AI-Enhanced Client Exploitation and Automated Credential Theft

Source

---
analysis: This hunt does not rely on static file signatures, which are easily rotated.
  It pivots from application failure modes (memory violation crashes) to fleet-wide
  prevalence and automated credential-store access, providing a contextual view of
  the attack chain that a single detection rule cannot replicate.
blind_spots:
- id: no-agent-on-host
  owner: Asset Management
  question: Are there vulnerable, unmanaged devices executing these implants?
  remediation: Deploy agents to all corporate-owned endpoints and audit managed status.
  requires: Endpoint agent coverage
  risk: A host without an agent provides no telemetry for process launches or application
    errors, leaving a gap in the behavioral search.
  stage: malware-implant-execution
- id: keystroke-logging-gap
  owner: Detection Engineering
  question: Is the NIK C2 implant actively streaming victim keystrokes?
  remediation: Investigate EDR capabilities for monitoring keyboard hook activity.
  requires: Detailed keystroke or input telemetry
  risk: Without specific input-monitoring telemetry, the keystroke-streaming feature
    of NIK C2 is invisible, leaving credential theft to be inferred only from object-access
    events.
  stage: automated-credential-theft
coverage:
- stage: vulnerability-exploitation-outlook-chrome
  status: covered
  steps:
  - scoping-vulnerable-inventory
  - client-application-crashes
- stage: malware-implant-execution
  status: covered
  steps:
  - rare-binaries-and-known-hashes
- stage: automated-credential-theft
  status: covered
  steps:
  - credential-access-activity
- reason: The AI-driven logic of the C2 occurs within the compromised session or on
    the attacker's infrastructure; standard network telemetry can see the connection
    but not the integrated AI analysis.
  stage: ai-enabled-command-and-control
  status: not_visible
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: The active exploitation of zero-day vulnerabilities in ubiquitous
    office software (Outlook and Chrome) presents an immediate threat to corporate
    credentials. This hunt identifies post-compromise activity that specifically bypasses
    static signature-based controls.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary has exploited zero-day vulnerabilities in Microsoft Outlook
  or Google Chrome to execute AI-integrated implants that automate credential harvesting
  and data analysis.
labels:
- hunt
- attack.t1190
- attack.t1555
- attack.t1059
- attack.t1071
- command and control
- credential access
- execution
- initial access
name: AI-Enhanced Client Exploitation and Automated Credential Theft
parameters:
  cve_ids:
    default:
    - CVE-2026-124194
    - CVE-2026-125350
    description: CVEs addressed in the November 2026 Patch Tuesday with known active
      exploitation.
    from:
      kind: article
      observed: '2026-11-12'
      ref: talos
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2026-11-12'
      ref: incident-response-policy
    type: number
  malware_hashes:
    default:
    - f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85
    - 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
    - ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694
    - f0f8ceed9d5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb
    - 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9
    description: Known hashes for VOLTA and NIK C2 implants.
    from:
      kind: article
      observed: '2026-11-12'
      ref: talos
    type: list[hash]
  scope_hosts:
    default: []
    description: Hostnames identified as vulnerable in the scoping step; leave empty
      to hunt across the entire estate.
    from:
      kind: manual
      observed: '2026-11-12'
      ref: hunt-analyst
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://blog.talosintelligence.com/never-be-afraid-to-ask-questions/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Start with devices identified in hb_vulnerability_finding. Note that hb_vulnerability_finding
  uses device_uid; analysts must resolve these to hostnames before populating the
  scope_hosts parameter for endpoint-surface queries.
references:
- name: "Talos \u2014 Never be afraid to ask questions"
  url: https://blog.talosintelligence.com/never-be-afraid-to-ask-questions/
related:
- hunt: lateral-movement-after-client-compromise
  reason: Once credentials are stolen by VOLTA/NIK, lateral movement using those credentials
    is the logical next stage.
  relation: follows
scenario:
  stages:
  - name: Zero-day client exploitation
    observables:
    - CVE-2026-124194
    - CVE-2026-125350
    - crafted HTML page targeting Chrome XML component
    - Spoofing within Microsoft Office Outlook
    slug: vulnerability-exploitation-outlook-chrome
    tactic: initial-access
    techniques:
    - T1190
  - name: Infostealer and C2 implant execution
    observables:
    - f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85.js
    - cca616647db9370c88998ae25da6997f.exe
    - ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694.exe
    - f_01b5ab.html
    - VOLTA infostealer
    - NIK C2 Windows implant
    slug: malware-implant-execution
    tactic: execution
    techniques:
    - T1059
  - name: AI-driven credential and keystroke theft
    observables:
    - LLM-based credential analysis
    - Dumping credentials from compromised sessions
    - Victim keystroke streaming
    - Automated generation of high-value dossiers from harvested data
    slug: automated-credential-theft
    tactic: credential-access
    techniques:
    - T1555
  - name: AI-enabled command and control
    observables:
    - NIK C2 framework communication
    - Integrated AI model data analysis within compromised sessions
    slug: ai-enabled-command-and-control
    tactic: command-and-control
    techniques:
    - T1071
  summary: Threat actors are exploiting zero-day vulnerabilities in Microsoft Outlook
    (CVE-2026-124194) and Google Chrome (CVE-2026-125350) to deliver AI-enhanced malware.
    Payloads such as the VOLTA infostealer and NIK C2 framework utilize large language
    models to automate the analysis of stolen credentials and keystrokes, significantly
    accelerating post-exploitation phases.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# AI-Enhanced Client Exploitation and Automated Credential Theft

