Ransomware on Autopilot, and a Pile of Critical Bugs Under Fire

Sysdig documented what it calls the first ransomware operation run end-to-end by an LLM, a milestone for agentic attacks. Elsewhere the exploitation news stacked up — ColdFusion, SharePoint, and NetScaler all in play — while Google and the FBI took apart the two-million-device NetNut/Popa proxy botnet.

AI & Model Security

• Sysdig says it captured the first documented case of agentic ransomware: an operator it dubs JADEPUFFER in which a large language model handled the entire chain — breaking into an internet-facing Langflow instance via CVE-2025-3248, stealing credentials, moving laterally, then encrypting and wiping a production database. Sysdig, The Hacker News.
• Unit 42 analyzed the ClawHub AI-agent marketplace and found malicious “skills” that slip past security scanners to deploy infostealers and run financial fraud — a new AI supply-chain risk vector for tool-using agents. Unit 42.
• An active campaign tracked as n4d implants internet-exposed MCP endpoints that expose code-execution tools, harvesting secrets from .env, config.json, docker-compose.yml, ~/.aws, and ~/.ssh, pulling cloud metadata from AWS/GCP/Azure, and persisting via services, cron, watchdog scripts, and cloudflared tunnels — with low-to-no VirusTotal detection (C2 at cdnorigin[.]net). Eyal Sela.
• Zscaler ThreatLabz detailed real-world indirect prompt-injection campaigns using SEO poisoning to lure AI agents to attacker sites carrying hidden instructions; testing showed several popular LLMs could be manipulated into making fraudulent payments. Zscaler.
• Unit 42 described “phantom squatting” — attackers pre-register the non-existent domains LLMs tend to hallucinate for target brands (via “adversarial hallucination probing”), then host phishing on traffic the AI tools point their way. The Hacker News.
• Armadin researchers detailed a sandbox escape from Anthropic’s Claude Cowork on Windows, chaining resume-flag manipulation and a domain-allowlist bypass to run arbitrary root commands and exfiltrate data. SC World.
• CERT.dk flagged a malicious “Perplexity” browser extension that captured user searches and keystrokes. CERT.dk.

New Tools & Releases

• skewrun — an Active Directory time-discovery toolkit for red teams that resolves DC time over CLDAP, SMB, NTP, Kerberos, and NTLM, then emulates it via libfaketime to run Kerberos-authenticated tooling without root and with a low-noise footprint. GitHub.
• CredSpy — unauthenticated enumeration of authentication methods on Microsoft accounts, revealing whether targets use passkeys, certificate auth, passwordless push, etc. — a useful recon primitive for identity attack-path mapping. RedByte.
• GadgetSniper — scans PE32+ binaries for call X ; jmp qword ptr [non-volatile-reg] sequences, the exact gadget needed to build believable spoofed call stacks for EDR evasion. GitHub.
• Jailbreaker (CE) — SpecterOps released a local, offline evaluation harness for testing chatbot and agent systems against jailbreaks, prompt injection, and related failure modes. GitHub.
• mcp-security-hub — FuzzingLabs published a curated repo of offensive MCP servers to wire into your agents. GitHub.
• OpenOSINT — a terminal-based AI agent that chains OSINT tools, pivots on findings from an email/username/domain/IP, and produces a structured report. GitHub.

Cloud & Identity

• Cisco Talos dissected an EvilTokens affiliate panel branded ARToken, a phishing-as-a-service platform targeting Microsoft 365 with 80+ API endpoints for device-code phishing, Primary Refresh Token (PRT) persistence, mailbox access, BEC, and SharePoint exfiltration — sharing infrastructure with the EvilTokens kit documented by Sekoia and Microsoft. Related reporting covers ConsentFix/ClickFix OAuth token theft that hijacks accounts “in three seconds.” Talos, BleepingComputer.
• A threat actor is auctioning a claimed pre-auth, zero-click Microsoft 365 initial-access exploit said to target core Exchange Online infrastructure (SSRF, OWA session-cookie generation, account takeover), with a $1M starting bid and $2.5M buy-now in XMR. Unverified, but worth monitoring given the target. Daily Dark Web.
• Kaspersky attributed new malware Umbrij to ToddyCat, using OAuth abuse to reach corporate Gmail correspondence via the Google API. The Hacker News.

Vulnerabilities & Exploits

• Adobe patched seven CVSS 10.0 flaws in ColdFusion (APSB26-68) and Campaign Classic, enabling arbitrary code execution, privilege escalation, arbitrary file read, and security-feature bypass; watchTowr published a detailed breakdown centered on RDS path-validation and upload-endpoint fixes. Adobe is moving to a twice-monthly bulletin cadence, attributing the surge to frontier AI models finding bugs. watchTowr, The Hacker News.
• CISA added CVE-2026-45659, a SharePoint Server RCE via untrusted-data deserialization (CVSS 8.8), to the KEV catalog after confirming active exploitation — despite Microsoft’s earlier “exploitation less likely” assessment. BleepingComputer, The Register.
• The new CitrixBleed-successor CVE-2026-8451 (pre-auth NetScaler memory overread via SAML request parsing) is now being exploited using public PoC code within days of disclosure; the same bulletin also fixes an “HTTP/2 Bomb” DoS flaw. SecurityWeek, CyberScoop.
• Oracle E-Business Suite CVE-2026-46817 was exploited against ~950 exposed instances before public exploit code dropped, allowing attackers to read sensitive files. The Register, CERT.dk.
• Cisco finally confirmed in-the-wild exploitation of the Unified Communications Manager flaw patched in early June; a PoC has been public since disclosure. BleepingComputer.
• RARLAB patched WinRAR (7.23) for CVE-2026-14191, a remote code execution bug triggered by crafted RAR5 recovery-volume files; the update is manual. Malwarebytes.
• Researchers pointed a local LLM at FreeBSD and turned up a local root exploit plus an ASLR bypass on SUID PIE binaries (CVE-2026-49415, CVE-2026-49414), now patched. FreeBSD advisory.

Threat Activity

• Google’s Threat Intelligence Group, with the FBI, Lumen, and others, disrupted the NetNut / Popa residential proxy network — ~2 million enrolled home devices operated by Israeli firm Alarum Technologies — after observing 316 distinct threat clusters (cybercrime and espionage) using it to mask activity and run password-spray attacks. Note some coverage flagged the FBI seizing the wrong NetNut domain initially. Google/Mandiant, KrebsOnSecurity.
• The mass FortiBleed credential-theft campaign (harvesting from hundreds of thousands of FortiGate firewalls) was linked to the INC and Lynx ransomware operations, with a single operator seen working both groups’ negotiation panels — tying the theft directly to follow-on intrusions. Dark Reading, SecurityWeek.
• ChocoPoC, a new Python RAT, is being pushed through trojanized GitHub PoC repos claiming to exploit hot CVEs — the malice sits in pulled PyPI dependencies, not the exploit code — stealing browser data, files, and shell history from the researchers running them. BleepingComputer, The Hacker News.
• Socket detailed PolinRider, a North Korea-linked supply-chain campaign compromising legitimate GitHub repos with malicious commits — often a one-line obfuscated JavaScript loader padded with whitespace to push it off-screen. Socket, blackorbird.
• A threat actor accessed DHS’s HSIN information-sharing network in late May–early June, potentially exposing sensitive security information; no classified-network impact reported so far. Nextgov.
• CERT.dk reports Russia has been linked to the destructive cyberattack on Jaguar Land Rover. CERT.dk.
• The unsealed affidavit against extradited Scattered Spider suspect Peter Stokes highlights glaring OPSEC failures — Snapchat photos flaunting cash, hotels, and jewelry — now central to the government’s case. BleepingComputer, vx-underground.
• Sophos documented a 2026 partnership between Vect and TeamPCP abusing supply-chain attacks on security tooling for credential theft and ransomware. Sophos.

Policy & Regulation

• CERT.dk warns of renewed uncertainty over the EU–US data-transfer agreement following a US Supreme Court ruling, with potential compliance knock-on effects for European organizations. CERT.dk.
• The UK’s National Cyber Action Plan, due Monday, was postponed amid the Labour leadership contest opening July 9. The Record.
• Anthropic said the US Department of Commerce lifted export controls on Claude Fable 5 and Mythos 5, and it is restoring access. Anthropic.