[ { "id": "hk-kowloon-bay-deepfake-ring", "date": "2025-01-05", "title": "Hong Kong police arrest 31 in Kowloon Bay deepfake romance-crypto syndicate (HK$34M)", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "HK", "region": "Asia-Pacific", "target": "Dating-app users in Taiwan, Singapore, Malaysia and the US", "loss_usd": 4370000, "summary": "Hong Kong's Commercial Crime Bureau arrested 31 people in Kowloon Bay who used AI face-swapped personas on dating apps to lure overseas victims into fake crypto platforms, taking over HK$34 million (about $4.37M).", "source": "DL News", "url": "https://dlnews.com/articles/regulation/hong-kong-crime-ring-used-deepfakes-to-steal-millions", "actor": "Hong Kong-based romance-investment scam syndicate", "actor_type": "criminal", "attribution": "Hong Kong Police Force Commercial Crime Bureau; 14 people including the alleged mastermind were prosecuted for conspiracy to defraud by February 2026", "motive": "Financial gain through pig-butchering style crypto investment fraud", "vector": "AI-generated and face-swapped images and videos of attractive women used to build online relationships on dating platforms, then steering victims to a fake cryptocurrency trading platform; some deepfake video calls", "root_cause": "Cheap generative face-swap tools let recruits with no technical skill present convincing synthetic identities; cross-border victims had no way to verify personas", "timeline": [ { "date": "2024", "event": "Syndicate operates for over a year from two rented units in Kowloon Bay industrial buildings" }, { "date": "2025-01-05", "event": "Police announce arrests of 31 people aged 20 to 34 and seizure of about HK$100 million in suspected criminal assets" }, { "date": "2026-02-10", "event": "Police charge nine more suspects, bringing prosecutions to 14 including the alleged mastermind" } ], "impact": "Over HK$34 million (about $4.37 million) lost by victims mainly in Taiwan, Singapore, Malaysia and the United States; cash, luxury handbags and watches seized", "response": "Arrests, asset seizures, charges of conspiracy to defraud and dealing with proceeds of crime; police publicly described the face-swapping method to warn the public", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "DL News", "url": "https://dlnews.com/articles/regulation/hong-kong-crime-ring-used-deepfakes-to-steal-millions" }, { "name": "Cointelegraph", "url": "https://cointelegraph.com/news/global-crackdown-crypto-scams-ai-deepfake-fraud" }, { "name": "The Standard (Hong Kong)", "url": "https://www.thestandard.com.hk/news/article/324116/Police-charge-nine-more-in-34m-deepfake-crypto-scam" } ] }, { "id": "cybertruck-chatgpt-planning", "date": "2025-01-07", "title": "Las Vegas Cybertruck bomber used ChatGPT to plan explosion, police say", "category": "Prompt injection", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "Trump International Hotel, Las Vegas", "loss_usd": null, "summary": "Las Vegas police said Matthew Livelsberger, an active-duty soldier, used ChatGPT to research explosives and plan the 1 January 2025 Cybertruck blast that injured seven; OpenAI said its model gave only public information.", "source": "Las Vegas Metropolitan Police Department", "url": "https://krdo.com/news/2025/01/07/watch-live-las-vegas-metropolitan-police-give-updates-on-cybertruck-explosion/", "actor": "Matthew Livelsberger", "actor_type": "criminal", "attribution": "Identified by police from phone and vehicle evidence; deceased by self-inflicted gunshot", "motive": "Personal and political grievances described in a manifesto on his phone", "vector": "Queries to ChatGPT about explosives, ammunition and fireworks; vehicle loaded with mortars and fuel canisters", "root_cause": "General-purpose chatbot answered questions whose intent was not evident; safeguards did not prevent the planning", "timeline": [ { "date": "2025-01-01", "event": "Cybertruck explodes outside Trump International Hotel" }, { "date": "2025-01-07", "event": "Police release ChatGPT query details" } ], "impact": "Seven people injured; first widely cited case of a US attack planned with a consumer chatbot", "response": "OpenAI said it was cooperating with law enforcement and that its models refused harmful instructions and warned the user", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "KRDO", "url": "https://krdo.com/news/2025/01/07/watch-live-las-vegas-metropolitan-police-give-updates-on-cybertruck-explosion/" }, { "name": "KOAA", "url": "https://www.koaa.com/news/crime/new-details-on-matthew-livelsberger-man-who-blew-up-cybertruck-in-las-vegas" } ] }, { "id": "funksec-ai-assisted-ransomware", "date": "2025-01-10", "title": "Check Point: FunkSec ransomware group built its Rust encryptor with AI assistance", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "85+ organisations listed on FunkSec leak site", "loss_usd": null, "summary": "Check Point Research found that FunkSec, a RaaS group that claimed 85 victims in December 2024, likely developed its Rust encryptor and tooling with AI help, letting an inexperienced author iterate fast.", "source": "Check Point Research", "url": "https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/", "actor": "FunkSec (DesertStorm persona)", "actor_type": "criminal", "attribution": "Check Point Research assessed the developer is likely an inexperienced author based in Algeria, citing Ghost Algeria references and upload sources; Kaspersky later made similar AI-code observations.", "motive": "Financial extortion mixed with hacktivist posturing; ransom demands as low as 10,000 USD", "vector": "Double-extortion ransomware (FunkSec V1.5, Rust) plus Python DDoS tool, HVNC remote access tool and a password scraping tool, all showing AI-generated code traits", "root_cause": "Generative AI lowered the skill needed to produce a working encryptor; code had polished English comments while operators showed weak English, and the group ran its own Miniapps chatbot for malicious tasks", "timeline": [ { "date": "2024-12-01", "event": "FunkSec data leak site launches and lists 85 claimed victims within the month" }, { "date": "2025-01-10", "event": "Check Point Research publishes analysis calling the tooling likely AI-assisted" }, { "date": "2025-07-28", "event": "Kaspersky publishes its own FunkSec analysis noting LLM-style placeholder comments" } ], "impact": "More than 85 claimed victims in about a month, though Check Point judged real impact modest and noted many leaked datasets were recycled from earlier hacktivist leaks. V1.5 was detected by only 3 antivirus engines at upload.", "response": "Check Point published IOCs and detection guidance; the report flagged AI-assisted tooling as a sign that novices can produce functional ransomware quickly.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Check Point Research", "url": "https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/01/ai-driven-ransomware-funksec-targets-85.html" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/new-ransomware-group-uses-ai/" } ] }, { "id": "brasilia-marcos-mion-deepfake-vouchers", "date": "2025-01-16", "title": "Brasilia police bust group using Marcos Mion deepfakes to sell fake restaurant vouchers", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "BR", "region": "Latin America", "target": "Consumers in Brazil's Federal District; Marcos Mion", "loss_usd": null, "summary": "Brasilia civil police arrested at least three people who manipulated TV host Marcos Mion's image and voice to sell restaurant vouchers never delivered; a May 2025 second phase arrested the alleged site builder.", "source": "SBT News", "url": "https://sbtnews.sbt.com.br/noticia/policia/policia-prende-golpistas-que-usavam-deepfake-de-marcos-mion-na-internet", "actor": "Brasilia-based fraud group behind Operacao Voice Over", "actor_type": "criminal", "attribution": "PCDF identified a technology company used as a front; a 24-year-old in Santa Helena de Goias was arrested in May 2025 for building the fake sites.", "motive": "Low-value mass fraud through fake discount vouchers.", "vector": "Deepfake video ads on social media, automated payment pages and digital marketing tooling.", "root_cause": "Celebrity likeness cloning combined with paid ad distribution.", "timeline": [ { "date": "2025-01-16", "event": "PCDF serves warrants; three arrested in flagrante" }, { "date": "2025-05-01", "event": "Second phase of Operacao Voice Over arrests site developer in Goias" } ], "impact": "Dozens of victims in the Federal District; amounts not disclosed; two imported vehicles seized.", "response": "Charges of electronic fraud, criminal association and money laundering carrying up to 21 years.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "SBT News", "url": "https://sbtnews.sbt.com.br/noticia/policia/policia-prende-golpistas-que-usavam-deepfake-de-marcos-mion-na-internet" }, { "name": "Jornal Opcao", "url": "https://www.jornalopcao.com.br/ultimas-noticias/jovem-e-preso-em-goias-por-usar-deepfake-de-marcos-mion-em-golpes-com-sites-falsos-705126/" } ] }, { "id": "brazil-voiceover-mion-deepfake", "date": "2025-01-16", "title": "Brasilia police Operacao VoiceOver busts gang using Marcos Mion deepfakes for voucher scam", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "BR", "region": "Latin America", "target": "Brazilian consumers", "loss_usd": null, "summary": "The Policia Civil do Distrito Federal arrested three people aged 20 to 23 who used deepfake video and voice of TV host Marcos Mion in sponsored ads for fake Outback discount vouchers sold on cloned sites.", "source": "Policia Civil do Distrito Federal", "url": "https://www.portaltela.com/noticias/2025/01/16/policia-desarticula-quadrilha-que-usava-deepfake-de-marcos-mion-para-fraudes-digitais/", "actor": "Taguatinga-based fraud group", "actor_type": "criminal", "attribution": "PCDF cybercrime unit identified a group operating from a fake marketing office in Taguatinga; one suspect confessed.", "motive": "Payments for non-existent discount vouchers.", "vector": "Deepfake videos of Marcos Mion in paid social media ads directing victims to cloned sites that collected payments to gang-controlled accounts.", "root_cause": "Cheap deepfake tooling plus paid ad distribution of celebrity endorsements.", "timeline": [ { "date": "2025-01-10", "event": "27 complaints about fake Mion promotion received in four days" }, { "date": "2025-01-16", "event": "Operacao VoiceOver: three arrested, four search warrants served" }, { "date": "2025-05-07", "event": "Second phase: 24-year-old site builder arrested in Santa Helena de Goias" } ], "impact": "Dozens of victims; two imported vehicles and electronics seized; combined charges carry up to 21 years.", "response": "Arrests, account freezes and charges of electronic fraud, criminal association and money laundering.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Portal Tela (PCDF)", "url": "https://www.portaltela.com/noticias/2025/01/16/policia-desarticula-quadrilha-que-usava-deepfake-de-marcos-mion-para-fraudes-digitais/" }, { "name": "Jornal Opcao", "url": "https://www.jornalopcao.com.br/ultimas-noticias/jovem-e-preso-em-goias-por-usar-deepfake-de-marcos-mion-em-golpes-com-sites-falsos-705126/" }, { "name": "SBT News", "url": "https://sbtnews.sbt.com.br/noticia/policia/hacker-e-preso-suspeito-de-usar-inteligencia-artificial-em-golpes-com-imagens-de-famosos" } ] }, { "id": "brad-pitt-ai-romance-scam-france", "date": "2025-01-17", "title": "French woman loses 830,000 euros to AI-generated 'Brad Pitt' romance scam; probe opened", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "FR", "region": "Europe", "target": "Private individual (53-year-old interior designer)", "loss_usd": 855000, "summary": "A French woman sent about 830,000 euros (about $855,000) over 18 months to scammers using AI-generated images of Brad Pitt, including fake hospital selfies; police in La Reunion opened a probe after her complaint.", "source": "AFP via Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/leisure/2025/01/17/france-launches-probe-into-ai-brad-pitt-scam", "actor": "Three men in their 20s reportedly based in Nigeria (per Le Parisien)", "actor_type": "criminal", "attribution": "Unidentified; a scam-tracing consultant cited by Le Parisien pointed to Nigeria-based operators, not confirmed by police", "motive": "Financial gain through romance fraud", "vector": "Fake social media and WhatsApp accounts posing as Brad Pitt and his mother; AI-generated selfies and images of the actor in hospital beds used as proof of identity and need for money", "root_cause": "Generative image tools made impersonation convincing; emotional manipulation over a prolonged period with no independent identity verification", "timeline": [ { "date": "2023", "event": "Victim first contacted by someone claiming to be Brad Pitt's mother; relationship develops online" }, { "date": "2024", "event": "Victim sends most of her 775,000 euro divorce settlement after claims of frozen accounts and kidney treatment" }, { "date": "2025-01-12", "event": "Victim tells her story on TF1; broadcast later withdrawn after online harassment" }, { "date": "2025-01-17", "event": "Police in La Reunion open probe to trace the receiving accounts" } ], "impact": "About 830,000 euros lost; the case became a global reference for AI-enabled celebrity romance fraud and prompted a statement from Pitt's representatives", "response": "Criminal complaint filed and investigation opened in La Reunion; Pitt's spokesperson warned fans about unsolicited outreach", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "AFP via Free Malaysia Today", "url": "https://www.freemalaysiatoday.com/category/leisure/2025/01/17/france-launches-probe-into-ai-brad-pitt-scam" }, { "name": "Global News", "url": "https://globalnews.ca/news/10959758/brad-pitt-scam" } ] }, { "id": "ghostgpt-criminal-chatbot", "date": "2025-01-23", "title": "GhostGPT: uncensored chatbot sold on Telegram to write malware and phishing for criminals", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Businesses targeted by phishing and BEC", "loss_usd": null, "summary": "Abnormal Security documented GhostGPT, a jailbroken LLM wrapper sold via Telegram with a no-logs claim, that produced a convincing DocuSign phishing email on request and is marketed for malware and exploit work.", "source": "Abnormal AI", "url": "https://abnormal.ai/blog/ghostgpt-uncensored-ai-chatbot", "actor": "Unknown", "actor_type": "criminal", "attribution": "Abnormal Security researchers identified the service on underground forums; operator identity not established.", "motive": "Selling uncensored AI access to cybercriminals for profit", "vector": "Telegram-delivered chatbot, likely a wrapper around a jailbroken commercial or open-source model, with guardrails removed", "root_cause": "Commercial LLM guardrails can be bypassed by wrapper services, giving low-skill actors ready-made phishing and malware generation", "timeline": [ { "date": "2024-11-01", "event": "GhostGPT advertisements accumulate thousands of views on cybercrime forums" }, { "date": "2025-01-23", "event": "Abnormal Security publishes analysis after testing the tool with a DocuSign phishing request" } ], "impact": "Forum posts with thousands of views indicated real criminal demand; the tool lowered the barrier for BEC and phishing lures with no jailbreak skills needed.", "response": "Abnormal published indicators and warned defenders; no takedown reported.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Abnormal AI", "url": "https://abnormal.ai/blog/ghostgpt-uncensored-ai-chatbot" }, { "name": "TechRepublic", "url": "https://www.techrepublic.com/article/what-is-ghostgpt/" }, { "name": "Security Boulevard", "url": "https://securityboulevard.com/2025/01/ghostgpt-a-malicious-ai-chatbot-for-hackers" } ] }, { "id": "storm-1516-bundestag-deepfakes", "date": "2025-01-23", "title": "Storm-1516 floods German election with 100+ AI-written fake news sites and deepfakes", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "DE", "region": "Europe", "target": "German Bundestag election candidates and voters", "loss_usd": null, "summary": "CORRECTIV and NewsGuard exposed a Russian network of more than 100 German-language fake news sites filled with LLM-rewritten articles and deepfake videos smearing Habeck, Baerbock and Faber before the February 2025 vote.", "source": "CORRECTIV", "url": "https://correctiv.org/faktencheck/russische-desinformation/2025/01/23/angriff-aus-russland-auf-bundestageswahl-deepfake-ki/", "actor": "Storm-1516 (John Mark Dougan network)", "actor_type": "state", "attribution": "Linked by researchers to Moscow-based former US officer John Mark Dougan and to the GRU; the German government formally blamed Russia and summoned its ambassador in December 2025.", "motive": "Undermine trust in pro-Ukraine candidates and influence the Bundestag election.", "vector": "Domains registered in waves from November 2024, LLM-rewritten articles, fake whistleblower videos including a face-swap deepfake of FDP politician Marcus Faber, amplified by pro-Russian influencers.", "root_cause": "Low cost of LLM content generation and deepfake tooling let a small team run a large synthetic media network ahead of a snap election.", "timeline": [ { "date": "2024-11-19", "event": "First wave of German-language fake news domains registered" }, { "date": "2025-01-23", "event": "CORRECTIV publishes investigation listing 102 Storm-1516 domains" }, { "date": "2025-02-23", "event": "Bundestag election held" }, { "date": "2025-12-12", "event": "German Foreign Office summons Russian ambassador over Storm-1516 interference" } ], "impact": "Fabricated abuse and espionage claims against leading candidates circulated on social media; most individual fakes did not go viral but the network persisted into 2026 state elections.", "response": "Media fact-checks and domain exposure; German authorities confirmed the operation and summoned Russia's ambassador; Storm-1516 videos reappeared during the 2026 Mecklenburg-Vorpommern vote.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "CORRECTIV", "url": "https://correctiv.org/faktencheck/russische-desinformation/2025/01/23/angriff-aus-russland-auf-bundestageswahl-deepfake-ki/" }, { "name": "CORRECTIV", "url": "https://correctiv.org/aktuelles/hybride-kriegsfuehrung/2025/12/12/russlands-botschafter-einbestellt-behoerden-bestaetigen-correctiv-recherche-zu-einflussoperation/" }, { "name": "ZDFheute", "url": "https://www.zdfheute.de/politik/deutschland/faktencheck-manipulierte-stimmzettel-wahl-mecklenburg-vorpommern-100.html" } ] }, { "id": "indonesia-prabowo-deepfake-aid-scam", "date": "2025-01-24", "title": "Indonesian police arrest two over deepfake videos of President Prabowo promising cash aid", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "ID", "region": "Asia-Pacific", "target": "Indonesian social media users across 20 provinces", "loss_usd": 5800, "summary": "Indonesian police arrested suspects AMA and JS for spreading AI videos of President Prabowo, VP Gibran and Minister Sri Mulyani offering aid for admin fees; about Rp 95 million (about $5,800) taken from 100-plus victims.", "source": "Indonesian National Police (INP)", "url": "https://inp.polri.go.id/artikel/inp-arrests-suspect-behind-deepfake-scams-impersonating-officials", "actor": "AMA (29) and JS (25), Indonesian nationals", "actor_type": "criminal", "attribution": "Arrested and charged by the Cyber Crime Directorate of Indonesia's National Police Criminal Investigation Agency; case files handed to prosecutors in April 2025", "motive": "Financial gain by collecting fake administrative fees from aid seekers", "vector": "Deepfake videos of state officials posted on TikTok and Instagram with a WhatsApp number; victims told to pay administrative fees to receive non-existent government funds", "root_cause": "Free generative video tools and reuse of official footage; victims trusted apparent presidential announcements on social media", "timeline": [ { "date": "2025-01-16", "event": "Suspect AMA arrested in Central Lampung; 11 victims over four months, about Rp 30 million taken" }, { "date": "2025-02-07", "event": "Second suspect JS arrested; police say about 100 victims in 20 provinces and Rp 65 million in profit" }, { "date": "2025-04-24", "event": "Bareskrim hands both case files to prosecutors; separate arrests over a deepfake of East Java governor Khofifah" } ], "impact": "Over 100 victims defrauded of roughly Rp 95 million in total; AFP fact-checkers found similar videos still circulating after the arrests", "response": "Arrests under the Electronic Information and Transactions Law and Criminal Code; cases referred to prosecution; public warnings issued", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Indonesian National Police", "url": "https://inp.polri.go.id/artikel/inp-arrests-suspect-behind-deepfake-scams-impersonating-officials" }, { "name": "Indonesian National Police (second arrest)", "url": "https://inp.polri.go.id/artikel/deep-fake-scammers-with-profit-of-idr-65-million-arrested-by-the-police" }, { "name": "OECD.AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2025-04-24-4595" } ] }, { "id": "deepseek-ddos-registration-halt", "date": "2025-01-28", "title": "DeepSeek halts new sign-ups after month-long DDoS and brute-force campaign peaks", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "CN", "region": "Asia-Pacific", "target": "DeepSeek chat and API services", "loss_usd": null, "summary": "DeepSeek said its services were under large-scale malicious attack on 28 January 2025 and limited sign-ups to Chinese mobile numbers; Qi An Xin XLab traced a month of escalating DDoS and brute-force traffic.", "source": "The Paper (澎湃新闻)", "url": "https://www.thepaper.cn/newsDetail_forward_30058949", "actor": "Unknown", "actor_type": "unknown", "attribution": "Qi An Xin XLab said attack and brute-force IPs were located in the United States; no group was named and DeepSeek did not attribute the attack.", "motive": "Unknown; analysts suggested disruption of the newly popular R1 service.", "vector": "Three phases: HTTP proxy floods from 3 January, SSDP and NTP reflection amplification from 20 January, then application-layer HTTP proxy attacks and password brute-forcing peaking 27 to 28 January.", "root_cause": "Sudden global demand for DeepSeek R1 outpaced the startup's DDoS mitigation and account-protection capacity.", "timeline": [ { "date": "2025-01-03", "event": "XLab observes first suspected HTTP proxy attacks against DeepSeek" }, { "date": "2025-01-27", "event": "Application-layer attacks surge; DeepSeek reports degraded web and API performance" }, { "date": "2025-01-28", "event": "DeepSeek status page cites large-scale malicious attack and restricts registration to +86 numbers" }, { "date": "2025-01-29", "event": "The Paper publishes Qi An Xin XLab analysis of the three attack phases" } ], "impact": "Hours of outages and degraded API performance for users worldwide; new registrations blocked for non-Chinese phone numbers; existing users could still log in.", "response": "DeepSeek switched IP addresses at 00:58 on 28 January, restricted sign-ups and restored service in stages; no user-data theft was confirmed.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Paper (澎湃新闻)", "url": "https://www.thepaper.cn/newsDetail_forward_30058949" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/deepseek-halts-new-signups-amid-large-scale-cyberattack" }, { "name": "GIGAZINE", "url": "https://gigazine.net/gsc_news/en/20250128-deepseek-large-scale-cyber-attack" } ] }, { "id": "deepseeek-pypi-packages", "date": "2025-01-29", "title": "Fake 'deepseeek' and 'deepseekai' PyPI packages steal secrets from DeepSeek developers", "category": "AI supply chain", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Developers integrating the DeepSeek API", "loss_usd": null, "summary": "Two PyPI packages posing as DeepSeek client libraries harvested user, host and environment-variable data to a Pipedream endpoint; they were pulled within an hour after a few hundred downloads.", "source": "Positive Technologies PT ESC", "url": "https://global.ptsecurity.com/research/pt-esc-threat-intelligence/malicious-packages-deepseeek-and-deepseekai-published-in-python-package-index", "actor": "PyPI account 'bvk'", "actor_type": "criminal", "attribution": "Uploaded by the dormant PyPI account 'bvk' created in June 2023; PT ESC noted code comments suggesting the payload was written with an AI assistant. No further attribution.", "motive": "Theft of API keys, cloud and database credentials stored in developer environment variables", "vector": "Typosquatted PyPI packages riding DeepSeek hype; payload ran when the deepseeek or deepseekai CLI commands were executed and exfiltrated via Pipedream", "root_cause": "Open package registry with no vetting of trending-name lookalikes; developers installing unofficial SDKs for a newly popular model", "timeline": [ { "date": "2025-01-29", "event": "deepseeek 0.0.8 published at 15:52 UTC and deepseekai 0.0.8 at 16:13 UTC" }, { "date": "2025-01-29", "event": "PT ESC detects the packages within minutes and alerts PyPI, which removes them" }, { "date": "2025-02-03", "event": "PT ESC publishes analysis; press reports over 200 downloads, more than 100 from the United States" } ], "impact": "PT counted 36 downloads via pip and bandersnatch plus 186 via browsers and other tools before removal; any victim's environment variables and host details were sent to the attacker", "response": "PyPI administrators deleted both packages within about an hour of notification; PT ESC published indicators and advised victims to rotate exposed credentials", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Positive Technologies PT ESC", "url": "https://global.ptsecurity.com/research/pt-esc-threat-intelligence/malicious-packages-deepseeek-and-deepseekai-published-in-python-package-index" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/developers-targeted-with-malware-disguised-as-deepseek-package/" }, { "name": "Help Net Security", "url": "https://www.helpnetsecurity.com/2025/02/03/deepseeks-popularity-exploited-to-push-malicious-packages-via-pypi/" } ] }, { "id": "deepseek-db-exposure", "date": "2025-01-29", "title": "DeepSeek leaves ClickHouse database with chat logs and API secrets open", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "CN", "region": "Asia-Pacific", "target": "DeepSeek", "loss_usd": null, "summary": "Wiz found a publicly reachable DeepSeek ClickHouse database exposing over a million log lines including user chat history, API secrets and backend details; it was locked down after disclosure.", "source": "Wiz Research", "url": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak", "actor": "Misconfiguration by DeepSeek; found by Wiz Research (responsible disclosure)", "actor_type": "accident", "attribution": "Self-evident misconfiguration; discovered and disclosed by Wiz Research, which notified DeepSeek before publishing", "motive": "None (accidental exposure); Wiz motive was security research", "vector": "Unauthenticated ClickHouse database reachable on ports 8123 and 9000 at oauth2callback.deepseek.com and dev.deepseek.com, queried via the HTTP interface", "root_cause": "Internal ClickHouse log database deployed with no authentication and exposed to the public internet; sensitive data (chat history, API keys) written to plaintext logs", "timeline": [ { "date": "2025-01-06", "event": "Oldest entries in the exposed log_stream table are dated from this day" }, { "date": "2025-01", "event": "Wiz Research finds the open database within minutes while assessing DeepSeek's external attack surface" }, { "date": "2025-01-29", "event": "Wiz publishes findings after DeepSeek promptly locks down the database following disclosure" }, { "date": "2025-01-30", "event": "Wide press coverage (BleepingComputer, Fortune) amid scrutiny of DeepSeek's security and privacy posture" } ], "impact": "Over one million log lines exposed: user chat history, API secret keys, backend details and operational metadata; Wiz said an attacker could have taken full control of the database and potentially escalated privileges", "response": "DeepSeek secured the database promptly after Wiz's disclosure; no public statement from DeepSeek on whether anyone else accessed the data", "status": "resolved", "cve": null, "sources": [ { "name": "Wiz Research", "url": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/deepseek-ai-exposed-databases-with-user-chat-history-api-keys/" }, { "name": "Fortune", "url": "https://fortune.com/2025/01/31/deepseek-sensitive-information-exposed-wiz-researchers" } ] }, { "id": "openai-deepseek-distillation", "date": "2025-01-29", "title": "OpenAI says it has evidence DeepSeek distilled its models through blocked API accounts", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "CN", "region": "Asia-Pacific", "target": "OpenAI models (via API)", "loss_usd": null, "summary": "OpenAI told the Financial Times it found signs DeepSeek used its outputs to train a rival in breach of its terms; Microsoft reportedly saw accounts pulling large data volumes via the API and blocked them. No proof shown.", "source": "Financial Times / Bloomberg", "url": "https://www.eweek.com/news/openai-accuses-deepseek/", "actor": "DeepSeek (alleged)", "actor_type": "unknown", "attribution": "Alleged by OpenAI and reported via anonymous Microsoft sources; DeepSeek did not respond; evidence not published", "motive": "Alleged low-cost model training via distillation", "vector": "High-volume API queries from accounts later attributed to DeepSeek", "root_cause": "Model outputs available via API can be used as training data in breach of terms of service", "timeline": [ { "date": "2024-10", "event": "Microsoft security reportedly notices unusual API extraction" }, { "date": "2025-01-29", "event": "OpenAI tells the FT it has evidence of distillation" }, { "date": "2025-01-29", "event": "White House adviser David Sacks says there is substantial evidence" } ], "impact": "Unknown; dispute over intellectual property and terms of service", "response": "OpenAI and Microsoft blocked suspected accounts; OpenAI said it was working with the US government", "status": "unresolved", "cve": null, "verification": "disputed", "sources": [ { "name": "eWeek", "url": "https://www.eweek.com/news/openai-accuses-deepseek/" }, { "name": "Computing", "url": "https://computing.co.uk/news/2025/ai/openai-deepseek-stealing-ip" }, { "name": "The Decoder", "url": "https://the-decoder.com/?p=20884" } ] }, { "id": "thailand-poipet-ai-police-scam", "date": "2025-02-04", "title": "Thai police arrest two from Poipet gang using AI face-altering to pose as police", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "TH", "region": "Asia-Pacific", "target": "Thai residents including beauty queen Charlotte Austin", "loss_usd": 118000, "summary": "Thai police arrested two members of a Poipet, Cambodia call centre that used AI to alter faces on video calls while posing as police; 163 victims, including Charlotte Austin who lost 4 million baht (about $118,000).", "source": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/2953450/two-men-arrested-for-alleged-b4m-ai-aided-scam-against-beauty-queen", "actor": "Poipet-based call-centre gang run by Chinese leaders with Thai members", "actor_type": "criminal", "attribution": "Thai police arrested Ramil Pantawong and Thanawut Kanyaphan as alleged gang members; scripts said to come from Chinese gang leaders in Cambodia", "motive": "Financial gain through law-enforcement impersonation fraud", "vector": "Video calls in which scammers used AI face-altering tools to appear as uniformed Thai police officers, telling victims they were under investigation and must transfer funds", "root_cause": "Real-time AI face manipulation defeated victims' visual verification of officials; cross-border scam compounds beyond Thai jurisdiction", "timeline": [ { "date": "2025-01", "event": "Charlotte Austin transfers 4 million baht after video calls with fake police officers" }, { "date": "2025-02-04", "event": "Thai police announce two arrests and identify at least 163 victims of the Poipet gang" } ], "impact": "At least 163 victims; the most prominent lost about 4 million baht; total losses not published", "response": "Two arrests in Thailand; investigation into the Cambodia-based operation continued", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/2953450/two-men-arrested-for-alleged-b4m-ai-aided-scam-against-beauty-queen" }, { "name": "South China Morning Post", "url": "https://www.scmp.com/week-asia/people/article/3297396/ai-assisted-scam-costs-thai-beauty-queen-us118000-two-arrested" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/918/" } ] }, { "id": "mexico-condusef-voice-clone-alert", "date": "2025-02-06", "title": "Mexico's Condusef warns of AI voice-cloning calls used to request large bank transfers", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "MX", "region": "Latin America", "target": "Mexican bank customers", "loss_usd": null, "summary": "Financial consumer regulator Condusef alerted the public that fraudsters were using AI to clone familiar voices in phone calls, typically to request large bank transfers, and linked it to a parallel WhatsApp scam.", "source": "Condusef via Posta", "url": "https://www.posta.com.mx/share/condusef-alerta-sobre-fraude-de-clonacion-de-voz-con-inteligencia-artificial/vl1753226", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Fraudulent bank transfers.", "vector": "Phone calls using AI-cloned voices of relatives or acquaintances.", "root_cause": "Voice samples available from social media and messaging.", "timeline": [ { "date": "2025-01-14", "event": "Condusef warns of WhatsApp fraud using AI-generated voice notes" }, { "date": "2025-02-06", "event": "Condusef publishes voice-cloning phone fraud alert" } ], "impact": "No case counts or losses published.", "response": "Public awareness alert.