October 23, 2026
- Symantec caught an offensive agent running attacks on hijacked models. A honeypot posing as an open AI service captured the operator's full working prompt: a five-layer jailbreak giving the model a fake "Fantasy AI" identity, then autonomous scanning, server exploitation, database and credential theft and cryptominer installation for up to 100,000 steps with no human in the loop — billed to the model owner. Honeypot telemetry logged more than 127,000 requests from tens of thousands of addresses, mostly endpoint discovery, brute-forcing with stolen API keys and probes of exposed config files. The Decoder
· AI & Model Security
in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them
September 4, 2026
- Node.js is being used as the delivery mechanism in intrusions against government departments, tech companies and hotels since February 2026, with Symantec noting that
node.exe is signed, trusted and widely allow-listed (The Hacker News).
· Threat Activity
in Malware That Gaslights the AI Analyst
July 10, 2026
- GodDamn ransomware — assessed by Symantec's Threat Hunter Team as a rebrand of Beast — uses the PoisonX kernel driver to neutralize security software before encryption. Dark Reading notes the driver was Microsoft-signed and is being used to kill EDR in attacks against US companies, continuing the run of BYOVD abuse seen with The Gentlemen's Kontron driver last week. The Hacker News · Dark Reading
· Malware & Endpoint Evasion
in Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0
June 20, 2026
- DragonForce affiliates deployed a custom Go RAT, Backdoor.Turn, that hides C2 inside legitimate Microsoft Teams relay infrastructure, observed by Symantec/Carbon Black against a major U.S. services firm. The Hacker News, SecurityWeek
· Ransomware & Extortion
in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token