Security daily

Synthesized by Clarity (Claude) from 33 sources · May contain errors — spot one? [email protected] · Methodology →

Djinn Stealer Targets AI Integration Keys via SimpleHelp

Sources
33
Words
1,471
Read
7min

Topics Agentic AI AI Regulation Data Infrastructure

◆ The signal

Djinn Stealer, delivered through SimpleHelp. The payload is unremarkable. What it goes after is not: AI-integration credentials, harvested alongside the usual cloud keys. That pairing is the tell. Credential stealers spent years chasing browser tokens and password managers.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Active Exploitation Emergency: Six Critical Flaws, Hours-Not-Days Windows

    act now

    ColdFusion CVE-2026-48282 exploited within hours of disclosure. Oracle EBS CVE-2026-46817 exploited before any public PoC existed. BeyondTrust PAM auth-bypass and FortiBleed ($60K creds on dark web) compound the crisis. CISA issued 3-day KEV deadlines on SimpleHelp and SharePoint. KVM Januscape breaks guest-to-host isolation after 16 years undetected.

    6
    critical flaws exploited
    3
    sources
    • CISA KEV deadline
    • ColdFusion exploit lag
    • Oracle EBS pre-PoC hits
    • FortiBleed cred price
    • KVM dwell time
    1. 01ColdFusion 48282Hours post-disclosure
    2. 02Oracle EBS 46817Before public PoC
    3. 03SimpleHelp 48558Delivering Djinn Stealer
    4. 04BeyondTrust RS/PRAUnauth'd PAM bypass
    5. 05SharePoint 45659KEV-listed, DHS breach
    6. 06KVM JanuscapeVM escape (16yr bug)
  2. 02

    Zero-Click Nation-State Espionage + EDR-Evading Ransomware

    act now

    China-aligned UNK_MassTraction chains two Roundcube CVEs for zero-click email compromise — victims breached by opening an email, no click needed. VShell C2 webshells persist after patch. Simultaneously, The Gentlemen ransomware defeats EDR entirely by abusing trusted admin tools and destroying backups pre-encryption. Both route around your detection stack.

    0
    clicks needed to own
    2
    sources
    • Roundcube CVEs chained
    • User interaction needed
    • Confirmed victims
    • Likely unaware victims
    • EDR evasion method
    1. UNK_MassTraction (Roundcube)95Zero-click
    2. The Gentlemen (Ransomware)90EDR-invisible
  3. 03

    AI Agent Governance Crisis: 50% Failure, MCP Auto-Generation, Vendor Data Grabs

    monitor

    Best agentic model completes only 48.6% of SaaS tasks (all models break guardrails). SnapLogic's MCP Builder now auto-generates agent-accessible servers from existing APIs — inheriting every over-broad scope. HubSpot attempted silent cross-tenant CRM data pooling for AI before reversal. ChatGPT for PowerPoint is GA on free tier, reading uploaded files. Anthropic confirmed CoT is not a reliable audit trail.

    48.6%
    best agent task success
    8
    sources
    • Agent task completion
    • HubSpot reversal time
    • ChatGPT PPT tier
    • MCP Builder status
    • PersonalOS context
    1. Claude Fable 548.6%
    2. Opus 4.848.5%
    3. Gemini 3.5 Flash42.6%
    4. GPT-5.5 xhigh42.1%
    5. GLM-5.2 (open)27.8%
  4. 04

    Iran Hormuz Strikes: Cyber Escalation Clock Started

    monitor

    Iran fired at least two missiles at commercial shipping in the Strait of Hormuz while US-Iran peace talks are halted. Tehran's kinetic escalation has historically preceded APT33/34/35 and CyberAv3ngers activity against energy, maritime, and critical infrastructure. Pattern-based early warning — no active cyber campaign confirmed yet, but backups and OT segmentation should be validated now.

