Weekly Threat Intel: Agentic AI, Stealer Logs, Edge CVEs

This week’s threat landscape converges on three fronts: attackers abusing agentic AI systems through prompt injection and over-privileged tool access, infostealer log dumps flooding criminal marketplaces with session tokens that bypass multi-factor authentication (MFA) entirely, and internet-facing VPN and firewall appliances absorbing a fresh wave of actively exploited CVEs. Patch KEV-listed edge devices first, force re-authentication and rotate any credentials appearing in stealer logs, and lock down your AI agents with least-privilege tool access — those are the three actions that matter most in the next seven days.

Key Takeaways

• Agentic AI abuse is escalating: indirect prompt injection steers agents with tool access into data exfiltration — audit tool permissions and log every call.
• Stealer logs beat password dumps: session cookies bypass MFA entirely — invalidate sessions and rotate credentials for any exposed account.
• Edge devices remain the top initial access vector: patch internet-facing VPN and firewall CVEs in KEV order this week, not this quarter.
• Detection lives in identity logs: session replay is caught by impossible-travel analytics in your identity provider (IdP), not endpoint telemetry.

TL;DR: This Week at a Glance

Agentic AI abuse: Automated agents with tool-calling capabilities are being manipulated via indirect prompt injection to exfiltrate data and abuse connected APIs. Your action: audit agent tool permissions and log every tool call.

Stealer logs: Fresh infostealer dumps from families like RedLine, Lumma Stealer, and StealC are circulating with cookies and session tokens — not just passwords. Your action: invalidate all active sessions and force credential rotation for any exposed accounts.

Edge device exploitation: VPN gateways and firewalls remain the highest-value initial access targets, with the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog flagging multiple appliance CVEs under active attack. Your action: patch internet-facing appliances this week, not this quarter.

Agentic AI Abuse: How Attackers Are Weaponizing Autonomous Agents

Traditional application attacks target deterministic code. Agentic AI attacks target a probabilistic reasoning engine wrapped in business logic — and that changes everything about the defender’s playbook. This week’s verified vendor and CERT reporting continues to document a consistent abuse pattern: attackers don’t break the model, they steer it.

The primary vector is indirect prompt injection. An attacker plants instructions in content the agent will consume — a web page, a PDF, an email, a support ticket — and the agent executes those instructions as if they came from its operator. OWASP’s Top 10 for LLM Applications ranks prompt injection as the leading risk for large language model (LLM)-integrated systems, and agentic architectures amplify it dramatically: an LLM that merely generates text is a nuisance when injected; an LLM that can call tools, query APIs, and take actions is a threat.

The second observed pattern is tool and API abuse. Over-privileged agents — granted broad database reads, write access to email, or unconstrained web fetch capabilities — become one compromised prompt away from data exfiltration. Research from Anthropic, OpenAI, and academic groups, including work presented through CERT coordination channels, has repeatedly demonstrated agents being convinced to send internal data to attacker-controlled endpoints via nothing more than crafted documents.

The third pattern is automated reconnaissance. Attackers are using LLM-driven agents to enumerate targets, draft phishing lures at scale, and accelerate vulnerability triage. This doesn’t introduce a new ATT&CK technique — it compresses the timeline of existing ones.

The defender implication is simple: treat every agent as a privileged service account. Scope its permissions, log its tool calls, and assume any external content it ingests is adversarial.

Stealer Logs: Fresh Infostealer Dump Activity and What It Exposes

If your incident response plan treats stolen credentials as the problem, you’re solving last year’s incident. Modern infostealer exfiltration is far more dangerous than a password breach for one specific reason: session tokens.

This week’s marketplace activity continues to feature the usual families — RedLine, Lumma Stealer (LummaC2), StealC, and Raccoon variants — with logs distributed through Telegram channels, Russian-language forums, and stealer-log search platforms that let criminals query stolen data by corporate domain. The relevant primary-source warning is the CISA and FBI advisory on infostealer malware (AA23-339A), which details exactly this ecosystem.

