How attackers create software that AI will recommend
How Attackers Built Software an AI Would Recommend
Island researcher Ofek Ronen disclosed a supply chain activity named MicrosoftSystem64, which as of September 20, 2026 is linked to at least 88 public GitHub repositories, delivering a cross-platform RAT through a malicious npm dependency chain. These repositories are not empty shells; attackers copied real open-source projects and retained their functionality, arranged reasonable uses for malicious dependencies, and imported or script-generated commit histories, using an automated fork network to create the illusion of widespread adoption. Among them, the third-party MCP server Cesarjoquin/shopify-mcp associated with the activity appeared in recommendation results from ChatGPT (GPT-5.6 Luna) and Google AI Overview without any threat context. The author said it is impossible to determine which signal led to its recommendation, nor to confirm whether the activity was specifically designed to influence large model recommendations, and reminded that package-name IOCs will quickly become invalid.
Island's investigation shifts focus from the malicious packages themselves to repository credibility building, showing that checks that only look at package-name IOCs will fail after package name rotation.