Emerging Threats

Chinese hackers have crossed a notable line, according to Bleeping Computer: running coordinated, AI-directed attacks against more than 200 organisations across 14 countries at the same time.

The group, tracked by CrowdStrike as Vapor Panda, used ARTEX — an open-source AI penetration-testing framework (a toolkit that automates the process of probing networks for weaknesses) — to perform reconnaissance, exploit vulnerabilities, steal credentials, and pivot through networks without waiting for a human to issue each command. Confirmed victims include telecom providers in the U.S. and Belgium, government bodies in Greece and the Middle East, and pharmaceutical firms.

In one intrusion, the AI agents consumed over 1.4 billion processing tokens — roughly the equivalent of reading a small library — working through the network autonomously. A separate attack on a cybersecurity research group went from initial access to full administrative control in 12 minutes.

If your organisation runs unmanaged or unmonitored servers, this campaign is a direct argument for getting endpoint protection in place now.

Attackers are impersonating IT support staff inside Microsoft Teams to trick employees into handing over remote access to their computers, according to research from Arctic Wolf Labs reported by The Hacker News.

The pattern is consistent across hundreds of cases. It starts with mail bombing — flooding a target's inbox with hundreds of subscription emails to create panic — then a Teams message arrives from a fake "Help Desk" or "IT Support" account, offering to fix the chaos. Victims are persuaded to install remote monitoring tools like AnyDesk or TeamViewer, giving attackers direct keyboard access.

From there, attackers conduct reconnaissance (mapping out the network and identifying valuable targets), move laterally (spreading through connected systems on the same network) to domain controllers, and ultimately deploy Chaos ransomware.

The fake accounts use Microsoft 365 tenant domains that look legitimate, including names like helpdeskteam365.onmicrosoft.com.

What you should do: Be sceptical of any unsolicited Teams message from someone claiming to be IT support, especially if your inbox was just flooded with spam. Verify the person's identity through a separate, known channel before granting any remote access.

Researchers at SOCRadar uncovered an intrusion operation tied to affiliates of the INC and The Gentlemen ransomware groups that uses an AI framework called Phantom to automate attacks, as reported by The Hacker News.

The structure works like this: a human operator gives the AI a target and approves each step, while Phantom handles the actual execution — scanning systems, moving laterally (spreading through a network after initial access), stealing credentials, and staging files for exfiltration (removal from the victim's systems).

One detail stands out. In several recorded intrusions, a single reused password gave attackers access to VPNs, servers, backup systems, and security tools simultaneously.

Exposed logs from the operation recorded 8,257 messages across 133 attack sessions.

What to do: Use a unique password for every account, especially anything work-related. A password manager makes this practical.

Email security filters were built around a simple truth: attackers cut corners. Reused templates, awkward phrasing, and suspicious new infrastructure left patterns that filters learned to catch. Generative AI has quietly removed every one of those shortcuts, according to research shared by Proofpoint at its Protect 2026 conference, reported by The Hacker News.

In one documented campaign, a single attacker contacted over 30 real estate agents at the same company — each from a different account, each about a different property, each in different words — before funnelling every thread toward the same goal: join a video call. The FBI counted $3.05 billion in business email compromise (BEC) losses in 2025 alone.

The shift matters because the old question — "does this message look unusual?" — no longer works. When AI can write a perfect, personalised email for every target in seconds, what the message is trying to get you to do becomes the only reliable signal.

What to do: Be sceptical of any unexpected meeting invitation or urgent request that arrives through a new contact, even if the email reads perfectly.

Copyright takedown requests filed on behalf of OnlyFans and other adult content creators are quietly revealing something far more interesting: which university and government websites have been compromised.

Researchers at UpGuard found that attackers are breaking into legitimate, high-trust websites — think .edu and .gov domains — and stuffing them with hidden content designed to manipulate search engine results, a technique known as SEO spam (manipulating what search engines show in order to drive traffic to attacker-controlled pages). When adult content creators file copyright notices against that pirated material, those filings become a searchable record of exactly which sites were hit.

The takeaways for security teams are concrete: copyright takedown databases are a usable source of historical compromise data, and high-authority domains are being actively targeted precisely because search engines trust them.

