Search: “traffic analysis”

6 stories in the last 24h

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AISep 16, 14:45 UTC · 21h agoPhishing & fraud in the wild

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.

Mandiant's September 2026 report describes an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider, then getting a poisoned package recommendation accepted and installing an infostealer via a malicious PyPI package. The attacker stole GitHub OAuth tokens, deployed the self-spreading Shai-Hulud worm across approximately 100 internal repositories, and stole repository secrets and product source code. Poisoning a package in the company's official namespace caused a second employee to pull the compromised version and become infected. Mandiant recommends verifying AI-recommended dependencies against checksums and allowlists, keeping secrets out of extension reach, and routing dependency traffic through internal repositories.

The Hacker NewsSep 16, 13:37 UTC · 23h agoData breach in the wild

Hackers reveal how Flock cameras really track cars and people

Hackers tore down a Flock Safety camera, dumped its storage, recovered an encryption key, and revealed its software detects people as well as vehicles.

Hackers from a collective calling itself stegan0gram removed a Flock Safety camera from service, made a near-complete copy of its storage, and recovered an encryption key stored on the device that unlocked thousands of vehicle-detection videos, sharing the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis of about 21 days of logs shows more than a million images, roughly 28 photos per passing vehicle, and Flock-built apps that detect people, bicycles, and even bumper stickers, while plate inference happens on Flock's servers. Flock had previously downplayed early-2025 root-access research by Jon Gaines, and records from Alpharetta, Georgia were searchable by over 2,000 agencies via Flock's national network.

Ars Technica · Security09:43 UTC · 2h agoData breach in the wild 4 sources

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated 07:55 UTC · 4h agofirst Sep 16, 15:27 UTC · 21h agoThreat actor in the wild 5 sources CVE-2020-0688 CVE-2019-0708 CVE-2021-26855+1 CVEs1

FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.

ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.

Cyber Security News11:20 UTC · 1h agoThreat actor in the wild 3 sources

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare BlogSep 16, 20:06 UTC · 16h agoMalware in the wild