Breaking

AI-Made Malware and 2M-Device Proxy Net: A Wave of Trusted-Path Abuse

July 8, 2026 at 03:32 EDT

Security
AI Agents

A cluster of incidents reported by security firms and law enforcement in early July 2026 points to a common trend: "once-trusted paths" such as AI agents, OAuth, browser features and developer repositories are being repurposed as bridges for attacks.

Early 2026 · Threat Landscape

When "Trusted Paths" Become Attack Routes

AI agents, OAuth authorization, browser features and developer tooling — each incident subverts a legitimate trust relationship, striking at the very premise of Zero Trust.

340+

Microsoft 365 orgs hit by EvilTokens in 5 weeks

Countries reached by the PhaaS campaign

187

H1 blockchain incidents (64 DeFi)

Blockchain incidents, H1 — where they hit

187

All incidents

DeFi / oracle

Roughly one in three exploited the distributed trust model of DeFi and oracles.

Four trusted paths, four subversions

AI agents

Langflow RCE fully automates ransomware — intrusion to credential theft, lateral movement and DB wiping. 3 LangGraph fixes.

OAuth

Device code flow abused to steal refresh tokens — bypassing MFA. 340+ orgs, 5 countries.

Blockchain

Distributed trust model targeted via DeFi and oracle abuse. 64 of 187 H1 incidents.

Dev tools

"Agentjacking" tricks AI coding agents into running malicious code via sources like Sentry error data and fake repos.

The promise

Autonomous agents, convenience-first OAuth and seamless tooling deliver real productivity gains developers now depend on.

The trade-off

Prompt injection, hijacking via shared docs, blind consent clicks and no-interaction attacks — trusted paths are the new blind spot.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.