AI安全专题周报（20261113）
报告编号：TIC-202611-AI02
报告周期：2026年11月7日—11月13日
一、报告概述
本期整理12项AI安全通告。Fireworks AI的上游云服务商失陷后，部分客户数据受到波及，其中包括Notion AI用于使用情况分析的对话记录。NEAR AI披露推理引擎漏洞已被利用，GPUStack认证绕过也被列入已知被利用漏洞目录。多份攻击调查显示，攻击者已将模型用于生成命令、编排入侵步骤和筛选窃取的数据。
报告重点内容涵盖：
AI服务与供应链：Fireworks AI、NEAR AI、Railway和Grok应用分享。
平台与工具漏洞：GPUStack、Azure OpenAI和VS Code的MCP及浏览器工具。
AI辅助攻击：Cairn、Operation Snowball、美国零售商入侵、ArcticRAT及聊天机器人推荐链接滥用。
二、本周重点安全事件
（一）ArcticRAT用大模型处理窃取的Android数据
事件名称：ArcticRAT将大模型API接入Android窃密链路
发布日期：2026-11-12
发布机构：Zimperium zLabs
威胁概述：
ArcticRAT早期针对特定加密货币应用用户，后续版本扩展为可远程控制Android设备的木马。攻击者通过仿冒Google Play页面、恶意广告或短信等渠道投递伪装应用，并滥用无障碍服务进行远程操作。研究人员在样本中发现大模型API被用于解析已窃取的短信和应用数据，从中提取高价值金融信息。原文将模型处理放在数据外传链路中描述。
IOC指标：
· MD5（节选）：07a7054eb4d40d7f98f771404b608f4d, 0a3b7ed1dfb8363dd2b3978ab23d0360, 1aba2ab7b8123d5027e2601811950655
· IP（节选）：108.187.44.146, 167.148.195.29
STIX详情：
{
"type": "bundle",
"id": "bundle--e30dc0c9-0e2c-4bb9-a6ca-50d74d017508",
"spec_version": "2.1",
"objects": [
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--3655c0f7-8027-4728-9a05-417d89d52a54",
"name": "ArcticRAT Operators",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "运营ArcticRAT并通过C2面板远程下发指令的攻击者/组织",
"x_evidence": "报告描述了攻击者通过C2服务器下发多个指令并运营ArcticRAT。",
"x_confidence": 0.85
},
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"name": "ArcticRAT",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "一种高度复杂且不断发展的Android恶意软件，从针对加密货币应用的间谍软件演变为企业级、AI驱动的远程访问木马（RAT）",
"aliases": [
"net.iceflow.arcticlink",
"net.frostlink.iceforge"
],
"x_evidence": "报告称ArcticRAT基于早期样本中的包名net.iceflow.arcticlink和net.frostlink.iceforge命名。",
"x_confidence": 0.95
},
{
"type": "tool",
"spec_version": "2.1",
"id": "tool--360e1ba6-b6f1-4533-a31a-7984f5431712",
"name": "grok-4.20-0309-non-reasoning",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT通过xAI API使用的底层AI模型，用于分析短信和应用数据",
"x_evidence": "报告称样本通过xAI API查询grok-4.20-0309-non-reasoning模型。",
"x_confidence": 0.93
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--81483344-5e78-4ba4-91e4-dd1c2783aa9d",
"name": "Hidden VNC",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "在用户无感知情况下实现远程控制的技术",
"aliases": [
"HVNC"
],
"x_evidence": "报告称通过Hidden VNC在用户无感知情况下控制设备。",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--ea385b16-01c8-407e-acef-287c6f489365",
"name": "Abuse MediaProjection",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "滥用Android原生MediaProjection框架进行无头视频捕获",
"aliases": [
"MediaProjection"
],
"x_evidence": "报告称利用Android原生MediaProjection框架启动无头视频采集。",
"x_confidence": 0.9
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--5568e7a1-795f-4013-a792-e98da828c75f",
"name": "Abuse VirtualDisplay",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "滥用Android VirtualDisplay实例化内存虚拟显示以抓取屏幕",
"aliases": [
"VirtualDisplay"
],
"x_evidence": "报告称利用VirtualDisplay框架实例化虚拟显示。",
"x_confidence": 0.9
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"first_observed": "2026-11-13T05:04:28Z",
"last_observed": "2026-11-13T05:04:28Z",
"number_observed": 1,
"objects": {
"0": {
"type": "process",
"name": "Screen_Cast",
"description": "C2指令，用于启动受感染设备的实时屏幕传输",
"aliases": [],
"evidence": "报告中捕获到C2服务器下发<Screen_Cast>指令以建立实时屏幕传输。",
"confidence": 0.9
},
"1": {
"type": "process",
"name": "Str_Red_Ser",
"description": "C2指令，用于在屏幕重绘通道中启动屏幕重绘操作",
"aliases": [],
"evidence": "报告捕获到<Str_Red_Ser>指令，在scren_redrport通道上触发交互。",
"confidence": 0.9
},
"2": {
"type": "process",
