Search: “internet-traffic”

24 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 0 high 0 medium 1 low 1 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More

Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.

Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.

Palo Alto Unit 42Aug 17, 13:04 UTC · Aug 17, 2026Research

Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.

Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.

Palo Alto Unit 42Aug 17, 12:46 UTC · Aug 17, 2026Research

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.

Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.

Palo Alto Unit 42Aug 17, 12:47 UTC · Aug 17, 2026Research

Trends in Web Threats: Old Web Skimmer Still Active Today

Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.

Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.

Palo Alto Unit 42Aug 17, 13:05 UTC · Aug 17, 2026Research

DDoS attacks hit record scale as 1 Tbps+ campaigns become more common

Cloudflare's H1 2026 report shows record DDoS scale, with more 1 Tbps+ attacks, multi-vector campaigns, and hacktivist surges against governments.

Cloudflare's H1 2026 DDoS Threat Report documents record-scale attacks, with a significant increase in campaigns exceeding 1 Tbps and April 2026 peaking at 6.46 trillion requests and 165 PB. Most network-layer attacks stayed small and short — 96.62% under 500 Mbps and 90.60% under 10 minutes — but multi-vector campaigns combining HTTP floods with DNS and CLDAP amplification grew. Operation Epic Fury drove 149 hacktivist DDoS claims against 110 organizations in 16 countries, hitting the government sector hardest, and Brazil overtook the US as the leading attack source country.

Help Net SecurityAug 13, 00:00 UTC · Aug 13, 2026Threat actor in the wild

When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic

Research shows Model Context Protocol agent traffic structurally resembles C2 beaconing and evades Suricata signatures and RITA behavioral scoring in testbeds.

An arXiv study demonstrates that Model Context Protocol (MCP) JSON-RPC traffic over Streamable HTTP mimics the polling patterns of C2 frameworks like Cobalt Strike and is not flagged as anomalous by standard enterprise defenses. In a Docker testbed with eleven traffic profiles across three TLS conditions, Suricata with the Emerging Threats Open ruleset produced near-zero alerts and RITA assigned a consistent 0.0 beacon score, regardless of jitter or TLS inspection. The authors propose an agent-native network indication standard using Agent-Native ALPN and out-of-band headers.

arXiv cs.CRSep 16, 17:27 UTC · 11h agoResearch

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42Aug 17, 13:05 UTC · Aug 17, 2026Research

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42Aug 17, 12:45 UTC · Aug 17, 2026Research

Advanced URL Filtering Archives

Palo Alto Networks markets Advanced URL Filtering as combining a malicious URL database with real-time ML and DL web protection.

The Unit 42 blog page is a product category archive for Advanced URL Filtering. The product description states it combines a malicious URL database with a real-time web protection engine powered by machine learning and deep learning models. No research findings, incidents, or vulnerabilities are discussed.

Palo Alto Unit 42Sep 8, 14:27 UTC · 8d agoIndustry 6 sources

Analyzing a Go-Based IoT Self-Propagating DDoS Botnet

Akamai researchers published an analysis of a Go-based, self-propagating IoT botnet used for DDoS attacks.

Akamai's security research team published an analysis of a self-propagating DDoS botnet written in Go that targets IoT devices. Detailed technical findings were not available in the provided source text, which included only the title.

Akamai BlogSep 3, 06:00 UTC · 13d agoMalware in the wild

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security AffairsAug 12, 08:27 UTC · Aug 12, 2026Malware in the wild

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.

The Hacker NewsSep 2, 13:44 UTC · 14d agoThreat actor in the wild

Trends in Web Threats: Attackers Were More Active During Holiday Season

Unit 42 tracked 533,000 malicious landing URL incidents from October-December 2021, showing web threats peaked during the holiday shopping season.

Unit 42 detected 533,452 malicious landing URL incidents (120,753 unique) and 2,906,875 malicious host URL incidents (165,255 unique) from October through December 2021. Threat activity peaked in November, likely tied to Black Friday in the United States, United Kingdom, and Germany. Most malicious domains appeared to originate in the United States, followed by Russia and Germany. Personal sites, blogs, business sites, and shopping sites were the most common apparently benign entry points for attacks.

Palo Alto Unit 42Aug 17, 13:06 UTC · Aug 17, 2026Research

A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs

eBPF/XDP-based NIDS with Isolation Forest reaches 0.965 live F1 on DDoS replay; gRPC microservices match monolithic accuracy within 2ms overhead.

The paper presents a DDoS-focused network intrusion detection system for transport networks built with Ericsson, combining a statistical baseline with an Isolation Forest trained on flow features from GoFlowMeter, an open-source Go implementation of CICFlowMeter, plus eBPF/XDP kernel-level traffic filtering. On a Raspberry Pi 5 testbed replaying CIC-DDoS2019 as real traffic, the Isolation Forest achieves 0.965 recall/F1 live in the monolithic variant, catching low-volume attack windows the baseline misses. gRPC microservices nearly match monolithic accuracy adding under 2ms per window, while the Kafka pipeline trails by roughly nine percentage points and adds about 27ms.

arXiv cs.CRSep 11, 09:00 UTC · 5d agoResearch

NETSCOUT expands Adaptive DDoS Protection with outbound attack mitigation

NETSCOUT extended Adaptive DDoS Protection to detect and mitigate outbound DDoS traffic at source, targeting IoT botnet attacks like Turbo-Mirai.

NETSCOUT announced an extension of its Adaptive DDoS Protection (ADP) for service providers to automatically detect and mitigate outbound DDoS traffic from compromised subscriber devices such as broadband routers and IoT devices. The capability addresses Turbo-Mirai-class botnets capable of multi-terabit attacks and integrates with Arbor Sightline, Arbor Threat Mitigation System, the ATLAS Intelligence Feed, and ASERT analysts. Source-side mitigation aims to reduce outages, transit costs, peering damage, and abuse complaints at ISPs.

