Case papercut-ai-agents-credential-theftAI-assisted malwareWorldwide
Hundreds of AI agents exploit PaperCut NG/MF servers to steal Windows credentials
A likely Russian-speaking actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and set up reusable internal access. GreyNoise found 440 compromised instances.
HighAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 16, 2026
- Location
- Worldwide
- Target
- PaperCut NG/MF servers at 395 organizations in 48 countries
- Severity
- High
- Triggered by
- Likely Russian-speaking threat actor
- Actor type
- Unknown
- Sector
- Multiple / cross-sector
- Reported loss
- None reported
- CVE
- None
What happened
A likely Russian-speaking actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and set up reusable internal access. GreyNoise found 440 compromised instances.
Impact: At least 440 compromised instances across 395 organizations in 48 countries, with reusable access to internal networks.
Who triggered it
Actor: Likely Russian-speaking threat actor
Attribution: GreyNoise assesses the actor as likely Russian-speaking; no named group given.
Motive: Unknown; credential theft and persistent access to internal networks
How it happened
Attack vector: AI agents exploiting PaperCut NG/MF servers at scale, then harvesting Windows credentials.
Root cause: Exposed, exploitable PaperCut NG/MF servers; the specific flaw is not stated in the summary.
Timeline
- Reported by GBHackers
Response
Unknown; GreyNoise identified and reported the compromised instances.
Current status: Under investigation
Sources (open in a new tab)
- GBHackers gbhackers.com
Cite this case
Hundreds of AI agents exploit PaperCut NG/MF servers to steal Windows credentials. AI Threat Watch, case papercut-ai-agents-credential-theft, Oct 16, 2026. https://aithreat.io/cases/papercut-ai-agents-credential-theft/
Permanent link: https://aithreat.io/cases/papercut-ai-agents-credential-theft/