PaperPhone Cluster Shows How One Bot Operator Can Look Like Thousands of Mobile Users
CrowdSec says the PaperPhone scraper used 75,000 IPs in 43 countries to impersonate mobile users.
46
Vendor
CrowdSec
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 1, 2026
- Last mentionedSep 30, 2026
Timeline
5 articles · newest firstCrowdSec Confirms Source Code Stolen in Supply Chain Attack
CrowdSec confirmed attackers stole source code from roughly 300 GitHub repositories via the May 2026 TanStack supply chain attack; no customer data affected.
58
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
70
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
CrowdSec says the TanStack npm supply chain attack let an attacker copy 170 private GitHub repos via a former employee's retained account.
74
Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes
CrowdSec 1.8.0 adds WAF bot detection via challenges and fingerprinting and fixes denial-of-service flaws in HTTP and Kubernetes audit datasources.
22
Related CVEs
by mentions- CVE-2026-453213%9.6Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages
Appears with
- CrowdSecorganization · 4
- TanStackvendor · 3
- CrowdSecvictim · 3
- GitHubvendor · 3
- AWSvendor · 2
- CrowdSec Security Engineproduct · 1
- PaperPhonemalware · 1
- Mistral AIvictim · 1
- npmvendor · 1
- TeamPCPvendor · 1
- OpenAIvictim · 1
- M247organization · 1
- GitHub OAuth tokenproduct · 1
- OpenAIvendor · 1
- CrowdSecproduct · 1
- Mistral AIvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.