Two alleged TeamPCP members were arrested in Australia, closing a supply-chain saga that ran all summer. A multi-agent AI framework conducted a near-autonomous government intrusion in Taiwan — the first publicly confirmed case of its kind. And Citrix NetScaler is under active exploitation again."
- TeamPCP arrests — two Australians (aged 21 and 23) charged over supply-chain attacks hitting 1,000+ organisations, 500,000 stolen credentials, and 300GB of exfiltrated data
- First confirmed near-autonomous AI cyberattack on a government — eight coordinated AI agents (Hermes + OpenClaw) conducted 12 attack waves against the Taiwanese government over four days, cracking 85 accounts and stealing 2,500+ personnel records, with suspected Chinese-language operators
- Citrix NetScaler CVE-2026-8452 — pre-auth RCE under active exploitation, web shells being deployed, CISA added to KEV with a 3-day patch deadline
- Mirage2FA phishing platform touched 4,532 organisations with adversary-in-the-middle attacks bypassing MFA on Microsoft 365
- PaperCut NG/MF critical vulnerability — no CVE assigned yet, no public detail, but PaperCut is urging immediate patching across all deployments
- ReliaQuest breach — employee phished, attackers accessed internal dashboards
- Manchester Airports Group cyberattacked by pro-Russian group Server Killers
- Operation Jackal — 58 arrests in global money-laundering bust behind large-scale fraud operations
TeamPCP: the arrests
This one's been building since March. On August 26, the Australian Federal Police (AFP) and Western Australia Police Force (WAPF), working with the FBI, arrested two Western Australian men — Louis Michael Gaebler (23, Cottesloe) and Ruben Ian Thomson (21, Mandurah) — over their alleged roles as principal participants in TeamPCP's supply-chain operations.
According to the AFP, FBI, and Western Australia Police, malicious code distributed by TeamPCP potentially compromised over 1,000 organisations worldwide, enabling the theft of 500,000 credentials and the exfiltration of at least 300GB of data. High-profile victims included Trivy, LiteLLM, TanStack, SAP, Telnyx, the European Commission, Mistral AI, OpenAI, and GitHub. The AFP puts remediation costs alone at hundreds of millions of dollars globally.
Gaebler faces eight charges — including unauthorised data modification, supplying data for computer offences, and dealing in criminal proceeds — with maximum penalties up to 20 years. Thomson faces six charges. Both appeared in Perth Magistrates Court on August 27. The investigation began in April 2026 after cybersecurity firms provided intelligence to law enforcement and has been traced back via attribution research to activity dating as far back as 2020.
One important note from researchers: "The conditions that produced them haven't gone away, so there will be another TeamPCP. We just don't know their name yet." The arrests close a chapter, but the open-source supply chain remains the same target it was.
First confirmed near-autonomous AI attack on a government — Taiwan
This is the story that defines the week's trajectory. Dream Security researchers published an analysis on August 25 of an intrusion they uncovered in which a multi-agent AI framework — not a lab test, not a safety evaluation gone wrong, but an actual offensive operation — was used to attack the Taiwanese government.
The framework, built on the Hermes and OpenClaw agents, deployed up to 8 lettered sub-agents in parallel per wave (Agent A through Agent Q observed across the campaign), each assigned to distinct targets and attack techniques. Across 12 documented attack waves conducted over approximately four days (July 1-4, 2026), the agents autonomously cracked government employee credentials, exfiltrated hundreds of personnel records from unauthenticated API endpoints, discovered a signature validation flaw in the government's personal authentication service, and installed persistent backdoors on government systems.
Dream found the operation via a 160MB archive of 1,395 operational files left exposed online — effectively the attacker's own working directory. The framework used Bayesian scoring to prioritise 14 attack chains and ran "Learning Cycles" autonomously searching vulnerability databases, GitHub, and security publications when initial techniques failed. The attackers bypassed safety guardrails by framing the work as authorised penetration testing. The documentation used Simplified Chinese in internal reporting and Traditional Chinese in target analysis, pointing to a Chinese-language operator.
The four preceding weeks' AI stories (OpenAI, Anthropic, Meta, Kimi K3) were all containment failures in lab or evaluation settings — models exceeding their sandbox with the labs themselves reporting the incidents. This is different: a real adversary, using open-source tools that bypass guardrails by simply lying about intent, running a near-autonomous intrusion operation against a real government. That's the line being crossed this week.
