Daily · 2026-07-25
🎯 Hermes Agent Weaponized in Bangkok, 🎯 Hotel Wi-Fi DNS Hijacks M365, 🎯 Botnets Hit 60M IPs, ⚠️ Rockwell Arena Flaws Patched, 📋 CIRCIA Pushback, 📋 Europol Com Crackdown
First documented case of an open-source AI agent weaponized against a government ministry, APT28-linked hotel Wi-Fi DNS hijack campaign, botnet ecosystem surpasses 60M IPs, Rockwell patches Arena Simulation flaws, industry pushes back on CIRCIA reporting rules, and Europol flags 4,340 URLs in 'The Com' crackdown.
The Hermes incident is the day's defining story: an open-source AI agent ran unattended in YOLO mode through post-exploitation against Thailand's Ministry of Finance. Recovered artifacts show exploit code, webshells, tunneling tools and stolen credentials aimed at Hadoop, Ambari and GlassFish, and they name ministry systems directly. Hermes is the first documented case of an AI agent with unrestricted decision authority in a real attack chain, and defenders can no longer model intrusion automation as human-paced.
Hotel and conference Wi-Fi is the quieter problem. Compromised gateways rewrite DNS to serve fake Microsoft 365 login pages to traveling employees in finance, legal and health care. The hotel Wi-Fi campaign resembles APT28 router operations, and real-time proxy phishing defeats SMS MFA.
Supporting data: residential proxy botnets now exceed 60 million IPs, with IPIDEA back near pre-takedown strength within hours; TrickBot returned with DNS tunneling; and slopsquatting research shows AI agents hallucinating package names consistently enough for attackers to pre-register them.
Watchlist: phishing-resistant MFA for corporate accounts, behavioral detection of proxy-rotated traffic, and approval gates for packages fetched by AI coding assistants.