Threat Brief — 2026-08-04 — Direct-to-IP C2, AI Agent Hijacks, Cloud Phishing

Executive summary. Today's feed highlights a convergence of AI-agent attack surface expansion and classic infrastructure weaknesses. A patched cPanel flaw gave authenticated hosting customers database-root SQL execution, while nearly half of C2 malware now bypasses DNS entirely. On the AI front, a Google ADK triage agent was manipulated via a public GitHub issue to trigger privileged code-fixing workflows — the first "agent recruits agent" pattern seen in a major repository. Phishers are increasingly abusing legitimate cloud platforms (Cloudflare Workers, Vercel, Netlify, GitHub Pages, IPFS) to host AitM attacks that defeat MFA.

Top items

• cPanel critical SQL flaw patched — authenticated customer could execute SQL as database root. An authenticated hosting customer could cross the privilege boundary between their cPanel account and the server's administrative database identity, executing SQL in the root context. Patched in a recent tarball release; hosting providers running older builds should upgrade immediately. (src: The Hacker News)

• Nearly half of C2 malware bypasses DNS, communicating directly via IP addresses. Unit 42 analysis shows ~50% of malware samples now hard-code IP addresses for C2, evading DNS-based filtering and monitoring. Zero-trust IP enforcement is recommended to detect and block these direct connections. (src: Unit 42)

• Legitimate cloud platforms abused for adversary-in-the-middle phishing that defeats MFA. Securelist details AitM attacks using Service Workers and Ultraviolet proxy techniques hosted on Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. These platforms' reputations help phishing pages evade URL filtering. (src: Securelist)

• Google deletes three ADK AI workflows after "agent recruits agent" attack nearly compromises repository. A public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent, crossing privilege boundaries within Google's Agent Development Kit. Google removed the affected workflows after Pillar Security demonstrated the chain. First reported today. (src: The Hacker News)

• tl;dv AI notetaker Firebase misconfiguration exposes all users' meeting data. A Google Firebase misconfiguration lets any tl;dv user query any other user's meeting information and potentially join calls — affecting government and corporate video meetings. First reported today. (src: Dark Reading)

• DOUBLECUP loader-as-a-service uses ClickFix lures and cached PNGs to deliver new RAT. A Russian LaaS codenamed DOUBLECUP stages malware-laced PNG images in browser cache via ClickFix social-engineering lures, ultimately delivering CountLoader and a previously undocumented RAT called DeviceManager. First reported yesterday; not yet featured. (src: The Hacker News)

• Rare Werewolf hackers behind massive fake-news network of 120+ sites and 74 Telegram channels. Positive Technologies uncovered an information-operation infrastructure tied to the Rare Werewolf group, spanning over 120 websites and 74 Telegram channels targeting Russian audiences. First reported today. (src: Securitylab)

• UK authorities again demand Apple weaken encryption; Apple responds with lawsuit. The UK government is renewing pressure on Apple to create an encryption backdoor. Apple has responded with legal action, arguing compliance would create an ideal avenue for cybercriminals. First reported today. (src: Securitylab)

• sqlmap adds non-SQLi features over the past year. The popular SQL injection tool has expanded well beyond exploitation, adding capabilities not directly related to SQLi that pentesters may find useful. Low operational priority but worth noting for defender awareness. (src: Xakep)

Themes

• AI agent attack surface is expanding faster than guardrails. The Google ADK "agent recruits agent" manipulation, combined with continued DeepSeek autonomous attack reporting and the "vibe hacking" analysis, signals that AI-agent privilege boundaries are the new frontier for lateral movement. Triage agents that can invoke privileged agents need the same isolation discipline as human privilege separation.
• Legitimate infrastructure is the attacker's favourite camouflage. Cloud platforms (Cloudflare Workers, Vercel, Netlify, GitHub Pages, IPFS) for phishing, Firebase for exposed meeting data, and direct-to-IP C2 all exploit the trust we place in well-known infrastructure. Reputation-based controls are insufficient on their own.