Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
64
Vendor
Symantec
- Mentions · 7d0
- Mentions · 30d3
- All mentions8
- First seenAug 15, 2026
- Last mentioned7d ago
Timeline
8 articles · newest firstNew Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials
Symantec says infostealer Aoki now steals local sessions and credentials for ChatGPT, Claude, Codex, Cursor, and Gemini.
60
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
78
Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program
SE Labs launched PIVOT, a six-month vendor detection testing program backed by CrowdStrike, Fortinet, Palo Alto Networks and Sophos, as major vendors exit MITRE evaluations.
40
Top 10 Best Browser Isolation Solutions in 2026
A 2026 market overview ranks ten remote browser isolation tools, with Menlo Security as the pure-play reference as SSE vendors bundle isolation.
12
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
62
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Symantec and Carbon Black found DragonForce-linked hackers using Backdoor.Turn, a Go RAT tunneling C2 through Microsoft Teams TURN relays via QUIC.
72
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.
76
Related CVEs
by mentions- CVE-2025-1055<1%5.6A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…
- CVE-2025-53770100%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
- CVE-2025-49704100%8.8Authenticated Code Injection RCE in Microsoft SharePoint
- CVE-2025-4970699%6.5Improper Authentication in Microsoft SharePoint Server (ToolShell Campaign)
- CVE-2025-53771100%6.5Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing
- CVE-2023-52271<1%6.5The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will…
- CVE-2025-61155<1%5.5The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers
Appears with
- Broadcomvendor · 5
- Broadcomorganization · 3
- Carbon Blackvendor · 3
- Symantecorganization · 3
- Zscalervendor · 2
- Zscalerorganization · 2
- Microsoftvendor · 2
- Palo Alto Networksvendor · 2
- Forcepointvendor · 1
- NexShieldproduct · 1
- Codexproduct · 1
- K7RKScanproduct · 1
- Microsoftorganization · 1
- Warlockmalware · 1
- Menlo Securityvendor · 1
- Ericomorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.