45
45
Chinese Hackers Use AI Agents in Multi
China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.
Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.
72
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.
65
57
45
Google researchers uncover criminal zero-day exploit likely built with AI
Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.
Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.
78
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.
Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.
60
45
45
45
Threat actors are coming for your AI assets to operationalize their use of AI
Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.
Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.
72
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
GreyNoise's Global Observation Grid observed a Russian-speaking threat actor operating from IP 45.142.193.132 deploy hundreds of autonomous AI agents, built on OpenAI's Codex harness with a DeepSeek model, to exploit PaperCut NG/MF flaws CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection RCE). At least 440 servers across 395 organizations in 48 countries were compromised; the US had 98 victims and educational institutions accounted for 204. The agents paired with Mimikatz, Certipy, Rubeus, and Impacket, escalated to domain admin in 12 of 440 cases, and executed DCSync to exfiltrate the full NTDS.DIT credential database.
78
60
57
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.
Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.
65
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.
75
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.
Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.
68
Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours
Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.
Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.
72
57
60
60
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.
Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.
70
45
45
57
Attackers turn to AI for help identifying files worth stealing
Gambit Security documents three threat actors using AI: a ransomware operator with Claude Code, credential harvester Zerofot, and the AI-built RAGE cryptomining framework.
Gambit Security examined three unrelated threat actors using AI across different stages of intrusions. A suspected operator tied to The Gentlemen ransomware-as-a-service used Claude Code running Claude Sonnet 4.6 in late June 2026 at six organizations, including an Australian energy utility, where it ran reconnaissance, ranked valuable databases, staged SQL Server dumps for exfiltration, and modified firewall configurations, accidentally taking one utility firewall offline. The Zerofot credential-harvesting operation, built with OpenAI Codex and Claude Code, collected 2,975 validated credentials from 1,742 hosts between April 5 and May 23, 2026, including SSH private keys and AWS access keys. The AI-generated RAGE Python framework exploits exposed Redis, Elasticsearch, Docker, Tomcat, and other services to harvest credentials and deploy cryptominers, guided at runtime by a DeepSeek-backed AI Orchestrator.
65
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.
GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.
55
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.
72
60
45
60
57
60
Hackers Leverage Claude to Exfiltrate Secrets from 1.8M Android apps
ShinyHunters-linked operators used Claude to scan 1.8M Android apps for hardcoded secrets, fueling intrusions across 40+ tenants.
Anthropic's September 2026 threat intelligence report describes a French-speaking operator (aliases MeowSHA, frkoo, blazespider) tied to ShinyHunters who ran 10 AWS EC2 workers and used Claude to decompile and scan 1.8 million Android APKs for hardcoded secrets with TruffleHog. Verified credentials were sorted into 100+ Telegram channels and paired with GitHub PAT harvesting, providing initial access for confirmed intrusions. In one supply-chain incident the actors extracted data from roughly 200 downstream customer organizations and dumped 2,100+ Azure AD token sets across 40+ corporate tenants in about 34 hours using AI agents. Anthropic banned tied accounts and stressed its own systems were not compromised.
72
57
45
60
57
60