"name": "layout_spped_661",
"description": "将目标视图树轮询率和屏幕重绘间隔修改为661ms的指令",
"aliases": [],
"evidence": "报告记录<layout_spped:661>修改轮询和重绘间隔。",
"confidence": 0.9
},
"3": {
"type": "process",
"name": "STOP_cleanupSock",
"description": "终止套接字并释放系统句柄的指令",
"aliases": [],
"evidence": "报告记录<STOP.cleanupSock>允许C2操作员终止套接字。",
"confidence": 0.9
},
"4": {
"type": "process",
"name": "screen_runrun",
"description": "在HVNC端口上实例化内存虚拟显示的指令",
"aliases": [],
"evidence": "报告记录<screen_runrun>在HVNC端口8888实例化虚拟显示。",
"confidence": 0.9
},
"5": {
"type": "process",
"name": "START_CAPTURE",
"description": "启动无头视频捕获的控制信号指令",
"aliases": [],
"evidence": "报告记录<START_CAPTURE>启动无头视频采集。",
"confidence": 0.9
},
"6": {
"type": "process",
"name": "apk_remove",
"description": "触发自动自我卸载的C2指令",
"aliases": [],
"evidence": "报告观察到<apk_remove>指令发起自我卸载序列。",
"confidence": 0.9
},
"7": {
"type": "process",
"name": "DELETE",
"description": "编程删除目标包名的指令",
"aliases": [],
"evidence": "报告记录<DELETE>可删除明确packageName。",
"confidence": 0.9
},
"8": {
"type": "process",
"name": "Attack_run",
"description": "勒索覆盖第一阶段指令，渲染初始覆盖框架",
"aliases": [],
"evidence": "报告记录<Attack_run>渲染默认勒索模板。",
"confidence": 0.9
},
"9": {
"type": "process",
"name": "Attack_costom",
"description": "勒索覆盖第二阶段指令，向活跃覆盖层注入动态内容",
"aliases": [],
"evidence": "报告记录<Attack_costom>注入动态勒索内容。",
"confidence": 0.9
},
"10": {
"type": "process",
"name": "xAI_API",
"description": "触发使用LLM框架收集自动化财务情报的C2指令",
"aliases": [],
"evidence": "报告记录<xAI_API>控制指令并携带API key。",
"confidence": 0.9
},
"11": {
"type": "process",
"name": "Get_AI_ANA_Data",
"description": "读取本地AI分析JSON并通过Socket外传的C2指令",
"aliases": [],
"evidence": "报告记录<Get_AI_ANA_Data>获取存储的JSON构件并外传。",
"confidence": 0.9
},
"12": {
"type": "process",
"name": "Phsing",
"description": "启动覆盖层以窃取PIN、图案和密码的C2指令",
"aliases": [],
"evidence": "报告记录<Phsing>启动高仿真锁屏覆盖层。",
"confidence": 0.9
},
"13": {
"type": "process",
"name": "Phsing_PATTERN",
"description": "模块化指令，为钓鱼覆盖层动态设置标题、副标题和最大尝试次数",
"aliases": [],
"evidence": "报告记录Phsing:PATTERN:[Main_Title]:[Bottom_Title]:[Max_Attempts]动态注入变量。",
"confidence": 0.9
},
"14": {
"type": "process",
"name": "Phsing_data_get",
"description": "追溯获取离线保存的历史凭据日志的C2指令",
"aliases": [],
"evidence": "报告记录<Phsing_data-get>指令获取历史日志。",
"confidence": 0.9
},
"15": {
"type": "process",
"name": "verify_credential",
"description": "后台静默验证窃取凭据的系统底层指令",
"aliases": [],
"evidence": "报告记录<verify_credential>指令静默执行locksettings verify。",
"confidence": 0.9
},
"16": {
"type": "process",
"name": "Phsing_off",
"description": "验证成功后关闭钓鱼覆盖层的指令",
"aliases": [],
"evidence": "报告记录<Phsing_off>在验证成功信号后下发。",
"confidence": 0.9
},
"17": {
"type": "process",
"name": "adb_search_pair",
"description": "执行mDNS扫描查找_adb-tls-pairing._tcp服务的ADB指令",
"aliases": [],
"evidence": "报告记录adb_search_pair发起mDNS扫描。",
"confidence": 0.9
},
"18": {
"type": "process",
"name": "con_adb_systeam",
"description": "执行TLS握手以验证本地ADB连接的指令",
"aliases": [],
"evidence": "报告记录con_adb_systeam执行TLS握手。",
"confidence": 0.9
},
"19": {
"type": "process",
"name": "stop_adb_manager",
"description": "终止活动ADB配对协程以擦除内存痕迹的指令",
"aliases": [],
"evidence": "报告记录stop_adb_manager终止协程。",
"confidence": 0.9
},
"20": {
"type": "process",
"name": "get_adb_app_info",
"description": "打开特权shell执行dumpsys lock_settings获取锁配置的指令",
"aliases": [],
"evidence": "报告记录get_adb_app_info执行dumpsys lock_settings | grep 'CredentialType:'。",
"confidence": 0.9
},
"21": {
"type": "process",
