{"stand":"2026-10-30","von":"2023-08","vorfaelle":[{"datum":"2026-10-29","id":"2026-10-29-vapor-panda-artex","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"China-nexus group turns AI agents on foreign ministries (ARTEX, VAPOR PANDA)"},{"datum":"2026-10-29","id":"2026-10-29-wiz-agent-kryptoboersen-fintechs","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent steals cloud credentials and goes after about 25 crypto exchanges and fintechs"},{"datum":"2026-10-29","id":"2026-10-29-wiz-agent-java-dienst","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Likely AI agent works through 602 steps after a break-in through a Java service"},{"datum":"2026-10-29","id":"2026-10-29-wiz-agent-flowise-instanzen","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Likely AI agent uses a hijacked Flowise instance to attack dozens more"},{"datum":"2026-10-28","id":"2026-10-28-n0n-opencode-skripte","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Extortionist has the OpenCode AI agent write attack scripts (n0n)"},{"datum":"2026-10-28","id":"2026-10-28-123-reg-artex","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"AI-driven attack exposes customer data at registrar 123 Reg (ARTEX)"},{"datum":"2026-10-27","id":"2026-10-27-hades-kimi-code-agent","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Kimi Code agent runs a 32-day ransomware campaign, per the attacker’s file (HADES)"},{"datum":"2026-10-27","id":"2026-10-27-vmmanager-hoster-ki-werkzeuge","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attack with AI tools hits dozens of hosting providers through VMmanager"},{"datum":"2026-10-27","id":"2026-10-27-qianxin-krankenhaus-desredteam","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker takes over a hospital web server with an AI agent (DesRedTeam)"},{"datum":"2026-10-26","id":"2026-10-26-seoul-polizei-artex-60-firmen","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Suspect allegedly hacked 60 South Korean companies with an AI pentest system (ARTEX)"},{"datum":"2026-10-26","id":"2026-10-26-warp-agentenschwarm-drittanbieter","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Breach at Warp through a vendor, CEO suspects an agent swarm"},{"datum":"2026-10-26","id":"2026-10-26-php2shell-firewalls-dream","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker takes over 25 servers and uses scripts suspected to be AI-assisted (PHP2Shell)"},{"datum":"2026-10-23","id":"2026-10-23-cyberstrikeai-agenten-japan","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attackers turn 44 AI agents loose on web applications in Japan (CyberStrikeAI)"},{"datum":"2026-10-23","id":"2026-10-23-yamaha-router-japan-skripte","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker gets into Japanese corporate networks via VPN devices, likely with AI help"},{"datum":"2026-10-23","id":"2026-10-23-php2shell-behoerde-europa-agent","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Suspected AI agents access password hashes at a government entity in Europe"},{"datum":"2026-10-23","id":"2026-10-23-llm-angriffsplaene-japan","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker uses a language model for planning and breaks into two companies"},{"datum":"2026-10-22","id":"2026-10-22-railway-umgebungsvariablen","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Railway says uncensored AI models enabled the exploits in its platform breach"},{"datum":"2026-10-22","id":"2026-10-22-91app-artex-bestelldatenbank","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"E-commerce software provider 91APP loses order data to an AI pentest system (ARTEX)"},{"datum":"2026-10-21","id":"2026-10-21-carliy0s-banken-lateinamerika","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Group uses Claude agents to attack Latin American banks (CARLIY0S, CyberCartel)"},{"datum":"2026-10-21","id":"2026-10-21-claude-code-gesundheitswesen-argentinien","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Operator uses a Claude Code harness to break into 15 healthcare organizations in Argentina"},{"datum":"2026-10-21","id":"2026-10-21-claude-code-behoerden-brasilien-kolumbien","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Chinese-speaking operator turns Claude Code on government agencies in Brazil and Colombia"},{"datum":"2026-10-21","id":"2026-10-21-claude-code-skills-indonesien","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Operator arms Claude Code with 819 skills to attack Indonesian government domains"},{"datum":"2026-10-21","id":"2026-10-21-claude-code-crm-anbieter-usa","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Russian-speaking group uses Claude Code to steal client data from a US software vendor"},{"datum":"2026-10-21","id":"2026-10-21-bugster-hermes-universitaeten-indien","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Actor uses Hermes and DeepSeek to steal student data in India (BUGSTER)"},{"datum":"2026-10-21","id":"2026-10-21-litellm-1-107-pypi","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Stealer likely written with LLM help ships in LiteLLM 1.107.0 on PyPI"},{"datum":"2026-10-21","id":"2026-10-21-storm-0940-artex-connectwise","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"China-aligned group reportedly hit ConnectWise customers with AI agents (Storm-0940)"},{"datum":"2026-10-21","id":"2026-10-21-sophos-zwei-einbrueche-webanwendungen","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Intruders likely using AI agents break into a network via SQL injection"},{"datum":"2026-10-21","id":"2026-10-21-sophos-webshells-upload-luecke","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Intruders likely using AI agents plant web shells through a file upload flaw"},{"datum":"2026-10-19","id":"2026-10-19-ki-agent-multi-cloud-einbruch","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent gets in via Kafka UI and reaches AWS, GCP and the identity provider"},{"datum":"2026-10-19","id":"2026-10-19-dodo-pizza-datasuckers","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Arrested hacker allegedly used AI tools in the Dodo Pizza breach (DataSuckers)"},{"datum":"2026-10-18","id":"2026-10-18-opencode-console-schluessel","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Breach at OpenCode, co-founder points to the attackers’ agents"},{"datum":"2026-10-17","id":"2026-10-17-jugendlicher-stadtunternehmen-spanien","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Teenager in Spain reportedly used AI models to steal data on about 5,000 residents"},{"datum":"2026-10-15","id":"2026-10-15-cl-unk-1211-linux-behoerden","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attackers spy on government servers, apparently with AI help (SysGoRAT, CL-UNK-1211)"},{"datum":"2026-10-15","id":"2026-10-15-cert-in-agenten-frameworks","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Criminals hit Indian organizations with publicly available AI attack frameworks"},{"datum":"2026-10-15","id":"2026-10-15-openai-statistikseite-geheimnisse","jahr":2026,"monat":"2026-10","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI model pulls server secrets from a government statistics website"},{"datum":"2026-10-15","id":"2026-10-15-openai-forschungsorganisation-systeme","jahr":2026,"monat":"2026-10","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI model breaks into a research organization’s internal systems during tests"},{"datum":"2026-10-14","id":"2026-10-14-scutum-ki-agenten-japan","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agents attack websites of Japanese companies"},{"datum":"2026-10-14","id":"2026-10-14-operation-cairn-behoerden-asien","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Operator turns DeepSeek-powered AI agents on government agencies in Asia (Operation CAIRN)"},{"datum":"2026-10-13","id":"2026-10-13-tangerhuette-digitales-rathaus","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Software maker calls the break-in at Tangerhütte’s digital town hall an AI attack"},{"datum":"2026-10-13","id":"2026-10-13-uta0576-ivanti-zero-day","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker likely uses LLMs to build an Ivanti VPN zero-day chain (UTA0576)"},{"datum":"2026-10-12","id":"2026-10-12-claude-code-deepseek-einbrueche","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agents running Claude Code on DeepSeek break into online stores (Cairn)"},{"datum":"2026-10-12","id":"2026-10-12-cpr-register-daenemark","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Attackers extract Denmark’s civil registry with allegedly AI-written code"},{"datum":"2026-10-09","id":"2026-10-09-inc-affiliate-phantom-wormgpt","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Ransomware affiliates run intrusions through the WormGPT AI assistant (Phantom, INC)"},{"datum":"2026-10-09","id":"2026-10-09-japan-datenleck-welle-ki-agent","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attackers target Japanese companies with an AI pentest system (ARTEX)"},{"datum":"2026-10-09","id":"2026-10-09-claude-hochschulserver-polizeiformular","jahr":2026,"monat":"2026-10","rolle":"vollautonom","rolle_bis":null,"titel":"Claude Mythos Preview runs commands on a university server during testing"},{"datum":"2026-10-08","id":"2026-10-08-ahsaycbs-krypto-mining","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Attackers hijack AhsayCBS servers and hide their miner, apparently with AI help"},{"datum":"2026-10-07","id":"2026-10-07-server-uebernahme-cairn-agenten","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agents take over a server through an exposed Spring Batch feature (Cairn)"},{"datum":"2026-10-06","id":"2026-10-06-cyberxero-claude-code-agenten","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Russian-speaking access broker deploys up to 51 Claude Code agents (CyberXero)"},{"datum":"2026-10-06","id":"2026-10-06-grosskirchen-seoul","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attacker using suspected AI subagents steals data from two Seoul megachurches"},{"datum":"2026-10-06","id":"2026-10-06-atb-datasuckers","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Ukrainian retailer ATB says attackers used AI at nearly every stage (DataSuckers)"},{"datum":"2026-10-05","id":"2026-10-05-openai-agenten-wikimedia","jahr":2026,"monat":"2026-10","rolle":"vollautonom","rolle_bis":null,"titel":"Suspected OpenAI agents try to abuse Wikimedia’s Etherpad as a proxy"},{"datum":"2026-10-05","id":"2026-10-05-gentlemen-affiliate-azazel","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Extortion affiliate wires a reverse shell into an AI assistant (Azazel, The Gentlemen)"},{"datum":"2026-10-04","id":"2026-10-04-ki-agenten-tencent-amap","jahr":2026,"monat":"2026-10","rolle":"vollautonom","rolle_bis":null,"titel":"AI agents on Tencent Cloud work around Amap’s bot protection and use leaked credentials"},{"datum":"2026-10-02","id":"2026-10-02-opencode-erp-spanien","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Crew with OpenCode AI agent steals ERP data from Spanish firms (Open Ledger)"},{"datum":"2026-10-02","id":"2026-10-02-banken-suedkorea-ki-agent","jahr":2026,"monat":"2026-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attacker reportedly used AI pentest system to steal South Korean bank data (ARTEX)"},{"datum":"2026-10-01","id":"2026-10-01-killsec-operation-killswitch","jahr":2026,"monat":"2026-10","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware gang allegedly used AI to build its infrastructure and find victims (KillSec)"},{"datum":"2026-09-30","id":"2026-09-30-freizeitplattform-webshells","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker plants webshells on municipal recreation platform, scripts likely AI-generated"},{"datum":"2026-09-29","id":"2026-09-29-npm-biz44-steuerserver","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker likely reworks the command server of an npm stealer with an AI assistant (biz44)"},{"datum":"2026-09-24","id":"2026-09-24-operation-master","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"AI agent writes the intrusion code for an invoice fraudster (Operation Master)"},{"datum":"2026-09-24","id":"2026-09-24-divd-ki-agent","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent picks each next step on its own inside DIVD’s hacked network"},{"datum":"2026-09-23","id":"2026-09-23-openai-agent-medicare-australien","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI models pull non-public data from Australian government services"},{"datum":"2026-09-23","id":"2026-09-23-remcontrol","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Android banking trojan with an AI-built command server (RemControl)"},{"datum":"2026-09-23","id":"2026-09-23-openai-agenten-datenportale-transluce","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"AI agents probe data portals for flaws, OpenAI confirms one case"},{"datum":"2026-09-22","id":"2026-09-22-onlineshops-agenten-gambit","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Agents running Opus 4.6 attack online stores and steal more than 600,000 credit cards"},{"datum":"2026-09-22","id":"2026-09-22-carbonato-docker-hermes","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Docker botnet installs a Hermes agent on the hosts it takes over (CARBONATO)"},{"datum":"2026-09-22","id":"2026-09-22-corp-mdm-logistik","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Android spyware aimed at logistics firms, likely developed with AI help (Corp MDM)"},{"datum":"2026-09-21","id":"2026-09-21-kapibala-greynoise","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker with likely AI-written tools breaches a Western government body (Kapibala)"},{"datum":"2026-09-20","id":"2026-09-20-kunming-nas-angriffsskripte","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker in Kunming has AI write attack scripts against home servers"},{"datum":"2026-09-18","id":"2026-09-18-gemini-irregular","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"Google’s Gemini model gets into three real companies during a test exercise"},{"datum":"2026-09-18","id":"2026-09-18-loot-ultravault-datadog","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"AI-built panels manage and test stolen credentials (Loot, UltraVault)"},{"datum":"2026-09-18","id":"2026-09-18-fsi-deepseek-agent-weblogic","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker turns a DeepSeek agent on WebLogic servers in the financial sector"},{"datum":"2026-09-18","id":"2026-09-18-ostorlab-scope-drift","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"AI pentest agent strays from its assignment and attacks an outside vendor"},{"datum":"2026-09-17","id":"2026-09-17-leakysensey-proxy-cybernews","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Patched Claude Code reportedly hijacks 87,000 IPs for a proxy network (LeakySensey)"},{"datum":"2026-09-17","id":"2026-09-17-qilin-ki-skripte","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware gang stages likely AI-generated wiper and ransomware scripts (Qilin)"},{"datum":"2026-09-17","id":"2026-09-17-scarlet-loop-zenox","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Language models pick payment services and test leaked credentials (SCARLET LOOP)"},{"datum":"2026-09-16","id":"2026-09-16-blackhatsect0r-dxqrtxx","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Script deletes a Hermes agent’s refusals (BlackHatSect0r \u0026\u0026 DXQRTXX)"},{"datum":"2026-09-16","id":"2026-09-16-openai-geleakter-api-schluessel","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI model in training uses an API key leaked on GitHub"},{"datum":"2026-09-16","id":"2026-09-16-mandiant-cloud-fehlersuche","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker builds tools with language models inside a healthcare organization’s cloud"},{"datum":"2026-09-16","id":"2026-09-16-rathat","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Android banking trojan uses Gemini to find tap targets and rank victims (RatHat)"},{"datum":"2026-09-15","id":"2026-09-15-phantomraven","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Bug bounty hunter spreads an LLM-generated infostealer via npm (PhantomRaven)"},{"datum":"2026-09-15","id":"2026-09-15-operation-chewbacca","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Group sabotages oil, gas and finance firms with partly AI-built software (Chewbacca)"},{"datum":"2026-09-14","id":"2026-09-14-aepd-ki-agent-spanien","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Organization