SANS ISC Reports AI Credential Theft, Ollama Exploits, PaperCut Vulnerabilities, and New Terminal Fix Malware

On September 1st, 2026, Johannes Ullrich from the SANS Internet Storm Center reported on AI-related risks, including attackers stealing credentials for AI models and scanning for exposed instances like Ollama. A honeypot mimicking an Ollama endpoint revealed attackers redirecting users to fake models, enabling arbitrary command execution via supply chain attacks. Additionally, PaperCut exploitation continues with a public Metasploit module available, requiring emergency patches or disconnection from the internet as no final patch exists yet. Microsoft detailed a new malware called Terminal Fix, which starts as a ClickFix attack via fake Cloudflare CAPTCHAs, uses DLL side-loading, steganography in PNG files, and establishes a backdoor with a SOCKS proxy for network access.