Dominic Jainy stands at the bleeding edge of modern computing, where the traditional boundaries of software development, artificial intelligence, and decentralized ledgers are rapidly dissolving. As an IT professional who has spent years dissecting the mechanics of machine learning and blockchain, he has gained a reputation for seeing the vulnerabilities that others overlook in the rush to innovate. His perspective is particularly vital today, as organizations grapple with a landscape where AI tools find bugs faster than humans can fix them and supply chains are compromised before a single line of code is even written. In a world where a “helpful” AI assistant might accidentally invite a botnet into a secure environment, Jainy’s expertise provides a necessary anchor, helping teams navigate the treacherous gap between rapid deployment and robust security.
The following discussion explores the most pressing threats of the current year, ranging from the sophisticated “HalluSquatting” techniques targeting AI-assisted development to the standardized ransomware playbooks of groups like DragonForce. We delve into the implications of massive-scale operations like SHELLSTORM, which has compromised over 1.4 million domains, and the rise of destructive malware like GigaWiper that leaves no hope for data recovery. Jainy also breaks down the evolution of supply chain attacks within the npm and NuGet ecosystems, the exploitation of AI gateways for cryptomining, and the specific ways threat actors are now leveraging the TON blockchain for command-and-control operations. Throughout the interview, the focus remains on the shrinking window between vulnerability discovery and active exploitation, offering a deep look into how security architecture must evolve to survive at machine speed.
Developers increasingly rely on AI coding assistants that sometimes invent non-existent resources or libraries. How does this “hallucination” habit create a new, programmable entry point for attackers?
The phenomenon we are witnessing is a fascinating, yet terrifying, evolution of typosquatting that we’ve dubbed “HalluSquatting.” It’s no longer about an attacker waiting for a developer to make a manual mistake; it’s about the attacker anticipating the mistakes of the AI itself. When an AI agent hallucinates a legitimate-sounding resource—perhaps a library it thinks should exist to solve a specific problem—it creates a vacuum. Attackers are now monitoring these common hallucinations, registering those package names in advance, and embedding malicious code. It’s a gut-wrenching realization for a developer to find that the very tool meant to boost their productivity has effectively “hallucinated” a backdoor into their environment. This isn’t just a theoretical risk; research has detailed how these phantom resources are being registered and then automatically pulled into projects because the AI suggested them with such confidence that the human operator didn’t think to double-check.
With the rise of “HalluSquatting,” we’re seeing prompt injections paired with phantom resources. Can you walk us through how an attacker actually weaponizes a helpful AI suggestion to drop a botnet?
The attack chain is a sophisticated blend of social engineering and technical exploitation. First, the attacker uses prompt injection to subtly nudge the AI agent into suggesting a specific, non-existent package. Once the AI suggests this “ghost” library, the developer—or in many cases, an automated script—attempts to install it. Because the attacker has already registered that name on a public repository like npm or PyPI, the installer finds the malicious package instead of a 404 error. This code often contains a botnet stager or an information stealer, which then executes with the permissions of the developer’s environment. We’ve seen this lead to the deployment of persistent botnets that wait for the right moment to act. It’s a sensory overload for security teams who have to monitor not just what their developers are writing, but what their AI tools are “dreaming up” in the background.
The report mentions “Citrix Bleed 2” and the DragonForce ransomware. Why are we seeing such a standardized, seven-step playbook being used across unrelated organizations in 2026?
What we’re seeing with Citrix Bleed 2, or CVE-2025-5777, is the industrialization of cybercrime. Attackers have moved away from bespoke, artisanal hacks toward a highly repeatable, factory-like process. The DragonForce operators have a playbook that is so consistent it feels like an automated script, even when handled by humans. They start by gaining access through a NetScaler appliance, then immediately escalate to SYSTEM using a registry-symlink or AppMgmt privilege-escalation trick. From there, they create rogue local admin accounts and establish persistence using tools like ScreenConnect or Zoho Assist. By the time they deploy the ransomware, the victim’s environment is already fully mapped and compromised. Seeing this same seven-step pattern across half a dozen unrelated organizations suggests a level of operational maturity where the attackers are essentially running a professional service. They aren’t just hacking; they are executing a business plan with terrifying efficiency.
Looking at the Jscrambler npm compromise and the fake Braintree NuGet package, the supply chain seems increasingly poisoned. What emotional or operational toll does this take on a development team that suddenly discovers their “trusted” secrets are being harvested?
It is a profound violation of trust that leaves a development team feeling completely exposed. Imagine the sinking feeling when you realize that a package you’ve relied on for years, like Jscrambler, was compromised via a stolen credential and has been shipping a Rust-based information stealer to your entire team. This wasn’t just a Linux problem; it targeted Windows and macOS too, automating its own propagation through registry operations. Similarly, the Braintree.Net NuGet package impersonated a legitimate SDK to intercept live payment data and exfiltrate API keys. For a developer, the emotional toll is one of constant paranoia. You start to question every dependency, every update, and every “npm install.” Operationally, it forces a complete halt—you have to rotate every secret, audit every line of code, and somehow try to rebuild a security posture that was shattered by a single “trusted” package.
Microsoft is now using AI like MDASH to find zero-day vulnerabilities at a pace that might overwhelm traditional patching cycles. How do organizations stay afloat when the gap between a patch and an exploit is shrinking to almost nothing?