reports a breach by an AI agent to Spain’s data protection authority"},{"datum":"2026-09-13","id":"2026-09-13-hacktron-openai-forum","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Claude-built exploit opens OpenAI’s forum and staff accounts to researchers"},{"datum":"2026-09-11","id":"2026-09-11-sans-isc-inferenz-lieferkette","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Agent builds itself a supply chain for stolen compute"},{"datum":"2026-09-11","id":"2026-09-11-gemstuffer","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"RubyGems package flood attributed to OpenAI agents (GemStuffer)"},{"datum":"2026-09-11","id":"2026-09-11-hacking-cat-monkey-ransomware","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Hacktivists encrypt data in Russia with likely AI-built ransomware (Hacking Cat)"},{"datum":"2026-09-10","id":"2026-09-10-innentaeter-israel","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Israel charges a security officer with breaching 26 companies using AI-built malware"},{"datum":"2026-09-10","id":"2026-09-10-nsw-online-registry","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Sydney man accused of scraping 8,769 restricted court registry files with ChatGPT scripts"},{"datum":"2026-09-10","id":"2026-09-10-gtg-20006-russische-spionage","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Russian-speaking spies have agents rework flagged malware (GTG-20006)"},{"datum":"2026-09-10","id":"2026-09-10-gtg-50014-shinyhunters","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"ShinyHunters-linked affiliates use Claude to break in and extort companies (GTG-50014)"},{"datum":"2026-09-10","id":"2026-09-10-gtg-10007-exploit-schmieden","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Chinese-speaking spies have parallel subagents probe their targets (GTG-10007)"},{"datum":"2026-09-10","id":"2026-09-10-gtg-50029-fafsearch","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Lone actor hacks European parties and media with Claude (fafsearch, GTG-50029)"},{"datum":"2026-09-10","id":"2026-09-10-gtg-50020-ki-lieferkette","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Russian-speaking actor sends agents against some thirty AI companies (GTG-50020)"},{"datum":"2026-09-10","id":"2026-09-10-nordkorea-suedkoreas-finanzsektor","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean actors hit South Korea’s financial sector with AI-written scripts"},{"datum":"2026-09-09","id":"2026-09-09-bluemoon","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Four espionage groups use an exploit kit likely developed with AI (BlueMoon)"},{"datum":"2026-09-09","id":"2026-09-09-manus-ai-c2-brasilien","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Manus AI steals certificates and VPN credentials from Brazil’s social security agency"},{"datum":"2026-09-09","id":"2026-09-09-papercut","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Codex agents running DeepSeek compromise 395 organizations via PaperCut flaws"},{"datum":"2026-09-09","id":"2026-09-09-anthropic-opus-4-6-vierter-vorfall","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"Early Claude Opus 4.6 version compromises a third party’s system during testing"},{"datum":"2026-09-09","id":"2026-09-09-kataru-iot-nozomi","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"IoT malware likely assembled with AI infects a honeypot (KATARU)"},{"datum":"2026-09-08","id":"2026-09-08-pivotc2","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-built RAT infects 178 FortiGate devices (PivotC2)"},{"datum":"2026-09-08","id":"2026-09-08-gtig-sechs-stunden-zugangsdaten","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attacker uses AI agents to build a credential theft campaign in under six hours"},{"datum":"2026-09-08","id":"2026-09-08-gtig-recon-framework","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Exposed C2 server holds AI agents and 23,800 harvested secrets (Recon)"},{"datum":"2026-09-08","id":"2026-09-08-adalat-ai-agentenschwarm","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Researcher breaks into Adalat AI’s systems with an AI agent swarm"},{"datum":"2026-09-04","id":"2026-09-04-openai-agentenschwarm-dsewiki","jahr":2026,"monat":"2026-09","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI agent swarm hijacks a German-language wiki as a message board"},{"datum":"2026-09-03","id":"2026-09-03-secflow","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI workers on Claude, DeepSeek and Qwen break into Fengtai’s district office (SecFlow)"},{"datum":"2026-09-03","id":"2026-09-03-screenconnect-vbs-wurm","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Rogue ScreenConnect clients run scripts, one of them likely AI-written"},{"datum":"2026-09-03","id":"2026-09-03-super-forms-mushr00w","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Super Forms exploits drop an AI-generated uploader (Mushr00w)"},{"datum":"2026-09-02","id":"2026-09-02-unit-42-einbruch-50-techniken","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attacker uses agents to chain more than 50 ATT\u0026CK techniques in under ten hours"},{"datum":"2026-09-02","id":"2026-09-02-gentlemen-affiliate-hermes","jahr":2026,"monat":"2026-09","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Extortion affiliate breaches companies with a DeepSeek-run Hermes agent (The Gentlemen)"},{"datum":"2026-09-02","id":"2026-09-02-nodestealer-spaehprogramm","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Facebook infostealer expanded into spyware, likely with AI help (NodeStealer)"},{"datum":"2026-09-01","id":"2026-09-01-breeze-comet","jahr":2026,"monat":"2026-09","rolle":"augmentiert","rolle_bis":null,"titel":"Group uses AI to develop scripts for attacks on Brazilian banks (BREEZE COMET)"},{"datum":"2026-08-31","id":"2026-08-31-tuktuk-the-gentlemen","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware group develops its C2 framework, reportedly with AI (TukTuk, The Gentlemen)"},{"datum":"2026-08-31","id":"2026-08-31-brazetsu","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"AI scores hijacked computers for an access marketplace (BraZetsu, Exilware)"},{"datum":"2026-08-31","id":"2026-08-31-metr-agenten-kampagne","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attackers use AI agents to probe METR for weaknesses"},{"datum":"2026-08-28","id":"2026-08-28-gryxa","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Coding agent builds an attack ecosystem for 324 hosts after a jailbreak (Gryxa)"},{"datum":"2026-08-27","id":"2026-08-27-agatha-brasilien-oasis","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Likely Claude-assisted attacks on Brazilian agencies and companies (AGATHA)"},{"datum":"2026-08-27","id":"2026-08-27-aurora-ransomware","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Ransomware affiliate deploys Cursor with Claude 4.5 Sonnet inside victim networks (Aurora)"},{"datum":"2026-08-27","id":"2026-08-27-metabase-zero-day-llm","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker exploits a Metabase zero day, likely with LLM help"},{"datum":"2026-08-24","id":"2026-08-24-slime22-taiwan","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Claude moves laterally through a Taiwanese tech company’s network (Slime22)"},{"datum":"2026-08-24","id":"2026-08-24-thinktank-signal-datenbank","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Hacking tool vendor uses ChatGPT to try to decrypt a think tank’s Signal data"},{"datum":"2026-08-24","id":"2026-08-24-huapi-taiwan","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Group attacks a Taiwanese company’s email system with a Chinese AI model (Huapi)"},{"datum":"2026-08-20","id":"2026-08-20-uat-10147","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Chinese-speaking group has PentestGPT attack web servers (SPECTRE, UAT-10147)"},{"datum":"2026-08-20","id":"2026-08-20-kimsuky-gmail-erweiterung","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean group steals Gmail through a Chrome extension with AI traces (Kimsuky)"},{"datum":"2026-08-19","id":"2026-08-19-sophos-slack-rat","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"RAT co-written by Claude uses Slack