Help Net SecurityAug 18, 00:00 UTC · Aug 18, 2026Tools

Free streaming boxes may be routing criminal traffic through your home

Researchers found SuperBox streaming boxes and the CyberFlix TV app enroll home connections into the Popanet residential proxy network, routing criminal traffic.

Researchers found that SuperBox devices and the CyberFlix TV app, distributed through SuperBox's custom app store, contain Popanet proxy functionality that registers the device with servers controlled by the proxy operator, enrolling household connections into residential proxy networks. The reported configuration weakens Android safeguards with exposed ADB access, root-level privileges without authentication, and removal of app-install protections. Plume's research warns these proxy networks can also function as malware-delivery platforms, and the FBI notes foreign entities use residential proxies to conceal activity such as credential stuffing and account abuse. Malwarebytes advises disconnecting and replacing affected SuperBox/CyberFlix devices rather than factory-resetting them.

Malwarebytes LabsSep 4, 09:20 UTC · 12d agoMalware in the wild

Show HN: Check if your IP has appeared in a residential proxy network

Spur Intelligence launches Have I Been Proxied, a free tool that checks if your public IP appeared in residential proxy networks.

Have I Been Proxied is a free one-click web tool that checks whether a user's public IP has been observed routing traffic in residential proxy networks. Devices can be silently enrolled via apps, browser extensions, VPNs, or smart TVs, and the tool offers guidance on which apps and devices to investigate. It is powered by Spur Intelligence's network intelligence data, which serves fraud and trust teams detecting residential proxies, VPNs, and anonymization infrastructure.

Hacker News · securitySep 15, 14:24 UTC · 1d agoTools HN 20↑ · 10 comments

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.

Barracuda researchers analyzed a phishing campaign that generates a blob URL to render the phishing page entirely inside the victim's browser, leaving no static page for scanners to inspect. The chain begins with a Docusign-themed email containing a calendar invite, followed by a crafted redirect through Microsoft Teams to a resource on cdn.bloom[.]io that the browser converts into the blob URL. Service workers, iframes, and a hidden command-and-control configuration indicate the page is part of a centrally managed phishing platform that can be updated and steered across victims. Researchers recommend inspecting blob URL activity, monitoring OAuth authorization flows, and analyzing the full click path in email security controls.

SecurityWeekSep 9, 10:00 UTC · 7d agoPhishing & fraud in the wild

TCRF taken offline by DDoS attack after Claude user ban

The Cutting Room Floor game wiki was taken offline by a DDoS attack after a user leveraging Claude was banned.

The Cutting Room Floor (TCRF), a wiki documenting unused video game content, was knocked offline by a distributed denial-of-service attack. The attack reportedly followed moderation action banning a user who was using Anthropic's Claude. The incident highlights friction between community sites and AI-assisted users and tools.

Lobsters · securityAug 28, 21:26 UTC · 19d agoAI safety & security in the wild

ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign

Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.

Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.

Palo Alto Unit 42Aug 17, 12:48 UTC · Aug 17, 2026Phishing & fraud in the wild

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security found NVIDIA NemoClaw's Ollama binding to 0.0.0.0 enables DNS rebinding attacks that let attacker pages poison model chat templates with persistent hidden instructions.

Oasis Security disclosed that NVIDIA NemoClaw on Windows/WSL paths binds Ollama to 0.0.0.0:11434 without authentication, exposing the API to browser-based DNS rebinding attacks from malicious webpages. An attacker can then modify the model's chat template via /api/create, planting hidden instructions that run on every subsequent inference and persist across conversations, invisible to API consumers. NemoClaw v0.0.35 fixed the issue on macOS and Linux; no fix exists for Windows and WSL paths beyond a warning in v0.0.34. Ollama's own 2024 fix (CVE-2024-28224) added Host header validation, but it is skipped when bound to non-loopback addresses. No exploitation has been reported as of August 25, 2026.

The Hacker NewsAug 25, 15:58 UTC · 22d agoAI safety & security CVE-2024-282241

Conformal Prediction for Offensive Security

Researchers apply conformal prediction to offensive security, presenting initial findings on privacy-attacking machine learning and network traffic analysis.

The paper observes that conformal prediction (CP), introduced over 25 years ago, has been used mainly defensively in cybersecurity and rarely for offensive purposes. The authors present initial findings applying CP in two offensive areas: attacks on privacy-preserving machine learning and network traffic analysis. The work aims to close a gap in the offensive security literature rather than report an incident.

arXiv cs.CRSep 4, 14:07 UTC · 12d agoResearch

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business NewsAug 21, 02:55 UTC · 27d agoResearch2

Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks

Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.

Palo Alto Networks Unit 42 identified two activity clusters, CL-CRI-1131 and CL-CRI-1163, tied by shared SOCKS5 relay infrastructure and use of large language models during operations. The Mexican cluster targeted a transportation organization, federal ministries and water utilities in Mexico and Ecuador, while the Brazilian cluster used resume-themed phishing, custom remote-access Trojans and SockTz SOCKS5 tunneling against financial organizations. An exposed self-hosted NextChat interface on attacker infrastructure led researchers to assess operators used Claude and GPT-4.1 to generate workaround scripts and troubleshoot execution failures. Unit 42 noted AI reduced time needed to troubleshoot intrusions after initial access, rather than replacing the attacker.

Cyber Security NewsSep 10, 08:06 UTC · 6d agoThreat actor in the wild 2 sources1