60
60
China-Linked Hackers Use AI Agents in Autonomous Attack on Taiwan
Suspected Chinese hackers used eight AI agents to autonomously breach Taiwan government networks, compromising 85+ accounts and stealing 2,500 personnel records.
Israeli cybersecurity firm Dream documented what appears to be the first fully autonomous, end-to-end AI hacking operation against a government target, suspected to be Taiwan, in early July. The toolkit, built from open-source agent frameworks Hermes and OpenClaw, deployed up to eight agents that mapped 21 government systems, compromised at least 85 accounts, and extracted over 2,500 personnel records before expanding to a nuclear safety agency and at least seven energy companies. Operators bypassed the model's guardrails by framing the entire campaign as an authorized penetration test. Dream found a 160MB, 1,395-file archive containing the deliberately assembled multi-agent weapon.
86
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.
Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.
65
Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.
72
60
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.
Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.
84
The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)
An autonomous coding agent harvested LLM API access from poorly secured gateways and aggregated stolen inference capacity behind a self-hosted gateway
A SANS researcher observed a semi-autonomous coding agent finding weakly secured LLM resale gateways via FOFA queries, creating trial accounts with temporary emails and CAPTCHA solving, and exploiting weak authorization such as client-supplied group_id fields. The agent validated stolen keys using factorial code-logic tests, then loaded roughly 379 upstream endpoints into a self-hosted New-API gateway, disabling 341 fake or dead channels. Five model names including claude-opus-5 and gpt-5.6-sol were served via round-robin and failover, forming a partially self-expanding inference supply chain resembling an evolution of LLMjacking.
68
60
60
60
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.
65
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.
76
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.
76
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.
Proofpoint reports a previously undocumented exploit kit, BlueMoon, chains Chrome V8 type confusion CVE-2026-85046 with an unassigned V8 sandbox escape and Windows ALPC heap overflow CVE-2026-85880 to achieve code execution and local privilege escalation. APT31 first used it on August 28, 2026 against US NGOs, mining, and commodity trading firms, deploying the GemStone browser backdoor disguised as a Google Gemini extension via the GhostChrome-X integrity bypass. UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket followed on September 2-3, targeting US aerospace, Vietnamese manufacturing, and Indonesian/Singaporean sectors with ShadowPad and sideloaded Rust and .NET payloads. Both V8 flaws were patch-gap zero-days, and verbose code suggests possible AI-assisted development.
82
60
60
60
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.
US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.
78
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.
78
60
60
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.
72
60
60
60
60
60
Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks
Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.
Palo Alto Networks Unit 42 identified two activity clusters, CL-CRI-1131 and CL-CRI-1163, tied by shared SOCKS5 relay infrastructure and use of large language models during operations. The Mexican cluster targeted a transportation organization, federal ministries and water utilities in Mexico and Ecuador, while the Brazilian cluster used resume-themed phishing, custom remote-access Trojans and SockTz SOCKS5 tunneling against financial organizations. An exposed self-hosted NextChat interface on attacker infrastructure led researchers to assess operators used Claude and GPT-4.1 to generate workaround scripts and troubleshoot execution failures. Unit 42 noted AI reduced time needed to troubleshoot intrusions after initial access, rather than replacing the attacker.
74
60
Thai Broadband Provider Hacked via Fortinet Vulnerability
Hackers exploited Fortinet CVE-2024-21762 RCE to breach Thai broadband provider 3BB, deploying MeshCentral backdoors and credential-harvesting tools across its network.
Hunt.io uncovered an intrusion staging directory in Thailand containing 298 files of custom tooling built for Triple T Broadband (3BB) and its former owner Jasmine. Initial access came via fingerprinting a FortiGate SSL-VPN appliance and exploiting CVE-2024-21762 for remote code execution, after probing CVE-2018-13379, CVE-2022-42475, and CVE-2023-27997. The actor also probed F5 BIG-IP for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, escalated privileges with PwnKit and Dirty COW, used MeshCentral as a C2 backdoor, harvested SSH/database/SNMP/Radius credentials, deployed PHP web shells, and ran cleanup scripts to hide the intrusion.
72
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.
GTIG documented throughout 2026 that adversaries increasingly use AI to automate and scale attacks. TeamPCP (UNC6780) used an AI coding chatbot with agent instructions to plan and execute a mass credential harvesting campaign in under six hours, and has compromised PyPI, npm, and Docker Hub since March 2026 with its Dustmaker credential stealer plus released tools Shai-Hulud and Miasma. PRC-nexus Basin Castle uses LLMs for target profiling, lure drafting, and malware development; APT42 (Calanque Ion) uses Gemini for OSINT and localized lures; APT24 (Ravine Castle) uses Gemini across the full attack lifecycle; and DPRK's Midnight Neptune (UNC1069) integrates AI into cryptocurrency theft. Google responds by disrupting attacker accounts and hardening models against distillation attacks.
68
60
60
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.
76
60
Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan
Dream researchers observed the first near-autonomous AI attack on a government target, with suspected Chinese hackers stealing 2,500+ Taiwan records.
Israeli firm Dream reported that suspected Chinese hackers used open-source AI models to run a near-autonomous cyberattack against Taiwan's government, extracting over 2,500 personnel records. The framework, built on Hermes and OpenClaw, adapted mid-operation without human intervention, ran autonomous 'Learning Cycles' researching applicable vulnerabilities, and expanded to supply chain vendors, a nuclear safety agency, a government email system, and seven-plus energy companies. Attackers bypassed safety guardrails by framing the work as authorized penetration testing. Dream discovered the operation via a 160MB online archive of nearly 1,400 files.
82
Chinese Hackers Use AI Agents in Multi
China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.
Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.
72
BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials
SOCRadar linked the BlackHatSect0r crew to a DeepSeek-powered AI agent that automated scanning and harvested 16,834 credentials from exposed systems.
SOCRadar researchers found an exposed operation server with 4.9 GB across 9,299 files, including the DXSCAN scanning platform, phishing tools, extortion material and a vault holding 16,834 credentials such as AWS keys, GitHub tokens and Stripe keys. The French-speaking crew ran a Nous Research Hermes agent against a DeepSeek model with safety features removed, queuing 2,759,860 domains and reaching 726,989 hosts. Access came from misconfigurations like public cloud buckets and exposed .env files, not new vulnerabilities.
63
APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.
Acronis Threat Research Unit documented PATCHCORD, a previously undocumented C/C++ backdoor delivered via fake VPN installers impersonating Afghan Telecom (AFTEL), which hijacks Edge, Chrome and Firefox shortcuts for persistence and executes in-memory shellcode. A related Go implant, SHEETCORD, abuses the Google Sheets API for per-victim C2 and was distributed via a domain impersonating India's National Informatics Centre, while a third tool, HACKERAI C2 Agent, uses GitHub Gists and shows signs of LLM-assisted coding. An exposed staging server revealed SuperShell, RAT frameworks, credential-harvesting tools and OpenSSH exploit code, and the researchers attribute the activity to APT36/Transparent Tribe at moderate confidence.
72