☕️ AI agent ran a cyberattack on its own

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🤖 AI agent ran a cyberattack on its own

🛡️ Nvidia launches AI security alliance

🏭 Ransomware gang steals product designs

🦊 GitLab flaw enables remote code execution

🎥 North Korea hackers steal crypto via Zoom

Plus: 💡 5 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.

• Researchers at Hunt.io discovered a live cyber-espionage operation against Thailand's Ministry of Finance in which an open-source autonomous AI agent called Hermes ran reconnaissance and privilege-escalation commands automatically, without waiting for the operator's approval.
• Hermes ran in "YOLO" mode, letting dangerous commands execute on their own, and the logs show it running LinPEAS, checking for privilege escalation, enumerating files, and cataloguing PDF, DOC and XLS records from the Office of the Permanent Secretary for Finance, though no files were exfiltrated.
• The operation, found because staging servers left directory listings exposed, also used a previously undocumented cross-platform Go implant called Hades for persistence and staged exploit code including PwnKit (CVE-2021-4034); researchers link it with low-to-medium confidence to a Chinese-speaking operator.

• Nvidia has launched the Open Secure AI Alliance, an industry group aimed at keeping open-source AI models secure while Washington debates whether to restrict them, arguing openness should be paired with safeguards rather than blanket limits.
• The alliance includes Palantir, IBM, Crowdstrike, SpaceX, and Hugging Face, with Nvidia pledging to contribute open models, data, and other resources to speed the development of new cybersecurity tools and techniques.
• The launch comes as the White House weighs limits on Chinese open-source models, after Treasury Secretary Scott Bessent said the administration would scrutinize them for intellectual property theft and later accused Moonshot AI's Kimi K3 of stealing American tech.

• Cl0p ransomware affiliates are breaking into exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data from manufacturers, automotive, aerospace, and retail apparel firms, then demanding payment through double-extortion.
• The attack chains a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a Windchill login weakness, exploiting CVE-2026-12569, a critical (CVSS 9.8) deserialization flaw in releases before 11.0 M030, to run code remotely without any account.
• Ransom-ISAC confirmed active exploitation dating to early June, with CISA adding the flaw to its catalog on June 25; after breaking in, attackers deploy JSP webshells, stage data, and send mass extortion emails, so defenders should apply fixed builds and hunt for hex-named JSP files.

• A newly disclosed exploit chain in GitLab lets any logged-in project member run code on default installations by abusing two memory-safety flaws in Oj, a native C-based JSON parser bundled inside otherwise memory-safe Ruby code.
• The flaws are patched (GitLab CE/EE 18.10.8, 18.11.5, and 19.0.2; Oj gem 3.17.3), with a proof-of-concept demonstrated but no in-the-wild exploitation reported; GitLab.com was already fixed and self-managed operators on affected versions must upgrade.
• An attacker with ordinary push and diff-view access pushes two crafted Jupyter Notebook (.ipynb) files in one commit; the parser mishandles them to hijack a callback pointer and defeat ASLR, running commands as the "git" user to expose source code, secrets, and internal services.

• North Korea's BlueNoroff hacking group is stealing cryptocurrency by luring victims into fake Zoom and Microsoft Teams calls, first scanning their browsers for crypto wallets to decide who is worth a full break-in, according to UK firm JUMPSEC.
• The kit scans a target's browser the moment they land on the fake meeting page, checking for Ethereum connections via the EIP-6963 standard and browser extension IDs matching wallets like MetaMask, then pushes results to an operator dashboard with no prompt shown to the victim.
• On Windows a copied ClickFix command runs a PowerShell loader that downloads a VBScript and adds a Microsoft Defender exclusion, while a silent macOS stealer grabs Chrome master keys from Keychain; Arctic Wolf found over 100 victims across 20+ countries, 41% in the US, with full compromise in under five minutes.

💡 Strategies & Tactics

Other news & articles you might like

• Opus 5 may have solved browser-based prompt injection, the biggest security flaw haunting AI agents LINK

• North Korea arrests bank hacking ring tied to crypto laundering: Report LINK

• Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts LINK

• Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions LINK

• Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems LINK

• Shared Claude chats were reportedly showing up in search engines LINK

🛠️ Trending tools

📚 Trending research papers

💬 How did you find today's edition?

We read every reply — just reply to this email and let us know how we can improve!