THREAT INTELLIGENCE BRIEF·Monday, August 3, 2026·AI-Powered

The most urgent threat this week is the public release of a proof-of-concept exploit for a domain-takeover technique targeting Active Directory Certificate Services (AD CS), posing a critical risk to enterprise networks.

The most urgent threat this week is the public release of a proof-of-concept exploit for a domain-takeover technique targeting Active Directory Certificate Services (AD CS), posing a critical risk to enterprise networks. Additionally, a significant vulnerability in COLDCARD hardware wallets has led to the theft of over $88 million, highlighting severe risks in specialized security hardware. We are also observing the rise of AI as a threat vector, with reports of an AI model breaching companies during tests and AI tools drastically accelerating the creation of sophisticated phishing campaigns. These developments signal a need to secure core infrastructure and adapt defenses for AI-driven threats.

9 articles analysed

Threat Categories

🐛Vulnerabilities2

⚠️Critical Flaws2

📧Phishing1

Article Analyses (5)

Week in review: Claude breached three companies during tests, AD CS domain-takeover PoC released

medium

PoC

Details

A proof-of-concept (PoC) exploit has been publicly released for a technique that can lead to a full domain takeover via Active Directory Certificate Services (AD CS). The availability of a public PoC significantly lowers the barrier for attackers to execute this high-impact attack against enterprise networks.

Affected Systems

Microsoft Active Directory Certificate Services (AD CS)

Potential Impact

Complete compromise of the Active Directory domain, allowing an attacker to gain administrative control over the entire network, leading to catastrophic data breaches, operational disruption, and financial loss.

Mitigations

The source article did not provide specific mitigation actions. General best practices for securing Active Directory Certificate Services should be followed.

Help Net Security Draft Post

COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft

high

Details

A critical flaw in the firmware of COLDCARD hardware wallets resulted in a faulty random number generator (RNG). This allowed attackers to predict wallet seeds and steal an estimated $88.6 million in Bitcoin from thousands of user wallets, demonstrating a catastrophic failure in a trusted security device.

Affected Systems

COLDCARD hardware wallets with vulnerable firmware.

Potential Impact

Direct and irreversible financial loss for organizations or individuals using the affected wallets for cryptocurrency custody. Significant reputational damage to the hardware wallet manufacturer and erosion of trust in such devices.

Mitigations

The source article did not provide specific mitigation actions. Users should seek guidance from the vendor on firmware updates and wallet security.

BleepingComputer Draft Post

Week in review: Claude breached three companies during tests, AD CS domain-takeover PoC released

medium

Details

The AI model Claude reportedly breached three companies during security testing, showcasing the novel threat of AI agents acting as autonomous attackers. These agents can independently identify and exploit vulnerabilities, representing a paradigm shift in offensive capabilities that could bypass traditional security defenses.

Affected Systems

Potentially any organization whose infrastructure is accessible to advanced AI models.

Potential Impact

Emergence of new, unpredictable attack vectors that can be executed at machine speed. Security incidents could occur without direct human attacker intervention, challenging conventional detection and response models.

Mitigations

Develop and enforce strict security policies governing the use of AI agents within the organization. Deploy AI coding agents in heavily restricted, sandboxed environments using tools like the open-source 'Nono' sandbox to limit their permissions and prevent access to sensitive systems.

Help Net Security Draft Post

AI cut phishing from hours to seconds, which is where DMARC and BIMI come in

medium

Details

The use of Artificial Intelligence has dramatically accelerated the phishing attack lifecycle, enabling threat actors to generate and launch highly convincing campaigns in seconds instead of hours. This increases the volume, sophistication, and personalization of attacks, making them more likely to succeed.

Affected Systems

All employees, customers, and partners who use email.

Potential Impact

Higher frequency of successful phishing attacks leading to credential theft, business email compromise (BEC), malware infections, and significant financial loss.

Mitigations

Ensure strict enforcement of DMARC, DKIM, and SPF to prevent domain spoofing. Implement Brand Indicators for Message Identification (BIMI) to provide a visual cue of email authenticity. Augment security awareness training to educate users on identifying sophisticated, AI-generated phishing attempts.

Help Net Security Draft Post

SkillSpector: NVIDIA’s open-source security scanner for AI agent skills

high

Details

NVIDIA has released an open-source tool named SkillSpector to address the emerging threat of malicious AI agent 'skills'. These skills, which extend an AI agent's capabilities, can be weaponized to include dangerous functions like shell access or file system manipulation, effectively turning the agent into an insider threat.

Affected Systems

Organizations developing or deploying AI agents that use extensible, third-party skills.

Potential Impact

A compromised AI agent could be instructed to exfiltrate sensitive data, deploy malware, or disrupt critical business operations, all while appearing as a legitimate process.

Mitigations

Establish a vetting process for all third-party AI skills before deployment, using tools like SkillSpector to scan for malicious code.

Help Net Security Draft Post

Generated by gemini-2.5-pro