AI Hijacks, Fake Fixes and a Developer Tool Bug: This Week's Security Roundup
A batch of roughly twenty smaller threats, including a new attack on AI agents, a clever scam hiding malware in a public blockchain, and a flaw in a popular coding tool, shows where attackers are pushing right now.
Key points
- A newly named technique called GhostJacking tricks AI agents, software programs that take actions on your behalf, into following instructions hidden inside content they read.
- The ClickFix scam, which fools users into pasting malicious commands into their own computers, now hides its payload inside the Ethereum blockchain, making the attack much harder to shut down.
- A flaw in the command-line version of Cursor, an AI-assisted code editor widely used by software developers, could let an attacker run code without the developer's knowledge.
- No single item this week is a major incident, but taken together they show attackers moving deeper into AI tools and developer software.
- The ClickFix risk applies to anyone browsing the web, not just technical staff.
Some security weeks hand you one enormous story. This is not that week. ThreatVectr compiled roughly twenty smaller incidents into a single bulletin, and the value is in reading them side by side. Individually, none of them would anchor a news broadcast. Together, they show a clear pattern.
Attackers are moving into AI tools, developer software, and scams that get the victim to do the dangerous step themselves.
What are the three threats worth knowing about?
They target very different people, so it matters which one applies to you.
The first is GhostJacking. An AI agent is a program that acts on your behalf: booking appointments, browsing pages, moving files, even sending messages. GhostJacking works by hiding instructions inside content the agent reads, a webpage, a document, an email. The agent mistakes those instructions for legitimate tasks and carries them out. Every major AI company has been warned about this class of vulnerability, sometimes called prompt injection, for years. GhostJacking is a named, working version of it in the wild.
The second is EtherHiding paired with ClickFix. ClickFix is a consumer scam with a simple trick: a fake error message on a website tells you to open your computer's command tool (the text-based window used to type direct instructions to your operating system) and paste in a "fix". The fix is malware. What makes this version nastier is EtherHiding. The malicious code gets stored inside the Ethereum blockchain, which is the public, decentralised record-keeping system behind a popular cryptocurrency. Because no single company controls that ledger, security teams cannot just take the page down.
The third is a bug in Cursor's command-line tool. Cursor is an AI-assisted code editor that many professional developers now use every day to write software. A flaw in its command-line version, the text-based interface developers use to run the tool directly, could allow an attacker to execute code the developer never requested. If you write software for a living and use Cursor, update it now.
Should ordinary people worry?
For most readers, only one item demands action: learn to spot ClickFix.
If a website ever tells you to open a terminal, the Windows Run box, or any command window, and paste something in, close the tab immediately. Legitimate websites do not do this. Real error messages from your operating system never ask you to copy a fix from a webpage. That is the whole scam, and knowing it makes you immune.
The GhostJacking risk grows as AI assistants get more power to act on your behalf. For now, treat any AI tool that can click, send, or purchase as you would a brand-new employee: watch what it does, limit what it can access, and do not hand it the keys to everything on day one.
What happens next?
Security teams should treat this bulletin as a direction indicator, not a checklist. Attacks on AI agents, developer toolchains, and self-inflicted malware installation are the direction. Defences built only for a human attacker at a keyboard are already catching up.
For developers: patch Cursor. For anyone running AI agents in a business setting: log every action the agent takes and restrict what it can execute. For everyone else: remember the ClickFix rule.
Common questions
What is prompt injection, and is GhostJacking the same thing?
Prompt injection is when hidden instructions inside text or a webpage hijack an AI model, telling it to do something its user never intended. GhostJacking is a working attack that uses this technique against AI agents, the kind of software that can take actions like clicking or sending messages on your behalf.
How do I know if a website is running a ClickFix scam?
The tell is a pop-up or error box that asks you to copy a piece of text and paste it into a command window or the Windows Run box. No genuine website support page will ever ask you to do this. Close the tab and do not paste anything.
