July 23-24 desk: AI agents weaponized, Clop active

Confirmed: a threat actor deployed the Hermes open-source AI agent in fully unattended mode against Thailand’s Ministry of Finance. No human in the loop. The agent ran post-exploitation on its own — host enumeration, privilege escalation attempts, lateral movement — until detected. This is the first documented operational case of an open-source AI agent running in YOLO mode inside a live government network.

The week’s technical queue follows.

AI agents as attack tooling

Three separate data points in 24 hours. The pattern is established.

Hermes / Thai Finance Ministry — Confirmed. Threat actor rented a server, installed Hermes open-source AI agent in YOLO mode (all tool calls auto-approved, no human confirmation required), and aimed it at Thailand’s Ministry of Finance. The agent enumerated hosts, attempted privilege escalation, and moved through the network without any operator intervention. Source: BleepingComputer. Attribution: unconfirmed.

ChatGPT AgentForger — Patched 2026-06-08. Disclosed 2026-07-24. A single phishing link was sufficient to authorize and silently deploy a rogue AI agent inside a victim’s ChatGPT Workspace organization. No secondary user interaction required. Research: Zenity Labs. OpenAI confirmed patch. Confidence: confirmed, fixed. Verify your organization is on a post-patch build.

Kimi K3 / Redis zero-days — Researchers used Kimi K3 AI agents to discover seven zero-days across four Redis versions and build working authenticated RCE PoCs. Redis shipped seven security releases in a single day. See the Redis patch entry below. The cycle — AI-assisted discovery, public PoC, emergency vendor releases — will repeat.

Vulnerabilities — patch queue

Certighost — Active Directory DC impersonation — Working exploit published 2026-07-24 by researchers H0j3n and Aniq Fakhrul. A low-privilege Active Directory user can obtain a certificate for a Domain Controller and authenticate as that machine account. DC accounts carry directory replication rights; the resulting Kerberos credential enables DCSync, which yields all NTLM hashes in the domain. Confidence: confirmed research publication, working PoC is public. No CVE identifier in the disclosure. Full coverage. If your environment runs Active Directory Certificate Services with default configurations, treat this as a patch-now item.

Redis — seven security releases, 2026-07-23 — Authenticated RCE chains documented across Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. Chains require RESTORE command access; Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL plus the bundled RedisBloom module. Patched builds: 6.2.23, 7.2.15, 7.4.10. If you run Redis where untrusted clients have RESTORE access, this is immediate. Full coverage.

NodeBB — eight high-severity flaws, all patched in 4.14.2 — Aikido Security AI pentest agents completed a six-hour review and surfaced all eight. Every version before 4.14.0 is affected. The simplest exploit requires only a settings change to trigger. Administrators should be on 4.14.2. Source: The Hacker News. Full coverage.

Bing image processing — CVE-2026-32194, CVE-2026-32195 (patched) — XBOW confirmed: a crafted SVG submitted to Bing’s image search pipeline executed as NT AUTHORITY\SYSTEM on Windows workers and as root on Linux workers across multiple production hosts in different network ranges. Microsoft issued two critical CVEs and patched the image-processing tier. Attack surface: requires SVG submission capability to Bing’s image API. Full coverage.

Ransomware tracker

Clop / PTC Windchill and FlexPLM — Confirmed active. Clop (Cl0p) is targeting internet-exposed PTC Windchill and FlexPLM product lifecycle management instances in a data theft extortion campaign. No file encryptor — exfiltration only, ransom demanded under threat of publication. Windchill and FlexPLM are common in manufacturing, aerospace, and defense supply chains. If either product is externally accessible in your environment, audit access logs now. Source: BleepingComputer.

Threat intel — active campaigns

BlueNoroff / Zoom-Teams phishing kit — North Korean threat actor (DPRK-aligned, financial crime focus). Confirmed operating phishing infrastructure via typosquatted Zoom and Microsoft Teams domains. New operational detail: the kit profiles crypto wallet holdings before payload delivery, targeting high-value holders first. Ongoing campaign.

UAC-0099 / MATCHBOIL.V2 — Russia-aligned group targeting Ukrainian organizations. Delivery: archive containing the legitimate Notepad++ binary alongside MATCHBOIL.V2 disguised as a Notepad++ plugin. CERT-UA advisory issued 2026-07-24. Confidence: confirmed by CERT-UA.

Golden Chickens resurface — The malware-as-a-service operator has introduced four new families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and a browser credential stealer. Extensive prior public research did not disrupt operations. Confirmed via research publication.

Hotel Wi-Fi DNS hijacking — Active campaign. Attackers modifying DNS on hotel and conference-center Wi-Fi infrastructure to redirect users to fake Microsoft 365 login pages. Attribution: unconfirmed. Scope: unquantified. Source: BleepingComputer. Use a VPN at hotel and conference Wi-Fi; do not trust DNS you did not provision.

Breach queue

• OnTrac — Parcel delivery company began notifying customers that a network breach may have exposed personal data. Breach scope and affected record count: not yet disclosed. Source: BleepingComputer. Confirmed.
• Chick-fil-A — 13,000 accounts — Updated figure from the June 17–19 credential stuffing event. Chick-fil-A confirmed 13,000+ accounts accessed via website and mobile app. Prior disclosure cited 2,182 Texas residents. Confirmed by company.

What to watch

1. Certighost patch coverage. Working exploit is public. Low-privilege AD users can now DCSync any domain where ADCS is misconfigured. Patch priority: immediate. No CVE in the disclosure at time of writing — track for an identifier.
2. Clop and manufacturing PLM. Windchill and FlexPLM are not typical IT targets. Organizations in defense or aerospace supply chains should assess whether third-party Windchill exposure creates indirect risk.
3. AI agents in YOLO mode. The Thai Finance Ministry incident is confirmed. Vendors of AI agent platforms with fully automated operational modes should expect CISA and allied agency guidance within weeks.
4. Redis patch rollout. Seven releases in one day. Internal clusters with RESTORE-accessible untrusted clients are the immediate risk surface; patch before week’s end.

— airgap