A Chinese-speaking hacker used autonomous AI agents to compromise websites belonging to more than 100 companies, spending an estimated $5,000 in AI tokens.

Reuters and NorForge research published October 19 revealed how one operator delegated most intrusion work to software, scaling attacks with minimal human involvement.

The campaign attempted to breach more than 1,200 websites. Identified victims included Deere, SharkNinja, and Cummins, although the affected environments and reported consequences differed. Reuters could not establish the extent of unauthorized data extraction.

Hacker Uses AI Agents to Breach

NorForge principal threat researcher Snorre Fagerland discovered the activity while investigating exposed Cairn instances, an open-source problem-solving platform.

More than 20 publicly accessible dashboards appeared linked to malicious operations, revealing targeting instructions, agent decisions, credentials, and exploitation results.

The most prolific Chinese-language cluster, tracked as AIA0001, operated more than 1,100 attack projects across 14 associated dashboards.

Its targets included e-commerce websites in the United States, Canada, Japan, and Australia. NorForge assessed that the operator sought persistent access to shopping and payment infrastructure for later monetization.

Cairn structures projects around an initial state and an objective. Agents generate “intents,” representing planned actions, and “facts,” representing discoveries.

A shared blackboard lets workers reuse findings, revise hypotheses, and explore alternative attack paths without continuous human direction. The targeting pipeline used Playwright to verify that shopping websites worked.

Instructions prioritized unauthenticated remote code execution, SQL injection, unsafe deserialization, authentication bypass, and vulnerable uploads. Requested payloads included uploader shells designed to preserve access.

NorForge independently confirmed an uploader shell on a vendor’s website. The agent attributed the compromise to unauthorized write access to a memcached session store, unsafe PHP object deserialization, and a gadget chain involving legacy Zend Framework components. Researchers did not independently validate every exploitation step.

Exposed worker directories contained Nmap, OWASP Amass, dnsrecon, ffuf, PHPGGC, Python, and Docker. A worker identifier suggested Claude Code orchestration using a DeepSeek model, but NorForge treated that interpretation cautiously.

Successful AIA0001 projects averaged just under 23 hours. Across observed campaigns, NorForge estimated approximately 10% success, warning that differing objectives prevented straightforward comparisons.

Reuters reported approximately $50 per successful intrusion; NorForge estimated roughly $5 per task, including failures. Both cost estimates remain uncertain because actual token-consumption records were unavailable.

Deere reported remediation and no indication that sensitive information was accessed. SharkNinja said the incident affected a standalone product-support website. Cummins was investigating a third-party vendor website that may have been affected.

The dashboards also exposed hundreds of credentials and other secrets, with TruffleHog verifying 11% as valid. This created additional exposure beyond the original intrusions: the attackers’ own unsecured AI infrastructure made sensitive victim information publicly available.

IOCs

IOC	Notes
199.247.25.25	AIA0002 staging server
199.247.27.2	AIA0002 staging server
46.8.xxx.xx9:8000	AIA0001 panel
95.182.xxx.x42:8000	AIA0001 panel
31.56.xxx.xx7:8000	AIA0001 panel
31.57.xxx.xx9:8000	AIA0001 panel
46.8.xxx.xx3:8000	AIA0001 panel
94.183.xxx.xx3:8000	AIA0001 panel
94.183.xxx.x34:8000	AIA0001 panel
31.59.xxx.xx5:8000	AIA0001 panel
95.182.xxx.x12:8000	AIA0001 panel
31.59.xxx.xx7:8000	AIA0001 panel
94.183.xxx.x54:8000	AIA0001 panel
95.182.xxx.xx5:8000	AIA0001 panel
94.183.xxx.xx8:8000	AIA0001 panel
31.59.xxx.xx3:8000	AIA0001 panel
108.61.xxx.xx6:8000	AIA0002 panel
66.42.xxx.xx9:8000	AIA0002 panel
95.179.xxx.xx3:8000	AIA0002 panel
45.63.xxx.xx7:8000	AIA0002 panel
136.244.xxx.xx6:8000	AIA0002 panel and staging
45.76.xxx.xx0:8000	AIA0002 panel
209.250.xxx.xx8:8000	AIA0002 panel
95.85.xxx.xx9:8000	AIA0002 panel and staging
136.244.xxx.x86:8000	AIA0002 panel
64.176.xxx.xx3:8000	AIA0002 panel
143.246.xxx.xx1:8000	AIA0003 panel

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Hacker Uses AI Agents to Breach Over 100 Websites for Just $5,000 appeared first on Cyber Security News.

Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.

The post One Compromised Login Exposed Millions of California Students’ Records appeared first on SecurityWeek.

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities

Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]

Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” it said at the time, adding that security teams, working to mitigate the issues, took “some” IT systems offline. On Monday, the company confirmed that it proactively took certain IT systems, including websites and apps, offline, affecting most of its brands, and said that “malicious actions of others” caused the security issue. “Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States,” Frans Muller, president and CEO of Ahold Delhaize, said in a Monday statement. “The investigation to date confirms this was the right decision.” At this time, all of the physical stores remain open, and the investigation hasn’t uncovered any evidence to suggest the miscreants stole any “sensitive customer, associate, or partner data,” the disclosure said. The company last week notified the Dutch National Cyber Security Centre about the digital intruders, and on Monday filed a report with the Dutch police, according to the statement. Albert Heijn’s website and app are back online, and the company expects home deliveries to resume on Friday. Belgian e-commerce is fully operational, and e-commerce services at Ahold Delhaize’s American brands (Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop) are expected to work “in the coming days.” The Etos and Gall & Gall websites are also up and running, along with the “majority of websites and apps” across brands serving central and southeastern Europe. Ahold Delhaize did not immediately respond to The Register’s questions about the cyberattack, including whether it was linked to attacks on refrigeration controllers at hundreds of French supermarkets beginning October 11. The attacks reportedly pushed temperatures as high as 122°F (50°C), spoiling food and causing fires at some locations. This latest cyberattack is Ahold Delhaize’s second in two years. A November 2024 digital break-in disrupted brands across the organization, with some Stop & Shop stores struggling to fill prescriptions, while Food Lion employees reported delayed and missing deliveries. INC Ransom claimed responsibility for the attack at the time and leaked some documents reportedly taken from the retailer's systems. Ahold Delhaize ultimately determined more than 2.2 million people’s data - including personal, financial, and health details - had been compromised. ®

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the