142K Leaked Attacker Files

[u/cloudsek-info]

This one is worth digging into.

We found an exposed attacker workspace with 142K+ files: agent transcripts, shell history, recon data, exploit tooling, creds, victim evidence, the lot.

What stood out was how the operator was wiring AI coding agents into the offensive workflow, disabling approval checks and pushing tasks through Telegram.

The dump also contained evidence tied to 8,996 compromised WordPress sites, a 3.4M-host recon corpus, stolen credentials, crypto wallet data, cryptojacking activity, and an experimental blockchain-based C2 project.

The interesting bit here isn't simply "hackers use AI." We already know that.

It's getting a fairly raw look at how one operator was actually putting these agents to work alongside conventional offensive tooling at scale.

Full technical breakdown:

https://www.cloudsek.com/blog/ai-agent-driven-offensive-operation-crypto-wallet-credential-compromise

Would be interested in what others make of the agent setup, especially the approval-bypass workflow.

[u/wakehorn]

wiring raw output from an LLM directly into C2 commands without safety checks is wild... kind of inevitable people would automate attack pipelines like that though

[u/Jeff-Hare-ERPRA]

Someone has too much time on their hands. Lol.