Security Roundup: Flowise Exploitation, AI Credential Theft and SAP Risks
Summary
A weekly roundup covers Anthropic’s Claude security controls, phishing and AI-account abuse, reported breaches, a Flowise exploit framework, an unverified Trezor implant report, faster SAP exploitation, and ransomware targeting outdated Synology devices.
Key points
- Anthropic added Claude Enterprise security and administration features, including inspection hooks that route prompts and tool calls to an organization’s existing security tools.
- Push Security documented fake event invitations used to phish work accounts, including a Microsoft device-code phishing flow.
- Chainalysis reported exposure of user names, usernames, password hashes and live tokens; Have I Been Pwned added about 851,000 email addresses from Harvard’s 2025 breach.
- Era researchers described Greeter exploiting Flowise flaw CVE-2024-58351 to run commands, search for credentials and attempt persistence.
- Mandiant reported AI-account hijacking cases involving fraudulent bills exceeding $100,000 in a day and up to $1 million overall; attackers mainly used stolen or exposed cloud credentials and API keys.
- Trezor advised some CryptoBilis customers to move funds to a new wallet after a buyer reported an implant; Trezor had not verified the report, and no stolen funds were reported.
- A study found SAP vulnerabilities were first exploited or had public proof-of-concept code within a median of one to three days; Synology warned that attackers are exploiting a flaw in outdated DSM releases for ransomware.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering phishing, data breaches, vulnerability exploitation, ransomware, and security product developments.
- Impact
- Reported incidents include exposed Chainalysis user password hashes and live tokens; phishing campaigns targeting Microsoft and Google accounts; attackers using hijacked enterprise AI access to generate fraudulent bills exceeding $100,000 in a day and up to $1 million at some organizations; and a Harvard breach affecting roughly 851,000 unique email addresses and detailed personal records. A reported implant in a Trezor Safe 5 may capture recovery phrases, though Trezor has not verified the report and no stolen funds were reported. Attackers are exploiting an unspecified Synology vulnerability against outdated DSM releases to encrypt data and extort victims. The roundup also reports exploitation activity involving Flowise and a sharp reduction in the time between SAP security-note releases and verified exploitation or public proof-of-concept.
MITRE ATT&CK
T1078 · Valid AccountsAttackers reportedly used stolen or exposed cloud credentials and API keys to take over companies' access to AI models.T1552.001 · Credentials In FilesThe Greeter framework searched compromised hosts for SSH keys and other credentials.T1566.002 · Spearphishing LinkFake event-registration pages were used in a phishing campaign targeting employees and prompting them to sign in with work accounts.
CVE
CVE-2024-58351Flowise · Flowisewith thousands of chat messages reading only “hello” while abusing an old code injection flaw (CVE-2024-58351) to execute commands.CVE-2026-40217Litellm · LitellmInitial access mainly came from stolen or exposed cloud credentials and API keys, and in one intrusion the attackers exploited a LiteLLM vulnerability (CVE-2026-40217) to upgrade ordinary keys to full admin credentials.
Threat Actors
Alexander BlockThe article says Alexander Gurevich is now known as Alexander Block. He is accused in the indictment of exploiting the Nomad Bridge smart contract and laundering cryptocurrency.Alexander GurevichAccording to the indictment, he allegedly exploited the Nomad Bridge smart contract in 2022 and laundered the stolen cryptocurrency; he appeared in a US court after extradition.ShinyHuntersThe Harvard University breach was subsequently tied to an extortion bid by ShinyHunters.
Vendors
AnthropicAnthropic adds security center, admin controls to Claude EnterpriseChainalysisChainalysis breach also exposed password hashes and tokensGoogleFake OpenAI and SpaceX event invites phish Microsoft and Google accountsMicrosoftFake OpenAI and SpaceX event invites phish Microsoft and Google accountsSAPSAP exploitation window shrinks to days as ransomware interest growsSynologySynology flaw patched in 2024 now exploited in ransomware attacksTrezorCryptoBilis-sold Trezor allegedly fitted with seed-stealing implant
Products
Agent SubstrateGoogle hands Agent Substrate, gVisor to CNCF for sandboxing AI agentsClaude EnterpriseAnthropic adds security center, admin controls to Claude EnterpriseDSMSynology warns that attackers are abusing a vulnerability fixed in December 2024 to hit devices still running outdated DSM releases, with the goal of encrypting data and extorting victims.Flowise‘Hello’ messages hide Chinese-language attack framework targeting FlowisegVisorGoogle hands Agent Substrate, gVisor to CNCF for sandboxing AI agentsKYTThe company has since taken several products offline, including its KYT transaction monitoring service after detecting abnormal activity, and is reaching out to customers whose KYT accounts show signs of unauthorizedLedgeran implant inside a Trezor Safe 5 purchased from the former Southeast Asian reseller, which also sold Ledger devices that were found to have been tampered with.LiteLLMInitial access mainly came from stolen or exposed cloud credentials and API keys, and in one intrusion the attackers exploited a LiteLLM vulnerability (CVE-2026-40217) to upgrade ordinary keys to full admin credentials.Nomad BridgeAlleged Nomad Bridge exploiter appears in US court after extraditionSAPSAP exploitation window shrinks to days as ransomware interest growsTrezor Safe 5funds to a freshly created wallet with a new seed, after a buyer reported finding an implant inside a Trezor Safe 5 purchased from the former Southeast Asian reseller, which also sold Ledger devices that were found to
Tools
GreeterEra researchers have detailed Greeter, a Chinese-language exploitation framework that bombarded Flowise honeypots with thousands of chat messages reading only “hello” while abusing an old code injection flawKali365The Microsoft option launches a device code phishing flow run through the Kali365 phishing-as-a-service platform.