as C2 at a financial services firm"},{"datum":"2026-08-19","id":"2026-08-19-silkparasite","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Spies target Central Asian government bodies with likely AI-assisted code (SilkParasite)"},{"datum":"2026-08-19","id":"2026-08-19-cloudsek-kryptodieb","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attacker steers Claude Code and Codex against nearly 9,000 WordPress sites"},{"datum":"2026-08-19","id":"2026-08-19-sophos-sonicwall-sma","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware operator uses possibly AI-written scripts after a SonicWall breach"},{"datum":"2026-08-19","id":"2026-08-19-siemens-s7-ki-skripte","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"AI-generated scripts access Siemens S7 controllers in the US"},{"datum":"2026-08-17","id":"2026-08-17-operation-asterix","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Claude Code checks over 100,000 Polish numbers for crypto fraudsters (Operation ASTERIX)"},{"datum":"2026-08-14","id":"2026-08-14-meta-muse-spark","jahr":2026,"monat":"2026-08","rolle":"vollautonom","rolle_bis":null,"titel":"Meta’s Muse Spark 1.1 attacks a real website in testing and alters its database"},{"datum":"2026-08-13","id":"2026-08-13-gambit-drei-taeterserver","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Claude Code accidentally takes an Australian energy utility’s firewall offline"},{"datum":"2026-08-13","id":"2026-08-13-zerofot-auto-scan","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Scanner built with Codex and Claude Code harvests nearly 3,000 credentials (Zerofot)"},{"datum":"2026-08-13","id":"2026-08-13-rage-kryptominer-framework","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Apparently AI-generated framework spreads cryptominers through exposed services (RAGE)"},{"datum":"2026-08-12","id":"2026-08-12-dream-multi-agenten-asien","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Multi-agent framework built on Hermes and OpenClaw attacks government bodies in Asia"},{"datum":"2026-08-10","id":"2026-08-10-fitnessstudio-australien","jahr":2026,"monat":"2026-08","rolle":"vollautonom","rolle_bis":null,"titel":"OpenClaw agent exploits a flaw in an Australian gym’s booking system"},{"datum":"2026-08-04","id":"2026-08-04-openai-irregular","jahr":2026,"monat":"2026-08","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI model takes over a real website in testing, mistaking it for part of the simulation"},{"datum":"2026-08-04","id":"2026-08-04-uk-aisi-mythos-5-gpt-5-6","jahr":2026,"monat":"2026-08","rolle":"vollautonom","rolle_bis":null,"titel":"Mythos 5 and GPT-5.6 Sol act without permission on the open internet in UK tests"},{"datum":"2026-08-04","id":"2026-08-04-talos-telegram-mini-apps","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"OpenClaw agent attacks Telegram Mini Apps and dumps a user database"},{"datum":"2026-08-04","id":"2026-08-04-talos-deluge-cryptojacking","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Operator hijacks torrent clients to mine Monero and has an AI manage the servers"},{"datum":"2026-08-04","id":"2026-08-04-talos-token-pipeline","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"AI turns React2Shell exploits into a credential pipeline (Token Pipeline)"},{"datum":"2026-08-04","id":"2026-08-04-talos-kameraplattformen","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI coding assistant attacks live camera platforms and a model gateway"},{"datum":"2026-08-03","id":"2026-08-03-jesta-deepseek-proxyjacking","jahr":2026,"monat":"2026-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"DeepSeek agent hijacks weakly secured servers for proxyjacking"},{"datum":"2026-08-03","id":"2026-09-08-slim-spider","jahr":2026,"monat":"2026-08","rolle":"augmentiert","rolle_bis":null,"titel":"Group ranks targets with AI and breaks into Brazilian financial firms (Slim Spider)"},{"datum":"2026-07-31","id":"2026-07-31-ransom-isac-beute-indizieren","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Extortionists have language models analyze stolen data (The Gentlemen, FulcrumSec)"},{"datum":"2026-07-31","id":"2026-07-31-captivecrunch","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Group hijacks hotel Wi-Fi captive portals with AI help (CaptiveCrunch, Storm-2945)"},{"datum":"2026-07-30","id":"2026-07-30-unit42-knaithe-hermes","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Chinese-speaking actor aims a Hermes agent at more than 460 targets (knaithe)"},{"datum":"2026-07-30","id":"2026-07-30-anthropic-opus-4-7-evaluierungen","jahr":2026,"monat":"2026-07","rolle":"vollautonom","rolle_bis":null,"titel":"Claude Opus 4.7 breaks into a real company during Anthropic tests"},{"datum":"2026-07-30","id":"2026-07-30-claude-mythos-5-pypi-schadpaket","jahr":2026,"monat":"2026-07","rolle":"vollautonom","rolle_bis":null,"titel":"Claude Mythos 5 uploads a malicious package to PyPI during Anthropic tests"},{"datum":"2026-07-30","id":"2026-07-30-anthropic-forschungsmodell-firma","jahr":2026,"monat":"2026-07","rolle":"vollautonom","rolle_bis":null,"titel":"Anthropic’s internal research model breaks into a company during testing"},{"datum":"2026-07-29","id":"2026-07-29-zyxel-botnetz-deepseek-telekom","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Zyxel botnet has DeepSeek classify hijacked devices by industry"},{"datum":"2026-07-29","id":"2026-07-29-earth-lamia-thailand","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Claude Code attacks an organization in Thailand as an autonomous agent"},{"datum":"2026-07-28","id":"2026-07-28-tokenlover-yaksalover-m365","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-built phishing platforms hijack Microsoft 365 accounts (TokenLover, YaksaLover)"},{"datum":"2026-07-24","id":"2026-07-24-wp-botnet-master","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Student of an AI exploit course runs a WordPress botnet (WP Botnet Master)"},{"datum":"2026-07-23","id":"2026-07-23-laundry-bear-aa26-204a","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Malware behind a Zimbra zero-day intrusion likely built with AI (Flowerbed, Laundry Bear)"},{"datum":"2026-07-23","id":"2026-07-23-hermes-thailand-finanzministerium","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Hermes agent combs through systems of Thailand’s finance ministry"},{"datum":"2026-07-22","id":"2026-07-22-inc-ransom-v-silicon","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Affiliate attacks v-silicon with likely LLM-written scripts (INC Ransom)"},{"datum":"2026-07-21","id":"2026-07-21-apk-werkstatt-surat","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"18-year-old in Surat allegedly built 121 malicious Android apps with AI tools"},{"datum":"2026-07-21","id":"2026-07-21-riverbaybuy-hermes","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker targets installment platforms with likely AI-written scripts (UTA-2026-019)"},{"datum":"2026-07-20","id":"2026-07-20-dragonforce-ki-opferbericht","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Extortionists use a likely AI-generated breach report as leverage (DragonForce)"},{"datum":"2026-07-20","id":"2026-07-20-webdav-labor-curp-mexiko","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"LLM-built delivery setup spreads PureRAT via fake Mexican government site"},{"datum":"2026-07-18","id":"2026-07-18-auftragshacker-phuket","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"26-year-old in Phuket allegedly learned hacking from an AI chatbot to erase warrants"},{"datum":"2026-07-16","id":"2026-07-16-hugging-face-einbruch","jahr":2026,"monat":"2026-07","rolle":"vollautonom","rolle_bis":null,"titel":"OpenAI agents escape their sandbox and break into Hugging Face"},{"datum":"2026-07-15","id":"2026-07-15-tag-150-finanzkunde","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-generated script infects a financial firm’s machine (DinDoor, TAG-150)"},{"datum":"2026-07-14","id":"2026-07-14-hunt-io-claude-code-deepseek","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Claude Code and DeepSeek compromise government systems in Afghanistan and Thailand"},{"datum":"2026-07-13","id":"2026-07-13-lexfo-drei-phishingbetreiber","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Operator builds a device code phishing kit with Claude (black-queen, saroula01)"},{"datum":"2026-07-13","id":"2026-07-13-lexfo-red-queen-mail-argenta","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Operator extends an Evilginx kit with AI and steals sessions (red-queen, mail-argenta)"},{"datum":"2026-07-08","id":"2026-07-08-huntress-ad-kartierung","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker maps Active Directory with an LLM-generated PowerShell script"},{"datum":"2026-07-08","id":"2026-07-08-scmbanker-mexiko","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"LLM likely writes a fraud kit aimed at Mexican bank customers (SCMBANKER, REF6045)"},{"datum":"2026-07-08","id":"2026-07-08-sqlmap-claude-code-telekom","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker targets telecom providers in Germany and Hungary with sqlmap and Claude Code"},{"datum":"2026-07-07","id":"2026-07-07-syndis-einzeltaeter-persistenz","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker sets up at least 16 persistence mechanisms, likely with help from an LLM"},{"datum":"2026-07-07","id":"2026-07-07-icecube-roundcube-universitaeten","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Spies hack campus mail servers with a likely AI-built stealer (IceCube, UNK_MassTraction)"},{"datum":"2026-07-06","id":"2026-07-06-cavern-manticore","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Iranian group attacks Israel with likely AI-assisted code (Cavern Manticore)"},{"datum":"2026-07-06","id":"2026-07-06-bandai-channel","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Japanese teenager cancels 46,812 Bandai Channel subscriptions with ChatGPT-built malware"},{"datum":"2026-07-06","id":"2026-07-06-northwave-agent-ransomware-kette","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Suspected Claude agent breaks in through web apps and steals a production database"},{"datum":"2026-07-06","id":"2026-07-06-openclaw-neo-phishing-steuerberater","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Telegram-directed OpenClaw agent phishes US tax professionals (Neo)"},{"datum":"2026-07-03","id":"2026-07-03-armored-likho","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Group hits agencies and the power sector with likely LLM-written loaders (Armored Likho)"},{"datum":"2026-07-02","id":"2026-07-02-avalon-crownx","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":null,"titel":"Phishing email delivers a likely AI-built ransomware framework (Avalon, CrownX)"},{"datum":"2026-07-01","id":"2026-07-01-sysdig-jadepuffer","jahr":2026,"monat":"2026-07","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent runs an extortion operation from break-in to encryption (ENCFORGE, JadePuffer)"},{"datum":"2026-07-01","id":"2026-07-01-front-gate-tickets-claude","jahr":2026,"monat":"2026-07","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Researcher uses Claude to take over a Front Gate Tickets admin account"},{"datum":"2026-06-30","id":"2026-06-30-gekaperte-ollama-litellm-endpunkte","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Attackers hijack Ollama and LiteLLM honeypots to power offensive tools (Strix)"},{"datum":"2026-06-29","id":"2026-06-29-sygnia-erpressung-aws","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker takes over an AWS environment in 72 hours with likely AI-assisted tooling"},{"datum":"2026-06-29","id":"2026-06-29-akira-bumblebee-tunnelskript","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Intruders secure access with a likely AI-written tunnel script (Bumblebee, Akira)"},{"datum":"2026-06-26","id":"2026-06-26-cartwright-llm-loader-onlineshop","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Likely LLM-written loader diverts online store payments (Cartwright)"},{"datum":"2026-06-26","id":"2026-06-26-tencent-yunding-agentenangriffe","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent works its way through a company network in under six hours"},{"datum":"2026-06-26","id":"2026-06-26-tencent-yunding-odoo","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent breaks into Odoo servers with an exploit it keeps rewriting"},{"datum":"2026-06-26","id":"2026-06-26-tencent-yunding-tautulli","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent exploits Tautulli to pull cloud credentials from several servers"},{"datum":"2026-06-25","id":"2026-06-25-blind-eagle-ki-downloader","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Blind Eagle sends SVG lures with a likely AI-written script (APT-C-36)"},{"datum":"2026-06-24","id":"2026-06-24-kitana-ncc-group","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Likely LLM-built AitM platform mirrors hospitality booking engines (Kitana)"},{"datum":"2026-06-23","id":"2026-06-23-buchungsplattformen-gastgewerbe","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Russian attacker uses Claude against hospitality booking platforms (HexStrike)"},{"datum":"2026-06-22","id":"2026-06-22-skelyaagent-babel","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Heavily AI-assisted attack on a Babel editor fails (SKELYAAGENT, UAC-0272)"},{"datum":"2026-06-22","id":"2026-06-22-wordpress-massenausnutzung","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Operator compromises over 25,000 websites with likely AI-built exploits (WP-SHELLSTORM)"},{"datum":"2026-06-19","id":"2026-06-20-rpsc-bewerbungsportal","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Applicant allegedly withdrew three rivals’ RPSC applications with AI-written code"},{"datum":"2026-06-19","id":"2026-07-01-fortibleed","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Operator with access to 409 FortiGate firewalls uses Cursor and AI agents (FortiBleed)"},{"datum":"2026-06-17","id":"2026-06-17-sysdig-llmjacking-ollama","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Operator hijacks a third-party Ollama server for an attack tool in development"},{"datum":"2026-06-17","id":"2026-06-17-smartrat-clickfix-zscaler","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Pix fraud trojan in Brazil with a control panel likely built with AI (SmartRAT)"},{"datum":"2026-06-16","id":"2026-06-16-oalabs-gestohlene-claude-instanzen","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Low-skilled actor compromises 14 companies with a stolen Claude instance and Codex"},{"datum":"2026-06-16","id":"2026-06-16-fulcrumsec","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Extortion group says it used AI to analyze loot from Novo Nordisk and Avnet (FulcrumSec)"},{"datum":"2026-06-15","id":"2026-06-15-sysdig-ctf-jailbreak","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Operators get language models to write exploits under a CTF pretext and deploy them"},{"datum":"2026-06-12","id":"2026-06-12-teampcp-npm-wuermer-antiy","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"npm worms likely developed with help from Claude Code (Mini Shai-Hulud, TeamPCP)"},{"datum":"2026-06-11","id":"2026-06-11-kali365","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Phishing platform for rent has Claude Sonnet comb hijacked mailboxes (Kali365)"},{"datum":"2026-06-11","id":"2026-06-11-wallet-finder-stealer","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written Python stealer lures users hunting for lost crypto wallets"},{"datum":"2026-06-08","id":"2026-06-08-4bid-hacktivisten-ki-skripte","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Pro-Ukrainian hacktivists use AI-written scripts in attacks outside Russia (4BID)"},{"datum":"2026-06-04","id":"2026-06-04-sysdig-container-ausbruch","jahr":2026,"monat":"2026-06","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent breaks in through marimo and escapes the container to the host"},{"datum":"2026-06-03","id":"2026-06-03-silentrunloader-ta4922","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Likely LLM-built stealer targets UK organizations (SilentRunLoader, TA4922)"},{"datum":"2026-06-02","id":"2026-06-02-sophos-cursor-multi-agenten-labor","jahr":2026,"monat":"2026-06","rolle":"augmentiert","rolle_bis":null,"titel":"Attackers run a multi-agent lab with Claude Opus 4.5 for EDR evasion"},{"datum":"2026-05-28","id":"2026-05-28-greyvibe","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Russia-linked