Inside a PaperCut Attacker's AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries

An AI-orchestrated campaign targeted PaperCut NG/MF print management software by exploiting two vulnerabilities, CVE-2026-81578 and CVE-2026-82078, through a Tapestry vulnerability chain and XML-RPC API abuse. The attackers used hundreds of AI agents leveraging OpenAI Codex and DeepSeek models to automate exploitation at scale. Post-exploitation activities included Windows credential harvesting, LSA secret extraction, reverse SOCKS5 pivoting with chisel, Metasploit automation, and Active Directory domain compromises. The campaign affected a reconnaissance pool of 1,005 hosts across 45 countries, with 46 confirmed Active Directory domain compromises and 45 targets maintaining live internal access pivots at discovery.

• PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578ExploitedMalware2026-10-01
• CVE-2026-82078: PaperCut MF/NG · Unsafe ReflectionCriticalVulnerability2026-08-28
• CVE-2026-81578: PaperCut NG/MF · Improper Access Control Vulnerability ExistsCriticalVulnerability2026-08-28
• CVE-2026-81578: PaperCut MF/NG · Authentication Bypass by Primary WeaknessHighVulnerability2026-08-28
• Nationaal Cyber Security Centrum PaperCut · Kwetsbaarheden VerholpenExploitedVulnerability2026-08-28