"name": "enable_accessibility_services",
"description": "利用ADB shell强制启用自身无障碍权限的指令",
"aliases": [],
"evidence": "报告记录enable_accessibility_services通过shell启用自身权限。",
"confidence": 0.9
},
"22": {
"type": "process",
"name": "disable_accessibility_services",
"description": "通过shell静默禁用无障碍服务的指令",
"aliases": [],
"evidence": "报告记录disable_accessibility_services静默禁用无障碍服务。",
"confidence": 0.9
},
"23": {
"type": "process",
"name": "adb_clear_lock",
"description": "通过shell清除受害者锁屏安全的指令",
"aliases": [],
"evidence": "报告记录adb_clear_lock执行locksettings clear。",
"confidence": 0.9
},
"24": {
"type": "process",
"name": "adb_set_password_pin_pattern",
"description": "通过shell设置新密码、PIN或图案以锁定受害者设备",
"aliases": [],
"evidence": "报告记录adb_set_password/adb_set_pin/adb_set_pattern执行locksettings set。",
"confidence": 0.9
},
"25": {
"type": "process",
"name": "adb_black_sc",
"description": "部署持久化黑屏覆盖层的指令",
"aliases": [],
"evidence": "报告记录adb_black_sc部署黑屏覆盖层。",
"confidence": 0.9
},
"26": {
"type": "process",
"name": "adb_black_hiden",
"description": "结束黑屏覆盖层的指令",
"aliases": [],
"evidence": "报告记录adb_black_hiden结束黑屏覆盖层。",
"confidence": 0.9
},
"27": {
"type": "process",
"name": "call_snd",
"description": "允许攻击者外拨电话或执行USSD代码的指令",
"aliases": [],
"evidence": "报告记录call_snd可发起外拨电话或USSD代码。",
"confidence": 0.9
},
"28": {
"type": "process",
"name": "CON_TE_CT",
"description": "获取并外传所有联系人的指令",
"aliases": [],
"evidence": "报告记录CON_TE_CT获取并外传联系人。",
"confidence": 0.9
},
"29": {
"type": "process",
"name": "locksettings_verify_old_password",
"description": "利用系统底层验证凭据密码的shell命令",
"aliases": [],
"evidence": "报告记录locksettings verify --old [password]命令。",
"confidence": 0.9
},
"30": {
"type": "process",
"name": "dumpsys_lock_settings_grep_CredentialType",
"description": "特权shell中解析OS级锁屏配置的命令",
"aliases": [],
"evidence": "报告记录dumpsys lock_settings | grep 'CredentialType:'命令。",
"confidence": 0.9
},
"31": {
"type": "process",
"name": "locksettings_clear_old_password",
"description": "清除受害者锁屏安全设置的命令",
"aliases": [],
"evidence": "报告记录locksettings clear --old [password]命令。",
"confidence": 0.9
},
"32": {
"type": "process",
"name": "locksettings_set_type_value",
"description": "设置新安全密码或图案以锁定受害者的命令",
"aliases": [],
"evidence": "报告记录locksettings set-[type] [value]命令。",
"confidence": 0.9
},
"33": {
"type": "file",
"name": "/storage/emulated/0/config/AI_DATA/",
"description": "本地缓存AI分析JSON结果的目录",
"aliases": [],
"evidence": "报告称AI生成响应以JSON格式缓存在/storage/emulated/0/config/AI_DATA/。",
"confidence": 0.9
},
"34": {
"type": "file",
"name": "/storage/emulated/0/config/System/",
"description": "缓存按日期命名的按键日志JSON文件的目录",
"aliases": [],
"evidence": "报告称键盘记录按日期存于/config/System/目录。",
"confidence": 0.9
},
"35": {
"type": "file",
"name": "/storage/emulated/0/config/Click_data/",
"description": "存储触摸、手势等交互序列的目录",
"aliases": [],
"evidence": "报告称触控交互序列存储于/config/Click_data/。",
"confidence": 0.9
},
"36": {
"type": "file",
"name": "/storage/emulated/0/config/screenshot/",
"description": "存储隐藏截屏文件的目录",
"aliases": [],
"evidence": "报告称隐藏截屏缓存于/config/screenshot/。",
"confidence": 0.9
},
"37": {
"type": "file",
"name": "/storage/emulated/0/config/phis_info/phish_logs.txt",
"description": "隐藏缓存凭证并支持历史获取或离线保存的文本文件",
"aliases": [],
"evidence": "报告称凭证同时缓存于phis_info/phish_logs.txt。",
"confidence": 0.9
}
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5c209d45-d3af-4ee1-82c8-db2e613e8f88",
"relationship_type": "uses",