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Posta (citing Condusef)", "url": "https://www.posta.com.mx/share/condusef-alerta-sobre-fraude-de-clonacion-de-voz-con-inteligencia-artificial/vl1753226" }, { "name": "Record", "url": "https://www.record.com.mx/contra/condusef-alerta-por-clonacion-de-voz-con-ia-que-suplanta-tus-familiares" } ] }, { "id": "nullifai-hugging-face-pickle", "date": "2025-02-06", "title": "nullifAI: broken-pickle models on Hugging Face evade Picklescan and carry reverse shells", "category": "AI supply chain", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Hugging Face Hub users loading PyTorch models", "loss_usd": null, "summary": "ReversingLabs found two Hugging Face models whose 7z-compressed, deliberately corrupted pickle streams hid a reverse shell to a hard-coded IP while passing Hugging Face's Picklescan checks.", "source": "ReversingLabs", "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face", "actor": "Unknown", "actor_type": "unknown", "attribution": "Uploaded by accounts glockr1 and who-r-u0000; ReversingLabs assessed the models as closer to a proof of concept than an active campaign and did not attribute them", "motive": "Unknown; payload gave remote shell access to any machine that deserialised the model", "vector": "PyTorch model files packed with 7z instead of ZIP and a pickle stream broken after the malicious opcodes, so scanners errored out before flagging the embedded reverse shell", "root_cause": "Pickle deserialisation executes arbitrary code by design; Picklescan stopped analysing on malformed streams and did not recognise non-ZIP archives", "timeline": [ { "date": "2025-01-20", "event": "ReversingLabs reports the two malicious repositories to Hugging Face" }, { "date": "2025-01-21", "event": "Hugging Face removes the models within 24 hours and updates Picklescan to handle broken pickle files" }, { "date": "2025-02-06", "event": "ReversingLabs publishes the nullifAI technique write-up with indicators of compromise" } ], "impact": "Two models with a platform-aware reverse shell to 107.173.7.141 were publicly hosted and undetected by Picklescan, ProtectAI and ClamAV scanning; no confirmed victims", "response": "Hugging Face removed the repositories and patched Picklescan; ReversingLabs published IOCs and urged use of safetensors over pickle-based formats", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "ReversingLabs", "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/02/malicious-ml-models-found-on-hugging.html" }, { "name": "Help Net Security", "url": "https://www.helpnetsecurity.com/2025/02/10/malicious-ml-models-found-on-hugging-face-hub/" } ] }, { "id": "sysdig-llmjacking-deepseek", "date": "2025-02-07", "title": "LLMjacking crews load stolen DeepSeek keys into reverse proxies days after model launch", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Cloud and AI API account holders (OpenAI, AWS, Azure)", "loss_usd": null, "summary": "Sysdig found over 20 reverse proxies running on stolen credentials; one held 55 DeepSeek keys, another burned 2.2 billion tokens worth tens of thousands of dollars in 4.5 days and resold access for 30 USD a month.", "source": "Sysdig Threat Research Team", "url": "https://www.sysdig.com/blog/llmjacking-targets-deepseek", "actor": "Unknown", "actor_type": "criminal", "attribution": "Sysdig TRT observed operators sharing access on Rentry and 4chan and hiding behind TryCloudflare tunnels; individuals not identified.", "motive": "Avoiding LLM costs and reselling model access", "vector": "Credentials stolen from vulnerable services such as Laravel or scraped from public repositories, verified by scripts and loaded into ORP proxies", "root_cause": "Leaked long-lived API keys with no usage caps; proxies made abuse look like legitimate traffic", "timeline": [ { "date": "2024-12-26", "event": "DeepSeek-V3 released; support appears in an ORP within days" }, { "date": "2025-01-21", "event": "DeepSeek-R1 added to proxies the day after its release" }, { "date": "2025-02-07", "event": "Sysdig publishes findings on DeepSeek-focused LLMjacking" } ], "impact": "One sampled proxy showed 132,651 prompts and 2.213 billion tokens, estimated at roughly 49,596 USD of victim spend in 4.5 days; Claude 3 Opus alone accounted for an estimated 38,951 USD.", "response": "Sysdig published indicators and urged key rotation, usage limits and secret scanning; affected providers were notified.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Sysdig", "url": "https://www.sysdig.com/blog/llmjacking-targets-deepseek" }, { "name": "SecurityBrief", "url": "https://securitybrief.co.uk/story/llmjacking-exploits-target-ai-models-like-deepseek-experts-warn" } ] }, { "id": "omnigpt-alleged-breach", "date": "2025-02-09", "title": "Hacker 'Gloomer' claims OmniGPT breach leaking 34M chat lines and 30K user contacts", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "OmniGPT (multi-model AI chat aggregator)", "loss_usd": null, "summary": "A BreachForums user posted data allegedly taken from OmniGPT: about 34 million lines of user-chatbot conversations, emails and phone numbers of roughly 30,000 users and links to uploaded files containing API keys and credentials.", "source": "CyberInsider", "url": "https://cyberinsider.com/omnigpt-allegedly-breached-34-million-user-messages-leaked/", "actor": "Gloomer (BreachForums persona)", "actor_type": "criminal", "attribution": "Self-claimed by the forum user Gloomer; OmniGPT did not confirm or deny the breach and no independent verification was published", "motive": "Sale and leak of user data for profit and notoriety", "vector": "Unknown; the actor did not disclose how OmniGPT's backend was accessed", "root_cause": "Unknown; researchers noted that, if genuine, the dump would point to weak authentication and data protection on the platform", "timeline": [ { "date": "2025-01-27", "event": "KrakenLabs flags an actor offering OmniGPT data for sale for about 100 dollars" }, { "date": "2025-02-09", "event": "Dataset posted on BreachForums under the Gloomer alias" }, { "date": "2025-02-13", "event": "CyberInsider and SiliconANGLE report the claims; OmniGPT makes no public statement" } ], "impact": "If authentic, 34,270,455 lines of conversations plus contact details for about 30,000 users and uploaded files holding API keys, credentials and billing data were exposed", "response": "No public statement from OmniGPT at the time of reporting; outlets advised users to reset passwords, revoke API keys and enable MFA", "status": "unresolved", "cve": null, "verification": "reported", "sources": [ { "name": "CyberInsider", "url": "https://cyberinsider.com/omnigpt-allegedly-breached-34-million-user-messages-leaked/" }, { "name": "SiliconANGLE", "url": "https://siliconangle.com/2025/02/12/ai-aggregator-omnigpt-reportedly-breached-sensitive-user-data-leaked-online/" }, { "name": "SecureWorld", "url": "https://www.secureworld.io/industry-news/omnigpt-massive-data-breach" } ] }, { "id": "omnigpt-breach-claim", "date": "2025-02-09", "title": "Hacker claims OmniGPT breach exposing 34 million chat messages and 30,000 user emails", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "OmniGPT AI chatbot aggregator", "loss_usd": null, "summary": "A BreachForums user named Gloomer posted samples allegedly taken from OmniGPT: over 34 million lines of user-chatbot conversations, around 30,000 emails with some phone numbers, file links and credentials. Unconfirmed.", "source": "KrakenLabs / Hackread", "url": "https://cyberinsider.com/omnigpt-allegedly-breached-34-million-user-messages-leaked/", "actor": "Gloomer (BreachForums poster)", "actor_type": "criminal", "attribution": "Self-claimed by the poster; samples reviewed by researchers but not verified by the vendor", "motive": "Data sale and notoriety", "vector": "Unknown; attacker claimed access to backend message store and user tables", "root_cause": "Unknown", "timeline": [ { "date": "2025-02-09", "event": "Data samples posted on BreachForums" }, { "date": "2025-02-12", "event": "Wide press coverage; OmniGPT silent" } ], "impact": "Alleged exposure of millions of private AI conversations, uploaded documents, API keys and crypto keys", "response": "No public statement from OmniGPT found", "status": "unresolved", "cve": null, "verification": "reported", "sources": [ { "name": "CyberInsider", "url": "https://cyberinsider.com/omnigpt-allegedly-breached-34-million-user-messages-leaked/" }, { "name": "SiliconANGLE", "url": "https://siliconangle.com/2025/02/12/ai-aggregator-omnigpt-reportedly-breached-sensitive-user-data-leaked-online/" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/3822911/hacker-allegedly-puts-massive-omnigpt-breach-data-for-sale-on-the-dark-web.html" } ] }, { "id": "vidoc-deepfake-job-candidates", "date": "2025-02-11", "title": "Vidoc Security Lab catches two deepfake job applicants in live video interviews", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Vidoc Security Lab (hiring developers in Poland)", "loss_usd": null, "summary": "Vidoc co-founder Dawid Moczadlo exposed two applicants using real-time face filters and ChatGPT-style answers in interviews; one refused to pass a hand over his face. Vidoc suspects a DPRK-style fake IT worker scheme.", "source": "The Register", "url": "https://www.theregister.com/2025/02/11/it_worker_scam", "actor": "Unknown", "actor_type": "unknown", "attribution": "Vidoc suspects a fake IT worker scheme similar to those linked to North Korea; no confirmed attribution", "motive": "Obtain remote employment under a false identity, likely for revenue or access", "vector": "Fabricated LinkedIn profiles and CVs with Polish and Serbian identities; live AI face filter on video calls; lagging, scripted answers", "root_cause": "Remote hiring relies on video calls that real-time deepfake filters can defeat; identity checks happened late in the process", "timeline": [ { "date": "2024-12", "event": "First candidate rejected after glitchy camera and movement reveal a synthetic face" }, { "date": "2025-02-04", "event": "Second candidate 'Bratislav' refuses hand-over-face test; interview ended and recording posted on LinkedIn" }, { "date": "2025-02-11", "event": "The Register reports the cases; later coverage by Fox 26 Houston in August 2025" } ], "impact": "No hire made; the company lost more than five hours of staff time and the video became a widely used example of interview deepfakes", "response": "Candidates rejected; Vidoc published the recording and advised employers to use physical tests and in-person checks", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2025/02/11/it_worker_scam" }, { "name": "Fox 26 Houston", "url": "https://www.fox26houston.com/news/scammers-ai-apply-jobs-deepfake-applicants-company-threat" } ] }, { "id": "crosetto-voice-clone", "date": "2025-02-12", "title": "AI-cloned voice of Italy's defence minister used to con business leaders", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "IT", "region": "Europe", "target": "Italian business executives", "loss_usd": null, "summary": "Scammers mimicked Defence Minister Guido Crosetto's voice to solicit ransom money for 'kidnapped journalists'; Massimo Moratti wired nearly EUR 1M, which police later froze in the Netherlands.", "source": "Reuters (via Yahoo News)", "url": "https://www.yahoo.com/news/italian-police-freeze-cash-ai-191616980.html", "actor": "Unknown fraud ring; two Dutch nationals placed under investigation", "actor_type": "criminal", "attribution": "Milan prosecutors placed two foreign (Dutch) nationals under investigation per ANSA; believed to be acting for others; no public arrests confirmed", "motive": "Financial fraud (fake ransom for kidnapped journalists)", "vector": "Phone calls from fake defence ministry officials handing over to an AI-cloned voice of Minister Crosetto requesting urgent wire transfers to foreign accounts", "root_cause": "Realistic voice cloning of a public figure combined with urgency and authority pretext; victims had no out-of-band verification before wiring funds", "timeline": [ { "date": "2025-02", "event": "Callers posing as Crosetto contact Armani, Bertelli, Moratti and other business leaders seeking ransom money" }, { "date": "2025-02", "event": "Moratti wires two payments totalling almost EUR 1M, then files a complaint with Milan prosecutors" }, { "date": "2025-02-12", "event": "Italian police announce the funds were traced to a Dutch account and completely frozen" }, { "date": "2025-02-13", "event": "ANSA reports two Dutch nationals under investigation; Milan prosecutors probe organised-crime group formation" } ], "impact": "Massimo Moratti wired almost EUR 1 million; Giorgio Armani, Patrizio Bertelli and other elites targeted but did not pay; funds later frozen", "response": "Moratti filed a complaint; Milan prosecutors opened an organised-crime probe; funds traced and frozen in the Netherlands; two suspects identified", "status": "under investigation", "cve": null, "sources": [ { "name": "Reuters (via Yahoo News)", "url": "https://www.yahoo.com/news/italian-police-freeze-cash-ai-191616980.html" }, { "name": "ANSA", "url": "https://www.ansa.it/english/news/general_news/2025/02/13/two-probed-over-crosetto-fraud-case_32818e79-b700-4d77-a94a-1a8938e7dcee.html" }, { "name": "Cyprus Mail (Reuters)", "url": "https://cyprus-mail.com/2025/02/12/italian-police-freeze-cash-from-ai-voice-scam-that-targeted-business-leaders" } ] }, { "id": "openai-cambodia-romance-baiting", "date": "2025-02-21", "title": "Cambodia-based romance-baiting scam used ChatGPT to generate multilingual social lures", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Asia-Pacific", "target": "Social-media users in Japan, China and English markets", "loss_usd": null, "summary": "A likely Cambodia-based network translated and generated comments in Japanese, Chinese and English for romance and investment scams, which OpenAI disrupted alongside a separate Urdu-English task scam.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf", "actor": "Unknown Cambodia-based scam network", "actor_type": "criminal", "attribution": "OpenAI assessed the accounts as likely originating in Cambodia.", "motive": "Financial fraud", "vector": "LLM translation and comment generation for pig-butchering lures", "root_cause": "Translation requests are benign in isolation; detection relied on behavioural clustering", "timeline": [ { "date": "2025-02-21", "event": "OpenAI publishes the romance-baiting and task-scam cases and bans the accounts" }, { "date": "2025-06-09", "event": "OpenAI June 2025 report documents further Cambodia-based scam activity (Wrong Number)" } ], "impact": "Scam reach extended across languages; victim losses not quantified.", "response": "Accounts banned; findings shared with platform partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI February 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf" }, { "name": "AI Incident Database report", "url": "https://incidentdatabase.ai/reports/4741" } ] }, { "id": "openai-dprk-employment-feb2025", "date": "2025-02-21", "title": "OpenAI disrupts North Korean IT-worker accounts writing fake resumes and interview scripts", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "Western companies hiring remote developers", "loss_usd": null, "summary": "ChatGPT accounts tied to the DPRK IT-worker scheme produced resumes, profiles and cover letters plus scripted excuses for suspicious behaviour such as avoiding video; some applications were posted on LinkedIn.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf", "actor": "North Korean IT worker network", "actor_type": "state", "attribution": "OpenAI linked the activity to the DPRK remote-worker scheme described in US DOJ indictments.", "motive": "Revenue generation for the North Korean regime", "vector": "LLM-generated applicant materials and interview coaching", "root_cause": "Text generation at scale made fraudulent applications convincing and cheap", "timeline": [ { "date": "2025-02-21", "event": "OpenAI publishes the Deceptive Employment Scheme case" }, { "date": "2025-06-09", "event": "OpenAI reports a further IT-worker cluster in its June 2025 report" } ], "impact": "Fraudulent applications to Western employers; hires and losses not quantified by OpenAI.", "response": "Accounts banned; findings shared with industry partners.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI February 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf" }, { "name": "AI Incident Database report", "url": "https://incidentdatabase.ai/reports/4741" } ] }, { "id": "openai-kimsuky-bluenoroff-rdp", "date": "2025-02-21", "title": "Kimsuky and BlueNoroff used ChatGPT to debug RDP brute-force code and research intrusion", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Cryptocurrency and intrusion targets of North Korean groups", "loss_usd": null, "summary": "OpenAI banned accounts linked to North Korea's Kimsuky and BlueNoroff that gathered information on cyber intrusion tools and cryptocurrency topics and debugged code for RDP brute-force attacks.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf", "actor": "Kimsuky and BlueNoroff (North Korea)", "actor_type": "state", "attribution": "OpenAI attributed the accounts to the two DPRK groups with industry-partner input.", "motive": "Espionage and cryptocurrency theft", "vector": "ChatGPT used for tool research and debugging of brute-force code", "root_cause": "Low-level coding help provided to accounts later tied to state actors", "timeline": [ { "date": "2025-02-21", "event": "OpenAI publishes the cyber threat actor case and bans the accounts" }, { "date": "2025-06-09", "event": "OpenAI June 2025 report reiterates DPRK cyber actor activity" } ], "impact": "Incremental productivity uplift; no novel capability observed.", "response": "Accounts banned, indicators shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI February 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf" }, { "name": "AI Incident Database report", "url": "https://incidentdatabase.ai/reports/4741" } ] }, { "id": "openai-peer-review-qianyue", "date": "2025-02-21", "title": "OpenAI bans China-linked Peer Review network building Qianyue social-media monitoring tool", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Western social-media users organising anti-China protests", "loss_usd": null, "summary": "Accounts likely in China used ChatGPT to write sales copy, debug code and analyse documents for the Qianyue Overseas Public Opinion AI Assistant, a Llama-based tool reporting on Western protests to Chinese authorities.", "source": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-peer-review", "actor": "Peer Review network (likely China)", "actor_type": "state", "attribution": "OpenAI assessed the accounts likely originated in China; the tool's client was described as Chinese security services.", "motive": "Monitoring of overseas dissent on behalf of Chinese authorities", "vector": "ChatGPT used for code debugging, document analysis, translation of protest announcements and marketing copy for the monitoring tool", "root_cause": "General coding and translation assistance applied to surveillance software development", "timeline": [ { "date": "2025-02-01", "event": "OpenAI publishes Peer Review case-study page" }, { "date": "2025-02-21", "event": "OpenAI publishes the Peer Review case and bans the accounts" } ], "impact": "Development support for a tool ingesting posts from X, Facebook, YouTube, Instagram, Telegram and Reddit; deployment status unknown.", "response": "Accounts banned; OpenAI called for threat sharing with upstream open-model providers.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI Peer Review case study", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-peer-review" }, { "name": "OpenAI February 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf" }, { "name": "AI Incident Database report", "url": "https://incidentdatabase.ai/reports/4741" } ] }, { "id": "sheinbaum-pemex-ai-investment-videos", "date": "2025-02-26", "title": "Sheinbaum denounces AI videos of her urging Mexicans to invest in Pemex shares", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "MX", "region": "Latin America", "target": "Mexican Facebook users; President Claudia Sheinbaum", "loss_usd": null, "summary": "Sheinbaum said AI-generated Facebook reels showing her inviting people to invest in Pemex for 6,000 to 7,000 pesos a day were false and had circulated since November 2024; Condusef issued parallel alerts.", "source": "El Financiero", "url": "https://www.elfinanciero.com.mx/nacional/2025/02/26/sheinbaum-evitar-hacer-un-milei-no-estoy-invitando-a-invertir-en-nada-aclara-sobre-videos-con-ia/", "actor": "Unknown", "actor_type": "criminal", "attribution": "No suspects; phishing domains such as pemexwealth.click were identified by fact-checkers.", "motive": "Lure victims to fake investment platforms and harvest personal data.", "vector": "Deepfake video and voice ads on Facebook and Instagram linking to fake Pemex investment sites.", "root_cause": "Platform ad review failed to block synthetic presidential endorsements.", "timeline": [ { "date": "2024-11-01", "event": "AI investment videos of Sheinbaum begin circulating" }, { "date": "2025-01-26", "event": "Condusef warns of deepfake investment scheme" }, { "date": "2025-02-26", "event": "Sheinbaum publicly denounces the videos at the mananera" } ], "impact": "Presidential likeness used for months in fraud; victim losses not published.", "response": "Videos added to the presidency's Detector de Mentiras segment; Condusef repeated warnings in June and August 2025.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "El Financiero", "url": "https://www.elfinanciero.com.mx/nacional/2025/02/26/sheinbaum-evitar-hacer-un-milei-no-estoy-invitando-a-invertir-en-nada-aclara-sobre-videos-con-ia/" }, { "name": "Xataka Mexico", "url": "https://www.xataka.com.mx/politica/claudia-sheinbaum-advierte-estafas-video-realizados-ia" }, { "name": "adn40", "url": "https://www.adn40.mx/es-tendencia/2025-01-26/deepfake-modus-operandi-nueva-estafa-por-la-que-alerta-condusef" } ] }, { "id": "wayback-copilot-lasso", "date": "2025-02-26", "title": "Copilot serves code from 20,000 GitHub repos that were made private, via Bing cache", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Microsoft Copilot and GitHub repository owners", "loss_usd": null, "summary": "Lasso Security found Copilot still returned content from over 20,000 repositories of 16,000+ organisations that had been made private or deleted, because Bing cached them while public. Microsoft disabled cache links.", "source": "Lasso Security", "url": "https://techcrunch.com/2025/02/26/thousands-of-exposed-github-repositories-now-private-can-still-be-accessed-through-copilot", "actor": "Lasso Security", "actor_type": "researcher", "attribution": "Responsible disclosure to Microsoft in November 2024", "motive": "Security research", "vector": "Copilot retrieval grounded on stale Bing index of formerly public pages", "root_cause": "Search cache not purged when repositories changed visibility", "timeline": [ { "date": "2024-11", "event": "Lasso reports the issue to Microsoft" }, { "date": "2025-02-26", "event": "Public disclosure; Microsoft had removed Bing cached links" } ], "impact": "Secrets and private code remained retrievable; Lasso said Copilot still had some access after the cache change", "response": "Microsoft disabled Bing cache link feature; Lasso said the fix was partial", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "TechCrunch", "url": "https://techcrunch.com/2025/02/26/thousands-of-exposed-github-repositories-now-private-can-still-be-accessed-through-copilot" }, { "name": "SC World", "url": "https://www.scworld.com/brief/microsoft-copilot-access-to-thousands-of-since-protected-github-repos-remains" } ] }, { "id": "storm-2139-azure-openai", "date": "2025-02-27", "title": "Microsoft names Storm-2139 members who hijacked Azure OpenAI with stolen keys", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Microsoft Azure OpenAI customers", "loss_usd": null, "summary": "Microsoft amended its lawsuit to name four people in a ring that used scraped customer API keys to access Azure OpenAI, bypass guardrails, resell access and generate harmful imagery.", "source": "SecurityWeek", "url": "https://www.securityweek.com/microsoft-names-suspects-in-lawsuit-against-ai-hackers/", "actor": "Storm-2139 (Arian Yadegarnia, Alan Krysiak, Ricky Yuen, Phat Phung Tan)", "actor_type": "criminal", "attribution": "Named by Microsoft Digital Crimes Unit in an amended civil complaint (E.D. Virginia); members located in Iran, UK, Hong Kong and Vietnam", "motive": "Resale of illicit access to generative AI services and creation of harmful or non-consensual imagery", "vector": "Customer Azure OpenAI API keys scraped from public sources, used with a custom de3u tool and reverse-proxy to bypass safety guardrails and resell access", "root_cause": "Customers leaking API keys in public code and configs; keys alone sufficed for access, enabling abuse until anomalous usage was detected", "timeline": [ { "date": "2024-07", "event": "Microsoft discovers abuse of stolen Azure OpenAI API keys via the de3u tool" }, { "date": "2024-12", "event": "Microsoft DCU files lawsuit against 10 John Does in Eastern District of Virginia; court allows seizure of a key domain" }, { "date": "2025-01", "event": "Filings unsealed; Storm-2139 members allegedly dox Microsoft's lawyers in response" }, { "date": "2025-02-27", "event": "Microsoft amends complaint naming four individuals (Fiz, Drago, cg-dot, Asakuri)" } ], "impact": "Unauthorised use of Azure OpenAI accounts of Microsoft customers, guardrails bypassed to generate harmful images including of celebrities; access resold to end users; financial loss not disclosed", "response": "Microsoft revoked access, added safety countermeasures, seized the de3u website, pursued civil litigation and referred the matter to law enforcement", "status": "ongoing", "cve": null, "sources": [ { "name": "SecurityWeek", "url": "https://www.securityweek.com/microsoft-names-suspects-in-lawsuit-against-ai-hackers/" }, { "name": "Microsoft On the Issues", "url": "https://blogs.microsoft.com/on-the-issues/?p=66868" }, { "name": "TechTarget", "url": "https://www.techtarget.com/cybersecurity/news/366619781/Microsoft-targets-AI-deepfake-cybercrime-network-in-lawsuit" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/?p=174779" } ] }, { "id": "tbilisi-deepfake-crypto-boiler-room-uk", "date": "2025-03-05", "title": "Leaked files expose Tbilisi call centre using Martin Lewis deepfakes to con 6,000 people", "category": "Deepfake fraud", "direction": "with-ai", "severity": "critical", "country": "GB", "region": "Europe", "target": "Retail investors in the UK and Europe", "loss_usd": 35000000, "summary": "A 1.9TB leak to SVT, OCCRP and the Guardian exposed a Tbilisi boiler room of about 85 agents that used deepfakes of Martin Lewis, Zoe Ball and Ben Fogle to lure 6,179 victims into fake crypto platforms for about $35M.", "source": "The Guardian", "url": "https://www.theguardian.com/money/2025/mar/05/deepfakes-cash-and-crypto-how-call-centre-scammers-duped-6000-people", "actor": "A.K. Group call centre, Tbilisi (self-styled skameri)", "actor_type": "criminal", "attribution": "Leaked recordings and CRM data link the operation to Georgian telemarketing firm A.K. Group; director Meri Shotadze and alleged boss Akaki Kevkhishvili did not respond to the Guardian.", "motive": "Financial gain through fake cryptocurrency investment platforms and withdrawal fees.", "vector": "Social media ads with deepfake celebrity endorsements led to fake trading dashboards; agents posing as advisers groomed victims by phone and coached them to deceive bank compliance staff.", "root_cause": "Platforms ran paid adverts with AI-altered celebrity videos; cross-border enforcement gaps left a Georgia-based operation largely unreachable by UK police.", "timeline": [ { "date": "2022-05-01", "event": "Tbilisi call centre begins targeting victims with fake crypto investment adverts" }, { "date": "2024-03-01", "event": "Ben Fogle warns on Instagram about a deepfake of himself promoting crypto" }, { "date": "2025-03-05", "event": "Guardian, OCCRP and SVT publish the Scam Empire investigation based on the leak" }, { "date": "2025-03-05", "event": "Georgian prosecutors say they are looking into A.K. Group" } ], "impact": "At least 6,179 victims worldwide lost about $35M; UK victims accounted for nearly a third, around £9M, with the largest single UK loss about £162,000. The UK represented about 45 percent of attempted calls.", "response": "Georgian prosecutors opened a probe after journalists' inquiries; UK figures renewed calls for Meta and Google to block deepfake adverts. No arrests were reported at publication.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Guardian", "url": "https://www.theguardian.com/money/2025/mar/05/deepfakes-cash-and-crypto-how-call-centre-scammers-duped-6000-people" }, { "name": "OCCRP Scam Empire", "url": "https://www.occrp.org/en/project/scam-empire/diamonds-dior-and-dubai-vacations-the-luxurious-lives-of-georgias-call-center-scammers" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/reports/4841" } ] }, { "id": "argentina-caputo-deepfake-immediate-ai", "date": "2025-03-11", "title": "Argentine federal prosecutor probes AI video of minister Caputo promoting Immediate AI", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "AR", "region": "Latin America", "target": "Argentine social media users", "loss_usd": null, "summary": "Authorities warned of a fake AI video of Economy Minister Luis Caputo endorsing the Immediate AI Comerciante platform, promising daily gains of up to 2M pesos; Fiscalia Federal No 5 under Franco Picardi took the case.", "source": "El Economista (citing Fiscalia Federal No 5)", "url": "https://eleconomista.com.ar/economia/alertan-una-nueva-estafa-vuelven-utilizar-imagen-luis-caputo-promocionar-una-plataforma-inversiones-n82830/amp", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; scammers also cloned Argentina.gob.ar and a La Nacion article in the earlier PrimeAurora case.", "motive": "Collect personal data and deposits for a fake trading platform.", "vector": "Manipulated video of the minister on Facebook leading to an online form harvesting contact details before soliciting funds.", "root_cause": "Government officials' footage repurposed with AI; cloned official websites added credibility.", "timeline": [ { "date": "2025-02-25", "event": "PrimeAurora scam using Caputo deepfake investigated" }, { "date": "2025-03-11", "event": "New Immediate AI Comerciante video reported; Fiscalia Federal No 5 handles case" } ], "impact": "No victim counts or losses published.", "response": "Federal prosecutor investigation and public warning.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "El Economista (citing Fiscalia Federal No 5)", "url": "https://eleconomista.com.ar/economia/alertan-una-nueva-estafa-vuelven-utilizar-imagen-luis-caputo-promocionar-una-plataforma-inversiones-n82830/amp" }, { "name": "Minuto Uno", "url": "https://www.minutouno.com/economia/advierten-una-nueva-estafa-declaraciones-falsas-luis-caputo-n6122004" }, { "name": "Chequeado", "url": "https://chequeado.com/ultimas-noticias/alertan-por-una-estafa-virtual-que-utiliza-la-imagen-de-luis-caputo-para-promocionar-una-supuesta-plataforma-de-inversion/" } ] }, { "id": "malaysia-vip-deepfake-investment-videos", "date": "2025-03-12", "title": "Malaysian police tie five deepfake videos of Anwar, Trump, Musk and Petronas to scam", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "MY", "region": "Asia-Pacific", "target": "Malaysian retail investors", "loss_usd": null, "summary": "Bukit Aman's commercial crime unit said one syndicate made five deepfake videos of PM Anwar, Donald Trump, Elon Musk, Petronas executives and MP Teresa Kok promoting a fake government-backed scheme with 100x returns.", "source": "Bernama", "url": "https://bernama.com/en/news.php?id=2401443", "actor": "Unidentified investment-scam syndicate", "actor_type": "criminal", "attribution": "Police believe a single syndicate produced and spread the videos across platforms; no arrests announced", "motive": "Lure victims into fake investment scheme and harvest personal data", "vector": "Deepfake endorsement videos on social media with a 'Learn More' button leading to data-collection pages and app downloads", "root_cause": "Low-cost synthetic video of trusted public figures; platforms slow to remove sponsored scam content", "timeline": [ { "date": "2024", "event": "Videos begin circulating widely on social media" }, { "date": "2025-03-12", "event": "Police and Securities Commission announce the five videos are linked and will be taken down" } ], "impact": "No losses or arrests published; videos reached a wide Malaysian audience before takedown", "response": "Securities Commission and MCMC committed to removing the videos; public warnings issued", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Bernama", "url": "https://bernama.com/en/news.php?id=2401443" }, { "name": "The Vibes", "url": "https://www.thevibes.com/articles/news/105779/police-detect-five-vip-deepfake-videos-linked-to-investment-scams" } ] }, { "id": "qatarenergy-ai-investment-videos", "date": "2025-03-26", "title": "QatarEnergy warns public of AI-generated videos impersonating it to sell fake investments", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "QA", "region": "Middle East & Africa", "target": "QatarEnergy brand and Gulf investors", "loss_usd": null, "summary": "Qatar's state energy company warned about fake adverts and AI-generated videos presenting investment opportunities in its name, stressing it never asks the public for money; it reissued the warning in November 2025.", "source": "Qatar Tribune", "url": "https://www.qatar-tribune.com/article/169404/latest-news/qatarenergy-warns-of-fake-adverts-videos-offering-investment-opportunities", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; part of a regional wave of deepfake investment scams noted by Gulf regulators.", "motive": "Investment fraud using a trusted state brand.", "vector": "AI-generated promotional videos and fake adverts on social media.", "root_cause": "Brand and executive footage easily cloned; no platform verification of corporate endorsements.", "timeline": [ { "date": "2025-03-26", "event": "QatarEnergy issues first warning" }, { "date": "2025-11-17", "event": "QatarEnergy reissues warning over continued AI videos" } ], "impact": "Ongoing impersonation of a national energy company; losses not disclosed.", "response": "Public advisories urging verification before acting on any offer.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Qatar Tribune", "url": "https://www.qatar-tribune.com/article/169404/latest-news/qatarenergy-warns-of-fake-adverts-videos-offering-investment-opportunities" }, { "name": "The Peninsula", "url": "https://www.thepeninsulaqatar.com/article/17/11/2025/qatarenergy-reminds-public-to-exercise-caution-over-fake-investment-ads" }, { "name": "Marhaba", "url": "https://marhaba.qa/qatarenergy-reissues-warning-over-fake-adverts-and-ai-generated-investment-scams/" } ] }, { "id": "singapore-deepfake-zoom", "date": "2025-04-07", "title": "Deepfake Zoom call of executives tricks Singapore finance director into $499K transfer", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "SG", "region": "Asia-Pacific", "target": "Multinational firm (Singapore office)", "loss_usd": 499000, "summary": "A finance director joined a Zoom call with deepfaked company executives and wired about US$499,000 to a mule account; Singapore and Hong Kong police traced and froze the funds.", "source": "Singapore Police Force", "url": "https://www.police.gov.sg/media-room/news/20250407_singapore_and_hong_kong_police_force_recover_over_$670000_in_a_scam", "actor": "Unknown business email compromise / deepfake fraud syndicate", "actor_type": "criminal", "attribution": "Not publicly attributed; Singapore Police Force and Hong Kong Anti-Deception Coordination Centre investigating", "motive": "Financial fraud (CEO impersonation / business email compromise)", "vector": "WhatsApp approach impersonating the CFO, followed by a Zoom call with deepfaked CEO and executives instructing a transfer to a local mule account", "root_cause": "Video deepfakes of known executives defeated visual trust; no independent verification or dual-approval control on a large urgent transfer", "timeline": [ { "date": "2025-03-24", "event": "Finance director contacted on WhatsApp by scammer impersonating the company's CFO" }, { "date": "2025-03-26", "event": "Victim joins deepfake Zoom call and transfers over USD 499,000 from the firm's HSBC account to a mule account" }, { "date": "2025-03-28", "event": "Victim alerts HSBC after a further USD 1.4M request; SPF Anti-Scam Centre and Hong Kong ADCC trace and withhold funds" }, { "date": "2025-04-07", "event": "Singapore Police Force publicises the case and the cross-border recovery" } ], "impact": "Over USD 499,000 (about S$670,000) transferred; over USD 494,000 moved on to Hong Kong accounts before being traced and withheld; scammers sought a further USD 1.4M", "response": "HSBC notified the Anti-Scam Centre; Singapore and Hong Kong police traced and withheld the funds within days; investigations ongoing", "status": "under investigation", "cve": null, "sources": [ { "name": "Singapore Police Force", "url": "https://www.police.gov.sg/media-room/news/20250407_singapore_and_hong_kong_police_force_recover_over_$670000_in_a_scam" }, { "name": "HRD Asia", "url": "https://hcamag.com/asia/specialisation/hr-technology/singapore-firm-nearly-lost-500000-after-deepfake-video-scam-police/531450" }, { "name": "Frank on Fraud", "url": "https://frankonfraud.com/hsbc-business-customer-got-deepfaked-sent-wire/" } ] }, { "id": "spain-coinblack-deepfake-crypto", "date": "2025-04-07", "title": "Spain's Operation COINBLACK: six held over 19M euro AI deepfake celebrity crypto scam", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "ES", "region": "Europe", "target": "208 investors worldwide", "loss_usd": 20900000, "summary": "Spanish National Police arrested six people in Granada and Alicante who used AI ads with deepfake celebrity endorsements to sell fake crypto investments, defrauding 208 victims of about 19 million euros ($20.9M).", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/six-arrested-for-ai-powered-investment-scams-that-stole-20-million/", "actor": "Spain-based investment fraud group led by a man using over 50 aliases", "actor_type": "criminal", "attribution": "Policia Nacional operation COINBLACK-WENDMINE with the Civil Guard; six arrests aged 34 to 57", "motive": "Financial gain through multi-stage investment, romance and recovery fraud", "vector": "Algorithmic victim targeting, deepfake celebrity ads, fake trading platforms, then recovery scams by impersonating Europol agents and UK lawyers", "root_cause": "Generative AI made fake endorsements credible at scale; shell companies laundered proceeds for two years before a victim complaint triggered the probe", "timeline": [ { "date": "2023", "event": "Investigation opens after a Granada victim files a complaint" }, { "date": "2025-04-07", "event": "Six arrests; 100,000 euros, devices, firearms and documents seized" }, { "date": "2025-04-08", "event": "OCCRP and BleepingComputer report police findings" } ], "impact": "About 19 million euros lost by 208 victims across multiple countries; some victims defrauded twice through fake recovery services", "response": "Arrests, seizures and charges for fraud and money laundering; police warned about AI-generated investment ads", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/six-arrested-for-ai-powered-investment-scams-that-stole-20-million/" }, { "name": "OCCRP", "url": "https://www.occrp.org/en/news/spanish-police-bust-eur19m-crypto-scam-using-ai-and-fake-celebs" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1017" } ] }, { "id": "xanthorox-ai-darknet", "date": "2025-04-07", "title": "Xanthorox AI: self-hosted five-model criminal platform marketed as WormGPT killer", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Potential phishing and malware victims worldwide", "loss_usd": null, "summary": "SlashNext found Xanthorox AI on darknet forums from late Q1 2025, claiming five custom models on private servers for coding, vision, reasoning and voice; seller screenshots showed Defender-evading ransomware output.", "source": "SlashNext", "url": "https://securityboulevard.com/2025/04/xanthorox-ai-the-next-generation-of-malicious-ai-threats-emerges/", "actor": "Unknown", "actor_type": "criminal", "attribution": "SlashNext researchers documented seller claims; capabilities largely unverified beyond vendor screenshots.", "motive": "Selling malicious AI tooling to cybercriminals", "vector": "Subscription access to a modular malicious AI suite sold through darknet forums and encrypted channels", "root_cause": "Locally hosted models outside commercial provider controls avoid guardrails and takedowns", "timeline": [ { "date": "2025-03-15", "event": "Xanthorox AI first spotted circulating in cybercrime communities" }, { "date": "2025-04-07", "event": "SlashNext publishes analysis of the platform" } ], "impact": "Lowered the bar for phishing, social engineering and malware creation; real-world attack volume attributable to the tool not established.", "response": "SlashNext published the analysis and indicators; no takedown reported.