57
42
Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.
72
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.
SOCRadar reports that exploitation of CVE-2025-25249 is being used to deploy PivotC2, a purpose-built post-exploitation RAT, on FortiGate firewall appliances. The attack follows the common pattern of compromising public-facing edge devices such as VPNs, routers, and firewalls as the initial entry point. Defenders running FortiGate appliances should prioritize patching and watch for post-exploitation activity indicating RAT deployment.
74
42
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.
78
42
57
57
57
42
42
57
60
42
57
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
42
42
57
60
42
57
42
42
Hackers build AI frameworks for widescale credential theft
Google GTIG details threat actors using autonomous multi-agent AI frameworks to automate attacks, including a six-hour credential-harvesting campaign and a 23,800-secret Recon panel.
Google Threat Intelligence Group (GTIG), drawing on Mandiant telemetry, reports threat actors are moving from AI coding assistants to autonomous multi-agent frameworks that automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. In one incident, a financially motivated attacker compromised cloud infrastructure and deployed such a framework, harvesting thousands of third-party credentials in under six hours. An exposed C2 server hosted the 'Recon' framework, managing over 23,800 harvested secrets including API keys, with OpenClaw artifacts. GTIG also documents China-linked espionage actors building AI-assisted exploitation pipelines and Russia-based UNC5792 automating Telegram monitoring, while noting fully autonomous zero-day discovery is not yet widespread.
75
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.
75
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI
Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.
Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.
62
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.
ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.
76
60
47
42
42
42
47
42
57
60
47
57