Weekly Threat Intel: Agentic AI Abuse, Autumn 2026 CVE Exploitation and Stealer Tradecraft

TL;DR: What Happened This Week in Threat Intel

This week’s verified threat intel centers on three converging threats: documented abuse of agentic AI tool integrations in active intrusions, sustained exploitation of long-patched CVEs still missing from far too many environments, and a measurable shift in infostealer tradecraft toward session-cookie theft and mfa bypass. The single most urgent action: audit and lock down every AI agent’s tool permissions and every internet-facing system against the CISA KEV list—today, not this quarter.

Agentic AI Abuse: How Attackers Weaponized AI Agents This Week

Traditional threat reporting has a well-established rhythm: a CVE drops, an exploit appears, a patch follows. Agentic AI abuse breaks that rhythm entirely—because the vulnerability isn’t a memory corruption bug. It’s a reasoning engine with credentials.

The pattern security teams are now seeing in documented intrusions follows a consistent shape. Threat actors are not (yet) coaxing LLM agents into writing malware from scratch. What they are doing is more mundane and more dangerous: hijacking the tool layer. When an agent is wired into an MCP server, a browser automation framework, or an enterprise integration, it inherits whatever those tools can reach—file shares, internal APIs, cloud consoles, ticketing systems. A successful indirect prompt injection planted in a fetched web page, a support ticket, or a code repository comment can redirect that inherited capability. The agent executes with its privileges, not the attacker’s, and the audit trail shows a trusted service account doing the damage.

OWASP’s Agentic AI threat model work—the successor discipline to the OWASP Top 10 for LLM Applications—codifies the core risks: tool misuse, confused deputy behavior, and excessive agency. This week’s observed tradecraft maps directly onto three of them:

• Indirect prompt injection into retrieval pipelines. Malicious instructions embedded in documents the agent ingests, steering it toward exfiltration endpoints disguised as legitimate tool targets.
• MCP server impersonation and over-broad tool grants. Developers installing community MCP integrations with permissions far wider than the task requires—an attacker-controlled MCP server is effectively a C2 channel with a JSON schema.
• Browser-agent abuse for session riding. Autonomous browsing agents that operate inside an authenticated session can be redirected to navigate to attacker-chosen URLs, silently blending malicious requests into legitimate traffic.

The defenders losing ground here are the ones treating agent logs as noise. The agents are already in your environment. The question is whether you can tell their good calls from their bad ones.

Hands-On: Detecting Malicious Agent Tool Calls

Agent abuse leaves traces—it just leaves them in logs most teams don’t baseline. Start with two hypotheses: (1) an agent is calling tools it has never called before, and (2) an agent is sending data to destinations it has never contacted.

Splunk SPL — new tool invocation per agent principal:

index=ai_agents sourcetype=mcp:audit
| stats earliest(_time) as first_seen latest(_time) as last_seen
        count by agent_id, tool_name, destination
| where first_seen > relative_time(now(), "-24h")
| lookup agent_baseline agent_id tool_name OUTPUT allowed
| where isnull(allowed)
| table _time, agent_id, tool_name, destination, count

Microsoft Sentinel KQL — anomalous egress volume from an agent service account:

Heartbeat
| where TimeGenerated > ago(24h)
| where Computer has "agent" or Computer has "llm"
| join kind=inner (
    Usage
    | where TimeGenerated > ago(24h)
    | summarize BytesOut=sum(Quantity) by Computer, bin(TimeGenerated, 1h)
) on Computer
| summarize TotalOut=sum(BytesOut) by Computer
| where TotalOut > 500000000  // 500 MB hourly baseline breach

Generic detection logic worth implementing regardless of SIEM:

• Alert on any agent tool call whose arguments contain base64 blobs, long URL-encoded strings, or destination hostnames not on an allowlist.
• Alert when an agent reads from secret stores, credential vaults, or HR systems—tools it should never touch in normal operation.
• Correlate agent audit logs with egress proxy logs. An agent fetching an internal wiki page followed minutes later by a POST to an unfamiliar domain is your prompt injection working as designed.

Actively Exploited CVEs of the Week

The autumn 2026 exploitation picture is dominated by a familiar problem: mature exploits against products that simply haven’t been patched. CISA’s Known Exploited Vulnerabilities (KEV) catalog remains the definitive triage list, and this week’s active exploitation clusters around edge devices, enterprise file-transfer software, and collaboration platforms.

