Cybercrime Infrastructure, AI Agents and Exposed Credentials Create New Paths to Compromise

A series of recent security findings shows attackers targeting both sides of modern digital infrastructure: criminal services, AI-enabled browsers, software supply chains, cloud development environments and operational technology access.

The incidents range from a disputed takeover of Cl0p’s leak site to malware that lets commercial large language models select malicious actions. Other research highlights a more immediate operational risk: credentials stolen from utilities, technology suppliers and exposed Docker hosts.

ShinyHunters turns an extortion site against Cl0p

ShinyHunters defaced the Tor leak site operated by the Cl0p ransomware group and claims to have stolen its server logs, source code and onion-service private keys.

The intruders demanded an eight-figure payment and a public apology. They also threatened to identify companies that allegedly paid Cl0p during its Oracle E-Business Suite campaign.

According to ShinyHunters, the operation was retaliation for threats made by a Cl0p representative during a feud connected to that campaign. The episode effectively applies ransomware-style pressure to another cybercrime operation, using threatened disclosure as leverage.

The alleged theft has not been independently confirmed. If genuine, server records could expose administrative activity, victim communications or other operational details, while possession of private keys could undermine trust in Cl0p’s onion service. The precise contents of the reportedly stolen data are not known.

The defacement itself proves that ShinyHunters obtained some level of access to the site, but it does not establish that every claimed asset was taken. A previous account of the Cl0p site takeover described exploitation involving Grav CMS.

No technical mitigation applies directly to outside organizations because the compromised infrastructure belongs to Cl0p. Companies involved in the Oracle E-Business Suite campaign, however, may face renewed exposure if ShinyHunters releases records that it says identify payers.

BragJack turns trusted AI webpages into control channels

Researchers at endpoint security company Forever disclosed BragJack, a collection of weaknesses affecting browser-based or browser-integrated AI assistants.

The affected products are:

• Google Chrome
• Microsoft Edge
• Opera Neon
• Perplexity Comet
• The Claude in Chrome extension

The attack exploits how these assistants accept instructions from designated webpages. If a malicious browser extension gains control over one of those trusted pages, it can inject scripts or manipulate network traffic. The extension can then submit prompts to the assistant without requiring the user to click or type anything.

That trust relationship can bridge a relatively familiar browser-extension threat into more sensitive AI capabilities. Depending on the browser and assistant, successful exploitation could expose email, local files and screenshots. It could also activate the device’s camera or microphone.

The issue is not simply that an extension can alter webpage content. BragJack allows the altered page to issue instructions through a component that may already hold broad permissions or authenticated access on the user’s behalf.

Vendors paid bug bounties ranging from $600 to $7,000. Exact affected versions, patch releases and product-specific workarounds have not been disclosed. Users and administrators should therefore check each vendor’s advisory and extension update status rather than assume that automatic browser updates address every affected component.

Organizations should also reassess installed extension inventories. An untrusted extension is the prerequisite for the attack path described by the researchers, making extension approval and removal policies a practical defensive layer.

AI models move deeper into malicious operations

Cisco Talos documented CLOSEDQUORUM, a Go-based Windows implant that delegates command-and-control decisions to commercial large language models.

Up to four models—DeepSeek, Qwen, Mistral and Gemini—vote on whether the implant should perform actions such as credential theft, code injection or persistence. CLOSEDQUORUM executes the winning choice rather than waiting for a human operator or receiving a conventional command from an attacker-controlled server.

Talos considers it the first publicly documented malware that assigns this decision-making role to commercial LLMs. The implant can send LSASS dumps, stored browser passwords and cryptocurrency wallet data to an operator-controlled Discord channel.

Its operational status remains uncertain. Talos has not confirmed deployment in the wild, and the publicly available build contains placeholder API keys. Development versions nevertheless indicate that the author may produce customized builds for individual operators.

AI also appears in the development history of RemControl, an Android banking trojan sold as malware-as-a-service. Group-IB found exposed API documentation suggesting an AI assistant helped create parts of the platform after the developer described it as a quiz and parental-monitoring application. One phishing overlay accidentally retained a complete AI-assistant response.

RemControl is distributed through counterfeit Google Play pages promoting the TVTap IPTV app. It targets customers of more than 30 banks across Western Europe, the Middle East and Canada.

Once a victim grants Android Accessibility permissions, the malware can place phishing overlays over banking applications, stream the screen, record keystrokes and provide full remote control. No dedicated removal procedure is available. Users should avoid the fake download pages, while defenders investigating suspected installations should examine Accessibility grants and unauthorized remote-control behavior.