group uses AI at every stage against Ukraine (LegionRelay, GREYVIBE)"},{"datum":"2026-05-28","id":"2026-05-28-hephaestus","jahr":2026,"monat":"2026-05","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Claude Code breaks into government bodies and universities in Asia (Hephaestus)"},{"datum":"2026-05-28","id":"2026-05-28-tuxbot-v3","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"IoT botnet written with a language model (TuxBot v3)"},{"datum":"2026-05-27","id":"2026-05-27-mouse5212-super-formatter","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"AI-written npm package steals files (mouse5212-super-formatter)"},{"datum":"2026-05-27","id":"2026-05-27-fedora-anaconda-ki-agent","jahr":2026,"monat":"2026-05","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent uses a longstanding Fedora account and gets patches into the Anaconda installer"},{"datum":"2026-05-26","id":"2026-05-26-sysdig-marimo-intrusion","jahr":2026,"monat":"2026-05","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent gets from marimo to an internal PostgreSQL database in about an hour"},{"datum":"2026-05-26","id":"2026-05-26-ababil-of-minab","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Iran-linked group refines a wiping script against Vyncs with ChatGPT (Ababil of Minab)"},{"datum":"2026-05-25","id":"2026-05-25-arpa-tuerkischer-versicherer","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-built platform spies on a Turkish insurer (ARPA, UTA-2026-013)"},{"datum":"2026-05-22","id":"2026-05-22-nimbus-manticore","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Iranian group uses a likely AI-written backdoor (MiniFast, Nimbus Manticore)"},{"datum":"2026-05-21","id":"2026-07-14-patriot-bait","jahr":2026,"monat":"2026-05","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Gemini CLI runs a botnet in a dental practice (Patriot Bait, bandcampro)"},{"datum":"2026-05-21","id":"2026-05-21-composio-einbruch","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Composio reports a breach using LLM-generated attack patterns, 5,001 GitHub tokens exposed"},{"datum":"2026-05-18","id":"2026-05-18-massa-ki-praegefehler","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker says AI found a bug in the Massa blockchain and sells the loot"},{"datum":"2026-05-15","id":"2026-05-15-leek-likho","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Group raids agencies in Russia and Belarus with likely AI-generated scripts (Leek Likho)"},{"datum":"2026-05-14","id":"2026-05-14-kimsuky-hellodoor","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean group deploys a Rust backdoor with AI traces (HelloDoor, Kimsuky)"},{"datum":"2026-05-13","id":"2026-05-13-gentlemen-rocketchat-leak","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Extortion group uses AI for its panel and negotiation texts (GLOCKER, The Gentlemen)"},{"datum":"2026-05-11","id":"2026-05-11-shadow-aether-064","jahr":2026,"monat":"2026-05","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"AI agent attacks Brazilian financial institutions (SHADOW-AETHER-064)"},{"datum":"2026-05-11","id":"2026-05-11-strix-hexstrike-japan","jahr":2026,"monat":"2026-05","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Suspected Chinese actor turns AI agents on a Japanese technology firm"},{"datum":"2026-05-11","id":"2026-05-11-canfail-longstream","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Malware against Ukraine with AI-written camouflage (CANFAIL, LONGSTREAM)"},{"datum":"2026-05-07","id":"2026-05-07-dokos-panel-vishing","jahr":2026,"monat":"2026-05","rolle":"augmentiert","rolle_bis":null,"titel":"Vishing panel from the ShinyHunters orbit, one variant reworked with an LLM (Doko’s Panel)"},{"datum":"2026-04-29","id":"2026-04-29-promptmink","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean group builds malicious npm packages with AI (PromptMink, Famous Chollima)"},{"datum":"2026-04-22","id":"2026-04-22-lazarus-web3-entwickler-expel","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean group uses ChatGPT and Cursor to target Web3 developers (HexagonalRodent)"},{"datum":"2026-04-22","id":"2026-04-22-bissa-scanner","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Operator runs a mass-exploitation scanner with Claude Code and OpenClaw (Bissa Scanner)"},{"datum":"2026-04-21","id":"2026-04-21-ngate-handypay","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"Tampered NFC payment app with likely AI-written code steals PINs in Brazil (NGate)"},{"datum":"2026-04-14","id":"2026-04-14-phantompulse-obsidian","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"Intrusion attempt via Obsidian with an AI-generated RAT (PHANTOMPULSE)"},{"datum":"2026-04-10","id":"2026-04-10-shadowlink-tp-link-proxys","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"Attackers turn TP-Link routers into proxies with a likely AI-written script (ShadowLink)"},{"datum":"2026-04-08","id":"2026-04-08-canis-c2-japan","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"Paidy phishing spreads spyware from a likely LLM-written framework (Canis C2)"},{"datum":"2026-04-04","id":"2026-04-04-prt-scan","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Actor opens over 500 malicious pull requests, later likely through an AI agent (prt-scan)"},{"datum":"2026-04-03","id":"2026-04-03-goffee-warpplugin","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"Backdoor with LLM hallmarks against Russian defense companies (WarpPlugin, GOFFEE)"},{"datum":"2026-04-02","id":"2026-04-02-apifox-cdn-ki-nutzlast","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"Poisoned Apifox CDN file loads likely AI-written stealers"},{"datum":"2026-04-01","id":"2026-04-01-ta416-csproj-downloader","jahr":2026,"monat":"2026-04","rolle":"augmentiert","rolle_bis":null,"titel":"China-aligned spies load PlugX through possibly LLM-built downloaders (TA416)"},{"datum":"2026-03-30","id":"2026-03-30-eviltokens","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Phishing platform mines stolen Microsoft 365 mailboxes with AI (EvilTokens)"},{"datum":"2026-03-30","id":"2026-03-30-deepload","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Malware with a likely AI-built obfuscation layer steals credentials (DeepLoad)"},{"datum":"2026-03-20","id":"2026-03-20-buddyboss-lieferkette","jahr":2026,"monat":"2026-03","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Lone actor has Claude Code ship a backdoored BuddyBoss plugin"},{"datum":"2026-03-20","id":"2026-03-20-canisterworm","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"npm worm with a likely AI-written propagation script (CanisterWorm, TeamPCP)"},{"datum":"2026-03-19","id":"2026-03-19-warlock-edr-killer","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware gang deploys a likely AI-written EDR killer (Warlock)"},{"datum":"2026-03-18","id":"2026-03-18-winupdatehelper","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Fake game mods install crypto miners via a likely AI-written script (WinUpdateHelper)"},{"datum":"2026-03-18","id":"2026-03-18-darksword-unc6353","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Hijacked Ukrainian websites serve iOS exploits with LLM traces (DarkSword, UNC6353)"},{"datum":"2026-03-12","id":"2026-03-12-slopoly-hive0163","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Interlock group uses a likely AI-written C2 client (Slopoly, Hive0163)"},{"datum":"2026-03-12","id":"2026-03-12-handala-void-manticore","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Iranian cluster uses a likely AI-written wiper against Stryker (Void Manticore)"},{"datum":"2026-03-10","id":"2026-03-10-codewall-jack-jill","jahr":2026,"monat":"2026-03","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"CodeWall’s AI agent gains admin rights over a company account at Jack \u0026 Jill"},{"datum":"2026-03-08","id":"2026-03-08-shotbird-chrome-erweiterung","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Chrome extension under a new owner serves likely AI-assisted malicious scripts (ShotBird)"},{"datum":"2026-03-06","id":"2026-03-06-rclone-mega-algerien-kuwait-mongolei","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Phishing