JadePuffer ransomware used AI agent to automate entire attack

Collection of active, high-impact threats and incidents: researchers documented JadePuffer as the first ransomware operation apparently automated end-to-end by an LLM agent; a takedown disrupted the NetNut residential proxy network that abused ~2 million compromised Android devices; a new ARToken phishing‑as‑a‑service (affiliate of EvilTokens) exposes extensive Microsoft 365 credential‑harvesting tooling; and OAuth-based ConsentFix/ClickFix attacks rapidly steal Microsoft 365 tokens, driving vendor mitigations (Opera Paste Protect) and guidance. Multiple actively exploited vulnerabilities were