The through-line in this week's cybersecurity news is not sophistication. It is monetization. Attackers are increasingly treating other people's infrastructure - servers, routers, and even the goodwill of open-source maintainers - as a revenue stream, and the AI industry is beginning to look like the next version of that same dynamic.
From Breach to Business Model
Compare the mechanics of four stories our desk has logged. BleepingComputer reports that attackers are exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online built-in CODE Server app for Nextcloud to backdoor servers. Separately, BleepingComputer reports that a proxyjacking campaign has hijacked D-Link and Ubiquiti devices across 34 countries, monetizing victims' internet connections through a commercial residential proxy network. And BleepingComputer also reports that a threat actor uploaded malicious packages to the Arch User Repository impersonating the popular helper tools yay and paru, delivering malware with root privileges.
None of these are smash-and-grab operations. Each one converts a compromised machine into a durable asset: a persistent foothold in a document server, a resold exit node, a privileged installer running on a developer workstation. The victim keeps paying for the hardware, the bandwidth, and the electricity. The attacker collects the upside.
The Residential Proxy Economy
The D-Link and Ubiquiti campaign is the clearest illustration. Proxyjacking does not encrypt files or demand a ransom. It quietly sells access to a home or small-office connection, which is valuable precisely because it looks residential. That demand comes from a legitimate commercial market for residential proxy services, which security researchers have long noted can be repurposed by fraudsters and scrapers. The result is a two-sided arrangement in which the attacker is effectively an arbitrageur: buying nothing, selling bandwidth that belongs to someone else.
For US consumers, the harm is diffuse. A compromised router does not announce itself. The bill does not change. The device simply does its owner's bidding more slowly while also working for a stranger. This is a harder problem to mobilize against than ransomware because there is no dramatic moment of discovery, and therefore little pressure on manufacturers or ISPs to act.
Open Source as Attack Surface
The Arch User Repository campaign follows the same logic at the software layer. AUR is a community-maintained collection where users can publish packaging scripts. Impersonating yay and paru - tools that many Arch users install early and trust implicitly - is a bet on that trust. The packages deliver malware with root privileges, meaning the compromise is total from the first command.
The economics here are unusually favorable to the attacker. The cost of uploading a package is near zero. The pool of potential victims is self-selecting: people who already accept that they are installing software from strangers. And the cleanup burden falls on volunteers, not on a company with a security budget. The Arch example is small in absolute terms, but it is a template that scales to any package ecosystem where convenience is prioritized over provenance. US enterprises that permit developers to pull from community repositories inherit that risk without inheriting any of the accountability.
