"A lot of security still comes down to trusting the wrong screen." That sentence, lifted from this week’s bulletin, threads through the incidents described below: attackers exploiting trust — in login pages, partners, installers, DNS records, and even automated agents — to turn everyday interactions into compromise.
AI agents and autonomous exploitation: knaithe/KnYuan, DeepSeek, Hermes Agent
Unit 42 reported a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan that has run an AI-enabled, largely autonomous campaign. The operation used DeepSeek as the reasoning engine and the Hermes Agent framework for orchestration, letting the stack scan for exploitable targets, generate exploit code, and initiate attacks without continuous human oversight. The campaign targeted seven specific vulnerabilities in widely used products, including Langflow (CVE-2026-33017), n8n (CVE-2026-21858 and CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824). Unit 42 said Hermes Agent provided orchestration — terminal access, Telegram-based command-and-control, and a skills system — while DeepSeek handled code generation, vulnerability assessment, and target selection. The actor also used Claude Code, Codex, and Qwen Code in a limited role.
Supply-chain and trusted-access abuse: OpenVPN, PAM, and fleet APIs
Several incidents in the bulletin illustrate how trusted relationships and exposed integrations give attackers easier paths. Kaspersky described a Toy Ghouls (aka Bearlyfy and Labubu) campaign where initial access came via an OpenVPN connection originating from an external partner’s network, allowing reconnaissance and lateral movement to Windows and Linux hosts before deployment of a custom ransomware family called GenieLocker. Group-IB detailed a covert Linux XMRig campaign first observed in March 2026 that exploited a trusted third‑party relationship to gain initial access, then weaponized the pam_rootok policy to impersonate low‑privileged users and create redundant persistence while suppressing logs. Separately, researcher Eaton Zveare disclosed unauthenticated internal and admin APIs in the My Eicher fleet management system that could enable account takeover and control of entire fleets; the issue was responsibly disclosed on November 3, 2025 and addressed by November 20.
Phishing and real-time deception: LogoKit, fake Claude guides, and recruiter lures
Barracuda warned that LogoKit has evolved into a "real-time deception platform" that builds customized phishing pages per victim, using legitimate services such as Thum.io for screenshots and Clearbit, Google Favicon, ImageKit and Microlink APIs to load authentic logos and imagery. That technique makes generic indicators of compromise harder to apply. Huntress and Malwarebytes supplied concrete examples: victims searching for how to install Claude on a Mac were served a sponsored, weaponized claude.ai/share conversation posing as an Apple Support guide that instructed users to paste a curl command and led to MacSync Stealer; and fake game downloads and cracked software installers distributed RenPy Loader which ultimately delivered Amatera Stealer. SlowMist reported social-engineering lures masquerading as recruiter calls and an "AI meeting tool" called Relay that delivered data-stealing malware for macOS and Windows.
Active campaigns, hijacks, and patching: SonicWall, CubePilot, and Chrome
Credential-stuffing activity beginning July 25, 2026 has produced successful logins to SonicWall VPN and firewall accounts, impacting 92 unique user accounts across 30 organizations, Huntress reported. The activity originated from five IPs and used infrastructure on DigitalOcean. CubePilot disclosed a DNS hijack on July 24 that gave attackers control of cubepilot[.]org DNS settings and TLS certificates for all subdomains, meaning credentials entered on the portal and forum on 24 July "may have been captured"; CubePilot has since regained control and revoked the fraudulent certificates. On the defensive side, Google shipped Chrome security updates on July 29, 2026 addressing 370 flaws — including seven rated critical (CVE-2026-17650 through CVE-2026-17656) — in versions 151.0.7922.71/.72 for Windows and Mac and 151.0.7922.71 for Linux. Google reported that 349 of those flaws were found internally and said none of the patched vulnerabilities had been flagged as actively exploited; it also said Chrome has seen over 1,800 vulnerabilities addressed since the start of the year.
How incident responders, SonicWall customers, and software maintainers are responding
- Incident responders and network teams are being urged — echoed by the U.K. NCSC — to push manufacturers of edge devices (firewalls, VPN gateways and network appliances) to provide forensic observability: reliable telemetry, logging, configuration state, and supported mechanisms to collect memory and at‑rest data after a compromise.
- SonicWall customers and network administrators should treat the reported credential-stuffing campaign as ongoing: Huntress linked the activity to five IPs on DigitalOcean and confirmed 92 impacted accounts across 30 organizations, underscoring the need for credential hygiene and monitoring of automated validation attempts.
- Open-source and package maintainers, and platform operators, are tightening supply-chain controls: GitHub listed concrete steps it has taken to harden supply chains, including safer pull_request_target defaults, read-only Actions cache for untrusted triggers, staged publishing for npm, and expanded credential revocation APIs.
The week's thread is clear in the bulletin's detail: attackers are buying scale from AI, speed from abused trust, and stealth from commonplace conveniences. Defenders are answering with patches, tighter CI/CD controls, and calls for better forensic telemetry — but the attacks documented here show how quickly trust can be weaponized, whether by an automated agent probing for CVEs or a phishing page built in real time. The practical question left by this reporting is not whether these techniques will be used again — the evidence says they will — but how quickly defenders can convert the same specific signals (CVE identifiers, compromised DNS records, IPs used in credential stuffing) into hardened, observable systems that deny attackers simple trust-based shortcuts.