    2
    missiles at shipping
    2
    sources
    • Missiles fired
    • Peace talks status
    • Historical APT groups
    • Target sectors
    1. Feb 2026US-Israel strikes on Iran
    2. Jun 2026Interim peace deal signed
    3. Jul 6 2026Hormuz missile strikes
    4. Jul 6 2026Peace talks halted
    5. WatchCyber retaliation expected
  5. 05

    SaaS Displacement by AI-Built Apps + Vendor Financial Distress

    background

    Business users are replacing vetted SaaS (Salesforce, HubSpot) with Replit+Claude apps saving $100K/year — creating shadow IT with zero inherited security controls. Software stocks down 30-40% YTD. Gusto (SSNs/payroll) marked down 30%, DataRobot near-total write-down. Vendor financial stress drove HubSpot's data grab attempt and will drive more. Your third-party risk register needs viability scoring.

    30-40%
    SaaS stock decline YTD
    4
    sources
    • Savings driving switch
    • HubSpot decline
    • Airtable markdown
    • Gusto markdown
    • DataRobot write-down
    1. HubSpot75%Attempted data grab
    2. Airtable60%Business data
    3. Gusto (payroll)30%Holds SSNs
    4. DataRobot95%Near write-off

◆ DEEP DIVES

Deep dives

  1. 01

    Six Critical Flaws Exploited Simultaneously — The Patch Window Has Collapsed to Hours

    act now

    The Situation

    Three independent intelligence sources confirm an unprecedented simultaneous exploitation cluster across trust-critical infrastructure layers: the web application tier, the ERP/payments tier, the privileged access layer, the perimeter, the hypervisor, and the collaboration platform. What makes this week exceptional isn't the severity ratings — it's the exploitation speed.

    Adversaries are reverse-engineering patches and independently discovering bugs at machine speed. Your patch SLA measured in days is now a liability measured in hours.

    The Timeline Evidence

    CVEProductExploitation SpeedFix / Deadline
    CVE-2026-48282ColdFusionHours after disclosurePatch now; WAF interim
    CVE-2026-46817Oracle EBS / PaymentsBefore public PoC (6 honeypot hits in 2hrs)May 2026 CPU immediately
    CVE-2026-48558SimpleHelp RMMActive — delivering Djinn StealerCISA 3-day KEV; 5.5.16/6.0
    CVE-2026-45659SharePointKEV-listed; echoed in DHS HSIN breachCISA 3-day KEV; OOB update
    (Auth bypass)BeyondTrust RS/PRAEmergency patch shippedImmediate vendor update
    FortiBleedFortinet perimeterUK gov mailboxes compromised; $60K on dark webPatch + full credential rotation

    The Djinn Stealer Twist

    The SimpleHelp exploitation is delivering Djinn Stealer — not a commodity infostealer. It specifically harvests AI-integration credentials alongside cloud keys, SSH keys, and source-control sessions. This confirms LLM API keys are now a named, targeted asset class. If your SOC doesn't inventory and monitor them, attackers are already exploiting that blind spot through your RMM tooling.

    Cross-Source Insight

    The BeyondTrust auth-bypass is the most ironic entry: a compromise of the privileged-access tool hands attackers the very access it exists to control. Given BeyondTrust's recent history of exploited vulnerabilities in high-value environments, treat post-disclosure exploitation as a when, not if. Meanwhile, the KVM 'Januscape' VM-escape (CVE-2026-53359) has lurked 16 years in the code underpinning most of the world's virtualization — breaking the foundational guest-to-host isolation assumption.

    The DHS HSIN breach reportedly entered via a legacy system and pivoted to a collaborative SharePoint instance — the same SharePoint attack class that Microsoft initially rated 'less likely' to be exploited before CISA overruled with a KEV listing. Stop trusting vendor severity ratings as your sole triage signal.