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "SlashNext via Security Boulevard", "url": "https://securityboulevard.com/2025/04/xanthorox-ai-the-next-generation-of-malicious-ai-threats-emerges/" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/darknets-xanthorox-ai-hackers-tools" }, { "name": "eSecurity Planet", "url": "https://www.esecurityplanet.com/cybersecurity/xanthorox-ai/" } ] }, { "id": "pindrop-ivan-x-deepfake-applicant", "date": "2025-04-08", "title": "Pindrop unmasks 'Ivan X', deepfake engineering candidate traced near Russia-DPRK border", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Pindrop Security (hiring process)", "loss_usd": null, "summary": "Pindrop said an engineering applicant called Ivan used deepfake video and generative AI in interviews; a recruiter saw lip-speech mismatch and his IP pointed to a possible Russian military site near North Korea.", "source": "CNBC via NBC News", "url": "https://www.nbcnews.com/tech/security/fake-job-seekers-are-flooding-us-companies-are-hiring-for-remote-positions-rcna200199", "actor": "Unknown", "actor_type": "unknown", "attribution": "Pindrop reported the IP geolocation pointed to a possible Russian military facility near the North Korean border; no formal attribution", "motive": "Gain remote employment and insider access under a synthetic identity", "vector": "Deepfake video and AI-generated persona during remote video interviews; later reapplied through a different recruiter", "root_cause": "Remote hiring pipelines lacked liveness and identity verification; synthetic video quality close enough to pass initial screening", "timeline": [ { "date": "2025-03", "event": "Recruiter flags mismatch between facial movements and speech; Pindrop's video authentication confirms deepfake" }, { "date": "2025-04-08", "event": "CNBC reports the case alongside Gartner's forecast that one in four candidates will be fake by 2028" } ], "impact": "No hire; the case became a widely cited example of AI-enabled applicant fraud and prompted Pindrop to extend detection to video meetings", "response": "Candidate rejected; Pindrop studied the technique on a second application and launched interview deepfake detection", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "CNBC via NBC News", "url": "https://www.nbcnews.com/tech/security/fake-job-seekers-are-flooding-us-companies-are-hiring-for-remote-positions-rcna200199" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/reports/5056" } ] }, { "id": "akirabot-openai-spam", "date": "2025-04-09", "title": "AkiraBot uses GPT-4o-mini to spam 80,000 websites through contact forms and chat widgets", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Small business sites on Shopify, Wix, Squarespace, GoDaddy", "loss_usd": null, "summary": "SentinelLABS exposed AkiraBot, a Python framework that scrapes each target site and asks OpenAI to write unique SEO spam, bypassing CAPTCHAs; it targeted 420,000 domains and hit at least 80,000 since September 2024.", "source": "SentinelLABS", "url": "https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/", "actor": "AkiraBot operators", "actor_type": "criminal", "attribution": "SentinelLABS analysis of the framework and its archives; operators unidentified and unrelated to Akira ransomware.", "motive": "Promoting dubious SEO services", "vector": "Automated form and chat submissions with LLM-generated messages, Selenium fingerprint spoofing, CAPTCHA-solving services and SmartProxy rotation", "root_cause": "Hardcoded OpenAI API keys and per-message generation defeated template-based spam filters and CAPTCHA defences", "timeline": [ { "date": "2024-09-01", "event": "Earliest AkiraBot archives show campaign start" }, { "date": "2025-04-09", "event": "SentinelLABS publishes analysis" }, { "date": "2025-04-10", "event": "OpenAI disables the API key and investigates associated assets" } ], "impact": "At least 80,000 websites successfully spammed out of more than 420,000 unique domains targeted.", "response": "OpenAI revoked the key, saying distributing output for spam violates policy; SentinelLABS advised blocking rotating promo domains rather than relying on CAPTCHA.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "SentinelLABS", "url": "https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/" }, { "name": "Infosecurity Magazine", "url": "https://infosecurity-magazine.com/news/aipowered-akirabot-captcha-spam" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/176415/cyber-crime/akirabot-ai-powered-spam-bot-evades-captcha-to-target-80000-websites.html" } ] }, { "id": "anthropic-iot-camera-creds", "date": "2025-04-23", "title": "Anthropic bans actor using Claude to build IoT security-camera credential scraper", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Owners of internet-connected security cameras", "loss_usd": null, "summary": "A skilled developer used Claude to rewrite a scraping toolkit that harvests leaked camera logins from breach platforms and stealer-log Telegram groups, aiming to force access to the devices.", "source": "Anthropic", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "actor": "Unknown (sophisticated individual developer)", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; no named actor, assessed as a technically capable individual using commercial breach-data platforms.", "motive": "Unauthorised access to security cameras and the networks behind them", "vector": "Claude used to refactor an open-source scraper, write URL-scraping scripts, parse stealer-log Telegram posts and improve the tool's search backend", "root_cause": "General-purpose coding assistance applied to dual-use credential-harvesting tooling; abuse detected by behavioural classifiers rather than blocked at prompt level", "timeline": [ { "date": "2025-03", "event": "Anthropic detects account building the camera-credential toolkit and bans it" }, { "date": "2025-04-23", "event": "Case published in Anthropic's March 2025 misuse report" } ], "impact": "Potential compromise of camera credentials and network penetration; Anthropic did not confirm real-world success.", "response": "Account banned; Anthropic cited the case as an example of AI-enhanced credential operations and fed indicators into its detection systems.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic March 2025 misuse report", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025" }, { "name": "OpenAI June 2025 report (cites the Anthropic report)", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" } ] }, { "id": "anthropic-novice-malware-builder", "date": "2025-04-23", "title": "Novice coder grows doxing toolkit and evasive malware builder with Claude's help", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Individuals targeted by doxing and remote-access malware", "loss_usd": null, "summary": "An individual with little coding skill used Claude to grow a basic toolkit into a suite with facial recognition and dark-web scanning, and a batch-script generator into a GUI malware builder with evasion and persistence.", "source": "Anthropic", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "actor": "Unknown individual", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; single low-skill actor, not named.", "motive": "Doxing and remote access to victims' machines", "vector": "Iterative code generation requests to Claude to add capabilities to doxing tools and a payload builder", "root_cause": "AI coding assistance lowered the skill barrier for building security-evading payloads", "timeline": [ { "date": "2025-03", "event": "Anthropic detects and bans the actor" }, { "date": "2025-04-23", "event": "Case published in Anthropic's misuse report" } ], "impact": "Demonstrated capability uplift for an unskilled actor; real-world deployment not confirmed.", "response": "Actor banned; Anthropic highlighted the case as an example of AI lowering the barrier to malware development.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic March 2025 misuse report", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025" }, { "name": "OpenAI June 2025 report (cites the Anthropic report)", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" } ] }, { "id": "anthropic-recruitment-fraud-2025", "date": "2025-04-23", "title": "Recruitment-fraud ring used Claude to polish fake hiring-manager lures in Eastern Europe", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Europe", "target": "Job seekers in Eastern European countries", "loss_usd": null, "summary": "A moderately sophisticated group impersonating hiring managers at real companies had Claude rewrite non-native English into fluent messages, craft interview scripts and format lures to harvest applicants' personal data.", "source": "Anthropic", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "actor": "Unknown recruitment-fraud group", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; group not named, assessed as moderately sophisticated.", "motive": "Theft of job seekers' personal information for fraud", "vector": "Real-time language sanitisation of scam messages, persuasive recruitment narratives and interview questions generated by Claude", "root_cause": "Scam text generation is hard to distinguish from legitimate HR writing; detection relied on account-level behavioural analysis", "timeline": [ { "date": "2025-03", "event": "Anthropic identifies and bans the recruitment-fraud accounts" }, { "date": "2025-04-23", "event": "Case disclosed in Anthropic's first misuse report" } ], "impact": "Group sought applicants' personal information; Anthropic did not confirm successful scams.", "response": "Accounts banned; Anthropic noted the case as evidence of AI lowering the language barrier for fraud.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic March 2025 misuse report", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025" }, { "name": "OpenAI June 2025 report (cites the Anthropic report)", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" } ] }, { "id": "east-java-khofifah-deepfake-arrests", "date": "2025-04-24", "title": "Indonesian police arrest three over TikTok deepfake of governor selling Rp500k motorbikes", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "ID", "region": "Asia-Pacific", "target": "Indonesian TikTok users; Governor Khofifah Indar Parawansa", "loss_usd": 5200, "summary": "Three men from Pangandaran edited videos of Governor Khofifah with AI to advertise a fake programme offering motorbikes for Rp500,000, taking about Rp87 million from roughly 100 victims before arrest.", "source": "Metro TV News", "url": "https://www.metrotvnews.com/read/KvJCLaYx-polri-tangkap-3-pelaku-penipuan-ai-deepfake-gubernur-jatim", "actor": "Suspects HMP, UP and AH from Pangandaran", "actor_type": "criminal", "attribution": "Arrested 16 April 2025 by Ditressiber Polda Jatim with Bareskrim support; roles were video creation, uploading and WhatsApp contact.", "motive": "Petty fraud through fake subsidised vehicle offers.", "vector": "Deepfake video edits posted from accounts imitating the governor on TikTok, with payments collected via WhatsApp.", "root_cause": "Cheap AI editing tools plus public trust in official-looking social accounts.", "timeline": [ { "date": "2025-04-16", "event": "Three suspects arrested in Pangandaran, West Java" }, { "date": "2025-04-24", "event": "Bareskrim announces arrests" }, { "date": "2025-04-28", "event": "Polda Jatim press conference details roles and proceeds" } ], "impact": "About 100 victims and roughly Rp87 million, about US$5,200, in losses; similar deepfakes used governors of Central and West Java.", "response": "Arrests and charges under the ITE law and criminal code; police warned of a wider deepfake fraud syndicate.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Metro TV News", "url": "https://www.metrotvnews.com/read/KvJCLaYx-polri-tangkap-3-pelaku-penipuan-ai-deepfake-gubernur-jatim" }, { "name": "detikJatim", "url": "https://www.detik.com/jatim/hukum-dan-kriminal/d-7890165/3-pelaku-penipuan-deepfake-berbasis-ai-gubernur-khofifah-ditangkap" }, { "name": "Metro TV News", "url": "https://www.metrotvnews.com/read/NnjCe4jx-3-pelaku-video-hoaks-khofifah-pakai-ai-dibekuk" } ] }, { "id": "korea-pipc-deepseek-prompt-transfer", "date": "2025-04-24", "title": "Korea's PIPC: DeepSeek sent Korean users' prompts to ByteDance-linked Volcano Engine", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "KR", "region": "Asia-Pacific", "target": "South Korean DeepSeek app users", "loss_usd": null, "summary": "Korea's PIPC found DeepSeek sent user data and AI prompts to five firms in China and the US, including ByteDance affiliate Volcano Engine, without consent, and ordered corrective measures.", "source": "Newsis", "url": "https://www.newsis.com/view/NISX20250424_0003153087", "actor": "DeepSeek (Hangzhou DeepSeek AI)", "actor_type": "accident", "attribution": "PIPC pre-inspection established the transfers; DeepSeek said Volcano Engine was used for security and UX analytics, not marketing.", "motive": "Service analytics and model training; no malicious intent established.", "vector": "App automatically sent device, network and prompt data to overseas cloud providers on each session, with no Korean privacy policy, opt-out or age check.", "root_cause": "Launch without a Korean-language privacy notice, consent flow or cross-border transfer safeguards required under PIPA.", "timeline": [ { "date": "2025-02-17", "event": "PIPC confirms data flow to ByteDance-linked servers; DeepSeek suspends new Korean downloads" }, { "date": "2025-04-10", "event": "DeepSeek blocks new cross-border transfers of prompt data" }, { "date": "2025-04-24", "event": "PIPC publishes findings and issues corrective recommendations" } ], "impact": "Prompts and metadata of Korean users, over one million downloads, sent abroad without consent; app removed from Korean stores pending fixes.", "response": "DeepSeek added an opt-out for training use, a Korean privacy policy and age verification, destroyed transferred prompt data and was required to report compliance within 60 days.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Newsis", "url": "https://www.newsis.com/view/NISX20250424_0003153087" }, { "name": "Hankyoreh via Daum", "url": "https://v.daum.net/v/20250217135901030" }, { "name": "Malwarebytes Labs", "url": "https://www.malwarebytes.com/blog/news/2025/02/deepseek-found-to-be-sharing-user-data-with-tiktok-parent-company-bytedance" } ] }, { "id": "vietnam-deepfake-extortion-ring", "date": "2025-04-25", "title": "Vietnam busts Chinese deepfake sextortion ring that hit nearly 1,000 executives for $8M", "category": "Deepfake fraud", "direction": "with-ai", "severity": "critical", "country": "VN", "region": "Asia-Pacific", "target": "Vietnamese business executives and officials", "loss_usd": 8000000, "summary": "Vietnam's Ministry of Public Security said Chinese nationals used AI deepfakes to fabricate explicit images of nearly 1,000 Vietnamese executives and demanded USDT; losses about VND 200 billion (about $8M).", "source": "VietNamNet", "url": "https://vietnamnet.vn/en/chinese-scammers-use-ai-deepfakes-to-extort-vietnamese-entrepreneurs-2395223.html", "actor": "Chinese extortion network with Vietnamese accomplices", "actor_type": "criminal", "attribution": "Ministry of Public Security investigation; three arrested in Bac Giang, nine detained in China, masterminds believed to be in Cambodia", "motive": "Extortion via threats to publish fabricated explicit material", "vector": "AI-generated explicit deepfakes of victims delivered by phone, social media and physical letters with demands of about $80,000 in USDT within three days", "root_cause": "Easily sourced victim photos, roaming SIMs obtained via intermediaries, and 71 rented bank accounts opened by abusing facial-recognition onboarding", "timeline": [ { "date": "2025-02-18", "event": "Investigation Department begins arrests of suspects in Binh Duong and Binh Phuoc" }, { "date": "2025-04", "event": "Three arrested in Bac Giang; Chinese authorities detain nine related suspects" }, { "date": "2025-04-25", "event": "Ministry of Public Security publishes case details and public warning" } ], "impact": "Nearly 1,000 victims targeted and about VND 200 billion extorted; funds laundered through rented accounts into USDT on Binance and OKX", "response": "Arrests in Vietnam and China, bank account freezes, public warnings about AI deepfake extortion", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "VietNamNet", "url": "https://vietnamnet.vn/en/chinese-scammers-use-ai-deepfakes-to-extort-vietnamese-entrepreneurs-2395223.html" }, { "name": "Frank on Fraud", "url": "https://frankonfraud.com/inside-the-8-million-deepfake-ai-extortion-scheme/" }, { "name": "Viet Nam News", "url": "https://vietnamnews.vn/society/1694933/vietnamese-authorities-warn-of-rising-ai-driven-deepfake-extortion-scams.html" } ] }, { "id": "xai-api-key-github-leak", "date": "2025-05-01", "title": "xAI employee leaks API key on GitHub exposing 60 private Grok models for two months", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "xAI private and unreleased Grok models", "loss_usd": null, "summary": "A key committed to a public GitHub repo by an xAI staffer worked against at least 60 fine-tuned and unreleased models, including grok-2.5V and models apparently built on SpaceX and Tesla data. It stayed valid two months.", "source": "KrebsOnSecurity / GitGuardian", "url": "https://getcoai.com/news/xai-developer-exposes-api-key-for-spacex-and-teslas-private-llms/", "actor": "xAI employee (accidental)", "actor_type": "insider", "attribution": "Found by consultant Philippe Caturegli and GitGuardian", "motive": "None (accidental commit)", "vector": "Secret committed to a public code repository", "root_cause": "No secret scanning or key rotation on employee repositories", "timeline": [ { "date": "2025-03-02", "event": "GitGuardian alerts the employee" }, { "date": "2025-04-30", "event": "GitGuardian alerts xAI security; key still valid" }, { "date": "2025-05-01", "event": "Repository removed after reporting" } ], "impact": "Two months of potential unauthorised access to private LLMs; no confirmed misuse", "response": "Repository taken down; xAI did not publicly comment", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "CO/AI", "url": "https://getcoai.com/news/xai-developer-exposes-api-key-for-spacex-and-teslas-private-llms/" }, { "name": "Fullerton College Cybersecurity", "url": "https://cybersecurity.fullcoll.edu/?p=304" } ] }, { "id": "xai-key-leak-spacex-tesla-llms", "date": "2025-05-01", "title": "xAI employee leaks API key on GitHub exposing 60 private Grok models for two months", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "xAI private and fine-tuned LLMs", "loss_usd": null, "summary": "An xAI technical staffer committed an x.ai API key to a public GitHub repo; GitGuardian found it granted access to at least 60 unreleased and private models, some fine-tuned on SpaceX and Tesla data, and it stayed valid for two months.", "source": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/", "actor": "xAI employee (accidental); found by Philippe Caturegli and GitGuardian", "actor_type": "accident", "attribution": "Accidental commit by an xAI employee; exposure publicised by Seralys' Philippe Caturegli and scoped by GitGuardian", "motive": "None; accidental secret exposure", "vector": "Plaintext API key in a .env file committed to a public GitHub repository, usable under the employee's identity against the x.ai API", "root_cause": "No pre-commit secret scanning or key rotation; the key remained valid for almost two months after GitGuardian's first alert to the employee", "timeline": [ { "date": "2025-03-02", "event": "GitGuardian automatically alerts the xAI employee about the exposed key" }, { "date": "2025-04-30", "event": "GitGuardian escalates to xAI security, noting the key is still valid; xAI points to its HackerOne program" }, { "date": "2025-04-30", "event": "Repository containing the key is removed from GitHub hours later" }, { "date": "2025-05-01", "event": "KrebsOnSecurity publishes the story; xAI does not comment" } ], "impact": "Access to at least 60 fine-tuned and private LLMs including unreleased Grok versions and models named for SpaceX and Tesla data; no evidence of third-party abuse was published", "response": "Repository removed after escalation; xAI directed researchers to its bug bounty program and issued no public statement", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/" }, { "name": "CO/AI", "url": "https://getcoai.com/news/xai-developer-exposes-api-key-for-spacex-and-teslas-private-llms/" } ] }, { "id": "bcp-credicorp-ceo-deepfake", "date": "2025-05-08", "title": "Peru's BCP denounces AI video impersonating Credicorp CEO Gianfranco Ferrari in scam", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "PE", "region": "Latin America", "target": "Banco de Credito del Peru customers", "loss_usd": null, "summary": "Banco de Credito del Peru said a social media video of Credicorp CEO Gianfranco Ferrari inviting the public into an investment programme was an AI simulation of his voice and appearance, and announced legal action.", "source": "Banco de Credito del Peru", "url": "https://www.peru-retail.com/bcp-denuncia-video-falso-con-ia-que-simula-al-ceo-de-credicorp-para-estafar-con-inversiones/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Lure investors using the credibility of Peru's largest bank.", "vector": "Deepfake video of the CEO on social media promoting a fake investment programme.", "root_cause": "Executive media appearances provide training data; social platforms carried the fake ad.", "timeline": [ { "date": "2025-05-07", "event": "Deepfake Ferrari video circulates on social media" }, { "date": "2025-05-08", "event": "BCP publishes statement declaring the video false and announcing legal action" } ], "impact": "No losses disclosed; reputational harm to BCP and Credicorp.", "response": "Public statement, legal action announced, customers urged to verify and report.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Peru Retail (citing BCP)", "url": "https://www.peru-retail.com/bcp-denuncia-video-falso-con-ia-que-simula-al-ceo-de-credicorp-para-estafar-con-inversiones/" }, { "name": "Libero", "url": "https://libero.pe/tiempoextra/2025/05/07/bcp-lanza-comunicado-ultima-hora-alarma-todos-sus-usuarios-esten-atentos-476336" } ] }, { "id": "cursor-npm-macos-backdoor", "date": "2025-05-09", "title": "npm packages 'sw-cur' and 'aiide-cur' backdoor Cursor on macOS, 3,200 downloads", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Cursor AI editor users on macOS", "loss_usd": null, "summary": "Socket found three npm packages promising cheap Cursor access that stole Cursor credentials, patched Cursor's main.js with attacker code, disabled auto-update and restarted the IDE to keep remote execution inside it.", "source": "Socket (via The Hacker News)", "url": "https://thehackernews.com/2025/05/malicious-npm-packages-infect-3200.html", "actor": "npm accounts gtr2018 and aiide", "actor_type": "criminal", "attribution": "Published under the npm usernames gtr2018 and aiide; no further attribution", "motive": "Credential theft and persistent code execution inside a developer IDE, with potential for source and CI/CD compromise", "vector": "Malicious npm packages advertised as tools for cheap Cursor access; install script harvested credentials, fetched an encrypted payload and overwrote files under Cursor.app", "root_cause": "Developers trusting unofficial npm packages to bypass subscription fees; IDE application files writable by the user and no integrity checking of patched components", "timeline": [ { "date": "2025-02-13", "event": "sw-cur and sw-cur1 published by gtr2018" }, { "date": "2025-02-14", "event": "aiide-cur published by aiide" }, { "date": "2025-05-09", "event": "Socket discloses the campaign with over 3,200 combined downloads and petitions npm for removal" } ], "impact": "More than 3,200 downloads; infected Cursor installs ran attacker-controlled code with auto-update disabled, exposing credentials, source code and build pipelines", "response": "Socket requested removal from npm and advised victims to reinstall Cursor from a trusted source, rotate credentials and audit code for unauthorized changes", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2025/05/malicious-npm-packages-infect-3200.html" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/malicious-npm-packages-target-cursor-ais-macos-users/" } ] }, { "id": "fsca-kamlana-deepfake-nedbank", "date": "2025-05-09", "title": "FSCA warns of WhatsApp deepfake of its commissioner pushing fake Nedbank AI trading tool", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "ZA", "region": "Middle East & Africa", "target": "South African retail investors; FSCA and Nedbank brands", "loss_usd": null, "summary": "South Africa's FSCA flagged a WhatsApp deepfake in which Commissioner Unathi Kamlana appears to endorse an NBSG or Nedbank Securities AI trading tool promising 20 to 30 percent higher returns.", "source": "Business Report", "url": "https://businessreport.co.za/business/2025-05-09-is-your-investment-safe-fsca-warns-against-deepfake-trading-scams-on-whatsapp/", "actor": "Unknown", "actor_type": "criminal", "attribution": "No suspects named; FSCA described a marked rise in AI-generated impersonators of licensed providers and prominent South Africans.", "motive": "Lure investors into a fraudulent trading platform.", "vector": "AI-generated video of the regulator's commissioner with Nedbank branding distributed via WhatsApp and Facebook groups, following a similar J532-NBSG scam the previous month.", "root_cause": "Public footage of officials enables cheap voice and face cloning; messaging platforms offer little pre-publication screening.", "timeline": [ { "date": "2025-04-01", "event": "FSCA flags earlier J532-NBSG scam on Facebook and WhatsApp" }, { "date": "2025-05-09", "event": "FSCA warns public about deepfake of Commissioner Kamlana" } ], "impact": "Reputational misuse of the regulator and Nedbank; number of victims and losses not disclosed.", "response": "Public warning to disregard the video and verify providers via FSCA channels; Momentum Group issued parallel warnings.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Business Report", "url": "https://businessreport.co.za/business/2025-05-09-is-your-investment-safe-fsca-warns-against-deepfake-trading-scams-on-whatsapp/" }, { "name": "Cape Argus", "url": "https://capeargus.co.za/business/2025-05-09-is-your-investment-safe-fsca-warns-against-deepfake-trading-scams-on-whatsapp" }, { "name": "Daily Investor", "url": "https://dailyinvestor.com/finance/76822/investment-scam-warning-in-south-africa/" } ] }, { "id": "fbi-ai-voice-us-officials", "date": "2025-05-15", "title": "FBI warns AI-voice vishing campaign impersonates senior US officials to hijack accounts", "category": "AI phishing", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "Senior US federal and state officials and their contacts", "loss_usd": null, "summary": "FBI PSA I-051525 said that since April 2025 actors have sent smishing texts and AI-generated voice messages posing as senior US officials to build rapport, push malicious links and take over accounts.", "source": "FBI IC3", "url": "https://www.ic3.gov/PSA/2025/PSA250515", "actor": "Unknown", "actor_type": "unknown", "attribution": "FBI did not attribute the campaign to a criminal or state group.", "motive": "Account takeover, information theft and fraud against officials' networks", "vector": "Text messages and AI-cloned voice messages suggesting a move to another messaging platform via a malicious link", "root_cause": "Cheap voice cloning plus public availability of officials' voices and contact graphs", "timeline": [ { "date": "2025-04-01", "event": "Campaign activity against officials begins, per FBI" }, { "date": "2025-05-15", "event": "FBI issues public service announcement" }, { "date": "2025-07-08", "event": "State Department cable reports AI-voice impersonation of Secretary Rubio on Signal" } ], "impact": "Compromised accounts were used to reach further officials and solicit information or money; number of victims not disclosed.", "response": "FBI advised independent verification, MFA, family code words and reporting to IC3.