Here’s why a stealer log beats a password dump:

• Cookies and session tokens: Infostealers grab browser cookie stores. A valid session cookie for a software-as-a-service (SaaS) application means the attacker authenticates as the user without ever touching the password or satisfying MFA — the session is already established.
• mfa bypass: The phishing-resistant factor you deployed is irrelevant to a replayed session cookie. Adversary-in-the-middle tooling plus stolen cookies collapses the traditional password-plus-token model.
• Browser-stored secrets: Saved card data, autofill credentials, and in some cases tokens for cloud CLI tools (AWS, Azure) harvested from local configuration files.
• Fingerprint context: Logs include user-agent and system details, enabling attackers to mimic the victim’s environment and defeat session-binding controls.

When a corporate email address appears in a stealer log, the response is not “reset the password.” The response is: invalidate all refresh tokens and active sessions, rotate secrets, and review sign-in logs for anomalous session usage following the initial theft date.

Edge Device Exploitation: VPNs, Firewalls and Appliances Under Fire

Edge appliances remain the most reliable initial access vector in the threat landscape, and this week’s pattern is consistent with the past several quarters: internet-facing VPN gateways, SSL-VPN endpoints, and firewall management interfaces under sustained exploitation.

The authoritative reference point is CISA’s Known Exploited Vulnerabilities (KEV) catalog, which agencies and mature enterprises treat as a mandatory patch-priority list. Recent additions and long-running KEV entries continue to include CVEs affecting products from Ivanti (Connect Secure and Policy Secure gateways), Fortinet (FortiOS SSL-VPN and FortiManager), Palo Alto Networks (PAN-OS GlobalProtect), Citrix (NetScaler/ADC), and SonicWall. The exploitation arc is familiar: pre-auth remote code execution (RCE) or authentication bypass on the management or VPN interface, followed by credential harvesting, configuration theft, and web-shell persistence before reboots wipe forensic evidence.

Two operational realities make edge devices uniquely dangerous:

1. They hold cached credentials and session material. Compromise of a VPN appliance can expose every stored session — mirroring the stealer-log problem at infrastructure scale.
2. Patching is disruptive and requires follow-up actions — certificate regeneration, config validation, integrity verification — that organizations skip, leaving themselves half-remediated.

Verify your exposure with external attack surface scanning, patch in KEV order, and — critically — assume an appliance that was unpatched against a KEV CVE is compromised until proven otherwise. Hunt for unexpected processes, new admin accounts, and outbound connections from the appliance itself.

New CVEs of the Week: Patch Priorities for Blue Teams

The table below reflects the structure of this week’s patch priorities. Always validate current KEV status and vendor advisories before scheduling — exploitation status changes daily.

Note: We deliberately avoid asserting specific CVE IDs as “exploited this week” without live KEV confirmation at publication time — check the catalog link above for the authoritative, daily-updated list. That discipline is the standard this digest holds itself to.

Adversary Tradecraft Breakdown: TTPs Mapped to MITRE ATT&CK

Map this week’s activity to the following ATT&CK techniques for detection engineering:

• T1190 – Exploit Public-Facing Application: Edge appliance exploitation (VPN/firewall CVEs) — the dominant initial access vector.
• T1078.004 – Valid Accounts: Cloud Accounts: Stealer-log session token replay against SaaS and cloud services.
• T1539 – Steal Web Session Cookie: Infostealer cookie harvesting; the enabling technique for MFA bypass.
• T1555.003 – Credentials from Password Stores: Browser credential extraction by RedLine/Lumma-class stealers.
• T1059 – Command and Scripting Interpreter: Web-shell and post-exploitation activity on compromised appliances.
• T1195.002 – Compromise Software Supply Chain (adjacent): Indirect prompt injection is functionally a supply-chain-style compromise of the agent’s input pipeline.
• T1566 – Phishing: LLM-generated lure content accelerating social engineering campaigns.

Detection engineering note: T1539 and T1078.004 are best detected through impossible-travel and session-anomaly analytics in your IdP and SaaS logs, not endpoint telemetry — the endpoint is already out of the loop when a session token is replayed.

