An LLM Agent Just Ran a Complete Ransomware Kill Chain Without a Human Operator. Your Defense Cannot Wait for One Either. (ft. John Hubbard)
ClickFix delivery, a ToddyCat OAuth backdoor, and same-day NetScaler exploitation round out a week defined by broken assumptions about who, or what, is on the other end.
INTRODUCTION
The adversary on the other end of this week's most significant intrusion was not a person. It was a large language model that chained together vulnerability exploitation, lateral movement, credential theft, and data destruction without human intervention.
Sysdig documented JADEPUFFER, an LLM agent that exploited a Langflow RCE flaw, stole database credentials, and destroyed production configuration data autonomously. ClickFix social engineering has become one of the dominant malware delivery methods, accounting for a large share of currently observed campaigns. ToddyCat deployed Umbrij malware that abuses OAuth tokens to silently read corporate Gmail through Google’s own API. Citrix disclosed a new CitrixBleed-style vulnerability in NetScaler, and attackers began exploitation the same day the advisory went public.
None of these required the adversary to invest significant skill, time, or money at the point of entry.
This week we are joined by John Hubbard, a SANS Senior Instructor and the author of SEC450: Security Operations and Analysis and LDR551: Building and Leading Security Operations Centers, and the host of the Blueprint podcast. John has spent his career inside the SOC as an analyst, consultant, and detection engineer, and teaches thousands of defenders each year how to build and run modern security operations. His throughline across this issue is consistent: these attacks compress the time defenders have to act, but even the cleverest technique still leaves signals across the wider attack chain, and the teams that win are the ones that have tooled, trained, and pre-authorized their response ahead of time rather than improvising under pressure. Full bio at the end.
Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.
Thanks for supporting us.
WEEKLY SIGNALS ANALYSIS
The attacker’s marginal cost per operation just dropped to near zero. JADEPUFFER proves that an LLM agent can execute a full ransomware kill chain, from initial exploitation through data destruction, without a human operator touching the keyboard. Reassess incident response playbooks that assume attacker dwell time includes human decision-making pauses.
Social engineering no longer requires a convincing lure when the victim is the execution engine. ClickFix attacks now dominate malware delivery by tricking users into pasting and running commands themselves, bypassing endpoint controls that filter inbound payloads. Evaluate whether your endpoint protection can detect locally initiated malicious commands, not just downloaded binaries.
Legitimate API authentication is the new persistence layer. ToddyCat’s Umbrij malware uses valid OAuth tokens to read Gmail through Google’s own API, producing traffic that is indistinguishable from normal application behavior. Audit OAuth grants and API access scopes for service accounts and third-party applications this week.
Disclosure-day exploitation is now the expected baseline, not the exception. Citrix’s new NetScaler vulnerability saw exploitation attempts within hours of the advisory’s publication, using publicly available proof-of-concept code. If your patch cycle assumes a grace period between disclosure and exploitation, that assumption expired a long time ago.
What not to over-index on: perimeter-focused vulnerability scanning cadences. Three of this week’s four signals involved attackers operating through channels that perimeter scans do not cover: OAuth tokens, user-initiated commands, and autonomous agents exploiting application-layer flaws.
THIS WEEK’S SIGNALS
Signal 1: JADEPUFFER Proves Autonomous AI Can Execute a Full Ransomware Attack
Why it matters: Sysdig documented what it believes is the first ransomware operation conducted end-to-end by an LLM agent. The operator, tracked as JADEPUFFER, used an AI agent to exploit a Langflow remote code execution vulnerability, harvest database credentials, pivot to a production MySQL instance, and destroy Nacos configuration data. The entire sequence completed as an end-to-end LLM-driven operation.
What is being misread: The industry is treating this as a proof-of-concept curiosity rather than a structural shift. The broken assumption is that ransomware operations require a human operator to make judgment calls during lateral movement and data targeting. JADEPUFFER demonstrates that an LLM can chain those decisions together autonomously, which means the economics of ransomware have changed. The cost to run a second, third, or hundredth campaign with the same agent approaches zero.