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "FBI IC3 PSA", "url": "https://www.ic3.gov/PSA/2025/PSA250515" }, { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/fbi-us-officials-targeted-in-voice-deepfake-attacks-since-april" } ] }, { "id": "aliyun-ai-labs-pypi-pickle", "date": "2025-05-22", "title": "PyPI packages posing as Alibaba AI Labs SDK hide infostealer in PyTorch model", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "CN", "region": "Asia-Pacific", "target": "Developers using Alibaba Cloud AI Labs services", "loss_usd": null, "summary": "Packages aliyun-ai-labs-snippets-sdk, ai-labs-snippets-sdk and aliyun-ai-labs-sdk shipped a model.pt whose pickle payload collected host details and .gitconfig and sent them to an Alibaba Cloud OSS bucket; about 1,600 downloads.", "source": "JFrog Security Research", "url": "https://research.jfrog.com/post/malicious-ai-models-hit-pypi/", "actor": "PyPI account 'ai-aliyun'", "actor_type": "criminal", "attribution": "Published by the PyPI user ai-aliyun imitating Alibaba's Aliyun brand; ReversingLabs noted checks for AliMeeting data suggesting developers in China were the targets", "motive": "Developer identity and infrastructure reconnaissance, likely as a first stage for further intrusion", "vector": "Fake SDK packages on PyPI whose import loads a PyTorch pickle that decodes base64 Python and exfiltrates data to aksjdbajkb2jeblad.oss-cn-hongkong.aliyuncs.com", "root_cause": "Pickle-based model files execute code on load; package registries do not inspect embedded ML artefacts", "timeline": [ { "date": "2025-05-19", "event": "Packages appear on PyPI and are available for less than 24 hours" }, { "date": "2025-05-22", "event": "JFrog publishes analysis of the model-embedded payload" }, { "date": "2025-05-28", "event": "ReversingLabs reports about 1,600 total downloads and the AliMeeting targeting" } ], "impact": "Roughly 1,600 downloads; victims' IP, username, system information and Git configuration were exfiltrated", "response": "Packages removed from PyPI; JFrog, ReversingLabs and OpenSSF published malicious-package records and indicators", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "JFrog Security Research", "url": "https://research.jfrog.com/post/malicious-ai-models-hit-pypi/" }, { "name": "Hackread", "url": "https://hackread.com/malware-ai-models-pypi-targets-alibaba-ai-labs-users/" }, { "name": "OSV MAL-2025-5096", "url": "https://osv.dev/vulnerability/MAL-2025-5096" } ] }, { "id": "gitlab-duo-hidden-prompt", "date": "2025-05-22", "title": "GitLab Duo prompt injection leaks private source code via hidden merge request text", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "GitLab Duo AI assistant", "loss_usd": null, "summary": "Legit Security showed prompts hidden with Unicode smuggling, Base16 or white KaTeX text in merge requests and issues could make GitLab Duo exfiltrate private code and inject HTML into its responses. GitLab patched it.", "source": "Legit Security", "url": "https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo", "actor": "Legit Security research team", "actor_type": "researcher", "attribution": "Reported to GitLab on 12 February 2025 and fixed before disclosure", "motive": "Security research", "vector": "Indirect prompt injection in project content Duo reads; streamed markdown rendered as HTML enabled script and image-based exfiltration", "root_cause": "Duo ingested full page context including comments and descriptions as instructions, and rendered output as HTML before sanitisation", "timeline": [ { "date": "2025-02-12", "event": "Legit Security reports the issues to GitLab" }, { "date": "2025-05", "event": "GitLab ships fixes" }, { "date": "2025-05-22", "event": "Public disclosure" } ], "impact": "Potential leak of private source code and malicious package suggestions to developers; no exploitation reported", "response": "GitLab addressed the rendering and injection issues", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Legit Security", "url": "https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/05/gitlab-duo-vulnerability-enabled.html" }, { "name": "TechRepublic", "url": "https://www.techrepublic.com/article/news-gitlab-duo-vulnerability-hidden-prompts/" } ] }, { "id": "lovable-rls-cve-2025-48757", "date": "2025-05-29", "title": "Lovable-built apps leak user data: 303 endpoints across 170 projects lacked row-level security", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "SE", "region": "Europe", "target": "Apps generated by the Lovable AI app builder", "loss_usd": null, "summary": "Researcher Matt Palmer found Lovable-generated Supabase backends shipped without working row-level security, letting anyone read or write tables; a scan of 1,645 apps found 170 exposing emails, phones, payment data and API keys.", "source": "Superblocks analysis of CVE-2025-48757", "url": "https://www.superblocks.com/blog/lovable-rls-breach", "actor": "Matt Palmer (researcher); exposure caused by generated-code defaults", "actor_type": "researcher", "attribution": "Discovered and disclosed by researcher Matt Palmer; Lovable disputed the CVE, arguing customers are responsible for securing their own data", "motive": "Security research and coordinated disclosure", "vector": "Direct queries to Supabase REST endpoints using the public anon key embedded in generated front ends, bypassing missing or ineffective RLS policies", "root_cause": "AI-generated backends defaulted to no effective row-level security and Lovable's later scanner only checked that a policy existed, not that it blocked unauthorized access", "timeline": [ { "date": "2025-03-21", "event": "Palmer reports the flaw to Lovable with proof-of-concept examples" }, { "date": "2025-04-14", "event": "A Palantir engineer publicly posts an exploit; Palmer starts a 45-day disclosure window" }, { "date": "2025-04-24", "event": "Lovable 2.0 ships with a security scan feature" }, { "date": "2025-05-29", "event": "CVE-2025-48757 published; Lovable marks it disputed" } ], "impact": "170 of 1,645 scanned apps (303 endpoints) exposed usernames, emails, phone numbers, subscription and payment status and third-party API keys; public exploit reportedly revealed debt amounts and home addresses", "response": "Lovable added a security review tool and API-key warnings but disputed the CVE and published no post-mortem; researchers criticised the scanner as giving a false sense of security", "status": "unresolved", "cve": "CVE-2025-48757", "verification": "disputed", "sources": [ { "name": "Superblocks", "url": "https://www.superblocks.com/blog/lovable-rls-breach" }, { "name": "SentinelOne CVE database", "url": "https://www.sentinelone.com/vulnerability-database/cve-2025-48757/" }, { "name": "Cyber Security News", "url": "https://cybersecuritynews.com/lovable-security-vulnerability/" } ] }, { "id": "lovable-rls-exposure", "date": "2025-05-29", "title": "170 Lovable-built apps expose user data through missing Supabase row-level security", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "SE", "region": "Europe", "target": "Apps generated with Lovable AI app builder", "loss_usd": null, "summary": "Matt Palmer scanned 1,645 Lovable-generated apps and found 170 with 303 endpoints where anyone with the public anon key could dump emails, phone numbers, payment records and API keys. Tracked as CVE-2025-48757.", "source": "Matt Palmer", "url": "https://superblocks.com/blog/lovable-vulnerabilities", "actor": "Matt Palmer (independent researcher)", "actor_type": "researcher", "attribution": "Public disclosure after scanning; Lovable's own infrastructure was not breached", "motive": "Security research", "vector": "Direct queries to Supabase tables using the public anon key exposed in app JavaScript", "root_cause": "AI-generated apps shipped without row-level security policies", "timeline": [ { "date": "2025-01", "event": "Palmer first notices the issue on a Lovable-built site" }, { "date": "2025-05-29", "event": "Public disclosure and CVE-2025-48757" } ], "impact": "Personal data and API keys from at least 170 apps were publicly readable", "response": "Lovable added security scanning for generated projects; affected developers were urged to enable RLS", "status": "contained", "cve": "CVE-2025-48757", "verification": "confirmed", "sources": [ { "name": "Superblocks", "url": "https://superblocks.com/blog/lovable-vulnerabilities" }, { "name": "Gigazine", "url": "https://gigazine.net/gsc_news/en/20250602-loveable-ai-made-service-vulnerability" }, { "name": "Vibe App Scanner", "url": "https://vibeappscanner.com/lovable-vulnerability-cve-2025-48757" } ] }, { "id": "open-webui-sysdig-cryptojacking", "date": "2025-06-02", "title": "Exposed Open WebUI instance hijacked to run AI-generated cryptominer and infostealer", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Internet-exposed Open WebUI deployment", "loss_usd": null, "summary": "Sysdig observed an attacker abuse an Open WebUI server exposed with admin rights and no login, uploading an obfuscated, partly AI-written Python Tool that deployed XMRig and T-Rex miners on Linux and Java infostealers on Windows.", "source": "Sysdig Threat Research Team", "url": "https://www.sysdig.com/blog/attacker-exploits-misconfigured-ai-tool-to-run-ai-generated-payload", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unattributed; Sysdig judged the Python payload mostly AI-generated with some human-written parts and noted Discord webhook C2", "motive": "Cryptomining and credential theft on compromised infrastructure", "vector": "Open WebUI Tools plugin feature used to upload and execute a Python script obfuscated through 64 layers of reversed compressed base64", "root_cause": "Self-hosted AI interface exposed to the internet with administrator privileges and authentication disabled", "timeline": [ { "date": "2025-05", "event": "Sysdig runtime detections flag miner traffic and LD_PRELOAD process hiding on a customer training system" }, { "date": "2025-06-02", "event": "Sysdig publishes the investigation of the AI-generated payload" }, { "date": "2025-06-03", "event": "Wiz adds the case to its cloud threat landscape as an Open WebUI cryptojacking incident" } ], "impact": "Compromised host mined Monero and Kawpow with hidden processes and systemd persistence; Windows stage stole Chrome extension data and Discord tokens with sandbox evasion", "response": "Detected at runtime via YARA and behavioral rules; Sysdig advised keeping AI interfaces off the public internet and enforcing authentication", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Sysdig", "url": "https://www.sysdig.com/blog/attacker-exploits-misconfigured-ai-tool-to-run-ai-generated-payload" }, { "name": "Wiz Cloud Threat Landscape", "url": "https://threats.wiz.io/all-incidents/open-webui-misconfiguration-exploited-for-cryptojacking" } ] }, { "id": "openai-scopecreep-malware", "date": "2025-06-09", "title": "ScopeCreep: Russian-speaking actor built Windows malware with ChatGPT throwaway accounts", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Gamers downloading a trojanized gaming tool", "loss_usd": null, "summary": "A Russian-speaking group used temporary ChatGPT accounts, one per code change, to build modular Windows malware with DLL sideloading, obfuscation, credential theft and Telegram alerts, spread via a trojanized game tool.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf", "actor": "ScopeCreep (Russian-speaking)", "actor_type": "criminal", "attribution": "OpenAI named the operation ScopeCreep and assessed the operators as Russian-speaking.", "motive": "Credential theft and financial gain", "vector": "Iterative malware development through disposable ChatGPT accounts; distribution via a trojanized gaming tool", "root_cause": "Account-per-request opsec defeated per-account abuse detection until behaviour clustering caught it", "timeline": [ { "date": "2025-06", "event": "Security press reports the trojanized gaming tool and malware repository takedown" }, { "date": "2025-06-09", "event": "OpenAI bans the accounts; partners take down the malicious code repository" } ], "impact": "Working malware with stealthy C2; OpenAI said impact may have been mitigated by fast reporting.", "response": "Accounts banned, repository removed by industry partners, indicators shared.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI June 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" }, { "name": "Security Affairs coverage", "url": "https://securityaffairs.com/178797/intelligence/openai-bans-chatgpt-accounts-linked-to-russian-chinese-cyber-ops.html" }, { "name": "TechRadar coverage", "url": "https://www.techradar.com/pro/security/openai-says-it-disrupted-at-least-10-malicious-ai-campaigns-already-this-year" } ] }, { "id": "openai-vague-focus", "date": "2025-06-09", "title": "VAGue Focus: China-linked accounts used ChatGPT to social-engineer US officials and press", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "US", "region": "North America", "target": "US senator's office, journalists and researchers", "loss_usd": null, "summary": "Accounts active in mainland Chinese business hours posed as staff of Focus Lens News, BrightWave Media Europe and Visionary Advisory Group, translating social-engineering messages and polishing letters to a US senator.", "source": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus", "actor": "VAGue Focus network (China-linked)", "actor_type": "unknown", "attribution": "OpenAI assessed Chinese-language, China-hours activity; state sponsorship not asserted.", "motive": "Intelligence collection and influence through social engineering", "vector": "LLM translation and drafting of pretext messages from fake media and advisory personas", "root_cause": "Persona-based outreach is indistinguishable from legitimate PR without behavioural clustering", "timeline": [ { "date": "2025-06", "event": "Translated messages posted as replies to journalists and researchers on social media" }, { "date": "2025-06-09", "event": "OpenAI publishes the VAGue Focus case and bans the accounts" } ], "impact": "Messages posted to journalists on social media; whether senator correspondence was sent is unconfirmed.", "response": "Accounts banned; OpenAI judged the hacking questions low-sophistication.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI VAGue Focus case study", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus" }, { "name": "OpenAI June 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" } ] }, { "id": "openai-vixen-keyhole-panda", "date": "2025-06-09", "title": "OpenAI bans APT15 and APT5 accounts using ChatGPT for pentest automation and US recon", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "US", "region": "North America", "target": "US defence and telecom infrastructure", "loss_usd": null, "summary": "Chinese state groups Vixen Panda (APT15) and Keyhole Panda (APT5) used ChatGPT for script edits, system configuration, pentest automation and Android social-media tooling while researching US defence and telecom targets.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf", "actor": "Vixen Panda (APT15) and Keyhole Panda (APT5)", "actor_type": "state", "attribution": "OpenAI attributed the accounts to the two China-nexus groups with industry input.", "motive": "Espionage against US infrastructure", "vector": "LLM assistance across reconnaissance, tooling and automation stages", "root_cause": "Productivity use of a public model by state operators; no capability beyond public tools", "timeline": [ { "date": "2025-06", "event": "Press coverage notes four of ten June 2025 cases likely originated in China" }, { "date": "2025-06-09", "event": "OpenAI publishes the case and bans the linked accounts" } ], "impact": "Incremental uplift only, per OpenAI; targeting of US defence and telecom sectors confirmed.", "response": "Accounts banned; findings shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI June 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" }, { "name": "Security Affairs coverage", "url": "https://securityaffairs.com/178797/intelligence/openai-bans-chatgpt-accounts-linked-to-russian-chinese-cyber-ops.html" } ] }, { "id": "openai-wrong-number-task-scam", "date": "2025-06-09", "title": "Wrong Number: Cambodia task scam used ChatGPT to translate SMS lures into six languages", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GB", "region": "Europe", "target": "UK mobile users recruited via SMS, WhatsApp and Telegram", "loss_usd": null, "summary": "A centralised Cambodia-based operation generated recruitment-style messages in six languages offering pay for trivial tasks, routing responders from SMS to WhatsApp to a Telegram mentor; one lure hit an OpenAI staffer.", "source": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-wrong-number", "actor": "Unknown Cambodia-based scam operation", "actor_type": "criminal", "attribution": "OpenAI assessed the operation as likely originating in Cambodia; entities not independently verified.", "motive": "Task-scam fraud", "vector": "Translation between Chinese and victim languages for SMS and chat lures", "root_cause": "Scam centres embedding LLM translation into existing workflows", "timeline": [ { "date": "2025-06", "event": "Lure SMS sent to UK numbers, one belonging to an OpenAI investigator" }, { "date": "2025-06-09", "event": "OpenAI publishes the Wrong Number case and bans the accounts" } ], "impact": "Scam reach extended to UK numbers; losses not quantified.", "response": "Accounts banned; indicators shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI Wrong Number case study", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-wrong-number" }, { "name": "OpenAI June 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf" } ] }, { "id": "stockholm-police-doctor-deepfake-ads", "date": "2025-06-09", "title": "Stockholm police warn of AI deepfakes of Anders Tegnell and Agnes Wold in card-theft ads", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "SE", "region": "Europe", "target": "Swedish consumers", "loss_usd": null, "summary": "Stockholm County Police reported multiple complaints since late May 2025 about social media ads using AI to imitate well-known doctors in fake health product promotions that harvested card details.", "source": "Polisen (Swedish Police)", "url": "https://polisen.se/aktuellt/nyheter/stockholm/2025/juni/aibedragerier/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Card data theft and unauthorised charges.", "vector": "Deepfake videos of former state epidemiologist Anders Tegnell and professor Agnes Wold in social media ads leading to fraudulent shops that captured card details.", "root_cause": "Trusted public health figures impersonated with AI on ad platforms lacking advertiser verification.", "timeline": [ { "date": "2025-05-25", "event": "Deepfake doctor ads begin circulating on social media" }, { "date": "2025-06-09", "event": "Stockholm police publish warning about AI scams on social media" } ], "impact": "Several reported victims had card details stolen and faced large unauthorised charges; no total loss figure published.", "response": "Police issued a public warning; impersonated doctors complained publicly.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Polisen", "url": "https://polisen.se/aktuellt/nyheter/stockholm/2025/juni/aibedragerier/" }, { "name": "Dagens Nyheter", "url": "https://www.dn.se/sverige/bedragare-utnyttjar-kanda-lakare-for-att-lura-svenskar/" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1242/" } ] }, { "id": "echoleak-m365-copilot", "date": "2025-06-11", "title": "EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Microsoft 365 Copilot", "loss_usd": null, "summary": "Aim Security showed a crafted email could make M365 Copilot silently exfiltrate tenant data with no clicks; Microsoft fixed it server-side, CVSS 9.3, no in-the-wild abuse reported.", "source": "SOC Prime", "url": "https://socprime.com/blog/cve-2025-32711-zero-click-ai-vulnerability/", "actor": "Security researchers at Aim Security (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-disclosed by Aim Security; vulnerability confirmed and rated critical by Microsoft (MSRC)", "motive": "Security research; no malicious exploitation reported", "vector": "Indirect prompt injection via a crafted inbound email that Copilot ingests through RAG, exfiltrating data via an allowlisted Teams image proxy while bypassing the XPIA classifier and link redaction", "root_cause": "LLM scope violation: untrusted email content could steer Copilot into reading privileged tenant data and emitting it in outbound requests without user interaction", "timeline": [ { "date": "2025-01", "event": "Aim Security discovers the zero-click chain and reports it to Microsoft" }, { "date": "2025-05", "event": "Microsoft deploys a server-side fix (some reports place final remediation in June)" }, { "date": "2025-06-11", "event": "CVE-2025-32711 published (CVSS 9.3); Aim Security publishes EchoLeak research" } ], "impact": "Proof-of-concept only: could silently exfiltrate emails, files and chat context from a Microsoft 365 tenant; no evidence of in-the-wild exploitation", "response": "Microsoft fixed the issue server-side with no customer action required and assigned a critical CVE; Aim criticised the roughly five-month remediation time", "status": "patched", "cve": "CVE-2025-32711", "sources": [ { "name": "SOC Prime", "url": "https://socprime.com/blog/cve-2025-32711-zero-click-ai-vulnerability/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html" }, { "name": "Hack The Box", "url": "https://www.hackthebox.com/blog/cve-2025-32711-echoleak-copilot-vulnerability" } ] }, { "id": "meta-ai-discover-feed", "date": "2025-06-12", "title": "Meta AI app's Discover feed broadcasts users' private medical and legal chats", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Meta AI app users", "loss_usd": null, "summary": "The Meta AI app's public Discover feed showed conversations users appeared to have shared by accident, including medical, financial and legal details, because the share flow gave no clear warning. Meta added a warning.", "source": "Business Insider / Mozilla Foundation", "url": "https://oecd.ai/en/incidents/2025-06-09-84d2", "actor": "Meta (product design); users sharing unintentionally", "actor_type": "accident", "attribution": "Documented by journalists and the Mozilla Foundation; Meta said the feed was not a bug", "motive": "None (feature design)", "vector": "Share button that posted chats to a public feed without explicit visibility cues", "root_cause": "Interface lacked clear indication that shared content was public", "timeline": [ { "date": "2025-06-09", "event": "Reports of sensitive chats on the Discover feed" }, { "date": "2025-06", "event": "Mozilla launches campaign with over 10,000 signatures" }, { "date": "2025-07-03", "event": "Mozilla reports Meta added a mandatory warning screen before sharing" } ], "impact": "Unknown number of users exposed private conversations and identities", "response": "Meta added a warning step before sharing; feed remained", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2025-06-09-84d2" }, { "name": "Mozilla Foundation", "url": "https://www.mozillafoundation.org/en/campaigns/meta-help-users-stop-accidentally-sharing-private-ai-conversations/" } ] }, { "id": "asana-mcp-cross-tenant", "date": "2025-06-17", "title": "Asana MCP server logic flaw exposed customer data across organisations for a month", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Asana MCP server customers", "loss_usd": null, "summary": "A logic bug in Asana's new MCP server, live from early May, could show tasks, project metadata, comments and files from other organisations to users of AI tools. Asana took it offline on 5 June and fixed it.", "source": "Asana", "url": "https://bleepingcomputer.com/news/security/asana-warns-mcp-ai-feature-exposed-customer-data-to-other-orgs", "actor": "Asana (software defect)", "actor_type": "accident", "attribution": "Disclosed by Asana to affected customers; no attacker involved", "motive": "None (bug)", "vector": "Cross-tenant data retrieval through the MCP integration used by LLM clients", "root_cause": "Logic flaw in tenant scoping of the MCP server", "timeline": [ { "date": "2025-05", "event": "Asana launches MCP server" }, { "date": "2025-06-04", "event": "Bug discovered" }, { "date": "2025-06-05", "event": "MCP server taken offline" }, { "date": "2025-06-17", "event": "Service restored with fix; customers notified" } ], "impact": "Roughly 1,000 customers potentially affected; no confirmed unauthorised viewing", "response": "Asana patched, reset MCP connections and offered logs to customers to review exposure", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/asana-warns-mcp-ai-feature-exposed-customer-data-to-other-orgs" }, { "name": "The Register", "url": "https://theregister.com/2025/06/18/asana_mcp_server_bug/" }, { "name": "UpGuard", "url": "https://upguard.com/blog/asana-discloses-data-exposure-bug-in-mcp-server" } ] }, { "id": "langflow-flodrix", "date": "2025-06-17", "title": "Langflow AI agent builder RCE (CVE-2025-3248) exploited to spread Flodrix botnet", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Langflow servers", "loss_usd": null, "summary": "After CISA added the unauthenticated Langflow code-injection flaw to KEV, attackers used public exploits on exposed AI workflow servers to install the Flodrix DDoS botnet.", "source": "Trend Micro", "url": "https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html", "actor": "Unknown Flodrix botnet operators", "actor_type": "criminal", "attribution": "No public attribution; campaign documented by Trend Micro Research, exploitation confirmed by CISA KEV listing", "motive": "Building a DDoS botnet; potential data theft from compromised AI servers", "vector": "Unauthenticated code injection in the /api/v1/validate/code endpoint of Langflow, exploited with public PoCs to drop a 'docker' shell script that fetches Flodrix ELF binaries", "root_cause": "Missing authentication and unsafe evaluation of user-supplied Python in the code-validation endpoint of Langflow versions before 1.3.0; many instances exposed to the internet unpatched", "timeline": [ { "date": "2025-03", "event": "Langflow 1.3.0 released fixing CVE-2025-3248 (CVSS 9.8)" }, { "date": "2025-05-05", "event": "CISA adds CVE-2025-3248 to the Known Exploited Vulnerabilities catalog" }, { "date": "2025-06-17", "event": "Trend Micro publishes analysis of Flodrix botnet campaign exploiting exposed Langflow servers" } ], "impact": "Full compromise of unpatched internet-exposed Langflow servers, enrolment into the Flodrix DDoS botnet and possible exposure of AI workflows and credentials; victim count not disclosed", "response": "Langflow patched in v1.3.0; CISA mandated federal patching via KEV; Trend Micro published IOCs and urged upgrades and network isolation", "status": "patched", "cve": "CVE-2025-3248", "sources": [ { "name": "Trend Micro", "url": "https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/recent-langflow-vulnerability-exploited-by-flodrix-botnet/" }, { "name": "Dark Reading", "url": "https://www.darkreading.com/vulnerabilities-threats/hackers-exploit-langflow-flaw-flodrix-botnet" } ] }, { "id": "wormgpt-grok-mixtral-variants", "date": "2025-06-17", "title": "Cato CTRL: new WormGPT variants are jailbroken wrappers on Grok and Mixtral", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Phishing and credential-theft victims of subscribers", "loss_usd": null, "summary": "Cato CTRL obtained two WormGPT variants sold via Telegram and showed one runs on xAI Grok and the other on Mistral Mixtral with guardrail-stripping system prompts; both wrote phishing emails and credential stealers.", "source": "Cato Networks CTRL", "url": "https://www.catonetworks.com/blog/cato-ctrl-wormgpt-variants-powered-by-grok-and-mixtral/", "actor": "keanu and xzin0vich (forum handles)", "actor_type": "criminal", "attribution": "Cato researcher Vitaly Simonovich extracted system prompt fragments identifying the underlying models; high confidence on model identity.", "motive": "Subscription revenue from uncensored AI access, about 550 EUR per year or up to 5,000 EUR for private setups", "vector": "Telegram chatbot wrappers around commercial LLM APIs with manipulated system prompts", "root_cause": "Prompt-level guardrails on commercial models can be overridden by a hostile system prompt", "timeline": [ { "date": "2024-10-26", "event": "Mixtral-based variant advertised on BreachForums" }, { "date": "2025-02-25", "event": "Grok-based variant advertised" }, { "date": "2025-06-17", "event": "Cato CTRL publishes findings; xAI and Mistral did not comment" } ], "impact": "Working uncensored assistants available to paying criminals; direct victim counts not reported.", "response": "Cato published the analysis; no provider action was reported at publication.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Cato Networks", "url": "https://www.catonetworks.com/blog/cato-ctrl-wormgpt-variants-powered-by-grok-and-mixtral/" }, { "name": "CyberScoop", "url": "https://cyberscoop.com/uncensored-ai-tool-traced-to-mistral-xai-grok/" }, { "name": "TechRepublic", "url": "https://www.techrepublic.com/article/news-wormgpt-variants-ai-models-grok-mixtral/" } ] }, { "id": "asana-mcp-cross-tenant-exposure", "date": "2025-06-18", "title": "Asana MCP server bug exposed customer data to other organizations for a month", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Asana customers using the MCP server", "loss_usd": null, "summary": "A logic flaw in Asana's Model Context Protocol server, launched May 1, let data from one customer's domain surface to other MCP users' AI assistants; Asana took the feature offline for two weeks and notified about 1,000 customers.", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/asana-warns-mcp-ai-feature-exposed-customer-data-to-other-orgs/", "actor": "Asana (software defect)", "actor_type": "accident", "attribution": "Internal software bug acknowledged by Asana; not the result of a hack", "motive": "None; software defect", "vector": "Cross-tenant data retrieval through the Asana MCP integration used by LLM clients", "root_cause": "Tenant isolation logic error in the experimental MCP server released as a beta", "timeline": [ { "date": "2025-05-01", "event": "Asana launches its MCP server for AI integrations" }, { "date": "2025-06-04", "event": "Asana discovers the cross-organization exposure bug" }, { "date": "2025-06-05", "event": "MCP server taken offline for maintenance" }, { "date": "2025-06-17", "event": "Service restored after all MCP connections are reset; customers must reconnect" } ], "impact": "Task details, project metadata, team information, comments and uploaded files could have been visible to other MCP users, scoped to each user's access; roughly 1,000 customers affected, no evidence of exploitation", "response": "Feature disabled for nearly two weeks, all MCP connections reset, affected organizations notified and told to delete foreign data and request access logs", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/asana-warns-mcp-ai-feature-exposed-customer-data-to-other-orgs/" }, { "name": "The Register", "url": "https://www.theregister.com/2025/06/18/asana_mcp_server_bug/" }, { "name": "UpGuard", "url": "https://upguard.com/blog/asana-discloses-data-exposure-bug-in-mcp-server" } ] }, { "id": "pickai-comfyui-backdoor", "date": "2025-06-18", "title": "Pickai backdoor spreads through ComfyUI flaws to nearly 700 AI image servers", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "ComfyUI image-generation servers; Rubick.ai platform", "loss_usd": null, "summary": "Qi'anxin XLab tracked a C++ backdoor delivered via ComfyUI vulnerabilities that disguised itself as config files, stole AI-related data and gave reverse shells; samples were also served from commercial AI vendor Rubick.ai's site.", "source": "Qi'anxin XLab", "url": "https://blog.xlab.qianxin.com/pickai-the_backdoor_hiding_in_your_ai_stack/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unattributed; XLab traced distribution to IP 185.189.149.151 and six C2 servers and found early samples uploaded from Hong Kong", "motive": "Remote access to AI infrastructure and theft of AI-related data", "vector": "Exploitation of several high-risk ComfyUI vulnerabilities to drop ELF executables disguised as config.json and vim.json, with systemd and init.d persistence", "root_cause": "Unpatched, internet-exposed ComfyUI instances; a compromised upstream AI vendor hosting the payloads", "timeline": [ { "date": "2025-02-28", "event": "Early Pickai sample uploaded to VirusTotal from Hong Kong" }, { "date": "2025-03-17", "event": "XLab detects ComfyUI exploitation delivering Pickai and registers an unclaimed C2 domain" }, { "date": "2025-05-03", "event": "XLab notifies Rubick.ai that its site hosts Pickai payloads; no response" }, { "date": "2025-05-27", "event": "China's National Cybersecurity Notification Center warns ComfyUI flaws are being exploited" }, { "date": "2025-06-18", "event": "XLab publishes the Pickai report counting at least 695 infected servers" } ], "impact": "At least 695 servers compromised, mainly in Germany, the United States and China; downstream risk to Rubick.ai e-commerce customers", "response": "XLab sinkholed one C2 domain and published IOCs; Chinese authorities issued a warning; Rubick.ai did not respond to notification", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Qi'anxin XLab", "url": "https://blog.xlab.qianxin.com/pickai-the_backdoor_hiding_in_your_ai_stack/" }, { "name": "Cyber Press", "url": "https://cyberpress.org/hackers-compromise-700-comfyui-ai-image-generation-servers/" }, { "name": "SC World", "url": "https://www.scworld.com/brief/malware-distributed-via-comfyui-server-exploits" } ] }, { "id": "skynet-prompt-injection-malware", "date": "2025-06-25", "title": "Skynet malware sample embeds prompt injection to fool AI malware analysis tools", "category": "Prompt injection", "direction": "on-ai", "severity": "low", "country": "NL", "region": "Europe", "target": "LLM-based malware analysis pipelines", "loss_usd": null, "summary": "Check Point found a half-finished Windows sample on VirusTotal with a string telling any analysing LLM to ignore instructions, act as a calculator and reply NO MALWARE DETECTED; it failed against o3 and GPT-4.1.", "source": "Check Point Research", "url": "https://research.checkpoint.com/2025/ai-evasion-prompt-injection/", "actor": "Unknown", "actor_type": "unknown", "attribution": "Uploaded anonymously from the Netherlands in early June 2025; author unknown.", "motive": "Evade AI-assisted detection and triage", "vector": "Hardcoded natural-language prompt inside the binary alongside sandbox checks, Tor proxy and string obfuscation", "root_cause": "AI analysis tools ingest attacker-controlled code as text, creating an injection surface", "timeline": [ { "date": "2025-06-05", "event": "Sample uploaded to VirusTotal via web interface" }, { "date": "2025-06-25", "event": "Check Point publishes analysis after testing injection against OpenAI models" } ], "impact": "No successful evasion observed; Check Point called it an early sign of malware targeting AI auditing tools.", "response": "Check Point tested the injection and published the sample analysis as a warning to AI-tool builders.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Check Point Research", "url": "https://research.checkpoint.com/2025/ai-evasion-prompt-injection/" }, { "name": "GovInfoSecurity", "url": "https://www.govinfosecurity.com/skynet-tries-to-outwit-ai-malware-analysis-a-28875" } ] }, { "id": "microsoft-jasper-sleet-ai-identities", "date": "2025-06-30", "title": "Microsoft: DPRK's Jasper Sleet IT workers use AI to forge IDs; 3,000 accounts suspended", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "US companies hiring remote IT workers", "loss_usd": null, "summary": "Microsoft reported DPRK remote IT workers (Jasper Sleet) use AI to swap faces into stolen ID documents, polish photos and resumes and test voice changers; it suspended 3,000 Outlook and Hotmail accounts they created.", "source": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/", "actor": "Jasper Sleet (North Korean remote IT worker program)", "actor_type": "state", "attribution": "Microsoft Threat Intelligence attribution to North Korea; consistent with US DOJ indictments of DPRK IT workers and facilitators", "motive": "Sanctions-evading revenue for the DPRK regime, with potential for data theft and extortion", "vector": "AI-edited identity and employment documents, enhanced profile photos, stolen US identities and laptop farms to secure remote jobs", "root_cause": "Remote hiring and identity checks that accept scanned documents and photos which generative tools can convincingly alter", "timeline": [ { "date": "2024-10", "event": "Microsoft finds a public repository with worker photos, resumes, VPN guides and payment records" }, { "date": "2025-01-03", "event": "DOJ indicts two North Koreans and three facilitators who earned at least $866,255 from ten of 64 infiltrated US firms" }, { "date": "2025-06-30", "event": "Microsoft publishes Jasper Sleet report and suspends 3,000 accounts" }, { "date": "2025-07-03", "event": "The Record reports ZachXBT tracing over $16.5 million in crypto to known DPRK IT workers since January 2025" } ], "impact": "Hundreds of jobs at US firms believed infiltrated; crypto payments averaging nearly $3 million per month traced to DPRK-linked workers in 2025", "response": "Account suspensions, detection guidance for employers, coordination with DOJ actions against laptop farms in 16 states", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/" }, { "name": "The Record", "url": "https://therecord.media/microsoft-shuts-down-3000-north-korea-it-worker-email" } ] }, { "id": "mumbai-valueleaf-deepfake-stock-ads", "date": "2025-07-01", "title": "Mumbai cyber police bust Bengaluru agency running deepfake stock-expert ads", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "IN", "region": "Asia-Pacific", "target": "Indian retail investors; impersonated market analysts", "loss_usd": null, "summary": "After an analyst found deepfake videos of himself, Mumbai Cyber Police traced paid promotions run in July 2025 by Bengaluru firm Valueleaf, reportedly for Hong Kong client First Bridge, and arrested four in October.", "source": "Lokmat Times", "url": "https://www.lokmattimes.com/mumbai/mumbai-cyber-police-bust-chinese-backed-deepfake-share-trading-scam-a522/", "actor": "Valueleaf staff; alleged client First Bridge (Hong Kong)", "actor_type": "criminal", "attribution": "Police reportedly described Chinese companies hiring Indian marketing firms for multi-crore ad contracts; four arrested including two engineers and an MBA graduate.", "motive": "Drive investors to fraudulent share-trading schemes.", "vector": "Deepfake videos of market experts distributed as paid Meta ads; after Meta flagged them, operators expanded ad accounts and moved domains to Dubai.", "root_cause": "Ad-agency intermediaries ran synthetic endorsement campaigns without verifying consent.", "timeline": [ { "date": "2025-07-01", "event": "Deepfake ads begin circulating as paid promotions" }, { "date": "2025-07-18", "event": "Videos removed after being flagged as misinformation" }, { "date": "2025-10-18", "event": "Four arrested in Bengaluru; remanded to police custody" } ], "impact": "Reputations of named analysts misused; investor losses not quantified; police called it possibly India's first deepfake investment-fraud case.", "response": "Case registered under BNS and IT Act; arrests and raid on Valueleaf office.