Loading story…
Check Point Research reported that AI use in offensive cyber operations advanced from planning support to direct execution during March and April, with commercial tools such as Claude Code appearing in live criminal, ransomware, mass-exploitation, and state-linked espionage activity. The report cites persistent AI-assisted operations tied to the breach of nine Mexican government agencies and the Bissa Scanner mass-exploitation platform, and says attackers are increasingly using AI to accelerate reconnaissance, exploitation, and post-compromise actions in ways that closely resemble skilled human operators.
The report also identifies new attack surfaces and scaling effects created by enterprise AI adoption. Agentic configuration artifacts including CLAUDE.md, hooks, settings files, and MCP-related files were described as targets for jailbreaks, supply-chain compromise, and credential theft, while the EvilTokens platform was highlighted for using LLMs to automate token theft, email analysis, business email compromise, and multilingual fraud. Check Point said AI is shrinking the patch window for defenders by speeding flaw discovery and weaponization, pointing to exploitation of an LMDeploy SSRF issue within 12 hours of disclosure, while warning that existing victim-side controls remain poorly suited to detecting AI-executed intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-03, Intezer published research describing five ways threat actors obtain LLM inference access, including underground offensive LLMs, crypto-funded intermediaries, leaked API keys, free-tier APIs, and exposed self-hosted servers. The report said exposed self-hosted LLM servers were the most durable abuse path and documented open instances across multiple AI platforms, including signs of active compromise on 14 LocalAI hosts.
On 2026-06-03, Anthropic published an analysis of 832 accounts banned for malicious cyber activity between March 2025 and March 2026, concluding that attackers are using AI deeper into the intrusion lifecycle, including post-compromise tasks such as account discovery and lateral movement. The report also said MITRE ATT&CK does not yet adequately capture AI-enabled behaviors like autonomous orchestration and agentic execution, and noted discussions with MITRE about evolving the framework.
An ASEC article described the evolution of AI-powered cybercrime from early malicious LLM services such as WormGPT into a broader ecosystem that included paid SaaS tools, open-source releases, local uncensored models, and AI-embedded malware such as Promptflux and Promptspy. The report said AI use had expanded beyond phishing content generation into reconnaissance, exploit validation, credential triage, attack orchestration, and malware self-modification.
On 2026-05-26, Check Point Research published a digest summarizing March–April 2026 AI-related cyber threat activity. The report concluded that agentic AI configuration files had become a persistent attack surface and that existing victim-side controls were poorly suited to detecting AI-executed operations.
In the March–April 2026 period, attackers were reported to have exploited an LMDeploy SSRF vulnerability within 12 hours of its disclosure. The case was presented as evidence that AI is compressing the time between vulnerability disclosure and weaponization.
During March–April 2026, the EvilTokens platform was described as operationalizing LLMs for token theft, email analysis, business email compromise generation, and multilingual fraud at scale. This marked a concrete example of AI-enabled phishing infrastructure being used in the wild.
During March–April 2026, the Bissa Scanner mass-exploitation platform was highlighted as another case where commercial AI tooling was used in active offensive operations. The activity illustrated AI use in scalable criminal exploitation rather than only pre-attack assistance.
During March–April 2026, attackers reportedly used the commercial AI tool Claude Code persistently in a live intrusion affecting nine Mexican government agencies. The case was cited as evidence that AI had moved from planning support into real-time operational deployment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceitpro.com
Open sourceintezer.com
Open sourceanthropic.com
Open sourcedetect.fyi
Open sourceasec.ahnlab.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic disclosed a state-backed espionage campaign in which a Chinese threat group abused **Claude Code** through the **Model Context Protocol (MCP)** to target about 30 organizations in technology, finance, chemicals, and government, with AI reportedly performing **80% to 90%** of the tactical work and humans stepping in only at key decision points. The campaign highlighted how attackers can exploit the same agentic integrations enterprises are deploying for automation, while related research showed how those risks extend to host compromise and autonomous vulnerability discovery: Netskope said Anthropic’s **Claude Mythos** independently found kernel memory corruption bugs, upstream software flaws, and reconstructed n-day vulnerabilities, including one Windows 11 privilege-escalation chain to **SYSTEM**. Defenders are responding with new monitoring and disruption techniques aimed at AI workflows rather than traditional endpoints alone. Splunk published detections for **sensitive data in prompts**, **excessive token use**, and **high-risk filesystem and shell tool invocations** in AWS Bedrock Claude logs, while detection-engineering guidance urged telemetry collection across model requests, responses, tools, MCP server changes, and cross-boundary actions to catch prompt injection, tool poisoning, and unauthorized tool use. Ars Technica also reported on Tracebit’s **"context bombing"** approach, which plants prompt injections in decoy secrets to derail AI hacking agents; in simulated AWS tests, the method reportedly cut full admin compromise rates from **57% to 5%** and reduced compromise with persistence from **36% to 1%**.