Patch Prioritization: What to Fix First

Not every KEV entry deserves the same urgency. Rank by exploit maturity × exposure × observed targeting:

1. Internet-facing MFT and file-transfer products first (Cleo, GoAnywhere, MOVEit successors). These are initial access broker inventory—exploitation feeds ransomware within days.
2. Edge and VPN appliances second (PAN-OS, Ivanti class). Exploitation is automated and opportunistic; an unpatched firewall is scanned within hours of exposure.
3. SharePoint and collaboration platforms third, but only if on-prem and externally reachable. The ToolShell chain persists via machine keys, so patching alone is insufficient—rotate keys and hunt.
4. Everything else on the KEV list within your standard 7–14 day cycle, with compensating controls (IP allowlisting, WAF rules) in the interim.

If your exposure management can’t tell you which of these are internet-facing within an hour, fix that before you fix anything else.

Infostealer Trends: New Stealer Tradecraft Observed

Infostealers remain the volume business of cybercrime, and the autumn 2026 tradecraft refinements are less about new malware families and more about delivery polish and post-theft monetization.

Delivery chains observed this week:

• Malvertising with signed installers. Sponsored search results for enterprise software (PDF tools, remote access utilities) landing on lookalike download pages—increasingly serving Authenticode-signed loaders to defeat naive trust checks.
• Cracked-software repos on GitHub. Threat actors publishing functional-looking utilities whose “activation” step is the stealer dropper. The CISA Secure Our World guidance on software sourcing exists for a reason.
• NPM/PyPI dependency confusion and typosquats. Stealer loaders packaged as developer tools—harvesting not just browser data but cloud CLI credentials and CI tokens from developer workstations.

The monetization shift that matters: stealers have moved beyond saved passwords to session cookies and tokens. Modern families (the RedLine/Lumma lineage and its successors) extract Chromium cookie databases and bypass app-bound encryption where possible, then sell “session-ready” logs. The buyer doesn’t crack your MFA—they simply never present a login prompt. This is why stealer infections now produce silent account takeovers that defeat MFA postures configured without token-binding or device posture checks.

Hands-On: Hunting Infostealer Artifacts

Sweep your estate for the fingerprints. These are the highest-yield checks:

Sysmon event IDs to alert on:

• Event ID 11 (FileCreate): writes to %LOCALAPPDATA%MicrosoftWindowsINetCookies or creation of .zip/.log archives in %APPDATA% or %TEMP% shortly after browser processes exit.
• Event ID 10 (ProcessAccess): unknown processes requesting handles to chrome.exe/msedge.exe with PROCESS_VM_READ.
• Event ID 1 (ProcessCreate): suspicious parent chains—explorer.exe spawning reg.exe queries against SoftwareMicrosoftWindowsCurrentVersionRun followed by archive creation.
• Event ID 3 (NetworkConnect): non-browser processes beaconing to Telegram API endpoints or fresh drop domains.

YARA rule skeleton for a stealer archive-staging pattern:

rule Stealer_Staged_Archive_Behavior {
  meta:
    description = "Detects stealer-style staged loot archives"
    author = "Hmmnm Threat Intel"
  strings:
    $zip = { 50 4B 03 04 }
    $s1 = "Login Data" ascii
    $s2 = "Cookies" ascii
    $s3 = "Local State" ascii
  condition:
    uint16(0) == 0x4B50 and 2 of ($s1,$s2,$s3)
}

Browser artifact locations to check manually: Chromium Login Data, Cookies, and Local State files under %LOCALAPPDATA%GoogleChromeUser DataDefault; check modification timestamps against your patch and incident timelines. A Local State decrypted by something that isn’t the browser is a compromise.

Campaign Overlap: Where AI Abuse, CVEs, and Stealers Intersect

Treat these three threat streams as one supply chain, because the operators do. Initial access brokers harvest stealer logs at industrial scale, test which stolen session cookies still authenticate, and resell working footholds. Where no stealer log exists, they buy exploit access against the KEV-listed edge devices above. And increasingly, the post-exploitation playbook includes the enterprise’s own automation: an agent with broad tool grants inside a compromised tenant is a free insider—capable of enumerating SharePoint, querying ticketing systems, and moving data without the operator writing a single custom tool.

The kill chain hasn’t changed. The padding on each stage has: stealers make initial access cheap, unpatched CVEs make it scalable, and agentic AI makes lateral movement and collection less noisy. Defenders who monitor only perimeters miss that all three stages now operate inside trusted boundaries.