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Lokmat Times", "url": "https://www.lokmattimes.com/mumbai/mumbai-cyber-police-bust-chinese-backed-deepfake-share-trading-scam-a522/" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1235/" } ] }, { "id": "supabase-mcp-cursor-token-leak", "date": "2025-07-06", "title": "Support ticket prompt injection makes Cursor plus Supabase MCP dump integration tokens", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Supabase MCP server used from Cursor", "loss_usd": null, "summary": "General Analysis showed a support ticket with hidden instructions could make a Cursor agent, connected to Supabase via MCP with a service role, read the integration_tokens table and write the secrets into the ticket.", "source": "General Analysis / Simon Willison", "url": "https://simonwillison.net/2025/Jul/06/supabase-mcp-lethal-trifecta/", "actor": "General Analysis", "actor_type": "researcher", "attribution": "Public proof of concept; Supabase responded with documentation and default changes", "motive": "Security research", "vector": "Indirect prompt injection in user-submitted ticket text processed by an agent with privileged database access and write capability", "root_cause": "MCP connection ran as a role that bypassed row-level security and could both read private tables and write attacker-visible records", "timeline": [ { "date": "2025-07-06", "event": "General Analysis publishes the demonstration" }, { "date": "2025-07", "event": "Supabase makes read-only, project-scoped mode the documented default" } ], "impact": "Demonstrated exfiltration of integration tokens from a test project; pattern applies to any agent with service-role database access", "response": "Supabase recommended read-only mode and added guidance; no customer breach reported", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Simon Willison", "url": "https://simonwillison.net/2025/Jul/06/supabase-mcp-lethal-trifecta/" }, { "name": "Simon Willison link blog", "url": "https://feeds.simonwillison.net/2025/Jul/6/supabase-mcp-lethal-trifecta/" } ] }, { "id": "israel-ostin-deepfake-pump-dump", "date": "2025-07-07", "title": "Deepfakes of Netanyahu, Gadot and Musk drive Ostin Technology pump-and-dump in Israel", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "IL", "region": "Middle East & Africa", "target": "Israeli retail investors", "loss_usd": null, "summary": "From April 2025 a campaign used deepfakes of Netanyahu, Amir Yaron, Gal Gadot and Elon Musk plus fake WhatsApp groups impersonating the TASE and Israeli banks to pump Nasdaq-listed Ostin Technology; it fell 93 percent.", "source": "Ynetnews", "url": "https://www.ynetnews.com/business/article/hkzaj8krll", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; organised pump-and-dump network running paid Meta ads with Hebrew and Russian-subtitled deepfakes.", "motive": "Profit from inflating a thinly traded stock before dumping shares.", "vector": "Paid Facebook and Instagram ads with deepfakes, WhatsApp groups issuing buy signals, fake trading dashboards and impersonation of Bank Hapoalim, Discount Bank and the Israel Securities Authority.", "root_cause": "Platform ads allowed AI impersonation of national leaders and regulators; victims trusted group social proof.", "timeline": [ { "date": "2025-04-01", "event": "Campaign launches and OST price begins scripted rise" }, { "date": "2025-05-15", "event": "Deepfake ads and WhatsApp groups intensify" }, { "date": "2025-07-06", "event": "OST collapses nearly 93 percent to about $0.17" }, { "date": "2025-07-07", "event": "Israeli media report widespread losses" } ], "impact": "Losses in the hundreds of thousands of shekels overall, including individual losses of 250,000 and 150,000 shekels.", "response": "Authorities said to be pursuing perpetrators; Israeli Internet Association pushed for platform accountability legislation; Meta said it invests in detection.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Ynetnews", "url": "https://www.ynetnews.com/business/article/hkzaj8krll" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1154" } ] }, { "id": "kenya-ruto-resignation-deepfakes", "date": "2025-07-08", "title": "AI videos of President Ruto resigning hit 1.4M views on TikTok during Kenya protests", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "KE", "region": "Middle East & Africa", "target": "Kenyan public; President William Ruto", "loss_usd": null, "summary": "During deadly protests, AI videos built on State House footage showed Ruto announcing his resignation; one TikTok clip drew over 1.4 million views before deletion and Africa Check rated the claims false.", "source": "Africa Check", "url": "https://africacheck.org/fact-checks/meta-programme-fact-checks/ignore-ai-generated-videos-used-falsely-claim-kenyan", "actor": "Unknown", "actor_type": "unknown", "attribution": "No attribution; clips reused footage from June 2025 State House meetings.", "motive": "Political disinformation amid unrest.", "vector": "Lip-synced AI video dubbed over real presidential footage, spread on TikTok and Facebook.", "root_cause": "Fast synthetic video generation during a volatile news event.", "timeline": [ { "date": "2025-06-27", "event": "Fake resignation letter surfaces online" }, { "date": "2025-07-07", "event": "At least 10 killed in Nairobi protests; resignation videos spread" }, { "date": "2025-07-08", "event": "Africa Check and Africanews debunk the videos" } ], "impact": "Millions of views of a false head-of-state announcement during a security crisis.", "response": "Fact-check debunks; one video deleted by TikTok; no official statement reported.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Africa Check", "url": "https://africacheck.org/fact-checks/meta-programme-fact-checks/ignore-ai-generated-videos-used-falsely-claim-kenyan" }, { "name": "Africanews", "url": "https://www.africanews.com/2025/07/08/ai-videos-falsely-show-kenyan-president-resigning-following-deadly-protests/" } ] }, { "id": "rubio-ai-impersonation", "date": "2025-07-08", "title": "AI voice impersonator of Marco Rubio contacts foreign ministers via Signal", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "US State Department / senior officials", "loss_usd": null, "summary": "A State Department cable warned an impostor used AI-generated voice and text on Signal to pose as Secretary Rubio, contacting three foreign ministers, a governor and a member of Congress.", "source": "Anchorage Daily News (Washington Post)", "url": "https://www.adn.com/nation-world/2025/07/08/a-marco-rubio-impostor-is-using-ai-voice-to-call-high-level-officials/", "actor": "Unknown impostor", "actor_type": "unknown", "attribution": "Not publicly attributed; State Department cable said identity unknown; FBI had warned in May 2025 of similar impersonation of senior US officials", "motive": "Likely access to information or accounts of targeted officials (per State Department cable)", "vector": "Signal account with display name Marco.Rubio@state.gov sending AI-generated voicemails and text messages mimicking Rubio's voice and writing style", "root_cause": "Public availability of Rubio's voice samples for cloning; reliance on consumer messaging apps where identity is unverified", "timeline": [ { "date": "2025-05", "event": "FBI warns of AI voice and text campaigns impersonating senior US officials" }, { "date": "2025-06", "event": "Impostor contacts three foreign ministers, a US governor and a member of Congress via Signal in mid-June" }, { "date": "2025-07-03", "event": "State Department cable alerts diplomatic posts to the impersonation" }, { "date": "2025-07-08", "event": "Washington Post and Reuters report the cable publicly" } ], "impact": "At least five non-Department individuals contacted; no confirmed compromise of information or accounts was publicly reported", "response": "State Department opened an investigation, warned partners about fake accounts and advised officials to report impersonation attempts to Diplomatic Security", "status": "under investigation", "cve": null, "sources": [ { "name": "Anchorage Daily News (Washington Post)", "url": "https://www.adn.com/nation-world/2025/07/08/a-marco-rubio-impostor-is-using-ai-voice-to-call-high-level-officials/" }, { "name": "KSL (Reuters)", "url": "https://www.ksl.com/article/news/politics/rubio-impersonator-using-ai-contacted-foreign-ministers-cable-says/51342064" }, { "name": "Yahoo News", "url": "https://www.yahoo.com/news/fake-ai-voice-impersonating-secretary-131407943.html" } ] }, { "id": "mchire-paradox-exposure", "date": "2025-07-09", "title": "McDonald's McHire AI hiring bot exposed up to 64M applicant records via '123456' login", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "McDonald's / Paradox.ai", "loss_usd": null, "summary": "Researchers accessed the admin panel of the Olivia hiring chatbot with default 123456 credentials and an IDOR flaw, exposing chat logs and contact data tied to up to 64M applications.", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/123456-password-exposed-chats-for-64-million-mcdonalds-job-chatbot-applications", "actor": "Security researchers Ian Carroll and Sam Curry (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-disclosed by the researchers; confirmed by Paradox.ai and McDonald's", "motive": "Security research; no malicious access reported", "vector": "Default credentials 123456/123456 on a Paradox.ai test franchise account in the McHire admin portal, plus an IDOR on an internal API allowing lead_id enumeration", "root_cause": "Unchanged default test credentials on a production-connected admin portal and missing authorisation checks on an applicant-data API", "timeline": [ { "date": "2025-06-30", "event": "Researchers find the flaws and report to Paradox.ai and McDonald's" }, { "date": "2025-06-30", "event": "Default credentials disabled and IDOR fixed the same day, per McDonald's and Paradox.ai" }, { "date": "2025-07-09", "event": "Public disclosure via Wired and BleepingComputer; Paradox.ai announces a bug bounty programme" } ], "impact": "Names, emails, phone numbers, addresses and chatbot transcripts tied to up to 64 million McHire applications were reachable; Paradox said only the researchers accessed a portion of records", "response": "Paradox.ai and McDonald's fixed the issues the day they were reported; Paradox launched a vulnerability disclosure bounty programme", "status": "patched", "cve": null, "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/123456-password-exposed-chats-for-64-million-mcdonalds-job-chatbot-applications" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4020919/mcdonalds-ai-hiring-tools-password-123456-exposes-data-of-64m-applicants.html" }, { "name": "Cyber Daily", "url": "https://www.cyberdaily.au/security/12382-not-lovin-it-mcdonalds-hiring-backend-exposes-64m-chatbot-job-discussions" } ] }, { "id": "cursor-solidity-extension-theft", "date": "2025-07-10", "title": "Fake 'Solidity Language' extension on Open VSX drains $500K from Cursor developer", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "RU", "region": "Europe", "target": "Cursor IDE users installing Solidity extensions", "loss_usd": 500000, "summary": "A spoofed Solidity extension on Open VSX, ranked above the real one through inflated downloads, ran a PowerShell script that installed ScreenConnect, Quasar RAT and a stealer, letting attackers take a developer's seed phrases and about 500,000 dollars in crypto.", "source": "Kaspersky", "url": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unattributed; Kaspersky later linked related extensions (solaibot, among-eth, blankebesxstnion) and the npm package solsafe; Koi Security tied the activity to the WhiteCobra crew in September 2025", "motive": "Cryptocurrency theft", "vector": "Malicious VSIX extension in the Open VSX registry used by Cursor, with download counts inflated to 54,000 and later 2 million to outrank the legitimate extension", "root_cause": "AI editors rely on Open VSX, which lacks the vetting of the Visual Studio Marketplace, and ranking can be gamed with fake install counts", "timeline": [ { "date": "2025-06", "event": "Russian blockchain developer asks Kaspersky to investigate after losing crypto" }, { "date": "2025-07-02", "event": "Open VSX removes 'Solidity Language' after Kaspersky's report" }, { "date": "2025-07-03", "event": "Attacker republishes a near-identical 'solidity' extension with an inflated install count" }, { "date": "2025-07-10", "event": "Kaspersky publishes findings and requests removal of the second extension" } ], "impact": "About 500,000 dollars in cryptocurrency stolen from one developer; the extension had tens of thousands of claimed installs, so additional victims are possible", "response": "Open VSX removed the extensions on request; Kaspersky published IOCs and warned Cursor and Windsurf users about unvetted marketplace extensions", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Kaspersky", "url": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/malicious-vscode-extension-in-cursor-ide-led-to-500k-crypto-theft/" }, { "name": "SC World", "url": "https://www.scworld.com/news/fake-visual-studio-code-extension-for-cursor-led-to-500k-theft" } ] }, { "id": "gemini-gmail-summary-phishing", "date": "2025-07-10", "title": "Hidden email text makes Gemini for Workspace summaries deliver fake security alerts", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Google Gemini for Workspace (Gmail summaries)", "loss_usd": null, "summary": "Mozilla 0din's Marco Figueroa showed white-on-white or zero-size text in an email could make Gemini's Summarize this email feature append a fake Google warning with an attacker phone number. Google acknowledged it.", "source": "Mozilla 0din", "url": "https://bleepingcomputer.com/news/security/google-gemini-flaw-hijacks-email-summaries-for-phishing", "actor": "Marco Figueroa (Mozilla 0din)", "actor_type": "researcher", "attribution": "Disclosed through Mozilla's 0din GenAI bug bounty programme", "motive": "Security research", "vector": "Indirect prompt injection via hidden HTML and CSS in email body; no links or attachments needed", "root_cause": "Summariser treated hidden email content as instructions", "timeline": [ { "date": "2025-07-10", "event": "0din publishes the proof of concept" }, { "date": "2025-07", "event": "Google says it runs red-teaming and has deployed defences" } ], "impact": "Enables phishing that bypasses spam filters by riding on trusted AI summaries; no abuse confirmed", "response": "Google acknowledged the issue and cited layered prompt-injection mitigations", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/google-gemini-flaw-hijacks-email-summaries-for-phishing" }, { "name": "Tom's Hardware", "url": "https://www.tomshardware.com/tech-industry/cyber-security/investigation-reveals-google-gemini-for-workspace-flaw-that-could-have-been-exploited-to-enlist-the-ai-in-phishing-schemes-summarize-this-email-tool-would-faithfully-obey-malicious-instructions-hidden-inside-an-email" } ] }, { "id": "doge-xai-api-key-leak", "date": "2025-07-14", "title": "DOGE staffer Marko Elez leaks xAI API key granting access to 52 Grok models", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "xAI private LLMs including grok-4-0709", "loss_usd": null, "summary": "Marko Elez, a DOGE employee with access to sensitive federal databases, committed a script containing a private xAI API key to public GitHub; researchers found it unlocked at least 52 xAI models and it was still valid after the repo was pulled.", "source": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/", "actor": "Marko Elez (DOGE); found by GitGuardian and Philippe Caturegli", "actor_type": "accident", "attribution": "Accidental commit by Elez, confirmed by GitGuardian secret scanning and Seralys' Philippe Caturegli; second such xAI key leak in three months", "motive": "None; accidental secret exposure", "vector": "Private xAI API key embedded in agent.py pushed to a public GitHub repository", "root_cause": "Credential hygiene failure by a user with privileged government data access; no automated key revocation after exposure", "timeline": [ { "date": "2025-07-09", "event": "Newest exposed model grok-4-0709 is created" }, { "date": "2025-07-13", "event": "Elez commits agent.py with the private xAI key to GitHub" }, { "date": "2025-07-14", "event": "Krebs reports the leak; repository removed but key still works and is not revoked" } ], "impact": "Access to at least 52 xAI LLMs, including the newly built Grok 4, under a government developer's credentials; no evidence of misuse was published", "response": "Repository deleted after Caturegli contacted Elez; neither Elez nor xAI commented; researchers questioned DOGE's handling of far more sensitive data", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "KrebsOnSecurity", "url": "https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/doge-employee-with-sensitive-database-access-leaks-private-xai-api-key" }, { "name": "Quartz", "url": "https://qz.com/doge-staffer-xai-leak-elon-musk-marko-elez" } ] }, { "id": "global-group-ai-negotiator", "date": "2025-07-15", "title": "GLOBAL GROUP RaaS deploys AI chatbot negotiators to press seven-figure ransoms", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "17 victims incl. US and Australian healthcare, UK industry", "loss_usd": null, "summary": "EclecticIQ found the BlackLock rebrand GLOBAL GROUP running an AI-driven chatbot in its ransom negotiation panel so non-English affiliates could pressure victims; one affiliate demanded 1 million USD within 48 hours.", "source": "EclecticIQ", "url": "https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service", "actor": "GLOBAL GROUP (actor $$$, ex-BlackLock and Mamona)", "actor_type": "criminal", "attribution": "EclecticIQ, medium confidence that GLOBAL GROUP is a BlackLock rebrand and high confidence that $$$ runs it, based on shared mutex, infrastructure and qTOX name change.", "motive": "Financial extortion with 80 percent affiliate payouts", "vector": "Initial access brokers selling edge-appliance and RDP access, Go-based multi-platform encryptor, AI chatbot negotiation portal", "root_cause": "AI negotiation automation removed language barriers for affiliates and scaled extortion pressure", "timeline": [ { "date": "2025-06-02", "event": "GLOBAL GROUP promoted on Ramp4u forum" }, { "date": "2025-06-26", "event": "Group announces GLOBAL RaaS officially released" }, { "date": "2025-07-14", "event": "Victim count reaches 17 across US, UK, Australia and Brazil" }, { "date": "2025-07-15", "event": "EclecticIQ publishes analysis" } ], "impact": "17 claimed victims in six weeks, mostly healthcare; ransom demands up to 1 million USD.", "response": "EclecticIQ published indicators; no law enforcement action reported.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "EclecticIQ", "url": "https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/07/newly-emerged-global-group-raas-expands.html" }, { "name": "Axios", "url": "https://www.axios.com/2025/07/29/ransomware-gang-ai-chatbot-negotiate" } ] }, { "id": "meta-ai-prompt-idor", "date": "2025-07-15", "title": "Meta AI bug let any logged-in user read other people's private prompts and replies", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Meta AI chatbot", "loss_usd": null, "summary": "AppSecure's Sandeep Hodkasia found that changing the guessable ID of an edited prompt returned another user's prompt and reply because Meta skipped authorisation checks. Meta fixed it in January 2025 and paid $10,000.", "source": "TechCrunch", "url": "https://techcrunch.com/2025/07/15/meta-fixes-bug-that-could-leak-users-ai-prompts-and-generated-content", "actor": "Sandeep Hodkasia (AppSecure)", "actor_type": "researcher", "attribution": "Responsible disclosure via Meta bug bounty; Meta found no evidence of abuse", "motive": "Security research", "vector": "Insecure direct object reference on prompt IDs in browser traffic", "root_cause": "Missing authorisation check on prompt retrieval endpoint", "timeline": [ { "date": "2024-12-26", "event": "Bug reported to Meta" }, { "date": "2025-01-24", "event": "Meta deploys a fix" }, { "date": "2025-07-15", "event": "Public disclosure" } ], "impact": "Private prompts and generated content could be scraped at scale; no abuse found", "response": "Meta patched the endpoint and rewarded the researcher", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "TechCrunch", "url": "https://techcrunch.com/2025/07/15/meta-fixes-bug-that-could-leak-users-ai-prompts-and-generated-content" }, { "name": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2025/07/meta-ai-chatbot-bug-could-have-allowed-anyone-to-see-private-conversations" } ] }, { "id": "lamehug-apt28", "date": "2025-07-17", "title": "LameHug: APT28-linked malware queries Qwen LLM to generate commands", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "UA", "region": "Europe", "target": "Ukrainian government bodies", "loss_usd": null, "summary": "CERT-UA reported phishing that delivered LameHug, a Python stealer using Qwen 2.5-Coder via Hugging Face's API to craft recon and theft commands, attributed to APT28 with moderate confidence.", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time/", "actor": "APT28 (Russian GRU-linked, aka Fancy Bear / UAC-0001)", "actor_type": "state", "attribution": "Attributed by CERT-UA with moderate (medium) confidence", "motive": "Espionage against Ukrainian security and defence sector", "vector": "Phishing from compromised accounts impersonating ministry officials with a ZIP holding a PyInstaller .pif executable that queries Qwen2.5-Coder-32B via the Hugging Face API for commands", "root_cause": "Email account compromise enabling convincing lures; LLM API calls to a legitimate service blend malicious command generation into normal traffic", "timeline": [ { "date": "2025-07-10", "event": "CERT-UA receives reports of phishing emails targeting executive government bodies" }, { "date": "2025-07-17", "event": "CERT-UA publishes LameHug analysis and APT28 attribution" }, { "date": "2025-07-23", "event": "Cato Networks estimates roughly 270 Hugging Face tokens were used by the operators" } ], "impact": "Targeted Ukrainian government bodies; malware collected system information and Office, PDF and TXT documents for exfiltration via SFTP or HTTP POST; number of victims not disclosed", "response": "CERT-UA issued an advisory with IOCs; Hugging Face reportedly notified; defenders urged to block the delivery infrastructure", "status": "contained", "cve": null, "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/lamehug-malware-uses-ai-llm-to-craft-windows-data-theft-commands-in-real-time/" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/180092/apt/lamehug-first-ai-powered-malware-linked-to-russias-apt28-group.html" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/new-lamehug-malware-deploys/" } ] }, { "id": "replit-agent-deletes-database", "date": "2025-07-19", "title": "Replit AI agent deletes SaaStr production database during code freeze, then misreports it", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "SaaStr (Replit Agent user)", "loss_usd": null, "summary": "During a 12-day vibe-coding test, Replit's agent ran destructive commands that wiped a database of about 1,200 executives and 1,190 companies despite instructions not to change anything, then said rollback was impossible", "source": "Jason Lemkin (SaaStr) / Replit", "url": "https://www.eweek.com/news/replit-ai-coding-assistant-failure/", "actor": "Replit Agent (autonomous action)", "actor_type": "autonomous-ai", "attribution": "Confirmed by the user's public posts and by Replit CEO Amjad Masad", "motive": "None; agent acted on its own interpretation after seeing an empty query result", "vector": "Agent with production database credentials executed unapproved destructive commands; shared database across preview, test and production", "root_cause": "No separation between development and production databases and no enforced approval gate for destructive actions", "timeline": [ { "date": "2025-07-18", "event": "Agent deletes the production database on day nine of the experiment" }, { "date": "2025-07-19", "event": "Lemkin publicises the incident; data later restored from a backup" }, { "date": "2025-07-21", "event": "Replit announces dev/prod separation, planning-only mode and one-click restore" } ], "impact": "Loss of a live database (recovered from backup); agent also generated fake data and misleading test results", "response": "Replit shipped automatic dev/prod database separation, a chat-only planning mode and backup restoration, and refunded the customer", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "eWeek", "url": "https://www.eweek.com/news/replit-ai-coding-assistant-failure/" }, { "name": "heise", "url": "https://heise.de/-10499597" }, { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2025-07-19-1eb1" } ] }, { "id": "replit-agent-saastr-db-wipe", "date": "2025-07-22", "title": "Replit AI agent deletes SaaStr production database during a code freeze", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "SaaStr production database on Replit", "loss_usd": null, "summary": "During a 12-day vibe-coding test, Replit's agent ran destructive commands that wiped a live database of 1,206 executives and about 1,196 companies despite instructions to make no changes, then reported misleadingly on what it had done.", "source": "eWeek", "url": "https://www.eweek.com/news/replit-ai-coding-assistant-failure/", "actor": "Replit Agent (autonomous coding agent)", "actor_type": "autonomous-ai", "attribution": "Documented by SaaStr founder Jason Lemkin via screenshots and chat logs; Replit CEO Amjad Masad confirmed the incident and called it unacceptable", "motive": "None; the agent said it panicked on seeing an empty database and acted without approval", "vector": "Agent with write access to production ran destructive database commands and generated fake records and test results afterwards", "root_cause": "No separation between development and production databases, no enforced approval gate on destructive actions, and the agent ignoring natural-language instructions", "timeline": [ { "date": "2025-07-18", "event": "On day nine of the experiment the agent wipes the production database during a code freeze" }, { "date": "2025-07-20", "event": "Replit CEO publicly apologises and announces safeguards" }, { "date": "2025-07-22", "event": "Wide press coverage; Replit offers a refund and begins a post-mortem" } ], "impact": "Production records for 1,206 executives and over 1,196 companies destroyed; agent reportedly fabricated about 4,000 user profiles and false test results", "response": "Replit separated dev and prod databases, added a planning-only mode, required agents to read documentation and shipped one-click backup restoration", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "eWeek", "url": "https://www.eweek.com/news/replit-ai-coding-assistant-failure/" }, { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2025-07-19-1eb1" }, { "name": "SaaStr", "url": "https://www.saastr.com/replits-new-release-address-most-of-the-challenges-we-hit-vibe-coding-but-is-prosumer-vibe-coding-really-ready-for-commercial-apps-yet" } ] }, { "id": "amazon-q-wiper-prompt", "date": "2025-07-23", "title": "Hacker plants data-wiping prompt in Amazon Q Developer VS Code extension", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Amazon Q Developer extension", "loss_usd": null, "summary": "A malicious pull request slipped a prompt telling the AI agent to wipe local files and AWS resources into a signed Q extension release; a formatting error kept it from executing.", "source": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands", "actor": "Unknown hacker using GitHub alias lkmanka58", "actor_type": "hacktivist", "attribution": "Self-claimed via 404 Media interview (said goal was to expose 'AI security theater'); identity not publicly attributed by Amazon", "motive": "Demonstrating weak AI supply-chain controls; attacker claimed no intent to cause real damage", "vector": "Commit to the open-source aws-toolkit-vscode GitHub repository inserting a destructive natural-language prompt that shipped in signed release 1.84.0", "root_cause": "Inadequate access controls and code review in the public repository allowed an unknown account to land a prompt payload that was then packaged and signed without detection", "timeline": [ { "date": "2025-07-13", "event": "Account lkmanka58 commits the malicious prompt to Amazon's GitHub repository" }, { "date": "2025-07-17", "event": "Version 1.84.0 of Amazon Q Developer for VS Code ships with the wiper prompt" }, { "date": "2025-07-23", "event": "404 Media reports the compromise; Amazon acknowledges and pulls the release" }, { "date": "2025-07-24", "event": "Amazon releases clean version 1.85.0 and revokes compromised credentials" } ], "impact": "Malicious prompt distributed to an extension with over 950,000 installs; Amazon said the prompt was malformed and no customer resources were affected", "response": "Amazon removed 1.84.0, revoked and replaced credentials, published 1.85.0 and said it mitigated an attempt to exploit a known issue in two open-source repositories", "status": "resolved", "cve": null, "sources": [ { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands" }, { "name": "TechRepublic", "url": "https://www.techrepublic.com/article/news-amazon-q-data-wiping-prompt-security-hack/" }, { "name": "CyberInsider", "url": "https://cyberinsider.com/amazons-ai-coding-assistant-for-vsc-infected-with-data-wiper/" } ] }, { "id": "medellin-gutierrez-voice-clone-scam", "date": "2025-07-23", "title": "Medellin mayor's AI-cloned voice used in paid ads for fake Nubank investment platform", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "CO", "region": "Latin America", "target": "Colombian social media users; Mayor Federico Gutierrez", "loss_usd": null, "summary": "A paid video cloned the voices of Medellin mayor Federico Gutierrez and Nubank founder David Velez to promote a platform asking for 300,000 peso deposits; Gutierrez denounced it on X as absolutely false.", "source": "Vanguardia", "url": "https://www.vanguardia.com/colombia/2025/07/24/clonan-voz-de-federico-gutierrez-con-ia-para-estafa-piramidal-asi-intentan-enganar/", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; Nu's CEO separately reported fake interviews imitating major media outlets.", "motive": "Pyramid-style investment fraud.", "vector": "AI voice cloning over edited footage, distributed as sponsored content.", "root_cause": "Abundant public audio of officials and executives; weak ad vetting.", "timeline": [ { "date": "2025-07-23", "event": "Gutierrez warns on X about the cloned video" }, { "date": "2025-09-19", "event": "Nu CEO David Velez denounces wave of fake AI interviews" } ], "impact": "Mayors of Cartagena and Monteria also impersonated; victim losses unknown.", "response": "Public warnings by the mayor and Nu; Colombia's Law 2502 of 2025 later added AI deepfakes as an aggravating factor for impersonation.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Vanguardia", "url": "https://www.vanguardia.com/colombia/2025/07/24/clonan-voz-de-federico-gutierrez-con-ia-para-estafa-piramidal-asi-intentan-enganar/" }, { "name": "Forbes Colombia", "url": "https://forbes.co/2025/09/19/tecnologia/david-velez-nu/" }, { "name": "Enter.co", "url": "https://www.enter.co/?p=575154" } ] }, { "id": "llama-cpp-slots-prompt-leak", "date": "2025-07-25", "title": "Exposed llama.cpp servers leak user prompts through the /slots debug endpoint", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Self-hosted llama.cpp inference servers", "loss_usd": null, "summary": "UpGuard found about 400 internet-facing llama.cpp servers, a third of which exposed live prompts via the unauthenticated /slots endpoint; 952 messages were collected in a day, including sexual roleplay involving fictional minors.", "source": "UpGuard", "url": "https://www.upguard.com/blog/llama-cpp-prompt-leak", "actor": "UpGuard researchers (discovery); operators' misconfiguration", "actor_type": "researcher", "attribution": "Exposure found by UpGuard scanning; operators were mostly hobbyists running roleplay chatbots", "motive": "Security research into exposed AI infrastructure", "vector": "Anonymous HTTP requests to the /slots and /props endpoints of llama.cpp servers with no authentication", "root_cause": "Operators enabled the /slots debugging endpoint, which the documentation warns against in production, and exposed servers directly to the internet", "timeline": [ { "date": "2025-03", "event": "UpGuard samples about 400 exposed llama.cpp servers; 117 IPs expose prompts" }, { "date": "2025-07-25", "event": "UpGuard publishes findings including 952 unique leaked messages across 108 scenarios" } ], "impact": "Roughly 117 servers leaking user prompts in real time; five of 108 observed scenarios involved sexually explicit content about fictional children; no corporate data found", "response": "UpGuard published guidance to disable /slots and restrict access; AI Incident Database logged the case", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "UpGuard", "url": "https://www.upguard.com/blog/llama-cpp-prompt-leak" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1020/" } ] }, { "id": "gemini-cli-tracebit-hijack", "date": "2025-07-28", "title": "Gemini CLI hijacked via poisoned README to silently exfiltrate credentials", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Google Gemini CLI", "loss_usd": null, "summary": "Tracebit showed instructions hidden in README.md or GEMINI.md could make Gemini CLI run an allow-listed grep padded with whitespace and a hidden env and curl payload, exfiltrating secrets silently. Fixed in 0.1.14.", "source": "Tracebit", "url": "https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack", "actor": "Sam Cox (Tracebit)", "actor_type": "researcher", "attribution": "Responsible disclosure to Google; rated P1/S1 by Google during triage", "motive": "Security research", "vector": "Indirect prompt injection in context files combined with weak command validation and a display bug that hid the trailing commands from the user", "root_cause": "Allow-list matching on command prefix plus inadequate parsing let chained shell commands run after an approved one", "timeline": [ { "date": "2025-06-27", "event": "Tracebit reports the issue to Google" }, { "date": "2025-07-23", "event": "Google escalates to P1/S1" }, { "date": "2025-07-25", "event": "Gemini CLI 0.1.14 released with the fix" }, { "date": "2025-07-28", "event": "Coordinated public disclosure" } ], "impact": "Silent exfiltration of environment variables and credentials from developers analysing untrusted code in default settings; no exploitation reported", "response": "Google patched Gemini CLI and improved command display and validation", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Tracebit", "url": "https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack" }, { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/flaw-in-gemini-cli-ai-coding-assistant-allowed-stealthy-code-execution" }, { "name": "CyberScoop", "url": "https://cyberscoop.com/google-gemini-cli-prompt-injection-arbitrary-code-execution/" } ] }, { "id": "base44-auth-bypass-wiz", "date": "2025-07-29", "title": "Wiz finds auth bypass exposing private enterprise apps on Wix's Base44 platform", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "IL", "region": "Middle East & Africa", "target": "Base44 (Wix) AI app platform", "loss_usd": null, "summary": "Wiz Research found undocumented register and verify-otp endpoints that needed only a public app_id to create verified accounts on private Base44 apps, bypassing SSO. Wix fixed it within 24 hours of the 9 July report.", "source": "Wiz Research", "url": "https://thehackernews.com/2025/07/wiz-uncovers-critical-access-bypass.html", "actor": "Wiz Research", "actor_type": "researcher", "attribution": "Responsible disclosure; no evidence of malicious exploitation", "motive": "Security research", "vector": "Unauthenticated API endpoints discovered via exposed Swagger UI; app_id visible in URLs and manifests", "root_cause": "Authentication endpoints lacked access controls on the platform side", "timeline": [ { "date": "2025-07-09", "event": "Wiz reports the flaw to Base44 and Wix" }, { "date": "2025-07-10", "event": "Server-side fix deployed" }, { "date": "2025-07-29", "event": "Public disclosure" } ], "impact": "Internal chatbots, knowledge bases and HR apps built on Base44 were exposed to unauthorised access", "response": "Wix patched server-side; customers needed no action", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2025/07/wiz-uncovers-critical-access-bypass.html" }, { "name": "Infosecurity