"source_ref": "intrusion-set--3655c0f7-8027-4728-9a05-417d89d52a54",
"target_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT运营方使用ArcticRAT恶意软件实施攻击",
"x_evidence": "报告描述运营方通过C2面板远程下发指令控制ArcticRAT。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5b82464d-5f28-4828-9f02-6fba13a15862",
"relationship_type": "uses",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "tool--360e1ba6-b6f1-4533-a31a-7984f5431712",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT使用grok模型进行AI驱动的数据分析",
"x_evidence": "报告称样本通过xAI API查询grok-4.20-0309-non-reasoning模型。",
"x_confidence": 0.93
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8e3a544b-fddb-4833-8662-e1bb71670a49",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Screen_Cast指令启动屏幕传输",
"x_evidence": "报告捕获到C2服务器下发<Screen_Cast>指令以启动实时屏幕传输。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5637503a-206c-4a3e-b97b-4ed777a8fd51",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Str_Red_Ser指令启动屏幕重绘操作",
"x_evidence": "报告记录<Str_Red_Ser>在scren_redrport通道启动重绘。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ff3cedb4-6412-440d-952a-7d666905ee85",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行layout_spped_661指令修改轮询速率",
"x_evidence": "报告记录<layout_spped:661>将轮询或重绘间隔改为661ms。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--12af2b3d-dd2d-4b4a-ade3-eb4d2d5d6f50",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行STOP_cleanupSock指令终止套接字",
"x_evidence": "报告记录<STOP.cleanupSock>终止套接字并释放句柄。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--430dc4b8-3e9f-48e9-9d7c-1de399a4a033",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行screen_runrun指令实例化虚拟显示",
"x_evidence": "报告记录<screen_runrun>在HVNC端口8888实例化虚拟显示。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--599c1741-6e7b-449a-92b7-77f616680708",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行START_CAPTURE指令启动视频捕获",
"x_evidence": "报告记录<START_CAPTURE>启动无头视频采集。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d473c979-5f41-41be-b533-2a3f4861bbf3",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行apk_remove指令进行自我卸载",
"x_evidence": "报告记录<apk_remove>自动触发自卸载。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6879d4e9-cf32-4968-9929-44cf6a875252",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行DELETE指令删除目标包名",
"x_evidence": "报告记录<DELETE>可删除指定packageName。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ac40c77a-7a66-4150-b50d-0f8bee27a1b2",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Attack_run指令渲染勒索覆盖框架",
"x_evidence": "报告记录<Attack_run>渲染默认勒索覆盖框架。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dea82a67-f498-4d99-8be4-26e823beaa41",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Attack_costom指令注入勒索内容",
"x_evidence": "报告记录<Attack_costom>向覆盖层注入动态内容。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--90b4fa64-ff0f-4d69-bb4c-74238e7bcbab",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行xAI_API指令触发AI情报收集",
"x_evidence": "报告记录<xAI_API>触发LLM金融情报收集。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--304d64f2-fd29-4e5f-99d2-b4a73e3b9ac5",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Get_AI_ANA_Data指令获取AI分析结果",
"x_evidence": "报告记录<Get_AI_ANA_Data>读取本地JSON并外传。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d0f77300-b68a-4367-9e78-4545b6463be3",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Phsing指令启动凭据钓鱼覆盖层",
