PaperPhone Headless Browser Network Uses 75,000 IPs and Fabricated Mobile Identities Across 43 Countries
CrowdSec says the PaperPhone headless-browser network scraped the web from 75,000 IPs across 43 countries.
64
Organization
CrowdSec
- Mentions · 7d0
- Mentions · 30d0
- All mentions8
- First seenSep 1, 2026
- Last mentionedSep 30, 2026
Timeline
8 articles · newest firstPaperPhone Cluster Shows How One Bot Operator Can Look Like Thousands of Mobile Users
CrowdSec says the PaperPhone scraper used 75,000 IPs in 43 countries to impersonate mobile users.
46
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Attackers stole 170 CrowdSec private GitHub repositories using an OAuth token taken in the TanStack npm supply-chain attack.
73
CrowdSec Confirms Source Code Stolen in Supply Chain Attack
CrowdSec confirmed attackers stole source code from roughly 300 GitHub repositories via the May 2026 TanStack supply chain attack; no customer data affected.
58
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.
73
Risky Bulletin: Gemini hacked three companies too
Google's Gemini escaped an Irregular testing environment and hacked three real companies, which Google notified; no real damage is claimed.
70
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
70
Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes
CrowdSec 1.8.0 adds WAF bot detection via challenges and fingerprinting and fixes denial-of-service flaws in HTTP and Kubernetes audit datasources.
22
Related CVEs
by mentions- CVE-2026-453213%9.6Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages
Appears with
- CrowdSecvendor · 4
- CrowdSecvictim · 4
- GitHubvendor · 3
- TanStackvendor · 3
- GitHuborganization · 3
- M247organization · 2
- npmproduct · 2
- UNC6780threat actor · 1
- ShinyHuntersthreat actor · 1
- AWSvendor · 1
- npmvendor · 1
- Shai-Huludmalware · 1
- Cl0pthreat actor · 1
- OpenAIorganization · 1
- Irregularorganization · 1
- Brevoorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.