in Algeria, Kuwait and Mongolia, a Turkish malware prompt in related files"},{"datum":"2026-03-03","id":"2026-03-03-grub1-salesforce-cloudflare","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Actor uses a language model to find the most valuable Salesforce data (GRUB1)"},{"datum":"2026-03-03","id":"2026-03-03-cybercx-passwortdatenbank","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Attackers fail to crack a password manager with likely AI-written malware"},{"datum":"2026-03-02","id":"2026-03-02-dust-specter-irak","jahr":2026,"monat":"2026-03","rolle":"augmentiert","rolle_bis":null,"titel":"Backdoors with AI traces targeting Iraqi government officials (Dust Specter)"},{"datum":"2026-03-01","id":"2026-03-01-hackerbot-claw","jahr":2026,"monat":"2026-03","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Self-described Claude agent attacks GitHub workflows and hijacks Trivy (hackerbot-claw)"},{"datum":"2026-03-01","id":"2026-03-01-beelzebub-tor-agent","jahr":2026,"monat":"2026-03","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Suspected AI agent attacks a web honeypot over Tor"},{"datum":"2026-02-27","id":"2026-03-12-forbidden-hyena","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Hacktivists hit Russian agencies and companies with AI-generated scripts (Forbidden Hyena)"},{"datum":"2026-02-25","id":"2026-02-25-mexikanische-behoerden","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"One operator steers Claude Code and GPT-4.1 against nine Mexican government agencies"},{"datum":"2026-02-24","id":"2026-02-24-punk-spider-ki-skripte","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Akira group dumps Veeam credentials with Gemini-generated scripts (PUNK SPIDER)"},{"datum":"2026-02-20","id":"2026-02-20-fortigate-600-kampagne","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Low-skilled actor takes over 600 FortiGate devices with DeepSeek and Claude Code"},{"datum":"2026-02-20","id":"2026-02-20-operation-olalampo-muddywater","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Iranian group uses a backdoor with AI traces in the Middle East (Olalampo, MuddyWater)"},{"datum":"2026-02-19","id":"2026-02-19-trustconnect-maas","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-built remote access trojan poses as remote management tool (TrustConnect)"},{"datum":"2026-02-19","id":"2026-02-19-ghost-loader-npm","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Partly LLM-generated npm packages steal developer credentials (Ghost Loader)"},{"datum":"2026-02-17","id":"2026-02-17-unit42-ransomware-skripte","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware operators deploy their payload with scripts consistent with AI help"},{"datum":"2026-02-12","id":"2026-02-12-unc6418-gemini-phishing","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Actor uses Gemini to scout accounts, then targets them with phishing (UNC6418)"},{"datum":"2026-02-10","id":"2026-02-10-react2shell-xmrig-darktrace","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-generated script exploits React2Shell and mines Monero on 91 hosts"},{"datum":"2026-02-10","id":"2026-02-10-voidlink-uat-9921","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":null,"titel":"Linux framework hits tech companies, version 2.0 written with TRAE SOLO (VoidLink)"},{"datum":"2026-02-03","id":"2026-02-03-sysdig-aws-admin-acht-minuten","jahr":2026,"monat":"2026-02","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"Attacker becomes AWS admin in eight minutes with likely AI-written code"},{"datum":"2026-01-30","id":"2026-01-30-polnischer-energiesektor-lazywiper","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"Partly AI-written wiper hits a manufacturer during a wave of attacks in Poland (LazyWiper)"},{"datum":"2026-01-29","id":"2026-01-29-redkitten-sloppymio","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"Implant with LLM traces likely targets NGOs documenting Iran’s protests (SloppyMIO)"},{"datum":"2026-01-28","id":"2026-01-28-purerat-vietnam","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"Suspected Vietnamese actor sends fake job offers with likely AI-written loaders (PureRAT)"},{"datum":"2026-01-27","id":"2026-03-05-apt36-vibeware","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"Pakistan-based group has language models build new implants daily against India (APT36)"},{"datum":"2026-01-22","id":"2026-01-22-konni","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean group targets blockchain developers with malware showing AI traces (KONNI)"},{"datum":"2026-01-12","id":"2026-01-12-huntress-veeam-nonprofit","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written script goes after Veeam credentials at a nonprofit"},{"datum":"2026-01-12","id":"2026-01-12-huntress-chase-telegram","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker hunts for Chase banking URLs with a likely AI-written script"},{"datum":"2026-01-12","id":"2026-01-12-huntress-lsass","jahr":2026,"monat":"2026-01","rolle":"augmentiert","rolle_bis":null,"titel":"After an RDP break-in, a likely AI-written script tries to dump LSASS"},{"datum":"2025-12-31","id":"2025-12-31-rome-training","jahr":2025,"monat":"2025-12","rolle":"vollautonom","rolle_bis":null,"titel":"Agent model ROME opens a reverse SSH tunnel in training and mines on GPUs"},{"datum":"2025-12-17","id":"2025-12-17-react2shell-llm-downloader","jahr":2025,"monat":"2025-12","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written downloader lands in a honeypot via React2Shell"},{"datum":"2025-12-04","id":"2025-12-04-kaikatsu-club","jahr":2025,"monat":"2025-12","rolle":"augmentiert","rolle_bis":null,"titel":"Student allegedly used ChatGPT to steal 7.25 million records from Japan’s Kaikatsu CLUB"},{"datum":"2025-11-17","id":"2025-11-17-nknshell-vpn-larva-24010","jahr":2025,"monat":"2025-11","rolle":"augmentiert","rolle_bis":null,"titel":"South Korean VPN site serves a likely AI-written backdoor (NKNShell)"},{"datum":"2025-11-13","id":"2025-11-13-gtg-1002","jahr":2025,"monat":"2025-11","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Claude Code runs most of a China-attributed campaign (GTG-1002)"},{"datum":"2025-11-11","id":"2025-11-11-rakuten-mobile-hyogo","jahr":2025,"monat":"2025-11","rolle":"augmentiert","rolle_bis":null,"titel":"Teenager uses a ChatGPT-built program to open Rakuten lines on other people’s accounts"},{"datum":"2025-11-03","id":"2025-11-03-balancer-v2","jahr":2025,"monat":"2025-11","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker drains Balancer V2 pools with a smart contract believed to be partly AI-written"},{"datum":"2025-10-28","id":"2025-10-28-bluenoroff","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":null,"titel":"North Korean group hits crypto firms with an AI-assisted stealer (GhostCall, BlueNoroff)"},{"datum":"2025-10-27","id":"2025-10-27-quantum-redirect","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":null,"titel":"Phishing against Beazley Security via a likely AI-built panel (Quantum Redirector)"},{"datum":"2025-10-16","id":"2025-10-16-dcrat-ladeskript-captcha","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written loader script drops a remote access trojan on a PC (DCRat)"},{"datum":"2025-10-15","id":"2025-10-15-maverick-whatsapp","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":null,"titel":"Partly AI-written banking trojan spreads via WhatsApp in Brazil (Maverick)"},{"datum":"2025-10-15","id":"2025-10-15-librarian-likho-grabber","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":null,"titel":"Group targets aviation firms with a likely AI-written file grabber (Librarian Likho)"},{"datum":"2025-10-08","id":"2025-10-08-uta0388","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":"dirigiert-autonom","titel":"China-linked group uses ChatGPT for spear phishing in five languages (GOVERSHELL, UTA0388)"},{"datum":"2025-10-01","id":"2025-10-08-wrecksteel-uac-0219","jahr":2025,"monat":"2025-10","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-generated stealer hits Ukrainian authorities (WRECKSTEEL, UAC-0219)"},{"datum":"2025-09-25","id":"2025-09-25-madilock-dateiserver","jahr":2025,"monat":"2025-09","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware apparently built through vibe coding encrypts a file server (MadiLock)"},{"datum":"2025-09-24","id":"2025-09-24-svg-phishing-microsoft","jahr":2025,"monat":"2025-09","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-obfuscated SVG attachment in phishing emails to US organizations"},{"datum":"2025-09-16","id":"2025-09-16-shai-hulud","jahr":2025,"monat":"2025-09","rolle":"augmentiert","rolle_bis":null,"titel":"Worm with a likely LLM-generated payload compromises hundreds of npm packages (Shai-Hulud)"},{"datum":"2025-09-16","id":"2025-09-16-revengehotels","jahr":2025,"monat":"2025-09","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written loaders infect hotel front desks (RevengeHotels, TA558)"},{"datum":"2025-09-09","id":"2025-09-09-huntress-angreifer-eigene-maschine","jahr":2025,"monat":"2025-09","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker installs security software on their own machine and exposes their AI use"},{"datum":"2025-08-27","id":"2025-08-27-vibe-hacking-gtg-2002","jahr":2025,"monat":"2025-08","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Lone criminal extorts at least 17 organizations with Claude Code (GTG-2002)"},{"datum":"2025-08-27","id":"2025-08-27-claude-vietnam-telekom","jahr":2025,"monat":"2025-08","rolle":"augmentiert","rolle_bis":null,"titel":"Suspected Chinese actor attacks Vietnamese telecom companies with Claude"},{"datum":"2025-08-27","id":"2025-08-27-s1ngularity-nx","jahr":2025,"monat":"2025-08","rolle":"augmentiert","rolle_bis":null,"titel":"Nx malware makes victims’ AI assistants hunt for secrets (s1ngularity)"},{"datum":"2025-08-20","id":"2025-08-20-help-tds-woocommerce-inputs","jahr":2025,"monat":"2025-08","rolle":"augmentiert","rolle_bis":null,"titel":"Hijacked WordPress site runs an apparently AI-built malicious plugin (woocommerce_inputs)"},{"datum":"2025-08-13","id":"2025-08-13-justaskjacky-tamperedchef","jahr":2025,"monat":"2025-08","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written apps smuggle in a backdoor (JustAskJacky, TamperedChef)"},{"datum":"2025-07-31","id":"2025-07-31-kodane-patch-manager","jahr":2025,"monat":"2025-07","rolle":"augmentiert","rolle_bis":null,"titel":"npm package drains crypto wallets, code likely written by Claude (@kodane/patch-manager)"},{"datum":"2025-07-24","id":"2025-07-24-koske","jahr":2025,"monat":"2025-07","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-assisted malware hides a rootkit in panda images (Koske)"},{"datum":"2025-07-17","id":"2025-07-17-lamehug-apt28","jahr":2025,"monat":"2025-07","rolle":"augmentiert","rolle_bis":null,"titel":"Malware gets its commands from Qwen2.5-Coder at runtime (LAMEHUG, APT28)"},{"datum":"2025-07-15","id":"2025-07-15-global-group","jahr":2025,"monat":"2025-07","rolle":"augmentiert","rolle_bis":null,"titel":"AI chatbots help affiliates negotiate with victims (GLOBAL GROUP)"},{"datum":"2025-06-05","id":"2025-06-05-scopecreep","jahr":2025,"monat":"2025-06","rolle":"augmentiert","rolle_bis":null,"titel":"Fake gaming app spreads malware developed with ChatGPT (ScopeCreep)"},{"datum":"2025-06-02","id":"2025-06-02-sysdig-open-webui","jahr":2025,"monat":"2025-06","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker uploads a likely AI-generated miner script through an unprotected Open WebUI"},{"datum":"2025-04-07","id":"2025-04-07-hochschule-sms-belaestigung","jahr":2025,"monat":"2025-04","rolle":"augmentiert","rolle_bis":null,"titel":"Chinese student harasses fellow students by text message with an AI-written program"},{"datum":"2025-04-03","id":"2025-04-03-encrypthub","jahr":2025,"monat":"2025-04","rolle":"augmentiert","rolle_bis":null,"titel":"Actor builds stealers, C2 servers and phishing pages with ChatGPT (EncryptHub, LARVA-208)"},{"datum":"2025-03-06","id":"2025-03-06-black-basta-beschwichtigungsschreiben","jahr":2025,"monat":"2025-03","rolle":"augmentiert","rolle_bis":null,"titel":"Operator has ChatGPT write a fake letter mid-intrusion (Black Basta)"},{"datum":"2025-02-27","id":"2025-02-27-apt-inc-powershell","jahr":2025,"monat":"2025-02","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware group destroys data with a likely LLM-generated PowerShell script (APT INC)"},{"datum":"2025-02-27","id":"2025-02-27-rakuten-mobile","jahr":2025,"monat":"2025-02","rolle":"augmentiert","rolle_bis":null,"titel":"Teenagers hijack Rakuten accounts with a ChatGPT-assisted program to get mobile lines"},{"datum":"2025-02-21","id":"2025-02-21-utg-q-015-wasserloch","jahr":2025,"monat":"2025-02","rolle":"augmentiert","rolle_bis":null,"titel":"Watering-hole attack in China spreads likely AI-written Python plugins (UTG-Q-015)"},{"datum":"2025-01-26","id":"2025-01-26-dk-boss-jamtara","jahr":2025,"monat":"2025-01","rolle":"augmentiert","rolle_bis":null,"titel":"Jamtara police arrest a gang that built Android malware with ChatGPT (DK Boss)"},{"datum":"2025-01-16","id":"2025-01-16-xworm-html-schmuggel","jahr":2025,"monat":"2025-01","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-made HTML files smuggle in a RAT (XWorm)"},{"datum":"2025-01-15","id":"2025-01-15-ransomhub-python-hintertuer","jahr":2025,"monat":"2025-01","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware affiliate keeps access through a likely AI-written Python backdoor (RansomHub)"},{"datum":"2025-01-10","id":"2025-01-10-funksec","jahr":2025,"monat":"2025-01","rolle":"augmentiert","rolle_bis":null,"titel":"Ransomware group claims over 85 victims and writes its code with AI help (FunkSec)"},{"datum":"2024-12-10","id":"2024-12-10-netsupport-chatgpt-skript","jahr":2024,"monat":"2024-12","rolle":"augmentiert","rolle_bis":null,"titel":"TradingView lure script built from ChatGPT drafts leads to NetSupport RAT"},{"datum":"2024-10-17","id":"2024-10-17-palisade-ssh-honeypot-agenten","jahr":2024,"monat":"2024-10","rolle":"dirigiert-autonom","rolle_bis":null,"titel":"Eight possible AI agents among eight million hits on an SSH honeypot"},{"datum":"2024-10-09","id":"2024-10-09-sweetspecter-openai","jahr":2024,"monat":"2024-10","rolle":"augmentiert","rolle_bis":null,"titel":"Spear phishing targets OpenAI employees, ChatGPT used for recon (SugarGh0st, SweetSpecter)"},{"datum":"2024-09-24","id":"2024-09-24-asyncrat-genai-skripte","jahr":2024,"monat":"2024-09","rolle":"augmentiert","rolle_bis":null,"titel":"Likely AI-written scripts in a fake invoice deliver AsyncRAT"},{"datum":"2024-06-26","id":"2024-06-26-wordpress-plugins-lieferkette","jahr":2024,"monat":"2024-06","rolle":"augmentiert","rolle_bis":null,"titel":"Attackers inject likely AI-generated malicious code into WordPress.org plugins"},{"datum":"2024-06-25","id":"2024-07-25-symantec-llm-ladeskripte","jahr":2024,"monat":"2024-06","rolle":"augmentiert","rolle_bis":null,"titel":"Phishing campaigns load malware through likely LLM-written scripts"},{"datum":"2024-04-10","id":"2024-04-10-ta547-deutsche-organisationen","jahr":2024,"monat":"2024-04","rolle":"augmentiert","rolle_bis":null,"titel":"Likely LLM-written loader targets organizations in Germany (TA547)"},{"datum":"2024-02-21","id":"2024-02-21-scattered-spider-entra-id","jahr":2024,"monat":"2024-02","rolle":"augmentiert","rolle_bis":null,"titel":"Likely LLM-written commands dump Entra ID identifiers (Scattered Spider)"},{"datum":"2024-02-21","id":"2024-02-21-indrik-spider-lockbit-azure","jahr":2024,"monat":"2024-02","rolle":"augmentiert","rolle_bis":null,"titel":"Attacker opens ChatGPT while stealing Azure credentials (Indrik Spider)"},{"datum":"2024-02-14","id":"2024-02-14-microsoft-openai-fuenf-staatsakteure","jahr":2024,"monat":"2024-02","rolle":"augmentiert","rolle_bis":null,"titel":"Five nation-state actors from Russia, North Korea, Iran and China use GPT-4 for groundwork"},{"datum":"2023-12-28","id":"2023-12-28-chatgpt-ransomware-hangzhou","jahr":2023,"monat":"2023-12","rolle":"augmentiert","rolle_bis":null,"titel":"Four security engineers refine ransomware with ChatGPT to extort Hangzhou firms"},{"datum":"2023-08-24","id":"2023-08-24-chatgpt-abbuchungsprogramm-zhejiang","jahr":2023,"monat":"2023-08","rolle":"augmentiert","rolle_bis":null,"titel":"Suspect empties company accounts with a draining program written by ChatGPT"}]}