"x_evidence": "报告记录<Phsing>启动高仿真锁屏钓鱼覆盖层。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--281f8a8c-5181-4218-975b-23cb1bfa0dfd",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Phsing_PATTERN指令动态设置钓鱼覆盖层变量",
"x_evidence": "报告记录Phsing:PATTERN:[Main_Title]:[Bottom_Title]:[Max_Attempts]动态注入。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9efafa42-b8bc-4e20-ac62-99993bb13673",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Phsing_data_get指令获取历史凭据日志",
"x_evidence": "报告记录<Phsing_data-get>追溯获取历史日志。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ef15027f-ca81-428b-a4ff-25d810f3087c",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行verify_credential指令验证窃取的凭据",
"x_evidence": "报告记录<verify_credential>静默验证凭据。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c4a93934-9a0b-4015-a6d1-879aec01d979",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行Phsing_off指令关闭钓鱼覆盖层",
"x_evidence": "报告记录验证成功后下发<Phsing_off>。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--af0da7d9-269d-4ab2-b39c-724b07e07bc9",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行adb_search_pair指令执行mDNS扫描",
"x_evidence": "报告记录adb_search_pair扫描_adb-tls-pairing._tcp。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--644d4f82-3d80-4f2f-a1f0-1e7ec04c3e66",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行con_adb_systeam指令执行TLS握手",
"x_evidence": "报告记录con_adb_systeam执行TLS握手。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ecb1bdf3-8c4c-49cf-a0ad-ac516462f609",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行stop_adb_manager指令终止ADB配对协程",
"x_evidence": "报告记录stop_adb_manager终止配对协程。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3cb8a946-fa62-4be7-b28e-ac9d456ec77f",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行get_adb_app_info指令解析锁配置",
"x_evidence": "报告记录get_adb_app_info执行dumpsys lock_settings。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c86bbb14-f4f7-4a72-b1f9-26aca8e9c583",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行enable_accessibility_services指令启用无障碍服务",
"x_evidence": "报告记录enable_accessibility_services通过ADB shell启用权限。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--690ba204-c25b-4a07-9dda-c33c0054a2eb",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行disable_accessibility_services指令禁用无障碍服务",
"x_evidence": "报告记录disable_accessibility_services静默禁用。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--638b7ebd-0dfe-4ce7-8a6d-4d79ea161b27",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行adb_clear_lock指令清除锁屏安全",
"x_evidence": "报告记录adb_clear_lock执行locksettings clear。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b7228784-6c49-4e98-bd46-a4272b5a3030",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行adb_set_password_pin_pattern指令设置新密码",
"x_evidence": "报告记录adb_set_password/adb_set_pin/adb_set_pattern执行locksettings set。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--54620365-107d-46f0-b23a-8efbd27ca94f",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行adb_black_sc指令部署黑屏覆盖层",
"x_evidence": "报告记录adb_black_sc部署持久黑屏覆盖层。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8ca22b17-5995-44f3-9ee4-b12af3cf416d",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行adb_black_hiden指令结束黑屏覆盖层",
"x_evidence": "报告记录adb_black_hiden结束黑屏覆盖层。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ee06bfc7-bbf1-42aa-acde-776ce1b55313",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行call_snd指令外拨电话或执行USSD代码",
