Trezor Implant, $1M LLMJacking Scams, Rapid SAP Exploits and Hidden Threats

Trezor Implant Threat Emerges

Security researchers have identified a sophisticated implant that targets the firmware of Trezor hardware wallets. The malicious code is designed to intercept seed phrases during the device initialization process, allowing attackers to extract private keys without triggering user alerts.

How the implant operates

The implant is delivered through a compromised supply chain component. Once the wallet firmware is updated with the tampered package, the malicious module resides in a hidden partition. During the seed generation phase it captures the mnemonic phrase, encrypts it with a public key controlled by the attacker, and stores the ciphertext in a non‑volatile area that is not checked by standard integrity tools.

Community response and mitigation steps

Following the disclosure, the Trezor development team issued an emergency firmware patch and recommended users verify the cryptographic signature of any new firmware before installation. The community also began a campaign to audit third‑party distribution channels for signs of tampering. Users are advised to:

• Download firmware only from the official Trezor website.
• Verify the SHA‑256 hash of the downloaded file against the values published on the site.
• Consider using a clean, air‑gapped computer for the update process.

Experts stress that hardware wallets remain one of the most secure options for crypto storage, but the incident highlights the need for rigorous supply chain hygiene.

LLMJacking Scams Reach $1 Million in Losses

Law enforcement agencies reported that fraudsters exploiting large language model (LLM) interfaces have amassed more than $1 million from victims in the past quarter. The technique, dubbed “LLMJacking,” involves hijacking legitimate AI chat services to inject malicious prompts that steer users toward phishing sites or fraudulent investment schemes.

Typical attack flow

Attackers first gain access to an API key for a popular LLM provider. They then embed a hidden instruction set that triggers when a user asks for financial advice. The LLM, unaware of the manipulation, returns a polished recommendation that includes a link to a counterfeit banking portal. Victims who follow the link often enter credentials that are instantly harvested.

Law enforcement crackdown

In response, the U.S. Department of Justice announced coordinated raids that resulted in the seizure of several servers used to host the fraudulent API keys. The agency also released guidance for developers on securing API access, emphasizing the use of rotating secrets and strict usage monitoring.

Security analysts recommend that organizations:

1. Implement rate limiting on API calls.
2. Monitor for anomalous request patterns.
3. Educate end users about the risks of unsolicited financial advice from AI tools.

SAP Vulnerabilities Weaponized Within Days

Two critical vulnerabilities in SAP’s NetWeaver and Business Technology Platform were disclosed in early September. Within 48 hours, threat actors released exploit code that leveraged the flaws to gain remote code execution on vulnerable ERP systems.

Technical overview

The first vulnerability, CVE‑2024‑XXXXX, is an insecure deserialization issue in the SAP NetWeaver Application Server. The second, CVE‑2024‑YYYYY, is a SQL injection bug in the SAP Business Technology Platform’s data services. Both allow an unauthenticated attacker to upload a malicious payload that runs with system privileges.

Impact on enterprises

Companies that rely on SAP for core business processes face immediate risk of data theft, ransomware deployment, and operational disruption. The SAP security advisory urges customers to apply the emergency patches released on September 5 and to conduct a thorough inventory of exposed endpoints.

Key steps for mitigation include:

• Applying the latest security patches to all SAP components.
• Isolating SAP servers behind dedicated firewalls.
• Enabling multi‑factor authentication for administrative accounts.

Overlooked Stories Worth Watching

While headline‑grabbing incidents dominate the news cycle, several lower‑profile developments merit attention from security professionals.

Synology NAS ransomware warnings

Synology recently issued a warning about a surge in ransomware targeting its Network Attached Storage devices. The attackers exploit weak default credentials and outdated SMB configurations to encrypt stored data. The Synology security advisory recommends disabling SMB v1, enforcing strong passwords, and enabling two‑factor authentication on admin accounts.

Flowise “hello” attacks

Open‑source workflow automation tool Flowise has been the subject of “hello” attacks, where malicious actors send crafted HTTP requests that trigger arbitrary code execution during the tool’s initialization routine. The Flowise security documentation now advises users to validate input payloads and to run the service inside a container with limited privileges.

Chainalysis breach fallout expands

After the initial disclosure of a breach at blockchain analytics firm Chainalysis, further investigation revealed that the attackers accessed internal audit logs that contain transaction tracing data for multiple cryptocurrency exchanges. The Chainalysis blog confirms that the compromised data does not include private keys, but the exposure could aid money‑laundering investigations.

Organizations using Chainalysis services should review their data sharing agreements and consider rotating any API tokens that were in use at the time of the breach.

These incidents illustrate the breadth of the current threat landscape. From hardware wallet implants to rapid weaponization of enterprise software flaws, the pace of discovery and exploitation shows no sign of slowing. Continuous monitoring, prompt patching, and a proactive security culture remain the most effective defenses against both high‑profile attacks and the quieter, yet equally damaging, under‑the‑radar threats.