Zscaler ThreatLabz details AI prompt injection, ClickFix, and APT campaigns

Zscaler’s ThreatLabz has published its July 2026 roundup covering multiple campaigns. It found two indirect prompt injection attacks that trick AI agents into fraudulent payments or misclassifying typosquatted domains. It also analysed ClickFix lures abusing shared Claude chats to deliver MacSync Stealer, an East Asia-linked APT targeting Middle East government entities with new malware TELESHIM, MIXEDKEY and BINDCLOAK, and an initial access broker abusing Microsoft Teams and Quick Assist to deploy GoGRPC. Updates cover new StealC variants, Anatsa on Google Play, and a malicious PyPI package.