Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
2026-09-28T20:51:32Z•95aa6d69cabe7369a2445f1daaaca8ec99b7ffd54aebce16f8085a503d32e4db
CVE-2026-76460AI securityAI-assisted attacksAPI key theftAzureDockerGitHub security tokens and OAuth tokens/npm compromiseMicrosoft 365OAuth abuseRATSalesforceSlack phishingTelegramagentic AIautonomous agentsbotnetcloud securitycredential theftdevice-code phishingidentity and access managementmalicious browser extensionmalwareprompt injectionransomwarespywaresupply-chain attack
What happened
Dark Reading security intelligence covering late-September 2026 threats, including AI-enabled botnets and autonomous-agent abuse, cloud and SaaS account compromise, phishing and OAuth consent attacks, malicious browser extensions, malware, supply-chain compromises, EDR evasion, geopolitical cyber operations, and critical vulnerabilities such as Cisco ISE authentication bypass CVE-2026-76460. The feed emphasizes growing risk from excessive privileges, exposed credentials, prompt injection, agentic systems, and cloud control-plane access.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- darkreading
- Record identifier
- 95aa6d69cabe7369a2445f1daaaca8ec99b7ffd54aebce16f8085a503d32e4db
- Enrichment time
- 2026-09-28T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.