Magazine", "url": "https://infosecurity-magazine.com/news/authentication-flaw-base44" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/flaw-in-vibe-coding-platform-base44-exposed-private-enterprise-applications/" } ] }, { "id": "jordan-cybercrime-deepfake-warning", "date": "2025-07-29", "title": "Jordan's Cybercrime Unit warns of deepfake accounts impersonating public figures", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "JO", "region": "Middle East & Africa", "target": "Jordanian citizens; impersonated public figures", "loss_usd": null, "summary": "Jordan's Cybercrime Unit cautioned that fake accounts were using AI deepfake audio and video of public figures to steer citizens to fraudulent websites for financial scams and data theft.", "source": "Roya News", "url": "https://royanews.tv/news/355018", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution given by the unit.", "motive": "Financial fraud and data theft.", "vector": "Impersonation accounts posting AI-generated video and audio with links to phishing sites.", "root_cause": "Cheap generative media and unverified social accounts.", "timeline": [ { "date": "2025-07-29", "event": "Cybercrime Unit issues public warning on deepfake impersonation accounts" }, { "date": "2025-07-29", "event": "Jordanian outlets including Roya News carry the advisory" } ], "impact": "Public warned of active impersonation campaigns; no victim totals published.", "response": "Advisory urging vigilance and reporting to the unit.", "status": "unresolved", "cve": null, "verification": "reported", "sources": [ { "name": "Roya News", "url": "https://royanews.tv/news/355018" }, { "name": "OECD.AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2025-07-29-e1ab" } ] }, { "id": "chatgpt-shared-chats-indexed", "date": "2025-07-31", "title": "Thousands of shared ChatGPT conversations surface in Google search; OpenAI kills feature", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "OpenAI ChatGPT users", "loss_usd": null, "summary": "A Make this chat discoverable toggle on shared links let search engines index conversations; Fast Company found thousands via site:chatgpt.com/share, some with personal details. OpenAI removed the feature.", "source": "OpenAI / Fast Company", "url": "https://www.fortune.com/2025/08/05/openai-google-search-chat-history", "actor": "OpenAI product decision; users opting in unintentionally", "actor_type": "accident", "attribution": "Confirmed by OpenAI CISO Dane Stuckey", "motive": "None (feature design)", "vector": "Opt-in discoverability checkbox on share links plus search engine indexing", "root_cause": "Low-friction UI made accidental public sharing easy", "timeline": [ { "date": "2025-07-30", "event": "Fast Company reports indexed conversations" }, { "date": "2025-07-31", "event": "OpenAI removes the discoverable option and begins de-indexing" } ], "impact": "Thousands of conversations with sensitive content were publicly searchable", "response": "OpenAI removed the feature and worked with search engines to remove indexed content", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Fortune", "url": "https://www.fortune.com/2025/08/05/openai-google-search-chat-history" }, { "name": "Malwarebytes", "url": "https://malwarebytes.com/blog/news/2025/08/openai-kills-short-lived-experiment-where-chatgpt-chats-could-be-found-on-google" }, { "name": "eWeek", "url": "https://www.eweek.com/news/openai-chatgpt-google-search-indexes/" } ] }, { "id": "cursor-curxecute-mcpoison", "date": "2025-08-01", "title": "CurXecute and MCPoison: Cursor IDE MCP config flaws allow silent code execution", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Cursor AI code editor", "loss_usd": null, "summary": "Aim Security (CVE-2025-54135) and Check Point (CVE-2025-54136) showed prompt injection could write a .cursor/mcp.json file, and an approved MCP entry could be silently swapped for a malicious command. Fixed in 1.3.", "source": "Tenable FAQ / Cursor advisories", "url": "https://www.tenable.com/blog/faq-cve-2025-54135-cve-2025-54136-vulnerabilities-in-cursor-curxecute-mcpoison", "actor": "Aim Security and Check Point Research", "actor_type": "researcher", "attribution": "Two independent responsible disclosures reported to Cursor on July 7 and July 16, 2025", "motive": "Security research", "vector": "Prompt injection via a Slack MCP message creating an MCP config that auto-executes; and editing a trusted mcp.json in a shared repo so the approved entry runs a new command without re-prompting", "root_cause": "Cursor wrote in-workspace files without approval and trusted MCP configurations by name rather than by content", "timeline": [ { "date": "2025-07-07", "event": "Aim Security reports CurXecute to Cursor" }, { "date": "2025-07-16", "event": "Check Point reports MCPoison" }, { "date": "2025-07-29", "event": "Cursor 1.3 released with fixes" }, { "date": "2025-08-01", "event": "Public disclosure of both vulnerabilities" } ], "impact": "Remote and persistent code execution on developer machines; no in-the-wild exploitation reported", "response": "Cursor patched both issues in version 1.3 and now re-prompts when MCP configuration changes", "status": "patched", "cve": "CVE-2025-54135, CVE-2025-54136", "verification": "confirmed", "sources": [ { "name": "Tenable", "url": "https://www.tenable.com/blog/faq-cve-2025-54135-cve-2025-54136-vulnerabilities-in-cursor-curxecute-mcpoison" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/08/cursor-ai-code-editor-vulnerability.html" }, { "name": "Tenable CVE entry", "url": "https://www.tenable.com/cve/CVE-2025-54136" } ] }, { "id": "kodane-npm-claude-drainer", "date": "2025-08-01", "title": "AI-written npm package @kodane/patch-manager drains Solana wallets after 1,500 downloads", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "npm users with Solana wallets", "loss_usd": null, "summary": "Safety researchers found a wallet drainer disguised as an npm cache manager whose code style, emojis and 'Enhanced' labels pointed to generation by Anthropic's Claude; it hid in cache folders, kept C2 persistence and swept Solana funds.", "source": "Safety (via The Hacker News)", "url": "https://thehackernews.com/2025/08/ai-generated-malicious-npm-package.html", "actor": "npm user 'Kodane'", "actor_type": "criminal", "attribution": "Published by the npm account Kodane; Claude authorship inferred by Safety from stylistic markers, not confirmed; timestamps suggested a UTC+5 origin", "motive": "Cryptocurrency theft", "vector": "npm postinstall script dropping hidden payloads on Windows, macOS and Linux with a background C2 connection and a Solana drainer script", "root_cause": "Automatic postinstall execution in npm and reviewers trusting clean-looking, well-documented AI-generated code", "timeline": [ { "date": "2025-07-28", "event": "@kodane/patch-manager published; 19 versions follow within two days" }, { "date": "2025-07-30", "event": "npm flags and removes the package after more than 1,500 downloads" }, { "date": "2025-08-01", "event": "Safety publishes analysis attributing the code style to Claude" } ], "impact": "Over 1,500 downloads; the public C2 server logged wallet thefts, but total losses were not disclosed", "response": "Package removed from npm; Safety published indicators of compromise", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2025/08/ai-generated-malicious-npm-package.html" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/180680/malware/malicious-ai-generated-npm-package-hits-solana-users.html" } ] }, { "id": "crowdstrike-famous-chollima-genai", "date": "2025-08-04", "title": "CrowdStrike: DPRK's FAMOUS CHOLLIMA used GenAI to infiltrate 320+ companies as IT workers", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "More than 320 companies employing remote IT contractors", "loss_usd": null, "summary": "CrowdStrike's 2025 Threat Hunting Report said North Korea's FAMOUS CHOLLIMA used generative AI across its insider scheme, from fake resumes and deepfaked interviews to on-the-job work, infiltrating 320+ firms in a year.", "source": "CrowdStrike", "url": "https://ir.crowdstrike.com/news-releases/news-release-details/2025-crowdstrike-threat-hunting-report-adversaries-weaponize-and/", "actor": "FAMOUS CHOLLIMA", "actor_type": "state", "attribution": "CrowdStrike attributes FAMOUS CHOLLIMA to North Korea; the report also cited a 220 percent year-on-year rise in infiltrated companies.", "motive": "Sanctions-evading revenue for the DPRK regime", "vector": "AI-generated application materials, deepfake video interviews, AI-assisted coding on the job under stolen or fabricated identities", "root_cause": "Remote hiring pipelines lacked identity verification able to detect AI-fabricated personas", "timeline": [ { "date": "2024-07-01", "event": "Start of the twelve-month reporting window" }, { "date": "2025-08-04", "event": "CrowdStrike releases the 2025 Threat Hunting Report at Black Hat USA" } ], "impact": "Over 320 companies infiltrated; salaries diverted to the DPRK and insider access gained.", "response": "CrowdStrike published hunting guidance; the report also noted EMBER BEAR using GenAI for influence content.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "CrowdStrike press release", "url": "https://ir.crowdstrike.com/news-releases/news-release-details/2025-crowdstrike-threat-hunting-report-adversaries-weaponize-and/" }, { "name": "Business Wire", "url": "https://www.businesswire.com/news/home/20250803570128/en/2025-CrowdStrike-Threat-Hunting-Report-Adversaries-Weaponize-and-Target-AI-at-Scale" } ] }, { "id": "claude-code-cve-2025-54795", "date": "2025-08-05", "title": "Claude Code command injection bypasses confirmation prompt (CVE-2025-54795 and -54794)", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Anthropic Claude Code CLI", "loss_usd": null, "summary": "Two Claude Code flaws let untrusted content in the context window bypass the confirmation prompt to run commands, and escape working-directory limits via prefix path matching. Fixed in versions 1.0.20 and 0.2.111.", "source": "Anthropic security advisories (via NVD)", "url": "https://www.isitpatched.com/cve/CVE-2025-54795", "actor": "External security researchers (credited in Anthropic advisories)", "actor_type": "researcher", "attribution": "Coordinated disclosure to Anthropic; CVEs published August 2025", "motive": "Security research", "vector": "Prompt injection via untrusted repository content causing a command parsing error that skips the confirmation prompt; path validation used prefix matching so sibling directories were reachable", "root_cause": "Insufficient command parsing and non-canonical path comparison in the CLI's safety checks", "timeline": [ { "date": "2025-06", "event": "Fixes shipped in Claude Code 0.2.111 (path) and 1.0.20 (command injection)" }, { "date": "2025-08-05", "event": "CVE-2025-54794 and CVE-2025-54795 published" } ], "impact": "Potential arbitrary command execution and out-of-scope file access on developer machines running Claude Code against untrusted repositories; no exploitation reported", "response": "Anthropic patched both issues and published GitHub security advisories", "status": "patched", "cve": "CVE-2025-54795, CVE-2025-54794", "verification": "confirmed", "sources": [ { "name": "IsItPatched CVE-2025-54795", "url": "https://www.isitpatched.com/cve/CVE-2025-54795" }, { "name": "Phoenix Security", "url": "https://phoenix.security/claude-code-leak-to-vulnerability-three-cves-in-claude-code-cli-and-the-chain-that-connects-them/" } ] }, { "id": "agentflayer-chatgpt-connectors", "date": "2025-08-06", "title": "AgentFlayer: one poisoned Google Drive document makes ChatGPT leak API keys", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "OpenAI ChatGPT Connectors (Google Drive, SharePoint)", "loss_usd": null, "summary": "Zenity Labs showed at Black Hat that a shared document with a 300-word prompt in 1-pixel white text could make ChatGPT search a victim's Drive for secrets and exfiltrate them via image URLs that bypassed url_safe checks.", "source": "Zenity Labs", "url": "https://labs.zenity.io/p/agentflayer-chatgpt-connectors-0click-attack-5b41", "actor": "Michael Bargury and Tamir Ishay Sharbat (Zenity Labs)", "actor_type": "researcher", "attribution": "Responsible disclosure presented at Black Hat USA 2025 as part of the AgentFlayer series", "motive": "Security research", "vector": "Zero-click indirect prompt injection in a shared file; triggered when the user asks ChatGPT to summarise it", "root_cause": "ChatGPT rendered attacker-chosen image URLs from trusted cloud domains, giving a covert channel out of the connector context", "timeline": [ { "date": "2025-08-06", "event": "Zenity presents AgentFlayer at Black Hat USA" }, { "date": "2025-08-08", "event": "Wired and others report OpenAI deployed mitigations" } ], "impact": "Proof of concept exfiltrated API keys from Google Drive; researchers said any connected resource could be targeted", "response": "OpenAI reportedly patched the demonstrated exfiltration path after disclosure", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Zenity Labs", "url": "https://labs.zenity.io/p/agentflayer-chatgpt-connectors-0click-attack-5b41" }, { "name": "Hackread", "url": "https://hackread.com/agentflayer-0-click-exploit-chatgpt-connectors-steal-data/" }, { "name": "TechSpot", "url": "https://www.techspot.com/news/108975-chatgpt-vulnerability-allows-hidden-prompts-steal-google-drive-cloud-data.html" } ] }, { "id": "gemini-calendar-invite-hijack", "date": "2025-08-06", "title": "Invitation Is All You Need: poisoned calendar invites make Gemini control smart homes", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "IL", "region": "Middle East & Africa", "target": "Google Gemini assistant and Google Home integrations", "loss_usd": null, "summary": "Researchers from Tel Aviv University, Technion and SafeBreach showed 14 indirect prompt injections where hidden text in Google Calendar invites made Gemini open shutters, start Zoom calls and delete events.", "source": "SafeBreach / Tel Aviv University", "url": "https://getcoai.com/news/researchers-exploit-google-gemini-through-calendar-invites-to-control-smart-homes/", "actor": "Ben Nassi, Stav Cohen and Or Yair (Tel Aviv University, Technion, SafeBreach)", "actor_type": "researcher", "attribution": "Academic responsible disclosure presented at Black Hat USA 2025; coordinated with Google", "motive": "Security research", "vector": "Hidden instructions in Google Calendar invite titles and descriptions, triggered when the user asks Gemini about their schedule or replies with everyday words, using delayed automatic tool invocation", "root_cause": "Gemini treated calendar content as trusted context and could invoke connected tools (Google Home, Zoom, Calendar) without a separate confirmation step", "timeline": [ { "date": "2025-02", "event": "Researchers report the attacks to Google" }, { "date": "2025-08-06", "event": "Findings presented at Black Hat USA and published as Invitation Is All You Need" }, { "date": "2025-08", "event": "Google says it rolled out filtering, model hardening and new user confirmations" } ], "impact": "First widely documented prompt injection with physical-world effects: smart home devices actuated, spam sent, browser content read and calendar events deleted in lab demos. No real-world victims reported", "response": "Google deployed mitigations including output filtering, prompt-injection classifiers and confirmation prompts for sensitive actions", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "CO/AI", "url": "https://getcoai.com/news/researchers-exploit-google-gemini-through-calendar-invites-to-control-smart-homes/" }, { "name": "Forkast", "url": "https://forkast.news/your-calendar-might-be-the-most-dangerous-thing-in-your-smart-home/" }, { "name": "TMCnet", "url": "https://blog.tmcnet.com/blog/rich-tehrani/security/hackers-exploit-google-gemini-to-hijack-smart-home-devices.html" } ] }, { "id": "copilot-yolo-mode-cve-2025-53773", "date": "2025-08-12", "title": "Copilot prompt injection flips VS Code to auto-approve mode for RCE (CVE-2025-53773)", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "GitHub Copilot in Visual Studio and VS Code", "loss_usd": null, "summary": "Injected text in files, web pages or GitHub issues could make Copilot write chat.tools.autoApprove into .vscode/settings.json, disabling confirmations and allowing shell commands. Microsoft patched it in August 2025.", "source": "Microsoft Security Response Center", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-53773", "actor": "Johann Rehberger (Embrace The Red)", "actor_type": "researcher", "attribution": "Credited to Johann Rehberger; fixed by Microsoft in the August 2025 Patch Tuesday release", "motive": "Security research", "vector": "Indirect prompt injection in code comments, project files or issues the agent reads, causing Copilot to edit workspace settings and enable unattended tool execution", "root_cause": "Copilot could modify its own security-relevant configuration file without user confirmation, turning any prompt injection into code execution", "timeline": [ { "date": "2025-06", "event": "Rehberger reports the issue to Microsoft" }, { "date": "2025-08-12", "event": "Microsoft publishes CVE-2025-53773 (CVSS 7.8) and ships a fix" }, { "date": "2025-08", "event": "Researchers note VS Code now prompts before Copilot edits settings.json" } ], "impact": "Full code execution on developer machines with the potential for worm-like spread through shared repositories; no exploitation in the wild reported", "response": "Microsoft patched Visual Studio and the Copilot extension and added a confirmation when the agent edits .vscode/settings.json", "status": "patched", "cve": "CVE-2025-53773", "verification": "confirmed", "sources": [ { "name": "Wiz vulnerability database", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2025-53773" }, { "name": "Cyber Security News", "url": "https://cybersecuritynews.com/github-copilot-rce-vulnerability" }, { "name": "Repello AI", "url": "https://repello.ai/blog/vscode-copilot-workspace-trust-bypass" } ] }, { "id": "copilot-audit-log-bypass", "date": "2025-08-18", "title": "Microsoft 365 Copilot summarised files without writing audit log entries", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Microsoft 365 Copilot enterprise customers", "loss_usd": null, "summary": "Pistachio CTO Zack Korman found that asking Copilot to omit the reference link when summarising a file produced no audit record, letting insiders read documents without a trace. Microsoft fixed it on 17 August 2025.", "source": "Pistachio", "url": "https://pistachioapp.com/blog/copilot-broke-your-audit-log", "actor": "Zack Korman (Pistachio)", "actor_type": "researcher", "attribution": "Reported to MSRC on 4 July 2025; researcher published after Microsoft declined to notify customers", "motive": "Security research", "vector": "Prompt phrasing that suppressed the citation link also suppressed audit logging of file access", "root_cause": "Audit record generation tied to link rendering rather than to the underlying file read", "timeline": [ { "date": "2025-07-04", "event": "Korman reports the flaw to MSRC" }, { "date": "2025-08-17", "event": "Microsoft deploys the fix, rated important" }, { "date": "2025-08-18", "event": "Public disclosure" } ], "impact": "Compliance and forensic logs may be incomplete for an unknown period", "response": "Microsoft fixed the logging gap silently without a CVE", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Pistachio", "url": "https://pistachioapp.com/blog/copilot-broke-your-audit-log" }, { "name": "Petri", "url": "https://petri.com/microsoft-fixes-copilot-flaw-audit-logs/" }, { "name": "heise", "url": "https://heise.de/-10578970" } ] }, { "id": "lenovo-lena-chatbot-xss", "date": "2025-08-18", "title": "Lenovo's Lena support chatbot coaxed into XSS payload that steals agent session cookies", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "CN", "region": "Asia-Pacific", "target": "Lenovo Lena customer support chatbot (GPT-4 based)", "loss_usd": null, "summary": "Cybernews used a 400-character prompt to make Lenovo's Lena chatbot emit HTML with a broken image tag that sent cookies to an attacker server, exposing support agents' sessions. Lenovo acknowledged and fixed it.", "source": "Cybernews", "url": "https://cybernews.com/security/lenovo-chatbot-lena-plagued-by-critical-vulnerabilities/", "actor": "Cybernews research team", "actor_type": "researcher", "attribution": "Responsible disclosure on 22 July 2025; Lenovo confirmed on 6 August", "motive": "Security research", "vector": "Direct prompt injection requesting HTML output; unsanitised chatbot response rendered in the support interface", "root_cause": "No input validation or output sanitisation between the LLM and the web front end", "timeline": [ { "date": "2025-07-22", "event": "Cybernews discloses the issue to Lenovo" }, { "date": "2025-08-06", "event": "Lenovo confirms the vulnerability" }, { "date": "2025-08-18", "event": "Lenovo patches and Cybernews publishes" } ], "impact": "Session hijack of live and historical support chats was possible; no evidence of real-world exploitation", "response": "Lenovo said it protected its systems after the report", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Cybernews", "url": "https://cybernews.com/security/lenovo-chatbot-lena-plagued-by-critical-vulnerabilities/" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4043005/lenovo-chatbot-breach-highlights-ai-security-blind-spots-in-customer-facing-systems.html" }, { "name": "BetaNews", "url": "https://betanews.com/2025/08/18/lenovos-lena-ai-chatbot-had-weakness-that-let-attackers-hijack-sessions/" } ] }, { "id": "nz-fma-deepfake-pump-dump-warning", "date": "2025-08-19", "title": "NZ FMA flags pump-and-dump scam using deepfakes of Kiwi business leaders in Meta ads", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "NZ", "region": "Asia-Pacific", "target": "New Zealand retail investors", "loss_usd": null, "summary": "New Zealand's Financial Markets Authority warned that Facebook and Instagram ads with deepfake videos of prominent local business figures were funnelling investors into WhatsApp groups pushing low-value foreign shares.", "source": "Financial Markets Authority (NZ)", "url": "https://www.fma.govt.nz/news/all-releases/media-releases/pump-and-dump-scam-nets-kiwi-investors/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; global pump-and-dump operation.", "motive": "Inflate thinly traded shares and dump them on lured investors; secondary recovery fraud.", "vector": "Deepfake endorsement ads on Meta platforms leading to WhatsApp investment groups with coordinated buy instructions.", "root_cause": "Platform advertising permitted AI-fabricated endorsements of real executives.", "timeline": [ { "date": "2025-08-19", "event": "FMA warns about deepfake-driven pump-and-dump scam" }, { "date": "2026-10-06", "event": "FMA repeats warning during World Investor Week citing AI deepfakes" } ], "impact": "Kiwi investors caught in share pumps and follow-on recovery scams; no aggregate loss published.", "response": "FMA media release MR 2025-41 and renewed warnings; FMA later reported flagging more than 190 fake trading sites for removal.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Financial Markets Authority", "url": "https://www.fma.govt.nz/news/all-releases/media-releases/pump-and-dump-scam-nets-kiwi-investors/" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1227/" }, { "name": "Finance Magnates", "url": "https://financemagnates.com/forex/regulation/australia-and-new-zealand-sound-alarm-on-ai-powered-investment-scams-as-takedowns-hit-record-pace" } ] }, { "id": "pib-sitharaman-quantumai-deepfakes", "date": "2025-08-19", "title": "PIB flags deepfakes of India's finance minister endorsing QuantumAI get-rich scheme", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "IN", "region": "Asia-Pacific", "target": "Indian Facebook users; Finance Minister Nirmala Sitharaman", "loss_usd": null, "summary": "India's PIB fact-check unit labelled fake several Facebook videos in which an AI-altered Nirmala Sitharaman promised returns such as Rs 10 lakh a month on Rs 22,000 or a QuantumAI platform; more clips were flagged later.", "source": "Storyboard18", "url": "https://www.storyboard18.com/brand-makers/deepfake-danger-pib-flags-fake-videos-of-fm-endorsing-fraudulent-platforms-79167.htm", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; PIB noted unnatural lip-sync, mismatched logos and suspicious domains.", "motive": "Investment fraud.", "vector": "Deepfake video ads on Facebook leading to fake trading platforms.", "root_cause": "Recycled official footage altered with lip-sync tools; ad platforms slow to remove.", "timeline": [ { "date": "2025-08-19", "event": "PIB Fact Check labels Sitharaman investment videos fake" }, { "date": "2025-10-28", "event": "PIB debunks new clip promising Rs 60,000 a day" }, { "date": "2026-04-16", "event": "PIB flags further Sitharaman deepfake on Facebook" } ], "impact": "Repeated misuse of the finance minister's likeness over nine months; losses not disclosed.", "response": "Public debunks with side-by-side original footage; advice to verify via official channels.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Storyboard18", "url": "https://www.storyboard18.com/brand-makers/deepfake-danger-pib-flags-fake-videos-of-fm-endorsing-fraudulent-platforms-79167.htm" }, { "name": "Gulf News", "url": "https://gulfnews.com/amp/story/world%2Fasia%2Findia%2Fviral-ai-video-of-indias-fm-sitharaman-offering-huge-returns-is-fake-1.500510156" }, { "name": "Outlook Money", "url": "https://www.outlookmoney.com/news/pib-fact-check-flags-fake-ai-video-of-nirmala-sitharaman-promoting-investment-scheme" } ] }, { "id": "comet-reddit-injection-brave", "date": "2025-08-20", "title": "Brave shows Perplexity Comet can be hijacked by a Reddit comment to steal Gmail OTPs", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Perplexity Comet AI browser", "loss_usd": null, "summary": "Brave found hidden text in a Reddit post could make Comet open Gmail, trigger account recovery and send the one-time code to the attacker when the user clicked Summarize. Perplexity patched; Brave said it was incomplete.", "source": "Brave Software", "url": "https://simonwillison.net/2025/Aug/25/agentic-browser-security/", "actor": "Brave security and privacy team", "actor_type": "researcher", "attribution": "Responsible disclosure by a competing browser vendor; Perplexity disputed severity", "motive": "Security research", "vector": "Indirect prompt injection in page content fed to the assistant without separating user instructions from untrusted text; agent acted across logged-in tabs", "root_cause": "Comet passed web page text to the model as part of the instruction stream and could act with the user's authenticated sessions", "timeline": [ { "date": "2025-07-25", "event": "Brave reports the vulnerability to Perplexity" }, { "date": "2025-07-27", "event": "Perplexity ships an initial fix" }, { "date": "2025-08-13", "event": "Brave finds the patch can still be bypassed" }, { "date": "2025-08-20", "event": "Brave publishes the disclosure" } ], "impact": "Proof of concept exfiltrated email addresses and Gmail recovery codes; Perplexity said no user data was compromised", "response": "Perplexity patched the reported case and said it was fixed before anyone noticed; Brave maintained Comet remained exploitable", "status": "patched", "cve": null, "verification": "disputed", "sources": [ { "name": "Simon Willison", "url": "https://simonwillison.net/2025/Aug/25/agentic-browser-security/" }, { "name": "Decrypt", "url": "https://decrypt.co/336763/perplexity-comet-flaw-exposed-user-data-attackers-brave-reports" }, { "name": "Yahoo Finance", "url": "https://finance.yahoo.com/news/perplexity-comet-flaw-exposed-user-232510101.html" } ] }, { "id": "grok-chats-indexed", "date": "2025-08-20", "title": "Over 370,000 Grok conversations exposed in Google search via share links", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "xAI Grok users", "loss_usd": null, "summary": "Forbes found Grok's share button generated indexable URLs, so search engines surfaced hundreds of thousands of user chats, some with personal, medical or credential details.", "source": "Fortune", "url": "https://fortune.com/2025/08/22/xai-grok-chats-public-on-google-search-elon-musk", "actor": "xAI product design flaw; exposure found by Forbes", "actor_type": "accident", "attribution": "Self-evident from Forbes investigation; xAI did not dispute the indexing", "motive": "None (accidental exposure via share feature)", "vector": "Grok 'Share' button created public URLs on grok.com with no noindex protection or user warning, which Google, Bing and DuckDuckGo crawled and indexed", "root_cause": "Share links published on the open web without noindex headers or consent disclosure, repeating the earlier ChatGPT shared-link indexing problem", "timeline": [ { "date": "2025-08-20", "event": "Forbes reports over 370,000 Grok conversations indexed by Google" }, { "date": "2025-08-22", "event": "Fortune and others detail exposed content including passwords, medical questions and harmful instructions" } ], "impact": "More than 370,000 user conversations publicly searchable, some containing names, passwords, medical details and instructions for drugs, explosives and malware", "response": "No formal statement from xAI beyond a Google spokesperson noting publishers control indexing; no public confirmation of a feature fix", "status": "unresolved", "cve": null, "sources": [ { "name": "Fortune", "url": "https://fortune.com/2025/08/22/xai-grok-chats-public-on-google-search-elon-musk" }, { "name": "Forbes Australia", "url": "https://www.forbes.com.au/news/innovation/xai-published-hundreds-of-thousands-of-grok-chatbot-conversations/" }, { "name": "Yahoo News", "url": "https://www.yahoo.com/news/articles/thousands-private-user-conversations-elon-173216941.html" } ] }, { "id": "proofpoint-lovable-phishing", "date": "2025-08-20", "title": "Proofpoint: Lovable AI builder abused for Tycoon MFA phishing hitting 5,000+ organisations", "category": "AI phishing", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Microsoft 365 users, UPS customers, Aave wallet holders", "loss_usd": null, "summary": "Proofpoint saw tens of thousands of malicious Lovable URLs a month since February 2025; one Tycoon campaign hit over 5,000 organisations with AI-built fake Microsoft logins capturing MFA tokens and session cookies.", "source": "Proofpoint Threat Research", "url": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing", "actor": "Multiple criminal groups incl. Tycoon kit operators", "actor_type": "criminal", "attribution": "Proofpoint telemetry; Lovable matched the reports to a cluster its Trust and Safety team had already found.", "motive": "Credential theft, card fraud and crypto wallet draining", "vector": "Prompt-generated phishing pages hosted on lovable.app, math CAPTCHA gates, adversary-in-the-middle Microsoft login clones, remixable harvester templates", "root_cause": "The AI builder generated and hosted deceptive credential pages without technical or policy barriers", "timeline": [ { "date": "2025-02-01", "event": "Tycoon file-sharing lure campaign impacts over 5,000 organisations" }, { "date": "2025-06-01", "event": "UPS impersonation (3,500 messages) and Aave drainer (10,000 emails) campaigns" }, { "date": "2025-07-01", "event": "Lovable adds real-time detection and daily scans of published projects" }, { "date": "2025-08-20", "event": "Proofpoint publishes research" } ], "impact": "Over 5,000 organisations hit in one campaign; payment card and SMS code data posted to Telegram; zgRAT delivered via a German invoice lure.", "response": "Lovable removed hundreds of phishing domains and the UPS app, added prompt-time blocking and daily scanning, and planned account-level fraud controls.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Proofpoint", "url": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/top-ai-website-builder-lovable-hit-in-worrying-cyberattack-heres-what-we-know" } ] }, { "id": "promptlock-ransomware", "date": "2025-08-26", "title": "ESET finds PromptLock, ransomware that uses a local gpt-oss model to write scripts", "category": "AI-assisted malware", "direction": "with-ai", "severity": "low", "country": "GL", "region": "Global", "target": "Windows and Linux systems", "loss_usd": null, "summary": "ESET described PromptLock, a Go ransomware prototype that prompts gpt-oss:20b via Ollama to generate Lua scripts for discovery, exfiltration and encryption; likely a proof of concept.", "source": "Security Affairs", "url": "https://securityaffairs.com/181595/malware/eset-warns-of-promptlock-the-first-ai-driven-ransomware.html", "actor": "NYU Tandon researchers (Ransomware 3.0 academic prototype)", "actor_type": "researcher", "attribution": "NYU Tandon team publicly claimed authorship after ESET's disclosure; ESET agreed the academic prototype closely resembles the PromptLock samples", "motive": "Academic research into LLM-orchestrated ransomware; samples uploaded to VirusTotal to test detection", "vector": "Go binary with hard-coded prompts calling OpenAI gpt-oss:20b via the Ollama API to generate Lua scripts for file enumeration, exfiltration and encryption", "root_cause": "Freely available open-weight LLMs can be embedded in malware to generate polymorphic payloads at runtime; sample reached VirusTotal without research labelling", "timeline": [ { "date": "2025-08", "event": "Windows and Linux PromptLock samples uploaded to VirusTotal" }, { "date": "2025-08-26", "event": "ESET publishes analysis calling it the first AI-powered ransomware, judged a proof of concept" }, { "date": "2025-09", "event": "NYU Tandon researchers reveal PromptLock is their Ransomware 3.0 prototype and non-functional outside a lab" } ], "impact": "No real-world victims; destruction features unimplemented; demonstrated feasibility of LLM-driven ransomware across Windows and Linux", "response": "ESET published detections and IOCs; NYU clarified the research origin and stated the prototype was lab-only", "status": "resolved", "cve": null, "sources": [ { "name": "Security Affairs", "url": "https://securityaffairs.com/181595/malware/eset-warns-of-promptlock-the-first-ai-driven-ransomware.html" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/08/someone-created-first-ai-powered.html" }, { "name": "Security Boulevard", "url": "https://securityboulevard.com/2025/09/nyu-scientists-develop-eset-detects-first-ai-powered-ransomware/" }, { "name": "Dark Reading", "url": "https://www.darkreading.com/vulnerabilities-threats/ai-powered-ransomware-promptlock" } ] }, { "id": "salesloft-drift-oauth", "date": "2025-08-26", "title": "Drift AI chatbot OAuth tokens stolen to raid 700+ Salesforce tenants", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Salesloft Drift / Salesforce customers", "loss_usd": null, "summary": "UNC6395 used OAuth tokens stolen from the Drift AI chat integration to bulk-export Salesforce data from hundreds of organizations and hunt for cloud keys and passwords.", "source": "Security Affairs", "url": "https://securityaffairs.com/181632/hacking/unc6395-targets-salesloft-in-drift-oauth-token-theft-campaign.html", "actor": "UNC6395 (unknown financially motivated group)", "actor_type": "criminal", "attribution": "Tracked as UNC6395 by Google Threat Intelligence Group and Mandiant; a group claiming ties to ShinyHunters also claimed responsibility, unconfirmed", "motive": "Credential harvesting (AWS keys, Snowflake tokens, passwords) from CRM data for follow-on intrusions and extortion", "vector": "Stolen OAuth and refresh tokens for the Salesloft Drift Salesforce integration used to run SOQL queries and bulk-export Account, Case, Opportunity and User objects", "root_cause": "Compromise of Salesloft's GitHub and Drift AWS environment exposed long-lived OAuth tokens for a widely trusted third-party app with broad Salesforce data scope", "timeline": [ { "date": "2025-03", "event": "Per Mandiant, actor gains access to Salesloft's GitHub account (March to June) and later Drift's AWS environment" }, { "date": "2025-08-08", "event": "Mass Salesforce data exfiltration via Drift OAuth tokens begins, continuing through at least August 18" }, { "date": "2025-08-20", "event": "Salesforce and Salesloft revoke all Drift tokens and remove Drift from AppExchange" }, { "date": "2025-08-26", "event": "Google Threat Intelligence Group publishes UNC6395 advisory; Drift Email tokens also found abused against Google Workspace" } ], "impact": "Over 700 organisations' Salesforce data exported, including support cases containing AWS keys, Snowflake tokens and passwords; downstream disclosures from Cloudflare, Zscaler, Palo Alto Networks, Google and others", "response": "Tokens revoked, Drift integration disabled and later taken offline, Mandiant engaged, customers told to rotate exposed secrets; FBI issued a FLASH alert", "status": "contained", "cve": null, "sources": [ { "name": "Security Affairs", "url": "https://securityaffairs.com/181632/hacking/unc6395-targets-salesloft-in-drift-oauth-token-theft-campaign.html" }, { "name": "Google Cloud Threat Intelligence", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6395-github-malware-salesforce-data" }, { "name": "Help Net Security", "url": "https://www.helpnetsecurity.com/2025/08/27/hundreds-of-salesforce-customer-orgs-hit-in-clever-attack-with-potentially-huge-blast-radius/" } ] }, { "id": "anthropic-dprk-remote-workers", "date": "2025-08-27", "title": "North Korean operatives used Claude to pass interviews and hold jobs at Fortune 500 firms", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "US Fortune 500 technology companies", "loss_usd": null, "summary": "Anthropic found DPRK IT workers using Claude to fabricate professional identities, complete coding assessments and perform day-to-day technical work after being hired, generating sanctioned revenue for the regime.", "source": "Anthropic", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "actor": "North Korean remote IT worker network", "actor_type": "state", "attribution": "Anthropic attributed the activity to North Korean operatives with high confidence, consistent with FBI reporting on the DPRK IT-worker scheme.", "motive": "Sanctions-evading revenue generation for the North Korean regime", "vector": "Claude used to build false identities, answer technical interviews and deliver work product that operators could not produce themselves", "root_cause": "AI removed the English-language and coding bottleneck that previously limited the scale of the fraudulent employment scheme", "timeline": [ { "date": "2025-08", "event": "Anthropic bans accounts tied to DPRK IT workers" }, { "date": "2025-08-27", "event": "Case published in Anthropic's August 2025 threat report" } ], "impact": "Fraudulent hires inside major US technology companies; salaries diverted to the DPRK in violation of sanctions.", "response": "Accounts banned, indicator-correlation tooling improved, findings shared with authorities.