Claude Extensions Expose Users to Zero-Click Attacks
Critical
Executive Summary
A critical zero-click vulnerability has been disclosed in Claude Desktop Extensions, which could allow an attacker to achieve remote code execution (RCE) on a victim's system.
The flaw, which has been assigned a CVSS score of 10.0, remains unpatched as Anthropic has declined to issue a fix, stating it falls outside their current threat model.
Vulnerability Details
Affected Product: 50 Claude Desktop Extensions (DXT)
CVSS Score: 10.0 (Critical)
Exploitation Status: Proof-of-concept exists; no evidence of active exploitation.
Risk & Impact
Triage: Critical; immediate user awareness and caution are required.
Attack Vector: An attacker can craft a malicious Google Calendar event with embedded instructions. When the user gives a vague prompt to Claude like "check my latest events and take care of it," the AI processes the malicious event and executes arbitrary code on the system without any further user interaction.
Ease of Exploit: Trivial. The attack requires no clicks from the user and can be triggered by a common, benign-seeming prompt.
Action Plan
Immediate Action: No patch is available. Anthropic has declined to fix the vulnerability.
Workaround: Users should exercise extreme caution when using Claude Desktop Extensions, particularly those that interact with external applications like Google Calendar. Avoid vague prompts that could be misinterpreted to execute instructions from untrusted sources.
Detection: Monitor for unexpected processes or file modifications, especially those initiated by Claude extensions.
Relevant professional terms
Zero-Click Attack
A cyberattack that compromises a device or system without any interaction from the user. These attacks exploit vulnerabilities in how software automatically processes data, allowing malicious code to execute silently.
Prompt Injection
A type of attack that targets Large Language Models (LLMs) by embedding malicious, hidden instructions within seemingly benign inputs. This can manipulate the AI into performing unintended actions, bypassing its safety features, or leaking sensitive data.
A critical remote code execution (RCE) vulnerability, identified as CVE-2026-21962, was weaponized almost immediately after public exploit code became available, according to a CloudSEK honeypot study.
The research, covering attack activity between January 22 and February 3, 2026, found that attackers began exploiting the flaw on the same day the exploit was released.
Vulnerability Details
Affected Product: Oracle WebLogic Server.
Identifier: CVE-2026-21962.
CVSS Score: 10.0 (Critical).
Exploitation Status: Actively Exploited; first attempts observed on January 22, 2026 - the same day the exploit code was published.
Risk & Impact
Triage: Urgent. Immediate patching is required due to active exploitation and the availability of public exploit code.
Attack Vector: Unauthenticated attackers can exploit this RCE vulnerability to compromise servers and access critical data. Automated scanning and exploitation attempts were widespread.
Ease of Exploit: Low. The vulnerability is easily exploitable and does not require user interaction or privileges.
Action Plan
Immediate Action: Apply the latest Oracle security patches (including the January 2026 Critical Patch Update) to all affected WebLogic Server instances immediately.
Workaround: If patching is not immediately possible, restrict administrative console access from the internet, disable unnecessary protocols and ports, and deploy web application firewall filtering.
Detection: Monitor logs for suspicious activity, including automated scanning tools (such as libredtail-http and Nmap Scripting Engine). Review WebLogic Server audit logs for unauthorized access attempts or other anomalies.
Relevant professional terms
Honeypot
A decoy computer system or network set up to attract and trap cyber attackers. It is designed to mimic a legitimate target to gather intelligence on attacker methods and divert them from real assets.
Remote Code Execution (RCE)
A type of security vulnerability that allows an attacker to execute arbitrary commands or code on a target machine from a remote location. RCE attacks are considered highly severe as they can lead to a full compromise of the affected system.
Threat actor TeamPCP compromised the popular LiteLLM Python library by publishing malicious versions to PyPI.
The attack aimed to steal credentials, API keys, and other sensitive data from developer environments and CI/CD pipelines.
Key TTPs
Initial Access: Gained access by using a compromised API token stolen from a previously compromised CI/CD tool (Trivy).
Execution: Malicious code was embedded in the package and executed upon import or, more dangerously, via a [.]pth file that triggers on any Python interpreter startup.
Defense Evasion: The payload was double base64-encoded to bypass simple inspection and used subprocess calls to avoid detection.
Campaign Analysis
This incident is part of a broader supply chain campaign targeting widely used open-source developer tools to steal credentials and expand access.
The attack highlights the significant risk posed by transitive dependencies and unpinned package versions in automated CI/CD environments.
Targeting & Infrastructure
Target Profile: Developers and organizations using the LiteLLM Python library, particularly those with automated pipelines that pull the latest package versions.
Infrastructure: Stolen data was encrypted and exfiltrated to the attacker-controlled domain models[.]litellm[.]cloud.
Supply Chain Attack: An attack strategy that targets less secure elements in a software supply network, such as third-party libraries or dependencies, to compromise a final product or organization.
.pth file: A Python configuration file that can be used to execute arbitrary code every time the Python interpreter starts, providing a method for persistent and stealthy execution.