We are entering an era of “machine-speed” vulnerability discovery. Microsoft’s use of AI techniques like MDASH is a double-edged sword; while it helps find issues before attackers do, it also results in a significant spike in the volume of security updates. For a typical IT team, the sheer number of CVEs—from the U-Boot flaws like BRLY-2026-037 to the critical Zimbra XSS issues—is overwhelming. The gap between “patch exists” and “already exploited” is no longer measured in weeks or days, but often in hours. To stay afloat, organizations have to move away from manual review and toward a “secure-by-default” architecture. You can’t have humans reviewing 50 times more code than they did five years ago. It requires automated remediation, short-lived secrets, and a brutal prioritization of “urgent” patches over everything else. If you aren’t patching at the speed of the discovery, you’re essentially standing still in the middle of a freeway.
The Helix extortion crew is using vishing and MFA abuse to target SharePoint libraries. How does a single compromised identity become a “throughline” for a multi-day exfiltration operation?
The Helix operation is a masterclass in patient, tactical exploitation. It starts with a single human error—a successful vishing call or an MFA fatigue attack that grants initial access. Once that identity is compromised, the attacker doesn’t just smash and grab; they quietly enumerate SharePoint libraries over several days, bulk-downloading data without triggering the usual alarms. What’s particularly clever is their “tactical split.” They use one compromised account for the heavy lifting of data theft and then, weeks later, use a second, separately compromised account just to deliver the extortion message via Microsoft Teams or email. This makes the attack harder to track because the account screaming for money isn’t the one that stole the data. It shows how a single identity can be the thread that unravels an entire organization’s data sovereignty if that identity isn’t treated with the same scrutiny as a firewall or a server.
We’re seeing malware like RedHook abuse Wireless ADB and others like GoodPersonRAT masquerading as VPNs. What does this shift toward mobile privilege abuse and spoofed “safety” tools signal for the average user?
It signals that the “safe havens” of the digital world are being systematically targeted. When a user downloads what they think is a Kuailian VPN to protect their privacy, only to have it drop GoodPersonRAT and give an attacker complete control over their machine, the irony is devastating. The RedHook Android malware is even more insidious, abusing Wireless ADB features to gain shell-level access autonomously. This moves beyond simple data theft and into the realm of total device takeover. For the average user, the takeaway is that “security” software itself has become a primary delivery mechanism for malware. We’re seeing these payloads hosted on reputable platforms like AWS S3 and GitHub to bypass filters, making it nearly impossible for a non-expert to distinguish a legitimate tool from a malicious one. It’s a predatory environment where the tools meant to shield you are being hollowed out and used as Trojan horses.
Operations like SHELLSTORM have targeted over 1.4 million domains using 27 different CVEs in WordPress plugins. In your view, how do we fix a web ecosystem that is so fundamentally fragmented and vulnerable?
SHELLSTORM is a staggering example of what happens when you combine scale with a fragmented ecosystem. By exploiting nearly 30 different vulnerabilities across a wide range of WordPress plugins, a Chinese-speaking threat actor managed to deploy web shells globally, with heavy concentrations in the U.S., Taiwan, and the U.K. These web shells then serve as a beachhead for the SNOWLIGHT dropper and the VShell backdoor. The problem is that the web is built on a foundation of “good enough” security that doesn’t hold up under professional scrutiny. Fixing this requires a shift in how we view plugin architecture. We need to stop treating plugins as isolated black boxes and start enforcing a more rigorous, centralized security standard. Until then, we are just playing a game of whack-a-mole across millions of compromised domains, where the attackers always have more hammers than we have holes to fill.
The GigaWiper backdoor is described as having three distinct ways to destroy a machine. Why would an attacker choose total destruction over a traditional ransom, and what does this say about the changing motivations of state-nexus actors?
Total destruction, as seen with GigaWiper, is about disruption and psychological warfare rather than financial gain. Whether it’s wiping the entire disk, overwriting the Windows drive, or running fake ransomware that encrypts files with a key it never even saves, the goal is to make the machine completely inoperable. This is often the calling card of state-nexus actors—in this case, linked to Iran-nexus groups—who want to cause chaos or retaliate against a target. It’s a digital scorched-earth policy. When you move from “I want your money” to “I want your data to cease to exist,” the stakes change entirely. For a victim, the realization that there is no key to buy and no backup to restore (if the backup server was also wiped) is the ultimate nightmare. It underscores that our threat models must account for actors whose primary objective is the permanent deletion of our digital existence.
What is your forecast for the intersection of AI-driven vulnerability discovery and human-led incident response?
I forecast that we are heading toward a “Kill Switch” era of security. As Microsoft and others accelerate vulnerability discovery to machine speeds, the sheer volume of “urgent” fixes will make traditional, human-led incident response physically impossible. We will see a shift toward “agentic” security, where AI defense agents are given the authority to automatically isolate compromised assets, kill rogue processes, and rotate credentials in real-time without waiting for a human ticket to be filed. However, this will also create a new attack surface, as we’ve seen with LiteLLM Proxy being exploited for cryptomining. The ultimate battle won’t be between a human and a hacker; it will be between the AI that defends the network and the AI that attacks it. The role of the human professional will transition from being a “fixer” to being a “governor,” overseeing the automated systems and making the high-level architectural decisions that no machine can yet master. The speed of the game has changed forever, and our only hope is to stop running and start building smarter engines.