Vendor

VirusTotal

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 2, 2026 · last 6h ago

Timeline2 articles

One runaway AI agent racked up a $50,000 cloud bill

Mandiant's AI Risk and Resilience report details prompt injection, AI supply chain compromises, agent abuse, and a runaway agent that accrued $50,000 in cloud charges.

Mandiant, drawing on Google Threat Intelligence Group (GTIG) observations, warns that poisoned data sources, model dependencies, and extension hooks can turn AI agents into channels for reconnaissance, lateral movement, and sandbox escape. Mandiant responded to incidents involving UNC6780 (TeamPCP), who stole AI service credentials and used prompt injection against AI coding assistants, while GTIG disclosed the first confirmed criminal use of an AI-developed zero-day exploit in a planned mass exploitation campaign. Red team tests showed an AI assistant manipulated into cloning internal repositories to an external GitHub account, and a runaway accounting agent made over 15,000 costly API calls in under an hour, generating roughly $50,000 in cloud charges.

Help Net Security09:45 UTC · 6h agoAI safety & security in the wild

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

HuntressSep 2, 13:00 UTC · 14d agoPhishing & fraud in the wild1

Appears with

threat actor TeamPCP 1 threat actor UNC6780 1 organization Google Threat Intelligence Group 1 product GitHub 1 product Joomla 1 product Microsoft 365 1 product Microsoft Entra ID 1 product Monday.com 1 product OpenClaw 1 product Windows Hello for Business 1 vendor Google 1 vendor Huntress 1 vendor Mandiant 1 vendor Spur 1 vendor Validin 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.