/
data_types_exposed:personal_data × latest_source_host:unit42.paloaltonetworks.com × limpar

Resultados

2 casos · pág. 1/1

unit42.paloaltonetworks.com · medium

BUGSTER actor uses jailbroken Hermes Agent and DeepSeek V4 for credential theft, VoIP fraud planning and Wi-Fi cracking, hitting Indian universities

Unit 42 analyzed the operational environment of a previously unreported, financially motivated, English-speaking actor using the handle BUGSTER. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine and the Cursor IDE as a secondary tool, with safety controls disabled in both. With AI-generated scripts and reco…

BUGSTER education telecommunications
unit42.paloaltonetworks.com · high

Prompt injection in AWS AgentCore Harness default config lets the root shell tool steal plaintext AgentCore Identity credentials

Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…