Hunt.io traces intrusions in four countries to AI agents running eight known exploits

Hunt.io's list of exploited flaws runs to eight: Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, path traversals in Grafana and Nexus, and a Nacos authentication bypass ^[4]. All eight are named, published bugs, not undisclosed ones ^[1], and the new part of the campaign sits above them, in the layer that assigned the work. Hunt.io said SecFlow converted "campaign objectives into tasks for specialized AI agents" and supplied those agents with tools, target information, shared storage and network routes ^[2], and that the framework "split reconnaissance, exploitation, collection, and reporting among specialist workers" ^[3].

After exploitation the operator planted web shells generated through a dedicated capability Hunt.io calls GLUTTON, then used them for reconnaissance, privilege escalation, credential theft and custom implant deployment ^[5]. One of those implants is SecBox, a Go-based remote-access and network-pivot framework ^[5]. Named victims include Taiwan's Kuomintang Party History Archives, Indonesia's Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam ^[6]. Details of the campaign first came to light in July 2026 ^[7].

The Hacker News, which compiled the week's items, wrote that "the path in was often already there" ^[18]. For the malicious extension set, no vulnerability was needed. Socket said of the collection code: "The module is byte-identical across all three analyzed extensions. It automatically retrieves authenticated user information, wallet-related bundle data, Firebase access tokens, and application state, then sends the information to threat actor-controlled Vercel deployments" ^[10]. The fourth extension uses a different collector against the same data and still carries artifacts from J7Tracker ^[9].

The U.K. National Cyber Security Centre warned that staff using unapproved AI tools can expose sensitive corporate data and create risks their employers may struggle to detect and manage ^[12]. "Providing shadow AI access to company or customer data likely increases the risk of data breaches, intellectual property loss and failure to meet regulatory requirements," NCSC said ^[13]. On the agents themselves the agency was more direct: "AI agents are complex pieces of software that can have critical security vulnerabilities. If an attacker successfully exploits a vulnerability, they can gain access to the same data, services, and privileges that the agent has legitimate access to" ^[14].

The week's cheapest intrusion used no software at all: Gen Digital described a merger-and-acquisition scam in which attackers impersonate executives, move legal teams onto WhatsApp and personal email, and use forged acquisition documents to start international wire transfers ^[15]. "The attackers presented the acquisition as a tightly controlled transaction coordinated by a reputable adviser, with only a small group involved and an announcement approaching fast," Gen Digital said ^[16]. The targets were senior people in private equity, industrial finance, sales, mining and energy ^[17].