Today’s stories share a theme: the gap between “an attacker got in” and “an attacker did damage” keeps shrinking, whether the accelerant is an AI agent, a stolen session token, or a public exploit chain against an unpatched plugin. Here’s what’s new since yesterday’s digest.
Threat actor watch: AI agents ran a full ransomware attack chain in under 10 hours
Palo Alto Networks’ Unit 42 investigated an intrusion where a human operator directed frontier AI models and agentic attack frameworks to carry out nearly every step of a ransomware attack — reconnaissance, lateral movement, privilege escalation, and exfiltration — compressing what normally takes human operators around two weeks into under 10 hours. The attacker’s AI agents monitored the environment, evaluated results, and re-planned in real time as conditions changed, rather than following a static script. In an unusual twist, a “documentation agent” compiled an 80-page security audit of the victim’s environment and left it behind alongside the ransom note. Unit 42’s conclusion is blunt: the attack didn’t rely on a novel zero-day or elite tradecraft, just AI-assisted operational speed — and defending against machine-speed attacks increasingly requires machine-speed response, such as automated playbooks that revoke credentials, kill OAuth sessions, and isolate cloud accounts the moment anomalous activity is confirmed. The Register · Cybernews
If your incident response runbooks assume you have hours to triage before an attacker moves from initial access to impact, this is a good week to re-time them. A 10-hour attack chain means detection-to-containment latency measured in tens of minutes, not the next business day — which puts real pressure on whether your alerting actually pages someone at 3 a.m., not just logs the event.
Identity security watch: Infostealer malware is hijacking Claude login sessions to drain accounts
Anthropic disclosed that infostealer malware families — including Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer on a small number of Macs — has been stealing browser cookies and session tokens from infected endpoints and using them to hijack victims’ Claude accounts. The compromise doesn’t originate from Claude itself; it’s a downstream consequence of malware already resident on the user’s machine. Attackers used the stolen sessions to burn through victims’ paid usage and run their own workloads at someone else’s expense. Anthropic’s response was to sign out compromised sessions, remove saved payment methods, and refund unauthorized charges. Help Net Security · BleepingComputer · Dark Reading
Stolen session tokens are more dangerous than stolen passwords precisely because they skip MFA — the authentication already happened, and a replayed cookie looks like the legitimate user picking up where they left off. This is true for any SaaS session, not just AI tools. If your detection coverage only watches for new logins and unfamiliar devices, it will miss a hijacked session presenting a token that was valid an hour ago. Watch for the actual tells instead: an impossible-travel jump in the same session, a sudden change in usage pattern or API call volume, or a session that outlives its normal token lifetime.
Vulnerability watch: Mass exploitation hits two WordPress plugins with critical RCE flaws
Wordfence reports blocking more than 440,000 exploit attempts against two unrelated critical vulnerabilities in widely used WordPress plugins. CVE-2026-14894 (CVSS 9.8) in Super Forms – Drag & Drop Form Builder and CVE-2026-32475 (CVSS 9.0–9.8) in Elementor Pro both stem from missing file-type validation, letting an unauthenticated attacker upload arbitrary files — including executable PHP — to a vulnerable site. A successful upload drops a web shell that can be used to create rogue administrator accounts, exfiltrate data, or take over the entire site. Fixes are available in Super Forms 6.3.314 and Elementor Pro 4.2.2. The Hacker News
Unauthenticated arbitrary file upload is about as bad as a WordPress vulnerability gets, and 440,000 blocked attempts is a strong signal that scanning is already indiscriminate across the internet — not targeted. If either plugin is in your stack, patching is not optional this week, and it’s worth checking your web server or WAF logs for POST requests to the plugins’ upload endpoints in the days before you patched, in case the update landed after an attempt already succeeded.
Also noted
Researchers have published a survey of 39 distinct attack techniques against passkey authentication — including prompt flooding, credential interface deception, assertion replay, and FIDO interface overlay attacks — that compromise accounts without breaking the underlying FIDO2 cryptography itself. The point isn’t that passkeys are broken; it’s that a modern passkey ceremony touches the browser, OS, password manager, cloud sync service, mobile device, Bluetooth transport, account recovery flow, and help desk — and researchers are finding weaknesses in nearly every one of those handoffs rather than in the cryptography. None of the 39 techniques are known to be operationalized by criminals yet, but the playbook is now public. BleepingComputer
Final thought
None of today’s stories required a novel exploit primitive — an AI agent executing known attack steps faster than a human team, a stolen session cookie standing in for a password, a missing file-type check in a plugin used on millions of sites. The common failure mode is trusting a signal (a session, an upload, an authentication ceremony) without verifying it’s still what it claims to be at the moment it’s used. If you want help reviewing whether your detection logic actually catches session replay and anomalous account activity rather than just new-device logins, see our how-to guides or book a discovery call.