"x_evidence": "报告记录call_snd可发起外拨电话或USSD。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6063058c-4bf6-48a3-a9fb-dcb149b3717a",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行CON_TE_CT指令外传联系人",
"x_evidence": "报告记录CON_TE_CT获取并外传联系人。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b0325725-8dc6-4b1a-a866-1aedf497228a",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行locksettings_verify_old_password命令验证密码",
"x_evidence": "报告记录locksettings verify --old [password]命令。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2a63402c-752b-4a5c-881b-32da7e5c0137",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行dumpsys_lock_settings_grep_CredentialType命令解析锁定配置",
"x_evidence": "报告记录dumpsys lock_settings | grep 'CredentialType:'命令。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f9359c74-9873-46b5-98ac-301816fea978",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行locksettings_clear_old_password命令清除锁屏安全",
"x_evidence": "报告记录locksettings clear --old [password]命令。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--da5327aa-d92b-4b3c-9f4d-f45fe2297fea",
"relationship_type": "executes",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT执行locksettings_set_type_value命令设置新密码",
"x_evidence": "报告记录locksettings set-[type] [value]命令。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1bdbeff7-a9bb-4afc-bab1-c13b7e1bc919",
"relationship_type": "drops",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT将AI分析结果写入AI_DATA目录",
"x_evidence": "报告称AI生成的JSON缓存在/storage/emulated/0/config/AI_DATA/。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ba6d52d2-2606-44b1-8158-ae64080afd3b",
"relationship_type": "drops",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT将按键日志缓存在System目录",
"x_evidence": "报告称键击日志存于/config/System/。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6767faff-919b-413f-a0d5-ae82b9992d36",
"relationship_type": "drops",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT将触控和手势序列存储在Click_data目录",
"x_evidence": "报告称交互序列存于/config/Click_data/。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5b2f8947-b821-490c-8939-a05ae9c97020",
"relationship_type": "drops",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT将隐藏截屏缓存于screenshot目录",
"x_evidence": "报告称隐藏截屏存于/config/screenshot/。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e84994f0-4365-4cd1-a23e-5c259c40ad37",
"relationship_type": "drops",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "observed-data--7c93aaf1-c671-486a-82a0-bdba0ac0a395",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT将凭证缓存在phish_logs.txt文件",
"x_evidence": "报告称凭证同时写入phish_logs.txt。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--18790127-5d57-4690-87db-cf7f9ecd97d1",
"relationship_type": "uses",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "attack-pattern--81483344-5e78-4ba4-91e4-dd1c2783aa9d",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT使用Hidden VNC实现无感远程控制",
"x_evidence": "报告称通过Hidden VNC实现完全远程控制。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f428352e-fced-452e-886a-3da176f488ae",
"relationship_type": "uses",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "attack-pattern--ea385b16-01c8-407e-acef-287c6f489365",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT滥用MediaProjection进行无头视频捕获",
"x_evidence": "报告称利用MediaProjection启动无头视频采集。",
"x_confidence": 0.9
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3069f69c-9f77-4335-97ca-190e705964e3",
"relationship_type": "uses",
