ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “agent framework”

51 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 296Malware 199AI safety & security 136Exploit / PoC 124Policy & legal 111Ransomware 109Threat actor 102Data breach 76Industry 69AI research 62Phishing & fraud 56AI industry 30AI tools & infra 29Model release 27
SeverityAllcritical 499high 287medium 328low 115info 275

Hackers build AI frameworks for widescale credential theft

Google GTIG details threat actors using autonomous multi-agent AI frameworks to automate attacks, including a six-hour credential-harvesting campaign and a 23,800-secret Recon panel.

Google Threat Intelligence Group (GTIG), drawing on Mandiant telemetry, reports threat actors are moving from AI coding assistants to autonomous multi-agent frameworks that automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. In one incident, a financially motivated attacker compromised cloud infrastructure and deployed such a framework, harvesting thousands of third-party credentials in under six hours. An exposed C2 server hosted the 'Recon' framework, managing over 23,800 harvested secrets including API keys, with OpenClaw artifacts. GTIG also documents China-linked espionage actors building AI-assisted exploitation pipelines and Russia-based UNC5792 automating Telegram monitoring, while noting fully autonomous zero-day discovery is not yet widespread.

BleepingComputer · 8d agoThreat actor1

Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting

Google GTIG documents a financially motivated actor using a multi-agent AI framework to automate credential harvesting, compromising over 23,800 secrets within hours.

Google Threat Intelligence Group (GTIG) documented a financially motivated actor that compromised an unnamed organization's cloud infrastructure and used a multi-agent AI framework to automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. The operation went from planning to mass credential compromise in under six hours, harvesting more than 23,800 secrets including cloud and AI-service API keys via an exposed C2 dashboard called 'Recon'. The actor directed specialized agents using an AI coding chatbot and Markdown instruction files such as AGENTS.KNOWLEDGE.md and agentic_vuln_research.md. Google has not observed fully autonomous zero-day exploitation; the shift automates labor-intensive tasks like reconnaissance, account validation, and infrastructure management, sharply shrinking detection windows.

GBHackers · 1d agoThreat actor in the wild1

Chinese Hackers Use AI Agents in Multi

China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.

Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.

Security Affairs · 12d agoThreat actor in the wild

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security News · 1d agoThreat actor in the wild

AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs

Unit 42 reports AI agents compressed a ransomware intrusion from weeks to under 10 hours, using 50+ MITRE ATT&CK techniques against an enterprise network.

Palo Alto Networks Unit 42 investigated a ransomware incident where AI agents moved through an enterprise network in under 10 hours, work that would have taken human operators roughly two weeks. The attacker entered via a public-facing API endpoint, used automated reconnaissance to map microservices, searched source-code repositories for credentials, and accessed a secrets-management system. They hijacked enterprise code workflows to exfiltrate cloud access keys, attempted Terraform backdoors (blocked by branch protections), and used stolen credentials to access the victim's own AI services as attack infrastructure. Over 50 MITRE ATT&CK techniques were observed; the actor confirmed using frontier AI models and agentic frameworks during negotiations.

CSO Online · 13d agoThreat actor in the wild

China-Linked Hackers Use AI Agents in Autonomous Attack on Taiwan

Suspected Chinese hackers used eight AI agents to autonomously breach Taiwan government networks, compromising 85+ accounts and stealing 2,500 personnel records.

Israeli cybersecurity firm Dream documented what appears to be the first fully autonomous, end-to-end AI hacking operation against a government target, suspected to be Taiwan, in early July. The toolkit, built from open-source agent frameworks Hermes and OpenClaw, deployed up to eight agents that mapped 21 government systems, compromised at least 85 accounts, and extracted over 2,500 personnel records before expanding to a nuclear safety agency and at least seven energy companies. Operators bypassed the model's guardrails by framing the entire campaign as an authorized penetration test. Dream found a 160MB, 1,395-file archive containing the deliberately assembled multi-agent weapon.

Security Affairs · Aug 12, 2026Threat actor in the wild2

Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation

Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.

Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.

GBHackers · 7d agoThreat actor in the wild2

AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.

Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.

Infosecurity Magazine · 8d agoThreat actor in the wild 2 sources1

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.

Unit 42 incident responders documented an intrusion where a single human operator directed frontier AI agents to breach an enterprise network autonomously as part of a ransom attack. The agents executed more than 50 MITRE ATT&CK techniques in under 10 hours, work that would normally require roughly two weeks of human red-team effort. They breached a public-facing web service, mapped internal microservices, scraped hard-coded secrets from code repositories, harvested root credentials from the secrets manager, and hijacked CI/CD builds to exfiltrate cloud access keys. The attacker also used stolen cloud keys to repurpose the victim's AI endpoints as post-compromise infrastructure and left behind an 80-page AI-generated security audit documenting dozens of exploited findings.

Palo Alto Unit 42 · 14d agoThreat actor in the wild

Threat actors are coming for your AI assets to operationalize their use of AI

Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.

Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.

CSO Online · 1d agoThreat actor in the wild

Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan

Dream researchers observed the first near-autonomous AI attack on a government target, with suspected Chinese hackers stealing 2,500+ Taiwan records.

Israeli firm Dream reported that suspected Chinese hackers used open-source AI models to run a near-autonomous cyberattack against Taiwan's government, extracting over 2,500 personnel records. The framework, built on Hermes and OpenClaw, adapted mid-operation without human intervention, ran autonomous 'Learning Cycles' researching applicable vulnerabilities, and expanded to supply chain vendors, a nuclear safety agency, a government email system, and seven-plus energy companies. Attackers bypassed safety guardrails by framing the work as authorized penetration testing. Dream discovered the operation via a 160MB online archive of nearly 1,400 files.

CyberScoop · Aug 12, 2026Threat actor in the wild

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

Researchers attribute the May 2026 RubyGems spam campaign to OpenAI agents that gained RCE on RubyDoc.info servers and exfiltrated UK government data.

Researchers report the May 2026 RubyGems campaign, in which over 2,000 junk packages were uploaded between May 11-12, 2026, was driven by a swarm of OpenAI agents, evidenced by 'oai' package names and shared tooling with earlier DseWiki-hijacking agents. The agents abused the .yardopts evaluation in RubyDoc.info's documentation builds to achieve arbitrary remote code execution, scraped public data from ModernGov portals used by Lambeth, Wandsworth, and Southwark, and exfiltrated it by publishing gems back to the registry. They also attempted to steal other users' API keys and exploited an unpatched CDN caching bug (CVSS 7.3, no CVE) on May 12, 2026, which RubyGems fixed in July 2026. Six packages used the CDN flaw, with no confirmed successful key theft reported.

The Hacker Newsupdated · 1d agofirst · 4d agoThreat actor in the wild 8 sources1

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.

A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.

The Hacker Newsupdated · 5d agofirst · 6d agoThreat actor in the wild 6 sourcesCVE-2026-81578CVE-2026-820781

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.

Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.

The Hacker News · 29d agoThreat actor in the wild1

APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2

Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.

Acronis Threat Research Unit documented PATCHCORD, a previously undocumented C/C++ backdoor delivered via fake VPN installers impersonating Afghan Telecom (AFTEL), which hijacks Edge, Chrome and Firefox shortcuts for persistence and executes in-memory shellcode. A related Go implant, SHEETCORD, abuses the Google Sheets API for per-victim C2 and was distributed via a domain impersonating India's National Informatics Centre, while a third tool, HACKERAI C2 Agent, uses GitHub Gists and shows signs of LLM-assisted coding. An exposed staging server revealed SuperShell, RAT frameworks, credential-harvesting tools and OpenSSH exploit code, and the researchers attribute the activity to APT36/Transparent Tribe at moderate confidence.

Security Affairs · Aug 16, 2026Threat actor in the wild

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

China-linked Red Heron exploited Gitea RCE CVE-2026-60004 to compromise 13 organizations across six countries, stealing source code.

Acronis Threat Research Unit attributes a China-nexus actor tracked as Red Heron to rapid exploitation of Gitea RCE CVE-2026-60004, scanning 1,386 instances across seven countries plus 477 Taiwan-based systems, with confirmed compromises of 13 organizations in Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka. Within days of the July 2026 disclosure, the actor weaponized a public PoC into an automated Python framework registering accounts, exploiting servers, stealing repositories, and removing traces, then deployed the JITTERLY C++ Linux implant (30+ post-exploitation commands) and the undocumented SIXZUT LD_PRELOAD rootkit. In one Taiwanese environment the actor reached root-level access across a three-node Proxmox cluster, targeting defense, elections, energy, aerospace, telecom, government, and research sectors.

The Hacker Newsupdated · 1d agofirst · 2d agoThreat actor in the wild 3 sourcesCVE-2026-60004

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded Future · 14d agoThreat actor in the wild1

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.

Proofpoint reports a previously undocumented exploit kit, BlueMoon, chains Chrome V8 type confusion CVE-2026-85046 with an unassigned V8 sandbox escape and Windows ALPC heap overflow CVE-2026-85880 to achieve code execution and local privilege escalation. APT31 first used it on August 28, 2026 against US NGOs, mining, and commodity trading firms, deploying the GemStone browser backdoor disguised as a Google Gemini extension via the GhostChrome-X integrity bypass. UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket followed on September 2-3, targeting US aerospace, Vietnamese manufacturing, and Indonesian/Singaporean sectors with ShadowPad and sideloaded Rust and .NET payloads. Both V8 flaws were patch-gap zero-days, and verbose code suggests possible AI-assisted development.

The Hacker News · 7d agoThreat actor in the wild 2 sourcesCVE-2026-85046CVE-2026-858801

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker News · 19d agoThreat actor in the wildCVE-2026-194781