Reported by 2 outlets
BlackHatSect0r uses AI agent with disabled safety controls for credential theft and attack automation
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks
gbhackers.com · 26d ago · September 17th, 2026
A French-speaking cybercrime crew calling itself BlackHatSect0r && DXQRTXX allegedly disabled safety controls in a self-hosted AI agent and used the resulting system to automate mass credential harvesting, target discovery, phishing preparation, and attack orchestration. The internet-exposed server reportedly contained 4.9 GB of material across 9,299 files, including a custom Go-based command-and-control platform named DXSCAN, […] The post BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from www.redhotcyber.com
The hacker recruited hundreds of AI agents: 11 organizations breached in 26 seconds
www.redhotcyber.com · 26d ago · September 17th, 2026
The hacker recruited hundreds of AI agents: 11 organizations breached in 26 seconds. An unknown attacker exploited hundreds of AI agents to target PaperCut NG and MF servers, compromising 440 instances across 395 organizations in 48 countries. Researchers from GreyNoise and Blackpoint Cyber discovered the campaign, which began on August 31, used AI models based on OpenAI Codex and DeepSeek to develop exploits and search for targets. Two zero-day vulnerabilities, CVE-2026-81578 and CVE-2026-82078, were urgently patched by PaperCut developers. The attacker, reportedly Russian-speaking, used AI agents to study vulnerable PaperCut versions, set up an Active Directory lab, write working PoC exploits, and debug them. After successful testing, hundreds of agents simultaneously searched for internet-accessible servers and attacked them automatically. In under four hours, the attacker went from initial code execution on a real victim server to domain admin privileges in one of the compromised organizations. At peak capacity, the campaign breached at least 11 organizations in just 26 seconds. At one US school, the path from initial access to domain admin took only seven minutes. The attacker stole credentials from 280 victims, extracted secrets from 147 others, and achieved domain admin in 12 organizations. Educational institutions were hardest hit with 204 victims. The attacker instructed agents not to touch organizations in 28 countries including Russia, China, and Iran, but the AI did not always respect these boundaries. Tools used included Mimikatz, Certipy, BloodHound, Rubeus, Impacket, NetExec, and Ligolo-ng. Source: https://www.redhotcyber.com/post/lhacker-ha-arruolato-centinaia-di-agenti-ia-11-organizzazioni-violate-in-26-secondi/