A Chinese-speaking operator running fleets of jailbroken AI coding agents in full-auto mode compromised more than 12,000 WordPress sites, harvested cryptocurrency wallet credentials, and developed blockchain-based command-and-control infrastructure — without direct human involvement at each step. The same day, federal agencies confirmed that AI-generated scripts are being used in active attacks against Siemens S7 Series PLCs across water, energy, and manufacturing environments. A year of MDR casework added a third data point: 30 of 38 confirmed adversarial AI incidents involved AI brand impersonation to distribute malware, including one case where a custom RAT's full development history — commits included — was traceable to an AI coding agent. Across these cases, AI is being used to automate multiple stages of intrusion activity, including reconnaissance, exploitation, credential theft, and payload development.

The window between disclosure and exploitation also remains short. CISA added four critical vulnerabilities to its KEV catalogue today, covering macOS, Windows IKE, VMware, and SharePoint. ShieldBreak, published shortly after Microsoft's August Patch Tuesday, achieves SYSTEM-level privilege escalation on a fully patched Windows 11 system in under 12 seconds using only built-in Windows components. Elementor Pro's CVSS 9.0 flaw requires no authentication, no nonce, and no unusual site configuration — only a published form with a file-upload field. Clop's Windchill campaign, now listing more than 40 named victims including Shell, Philips, and Fiserv, demonstrates how quickly exploitation can scale when a single platform flaw is targeted across multiple organisations.

CISA, the FBI and HHS updated their joint advisory on Medusa ransomware, a RaaS variant active since 2021 that has affected over 500 victims. The update adds new affiliate payment details, exploited vulnerabilities including CVE-2026-1731, and PowerShell obfuscation techniques. It also details new tools such as Nezha and Rclone used for stealth and data exfiltration, with HHS joining as a co-sealer.

ReliaQuest linked Clop to a custom web shell deployed after exploitation of CVE-2026-12569, a critical flaw in PTC Windchill. The implant decrypts stored credentials, maps sensitive vault files and includes a Java class loader enabling further code execution without additional tools. Its traffic uses a custom HTTP header and GZIP compression to evade standard network monitoring.

The CareCloud healthcare breach now affects over 3.7 million individuals, according to HHS data, far above earlier state estimates of roughly 350,000. Attackers accessed a CareCloud AWS environment between 10 and 16 March, stealing names, Social Security numbers, driver's licence numbers and medical and health insurance information. A small subset of victims also had payment card data exposed, and no group has claimed responsibility.

CloudSEK found an exposed directory revealing a Chinese-speaking operator using jailbroken AI coding agents, including Claude Code and Codex, to run intrusions unattended. The operation compromised over 12,000 WordPress sites, harvested crypto wallet keys and seed phrases from a phishing network's exposed database, and deployed cryptojacking malware. The operator was also developing a blockchain-based command-and-control system designed to resist takedowns.

Check Point Research identified a campaign called StopAndProtect that uses thousands of hacked WordPress sites as command-and-control infrastructure, malware distribution points, and stolen data storage. Victims are infected via a ClickFix fake CAPTCHA prompt that executes a PowerShell chain delivering a modular toolkit including ransomware, an SMB/USB worm, a credential stealer, and a custom chat utility. Operator OPSEC failures exposed infection logs covering over 6,000 unique victim IPs, along with attacker source code and close to 2,000 compromised WordPress domains.

The Grandoreiro banking trojan remains active despite a 2024 law-enforcement takedown, with a renewed campaign observed in May 2026 primarily targeting Mexico. Attackers abuse the legitimate Duplicate Files Finder application to load a malicious DLL via sideloading, delivering the payload while blending into trusted software activity. The loader performs extensive anti-analysis checks, including sandbox detection, VM artefact inspection, process blacklisting, and geolocation filtering, before contacting its command-and-control infrastructure.

Gen Threat Labs identified WordlistLoader, a loader that reconstructs shellcode from a wordlist of plain English words and delivers Amatera Stealer through ClearFake fake CAPTCHA campaigns on compromised websites. Amatera has been significantly upgraded since version 4.0.2, adding control-flow obfuscation, hardened syscall invocation through the WoW64 transition, and a revamped Application-Bound Encryption bypass using browser thread-pool hijacking. The latest version, 4.3.3-alpha1, resolves syscall numbers independently and issues them via dynamically generated x64 trampolines to evade user-mode hooks.

A proof-of-concept tool named ShieldBreak, published by the Nightmare-Eclipse disclosure actor, chains Cloud Files, NT Object Manager namespace manipulation, and a timing race in Windows Defender's remediation path to achieve local privilege escalation on fully patched Windows 11 and Server 2025 systems. The exploit redirects Defender's own clean engine to write an attacker-supplied DLL to C:\Windows\System32\phoneinfo.dll, then uses the built-in Windows Error Reporting QueueReporting scheduled task to execute it as SYSTEM. The attack completes in under 12 seconds from a standard user account with no additional arguments required.

CVE-2026-32475, a CVSS 9.0 vulnerability in Elementor Pro versions 4.2.1 and below, allows unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. The flaw stems from a desynchronisation between the plugin's file validation and file-move loops, where submitting an empty first file entry causes the extension blocklist check to exit early while the mover still processes the malicious PHP file that follows. No authentication or nonce is required, and all values needed to exploit the vulnerability are visible in the page's public HTML.

Sophos X-Ops reviewed 38 confirmed adversarial AI-related incidents over 12 months, finding that 30 involved attackers impersonating AI software brands such as Claude, ChatGPT and Copilot to deliver malware via fake installer sites and browser extensions. One case involved a custom Slack-controlled RAT built using Claude as a coding agent, with the commit history confirming AI's role in development. Separately, analysts identified a ransomware intrusion where AI-generated PowerShell tooling with inline Mandarin comments and methodical pre-encryption testing suggested AI-assisted attack scripting.