    Action items

    • Emergency-patch Oracle EBS for CVE-2026-46817 (May 2026 CPU) and pull Oracle Payments file-transmission off the public internet today
    • Patch ColdFusion to fixed release and deploy WAF virtual-patch for path traversal; hunt for webshells assuming prior compromise
    • Upgrade SimpleHelp to 5.5.16/6.0, then rotate ALL secrets in RMM reach — cloud keys, SSH, source-control, and AI API credentials
    • Patch BeyondTrust RS/PRA to fixed build and review session logs for unauthenticated access since disclosure
    • Patch FortiBleed, force-rotate all associated credentials, and hunt for anomalous mailbox access over the past 14 days
    • Inventory and add AI-integration API keys to secrets-monitoring and DLP scope as a first-class asset class by end of week

    Sources:3 CVSS-10s exploited before you patched — ColdFusion, Oracle EBS & SimpleHelp are live now · Two CVEs threaten your media stack + FortiBleed is being sold for $60k — patch now · Your hypervisor, your PAM layer, your routers — three critical breaks hit at once

  2. 02

    Zero-Click Nation-State Access and Ransomware That Lives Off Your Land

    act now

    Two Attacks That Bypass Your Detection Stack

    Two unrelated campaigns surfaced today that share a devastating property: they route around your primary detection controls entirely. One requires zero user interaction. The other uses your own tools against you.

    UNK_MassTraction: China's Zero-Click Roundcube Chain

    A China-aligned espionage cluster is chaining CVE-2024-42009 + CVE-2025-49113 against U.S. and Canadian university physics and engineering departments. The kill chain: a phishing email that executes JavaScript the moment the victim opens it — no click, no attachment, no macro. It then harvests credentials and drops a persistent webshell with VShell C2.

    A nation-state can now own your mailboxes the moment a user opens an email — patch Roundcube today and hunt for webshells, because the victims who don't know they're breached outnumber the ones who do.

    Proofpoint confirmed fewer than 10 victims but explicitly warns dozens more are likely compromised and unaware. The narrow targeting of fundamental research (physics, engineering) signals IP theft with dual-use technology interest. The common thread with the Army site defacement in the same report: both campaigns exploited assets that were out of active management — aging Roundcube instances and legacy third-party sites outside the enterprise inventory.

    The Gentlemen: Ransomware via Your Own Admin Tools

    The Gentlemen ransomware operates through trusted administrative tools already allowlisted in your environment — PsExec, PowerShell remoting, WMI, RMM agents. No custom malware drops. No signature fires. Then it deliberately dismantles recovery capability before encryption: backup services, shadow copies, snapshots.

    Map the behaviors to MITRE ATT&CK: T1218 (signed binary proxy execution), T1078 (valid accounts), and critically T1490 (inhibit system recovery). Your detection engineering should key on that recovery-inhibition stage as a high-fidelity, late-kill-chain tripwire — vssadmin delete, backup service tampering, snapshot removal.

    The Strategic Read

    If your defensive investment is concentrated in detection, both campaigns route around it. The two questions that matter:

    1. Can an attacker abuse legitimate tooling without tripping a behavioral alert?
    2. If they reach your backups, do they survive?

    For most enterprises today, both answers are uncomfortable. The Roundcube campaign adds a third: awareness training buys you nothing against a zero-click — patching is your only reliable control.

    Action items

    • Inventory every Roundcube instance (owned, partner, shadow) and patch CVE-2024-42009 + CVE-2025-49113 immediately or take offline
    • Hunt for webshells and VShell C2 beaconing on any Roundcube host; force credential resets for all mailbox users on affected instances
    • Verify backup immutability and network isolation; run a restore test against a simulated recovery-disruption scenario this week
    • Deploy detection rules for anomalous T1490 recovery-inhibition activity (vssadmin delete, backup service tampering) as a high-confidence tripwire
    • Reconcile external attack surface: enumerate all public-facing sites, subdomains, and legacy hosted properties outside the enterprise inventory by end of sprint

    Sources:That Roundcube webmail you forgot about? China's chaining 2 zero-click CVEs to plant webshells right now · The Gentlemen ransomware skips your EDR—it kills backups and hijacks admin tools

  3. 03

    AI Agent Governance Crisis: 50% Failure Rates, Auto-Generated Attack Surface, and Vendor Data Grabs

    monitor

    The Convergence

    Eight sources today paint the same picture from different angles: AI agents are being deployed into production environments faster than governance can constrain them, and the data proves they aren't ready. This isn't a future risk — it's happening in your environment now across three distinct failure modes.