The Coruna framework is a sophisticated exploit kit used in the "Operation Triangulation" campaign to target iPhones.
It leverages a chain of zero-day vulnerabilities to deliver a spyware implant, enabling espionage and data theft from compromised devices.
Key TTPs
Initial Access: Achieved via a zero-click exploit delivered through a malicious iMessage attachment.
Execution: The exploit chain uses multiple stages, including JavaScript code, to execute a privilege escalation exploit and gain root privileges.
Defense Evasion: The initial malicious iMessage and exploit artifacts are deleted from the device to hinder forensic analysis.
Campaign Analysis
Operation Triangulation is described as one of the most complex attack chains ever seen, utilizing four zero-day vulnerabilities and undocumented hardware features.
The Coruna framework represents an updated version of this exploit, indicating continuous development by a highly skilled actor.
Targeting & Infrastructure
Target Profile: The campaign targets iOS devices, with victims including commercial, governmental, and diplomatic organizations.
Relevant Terms
Kernel Exploit: A type of attack that targets the core component (kernel) of an operating system to gain elevated privileges and full control over a device.
Zero-Click Exploit: A cyberattack that requires no interaction from the victim. The exploit is triggered automatically, for instance, upon receiving a specially crafted message.
Threat actors are actively exploiting the "PolyShell" vulnerability in Magento and Adobe Commerce, impacting over half of all vulnerable e-commerce stores.
The unauthenticated flaw allows attackers to upload malicious files via the REST API, leading to potential remote code execution and data theft.
Key TTPs
Initial Access: Exploiting an unrestricted file upload vulnerability via the REST API's guest cart functionality.
Execution: Uploading a "polyglot" file, a script disguised as a harmless image (e.g., GIF), which can then be executed on the server.
Campaign Analysis
This automated campaign began just days after the vulnerability's public disclosure, highlighting the speed at which threat actors can weaponize new exploits.
The attacks are widespread and indiscriminate, targeting any vulnerable Magento installation to deploy web shells and potentially exfiltrate payment data.
Targeting & Infrastructure
Target Profile: All stable Magento Open Source and Adobe Commerce version 2 installations are affected.
Infrastructure: Attackers are conducting mass scanning and have already compromised over half of all vulnerable stores.
Relevant Terms
REST API: (Representational State Transfer Application Programming Interface) A set of rules that developers follow when they create an API, commonly used for web services to communicate with each other.
Polyglot File: A file that is a valid form of multiple different file types. In this attack, it's a file that is both a valid image and a valid PHP script, designed to bypass security checks.
Researchers have developed ProAttack, a prompt-based backdoor method that poisons Large Language Models (LLMs) with nearly undetectable malicious prompts.
This technique achieves high success rates by using the prompt itself as the trigger, avoiding common detection methods.
Key Findings
The ProAttack method can achieve an attack success rate approaching 100% on multiple text classification benchmarks.
In some tests, the attack required as few as six poisoned samples to successfully create a backdoor in the model.
The technique is a "clean-label" attack, meaning it doesn't alter the sample labels, making the poisoned data appear natural and bypassing traditional defenses.
The Bottom Line
The emergence of ProAttack demonstrates that standard operational practices like prompt engineering are now a significant, unaddressed attack vector.
Since this method bypasses anomaly detection by using legitimate-looking prompts and correct data labels, organizations can no longer rely on input scanning alone.
This represents a fundamental shift in the LLM threat landscape, requiring security leaders to re-evaluate the trust placed in shared prompt templates and open-source datasets, as they can now serve as Trojan horses for sophisticated backdoors.
Relevant Terms
Prompt Engineering: The process of structuring text that can be interpreted and understood by a generative AI model.
Attack Surface: The sum of the different points (the "attack vectors") where an unauthorized user can try to enter or extract data from an environment.
The convicted founder of spyware firm Intellexa suggests the Greek government authorized the use of Predator spyware to hack phones belonging to ministers, journalists, and military officials. This follows a Greek court's conviction of four individuals connected to the company.
The Scheme
TTP 1: Deployed Predator spyware to infiltrate mobile phones, enabling access to messages, photos, and remote camera/microphone activation.
TTP 2: Utilized one-time malicious links sent via phishing messages to deliver the spyware payload.
TTP 3: Leveraged zero-day vulnerabilities in mobile browsers to ensure successful infection of targeted devices.
The Players
Threat Actor:Greek Government
Facilitators Convicted:Tal Dilian, Sara Hamou, Felix Bitzios, and Yiannis Lavranos
The Consequence
Outcome: Four individuals were convicted for breaches of privacy and illegal access to communication systems, receiving eight-year sentences, which are suspended pending appeal.
Strategic Takeaway
This case highlights the significant accountability challenge when private spyware vendors enable state-level domestic surveillance, blurring the lines between national security and political espionage.
Relevant Terms
Spyware: Software designed to secretly enter a device, gather information, and forward it to a third party without consent.
Zero-Day Vulnerability: A flaw in software or hardware that is unknown to the party responsible for patching it, which can be exploited by attackers.