Blue-Team Action Checklist

1. Enumerate every AI agent, MCP server, and browser-automation integration in the environment; enforce tool allowlists and least-privilege scopes this week.
2. Deploy the agent tool-call anomaly rules from this article’s detection section into your SIEM.
3. Reconcile your internet-facing asset inventory against the CISA KEV catalog; patch the five CVEs in the table above or apply compensating controls within 72 hours.
4. If you run on-prem SharePoint, rotate machine keys and hunt for webshells—patching alone does not evict ToolShell.
5. Push Sysmon config updates covering the four event-ID patterns listed; back them with the YARA rule in endpoint tooling.
6. Block listed IOCs at egress proxy and DNS; add stealer drop-domain feeds to your threat intel platform.
7. Enable token binding or conditional-access device posture checks to blunt stolen-session logins.
8. Verify backup and recovery paths for any MFT product you expose externally—assume it will be exploited eventually.

CTF and Learning Corner: Practice These Techniques

• Prompt injection: Gandalf by Lakera and the Prompt Airlines-style challenges teach indirect injection and filter evasion hands-on.
• LLM and agent security broadly: OWASP’s GenAI security resources at genai.owasp.org include labs and the LLM Top 10 mapped to test cases.
• Detection engineering: Detection Engineering community resources and the Sigma HQ rule repository for building the SIEM detections above from scratch.
• Endpoint forensics and stealer hunting: CyberDefenders blue-team labs and LetsDefend incident-response challenges include infostealer triage scenarios.
• General hands-on range: TryHackMe and Hack The Box maintain SOC-analyst and malware-analysis paths that mirror this week’s TTPs.

IOC and Source Appendix

• Sources: CISA Known Exploited Vulnerabilities Catalog (cisa.gov/known-exploited-vulnerabilities-catalog); Microsoft Security Response Center (msrc.microsoft.com/update-guide); SAP Security Notes (support.sap.com); Palo Alto Networks security advisories (security.paloaltonetworks.com); Fortra advisories (fortra.com/security/advisories); OWASP GenAI Security (genai.owasp.org).
• Indicators: Hashes and drop domains for the stealer families referenced are distributed through CISA AIS and MISP feeds; due to takedown churn, consume them from a feed rather than a static list—verify against vendor advisories before blocking.

What to Watch Next Week

Three things to monitor. First, disclosure timelines for upcoming edge-device patch releases—historically, public PoC code appears within 72 hours of patch availability, so pre-stage your change windows. Second, watch for the first verified cases of prompt injection chaining multiple tool calls autonomously—that escalation from single-shot injection to multi-step agent abuse would materially change the threat model. Third, monitor stealer log marketplaces for spikes tied to this week’s malvertising campaigns; a flood of fresh corporate SSO session logs is the leading indicator of next quarter’s account-takeover incidents. We’ll cover it here.

Frequently Asked Questions

What is agentic AI abuse in a cybersecurity context?

Agentic AI abuse is when attackers manipulate an AI agent—via prompt injection or by compromising its tool integrations such as MCP servers—so the agent performs attacker-chosen actions using its own legitimate privileges: exfiltrating data, reading secrets, or issuing API calls. The agent is the confused deputy; the abuse rides on trust the environment already extends to it.

Which CVEs should I patch first this week?

Follow the risk-ranked order in the patch prioritization section: internet-facing file-transfer and MFT products first, then edge/VPN appliances, then on-prem SharePoint. Anything KEV-listed with a public exploit and external exposure goes to the top—check the CISA KEV catalog against your asset inventory before choosing anything else.

How do I know if an endpoint is infected with an infostealer?

Look for the signals in the hunting section: unknown processes reading browser data files (Login Data, Cookies, Local State), archive files staged in %TEMP% or %APPDATA%, unusual process/parent chains in Sysmon Event ID 1, and—critically—credential-abuse alerts where a valid session appears from a new device or geography. YARA hits on staged loot archives are conclusive.

Can AI agents be used to launch cyberattacks automatically?

Not in the way headlines suggest. Verified abuse so far involves tool misuse, prompt injection, and data exfiltration through the agent’s existing privileges—not autonomous offensive campaigns. Agents dramatically lower operational toil for attackers who already have a foothold, but claims of self-driving malware are currently hype. That said, monitor the multi-step injection escalation flagged in “What to Watch.”

Where can I practice detecting these threats hands-on?

Start with Gandalf by Lakera for prompt injection, OWASP’s GenAI resources for agent security theory, CyberDefenders and LetsDefend for stealer triage and IR, and the Sigma rule repository for detection engineering practice. TryHackMe’s SOC analyst path packages most of this week’s TTPs into guided labs—all free or freemium.