2026年10月26日の
セキュリティ情報

Subject: [Intel] Evolution of macOS RAT "ICMacOS"

Dear team,

We are sharing intelligence regarding the evolution of the ICMacOS malware.

■ Overview
ICMacOS has transitioned from a credential stealer to a Remote Access Trojan (RAT). It now supports remote command execution via WebSockets and ensures persistence using macOS LaunchAgents.

■ Scope
- Target: macOS
- Persistence Mechanism: Property list named 'com.apple.systemupdater' in the user's Library/LaunchAgents folder.

■ Recommended Actions
1. Monitor and audit ~/Library/LaunchAgents for unauthorized plist files, specifically those mimicking Apple services.
2. Analyze network traffic for anomalous WebSocket connections to unknown C2 servers.
3. Ensure all macOS endpoints are fully patched.

■ Reference
- SOCRadar Analysis

Priority: Medium
Deadline: Ongoing

Subject: [Intel] Supply Chain Attack Targeting AI Coding Agents (MALFEX)

Dear Team,

We are sharing information regarding a new attack vector targeting AI coding agents.

■ Overview
An attack has been observed where a malicious instruction file (e.g., AGENTS.md) placed in a directory tricks an AI agent into installing a malicious npm package ('function-color'). This is part of the MALFEX campaign and leads to the execution of a Windows payload via a secondary downloader ('function-flag').

■ Scope
- Environments utilizing AI coding agents (e.g., OpenAI Codex) where agents are operated in directories containing untrusted files.

■ Mitigation Steps
1. Review and restrict the permissions of AI agents to prevent unauthorized package installations.
2. Monitor environment logs for the installation of suspicious npm packages such as 'function-color' or 'function-flag'.
3. Advise developers against running AI agents in directories containing files from untrusted sources.

■ Reference
- Forever Security Report

Priority: Medium
Deadline: Immediate review

Subject: [Security Alert] Fake IT Support Scams via Microsoft Teams

Dear employees,

We have received reports of attackers posing as "IT Support" via Microsoft Teams to trick users into installing malware or ransomware.

What you need to do:
1. Be extremely cautious of messages from external users claiming to be IT support. Do not click any links or download any files they provide.
2. Please be aware that our IT department will never ask you to install software or provide credentials via an external Teams chat.
3. If you receive a suspicious message, please report it to the IT security team immediately.

Deadline: Immediate

Subject: [Security Alert] Data Breach at Blastmail Email Delivery System

Dear employees,

We have been informed of a data breach at "Blastmail," an email delivery system provided by Rakus Light Cloud, which may affect our organization.

Requested Actions:
1. Please be vigilant against suspicious emails (e.g., unexpected invoices or urgent requests) that may use the leaked contact information for phishing attacks.
2. Do not click on any suspicious links or download attachments from unknown senders.
3. If you have already interacted with a suspicious email or entered your credentials, please report it to the IT security team immediately.

Deadline: Immediate

Subject: [Security Alert] Account Hijacking via Malicious Files

Dear employees,

A new type of malware has been discovered that allows attackers to hijack accounts like Gmail and WhatsApp without needing your password.

What we need from you:
1. Do not open any suspicious attachments or shortcut files (.lnk) from unknown senders.
2. If you notice any unusual behavior on your computer, please report it to the IT department immediately.

Deadline: Immediate