AI Agents Used in Cyberattacks Against PaperCut Software Instances

Suspected Russian-speaking cyber actors reportedly used hundreds of AI agents to exploit recently disclosed vulnerabilities (CVE-2026-81578 and CVE-2026-82078) in PaperCut NG/MF. These opportunistic attacks, primarily targeting the education sector across multiple countries, compromised over 440 instances through authentication bypass and remote code execution. Post-exploitation activities included deploying Windows registry hive collection tools and Metasploit/Meterpreter payloads, highlighting an evolving threat landscape.