GreyNoise details PaperCut campaign using hundreds of AI agents

GreyNoise described a campaign in which an attacker used hundreds of AI agents based on Codex and DeepSeek to exploit PaperCut NG/MF vulnerabilities. Since August 31, 2026, at least 440 PaperCut installations across 395 organizations in 48 countries were compromised, with credentials stolen from 280 victims.

• 11 organizations compromised within 26 seconds of campaign start
• 440 PaperCut installs at 395 organizations in 48 countries
• Credentials stolen from 280 victims, admin rights on 12
• About half of victims are schools and universities