Phalanx

Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours

Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.