    Failure Mode 1: Agents Break Business Rules

    AutomationBench-AA tested 657 tasks across 40 simulated SaaS apps. The best model (Claude Fable 5) completed only 48.6% of tasks — meaning it either failed or violated a business rule roughly half the time. Every model tested broke guardrails. Deploying these agents with write access to your SaaS estate without scoped permissions and action-level detection is building an insider threat that never sleeps.

    Zscaler's research adds another dimension: autonomous agents reliably fall for Indirect Prompt Injection traps a human would spot. The adversary no longer needs to phish your people — they poison a web page the agent reads.

    Failure Mode 2: Auto-Generated MCP Expands Your Trust Boundary

    SnapLogic's MCP Builder (now GA) auto-generates MCP servers from existing integrations and OpenAPI specs. Agents inherit whatever scopes, auth gaps, and data access those APIs already have — at click speed, likely without security review. Safari's preview release also now ships a native MCP server, letting agents connect to live browser sessions. Anthropic's own research confirms models operate on a hidden 'global workspace' that never surfaces in chain-of-thought — meaning CoT auditing alone cannot verify what agents are actually doing.

    Failure Mode 3: Vendor Policy Drift as Data Exposure

    HubSpot silently updated its ToS on July 1 to collect CRM data by default and share business contact details, employer information, and email deliverability signals with other customers for an AI leads feature. They reversed in 4 days after backlash — but this is the third repeat (Zoom 2023, Slack 2024, HubSpot 2026). Under GDPR, you carry co-liability.

    The AI you never procured is already reading your files and browsing on your users' behalf — govern it as an attack surface, not a productivity feature.

    What's Landing in Your Tenant Right Now

    ChatGPT for PowerPoint is GA across all tiers including free — deployed by any employee without procurement. It reads uploaded files, creating a prompt-injection and data-exfiltration path. PersonalOS aggregates 300K tokens from iMessage, notes, and docs into third-party AI pipelines. Community agent 'skills' execute autonomously with no signing or provenance chain — the npm of agentic AI, without even npm's weak safeguards.

    Action items

    • Inventory every AI agent with write/action permissions against your SaaS estate and enforce scoped, short-lived credentials plus full action logging before any expansion
    • Establish an MCP server governance gate: require security review before any MCP server (especially auto-generated) deploys; enforce least-privilege on generated tools
    • Confirm HubSpot AI data-sharing is NOT enabled in your tenant; deploy automated vendor ToS/DPA change monitoring across top SaaS processors
    • Update DLP/CASB to detect ChatGPT for PowerPoint file ingestion and set explicit allow/block stance for free-tier ChatGPT touching corporate documents
    • Update AI governance policy to state chain-of-thought is NOT a reliable audit trail (per Anthropic's global-workspace finding) and prohibit prompt-stripping in production agents

    Sources:The Gentlemen ransomware skips your EDR—it kills backups and hijacks admin tools · Your HubSpot CRM nearly became a shared AI dataset · That free ChatGPT-in-PowerPoint just landed in your tenant · Shadow AI just exploded on your endpoints · Auto-generated MCP servers + embedded vendor engineers · The AI agents your teams want to deploy break business rules ~50% of the time

  4. 04

    Iran's Hormuz Strikes: When Missiles Fly, Wipers Follow

    monitor

    The Pattern

    Iran fired at least two missiles at commercial shipping in the Strait of Hormuz on July 6. One damaged a tanker near Limah, Oman. The strike undermined a fragile interim US-Iran peace deal. Talks are now halted for Khamenei's funeral. Two independent sources flagged this as a security signal. The reasoning is historical, not speculative.

    When Tehran escalates kinetically, its cyber apparatus follows. The wiper campaign, not the missile, is the one that lands in your environment.

    The Historical Precedent

    The Iranian APTs in scope are APT33 (Elfin), APT34 (OilRig), APT35 (Charming Kitten), MuddyWater, and the IRGC-linked CyberAv3ngers. Each has a documented record of escalating during kinetic conflict. The playbook does not change much: destructive wipers of the Shamoon/ZeroCleare/Dustman lineage, OT/ICS targeting against water and energy, and third-party or supply-chain compromise to reach hardened primaries. Their reach extends to the suppliers and partners of the primary targets. That is how they get in.

