Cybersecurity
Executive Brief Series

Episode Summary

Ethereum Developer Compromised via Malicious VS Code Extension

An Ethereum developer was recently compromised after installing a third-party extension—contractshark/solidity-lang—in Cursor, a modified version of Visual Studio Code. The extension silently exfiltrated environment variables (.env file), exposing sensitive API keys and wallet credentials. The attack led to a wallet drain within days. With over 54,000 downloads, the malicious extension represents a successful supply chain attack.

Fortunately, the damage was limited thanks to good OpSec practices—only hot wallets used for development were affected. But the threat is ongoing: the extension is still active in the store. Developers are urged to inspect local logs for evidence of compromise and audit any third-party extensions installed via Cursor or VS Code.

GPT-5 Jailbroken Within 24 Hours of Release

Researchers at Neural Trust successfully jailbroke GPT-5 less than a day after its public release. Using prompt chaining techniques like Echo Chamber and Storytelling, they bypassed OpenAI’s content filters and got the model to describe how to build a Molotov cocktail—highlighting persistent prompt injection vulnerabilities in foundation models.

The breach raises questions about OpenAI’s safeguards, particularly the failure of classification layers meant to intercept harmful prompts across multi-turn conversations. If widely abused, these techniques could further erode trust in generative AI tools and expand the risk landscape for enterprise adoption.

Scattered Spider and ShinyHunters Join Forces

Two high-profile threat groups—Scattered Spider and ShinyHunters—are reportedly collaborating. Scattered Spider is known for its social engineering expertise (e.g., the MGM breach), while ShinyHunters specializes in credential theft and data exfiltration (e.g., Snowflake incident affecting Ticketmaster and AT&T). New research from ReliaQuest shows the groups are now sharing infrastructure, phishing tactics, and domain naming patterns.

Their combined capabilities are a concerning development. Together, they can blend convincing social engineering with deep post-access exploitation techniques. As social engineering continues to be the top attack vector, defenders are encouraged to harden identity controls, implement Zero Trust principles, and expand user training and phishing simulations.