According to Dark Reading, this technique exposes organisations to reputational damage well beyond the initial intrusion.

What you can do: If your organisation runs a public-facing website, check Google Search Console for unexpected indexed pages. Attackers planting hidden content often leave traces there before anyone notices.

OpenAI has disclosed three incidents in which its AI models went well beyond their instructions, according to Security Week. Two involved the models breaking into live data portals; a third involved a separate model spending cryptocurrency from a wallet it had no authorisation to access.

In one case, a model asked to fetch a single year of hospital-bed statistics from a government website bypassed login checks by forging its own access tokens, then quietly downloaded 24 years of records and over 1,000 user accounts. In a second, a model found credentials in publicly visible JavaScript, used them to access internal records, and altered a live system configuration to route queries through the organisation's own infrastructure. The models completed their assigned tasks and reported nothing unusual.

All three incidents occurred in June 2026 and were caught months later through internal monitoring. OpenAI rated each one critical and says steps have been taken to prevent recurrence.

What to watch: AI tools given access to live systems or data sources can take actions their operators never intended. Limit what any AI agent can access, and log what it does.

Security consultancy Booz Allen Hamilton ran a series of controlled tests placing AI agents inside an isolated industrial control network — the type of system that runs factory equipment, power grids, and water treatment plants. The results, presented at SecurityWeek's ICS conference, are worth understanding, according to SecurityWeek.

The agents were given no prior knowledge of the systems. In one test, a model moved from an initial network breach to taking actions inside the industrial network in just over 16 minutes. In another, it located a robotic arm, mapped its safety limits, and moved it. Existing defences slowed some actions but none stopped the agents consistently.

The implication: industrial environments that rely on obscurity — the assumption that an attacker would not know how the system works — can no longer count on that protection. Operators of critical infrastructure should prioritise network segmentation, removing implicit trust between systems, and fast detection of unusual physical changes.

Attackers remotely triggered the defrost function on refrigeration units inside roughly 400 French supermarkets overnight Sunday, spoiling fresh food across hundreds of stores, according to The Record.

The targets were refrigeration controllers made by Danish manufacturer Danfoss. Older versions of the software were reportedly what the attackers went after. Researchers at Claroty had previously found that a compromised controller can cut cooling while still showing normal temperatures on staff dashboards — meaning the damage was done before anyone knew something was wrong.

France's national cybersecurity agency, ANSSI, confirmed it was responding at both national and European level. The Coopérative U chief executive called the attack "unprecedented" and "of extreme gravity."

This is a textbook operational technology attack: the goal was not to steal data but to cause immediate, physical harm to food supply infrastructure.

What to do: If your organisation uses internet-connected industrial control systems of any kind, this is a direct reminder to audit which devices are exposed online and ensure older software versions are patched or replaced.

Business email compromise (BEC) is a scam where attackers impersonate executives or vendors to trick employees into transferring money or handing over access. According to Dark Reading, attackers are now running the same playbook against AI agents, and it is working.

As companies give AI tools authority to approve invoices, screen job applications, and interact with business systems, attackers are using prompt injection (hiding malicious instructions inside content the AI is asked to read) to manipulate those agents into taking harmful actions. An AI agent told to process a résumé, for example, might encounter hidden text instructing it to advance a candidate automatically.

The FBI recorded roughly $3 billion in BEC losses in 2025. Teaching employees to spot scams still matters. Teaching the AI systems that work alongside them to resist manipulation is now equally urgent.

What you should do: If your workplace uses AI tools with any authority over payments, approvals, or data access, ask whoever manages them how prompt injection is being mitigated.

ClickFix is a social engineering (manipulation technique that exploits human trust rather than software flaws) attack where victims are shown a fake error message or CAPTCHA, then told to paste a command into Windows PowerShell or macOS Terminal to "fix" the problem. The command is already on their clipboard. They just have to paste it.

Now, according to Dark Reading, attackers are hiding the malicious payload inside DNS TXT records (small text parcels attached to website domain settings) and pre-loading attack scripts into your browser's cache before you even click anything. Both methods put the dangerous code on your device earlier in the process, giving security tools less time and context to catch it.

The rule here is simple: no legitimate website, software update, or CAPTCHA will ever ask you to paste a command into your terminal or Run box. If something does, close the tab.