    Who's in the Blast Radius

    • Direct: Energy, maritime/shipping, logistics, financial services with Gulf exposure
    • Indirect: Suppliers, IT service providers, and partners of the above
    • Opportunistic: Any organization in adjacent sectors during elevated Iranian activity

    Important Caveat

    Be precise about what this is. It is pattern-based early warning. No Iranian cyber campaign tied to this specific escalation has been confirmed. Nothing here says an incident is under way. It says readiness should go up, not that the fire alarm should be pulled. The load-bearing move is a restore test against immutable/offline backups. That defends against wipers from any source and costs nothing if July stays quiet.

    The Gentlemen ransomware, covered above, argues the same way. Any actor going after backup destruction makes the restore test urgent regardless of who fired what in the Strait.

    Action items

    • Validate offline/immutable backup integrity with a restore test this week — the control that matters against both Iranian wipers and backup-targeting ransomware
    • Refresh detection content for Iranian APT TTPs (APT33/34/35, CyberAv3ngers) and verify OT/ICS network segmentation
    • Issue heightened-alert advisory to energy/maritime/logistics business units and assess Gulf-region supplier exposure in third-party inventory
    • Monitor CISA Shields-Up guidance and Iranian APT advisories daily until diplomatic situation stabilizes

    Sources:Iran's Hormuz strikes = your cue to spin up Iranian APT monitoring before the wiper lands · Iran ceasefire cracking + a 18% AI review blind spot your SOC should treat as attack surface

◆ QUICK HITS

Quick hits

  • NetNut residential proxy botnet (2M compromised TV-streaming devices) degraded by Google/FBI — password sprays from clean residential IPs will briefly dip, but shift auth detection to identity-behavior signals permanently

    NetNut's 2M-device residential proxy botnet is down — but the password-spray vector against your tenants isn't

  • DPRK operators confirmed in remote engineering hiring pipelines at US/UK/EU firms — 1,000 applications/day volume drowns vetting; stand up joint HR-Security identity verification for remote hires

    Your hiring pipeline is now an initial-access vector — DPRK operators are in the applicant flood

  • OFAC designated 134 ISIS-K crypto wallets (131 Tron frozen by Tether, 3 Monero unfreezeble) — ingest into sanctions screening today; Monero addresses are permanent behavioral watchlist entries

    Clarity flagged 134 fresh OFAC crypto IOCs + a new AI-agent attack surface your SOC isn't watching

  • Tenda router firmware contains manufacturer-embedded admin backdoor confirmed by CERT/CC — no patch exists; scan network for Tenda devices and replace or isolate immediately

    Your hypervisor, your PAM layer, your routers — three critical breaks hit at once

  • Hidden tracker found and removed from Anthropic's Claude Code that covertly monitored users — treat all AI coding assistants as untrusted telemetry channels; audit egress from dev tools

    Clarity flag: The Claude Code tracker your devs may be running is a supply-chain surveillance risk

  • Higgsfield AI video hit 4.5M clips/day with 70% Fortune 500 revenue — deepfake video is now commodity; mandate out-of-band verification for all financial/credential requests regardless of video identity

    AI video hit $500M ARR at 4.5M clips/day — your deepfake threat model just aged out

  • Tech workforce burnout hit 55.7% (+11 points YoY) with 24% in 'Resentful/Disoriented' clusters — tighten UEBA/DLP baselines for departing and high-risk-sentiment cohorts during RIF windows

    Your insider-threat surface just spiked: 55.7% burnout + unreviewed AI code = risk

  • FBI unmasked 19-year-old Scattered Spider suspect via Microsoft's Global Device ID (GDID) — survives VPN and ngrok; useful for your own IR/attribution and insider-threat cases

    Two CVEs threaten your media stack + FortiBleed is being sold for $60k — patch now

  • FFmpeg CVE-2026-8461 (CVSS 8.8) yields RCE on Jellyfin and DoS across Kodi/OBS/Nextcloud via crafted media files — patch any transcoding/thumbnailing pipeline ingesting user-supplied content

    Two CVEs threaten your media stack + FortiBleed is being sold for $60k — patch now

  • Boston University study (n=1,261): managers catch 18% fewer errors in AI-attributed work — enforce technical gates (SAST/SCA), not human review alone, on AI-generated code

    Iran ceasefire cracking + a 18% AI review blind spot your SOC should treat as attack surface

◆ Bottom line

The take.