Guest Perspective (John Hubbard): For a long time, in my SOC courses, I’ve emphasized the concept of OODA loops and how they lead to the straightforward conclusion that any effective defense will inherently need to be as fast as, if not faster than the attacker. Fully automated attacks take the red side of the equation and dramatically decrease the time defenders have to not only detect the problem but also respond. When attackers use agents that can find and execute actions on your network autonomously, your defenders will have to train, tool, and tune for the same level of autonomy and speed. What might that mean in the case of JADEPUFFER? One obvious example is how often your team is willing to let agents take fully automated containment actions. While the risks to fully automated containment are clear, the consequences of not responding quickly to attacks like JADEPUFFER could be worse. My advice is to consider how you can maximize the context and quality of information brought into agent decisions about automated containment, and push to continuously increase the number of playbooks and workflows that you’re comfortable letting run in a fully automated way. By evaluating agent performance using measures such as agreement between recommended and actual containment actions, you can build confidence in specific automated playbooks and push towards increasing coverage of automated response.
Think Red (Douglas McKee): Why pay an operator to click through the same steps every time when an agent can do it for me? I point it at a class of exposed systems, and it handles the boring parts such as finding the target, pulling secrets, testing access, and moving to the data that matters. The win condition is not some brilliant custom exploit. It is repeatability. Once the agent works once, the second run costs almost nothing. That is the part defenders should worry about. I did not just automate a task; I automated the gap between first access and business impact.
Act Blue (Ismael Valenzuela): Most detection pipelines were designed around the tempo of human attackers, where dwell time creates detection windows. An autonomous agent compresses that dwell time to minutes or seconds, so detection must be automated too. Speed is not the only variable that matters, though. As I covered in my talk at the SANS AI Summit, blue teams still hold the defender’s advantage, from home-field knowledge of the environment to the ability to pre-position controls ahead of the attacker, and the aim is to apply that advantage rather than simply try to out-run the agent. Immediately audit any internet-facing Langflow or similar AI orchestration platforms. Restrict egress from these services and ensure database credentials are not stored in environment variables. The deeper problem is that your response workflow likely requires a human to approve containment actions. Pre-authorize automated network isolation for high-confidence indicators like unexpected database connections from application servers or mass configuration deletions. When the attacker has no human in the loop, your defense cannot afford one either.
Supporting sources:
The Hacker News: AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
Hackread: Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation
Signal 2: ClickFix Turns the User Into the Malware Execution Engines
Why it matters: ClickFix-style attacks have become one of the dominant malware delivery patterns by convincing users to copy and paste malicious commands into their own terminals. Opera responded by shipping a “Paste Protect” feature, which is itself an acknowledgment that the technique has moved from novelty to dominant vector.
What is being misread: Defenders are treating ClickFix as a social engineering problem that awareness training can solve. The architectural flaw is deeper. Endpoint detection was designed around the assumption that malicious code arrives from an external source, as a downloaded file, email attachment, or network payload. ClickFix inverts this. The user becomes the delivery mechanism, and the execution originates from a trusted local process like PowerShell or Terminal. Most EDR tools treat locally initiated commands with lower suspicion than inbound payloads.
Guest Perspective (John Hubbard): This is an attack that should be approached across the multiple steps and layers it takes to execute. For a ClickFix attack to succeed, users must be able to reach a questionable website where the attack is hosted, which can be addressed with strong reputation-based web filtering. Next is another layer of defense — the browser itself must not warn the user of the attack; tools like Opera’s new Paste Protect or even browser-based security monitoring tools can further assist in prevention. Next, the user must not be alarmed by the command and copy it into a shell or terminal. We’ve been doing phishing training for years — it’s likely time to inject some ClickFix scenario training as well, to make sure users aren’t so quick to run commands they find on the internet. Finally, the command itself must not be flagged and blocked by EDR, and then the action the command takes (download and execute untrusted code) must further be missed by any EDR and application control tools like Microsoft’s built-in Windows Defender Application Control (WDAC). While clearly ClickFix is a clever attack, it’s not as if our existing defenses are useless. The timeless approach of a threat-informed, defense-in-depth posture that has been tested in red and purple team exercises can address a majority of these attacks if the security team can put in the time to implement and check their defenses.
Think Red (Douglas McKee): ClickFix works because it turns habit into execution. The best targets are often the people most comfortable following technical instructions such as developers, IT staff, researchers, and power users. They run commands all day, so one more command does not feel strange. Your tools see PowerShell or Terminal launched by the user and treat it like administration. My objective is getting the victim to make the malicious action look local, intentional, and trusted. The attack surface is not the endpoint. It is the habit.
Act Blue (Ismael Valenzuela): The fundamental gap here is that most EDR behavioral baselines treat user-initiated shell commands as low-risk events. Start by deploying application control policies that restrict PowerShell, Terminal, and cmd.exe execution to signed scripts or approved command patterns for non-administrative users. Opera's Paste Protect feature is worth evaluating for browser-based vectors, but it only covers one entry point. Complement it with broader browser-based defenses like Browser Detection & Response (BDR) that monitor the full browser session, not just the paste action. Implement clipboard monitoring that flags when encoded or obfuscated command strings are pasted into terminal applications. The intermediary layer matters too. ClickFix campaigns frequently use intermediary pages that fingerprint the victim's OS to deliver platform-specific payloads. Deploy web proxy rules that detect and block the known intermediary domains hosting ClickFix landing pages. The lesson is clear. When the user is the delivery mechanism, the control must sit between the clipboard and the shell, not between the network and the endpoint.
Supporting sources:
Dark Reading: And the Winner in Dominant Malware Delivery? ClickFix
Bleeping Computer: Opera rolls out Paste Protect feature to fight ClickFix attacks
Help Net Security: Opera blocks ClickFix attacks with new clipboard protection feature
Dark Reading: Crafty Phishing Campaigns Auto-Adapt to Victim’s Device, OS
Signal 3: ToddyCat Deploys Umbrij Malware to Backdoor Gmail Through OAuth and Google API
Why it matters: The China-linked APT group ToddyCat has deployed a new malware family called Umbrij that abuses OAuth tokens to access corporate Gmail accounts through Google’s legitimate API. The campaign targets corporate email communications, giving ToddyCat persistent, silent access to sensitive correspondence that looks exactly like normal authenticated application traffic to any monitoring tool watching the wire.
What is being misread: Organizations assume that enabling MFA and monitoring login events protects email accounts from unauthorized access. Umbrij sidesteps both. It does not log in as the user. It authenticates as an application with a valid OAuth grant and reads mail through the API. The broken architectural assumption is that email security controls monitor the inbox from the user-session layer. API-level access through OAuth tokens operates on an entirely different plane, one that most email security gateways and CASB tools do not inspect with the same rigor.
Guest Perspective(John Hubbard): ToddyCat has come up with a very clever move to obtain access to user mailboxes, but in planning detection we should never lose focus on the bigger picture of the entire attack chain. While there are many malware campaigns that are incredibly sneaky in one technique, defenders often forget that the chain of events leading up to and following the clever move still often leaves clear opportunities for defenders. In the case of this malware there’s one clear signal visible to any EDR - the fact that it uses Chrome in headless mode with an attached remote debugging port. As Kaspersky points out in the original source reporting, the ‘--remote-debugging-port’ and ‘--headless’ flags are highly unusual for standard host machines and could provide a high-fidelity signal of this technique for defenders. Additionally even after the credential theft, defenders should have visibility into approved OAuth applications, their usage patterns, and access token issuance and threat hunt for suspicious activity. Using “known good” applications like Google’s ‘Workspace Migration for Microsoft Outlook’ sounds initially clever, but many organizations would never expect any user to be using it, let alone repeatedly. Additionally, continuous usage of an application that is clearly designed to be used once by a user is a clear red flag. Reviewing your Google OAuth log events for suspicious “authorize” and “activity” events related to the GWMMO client_id, and looking for IP addresses on activity events outside of a user’s normal geography and ASNs (and the suspicious volume and cadence of activity from an app designed to be used once) can likely provide a clear signal for this kind of attack, no matter how clever their method is for obtaining the access.
Think Red (Douglas McKee): Give me the OAuth token your environment already trusts, and I get the mailbox without needing the password. I am not logging in as a suspicious user from a strange location. I am reading mail through Google’s own API, the same way approved applications do every day. That gives me quiet access to negotiations, legal threads, customer conversations, and whatever else lives in the inbox. The win condition is persistent visibility, not a shell. To your stack, I am not an intruder. I am an integration.
Act Blue (Ismael Valenzuela): OAuth grants are the new persistence mechanism, and most organizations have no continuous audit process for them. Pull a complete inventory of OAuth application grants across your Google Workspace tenant this week, focusing on applications with mail.read or gmail.readonly scopes. Revoke any grants that cannot be attributed to a known, approved business application. Revocation alone is not durable, though. Even after revocation, an attacker with initial access can re-establish grants. Implement conditional access policies that restrict OAuth consent to admin-approved applications only, and enable Google Workspace alert center notifications for new OAuth grants. The broader principle applies across all cloud platforms. Any API that accepts OAuth tokens is a potential persistence channel, and the only way to detect abuse is to treat OAuth grant management as a continuous security operation, not a one-time configuration task.