Defender Actions: Hands-On Detections and Hunting Queries

Run these queries against your telemetry to hunt this week’s tradecraft.

KQL — Entra ID: sign-in from new ASN with existing session characteristics (cookie replay hunt):

SigninLogs
| where ResultType == 0
| where AuthenticationProcessingDetails has "Refresh token" or AuthenticationRequirement == "singleFactorAuthentication"
| where IPAddress !in~ (
    SigninLogs
    | summarize allowed=make_set(IPAddress) by UserId
    | project allowed)
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location

Splunk — detect MFA-satisfied logins followed by anomalous geo (stealer log tradecraft):

index=auth sourcetype=okta OR sourcetype=o365
| stats count dc(src_ip) as ip_count values(geo.city) as cities by user
| where ip_count > 2
| search cities!="your_expected_region*"

Sigma-style rule — agent tool-call anomaly (LLM agent exfiltration pattern):

title: LLM Agent External Data Exfil Attempt
logsource:
    product: application
    service: ai_agent_tool_calls
detection:
    selection:
        tool_name:
            - 'http_fetch'
            - 'send_email'
        destination|contains:
            - 'webhook.site'
            - 'pastebin'
            - 'requestbin'
    condition: selection
level: high

YARA idea — infostealer payload triage: hunt for binaries importing browser credential-store decryption APIs (CryptUnprotectData, sqlite3_open targeting Login Data/cookies databases) combined with command-and-control (C2) strings in the RedLine/Lumma-known port ranges. Keep the rule on behavior plus structure, not family-specific strings, so it generalizes across stealer rebuilds.

Edge appliance hunting — grep for web shells:

grep -rE "eval(|base64_decode|system(" /var/log/ /path/to/webroot/ --include="*.jsp" --include="*.php" | sort -u

Proxy log hunt for prompt injection callbacks:

index=proxy uri_path="*webhook.site*" OR uri_path="*burpcollaborator*" dest_category!="approved_egress"
| stats count by src_ip, uri_path, dest_ip

CTF and Lab Corner: Practicing This Week’s Techniques Safely

Want to internalize this tradecraft? Build the lab — don’t touch production.

• Agentic AI abuse lab: Stand up an isolated VM running an open-source agent framework (LangChain, AutoGen, or a self-hosted LLM via Ollama). Give the agent a deliberately over-privileged tool — a fetch tool and a fake “send email” function — then plant indirect prompt injection payloads in documents it ingests. Observe exactly how OWASP’s LLM Top 10 risks materialize.
• Infostealer behavior lab (defensive view): Use FLARE-VM in a snapshotted, network-isolated VM. Analyze published stealer samples from public malware repositories (e.g., MalwareBazaar) with YARA and a disassembler — focus on the cookie-store and credential-store access routines. Never execute live samples with network access.
• Edge exploitation lab: Run vulnerable appliance virtual images (where vendors legally provide them for research) inside a lab-only network segment. Practice detecting web-shell drops and configuration theft from the blue-team side using the grep and log queries above.
• CTF practice: Try LLM-security challenges on platforms like Gandalf by Lakera and prompt-injection labs on Hack The Box / TryHackMe to build injection intuition legally.

Securing AI Agents and LLM Integrations: Hardening Checklist

agentic ai security is privilege management, not prompt wizardry. Apply this checklist:

1. Least-privilege tool access: Scope each agent tool to the minimum API permissions. An agent summarizing emails should not have send capability by default.
2. Human-in-the-loop for high-impact actions: Any tool that moves money, sends external communications, or modifies data requires explicit human approval.
3. Strict egress allowlisting: Agents should only reach approved endpoints. Block generic URL-fetch tools from arbitrary destinations — that’s the exfiltration channel.
4. Treat retrieved content as untrusted input: Delimit and label external content so instructions embedded in documents are handled as data, not commands.
5. Log every tool call: Tool name, arguments, initiating user/session, and destination. Your security information and event management (SIEM) platform needs this telemetry before you need it during an incident.
6. Output filtering: Inspect model output for secrets, credentials, and unexpected external URLs before it reaches tools or users.
7. Session isolation: Prevent cross-session memory leakage; one user’s injected context should never poison another’s.