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic August 2025 threat report", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025" }, { "name": "heise coverage", "url": "https://heise.de/-10623474" } ] }, { "id": "anthropic-nocode-raas", "date": "2025-08-27", "title": "Lone criminal sold Claude-built ransomware variants on forums for $400 to $1,200", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Buyers' victims via ransomware-as-a-service", "loss_usd": null, "summary": "A single actor with basic coding skills used Claude to develop, market and sell several ransomware variants with evasion, encryption and anti-recovery features, packaged for $400 to $1,200 on underground forums.", "source": "Anthropic", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "actor": "Unknown individual", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; single cybercriminal who could not have built the core components without Claude.", "motive": "Profit from ransomware-as-a-service sales", "vector": "Claude generated encryption routines, anti-analysis techniques and Windows internals code the actor could not write alone", "root_cause": "Actor lacked skills to build the components independently; malware-generation detection was insufficient at the time", "timeline": [ { "date": "2025-01", "event": "Sales offering for the ransomware packages observed on forums" }, { "date": "2025-08-27", "event": "Anthropic discloses the case and bans the account" } ], "impact": "Functional ransomware offered to other criminals; number of deployments and victims not published.", "response": "Account banned, partners alerted, new detections for malware upload, modification and generation deployed.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic August 2025 threat report", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025" }, { "name": "heise coverage", "url": "https://heise.de/-10623474" } ] }, { "id": "anthropic-vibe-hacking", "date": "2025-08-27", "title": "Claude Code used to automate data extortion against 17 organizations", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Healthcare, government, emergency services", "loss_usd": null, "summary": "Anthropic's threat report described a criminal using Claude Code for recon, credential harvesting and tailored ransom notes against at least 17 organizations, demanding up to ~$500K.", "source": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2025/08/claude-ai-chatbot-abused-to-launch-cybercrime-spree", "actor": "GTG-2002 (unnamed cybercriminal tracked by Anthropic)", "actor_type": "criminal", "attribution": "Identified and disrupted by Anthropic's threat intelligence team; actor identity not publicly disclosed", "motive": "Financial extortion via data theft (ransoms of USD 75,000 to over 500,000 in bitcoin)", "vector": "Claude Code used as an autonomous operator: scanning thousands of VPN endpoints, credential harvesting, writing obfuscated tunnelling tools, selecting data to steal and drafting ransom notes", "root_cause": "Agentic coding tools can be misused to run end-to-end intrusions at scale; victims had internet-exposed VPN services and weak credential hygiene", "timeline": [ { "date": "2025-07", "event": "Anthropic detects the extortion operation spanning at least 17 organisations" }, { "date": "2025-08-27", "event": "Anthropic publishes threat intelligence report describing the vibe hacking case and bans the accounts" } ], "impact": "At least 17 organisations in healthcare, emergency services, government and religious sectors had personal, health and financial records stolen; ransoms demanded up to over USD 500,000", "response": "Anthropic banned the accounts, deployed new classifiers to detect similar misuse and shared indicators with partners and authorities", "status": "contained", "cve": null, "sources": [ { "name": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2025/08/claude-ai-chatbot-abused-to-launch-cybercrime-spree" }, { "name": "Anthropic", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025" }, { "name": "Dark Reading", "url": "https://www.darkreading.com/cyberattacks-data-breaches/anthropic-ai-automate-data-extortion-campaign" } ] }, { "id": "nx-s1ngularity", "date": "2025-08-27", "title": "s1ngularity: trojanized Nx packages weaponize Claude and Gemini CLIs to steal secrets", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Nx build system users", "loss_usd": null, "summary": "Malicious Nx npm releases ran local AI coding CLIs with permission-bypass flags to inventory secrets, then leaked thousands of developer credentials to public GitHub repos.", "source": "Okta", "url": "https://www.okta.com/newsroom/articles/the-s1ngularity-attack--when-attackers-prompt-your-ai-agents-to-", "actor": "Unknown supply-chain attacker (s1ngularity)", "actor_type": "criminal", "attribution": "No public attribution; analysed by Nx maintainers, Wiz, StepSecurity, Socket and GitHub Security Lab", "motive": "Mass theft of developer secrets (GitHub and npm tokens, SSH keys, crypto wallets, cloud credentials)", "vector": "Malicious postinstall script in Nx npm releases 20.9.0 to 21.8.0 ran Claude, Gemini and Q CLIs with permission-bypass flags to find secrets, then pushed them to public GitHub repos", "root_cause": "Nx GitHub Actions workflow using pull_request_target with an unsanitised PR title let the attacker steal the npm publish token from an outdated branch", "timeline": [ { "date": "2025-08-21", "event": "Vulnerable workflow added to Nx repo; reverted on master but still present on an outdated branch" }, { "date": "2025-08-26", "event": "Attacker publishes trojanized Nx versions to npm; malware runs AI CLIs and leaks secrets for several hours" }, { "date": "2025-08-27", "event": "Nx pulls malicious versions, revokes tokens and publishes advisory GHSA-cxm3-wv7p-598c" }, { "date": "2025-08-28", "event": "Second phase: stolen GitHub tokens used to flip about 6,700 private repos public across 480 accounts" }, { "date": "2025-09-09", "event": "Wiz reports 2,180 accounts and 7,200 repositories affected across three phases" } ], "impact": "Over 2,000 secrets and 20,000 files leaked from about 1,000 developers; 480 accounts and about 6,700 private repositories made public; 2,180 accounts affected overall per Wiz", "response": "Nx revoked npm tokens, removed packages, enforced 2FA and trusted publishing; GitHub removed leaked repositories; victims told to rotate all credentials", "status": "contained", "cve": null, "sources": [ { "name": "Okta", "url": "https://www.okta.com/newsroom/articles/the-s1ngularity-attack--when-attackers-prompt-your-ai-agents-to-" }, { "name": "Wiz", "url": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack" }, { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack" }, { "name": "GitHub Security Lab", "url": "https://securitylab.github.com/advisories/GHSL-2025-111_nrwl_nx/" } ] }, { "id": "talos-exposed-ollama-servers", "date": "2025-09-02", "title": "Cisco Talos finds over 1,100 Ollama LLM servers open to the internet without authentication", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Self-hosted Ollama deployments", "loss_usd": null, "summary": "A Shodan sweep by Cisco Talos located more than 1,100 publicly reachable Ollama servers within minutes; about 20 percent were actively serving models open to extraction, jailbreak and resource abuse.", "source": "Cisco Talos (via The Register)", "url": "https://www.theregister.com/2025/09/02/exposed_ollama_servers_insecure_research/", "actor": "Cisco Talos researchers (discovery); operators' misconfiguration", "actor_type": "researcher", "attribution": "Research scan by Cisco Talos; exposures stem from default Ollama configurations without authentication", "motive": "Security research measuring exposed AI infrastructure", "vector": "Unauthenticated Ollama API endpoints discoverable via Shodan", "root_cause": "Ollama ships without built-in authentication and operators bind it to public interfaces", "timeline": [ { "date": "2025-08", "event": "Talos finds over 1,000 exposed servers within 10 minutes of starting its scan" }, { "date": "2025-09-02", "event": "Findings published: 36.6 percent of servers in the US, 22.5 percent in China, 8.9 percent in Germany" } ], "impact": "Over 1,100 exposed servers, roughly 20 percent hosting models exposed to extraction, backdoor injection and unauthorized use; the rest open to model uploads or configuration tampering", "response": "Talos recommended authentication, network restrictions and monitoring; later scans reported far larger exposure counts", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2025/09/02/exposed_ollama_servers_insecure_research/" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/hundreds-of-llm-servers-left-exposed-online-heres-what-we-know" }, { "name": "GovInfoSecurity", "url": "https://www.govinfosecurity.com/exposed-llm-servers-expose-ollama-risks-a-29354" } ] }, { "id": "wuhan-ai-faceswap-mcn-hijack", "date": "2025-09-09", "title": "Wuhan cyber police crack AI face-swap gang that hijacked an MCN agency's official account", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "CN", "region": "Asia-Pacific", "target": "Wuhan MCN agency's official account and company registration", "loss_usd": null, "summary": "A gang used AI face-swap videos to pass platform identity checks, changed a Wuhan MCN firm's legal representative, hijacked its official account and posted scam lures; police arrested four.", "source": "Guangming Daily (光明网)", "url": "https://m.gmw.cn/2025-12/02/content_1304246595.htm", "actor": "Four suspects led by 'A Cheng' of Weifang, Shandong", "actor_type": "criminal", "attribution": "Wuhan police traced the operation to A Cheng, who performed face-swap verifications for three upstream brokers selling 'face pass' services.", "motive": "Paid bypass of real-name verification for account takeovers and scam promotion.", "vector": "Synthetic face videos defeating liveness checks on a platform, then alteration of company legal-person data and password reset.", "root_cause": "Platform identity verification relied on facial liveness that mature face-swap tooling could defeat.", "timeline": [ { "date": "2025-06-10", "event": "MCN staff find account hijacked and legal representative altered" }, { "date": "2025-07-17", "event": "Officers arrest A Cheng in Weifang and seize face-swap materials" }, { "date": "2025-09-09", "event": "Wuhan police announce Hubei's first AI face-swap intrusion case solved" }, { "date": "2025-12-02", "event": "Ministry of Public Security cyber bureau publicises the case" } ], "impact": "Corporate account and legal-person data altered; scam content pushed to followers; over 400,000 yuan in illicit proceeds recovered.", "response": "Four arrested for illegal intrusion into computer information systems; case featured in national Jingwang 2025 campaign.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Guangming Daily (光明网)", "url": "https://m.gmw.cn/2025-12/02/content_1304246595.htm" }, { "name": "The Paper (澎湃新闻)", "url": "https://m.thepaper.cn/newsDetail_forward_31644121" }, { "name": "Xinhua (新华网)", "url": "https://www.news.cn/legal/20250924/ecc49082bdf54da298e2402a6df778a5/c.html" } ] }, { "id": "vyro-ai-elasticsearch-leak", "date": "2025-09-10", "title": "Vyro AI leaves 116GB of ImagineArt and Chatly prompts and tokens on open Elasticsearch", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "PK", "region": "Asia-Pacific", "target": "Vyro AI (ImagineArt, Chatly, Chatbotx apps)", "loss_usd": null, "summary": "Cybernews found an unauthenticated Elasticsearch server belonging to Vyro AI streaming about 116GB of live logs with user prompts, bearer tokens and user agents from apps with over 10 million downloads.", "source": "Cybernews", "url": "https://www.malwarebytes.com/blog/news/2025/09/when-ai-chatbots-leak-and-how-it-happens", "actor": "Misconfiguration by Vyro AI; found by Cybernews", "actor_type": "accident", "attribution": "Discovered by Cybernews researchers during internet scanning", "motive": "None (accidental exposure)", "vector": "Elasticsearch instance exposed with no authentication or network restriction", "root_cause": "Logging pipeline written to a public database; sensitive tokens stored in logs", "timeline": [ { "date": "2025-02", "event": "Instance first indexed by IoT search engines" }, { "date": "2025-04-22", "event": "Cybernews discovers the exposure" }, { "date": "2025-09-10", "event": "Public disclosure" } ], "impact": "Bearer tokens could enable account hijacking and fraudulent purchases; prompts may include private content", "response": "Server secured after disclosure; no public statement from Vyro found", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2025/09/when-ai-chatbots-leak-and-how-it-happens" }, { "name": "Daily Security Review", "url": "https://dailysecurityreview.com/cyber-security/popular-ai-chatbots-leak-sensitive-user-data-from-unsecured-server/" } ] }, { "id": "ireland-humphreys-deepfake-boi-warning", "date": "2025-09-11", "title": "Bank of Ireland warns of deepfake videos cloning presidential candidate Heather Humphreys", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "IE", "region": "Europe", "target": "Irish consumers", "loss_usd": null, "summary": "Bank of Ireland warned that fraudsters were cloning the image and voice of presidential candidate Heather Humphreys in fake investment videos on Meta platforms, and called for platforms to verify financial advertisers.", "source": "Bank of Ireland", "url": "https://www.con-telegraph.ie/2025/09/11/mayo-scam-alert-fraudsters-cloning-presidential-election-candidate-in-fake-investment-videos/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Investment fraud exploiting election-period attention.", "vector": "AI voice and image cloning in social media adverts endorsing a high-return scheme.", "root_cause": "Social platforms do not verify that financial advertisers are authorised.", "timeline": [ { "date": "2025-09-10", "event": "Humphreys deepfake investment adverts detected on Meta platforms" }, { "date": "2025-09-11", "event": "Bank of Ireland issues public warning" } ], "impact": "No losses disclosed; bank expected more adverts during the campaign.", "response": "Warning, advice to check the Central Bank of Ireland register, call for advertiser verification.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Connaught Telegraph (citing Bank of Ireland)", "url": "https://www.con-telegraph.ie/2025/09/11/mayo-scam-alert-fraudsters-cloning-presidential-election-candidate-in-fake-investment-videos/" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/reports/6210" } ] }, { "id": "whitecobra-vsix-crypto-stealers", "date": "2025-09-13", "title": "WhiteCobra floods Open VSX and VS Code Marketplace with 24 crypto-stealing extensions", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "VS Code, Cursor and Windsurf users", "loss_usd": null, "summary": "Koi Security tied a crew it named WhiteCobra to 24 malicious extensions whose second-stage script fetched LummaStealer or a macOS payload; Ethereum developer Zak Cole lost his wallet to a fake Solidity extension for Cursor.", "source": "Koi Security (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/whitecobra-floods-vscode-market-with-crypto-stealing-extensions/", "actor": "WhiteCobra", "actor_type": "criminal", "attribution": "Named by Koi Security from a leaked playbook; linked to the July 2025 Cursor extension theft of about 500,000 dollars", "motive": "Cryptocurrency theft with campaign revenue targets of 10,000 to 500,000 dollars", "vector": "Lookalike extensions on Open VSX (16) and the Visual Studio Marketplace (8) with inflated downloads; prompt.js downloads platform-specific payloads from Cloudflare Pages", "root_cause": "Shared VSIX ecosystem lets malicious extensions reach AI editors through Open VSX with minimal review; new versions replace removed ones within hours", "timeline": [ { "date": "2025-07", "event": "Fake Solidity extension leads to a 500,000 dollar theft investigated by Kaspersky" }, { "date": "2025-09", "event": "Zak Cole reports his wallet drained after installing a fake Solidity extension with 54,000 Open VSX downloads" }, { "date": "2025-09-13", "event": "Koi Security publishes the WhiteCobra analysis; campaign still active" } ], "impact": "24 extensions targeting VS Code, Cursor and Windsurf users; at least two confirmed wallet thefts including one of about 500,000 dollars; infostealer theft of credentials and messaging data", "response": "Marketplaces removed reported extensions but the actor kept republishing; Koi advised scrutinising new extensions with sudden download spikes", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/whitecobra-floods-vscode-market-with-crypto-stealing-extensions/" }, { "name": "Kaspersky", "url": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers" } ] }, { "id": "kimsuky-chatgpt-military-id", "date": "2025-09-15", "title": "Kimsuky uses ChatGPT-forged South Korean military ID in spear-phishing", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "KR", "region": "Asia-Pacific", "target": "South Korean defense-related researchers", "loss_usd": null, "summary": "Genians found North Korea's Kimsuky attached AI-generated deepfake military ID drafts to phishing emails that dropped malware on researchers, activists and journalists.", "source": "The Record", "url": "https://therecord.media/north-korea-kimsuky-hackers-phishing-fake-military-ids-chatgpt", "actor": "Kimsuky (North Korean state-sponsored, aka APT43)", "actor_type": "state", "attribution": "Attributed by Genians Security Center based on infrastructure and tooling overlap with known Kimsuky campaigns", "motive": "Espionage against South Korean defence, research, activist and journalist targets", "vector": "Spear-phishing from a spoofed defence domain with Government_ID_Draft.zip whose shortcut ran obfuscated PowerShell to fetch malware and a ChatGPT-generated fake military ID image", "root_cause": "Image-generation guardrails bypassed by framing prompts as legitimate sample designs; targets trusted an official-looking ID lure", "timeline": [ { "date": "2025-07-17", "event": "Phishing emails with deepfake military ID attachment sent to South Korean targets" }, { "date": "2025-09-15", "event": "Genians publishes analysis attributing the campaign to Kimsuky; The Record and The Register report it" } ], "impact": "Malware delivered to defence-related researchers, activists and journalists in South Korea; number of successful infections not disclosed", "response": "Genians published IOCs and detection guidance; no public response from OpenAI specific to this campaign", "status": "ongoing", "cve": null, "sources": [ { "name": "The Record", "url": "https://therecord.media/north-korea-kimsuky-hackers-phishing-fake-military-ids-chatgpt" }, { "name": "Genians", "url": "https://genians.com/news/chatgpt-exploited-in-north-korean-cyber-espionage-campaign-genians-reveals/" }, { "name": "The Register", "url": "https://www.theregister.com/2025/09/15/north_korea_chatgpt_fake_id/" } ] }, { "id": "chile-boric-deepfake-cde-referral", "date": "2025-09-17", "title": "Chile weighs state legal action over deepfake of President Boric in investment scam ad", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "CL", "region": "Latin America", "target": "Chilean social media users; President Gabriel Boric", "loss_usd": null, "summary": "Security Minister Luis Cordero said the government was weighing a referral to the Consejo de Defensa del Estado over a deepfake that spliced Boric's voice and image into an ad for a supposed investment platform.", "source": "Pauta", "url": "https://www.pauta.cl/actualidad/2025/09/17/gobierno-evalua-denunciar-ante-el-cde-estafa-que-usa-imagen-del-presidente-boric.html", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; reporting linked earlier Boric and Codelco fakes to campaigns run from Uruguay for XMR Markets.", "motive": "Investment fraud.", "vector": "AI-edited presidential footage in paid social media ads promising returns of 8 million pesos on 200,000.", "root_cause": "No legal framework for deepfakes in Chile at the time; ad platforms slow to act.", "timeline": [ { "date": "2025-06-04", "event": "Study reports Boric lithium-investment deepfake among top social scams" }, { "date": "2025-09-17", "event": "Government evaluates CDE complaint over new Boric deepfake" }, { "date": "2026-07-23", "event": "Chamber of Deputies approves deepfake bill with fines up to 716 million pesos" } ], "impact": "Presidential likeness repeatedly used in scams; victim losses not quantified.", "response": "Ministerial denunciation and possible CDE action; legislative response in 2026.", "status": "unresolved", "cve": null, "verification": "reported", "sources": [ { "name": "Pauta", "url": "https://www.pauta.cl/actualidad/2025/09/17/gobierno-evalua-denunciar-ante-el-cde-estafa-que-usa-imagen-del-presidente-boric.html" }, { "name": "Emol", "url": "https://www.emol.com/noticias/Economia/2025/06/04/1168317/estafas-redes-sociales-estudio.html" }, { "name": "Pauta", "url": "https://www.pauta.cl/actualidad/2026/07/23/camara-aprueba-proyecto-que-regula-deepfakes-contempla-multas-de-hasta-716-millones.html" } ] }, { "id": "kenya-raila-x-hack-crypto-deepfake", "date": "2025-09-18", "title": "Hacked Raila Odinga X account posts deepfake endorsing crypto token to scam Kenyans", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "KE", "region": "Middle East & Africa", "target": "Kenyan crypto buyers", "loss_usd": null, "summary": "A deepfake video of former PM Raila Odinga endorsing the Kenya Token was posted from his reportedly hacked X account and removed the same evening; unconfirmed data suggested 20 percent of supply was bought soon after.", "source": "Kenyans.co.ke", "url": "https://www.kenyans.co.ke/news/116373-concerns-large-scale-scamming-after-hacked-raila-odinga-account-endorses-dubious?page=1", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; account compromise followed a similar apparent endorsement by ICT Cabinet Secretary William Kabogo weeks earlier.", "motive": "Pump a token using a national figure's verified account.", "vector": "Account takeover of a verified X profile combined with an AI-generated endorsement video.", "root_cause": "Compromised credentials on a high-trust account amplified a deepfake.", "timeline": [ { "date": "2025-09-18", "event": "Deepfake crypto endorsement posted from Odinga's X account and removed that evening" }, { "date": "2025-09-19", "event": "Kenyan media report scam concerns" } ], "impact": "Potential large-scale losses by token buyers; no official figure.", "response": "Video removed; government sources informally confirmed it was fake.", "status": "unresolved", "cve": null, "verification": "reported", "sources": [ { "name": "Kenyans.co.ke", "url": "https://www.kenyans.co.ke/news/116373-concerns-large-scale-scamming-after-hacked-raila-odinga-account-endorses-dubious?page=1" }, { "name": "TechCabal", "url": "https://techcabal.com/2025/09/19/raila-odinga-kenya-token-project/" }, { "name": "Kenyan Wall Street", "url": "https://kenyanwallstreet.com/deepfake-scam-raila-odinga-x-account-escalating-cryptocurrency-fraud" } ] }, { "id": "shadowleak-deep-research", "date": "2025-09-18", "title": "ShadowLeak: zero-click prompt injection makes ChatGPT Deep Research leak Gmail data", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "OpenAI ChatGPT Deep Research agent (Gmail connector)", "loss_usd": null, "summary": "Radware showed hidden HTML in an email could make ChatGPT's Deep Research agent extract inbox data and post it to an attacker URL from OpenAI's cloud with no user click. OpenAI patched it in August 2025.", "source": "Radware", "url": "https://securityaffairs.com/182334/hacking/shadowleak-radware-uncovers-zero-click-attack-on-chatgpt.html", "actor": "Radware research team", "actor_type": "researcher", "attribution": "Responsible disclosure by Radware researchers; no evidence of in-the-wild abuse", "motive": "Security research and responsible disclosure", "vector": "Hidden HTML text in an email; when the user asks Deep Research to analyse the inbox, the agent calls browser.open with Base64-encoded personal data appended to an attacker URL", "root_cause": "Agent treated untrusted email content as instructions and could make outbound HTTP requests server-side, so exfiltration bypassed client-side URL checks and enterprise monitoring", "timeline": [ { "date": "2025-06-18", "event": "Radware reports the flaw to OpenAI" }, { "date": "2025-08", "event": "OpenAI deploys a fix" }, { "date": "2025-09-18", "event": "Radware publishes the ShadowLeak write-up" } ], "impact": "Proof of concept achieved reliable exfiltration of Gmail content; Radware warned the same technique could reach other connectors such as Google Drive, Dropbox, GitHub, Outlook and SharePoint. No real victims reported", "response": "OpenAI patched the service-side exfiltration path in early August 2025 before public disclosure", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Security Affairs", "url": "https://securityaffairs.com/182334/hacking/shadowleak-radware-uncovers-zero-click-attack-on-chatgpt.html" }, { "name": "The Register", "url": "https://theregister.com/2025/09/19/openai_shadowleak_bug" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/vulnerability-chatgpt-agent-gmail" } ] }, { "id": "notion-agent-pdf-exfil", "date": "2025-09-19", "title": "Notion 3.0 agents tricked by white-text PDF into leaking client data via web search", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Notion AI agents (Notion 3.0)", "loss_usd": null, "summary": "CodeIntegrity's Abi Raghuram showed a PDF with hidden white text could make a Notion agent collect client names, companies and ARR and pass them in a URL to its web search tool. Notion added detection and link approvals.", "source": "CodeIntegrity / Simon Willison", "url": "https://simonwillison.net/2025/Sep/19/notion-lethal-trifecta/", "actor": "Abi Raghuram (CodeIntegrity)", "actor_type": "researcher", "attribution": "Public proof of concept; Notion responded with product changes", "motive": "Security research", "vector": "Indirect prompt injection in an uploaded PDF; agent's search tool accepted arbitrary URLs so exfiltration rode on a legitimate function call", "root_cause": "Agent combined private workspace access, untrusted file content and an outbound web tool without link approval", "timeline": [ { "date": "2025-09-18", "event": "Notion 3.0 agents launch" }, { "date": "2025-09-19", "event": "CodeIntegrity publishes the exfiltration demo" }, { "date": "2025-09-22", "event": "Notion announces broader injection detection, link approval prompts and admin control to disable web access" } ], "impact": "Any user summarising a malicious PDF could leak workspace data; no real victims reported", "response": "Notion upgraded injection detection for attachments, required approval of model-generated links and let admins disable agent web access", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Simon Willison", "url": "https://simonwillison.net/2025/Sep/19/notion-lethal-trifecta/" }, { "name": "The Decoder", "url": "https://the-decoder.com/notion-ai-agents-get-security-update-after-data-leak/" }, { "name": "Schneier on Security", "url": "https://www.schneier.com/?p=70883" } ] }, { "id": "malterminal-gpt4-malware", "date": "2025-09-22", "title": "SentinelLABS finds MalTerminal, GPT-4-driven malware generator likely predating Nov 2023", "category": "AI-assisted malware", "direction": "with-ai", "severity": "low", "country": "GL", "region": "Global", "target": "None confirmed; proof-of-concept or red team tooling", "loss_usd": null, "summary": "Hunting for embedded API keys, SentinelLABS found MalTerminal.exe and loaders that ask GPT-4 to generate ransomware or a reverse shell at runtime via an endpoint deprecated in November 2023; no in-the-wild use found.", "source": "SentinelLABS", "url": "https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/", "actor": "Unknown", "actor_type": "unknown", "attribution": "SentinelLABS presented the finding at LABScon 2025; authorship unknown, possibly a researcher or red team.", "motive": "Unknown", "vector": "Python-compiled Windows executable prompting the OpenAI chat completions API to write malicious code on demand", "root_cause": "Cloud LLM APIs allow malware to defer malicious logic generation to runtime, leaving little static signature", "timeline": [ { "date": "2023-11-01", "event": "Deprecated OpenAI endpoint suggests sample written before this date" }, { "date": "2025-09-19", "event": "Findings presented at LABScon 2025" }, { "date": "2025-09-22", "event": "Coverage and abridged write-up published" } ], "impact": "No victims identified; a VirusTotal retrohunt found over 7,000 samples with 6,000 unique API keys, plus offensive LLM tools such as vulnerability injectors and WormGPT copycats.", "response": "SentinelLABS published hunting methods based on embedded keys and prompt structures.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "SentinelLABS", "url": "https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/182433/malware/researchers-expose-malterminal-an-llm-enabled-malware-pioneer.html" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/09/researchers-uncover-gpt-4-powered.html" } ] }, { "id": "microsoft-llm-svg-phishing", "date": "2025-09-24", "title": "Microsoft blocks phishing campaign using LLM-generated obfuscated SVG files", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "US", "region": "North America", "target": "US organizations", "loss_usd": null, "summary": "Microsoft Threat Intelligence detected credential phishing using SVG attachments posing as PDFs whose verbose obfuscated code was likely written by an LLM.", "source": "SecurityBrief UK", "url": "https://securitybrief.co.uk/story/microsoft-details-ai-powered-defences-against-novel-svg-phishing", "actor": "Unknown credential-phishing operators", "actor_type": "criminal", "attribution": "No public attribution; Microsoft Threat Intelligence assessed the code was likely LLM-generated using Security Copilot", "motive": "Credential theft (phishing for account logins)", "vector": "Self-addressed emails from a compromised business account carrying SVG files posing as PDFs; hidden business-term attributes decoded by JavaScript redirect to a fake CAPTCHA and login page", "root_cause": "SVG files can carry executable script and evade PDF-focused filters; LLM-generated obfuscation masked the payload from signature-based detection", "timeline": [ { "date": "2025-08-18", "event": "Microsoft Defender for Office 365 detects and blocks the SVG phishing campaign" }, { "date": "2025-09-24", "event": "Microsoft publishes 'AI vs AI' analysis of the campaign" } ], "impact": "Campaign blocked by Defender for Office 365; limited to US organisations; no confirmed credential compromises reported", "response": "Microsoft blocked the campaign, published indicators and detection guidance, and used Security Copilot to characterise the AI-generated code", "status": "contained", "cve": null, "sources": [ { "name": "SecurityBrief UK", "url": "https://securitybrief.co.uk/story/microsoft-details-ai-powered-defences-against-novel-svg-phishing" }, { "name": "Microsoft Security Blog", "url": "https://microsoft.com/en-us/security/blog/2025/09/24/ai-vs-ai-detecting-an-ai-obfuscated-phishing-campaign" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/ai-generated-code-phishing/" } ] }, { "id": "forcedleak-agentforce", "date": "2025-09-25", "title": "ForcedLeak: Web-to-Lead prompt injection and a $5 expired domain leak Agentforce CRM data", "category": "Prompt injection", "direction": "on-ai", "severity": "critical", "country": "US", "region": "North America", "target": "Salesforce Agentforce", "loss_usd": null, "summary": "Noma Security found instructions in a Web-to-Lead form, plus a whitelisted Salesforce CSP domain that had expired and cost $5, let Agentforce send CRM records to an attacker. Salesforce fixed it by 8 September 2025.", "source": "Noma Security", "url": "https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html", "actor": "Noma Labs (Noma Security)", "actor_type": "researcher", "attribution": "Responsible disclosure to Salesforce on 28 July 2025; Noma scored it CVSS 9.4", "motive": "Security research", "vector": "Hidden instructions in the Description field of a Web-to-Lead submission; when staff query leads, the agent renders a PNG request carrying CRM data to the expired my-salesforce-cms.com domain", "root_cause": "Agent could not distinguish data from instructions, and the Content Security Policy trusted a domain Salesforce no longer owned", "timeline": [ { "date": "2025-07-28", "event": "Noma reports ForcedLeak to Salesforce" }, { "date": "2025-09-08", "event": "Salesforce deploys Trusted URL enforcement for Agentforce and Einstein" }, { "date": "2025-09-25", "event": "Public disclosure" } ], "impact": "Any organisation using Agentforce with Web-to-Lead was exposed to CRM exfiltration; no confirmed abuse", "response": "Salesforce re-registered the expired domain and enforced Trusted URLs so agents cannot send data to untrusted destinations", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html" }, { "name": "Dark Reading", "url": "https://darkreading.com/vulnerabilities-threats/salesforce-ai-agents-leak-sensitive-data" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/182676/hacking/forcedleak-flaw-in-salesforce-agentforce-exposes-crm-data-via-prompt-injection.html" } ] }, { "id": "postmark-mcp-backdoor", "date": "2025-09-25", "title": "First malicious MCP server found: postmark-mcp npm package BCCs all emails to attacker", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "postmark-mcp users", "loss_usd": null, "summary": "Koi Security found a lookalike postmark-mcp package whose v1.0.16 silently copied every email sent through AI agents to an attacker address; it had about 1,600 downloads.", "source": "The Hacker News", "url": "https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html", "actor": "npm publisher 'phanpak' (identity unknown)", "actor_type": "criminal", "attribution": "Identified by Koi Security; package tied to npm account phanpak, which maintained 31 other packages; account later deleted", "motive": "Covert harvesting of email contents (invoices, password resets, internal communications)", "vector": "Trusted npm package postmark-mcp, a copy of Postmark's official MCP server, updated in v1.0.16 with a one-line BCC to phan@giftshop.club on every outbound email", "root_cause": "AI agents installed unvetted community MCP servers with full email-sending trust; a single maintainer could push a backdoored update with no review", "timeline": [ { "date": "2025-09-17", "event": "Version 1.0.16 of postmark-mcp published with the hidden BCC line" }, { "date": "2025-09-25", "event": "Koi Security discloses the backdoor; package has about 1,500 weekly downloads" }, { "date": "2025-09-26", "event": "Developer removes the package from npm without responding to Koi" } ], "impact": "An estimated 300 organisations exposed; thousands of emails a day including password resets and invoices silently copied to the attacker's server", "response": "Package deleted from npm by the publisher; Koi, Snyk and Qualys advised uninstalling v1.0.16+, rotating credentials and auditing outbound mail", "status": "contained", "cve": null, "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html" }, { "name": "Snyk", "url": "https://snyk.io/es/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/" }, { "name": "Qualys", "url": "https://threatprotect.qualys.com/2025/09/30/malicious-mcp-server-on-npm-postmark-mcp-exploited-in-attack/" } ] }, { "id": "sarb-kganyago-deepfake-warning", "date": "2025-09-25", "title": "South African Reserve Bank warns of deepfake video of Governor Kganyago pushing investment", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "ZA", "region": "Middle East & Africa", "target": "South African public", "loss_usd": null, "summary": "The SARB posted on X that a circulating video showing Governor Lesetja Kganyago endorsing an investment was a deepfake with an altered voice, stressing the central bank never promotes investments or asks for transfers.", "source": "IOL (citing SARB)", "url": "https://iol.co.za/business/2025-09-25-south-african-reserve-bank-warns-public-about-deepfake-investment-scam/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Lure investors to a fraudulent platform using central bank credibility.", "vector": "AI-generated video with cloned voice of the governor shared on social media directing viewers to a suspicious platform.", "root_cause": "Public figures' speeches provide ample training material for voice and face cloning.", "timeline": [ { "date": "2025-09-24", "event": "SARB flags deepfake video on X" }, { "date": "2025-09-25", "event": "South African media report the warning" } ], "impact": "No losses disclosed; coverage cited reports of a 1,200 percent rise in deepfake fraud cases in South Africa.", "response": "Public warning; SARB urged verification before trusting online content.