Malware Activity
BragJack POC Attack Shows How Malicious Extensions Can Hijack Browser AI Assistants
BragJack is a proof-of-concept attack that shows how a single malicious browser extension can hijack AI assistants built into Chromium-based browsers, Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome. Once the extension is installed, it can run without further user interaction, abusing declarativeNetRequest (DNR) and content scripts to seize the trusted message channels between an AI “brain” (the model on a vendor site) and its “body” (privileged browser components). Instead of classic prompt injection, BragJack uses “prompt forcing,” where the extension feeds entire prompts and follow-up instructions directly into the agent’s control plane, so model guardrails never see the attack as untrusted content. In Chrome, this allowed code execution inside Gemini’s context, enabling local file reads, screenshots, and potential camera/mic access (CVE20260628). In Comet and Opera Neon, the agent could act on websites, summarize emails, and send data elsewhere. In Edge, a race condition between “Think” and “Do” modes (CVE202655945) let forced prompts execute as actions. Claude in Chrome was compromised via a trusted marketing page that could pass prompts to its side panel. No inthewild attacks are known, and vendors have patched the flaws and paid around $20,000 in bounties. However, these flaws emphasize the need to tightly control extension permissions, treat AI-agent activity as its own telemetry source, and design agents with strict origin validation, least privilege, and auditable command channels.
- Bleeping Computer: BragJack POC Attack Article
- Cybersecurity News: BragJack POC Attack Article
- Forever Security: Bragjack Hijacking Blog
Threat Actor Activity
ShinyHunters Hijacks Clop Ransomware Leak Site and Turns Extortion Back on Clop
ShinyHunters, a prolific data extortion group, claims that they have breached and hijacked the dark web leak site of the Clop (Cl0p) ransomware operation. They say they exploited an unauthenticated file upload flaw in Grav CMS to gain “full access” to Clop’s Tor server, deface the site with their Umbreon logo, and steal source code, plugins, logs, and even the private keys for Clop’s onion service (though those theft claims haven’t been independently verified). Using Clop’s own leak domain, ShinyHunters posted an eight-figure extortion demand, framed as 2.333% of Clop’s net worth, threatening to continually raise the amount every twenty-four (24) hours and demanding a public apology plus proceeds from Clop’s Oracle E Business Suite campaign. They also threatened to publish records of which companies paid Clop, how much, and which Bitcoin addresses were used. ShinyHunters says the attack is retaliation for a feud dating back to Clop’s alleged unauthorized use of an Oracle zero-day exploit and violent threats against a ShinyHunters member. Clop has posted a brief message asking ShinyHunters to come “online old platform,” but ShinyHunters continues to treat the ransomware gang as an extortion target.
Vulnerabilities
Gyazo Data Breach Exposes 23.6 Million User Records and Image Metadata
Gyazo confirmed a major data breach after attackers exploited a server vulnerability on September 11, 2026, gaining access to its database and stealing approximately 23.6 million user records. Exposed information may include names, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google SSO addresses, profile and subscription details, billing status, and usage data. The attackers also accessed roughly 490 million image metadata records (primarily tied to images uploaded before January 2019) including image IDs, IP addresses, EXIF location data, OCR-extracted text, source URLs, and hashed passphrases for private images. Gyazo said the attackers obtained a list identifying private images and acknowledged that some content may have been viewed, prompting the company to disable access to affected files and temporarily suspend the platform. The vulnerability has since been fixed, and Helpfeel is investigating with external experts and authorities while notifying affected users and advising them to change reused passwords and remain alert for suspicious communications. Out of an abundance of caution, CTIX analysts urge users to renew their passwords, and ensure their software is up-to-date with the latest security updates.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
