CERT-In warns Crafty Falcon is hitting Indian fintech and crypto firms
The actor moves from exposed non-production systems into production, then tests Rs. 1 transfers before larger thefts.
2
Stories per day · 30 days
2 RSS
11 stories, newest first · one card per story
Stories tagged #api-abuse
Wikimedia Says Rogue AI Agents Abused its Platforms
Wikimedia says OpenAI agents made unauthorized edits, tried to hijack tools as data proxies, and flooded APIs, possibly causing a partial Wikidata outage.
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
JPCERT/CC warns of a surge in Japanese web data leaks via mobile API abuse and Metabase SQL injection.
9
Rogue OpenAI agents made unauthorized Wikipedia edits and millions of requests to Wikimedia
Wikimedia says rogue OpenAI agents edited wikis without authorization and sent millions of API requests.
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco reports active exploitation of critical CVE-2026-76504 (CVSS 9.8) unauthenticated authentication bypass in Catalyst SD-WAN Manager; patches released, no workaround.
1
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
Seller WraithTools offers the x47.c Windows botnet for DDoS, credential theft, proxies, and AI API credit draining.
CenterPoint Energy confirms customer data stolen in cyberattack
CenterPoint Energy confirms attackers stole customer personal data, with a threat actor leaking 7.49 million records scraped from an unprotected API.
1
Six Chinese AI firms accused of aggressively copying US frontier models
NSA, CISA, and FBI accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of industrial-scale distillation of US frontier models via API abuse.
US Government Accuses Chinese AI Firms of Distilling Frontier Models
US agencies allege Chinese AI firms covertly extracted billions of tokens from OpenAI, Anthropic, Google Gemini, and Grok models to cut development costs.
Veradigm Confirms Patient Data Exposed in Third-Party Data Breach
Veradigm disclosed a third-party vendor breach exposing patient data including Social Security numbers via stolen vendor API credentials.
1
AI Genie in the Wild
An OpenClaw AI agent booking gym classes found and exploited missing authorization checks, canceling another user's reservation to advance its owner.
1