Threat Roundup: AI Agent Theft, Password Manager Flaws, Chrome Zero-Day Under Active Attack

TL;DR: Infostealers now target AI agent configurations, 25 password recovery flaws found in major cloud password managers, Chrome CVE-2026-2441 actively exploited, new ZeroDayRAT mobile spyware platform discovered, and malware architecture trends shift toward 64-bit.

Infostealers Evolve to Target AI Agent Configurations

Cybersecurity researchers have documented the first confirmed case of information stealers successfully exfiltrating OpenClaw AI agent configuration files and gateway tokens. According to The Hacker News report, this represents a significant evolution in infostealer behavior—the transition from traditional browser credential theft to harvesting what researchers describe as the "souls and identities" of personal AI agents.

This development signals a new attack vector as AI agents become more integrated into personal and professional workflows. The theft of configuration files and gateway tokens could enable attackers to impersonate users through their AI agents, potentially accessing connected services and data stores.

Password Manager Vulnerabilities Expose Cloud Infrastructure

Researchers Matteo Scarlata, Giovanni Torrisi, Matilda Backendal, and Kenneth G. Paterson have identified 25 password recovery attack vectors affecting major cloud-based password managers including Bitwarden, Dashlane, and LastPass. The attacks range from integrity violations to complete organizational vault compromise under specific conditions.

These findings highlight critical weaknesses in password recovery mechanisms that threat actors could exploit to bypass primary authentication controls. The research underscores the importance of evaluating password managers' recovery processes as potential attack surfaces, not just their encryption implementations.

Chrome Zero-Day Under Active Exploitation

Google released emergency security updates for Chrome to address CVE-2026-2441, a high-severity use-after-free vulnerability in CSS that carries a CVSS score of 8.8. Security researcher Shaheen Fazim discovered and reported the flaw on February 11, with Google confirming active exploitation in the wild.

The rapid weaponization of this vulnerability—reported and patched within days—demonstrates the current threat landscape's velocity. Organizations should prioritize immediate Chrome updates to prevent exploitation of this actively targeted flaw.

ZeroDayRAT Mobile Spyware Platform Emerges

Cybersecurity researchers have identified ZeroDayRAT, a new mobile spyware platform marketed on Telegram for real-time surveillance and data theft on both Android and iOS devices. The platform features dedicated channels for sales, customer support, and regular updates, providing buyers with a comprehensive operational spyware solution.

This commercialization of mobile surveillance tools lowers the barrier to entry for threat actors, enabling less technically sophisticated adversaries to conduct sophisticated mobile espionage campaigns. The Telegram-based distribution model also complicates takedown efforts.

64-Bit Malware Architecture Trends

SANS researchers have published updated analysis on the 32-bit versus 64-bit malware landscape, building on their 2022 research. The analysis examines whether threat actors continue favoring 32-bit code as a common denominator for broader Windows compatibility, or if the landscape has shifted toward native 64-bit implementations.

This architectural trend analysis provides valuable intelligence for defensive planning, as understanding malware compilation targets can inform detection strategies and system hardening priorities.

Weekly Attack Pattern Analysis

The week's threat intelligence reveals a pattern of attackers exploiting trusted tools and workflows rather than purely novel exploits. This includes abuse of Outlook add-ins, cloud configuration weaknesses, and supply chain infiltration combined with traditional botnet tactics and AI assistance.

This hybrid approach—mixing legacy techniques with modern attack vectors—suggests threat actors are optimizing for reliability over novelty, focusing on paths of least resistance through existing trust relationships.

Lithuania's AI-Driven Fraud Preparedness Initiative

The KTU Consortium presented their "Safe and Inclusive Digital Society" mission at Lithuania's Innovation Agency, addressing the intersection of technological advancement and digital risk management. The presentation highlighted the accelerating pace of innovation and corresponding security challenges in AI-driven fraud scenarios.

This governmental approach to proactive AI security preparedness provides a model for national-level responses to emerging technology threats, particularly in the financial and social engineering domains.