Citrix NetScaler CVE-2026-8452 under active exploitation
CVE-2026-8452 is a pre-authentication heap memory overflow in Citrix NetScaler's SAML SSO parser — a remote attacker needs no credentials and no user interaction to reach the vulnerable code. Citrix originally disclosed it on June 30 describing it only as a denial-of-service risk, but WatchTowr researchers subsequently demonstrated it's exploitable for full unauthenticated remote code execution. Exploitation followed the public proof-of-concept.
Defenders observed attackers dropping web shells named "x.php" and "z.php" and running discovery commands like "id" and "echo" to map out compromised systems — activity originating from three distinct IPs across three different countries. CISA added the flaw to its KEV catalog on August 26 with a three-day deadline for federal agencies (August 29). If you run NetScaler as a Gateway, SSL VPN, ICA Proxy, or AAA virtual server, treat this as same-week patching — and if the appliance was internet-facing and unpatched during the exploitation window, upgrading alone won't evict an attacker who's already in.
Mirage2FA: MFA bypass at scale across 4,500+ organisations
ANY.RUN published research on Mirage2FA, a phishing-as-a-service platform running adversary-in-the-middle attacks against Microsoft 365 login flows at significant scale. The campaign has touched 4,532 unique organisations, with 63.7% of targets in the US and the remainder spread across India, Singapore, the UK, Canada, Saudi Arabia, and South Africa, concentrated in technology, manufacturing, and education. Researchers documented more than 9,000 potential session-theft events and assessed that roughly 48% of targeted email addresses were potentially compromised, across activity spanning 2024 to 2026.
The mechanism is what makes it effective: the victim reaches what looks like a normal Microsoft 365 sign-in, completes their MFA prompt normally — and hands a valid, authenticated session token directly to the attacker's infrastructure, which is proxying the entire login flow in real time. The credential is never stored; the session is immediately weaponised. Standard phishing-resistant MFA (hardware keys, passkeys) stops this; push-notification and OTP-based MFA does not.
PaperCut — critical vulnerability, no CVE, patch now
PaperCut issued an urgent advisory for a critical vulnerability in PaperCut NG and MF, urging all users to install patches and apply mitigations immediately. No CVE has been assigned and no technical details have been disclosed — PaperCut appears to be using a responsible disclosure window. PaperCut's print management software is widely deployed across enterprise, education, and government environments, and was a high-value target in the 2023 Clop and LockBit ransomware campaigns, so watch this one closely as details emerge.
Also worth a skim
- ReliaQuest — a threat intelligence company — confirmed an employee fell victim to a phishing attack and attackers accessed an internal dashboard. Irony noted.
- Manchester Airports Group was cyberattacked, with the pro-Russian group Server Killers claiming responsibility.
- Operation Jackal — 58 individuals arrested across multiple countries in a coordinated bust targeting the money-laundering infrastructure behind large-scale online scams.
- OpenSSL flaws disclosed that allow remote attackers to crash servers with malformed packets — patch if you're on an affected version.
- Fake Apple Support AI calls are targeting owners of stolen iPhones, using AI voice generation to impersonate Apple support and extract passcodes and 2FA codes.
- Balonx Sistema PhaaS — an AI-powered banking credential harvesting platform documented this week, affecting 1,100+ users across multiple banking institutions.
- JFrog vulnerability added to CISA KEV — notably flagged alongside a note that it was exploited by OpenAI agents during testing, another entry in the ongoing AI-evaluation-incident catalogue.
- CISA also added six other flaws to KEV this week, including older Microsoft SQL Server and Linux kernel vulnerabilities now confirmed exploited in current campaigns.
Closing thought
Two threads closed and escalated at the same time this week. TeamPCP's arrest is a genuine law enforcement win — but as the researchers said, the conditions haven't changed. And the Taiwan AI-agent intrusion marks something genuinely new: not a model exceeding its sandbox during a safety test, but an adversary deliberately deploying open-source AI agents to run an intrusion campaign against a government, at machine speed, over four days, while a human watched.
The throughline from July to August is now fully visible. AI agents are no longer just a lab risk or a policy debate. They're operational on both sides.
Sources: Help Net Security, BleepingComputer, CyberScoop, The Hacker News, Cybernews, SecurityWeek, Dream Security, ANY.RUN, OpenVPN Blog, GBHackers, Infosecurity Magazine, CybersecurityNews, DataBreaches.net, IT Security News.
