Cybersecurity researchers have uncovered two significant threats affecting users and developers. First, they identified a new phishing technique called ‘CoPhish’ that exploits Microsoft Copilot Studio agents to deceive users into granting access through fake OAuth consent prompts. These malicious chatbot agents mimic legitimate Microsoft domaintricking users into clicking customized login buttons that redirect to harmful sites, steal session tokens, hijack accounts and in some cases, high-privilege admin roles. Although Microsoft plans to fix these issues in future updates, current vulnerabilities remain exploitable. Second, a sophisticated malware named GlassWorm has been discovered infecting Visual Studio Code extensions available on popular platforms. This self-spreading worm uses the Solana blockchain and Google Calendar as command-and-control centers to avoid detection and takedown. It employs techniques like invisible Unicode characters to hide malicious code and target widely used extensions thus, infecting thousands of downloads. Once inside, it can steal credentials, drain cryptocurrency wallets, and convert developer machines into tools for cybercriminal activitiescommunicating through decentralized networks for resilience. These threats highlight the growing risks in cloud and developer environments, underscoring the importance of strict security policies, cautious permission practices, and continuous monitoring to protect against evolving cyber-attacks. CTIX analysts will continue to report on the latest malware strains and attack methodologies.