Zero-day in Meta's Muse macOS AI agent lets local malware hijack it

🕵️ RESEARCH & DEEP DIVES

• Zero-day in Meta's Muse macOS AI agent lets local malware hijack the assistant and steal credentials
  A zero-day in Meta's Muse AI agent for macOS lets unprivileged local malware redirect the agent's dictation endpoint to hijack it, inject prompts, and steal authentication data.

  • Affects Meta's Muse AI agent for macOS, which holds broad delegated permissions over files, email, calendars, browser, purchases, and linked devices.
  • The undocumented endo_voyager_dictation_endpoint config setting can be modified by an unprivileged local process, redirecting Muse's dictation traffic to an attacker-controlled server.
  • Attack flow: malware already running as the local user (no RCE on a clean Mac) changes the endpoint, then captures dictated audio/prompts, injects malicious instructions, and obtains account authentication data.
  • Disclosed by Patrick Wardle (Objective-See) with a proof-of-concept named 'not-a-mused' implementing a subset of Muse's 50+ commands; demos showed querying linked devices' location and triggering BLE scans.
  • Meta had not publicly responded; its bug bounty offers up to $300,000 for qualifying Muse flaws.
  Sources 📄 Source: github.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Study: 5.65% of enterprise web apps serve live credentials in production JavaScript bundles
  An IEEE Access study documents runtime credential exposure in production web apps that static secret scanners miss.

  • Applies to organizations running Azure-heavy enterprise web applications that ship JavaScript bundles to browsers.
  • Azure AD client credentials and APIM subscription keys were found live in production JavaScript bundles, enabling account takeover and mass data exposure.
  • An authorized engagement across ~2,000 enterprise web assets found 113 (5.65%) serving live credentials; 73.3% of exposed apps had the full Azure AD token-mint chain co-located in one browser-reachable bundle.
  • CryptoJS-encrypted configuration defeats all static scanners since credentials exist only after runtime decryption with a co-located key; 13.9% of the GT-194 ground truth was found only by manual analysis.
  • Best static scanner recovered 36.6% of secrets and best runtime-aware scanner 77.8% (F1 = 0.818); combined coverage plateaus at 86.1% across nine evaluated scanners.
  Sources 📄 Source: doi.org · 📎 Coverage: arxiv.org · 👁 via arXiv cs.CR

• SoK paper systematizes the Linux kernel bug lifecycle from discovery to patch deployment
  Researchers have published a SoK systematizing the Linux kernel bug lifecycle and identifying why the crash-to-patch gap persists.

  • Applies to the Linux kernel and automated bug-finding systems such as syzbot, which now surface bugs faster than downstream processes can absorb.
  • Covers five stages of the bug lifecycle: discovery, triage, patch generation, patch validation, and integration.
  • Later stages remain far less automated, so fixed bugs often stay open for weeks, need review-driven revisions, or lack reproducers.
  • Kernel-specific challenges include concurrency, implicit invariants, cross-syscall state, hardware dependence, lack of fault isolation, and architecture/configuration multiplicity.
  • Authors argue repair and validation tools wrongly assume reproducers, localized root causes, and correctness oracles that many real bug reports lack.
  Sources 📎 Coverage: arxiv.org · 👁 via arXiv cs.CR

• Inside BambooToken's Linux implant: shell and file control over MQTT
  Researchers reverse-engineered the BambooToken Linux backdoor, which uses MQTT with XOR-obfuscated messages for shell and file control.

  • Applies to Linux x86-64 hosts; the analyzed sample is a stripped, statically linked C++ ELF (SHA-256 bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e).
  • The implant connects to embedded MQTT broker live-hk[.]c2iznja[.]com on TCP port 2883 and subscribes to a fixed group topic {534E19D5-434B-4cad-A0C2-8D75E0B2FBFC}.
  • It resolves into three components: a host inventory collector, a shell command worker using /bin/sh -c via popen, and a file manager supporting dir, download, upload, and delete operations.
  • Messages are XORed with a repeating 37-byte key; topics are XORed per segment and hex-encoded, and the sample supports background daemonization via a double-fork.
  • The sample's SHA-256 is listed in Black Lotus Labs' published BambooToken IOC collection, confirming family attribution.
  • Decoded file-listing responses use the misspelled field 'flies', a useful traffic discriminator.
  Sources 📄 Source: github.com · 📎 Coverage: app.reverser.space · 👁 via r/netsec