Product

SecFlow

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 4, 2026 · last 5d ago

Timeline2 articles

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker NewsSep 10, 17:47 UTC · 5d agoIndustry in the wild

Chinese Hackers Use AI Agents in Multi

China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.

Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.

Security AffairsSep 4, 11:00 UTC · 11d agoThreat actor in the wild

Appears with

vendor Anthropic 2 ai model Qwen 2 vendor Alibaba 2 ai model DeepSeek 1 organization Hunt.io 1 organization Kuomintang 1 organization NCSC 1 product Claude Code 1 product GLUTTON 1 product Qwen 1 product Windows 11 1 vendor DeepSeek 1 vendor Gen Digital 1 vendor Hunt.io 1 vendor Microsoft 1 vendor NCSC 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.