AI-Based Misuse and Phishing: ThreatsDay Overview

Security often comes down to a single weak point: the moment a system or user accepts a “trusted” screen or process as legitimate. In this ThreatsDay roundup, we see again how attackers exploit trust—whether it’s a login page, an installation guide, a fake recruiter chat, or an apparently familiar service that responds just differently enough. Behind the scenes, the same building blocks typically follow: reused credentials, exposed environments, silent loaders, and exploit paths that should have been properly segmented in the first place.

The threats change weekly, but the pattern shifts slowly. The details below are a selection of the week’s most important signals.

AI-based abuse moves from experimentation to operations

What stands out is how AI is being used not only to scan or write faster, but to support the entire attack journey. For example, there were reports of an autonomous, AI-assisted hacking campaign by a threat actor that, via an orchestration layer (including Telegram), inventories targets and then initiates attacks. The core logic for code generation, vulnerability assessment, and decision-making was tied to an AI engine.

We also see AI in campaigns with a strong “public” component. One operation combined commodity malware with hands-on intrusions and AI-driven influence capabilities. Fake accounts and AI profiles were used to increase visibility and drive traffic to fraud-focused services. In other words: the cyber side and the influence side are under one roof—making detection harder.

Phishing becomes real-time and more personal

Phishing remains a dominant access gateway. This time there’s extra attention for LogoKit, which has evolved from a traditional phishing kit into a “real-time deception platform.” Instead of static fake pages that are easy to spot, the platform builds personalized login experiences per victim.

The mechanism leverages legitimate commercial web services to generate background content based on real screenshots and to load brand symbols dynamically. As a result, the pages look visually very similar to what victims are used to. Coupled with warnings about passwords or delivery problems, the flow then pushes victims toward the spoofed environment.

Vulnerabilities: 370 Chrome flaws and faster exploitation

Google delivered patches for a large number of security issues in Chrome. In an update released in late July, 370 vulnerabilities were fixed, including seven with critical severity. Google said that some of the bugs were found via different test and analysis tools, and that none of the patched issues had been reported as actively exploited at the time of publication.

Separately, a broader trend study also comes through: while more vulnerabilities are being discovered and disclosed, the step from publication to proven exploitation appears to be accelerating. Put simply, organizations have less time to patch before attackers find a path to exploitation.

Credential stuffing and account takeovers via “trusted” access

Where phishing provides the first click, credential stuffing and account takeovers can speed up the next phase. A campaign was mentioned that has been running since the end of July and automates login attempts against SonicWall VPN and firewall accounts. Multiple users and multiple organizations were affected, and the activity was linked to a set of source IPs and hosting infrastructure.

Elsewhere in the chain, we also see how “access” stays the starting point. Information about fleet management was discussed, for instance: a vulnerability in a vehicle fleet management system could enable misuse of unauthenticated internal and admin APIs. That made it possible to obtain high-level access and even facilitate account takeovers.

DNS hijacking and the danger of redirects you don’t see

DNS-related attacks often only get attention once something goes wrong. In an incident involving CubePilot, it was reported that attackers gained control of a domain’s DNS settings and also obtained TLS certificates for subdomains. This allowed traffic to internal systems to be intercepted.

Key detail: if you reuse the same passwords across multiple places, DNS abuse expands the blast radius of an incident. CubePilot said credentials may have been captured when users logged in on or around the relevant date, and advised changing passwords elsewhere. Domain control and certificates have since been restored, but the lesson remains: don’t rely on “availability” alone—also verify origin and certificate chains.

Supply chain and CI/CD: hardening sets the tone

Besides the attack techniques, there’s also good news: vendors and platforms keep tightening their supply-chain defense layer. GitHub outlined steps to address weaknesses in package repositories and CI/CD systems. Examples mentioned include stronger preventive protection for high-impact accounts, safer defaults for GitHub Actions, tighter control over triggers, and improvements to read-only caching for untrusted triggers.

npm also came up in the story with measures aimed at trusted publishing and staged publishing, plus cooldowns for automated version updates. For incident response, additional thinking went toward revoking credentials and expanding those capabilities via APIs.

Practical attention points for teams

• Patch quickly: when the time between publication and exploitation is getting shorter, “patch later” no longer works.
• Secure authentication: watch for credential stuffing and ensure VPN and firewall accounts have strict controls.
• Monitor DNS and certificates: DNS redirection plus fraudulent TLS is a combination that can easily hijack trust.
• Harden the supply chain: set up your CI/CD and package flow with the latest best practices around privileges, triggers, and publishing paths.
• Train recognition of personalized phishing: real-time, visually convincing pages make “I can tell” less reliable.

Conclusion: AI-based abuse needs the same basics—but tighter

The common thread in this ThreatsDay is clear: attackers benefit from trust that’s given too easily. AI-based abuse, real-time phishing, and automated validation of credentials help threats slip through the first line of defense faster and smarter. Countermeasures aren’t new—but they do need to be applied consistently and in time: patching, strengthening authentication, monitoring DNS and account risks, and continuing to harden the supply chain.