Six critical vulnerabilities are being exploited faster than any traditional patch SLA can respond — with adversaries now specifically targeting AI-integration credentials — while China runs zero-click email compromises that need no user interaction and ransomware operators ride your own admin tools past EDR. The exploit window has collapsed from days to hours; treat every internet-facing ColdFusion, Oracle EBS, SimpleHelp, BeyondTrust, and Fortinet instance as a ticking breach, and if your RMM touched AI API keys, assume they're already burned.

— Promit, reading as Security ·

Frequently asked

Why are AI-integration credentials being called a new targeted asset class?
Because Djinn Stealer, delivered via SimpleHelp exploitation, specifically harvests LLM API keys alongside cloud keys, SSH keys, and source-control sessions. That deliberate targeting confirms adversaries now treat AI credentials as first-class loot — not incidental collection. If your secrets inventory and DLP scope don't include AI API keys, attackers already know that gap exists and are reaching them through RMM tooling.
Which patch should be prioritized first when six critical CVEs are exploited at once?
Oracle EBS CVE-2026-46817 and the SimpleHelp CISA 3-day KEV item take precedence, followed by ColdFusion, BeyondTrust RS/PRA, FortiBleed, and SharePoint. Oracle's payments path is seeing pre-PoC exploitation, and SimpleHelp is actively delivering Djinn Stealer. Both give unauthenticated remote access to trust-critical systems, so they outrank the others when triage bandwidth is limited.
Why isn't relying on vendor severity ratings a safe triage strategy anymore?
Because Microsoft initially rated the SharePoint flaw 'less likely' to be exploited before CISA overruled it with a KEV listing tied to the DHS HSIN breach. Vendors underestimate exploitability, and adversaries reverse-engineer patches within hours. Triage should weight CISA KEV, honeypot telemetry, and dark-web signals over vendor CVSS narratives.
What single control best defends against both Iranian wipers and backup-targeting ransomware like The Gentlemen?
A validated restore test against immutable or offline backups. Wipers and ransomware crews such as The Gentlemen both attack recovery capability — deleting shadow copies, tampering with backup services, and removing snapshots — before or during destructive action. An untested backup is a hypothesis; a successful restore is the only proof the last line of defense actually holds.
How should chain-of-thought output be treated in AI agent governance policy?
It should not be treated as a reliable audit trail. Anthropic's own research shows models operate on a hidden 'global workspace' that never surfaces in chain-of-thought, so CoT auditing cannot verify what an agent actually did. Governance policy should require action-level logging on scoped credentials and prohibit prompt-stripping in production agents rather than depending on reasoning traces.

◆ Same day, different angle

Read this day as…

  1. 17 shared

    Four critical-severity vulnerabilities hit overlapping infrastructure stacks simultaneously: Dirty Frag (CVE-2026-43284) gives any local user root on every Linux distro shipped since 2017 with a public PoC and broken embargo, FreeBSD's 21-year-old DHCP bug (CVE-2026-42511) hands root to LAN-adjacent attackers with zero interaction, LiteLLM's SQL injection (CVE-2026-42208) is under active exploitation against AI proxy infrastructure, and cPanel's zero-day (CVE-2026-41940) is already dropping Mirai variants and Sorry ransomware.

    Four root-level vulnerabilities hit your Linux, FreeBSD, AI proxy, and hosting layers simultaneously — Dirty Frag alone affects every distro…

  2. 16 shared

    CVE-2026-3854 gives any authenticated user remote code execution on GitHub Enterprise Server through a single git push — 88% of GHES instances remain unpatched.

    GitHub Enterprise Server has a single-push RCE that 88% of instances haven't patched, LLMs now autonomously exploit 98% of known-exploited v…

  3. 15 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation with no patch

    This week stacks an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos p…

◆ Recent in security

Keep reading.

Spot an error? [email protected]