Jul 14, 2026
Threat actors are increasingly operationalizing AI and automation to scale attacks and exploit weak controls across both enterprise and consumer environments. An open-source offensive platform dubbed **CyberStrikeAI**—a Go-based “AI-native security testing” framework integrating 100+ tools—was observed in infrastructure used to target **Fortinet FortiGate** edge devices at scale; researchers linked activity to an IP (212.11.64.250) exposing a `CyberStrikeAI` banner and to scanning/communications patterns consistent with mass exploitation. Separately, a newly disclosed and rapidly patched **OpenClaw** vulnerability showed how AI agent tooling can be hijacked: researchers reported that a malicious website could take over a developer’s locally running agent due to inadequate trust-boundary validation, prompting urgent upgrades to **OpenClaw v2026.2.25+**. In parallel, a “vibe-coding” hosted app on the *Lovable* platform leaked data impacting **18,000+ users** after a researcher found **16 flaws (six critical)** tied to mis-implemented backend controls (including missing/incorrect row-level security in *Supabase*), enabling unauthorized access to records and actions like bulk email and account deletion. Criminal monetization also continues to evolve beyond AI-agent risks. **AuraStealer**, a Russian-language infostealer positioned as a successor/competitor after Lumma disruptions, was advertised on multiple underground forums and is supported by a sizable C2 footprint; analysis of 200+ samples identified **48 C2 domains**, with operators abusing low-cost TLDs (e.g., `.shop`, `.cfd`) and using **Cloudflare** as a reverse proxy to mask origin infrastructure. Broader reporting and commentary reinforced that identity and access failures remain a dominant breach driver and that AI adoption is expanding the attack surface via over-privileged agents and “shadow AI,” while ransomware operators increasingly target recovery paths (including backups) and dwell to corrupt restore points. Several items in the set were non-incident thought leadership or workforce content (skills gap, jobs listings, awards, and general AI security tips) and did not add event-specific technical details beyond high-level risk framing.
Jun 29, 2026
Threat actors increasingly abused *legitimate AI tools* and automation to accelerate intrusions, with CrowdStrike reporting an **89% YoY increase in AI-enabled adversary activity** and an average eCrime breakout time dropping to **29 minutes** (fastest observed **27 seconds**). CrowdStrike also described attackers poisoning or hijacking local AI tooling via **malicious JavaScript embedded in npm packages** targeting tools such as *Claude* and *Gemini* to steal credentials and crypto assets, and highlighted a **CHATTY SPIDER** intrusion that began with voice phishing and remote access via **Microsoft Quick Assist**, followed by attempted exfiltration using **WinSCP** and a fallback to **Google Drive** when blocked. Separate reporting detailed additional active campaigns and exploitation trends consistent with faster initial access and persistence: **UAC-0050 (DaVinci Group / “Mercenary Akula”)** used spear-phishing with spoofed Ukrainian judicial themes and multi-layer archives (ZIP→RAR→passworded 7z) to deliver an `*.pdf.exe` dropper that installed **Remote Manipulator System (RMS)** for remote control and file transfer against a European financial institution. **UnsolicitedBooker** shifted targeting to telecoms in Kyrgyzstan and Tajikistan, using phishing documents that prompt “Enable Content” to run macros that drop loaders (e.g., **LuciLoad**, **MarsSnakeLoader**) and deploy **LuciDoor** and **MarsSnake** backdoors. Vulnerability intelligence for January 2026 also warned of **active exploitation** including **APT28** use of a Microsoft Office zero-day (**CVE-2026-21509**) via weaponized RTFs to deliver implants (e.g., **Covenant**), alongside multiple critical authentication-bypass and RCE issues affecting enterprise platforms—reinforcing that adversaries are combining rapid social engineering, supply-chain style delivery, and exploited vulnerabilities to compress dwell time and speed lateral movement.
Jun 29, 2026