Threat Brief — 2026-07-01 — Azure Spray, SimpleHelp RCE, AI Agents Under Fire
Executive summary. Three actively exploited criticals dominate today: SimpleHelp's OIDC auth bypass (CVSS 10.0) is delivering the novel TaskWeaver and Djinn Stealer payloads; Oracle E-Business Suite Payments has a CVSS 9.8 takeover flaw being touched in the wild; and CISA confirms the Windows Defender "BlueHammer" EoP is now in ransomware operators' toolkits. Separately, a large-scale Azure CLI password spray has fired 81M+ attempts and hit at least 78 accounts. A strong secondary theme is AI-agent attack surface: poisoned MCP tool descriptions, agentjacking via fake bug reports, BioShocking browser prompt injection, and exposed LLM endpoints all surfaced in the last 24 hours.
Top items
- CVE-2026-48558KEV — SimpleHelp OIDC auth bypass (CVSS 10.0), actively exploited. Identity tokens accepted without signature verification; unauth RCE and MFA bypass. TaskWeaver + Djinn Stealer delivered via compromised remote-support servers (~1,000 exposed at disclosure). Affects SimpleHelp ≤5.5.15 and 6.0 pre-release. (The Hacker News)
- CVE-2026-46817KEV — Oracle E-Business Suite Payments auth/privilege flaw (CVSS 9.8), actively exploited. Unauthenticated HTTP-reachable improper-privilege flaw enabling complete takeover. Affects Oracle Payments component 12.2.3–12.2.15. Defused Cyber reports in-the-wild abuse. (The Hacker News)
- CVE-2026-33825KEV·R (BlueHammer) — Microsoft Defender EoP, now ransomware-toolkit. Local authenticated attacker can access the SAM database and escalate to SYSTEM. Patched April 2026; KEV-listed Apr 22; now confirmed in ransomware ops. (BleepingComputer)
- Azure CLI password spray — 81M+ attempts, ≥78 accounts compromised. Huntress reports massive ongoing automated spray targeting Microsoft Azure CLI. Treat as identity-protection priority: review Conditional Access and disable legacy/programmatic auth where possible. (The Hacker News)
- CVE-2026-8037 — Progress Kemp LoadMaster pre-auth root command exec. Unauthenticated crafted API request yields root on the appliance. CVSS 9.x; patch immediately. (The Hacker News)
- Citrix NetScaler ADC/Gateway — 6 patched flaws (file read, DoS). No in-the-wild exploitation cited, but exposure footprint is historically large — prioritise patching. (The Hacker News)
- Apple iOS / macOS / Safari — 30+ flaws patched, including AI-discovered WebKit bugs. Four WebKit vulnerabilities flagged as discovered via AI tooling. Update all managed devices. (The Hacker News)
Themes
AI-agent and LLM attack surface is expanding fast. Multiple distinct vectors surfaced: poisoned MCP tool descriptions silently exfiltrating company data (Microsoft research); "agentjacking" via fake bug reports hijacking AI coding agents; "BioShocking" prompt-injection tricking AI browsers into leaking credentials; exposed AI endpoints being hijacked for offensive ops (Langflow CVE-2026-33017KEV miner deployment); and 282 iOS chatbot apps found leaking LLM API keys in plaintext. Together these form a coherent "AI stack as new perimeter" story — prioritise access controls on AI endpoints, scrutinise agent tool definitions, and review coding-agent command boundaries (GuardFall bypass shows existing safety checks are bypassable via classic shell injection).
Identity attacks remain the top monetisation path. The Azure CLI spray and SimpleHelp's MFA bypass both sit on identity boundary failure — one at scale, one at depth. Pair these with the ongoing BEC research and the Nidec-Blackfield $2M ransom ask, and identity hardening (MFA, Conditional Access, service-account hygiene, privileged access review) is the single highest-leverage control right now.
Supply-chain vectors are diversifying. New this cycle: "phantom squatting" on AI-hallucinated domains to poison software dependencies, and trojanised Pyrogram forks on PyPI targeting Telegram bot developers for arbitrary file read. Both are low-sophistication, high-reward entry points — review dependency provenance and pin hashes where possible for Python projects touching Telegram.