized third parties.

The attackers utilized a credential stuffing technique, leveraging email and password pairs that had been leaked in unrelated, third-party data breaches. Domino’s emphasized that its internal corporate systems were not compromised during the incident and that the company does not store customer payment details on its platform. As a precautionary measure, the company has successfully forced password resets on all affected accounts to prevent further unauthorized access.

AI Under Scrutiny as South Korea Probes Major Bank Cyberattacks

Artificial intelligence is facing intense scrutiny in South Korea following a wave of sophisticated cyberattacks targeting the nation’s financial institutions. South Korean President Lee Jae Myung publicly noted that there are compelling signs pointing to the use of AI in some of the recent hacking incidents, which successfully breached customer personal information.

Police have launched a full-scale, comprehensive investigation into the breaches, though authorities have not yet disclosed the specific AI tools utilized or the full extent of the data compromise. Concurrently, cybersecurity firm CrowdStrike reported finding Claude Code session histories, ARTEX configuration files, and Claude memory files while analyzing infrastructure linked to the attacks. Based on these artifacts, CrowdStrike assesses with moderate confidence that a Chinese-speaking, financially motivated threat actor is likely orchestrating the campaign.

Empire Market Co-Founder Sentenced to Four Decades Behind Bars

The long arm of the law has caught up with another major dark web figure, as 30-year-old Raheim Hamilton of Virginia was sentenced to 40 years in federal prison and hit with a $5 million fine. Hamilton previously pleaded guilty to a drug conspiracy charge related to Empire Market, a notorious dark web marketplace that he co-created and operated alongside Thomas Pavey between 2018 and 2020.

During its operational lifespan, the illicit marketplace facilitated more than four million transactions valued at over $430 million, primarily involving illegal drug sales alongside stolen credentials, personal information, counterfeit currency, and specialized hacking tools. Pavey, who entered a guilty plea last year, is scheduled to receive his sentencing later this month.

Exposed Nvidia DCGM Exporters Leak Telemetry from 12,000 GPUs

In hardware and infrastructure vulnerability news, security researchers disclosed CVE-2026-47483, a high-severity vulnerability affecting Nvidia’s DCGM Exporter GPU monitoring tool. The flaw allows unauthenticated attackers to flood profiling endpoints with malicious requests, rapidly exhausting system resources and crashing the service. This disruption can severely degrade or halt AI workloads running on the same host infrastructure.

During internet-wide scans conducted between March and May 2026, researchers discovered approximately 2,100 hosts exposing the monitoring exporter directly to the public internet without any authentication, inadvertently leaking sensitive telemetry data from more than 12,000 individual GPUs. Nvidia has swiftly addressed the security gap, and system administrators are strongly urged to update their software to version 4.8.2 or later.

Shai-Hulud-Style Worm Slips Into Tensorlake’s NPM SDK

Software supply chain risks struck again when version 0.5.144 of tensorlake, the official npm SDK for Tensorlake’s AI agent sandboxes, was compromised. Security researchers from Socket and Sonatype reported that the package was modified to execute a credential-stealing worm during the installation process, echoing previous ChainDrop and Shai-Hulud supply chain attacks.

The malicious code is designed to harvest a wide array of sensitive data, including credentials for npm, GitHub, AWS, Kubernetes, and HashiCorp Vault, as well as configuration files for various AI coding tools. Furthermore, the worm possesses the capability to execute arbitrary code supplied directly by the attacker and can automatically republish itself through other software packages that the compromised victim has publishing rights to, creating a dangerous propagation loop.