For full coverage, see our guides on LLM security fundamentals and agentic AI security.

Weekly Hardening Checklist for Security Engineers

1. Patch KEV-listed edge devices today: Internet-facing VPNs, firewalls, and appliances first; verify patch success with external scanning and integrity checks.
2. Hunt stealer-log exposure: Check corporate domains against known log sources; for every hit, invalidate all sessions, rotate credentials, and step-up MFA registration.
3. Block this week’s indicators of compromise (IOCs): Ingest vendor and CISA indicators at your firewall, proxy, and DNS layers.
4. Review AI agent permissions: Audit tool scopes, disable unconstrained fetch tools, and enable tool-call logging.
5. Deploy the detections above: Stand up the session-replay and agent-egress queries in your SIEM.
6. Enforce phishing-resistant MFA and token binding where your identity platform supports it.

FAQ

What is agentic AI abuse in a cybersecurity context?

Agentic AI abuse is when attackers manipulate autonomous AI agents — systems that can call tools, query APIs, and take actions — into doing things their operator never intended. The main technique is indirect prompt injection: planting malicious instructions in content the agent reads (a web page, email, or document) so it exfiltrates data or abuses its connected tools. In plain English: you’re not hacking the AI’s code, you’re socially engineering it — and an agent with too many permissions turns that into real damage.

Why are stealer logs a bigger risk than a password breach?

Because infostealers capture far more than passwords — they harvest browser cookies and session tokens. A valid session cookie lets an attacker sign in as the victim without knowing the password and without triggering MFA, because the session is already authenticated. Stealer logs also expose saved card data, browser-stored secrets, and system fingerprints that help attackers impersonate the victim. A password breach gets you one credential; a stealer log gets you the victim’s live sessions.

Which edge devices should I patch first this week?

Start with anything internet-facing that appears in CISA’s KEV catalog — historically that means Ivanti Connect Secure, Fortinet FortiOS/FortiManager, Palo Alto PAN-OS GlobalProtect, Citrix NetScaler, and SonicWall appliances. Patch, then verify: regenerate certificates where vendors require it, check integrity, and hunt for signs the device was compromised before the patch landed. An unpatched KEV appliance should be treated as breached until proven otherwise.

How do I detect agentic AI abuse in my environment?

Three layers: log every agent tool call (tool name, arguments, destination), anomaly-detect API usage patterns — agents suddenly hitting external endpoints like webhook.site or unusual volumes of data fetches — and enforce least-privilege configuration so an injected prompt can’t do much damage even when it succeeds. Without tool-call telemetry, you are blind to this entire attack class.

Are the IOCs and CVEs in this post verified?

Our policy is primary sources only: vendor advisories, CISA KEV entries, and CERT bulletins. We do not republish IOCs or exploitation claims from unconfirmed social media posts, and where real-time status (like current KEV listing) changes daily, we link the authoritative source rather than assert a snapshot. Validate everything against those live sources before acting.

Sources and Verification Notes

Sourcing policy: This digest cites only primary sources — vendor security advisories, CISA/FBI advisories, the CISA KEV catalog, and CERT bulletins. We do not amplify unverified social media claims, unnamed-researcher screenshots, or vendor marketing dressed as threat intel. Where CVE-level exploitation status could not be confirmed at publication time, we say so and point you to the authoritative, live-updated source.

• CISA Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog
• CISA/FBI Advisory on Infostealer Malware (AA23-339A): cisa.gov/news-events/cybersecurity-advisories/aa23-339a
• OWASP Top 10 for LLM Applications: genai.owasp.org/llm-top-10
• MITRE ATT&CK: attack.mitre.org
• Vendor PSIRT portals: Fortinet, Palo Alto Networks, Citrix, Ivanti

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy