Weekly Threat Recap Defense Playbook: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, and 700 Supermarkets Hit — What to Patch, Hunt, and Harden Now

This week's recap is a reminder that the most damaging incidents rarely announce themselves. Between a surge of 98 zero-day vulnerabilities disclosed or exploited, security researchers demonstrating rogue AI agents acting outside their intended guardrails, a $100 million cryptocurrency theft, and a supply-chain style disruption that took down operations at roughly 700 supermarkets, defenders were hit from every direction at once: trusted software channels, commodity hardware, legacy bugs being re-weaponized, and systems nobody thought to monitor.

The through-line across all of these stories is trust abuse. Attackers compromised connections organizations assumed were safe — vendor integrations, update pipelines, agentic AI tooling with broad permissions, and point-of-sale/back-office infrastructure in retail distribution. If your detection strategy still assumes that 'trusted' processes, signed updates, or internal service accounts are inherently benign, this week should change your mind.

This post breaks down each threat class from the recap, explains the attack mechanics from a defender's perspective, and delivers hunting content you can deploy in your SIEM and EDR today.

Technical Analysis

1. The Zero-Day Surge — 98 in a Single Week

A volume of 98 zero-days in one reporting cycle is not a statistical anomaly anymore; it reflects two structural realities. First, exploit brokers and nation-state programs are holding larger 0-day inventories and burning them faster. Second, vendor patch cycles and coordinated disclosure windows are compressing, meaning defenders now receive clustered patch events rather than isolated ones.

Defensive implications:

• Patch triage becomes the bottleneck. With no CVE-level detail available on all 98 at disclosure time, your vulnerability management program must prioritize by exposure and exploitability, not CVSS alone. Internet-facing services, VPN concentrators, firewalls, and remote access infrastructure remain the highest-yield targets for 0-day exploitation.
• Assume compromise on edge devices. When a 0-day drops against perimeter gear, the correct posture is: patch, then hunt for pre-patch exploitation. Attackers routinely establish persistence (web shells, rogue accounts, cron/systemd implants) before the patch window closes. Patching without forensics leaves the implant alive.
• Virtual patching buys time. WAF rules, IPS signatures, and network segmentation can reduce exploitability while vendor patches are validated.

2. Rogue AI Agents — The New Insider Threat

The recap's coverage of rogue AI agents is the most strategically important story of the week for enterprise defenders. Agentic AI frameworks — autonomous agents built on LLMs that can execute tools, call APIs, browse, and run code — are being deployed with permissions that would horrify any security architect if a human employee requested them.

From a defender's perspective, the attack surface includes:

• Prompt injection leading to tool abuse. An agent instructed to 'summarize this document' that encounters embedded instructions can be redirected to exfiltrate data, execute shell commands, or call internal APIs it was granted access to. The agent's legitimate credentials become the attacker's credentials.
• Over-privileged service identities. Agents typically run under service accounts with broad read/write scopes. There is no MFA on an API token.
• Unlogged autonomy. Traditional audit logging captures user actions. Agent tool-calls often bypass existing DLP and UEBA baselines because the traffic originates from sanctioned automation infrastructure.
• Agent frameworks executing code. Many agent runtimes invoke Python, Node.js, or shell interpreters to complete tasks — a detection surface that closely resembles attacker behavior precisely because it is arbitrary code execution, just sanctioned.

The observable indicators of a rogue or hijacked agent are process trees where an agent runtime (Python, Node, containerized workloads) spawns command interpreters, network tools, or scripting engines outside its expected tool-call patterns, plus anomalous outbound connections from agent hosts to unfamiliar destinations.

3. The $100M Crypto Theft

Nine-figure crypto thefts in 2025–2026 overwhelmingly follow one of three patterns: private key compromise (via infostealers, phishing, or compromised signing infrastructure), malicious transaction approval (users or automated signing services tricked into signing attacker-crafted transactions, often via front-end compromise of a legitimate DeFi interface), or supply-chain compromise of wallet/signing software.

For organizations holding or transacting digital assets, the defensive lesson is that the endpoint and the signing path are the perimeter. Infostealer malware targeting browser extension wallets, clipboard hijacking of wallet addresses, and credential theft against cloud key-management services are the precursor behaviors your SOC can actually detect.

Key observables:

• Non-browser processes accessing browser credential stores or wallet extension data directories (LevelDB/IndexedDB under browser profile paths).
• Processes reading clipboard contents in tight loops.
• Unsigned executables staging in user profile directories shortly before outbound connections to cryptocurrency infrastructure.

4. 700 Supermarkets Disrupted — Third-Party and Retail Infrastructure Risk

The disruption hitting ~700 supermarkets follows the now-familiar pattern of a shared service provider or software vendor compromise cascading downstream. Whether the vector is a compromised software update, an MSP/platform breach, or ransomware against a logistics/ordering backend, the effect on downstream operators is identical: point-of-sale, inventory, and ordering systems go offline simultaneously across hundreds of locations that individually did nothing wrong.

Defensive implications for retail and any franchise-style operation:

• Your vendor's incident is your incident. Contractual SLAs for breach notification and recovery time objectives are not optional paperwork.
• Segment store networks from corporate and vendor management planes. POS terminals and back-office systems should have no path to lateral movement beyond what is strictly required.
• Offline operational runbooks matter. Stores that can operate in degraded mode (offline POS, manual inventory) convert a catastrophic outage into a business disruption.
• Monitor vendor management agents. Remote management tooling deployed by third parties (RMM agents, update services) is a top-tier persistence and lateral movement vehicle and must be inventoried, allow-listed, and alerting on any deviation.

Detection & Response

The following detections target the observable behaviors described above: rogue/hijacked AI agent tool execution, crypto-wallet-targeting infostealer behavior, and suspicious remote management tooling common in supply-chain cascades. All rules are designed to be high-fidelity; tune baselines for your environment before enabling at high sensitivity.

Sigma Rules

---
title: AI Agent Runtime Spawning Command Interpreter or Network Tool
id: 3f9c2a71-8b4d-4e6a-9c12-7d5e1f8a3b44
status: experimental
description: Detects agentic AI runtimes (Python, Node.js) spawning command interpreters, download cradles, or network utilities, consistent with prompt injection or rogue agent tool abuse.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://thehackernews.com/2026/10/weekly-recap-98-zero-days-rogue-ai.html
author: Security Arsenal
date: 2026/10/19
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate AI agent frameworks invoking shell tools as designed; baseline known agent service accounts and approved tool-call patterns
level: high
---
title: Non-Browser Process Accessing Browser Credential or Wallet Extension Stores
id: 8e1d4b92-5c3a-4f78-b2e6-9a7c3d1f5e21
status: experimental
description: Detects processes other than the browser itself reading browser Login Data, Cookies, or wallet extension LevelDB data, a hallmark of infostealers preceding cryptocurrency theft.
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://thehackernews.com/2026/10/weekly-recap-98-zero-days-rogue-ai.html
author: Security Arsenal
date: 2026/10/19
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
  selection_file:
    TargetFilename|contains:
      - 'Login Data'
      - 'Cookies'
      - 'Local Extension Settings'
      - 'nkbihfbeogaeaoehlefnkodbefgpgknn'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  condition: selection_path and selection_file and not filter_browser
falsepositives:
  - Enterprise backup or DLP agents reading browser profiles; allow-list by signer and path
level: high
---
title: Unauthorized Remote Management Tool Execution
id: c7a2e5d3-1f6b-4a98-8d34-2b9e6f4c7a18
status: experimental
description: Detects execution of common RMM tooling frequently abused in supply-chain and MSP compromises. Alert when RMM binaries run outside the organization's approved tooling inventory.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://thehackernews.com/2026/10/weekly-recap-98-zero-days-rogue-ai.html
author: Security Arsenal
date: 2026/10/19
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\screenconnect.exe'
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\rustdesk.exe'
      - '\splashtop.exe'
      - '\atera.exe'
      - '\ninjarmm.exe'
  condition: selection
falsepositives:
  - Approved RMM tooling deployed by IT or a contracted MSP; suppress by hash/signer for authorized agents only and alert on everything else
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for AI agent runtimes and automation service accounts spawning command interpreters or making unexpected outbound connections. It works against Defender for Endpoint tables and Syslog-ingested Linux agent hosts in Sentinel.

// Hunt 1: Agent/automation runtimes spawning shells or network tools (Windows + Linux)
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","curl.exe","wget.exe","certutil.exe","bitsadmin.exe","sh","bash","nc","ncat","socat"]);
let agentParents = dynamic(["python.exe","python3.exe","node.exe","python","python3","node"]);
let window = 7d;
let winEvents = DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where InitiatingProcessFileName in~ (agentParents)
    | where FileName in~ (suspiciousChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName;
let linEvents = Syslog
    | where TimeGenerated > ago(window)
    | where ProcessName in~ ("sh","bash","curl","wget","nc","ncat","socat")
    | where SyslogMessage has_any ("python","node")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage;
winEvents
| union linEvents
| order by TimeGenerated desc;
// Hunt 2: Suspicious outbound connections from agent hosts to rare destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (dynamic(["python.exe","node.exe","python","node"]))
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteUrl) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| where DistinctDestinations >= 1
| order by ConnectionCount desc;

Velociraptor VQL

Use this artifact to sweep endpoints for non-browser processes with handles to browser credential/wallet stores and for unsigned executables staging in user profile paths — the precursor behavior to crypto wallet theft.

-- Hunt for non-browser processes accessing browser credential and wallet extension stores
SELECT Pid, Name, Exe, CommandLine, Username,
       FullPath AS AccessedPath
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data',
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Local Extension Settings/**',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Login Data',
  'C:/Users/*/AppData/Roaming/Mozilla/Firefox/Profiles/*/logins.json'
])
WHERE NOT FullPath =~ 'System Volume Information'

-- Correlate with running processes that are unsigned and staging in user profile paths
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(AppData\\\\(Local|Roaming)|Users\\\\Public)'
  AND NOT Name =~ '(chrome|msedge|firefox|brave|Teams|OneDrive)'
ORDER BY CreateTime DESC

Remediation and Verification Script

Run this on endpoints and agent-hosting servers to inventory automation runtimes with child-process execution capability, enumerate RMM tooling, and verify browser credential store protections. Review output before taking enforcement action.

# Security Arsenal - Rogue Agent / Infostealer / Rogue RMM Verification Script
# Run elevated. Outputs a consolidated risk report to C:\Windows\Temp\SA-WeeklyRecap-Audit.txt

$report = "C:\Windows\Temp\SA-WeeklyRecap-Audit.txt"
"=== Audit started $(Get-Date) ===" | Out-File $report

# 1. Enumerate RMM tooling present on the system (compare against approved inventory)
"`n--- RMM Tooling Check ---" | Out-File $report -Append
$rmm = @("screenconnect","anydesk","teamviewer","rustdesk","splashtop","atera","ninjarmm")
foreach ($tool in $rmm) {
    $found = Get-ChildItem -Path "C:\Program Files","C:\Program Files (x86)","C:\Users" -Filter "$tool*.exe" -Recurse -ErrorAction SilentlyContinue -Depth 4
    if ($found) { $found.FullName | Out-File $report -Append }
}

# 2. Find python/node processes with command-interpreter children (rogue agent behavior)
"`n--- Agent Runtime Child Process Check ---" | Out-File $report -Append
$agents = Get-CimInstance Win32_Process | Where-Object { $_.Name -match "python|node" }
foreach ($a in $agents) {
    $children = Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $a.ProcessId -and $_.Name -match "cmd|powershell|pwsh|curl|certutil" }
    foreach ($c in $children) {
        "PARENT: $($a.Name) (PID $($a.ProcessId)) -> CHILD: $($c.Name) (PID $($c.ProcessId)) :: $($c.CommandLine)" | Out-File $report -Append
    }
}

# 3. Verify Credential Guard / LSASS protection status (infostealer mitigation)
"`n--- Credential Protection Check ---" | Out-File $report -Append
$lsa = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -ErrorAction SilentlyContinue
"RunAsPPL: $($lsa.RunAsPPL)" | Out-File $report -Append
$cg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
"Credential Guard status: $($cg.SecurityServicesRunning)" | Out-File $report -Append

# 4. Hardening: enable LSASS protection if not set (requires reboot; validate in test first)
# Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -Value 1

# 5. List unsigned executables in user profile paths (staging indicator)
"`n--- Unsigned Executables in User Paths ---" | Out-File $report -Append
Get-ChildItem "C:\Users\*\AppData\Local","C:\Users\*\AppData\Roaming","C:\Users\Public" -Filter *.exe -Recurse -ErrorAction SilentlyContinue -Depth 3 |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne "Valid") { "$($_.FullName) :: $($sig.Status)" | Out-File $report -Append }
  }

"=== Audit complete ===" | Out-File $report -Append
Write-Host "Report written to $report. Review findings before enforcement."

Remediation

Zero-day surge response:

• Triage the 98 disclosed zero-days against your asset inventory within 24 hours. Prioritize internet-facing edge devices, remote access infrastructure, and any product already listed in the CISA Known Exploited Vulnerabilities catalog — KEV entries carry federal remediation deadlines and should carry yours too.
• After patching any edge device exploited via 0-day, perform compromise assessment: audit local accounts, review web server directories for web shells, check scheduled tasks/cron, and diff running configurations against known-good baselines.
• Where patches are not yet available, apply vendor-published workarounds, disable the affected feature, or place the service behind an authenticating reverse proxy.

Rogue AI agent governance:

• Inventory every AI agent deployment, its service account, and its granted API scopes. Apply least privilege: agents should hold task-scoped, short-lived credentials, not standing broad access.
• Enforce tool allow-lists at the agent framework level. If the agent has no legitimate need to invoke a shell, disable shell tool execution entirely.
• Log every tool call (input, output, destination) to your SIEM and baseline per-agent behavior. Alert on new destinations, new tool types, and volume anomalies.
• Treat all agent-ingested content (documents, emails, web pages) as untrusted input. Deploy prompt-injection filtering and human-in-the-loop approval for destructive or external-facing actions.

Crypto theft prevention:

• Move treasury/signing operations to hardware security modules or MPC-based custody; never hold meaningful private keys on general-purpose endpoints.
• Deploy the infostealer detections above, enable LSASS protection and Credential Guard, and block unsigned executables in user profile paths via WDAC/AppLocker.
• Require out-of-band verification for any transaction above threshold, and pin/verify the integrity of DeFi front-ends used by treasury staff.

Supply-chain / retail cascade resilience:

• Contractually require vendors and MSPs to meet breach notification SLAs and maintain incident response capabilities; verify, don't trust.
• Inventory and allow-list all third-party RMM agents. Alert on any RMM binary outside the approved list (the Sigma rule above covers this).
• Segment store/POS networks from corporate and vendor management planes; test degraded-mode operations quarterly.

The common denominator this week is that trust itself was the attack surface. Inventory what you trust, monitor it like an adversary already controls it, and make sure your detections assume breach — because this week, for hundreds of organizations, someone already was inside.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub