Attackers exploited a SQL injection vulnerability in an unvalidated autocomplete search field of a public-facing web application that communicated with an Oracle database over a JDBC connection. The compromised database account had sufficient privileges (at minimum CREATE PROCEDURE) to create Java schema objects. Attackers submitted Java source code via the CREATE JAVA SOURCE Oracle SQL statement, which Oracle's embedded JVM compiled and stored as schema objects — never writing a binary or executable to disk, evading most EDR products. The toolkit, tracked as 'khunt', consisted of six Java objects and several PL/SQL wrappers: KhuntCmd (executes OS commands via cmd.exe), KhuntHash (extracts Oracle user password hashes to a file), KhuntFS and KhuntFS2 (filesystem enumeration, read, search, size), KhuntT (connectivity check), and KhuntUnzip (archive extraction). Running KhuntCmd with 'cmd.exe /c whoami' returned SYSTEM-level access on the underlying Windows server. Post-exploitation activity included using PowerShell and reg.exe to copy SECURITY and SYSTEM registry hives to F:\Oracle, running tasklist /svc into khunttasks.txt, and copying SAM and SECURITY hives with esentutl.exe for credential harvesting. The technique is architecturally similar to Marco Ivaldi's raptor_oraexec.sql from 2006. The malicious requests originated from IP 178.162.151[.]229. Detection firing occurred on July 27, 2026 via credential-theft alerts.