Malicious packages and exposed Docker APIs target developer secrets

Attackers published malicious releases of MemTensor’s MemOS packages on npm and PyPI, including a memory plugin for the OpenClaw AI agent harness.

The packages deploy a previously unseen Go implant called sckit. It does not execute during package installation, reducing the chance that installation-focused checks will detect its behavior. Instead, execution begins when the Python library is imported or the npm plugin is used.

The implant searches for credentials associated with npm, PyPI, GitHub, AWS, Hugging Face and other services. It also includes templates designed to support further propagation through npm, PyPI and GitHub Actions.

Semgrep found no evidence that those propagation mechanisms had succeeded at the time of its analysis. Aikido and StepSecurity separately published findings about the campaign.

Affected package versions have not been disclosed, and no formal cleanup procedure is available. Organizations should identify systems where the packages were imported or activated, remove the malicious components and rotate potentially exposed development, cloud and AI-platform credentials.

CARBONATO takes a different route to similar secrets. The botnet scans for Docker daemons exposed without authentication on TCP port 2375, then checks neighboring networks every five minutes for additional targets.

On compromised hosts, it installs Hermes Agent, a legitimate open-source AI agent framework. CARBONATO replaces the framework’s persona file with instructions to obey commands delivered through Telegram, maintain persistence and harvest credentials. AI API keys receive the highest collection priority.

ThreatDown discovered the operation through an exposed Docker registry. Language, timezone and infrastructure clues suggest that the operators are based in Costa Rica, although this remains an attribution assessment rather than a confirmed identity.

Defenders should block unauthenticated access to Docker’s remote API, investigate exposed registries and treat credentials stored on compromised hosts as stolen.

Stolen identities expose routes into water utilities

SpyCloud examined stolen identity records linked to 10,000 US water and wastewater utilities and their technology suppliers. It identified active infostealer exposure at 1,787 organizations.

At 258 of them, the stolen data included credentials associated with operational technology or remote-access systems. These findings represent possible entry points, not evidence that attackers successfully entered utility networks.

One infection at an advanced-metering technology provider captured stored credentials for roughly 167 utility metering portals. At utilities themselves, exposed credentials were primarily associated with remote-administration products, including TeamViewer and management portals from SonicWall and Fortinet.

The supplier case illustrates how one compromised endpoint can create access risks across many customers. Utilities should review remote-access accounts and credentials connected to affected employees or providers, invalidate exposed sessions and examine whether the accounts were used unexpectedly.

Separately, Team Cymru identified almost 11,000 servers running Claude Relay Service or its successor, sub2api. These gateways pool AI accounts and present the relay’s identity and location to model providers instead of those of the original user.

In one US-hosted cluster, more than 4,000 IP addresses in China and Hong Kong connected to 304 relays that also communicated with OpenAI, Anthropic, xAI and Google endpoints. Anthropic, OpenAI and Google exclude those regions. No provider response or specific technical mitigation has been disclosed.

TDengine patch closes a pre-authentication crash path

Ridge Security disclosed CVE-2026-42542, a high-severity vulnerability affecting TDengine versions 3.4.0.0 through 3.4.1.5. TDengine 3.4.1.6 contains the fix.

The time-series database is used in industrial telemetry, energy, utility and IoT environments. An unauthenticated attacker can send one malformed packet to the server’s RPC port and crash the service.

The flaw begins with an integer underflow during pre-authentication message parsing. That error leads to a heap buffer overflow. Researchers confirmed denial of service and advised defenders to consider the underlying memory corruption, although no additional exploitation outcome has been established.

CVE-2026-42542 has a CVSS score of 7.5 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It requires network access but no privileges or user interaction, with the documented impact limited to availability.

Administrators should upgrade to TDengine 3.4.1.6 and restrict access to the RPC service wherever possible. No CISA Known Exploited Vulnerabilities listing or associated remediation deadline is known.

Canonical, meanwhile, is changing Ubuntu kernel maintenance from separate four-week regular and two-week security Stable Release Update cycles to a unified two-week cycle. Because the workstreams overlap, Canonical expects a kernel release every week.

Administrators needing earlier fixes can test release candidates from the -proposed pocket before certification finishes. Canonical also intends to publish workarounds or hardening advice within 24 to 48 hours of public vulnerability disclosure.