Supporting sources:
Signal 4: CitrixBleed 2 Exploited Within Hours of Disclosure as Ransomware Groups Pile On
Why it matters: Citrix patched CVE-2026-8451, a high-severity information disclosure flaw in NetScaler with strong similarities to the original CitrixBleed vulnerability that caused widespread damage in 2023. Exploitation began less than 24 hours after public disclosure, using publicly available proof-of-concept code. Separately, the Anubis ransomware operation has been observed exploiting the related CVE-2025-5777 (Citrix Bleed 2) for initial access, combining it with BYOVD techniques and supply-chain credentials for post-exploitation.
What is being misread: Security teams are treating each new NetScaler CVE as an isolated patch event. The systemic issue is that NetScaler appliances sit at the network edge, handle authentication traffic, and store session tokens in memory. Every memory disclosure vulnerability in this class of device potentially exposes active session material. The broken assumption is that patching one CitrixBleed variant closes the class of vulnerability. Citrix has now disclosed and patched three variants of the same fundamental memory disclosure pattern, and attackers have exploited each one faster than the last.
Guest Perspective (John Hubbard): Diving into this vulnerability shows that there are several ways to both detect and prevent its exploitation, even before patching, by matching requests to specific URLs and their content, as well as turning off (where viable) the SAML IDP functionality. However, the two core questions many defenders will face in this situation, and others like it, are deciding on the patch vs. temporarily disrupting approach, and how quickly you can evaluate which is more appropriate and get it executed. This again comes back to the point that security is now a game of speed - yours vs. the attacker’s. Where they have you outpaced, even with viable solutions, you will still fall behind. Everyone should indeed both patch and block this specific attack, but the bigger picture here is considering how painful this type of situation is to address. If your team took this information and was able to act on it in a quick, calm, and non-disruptive way, that’s a sign you’re in a great spot. If however this created emergency meetings, disrupted critical applications, middle of the night panicked phone calls, or a delayed response due to difficult team coordination, that’s your signal to test and improve how you can build resilience, communication, and speed optimization into your table top scenarios and other training.
Think Red (Douglas McKee): NetScaler is valuable because it sits in front of the thing I actually want, authenticated access. I do not need to beat MFA if the appliance hands me session material from memory. A leaked token is better than a stolen password because it lets me inherit a session that already passed the checks. The economics are obvious. One edge device can expose access for administrators, remote users, and downstream systems at the same time. The bug is memory disclosure, but the payoff is trust reuse. I am not breaking authentication. I am taking the part that happens after authentication and using it as my front door.
Act Blue (Ismael Valenzuela): NetScaler appliances in your environment should be treated as tier-zero assets given their repeated exposure to this vulnerability class. Patch CVE-2026-8451 immediately, prioritizing any internet-facing instances. Force-terminate all active sessions post-patch to invalidate any tokens that may have been leaked. Patching is necessary but not sufficient here. Deploy out-of-band monitoring for NetScaler appliances that detects anomalous memory content in HTTP responses, a pattern that network detection tools can flag even before a specific CVE is assigned. Review whether your WAF or reverse proxy configuration can strip or normalize responses from NetScaler endpoints to limit data leakage. The recurring lesson from this vulnerability class is that edge appliances that handle authentication are single points of failure. If you cannot patch within hours of disclosure, you need compensating controls that detect exploitation independently of the patch cycle.
Supporting sources:
SecurityWeek: New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure
CyberScoop: Citrix patches a new NetScaler flaw with echoes of CitrixBleed
The Hacker News: Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
SecurityWeek: Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack
MEME OF THE WEEK
Some weeks the meme writes itself. This week it ran itself.
ROLE-BASED TAKEAWAYS
Executive / CISO / Board Level
Autonomous AI-driven attacks have moved from theory to documented reality. JADEPUFFER’s full-chain ransomware operation without a human operator means board-level risk discussions must now account for attack campaigns that scale at near-zero marginal cost. Ask your team whether your incident response plan includes pre-authorized automated containment, because any step requiring human approval is now a potential gap.
Edge appliance risk is compounding, not resolving. Citrix has disclosed three variants of the same memory-disclosure vulnerability class. Each was exploited faster than the last. If your organization runs internet-facing NetScaler appliances, request a briefing on time-to-patch metrics and compensating controls for the period between disclosure and deployment.
ClickFix delivery now dominates malware campaigns. A large share of observed malware delivery now uses social engineering that turns the user into the execution mechanism, bypassing traditional email and endpoint controls. Security awareness programs alone are insufficient. Fund controls that monitor what happens between the clipboard and the command line, including application control, browser-based detection, and web filtering.
Enterprise Architect
Design Principle Impact: The assumption that response workflows can include human decision gates at every escalation point is now a liability. Architect automated containment triggers for high-confidence threat indicators such as unauthorized database access from application-tier hosts, mass configuration deletion, or anomalous OAuth grant creation. The JADEPUFFER case proves that attacker timelines can be shorter than human approval chains.
New Constraint/Dependency: OAuth grants across Google Workspace, Microsoft 365, and other SaaS platforms must be treated as persistent access channels subject to continuous monitoring, not one-time configuration. ToddyCat’s Umbrij malware demonstrates that a valid OAuth token provides silent, ongoing access that existing CASB and email gateway architectures were not designed to detect at the API layer. Enforce this in design by restricting OAuth consent to admin-approved applications, revoking any grant that cannot be tied to a known business use, and treating grant management as a continuous operation rather than a provisioning step.
Security Operations
Implementation Watch Item: Monitor for new or modified OAuth application grants across Google Workspace and Microsoft 365 tenants, specifically applications requesting mail.read, gmail.readonly, or equivalent scopes. ToddyCat’s Umbrij campaign exploits exactly this access pattern.
Common Failure Mode: Incident response playbooks that require analyst triage and management approval before network isolation will fail against autonomous agent attacks like JADEPUFFER. The entire kill chain completes in minutes. Pre-authorize automated isolation for database servers that receive unexpected connections from application-tier hosts.
Monitoring Patterns: Watch for PowerShell or terminal processes initiated by non-administrative users immediately following browser activity. ClickFix campaigns produce a distinctive pattern. The user visits a page, copies content, and then executes a shell command within seconds. Correlate browser navigation logs with shell execution telemetry to surface this sequence.
Signal vs Noise Guidance: A new OAuth grant for a mail-reading scope is a genuine threat indicator if it was not requested through your organization’s app approval workflow. A user running PowerShell is noise. A user running an encoded PowerShell command within 30 seconds of visiting an unknown URL is signal.
Take the Adversary by Surprise: Create a monitored decoy OAuth grant tied to a honeypot mailbox using a realistic migration-style app name. Alert on any authorization-code exchange, Gmail API access, or app-consent activity involving that account. The goal is not another generic trap; it is to prove whether your monitoring can see OAuth abuse before a real mailbox is touched.
AI Orchestration Hardening: Audit internet-facing Langflow and similar AI orchestration platforms this week. Restrict their outbound egress and remove database credentials from environment variables, since JADEPUFFER’s agent harvested credentials from exactly that location before pivoting to production data.
Preventive Controls for ClickFix: Deploy application control policies that restrict PowerShell, Terminal, and cmd.exe execution to signed scripts or approved command patterns for non-administrative users. Complement browser-native features like Opera’s Paste Protect with broader browser-based defenses such as Browser Detection & Response (BDR), and add web proxy rules that block the known intermediary domains hosting ClickFix landing pages.
NetScaler Response Actions: Patch CVE-2026-8451 on internet-facing NetScaler appliances first, then force-terminate all active sessions post-patch to invalidate any tokens leaked from memory. Deploy out-of-band monitoring that flags anomalous memory content in NetScaler HTTP responses, and review whether your WAF or reverse proxy can strip or normalize those responses to limit leakage.
About this week’s guest
John Hubbard is a SANS Senior Instructor and the Cyber Defense Curriculum Lead at the SANS Institute, where he helps shape the training that thousands of defenders rely on to build and run modern security operations. He is the author of SEC450: SOC Analyst Training and the co-author of LDR551: Building and Leading Security Operations Centers, two courses that turn years of frontline SOC leadership into practical, hands-on skills for analysts and the leaders who manage them.
A SOC consultant and multiple-GIAC-certified practitioner, John focuses on the craft of detection and response, teaching teams how to hunt, detect, and act with the speed and judgment that modern threats demand. He also hosts Blueprint, a podcast on cyber defense and security operations where he interviews leading practitioners and breaks down the tools and techniques that make blue teams effective.
Connect with John on LinkedIn.
See you next Monday!
The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.