This hunt targets the exploitation of CVE-2026-124194 and CVE-2026-125350, which allow remote attackers to execute code via crafted client-side content. Following initial access, the hunt looks for the VOLTA and NIK C2 implants, which use AI to prioritize stolen credentials and stream keystrokes. By correlating application crashes on vulnerable hosts with rare process launches and automated credential access, the hunt identifies successful compromises that traditional signatures might miss.

## scoping-vulnerable-inventory
<!-- Identify vulnerable hosts -->
Find devices currently missing patches for the actively exploited Outlook and Chrome CVEs.

```sqlite target=endpoint role=scoping params=(cve_ids=cve_ids)
~~~yaml
expected: A list of device UIDs that are susceptible to the zero-day exploits. This
  list is used to prioritize the behavioral search.
reads:
- cve_uid
- device_uid
- first_seen
- title
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_uid, cve_uid, title, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0
```

## early-stage-parallel
<!-- Gather early-stage evidence -->
parallel:
- → client-application-crashes
- → rare-binaries-and-known-hashes
join: → early-stage-triage

## client-application-crashes
<!-- Client application crashes -->
Find Access Violation (c0000005) errors in Outlook or Chrome, often indicating memory corruption during exploitation.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: A concentration of crashes on specific vulnerable hosts during the lookback
  period.
reads:
- app_name
- device_hostname
- exception_code
- message
- time
silence: not_evidence_of_absence
source: hb_application_error
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, app_name, exception_code, message, time FROM hb_application_error WHERE (LOWER(app_name) LIKE '%chrome.exe' OR LOWER(app_name) LIKE '%outlook.exe') AND exception_code = 'c0000005' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## rare-binaries-and-known-hashes
<!-- Rare binaries and known hashes -->
Stack-count rare processes launched from user-writable paths or matching known implant hashes.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, malware_hashes=malware_hashes)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Rare binaries appearing on a small number of hosts, potentially matching
  known malicious hashes.
prevalence:
  by: device_hostname
  key:
  - process_path
  - process_hash_sha256
  rare_below: 3
reads:
- device_hostname
- process_hash_sha256
- process_path
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT LOWER(process_path) AS path, process_hash_sha256, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\appdata\%' OR LOWER(process_path) LIKE '%\users\public\%' OR instr(',' || '{{malware_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path, process_hash_sha256 HAVING hosts <= 3 ORDER BY hosts ASC
```

## early-stage-triage
<!-- Early stage triage -->
```agent target=hunter
cite: required
context:
- scoping-vulnerable-inventory
- client-application-crashes
- rare-binaries-and-known-hashes
max_iterations: 3
objective: Identify hosts where a client-side crash was followed by the execution
  of a rare or malicious process.
success_criteria: A list of suspicious hosts with cited crash and process events.
tools:
- endpoint
```

## credential-access-activity
<!-- Credential access activity -->
Monitor for unauthorized access to sensitive credential stores (LSASS, SAM) typically targeted by NIK C2 and VOLTA.

```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Access events to LSASS or SAM by processes not expected to do so (excluding
  known AV/EDR).
reads:
- access_mask
- actor_process_name
- device_hostname
- object_name
- object_type
- time
silence: not_evidence_of_absence
source: hb_resource_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, actor_process_name, object_name, access_mask, time FROM hb_resource_activity WHERE (LOWER(object_name) LIKE '%lsass%' OR object_type = 'SAM_USER') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## follow-on-triage
<!-- Follow-on triage -->
```agent target=hunter
cite: required
context:
- early-stage-triage
- credential-access-activity
max_iterations: 5
objective: Determine if any host showing signs of exploitation has also engaged in
  automated credential theft.
success_criteria: A final malicious | suspicious | benign verdict per host.
tools:
- endpoint
```

## routing-decision
<!-- Route on verdict -->
if~: "the follow-on-triage verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → contain-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: no-agent-on-host)
else: → analyst-review

## contain-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host and initiate a full password reset for all accounts logged into this machine in the last 24 hours.
```
→ analyst-review

## analyst-review
<!-- Analyst review -->
```manual target=analyst
Review the cited crash events and credential access. Check for any outbound network connections to suspicious domains that weren't captured in the C2 list.
```
→ close-out

## close-out
<!-- Close out -->
```manual target=analyst
Record the vulnerable hosts that were successfully patched. Note any unmanaged devices that were identified as out-of-scope for the behavioral steps.
```
→ end