"source_ref": "malware--083fbe2c-8f80-4ed2-8a1b-622e03ff3567",
"target_ref": "attack-pattern--5568e7a1-795f-4013-a792-e98da828c75f",
"created": "2026-11-13T05:04:28Z",
"modified": "2026-11-13T05:04:28Z",
"description": "ArcticRAT滥用VirtualDisplay实例化虚拟显示",
"x_evidence": "报告称利用VirtualDisplay实例化内存虚拟显示。",
"x_confidence": 0.9
}
]
}报告链接：
https://zimperium.com/blog/arcticrat-ai-powered-android-rat
https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT
（二）Fireworks AI事件波及Notion AI对话
事件名称：Fireworks AI安全事件及Notion AI对话数据暴露
发布日期：2026-11-12
发布机构：Fireworks AI、Notion
威胁概述：
Fireworks AI披露，10月23日其一家第三方云服务商遭入侵，攻击者次日进入其研发环境并运行未授权工作负载。事件涉及部分客户的账单和资源元数据、数据集及未完整的模型权重。Notion确认，受影响数据包括供Insights功能使用的Notion AI聊天记录，涉及不到1%的工作区。多数受影响工作区的记录未标注作者和工作区，记录中未包含工具调用结果。Notion已停用Insights并通知受影响客户，建议轮换曾粘贴进相关对话的敏感凭据。
IOC指标：
· 暂无公开IOC
报告链接：
https://fireworks.ai/security/bulletins/october-2026-security-incident-update
https://www.notion.com/en-gb/security/advisories/security-incident-involving-a-third-party-ai-vendor
（三）NEAR AI推理服务遭在野入侵
事件名称：NEAR AI推理服务器的SGLang远程代码执行漏洞被利用
发布日期：2026-11-11
发布机构：NEAR AI
威胁概述：
攻击者利用SGLang远程代码执行漏洞控制了一台推理服务器，随后接触到内部系统。NEAR AI确认约100名用户的账户资料被下载，18个旧版智能体的对话、设置及日志被获取，两名云客户的API密钥出现在受影响日志中。11月8日在该服务器上处理的请求可能被观察，含机密模式请求。NEAR AI已修复其推理集群并轮换凭据。公开通告没有给出该漏洞的CVE或SGLang上游修复版本。
IOC指标：
· 暂无公开IOC
报告链接：
https://near.ai/blog/security-incident-report-sglang-vulnerability
（四）GPUStack认证绕过遭在野利用
事件名称：GPUStack认证绕过漏洞 CVE-2026-102895
发布日期：2026-11-10
发布机构：GPUStack、CISA
威胁概述：
GPUStack 2.2.0之前的版本默认将被识别为来自回环地址的请求提升至内置管理员权限。同机反向代理或可被外部请求控制的来源地址头可能触发这一逻辑。攻击者取得管理员权限后可访问模型、工作节点和配置，创建API密钥，或借助自定义推理后端在工作节点执行代码。项目通告确认v2.1.1部署曾被利用，CISA于11月9日将该漏洞纳入KEV目录。项目在2.2.0移除回环地址自动提权逻辑。
IOC指标：
· CVE：CVE-2026-102895
报告链接：
https://github.com/advisories/GHSA-gj9m-f8ph-pmhr
https://github.com/cisagov/kev-data/blob/develop/known_exploited_vulnerabilities.json#L109-L123
（五）Azure OpenAI关键功能缺少身份验证
事件名称：Azure OpenAI权限提升漏洞 CVE-2026-119990
发布日期：2026-11-10
发布机构：Microsoft
威胁概述：
Microsoft披露Azure OpenAI的一项权限提升漏洞。服务的一项关键功能缺少身份验证，可让未经授权的攻击者通过网络提升权限。厂商给出的CVSS 3.1基础分为9.8，攻击条件不要求已有权限或用户交互。CVE记录将该问题标注为仅由厂商托管的服务漏洞。该通告适用于Azure OpenAI服务中的对应缺陷，影响研判应以厂商安全响应中心的更新为准。
IOC指标：
· CVE：CVE-2026-119990
报告链接：
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119990
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119990.json
（六）Railway平台失陷导致AI服务凭据被盗用
事件名称：Railway 10月21日安全事件复盘
发布日期：2026-11-11
发布机构：Railway
威胁概述：
Railway复盘显示，攻击者突破构建隔离后取得云环境凭据，进入编排主机，并借助主机上的解密权限访问部分客户环境变量。查询日志显示其优先搜寻AI服务提供商密钥。Railway估算盗用费用约74万美元，并重置了1,852名用户的关联账号令牌。日志能确认约10万工作区是环境变量可能被解密的上限，实际解密的变量数量尚无法据此确定。相关客户已收到通知。
IOC指标：
· 暂无公开IOC
报告链接：
https://blog.railway.com/p/incident-report-october-security-incident
（七）Grok生成应用公开分享造成数据暴露
事件名称：GhostShares 2 披露Grok生成应用的公开访问风险
发布日期：2026-11-12
发布机构：Claroc Research
威胁概述：
Claroc利用可查询的DNS记录定位Grok生成应用的独立域名。在研究人员测试时仍在线的37,571个应用中，有35,578个无需登录即可打开。部分应用显示内部业务资料、员工名单或个人数据。研究人员还在自建应用中复现了登录后缺少成员权限检查的情形，写入和删除测试仅针对自建应用。可公开访问的应用数反映暴露范围，原文并未将这些应用全部判定为含有敏感数据。
IOC指标：
· 暂无公开IOC
报告链接：
https://blog.claroc.io/ghostshares-grok-build-apps/
（八）疑似AI生成脚本推动美国零售商入侵
事件名称：美国零售商入侵中疑似AI辅助的凭据搜寻和横向移动
发布日期：2026-11-12
发布机构：Symantec、Carbon Black威胁狩猎团队
威胁概述：
攻击者在入侵一家美国零售商的Web服务器后，手工输入的命令和多次投递的载荷受阻，随后改用更长的PowerShell脚本搜寻服务配置及凭据。Symantec根据脚本结构、注释和提交节奏，判断操作者很可能在转发模型输出。攻击者查询SolarWinds Orion后约10分钟在第二台服务器执行命令，之后还寻找销售终端脚本中的密码。调查未观察到数据盗出或加密。
IOC指标：
· IP（节选）：204.194.49.129, 166.0.25.106, 154.81.37.136, 108.165.20.205
· SHA256（节选）：54fb493822bcd832f7b2256015f13e3dfde815e1931e7fd39a90ea8ad3fdbd0a, 9c866c403e6bd5778fa3788cac9aac39aab1bf2d18a22c9999a4c27e30c0abf3, 7265d69dd8d8939dc888ce5f05190ce200ee2660f928f3b84f60e6a7b3383205
报告链接：
https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer
（九）聊天机器人推荐链接被用于诈骗和恶意下载
事件名称：Gen Threat Labs披露AI回答中的恶意链接
发布日期：2026-11-12
发布机构：Gen Threat Labs
威胁概述：
Gen Threat Labs记录了用户从聊天机器人回答进入仿冒商店、钓鱼页面或恶意软件下载站点的案例。仿冒Upscayl的站点向用户提供携带窃密程序的安装包。另有合法网站在被入侵后按访问者特征跳转到诈骗基础设施。部分案例涉及搜索结果投毒或内容操纵，但研究人员指出，单凭外部观测难以确定每条恶意链接进入模型回答的路径。
IOC指标：
· Domain：upscayl.io
报告链接：
https://www.gendigital.com/blog/insights/research/ai-chatbot-scams
（十）Operation Snowball滥用越狱版DeepSeek智能体
事件名称：Operation Snowball持续入侵活动
发布日期：2026-11-10
发布机构：Malbear Labs
威胁概述：
Malbear Labs从攻击者暴露的工作目录取得约70份会话记录，分析了一次持续两周多、针对欧洲电信运营商及其托管环境的入侵活动。操作者向采用DeepSeek Flash的自建智能体下达目标，智能体利用漏洞、尝试横向移动，并在多次受阻后调整工具或路径。报告中的13家机构是智能体识别的目标范围。各机构受影响程度及实际外传规模仍待独立确认。
IOC指标：
· Domain：api.tablacysexplorer.com
· IP:Port：146.70.53.182:2299, 113.23.212.15:8000, 212.46.38.73:56777
报告链接：
https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign
（十一）Cairn被用于针对半导体等行业的自主攻击
事件名称：Cairn自主攻击框架被滥用于在野入侵
发布日期：2026-11-12
发布机构：Palo Alto Networks Unit 42
威胁概述：
Unit 42调查显示，攻击者在8月至9月间将开源渗透测试框架Cairn与智谱GLM及DeepSeek模型结合，针对至少19家机构执行25次行动。操作者设定目标，由框架规划并执行多阶段任务。调查确认10家目标机构发生未授权访问或数据获取，涉及半导体、国防及民间组织。部分案例还出现生产环境管理员账户被创建，以及在用标准投票文档被改写。
IOC指标：
· IP：154.44.31.4, 82.29.129.54
报告链接：
https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
（十二）VS Code修复MCP命令执行和本地文件泄露
事件名称：VS Code MCP通知及智能体内置浏览器漏洞
发布日期：2026-11-10
发布机构：Microsoft
威胁概述：
在VS Code 1.145.2及更早版本中，恶意MCP服务器可以借由通知内容插入命令链接，连接该服务器的用户点击链接后可触发命令执行。另一项漏洞涉及内置浏览器的文件上传工具，受外部网页内容影响的智能体可能发起上传操作，而工具没有执行预期的文件路径审批。Microsoft在1.145.3修复这两项漏洞，调整了通知渲染方式及上传审批机制。
IOC指标：
· CVE：CVE-2026-120779, CVE-2026-102230
报告链接：
https://github.com/microsoft/vscode/security/advisories/GHSA-66hq-jw93-462h
https://github.com/microsoft/vscode/security/advisories/GHSA-f56j-7499-5hch
三、本周AI安全风险观察
推理服务的安全取决于管理接口和运行组件。GPUStack认证绕过可让攻击者取得平台管理员权限，并借自定义推理后端在工作节点执行代码。NEAR AI事件则显示，推理引擎被攻陷后，正在处理的请求可能暴露，包括在可信执行环境中运行的请求。
AI供应商持有的业务数据和凭据可能扩大入侵影响。Fireworks AI事件波及Notion AI部分对话记录。Railway的调查显示，攻击者定向搜寻AI服务密钥，盗用费用估算约74万美元。供应商侧的数据留存、服务间授权和模型调用记录都需要纳入排查。
模型已被接入不同攻击环节。ArcticRAT用模型从窃取的短信和应用数据中筛选金融信息，Cairn和Snowball展示了智能体连续执行任务的方式。美国零售商入侵中的脚本和操作节奏则支持人工转发模型输出的判断。
开发工具、应用分享和聊天机器人推荐链接也会影响用户的访问与执行权限。VS Code的MCP通知可被用来诱导执行命令。Grok生成应用的公开链接可经DNS数据发现，Gen Threat Labs还观察到用户沿聊天机器人推荐的链接进入仿冒下载站。
四、安全建议
核查模型推理环境：优先将受影响的GPUStack升级至2.2.0或更高版本，检查异常创建的管理员密钥、自定义推理后端和工作节点进程。核对推理引擎版本，并将管理接口与业务调用入口隔离。
处置供应商数据和凭据风险：对照Fireworks AI、Notion和Railway的通知确认影响范围，撤销并轮换可能暴露的密钥。按应用分配模型服务凭据，检查近期调用和账单，设置用量上限及异常费用告警。
收紧开发工具与生成应用权限：将受影响的VS Code升级至1.145.3或更高版本，限制MCP服务器接入并核查文件上传审批。发布生成应用前检查未登录访问、成员授权和敏感数据可见范围。软件下载使用厂商或项目官方入口。
结合行为和指标排查入侵：移动端关注仿冒应用、异常无障碍权限及对外连接。企业网络侧结合密钥批量验证、短时集中探测、异常PowerShell执行和横向登录开展溯源，并用本期公开指标核查历史日志。
五、报告总结
本期事件覆盖模型推理服务、AI供应商和开发工具。GPUStack与NEAR AI的在野利用表明，管理权限和推理组件失陷可直接波及工作节点或正在处理的数据。Fireworks AI和Railway事件进一步说明，对话数据和模型密钥在服务间流转时，影响可延伸至下游客户。
ArcticRAT、Cairn和Snowball分别展示了模型在窃密数据筛选、攻击编排和持续入侵中的作用。Symantec在美国零售商入侵调查中记录了疑似由模型生成的脚本。判断AI参与程度时，可结合会话记录、脚本特征与受害环境日志。
组织应优先修复已遭利用的推理平台漏洞，核对供应商通知并轮换受影响的凭据，同时检查智能体工具权限、生成应用共享设置及模型调用费用。
报告说明
本报告由360威胁情报中心基于2026年11月7日至11月13日公开威胁情报整理形成，重点分析ArcticRAT窃密活动、Fireworks AI与Notion AI数据暴露、NEAR AI推理服务入侵、GPUStack与Azure OpenAI权限漏洞、Railway模型密钥盗用、Grok生成应用暴露、美国零售商AI辅助入侵、聊天机器人推荐链接滥用、Operation Snowball、Cairn自主攻击及VS Code开发工具漏洞等事件，为企业AI应用、智能体开发环境、模型推理平台、云服务凭据与终端安全防护提供参考。
情报时效性：2026年11月7日—11月13日 威胁评估等级：高风险（多源情报验证）