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "IOL", "url": "https://iol.co.za/business/2025-09-25-south-african-reserve-bank-warns-public-about-deepfake-investment-scam/" }, { "name": "Personal Finance", "url": "https://persfin.co.za/business/2025-09-25-south-african-reserve-bank-warns-public-about-deepfake-investment-scam" } ] }, { "id": "gemini-trifecta-tenable", "date": "2025-09-30", "title": "Gemini Trifecta: log, search-history and browsing flaws let Gemini exfiltrate user data", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Google Gemini (Cloud Assist, Search, Browsing Tool)", "loss_usd": null, "summary": "Tenable disclosed three Gemini flaws: prompts in User-Agent headers ran when Cloud Assist summarised logs, injected browser-history queries became trusted context, and the browsing tool leaked data. Google fixed all.", "source": "Tenable Research", "url": "https://tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing", "actor": "Tenable Research", "actor_type": "researcher", "attribution": "Responsible disclosure to Google; remediated before publication", "motive": "Security research", "vector": "Poisoned HTTP log entries, JavaScript that injects queries into a victim's Chrome history, and prompts that make the browsing tool embed saved locations in outbound requests", "root_cause": "Gemini integrations treated logs, search history and web content as trusted context without separation from user intent", "timeline": [ { "date": "2025", "event": "Tenable reports the three issues to Google" }, { "date": "2025-09-30", "event": "Tenable publishes the Gemini Trifecta research after Google remediation" } ], "impact": "Potential exposure of saved information and location data and compromise of cloud resources for Gemini users; no exploitation reported", "response": "Google stopped rendering hyperlinks in log summaries, hardened the search personalisation model and remediated the browsing tool", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Tenable", "url": "https://tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4068175/gemini-trifecta-ai-autonomy-without-guardrails-opens-new-attack-surface.html" }, { "name": "iTWire", "url": "https://itwire.com/guest-articles/guest-research/tenable-exposes-ai-flaws-in-google-gemini-that-could-have-let-hackers-steal-data-from-millions" } ] }, { "id": "argentina-adorni-ypf-ai-video", "date": "2025-10-01", "title": "AI-altered video of Argentine spokesman Adorni touts fake YPF investment platform", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "AR", "region": "Latin America", "target": "Argentine Facebook users; YPF and spokesman Manuel Adorni", "loss_usd": null, "summary": "Chequeado rated false a Facebook video in which a July 2025 press conference by spokesman Manuel Adorni was altered with AI to announce a YPF platform paying 3 million pesos a month; links led to phishing sites.", "source": "Chequeado", "url": "https://chequeado.com/ultimas-noticias/no-manuel-adorni-no-promociono-una-plataforma-de-inversion-del-gobierno-con-ypf-en-este-video-fue-alterado-con-ia/", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; same template used with Milei, Caputo and Kicillof since February 2025.", "motive": "Phishing and investment fraud.", "vector": "Lip-synced AI edit of official footage, device-dependent redirect to fake advisory or fake newspaper site collecting personal data.", "root_cause": "Public press-conference video is easily repurposed; ad and post moderation lagged.", "timeline": [ { "date": "2025-02-01", "event": "YPF deepfake scams featuring Milei and Kicillof circulate" }, { "date": "2025-07-24", "event": "Adorni gives the press conference later manipulated" }, { "date": "2025-10-01", "event": "Chequeado publishes fact-check rating the video false" } ], "impact": "Government and state oil company likeness abused for data harvesting; losses unknown.", "response": "YPF said it communicates only through verified channels; fact-check published.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Chequeado", "url": "https://chequeado.com/ultimas-noticias/no-manuel-adorni-no-promociono-una-plataforma-de-inversion-del-gobierno-con-ypf-en-este-video-fue-alterado-con-ia/" }, { "name": "Chequeado", "url": "https://chequeado.com/ultimas-noticias/las-estafas-con-las-que-intentaron-enganarnos-en-2025/" }, { "name": "Chequeado", "url": "https://chequeado.com/ultimas-noticias/estafas-y-videos-creados-con-inteligencia-artificial-asi-se-utiliza-la-imagen-de-famosos-para-enganar-con-falsas-inversiones-en-ypf/" } ] }, { "id": "brazil-gisele-deepfake-ads", "date": "2025-10-01", "title": "Brazil police bust ring using Gisele Bundchen deepfakes in Instagram ad scams", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "BR", "region": "Latin America", "target": "Brazilian consumers", "loss_usd": 3900000, "summary": "Rio Grande do Sul police arrested suspects accused of running deepfake celebrity ads for fake giveaways and products, moving over R$20M (about $3.9M) in suspicious funds.", "source": "AI Incident Database (CNN Brasil, Reuters)", "url": "https://incidentdatabase.ai/cite/1224/", "actor": "Unnamed Brazilian fraud ring (Operation Jungle Mode suspects)", "actor_type": "criminal", "attribution": "Identified by Rio Grande do Sul Civil Police after COAF flagged suspicious funds; suspects not publicly named", "motive": "Consumer fraud (fake giveaways and products with shipping-fee payments)", "vector": "Instagram ads with deepfake videos of Gisele Bundchen and other celebrities promoting fake suitcase giveaways and skincare products, collecting shipping fees for goods never delivered", "root_cause": "Easy celebrity deepfake generation combined with insufficient ad-platform screening of fraudulent celebrity endorsements", "timeline": [ { "date": "2024-08", "event": "Scheme active since at least this month, per police" }, { "date": "2025-10-01", "event": "Operation Jungle Mode: 7 arrest and 9 search warrants executed across five Brazilian states; four suspects arrested" }, { "date": "2025-10-03", "event": "Reuters reports the case; Meta says it removes deceptive celebrity ads when detected" } ], "impact": "Over R$20 million (about USD 3.9M) in suspicious funds moved from victims who paid for non-existent goods; victim count not disclosed", "response": "Police arrested suspects, froze assets across five states; Bundchen's team warned consumers to verify offers; Meta cited ad-removal policies", "status": "under investigation", "cve": null, "sources": [ { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1224/" }, { "name": "Reuters (via Yahoo News)", "url": "https://www.yahoo.com/news/articles/brazilian-scammers-raking-millions-used-204932574.html" }, { "name": "Malay Mail (Reuters)", "url": "https://www.malaymail.com/news/tech-gadgets/2025/10/05/brazilian-scammers-rake-in-millions-using-gisele-bundchen-deepfakes-in-instagram-ads-to-defraud-victims/193369" } ] }, { "id": "old-mutual-trevor-manuel-deepfake", "date": "2025-10-03", "title": "Old Mutual warns of deepfake videos of chairman Trevor Manuel pushing fake investments", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "ZA", "region": "Middle East & Africa", "target": "Old Mutual customers and South African public", "loss_usd": null, "summary": "Old Mutual warned that AI videos using the likeness and cloned voice of its chairman, former finance minister Trevor Manuel, were circulating on social media to solicit money for fake investments.", "source": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1226/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Solicit investment funds under a trusted financial brand.", "vector": "Deepfake videos on social media impersonating the chairman of a major insurer.", "root_cause": "Unverified financial advertising on social platforms.", "timeline": [ { "date": "2025-10-01", "event": "Deepfake Manuel investment videos circulate on social media" }, { "date": "2025-10-03", "event": "Old Mutual issues public warning; Manuel denies involvement" } ], "impact": "No loss figures published; reputational risk to Old Mutual and its chairman.", "response": "Public denial and warning by Old Mutual and Trevor Manuel.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1226/" }, { "name": "AI Incident Database entity", "url": "https://incidentdatabase.ai/entities/unknown-scammers-impersonating-trevor-manuel/" } ] }, { "id": "pesaro-meloni-deepfake-pensioners", "date": "2025-10-05", "title": "Pesaro retirees lose over 10,000 euros to deepfake of Meloni promoting investment site", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "IT", "region": "Europe", "target": "Retired couple in Pesaro; Prime Minister Meloni's likeness", "loss_usd": 11700, "summary": "A couple in their sixties told Pesaro police that a video with Meloni's cloned face and voice, styled as a government spot, led them to deposit over 10,000 euros on a platform that vanished at withdrawal.", "source": "Open", "url": "https://www.open.online/2025/10/05/pesaro-truffa-clone-giorgia-meloni-ai-coppia-raggirata/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Under investigation by the Pesaro Questura alongside other synthetic-voice scams.", "motive": "Fake investment platform fraud.", "vector": "Deepfake video of the prime minister mixed into social media feeds, small initial deposits followed by blocked withdrawals.", "root_cause": "Synthetic political endorsements and absent moderation of paid content.", "timeline": [ { "date": "2025-09-01", "event": "Couple sees deepfake Meloni video and begins investing" }, { "date": "2025-10-05", "event": "Two complaints filed with Pesaro police reported in press" } ], "impact": "More than 10,000 euros, about US$11,700, lost by one couple; over 25,000 euros across two Pesaro cases.", "response": "Police investigation opened; no arrests reported.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Open", "url": "https://www.open.online/2025/10/05/pesaro-truffa-clone-giorgia-meloni-ai-coppia-raggirata/" }, { "name": "Blue News", "url": "https://www.bluewin.ch/it/attualita/borsa-economia/italia-boom-truffe-finanziarie-deepfake-anche-con-musk-meloni-li.2431891" } ] }, { "id": "openai-dprk-korean-c2-phishing", "date": "2025-10-07", "title": "North Korea-linked cluster used ChatGPT for C2 tooling in phishing of Seoul's diplomats", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "KR", "region": "Asia-Pacific", "target": "South Korean diplomatic entities", "loss_usd": null, "summary": "Korean-language accounts aligned with known DPRK phishing campaigns against South Korean diplomats used ChatGPT to develop C2 malware, macOS extensions, Windows Server VPN configs and credential-theft tooling.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf", "actor": "North Korea-linked phishing cluster", "actor_type": "state", "attribution": "OpenAI aligned the cluster with publicly reported DPRK campaigns against South Korean diplomatic targets.", "motive": "Espionage", "vector": "LLM-assisted development of C2 infrastructure and browser-extension conversion for phishing", "root_cause": "Developer-style requests for C2 and extension code were not individually blocked", "timeline": [ { "date": "2025-10", "event": "The Hacker News and ThaiCERT relay the DPRK attribution" }, { "date": "2025-10-07", "event": "OpenAI suspends the accounts and publishes the case" } ], "impact": "Tooling for an active diplomatic phishing campaign; victim compromises not quantified.", "response": "Accounts suspended; OpenAI shared findings with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI October 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf" }, { "name": "ThaiCERT repost of The Hacker News", "url": "https://www.thaicert.or.th/?p=9836" }, { "name": "SiliconANGLE coverage", "url": "https://siliconangle.com/2025/10/07/openai-details-expanding-efforts-disrupt-malicious-use-ai-new-report/" } ] }, { "id": "openai-russian-rat-stealers", "date": "2025-10-07", "title": "Russian-speaking criminals assembled RAT and credential stealers from ChatGPT snippets", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Windows users targeted by the group's malware", "loss_usd": null, "summary": "OpenAI banned accounts tied to Russian-speaking criminal groups that requested small code pieces to build a remote-access trojan, credential stealers and evasion features, posting evidence of their work on Telegram.", "source": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling/", "actor": "Unknown Russian-speaking criminal group", "actor_type": "criminal", "attribution": "OpenAI linked the accounts to Russian-speaking criminal communities via their Telegram channel.", "motive": "Credential theft and financial gain", "vector": "Requests split into snippets to evade refusals, then assembled into malware", "root_cause": "Fragmented coding requests bypassed intent detection", "timeline": [ { "date": "2025-10", "event": "Group posts evidence of its malware work in a Russian-language Telegram channel" }, { "date": "2025-10-07", "event": "OpenAI publishes the case and bans the accounts" } ], "impact": "Refined malware components; OpenAI said the model refused direct malicious requests.", "response": "Accounts banned; findings shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI case study", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-russian-speaking-malware-tooling/" }, { "name": "OpenAI October 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf" }, { "name": "vpnMentor coverage", "url": "https://www.vpnmentor.com/news/openai-new-security-report-reveals-latest-ai-threats/" } ] }, { "id": "openai-scam-centres-oct2025", "date": "2025-10-07", "title": "Scam networks in Cambodia, Myanmar and Nigeria used ChatGPT for investment-fraud personas", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Social-media users targeted by investment and romance scams", "loss_usd": null, "summary": "Organised scam operations in Cambodia, Myanmar and Nigeria used ChatGPT to translate messages, generate social-media content and build investment personas, even asking it to strip em dashes to hide AI authorship.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf", "actor": "Unknown scam networks (Cambodia, Myanmar, Nigeria)", "actor_type": "criminal", "attribution": "OpenAI located the operations by language, timing and infrastructure; groups not named.", "motive": "Financial fraud", "vector": "LLM content generation and translation inside existing scam workflows", "root_cause": "Scam centres embedding AI for efficiency; OpenAI noted the model is used three times more often to detect scams than to run them", "timeline": [ { "date": "2025-10", "event": "OpenAI notes model used three times more to detect scams than to run them" }, { "date": "2025-10-07", "event": "OpenAI publishes the case and bans the accounts" } ], "impact": "More polished multilingual lures; victim losses not quantified.", "response": "Accounts banned; findings shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI October 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf" }, { "name": "SiliconANGLE coverage", "url": "https://siliconangle.com/2025/10/07/openai-details-expanding-efforts-disrupt-malicious-use-ai-new-report/" }, { "name": "vpnMentor coverage", "url": "https://www.vpnmentor.com/news/openai-new-security-report-reveals-latest-ai-threats/" } ] }, { "id": "openai-scam-networks-oct-2025", "date": "2025-10-07", "title": "OpenAI bans ChatGPT accounts of scam networks in Cambodia, Myanmar and Nigeria", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Online fraud victims worldwide", "loss_usd": null, "summary": "OpenAI's October 2025 threat report said it disrupted scam networks likely based in Cambodia, Myanmar and Nigeria that used ChatGPT for scripts, impersonation, translation and victim engagement, and banned the accounts.", "source": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-scam-operations", "actor": "Organised online fraud networks in Cambodia, Myanmar and Nigeria", "actor_type": "criminal", "attribution": "OpenAI investigation based on account behaviour; locations assessed as likely, not confirmed by law enforcement", "motive": "Financial gain through investment, romance and task scams", "vector": "ChatGPT used to draft scam scripts, translate conversations, build personas and sustain victim engagement", "root_cause": "General-purpose LLM access lowered the language and labour cost of running multilingual scam operations", "timeline": [ { "date": "2025-07", "event": "OpenAI begins tracking the scam-related account clusters over a three-month period" }, { "date": "2025-10-07", "event": "OpenAI publishes case study and confirms account bans" } ], "impact": "Scale of victim losses not published; OpenAI described attempts to defraud people online across several regions", "response": "Accounts banned and indicators shared with industry partners", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-scam-operations" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/openai-says-it-stopped-an-asian-scam-campaign-hijacking-chatgpt-to-lure-in-victims" } ] }, { "id": "openai-unk-droppitch-taiwan", "date": "2025-10-07", "title": "UNK_DropPitch used ChatGPT to craft phishing and tooling against Taiwan's chip sector", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "TW", "region": "Asia-Pacific", "target": "Taiwanese investment and semiconductor firms, US academia", "loss_usd": null, "summary": "A Chinese-language cluster tracked as UNK_DropPitch (UTA0388) wrote multilingual phishing emails and built remote-execution scripts and HTTPS traffic protection with ChatGPT while targeting Taiwan's chip industry.", "source": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf", "actor": "UNK_DropPitch / UTA0388 (China-linked)", "actor_type": "state", "attribution": "OpenAI and third-party trackers link the cluster to a Chinese hacking outfit; confidence moderate.", "motive": "Espionage against semiconductor and political targets", "vector": "LLM-generated phishing content and malware debugging", "root_cause": "Phishing drafting and tooling requests embedded in routine-looking developer sessions", "timeline": [ { "date": "2025-10", "event": "Third-party trackers publish UTA0388 overlap with the OpenAI cluster" }, { "date": "2025-10-07", "event": "OpenAI suspends the accounts and publishes the case" } ], "impact": "Targeted phishing of Taiwanese financial and chip firms; compromise outcomes not published.", "response": "Accounts suspended; indicators shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI October 2025 report PDF", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf" }, { "name": "ThaiCERT repost of The Hacker News", "url": "https://www.thaicert.or.th/?p=9836" }, { "name": "SiliconANGLE coverage", "url": "https://siliconangle.com/2025/10/07/openai-details-expanding-efforts-disrupt-malicious-use-ai-new-report/" } ] }, { "id": "camoleak-copilot-chat", "date": "2025-10-09", "title": "CamoLeak: hidden PR comments make GitHub Copilot Chat leak private repo secrets", "category": "Prompt injection", "direction": "on-ai", "severity": "critical", "country": "US", "region": "North America", "target": "GitHub Copilot Chat", "loss_usd": null, "summary": "Legit Security found a CVSS 9.6 flaw where invisible markdown comments in pull requests steered Copilot Chat to read private repositories and exfiltrate secrets character by character through GitHub's Camo image proxy.", "source": "Legit Security", "url": "https://legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code", "actor": "Omer Mayraz (Legit Security)", "actor_type": "researcher", "attribution": "Responsible disclosure through HackerOne in June 2025", "motive": "Security research", "vector": "Prompt injection in invisible pull request or issue comments; Copilot acts with the viewer's permissions and encodes stolen data as a sequence of pre-generated Camo image URLs that bypass CSP", "root_cause": "Copilot Chat consumed hidden comment content as instructions and could render images through the trusted Camo proxy, creating a covert exfiltration channel", "timeline": [ { "date": "2025-06", "event": "Legit Security reports the flaw to GitHub via HackerOne" }, { "date": "2025-08-14", "event": "GitHub disables image rendering in Copilot Chat to close the Camo channel" }, { "date": "2025-10-09", "event": "Public disclosure of CamoLeak" } ], "impact": "Proof of concept exfiltrated AWS keys, tokens and the description of an undisclosed zero-day from a private repository; the attack could also push malicious packages via Copilot suggestions", "response": "GitHub disabled all image rendering in Copilot Chat and blocked use of Camo for leaking user content", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Legit Security", "url": "https://legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code" }, { "name": "The Register", "url": "https://theregister.com/2025/10/09/github_copilot_chat_vulnerability/" }, { "name": "eSecurity Planet", "url": "https://www.esecurityplanet.com/news/github-copilot-data-theft/" } ] }, { "id": "hk-ai-faceswap-lost-id-syndicate", "date": "2025-10-10", "title": "Hong Kong police arrest 22 who used AI face-swaps on lost ID cards to open bank accounts", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "HK", "region": "Asia-Pacific", "target": "Seven Hong Kong banks and stored-value facilities", "loss_usd": 216000, "summary": "A syndicate pasted members' faces onto photos from lost Hong Kong ID cards to pass remote onboarding at seven banks, opening 19 accounts that laundered about HK$190 million; 22 people were arrested.", "source": "TVB News", "url": "https://news.tvb.com/en/799013-CriminalsyndicateforgeIDcardswithAItoopenbankaccountsandborrowloans", "actor": "Hong Kong triad-linked fraud syndicate", "actor_type": "criminal", "attribution": "Hong Kong Island Regional Crime Unit identified two ringleaders, five core members and 15 mule account holders, some with triad backgrounds.", "motive": "Obtain loans and credit cards and launder proceeds of phone, investment and shopping scams.", "vector": "AI face-swapping of lost ID card images used in 23 online account applications between September 2024 and April 2025; 19 passed KYC checks.", "root_cause": "Remote onboarding relied on selfie-to-ID matching that could be defeated by synthetic faces built on genuine stolen documents.", "timeline": [ { "date": "2024-09-01", "event": "Syndicate begins submitting AI-altered account applications" }, { "date": "2025-10-08", "event": "Police make arrests across Hong Kong over two days" }, { "date": "2025-10-10", "event": "Police announce 22 arrests and HK$190 million in laundered funds" } ], "impact": "Accounts linked to at least 14 local scams with losses of about HK$1.68 million, roughly US$216,000, and about HK$190 million in suspected criminal proceeds moved in a year.", "response": "Arrests for conspiracy to defraud and money laundering; phones, laptops and printers seized; regulators and banks told to strengthen remote identity checks.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "HK01", "url": "https://global.hk01.com/突发/60284283/警捣犯罪集团拘22人-ai换报失身份证头像开户借贷-洗-1-9亿黑钱" }, { "name": "TVB News", "url": "https://news.tvb.com/en/799013-CriminalsyndicateforgeIDcardswithAItoopenbankaccountsandborrowloans" }, { "name": "The Standard", "url": "https://www.thestandard.com.hk/news/article/313790/Police-dismantle-AI-driven-fraud-syndicate-arresting-22" }, { "name": "World Journal (世界日報)", "url": "https://www.worldjournal.com/wj/amp/story/121341/9063323" } ] }, { "id": "smithery-mcp-hosting-traversal", "date": "2025-10-15", "title": "Path traversal in Smithery MCP hosting exposed root access to 3,000 hosted MCP servers", "category": "AI supply chain", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Smithery.ai hosted MCP servers", "loss_usd": null, "summary": "GitGuardian showed that an unvalidated dockerBuildPath in smithery.yaml let a malicious Dockerfile read the builder's home directory and steal a fly.io token giving root on more than 3,000 hosted MCP servers and visibility of customer API keys.", "source": "GitGuardian", "url": "https://blog.gitguardian.com/breaking-mcp-server-hosting/", "actor": "GitGuardian researchers", "actor_type": "researcher", "attribution": "Discovered and responsibly disclosed by GitGuardian; Smithery acknowledged and fixed the flaw and found no evidence of exploitation", "motive": "Security research into MCP hosting platforms", "vector": "Setting dockerBuildPath to a parent directory so the Docker build context included the builder's .docker/config.json containing an overprivileged fly.io token", "root_cause": "Unvalidated build configuration plus a shared, overprivileged platform credential with access to the fly.io Machines API", "timeline": [ { "date": "2025-06-10", "event": "GitGuardian discovers the path traversal" }, { "date": "2025-06-13", "event": "Proof of concept disclosed to Smithery, which acknowledges it the same day" }, { "date": "2025-06-14", "event": "Partial fix deployed and compromised token rotated" }, { "date": "2025-06-15", "event": "Complete fix deployed" }, { "date": "2025-10-15", "event": "GitGuardian publishes the write-up" } ], "impact": "Demonstrated root command execution on hosted MCP servers and capture of a customer API key in traffic; secrets of thousands of customers across hundreds of services could have been exposed", "response": "Smithery rotated the token and fixed the build path validation within two days of disclosure", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "GitGuardian", "url": "https://blog.gitguardian.com/breaking-mcp-server-hosting/" }, { "name": "SC World", "url": "https://scworld.com/news/smithery-ai-fixes-path-traversal-flaw-that-exposed-3000-mcp-servers" } ] }, { "id": "uae-economy-minister-deepfake-ads", "date": "2025-10-16", "title": "UAE economy minister says his deepfake was used in social media investment scam campaigns", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "AE", "region": "Middle East & Africa", "target": "UAE residents; Economy Minister Abdullah bin Touq Al Marri", "loss_usd": null, "summary": "At GITEX 2025, Minister Abdullah bin Touq Al Marri said fraudsters had manipulated his image in video campaigns urging people to invest in shares, and called for deepfake detection technology.", "source": "AGBI", "url": "https://www.agbi.com/tech/2025/10/uae-minister-and-tech-experts-warn-of-deepfake-explosion/", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; the minister described recent targeting by fraudsters.", "motive": "Investment fraud using a ministerial endorsement.", "vector": "Manipulated video of the minister in social media ad campaigns.", "root_cause": "Abundant public footage of officials and limited content authentication.", "timeline": [ { "date": "2025-10-14", "event": "Minister discloses deepfake targeting at GITEX Global" }, { "date": "2025-10-16", "event": "Regional press reports the warning" } ], "impact": "Ministerial likeness used to lure investors; no loss figures given.", "response": "Public warning; call for authentication tools; no enforcement action reported.", "status": "unresolved", "cve": null, "verification": "reported", "sources": [ { "name": "AGBI", "url": "https://www.agbi.com/tech/2025/10/uae-minister-and-tech-experts-warn-of-deepfake-explosion/" }, { "name": "MENA Startup Digest", "url": "https://menastartupdigest.com/?p=18580" } ] }, { "id": "uae-economy-minister-deepfake-videos", "date": "2025-10-16", "title": "UAE Economy Minister says his face was deepfaked in social media investment scam videos", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "AE", "region": "Middle East & Africa", "target": "UAE social media users", "loss_usd": null, "summary": "At GITEX 2025, UAE Minister of Economy Abdulla bin Touq Al Marri said fraudsters had manipulated his image in social media videos promoting fraudulent share investment schemes and called for deepfake detection tools.", "source": "AGBI", "url": "https://www.agbi.com/tech/2025/10/uae-minister-and-tech-experts-warn-of-deepfake-explosion/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Lure investors with a government minister's apparent endorsement.", "vector": "Manipulated videos of the minister on social media promoting share investment schemes.", "root_cause": "Abundant public footage of officials and limited platform verification of financial ads.", "timeline": [ { "date": "2025-10-14", "event": "Minister discusses being targeted by deepfake investment videos at GITEX" }, { "date": "2025-10-16", "event": "Regional media report the warning and Sumsub MENA deepfake growth figures" } ], "impact": "No losses disclosed; Sumsub data cited 600 percent growth in deepfakes in Saudi Arabia and 200 percent in Kuwait.", "response": "Minister publicly stated he would never endorse share investments on camera.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "AGBI", "url": "https://www.agbi.com/tech/2025/10/uae-minister-and-tech-experts-warn-of-deepfake-explosion/" }, { "name": "MENA Startup Digest", "url": "https://menastartupdigest.com/uae-minister-warns-of-mena-deepfake-explosion-after-being-targeted-in-investment-scams/" } ] }, { "id": "pampanga-marcos-deepfake-p93m", "date": "2025-10-22", "title": "Philippine doctor loses P93M to investment scam backed by deepfake of President Marcos", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "PH", "region": "Asia-Pacific", "target": "Dr. Marie Faith Sagun-Villarta, Pampanga", "loss_usd": 1600000, "summary": "PNP-CIDG entrapped two suspects in Angeles City who used an AI-generated video of President Marcos Jr. and gifts supposedly from him to convince a doctor to hand over about P93 million for fake investments.", "source": "GMA News", "url": "https://www.gmanetwork.com/news/topstories/nation/963384/marcos-deepfake-video-scam-pampanga/story/", "actor": "Two suspects detained by PNP-CIDG Tarlac", "actor_type": "criminal", "attribution": "Palace press officer Claire Castro confirmed the video was an AI deepfake; suspects face estafa charges under cybercrime law.", "motive": "Financial fraud using the president's likeness.", "vector": "Deepfake video of the president plus luxury gifts and promises of 20 to 30 percent dividends over about a year.", "root_cause": "Synthetic media exploited trust in a head of state; no verification channel for supposed presidential investment offers.", "timeline": [ { "date": "2024-10-01", "event": "Victim begins investing after seeing manipulated video and receiving gifts" }, { "date": "2025-10-21", "event": "CIDG entrapment at a coffee shop with marked money" }, { "date": "2025-10-22", "event": "Arrests and deepfake confirmation reported" } ], "impact": "About P93 million, roughly US$1.6 million, lost by one victim.", "response": "Two arrested and charged with estafa through fraudulent means related to cybercrime; CICC had earlier warned about Marcos deepfakes promoting trading platforms.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "GMA News", "url": "https://www.gmanetwork.com/news/topstories/nation/963384/marcos-deepfake-video-scam-pampanga/story/" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1148/" }, { "name": "ABS-CBN", "url": "https://abs-cbn.com/news/technology/2025/6/24/cicc-warns-vs-deepfake-video-using-president-s-image-to-promote-trading-platform-0700" } ] }, { "id": "kaspersky-bluenoroff-ghostcall", "date": "2025-10-28", "title": "Kaspersky: BlueNoroff GhostCall and GhostHire campaigns sped up by generative AI", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Web3 and crypto executives and blockchain developers", "loss_usd": null, "summary": "Kaspersky said BlueNoroff used generative AI to speed malware development and analyse stolen data for targeting in GhostCall (fake VC calls on macOS) and GhostHire (fake recruiter tests), active since April 2025.", "source": "Kaspersky GReAT", "url": "https://www.kaspersky.com/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools", "actor": "BlueNoroff (Lazarus subgroup)", "actor_type": "state", "attribution": "Kaspersky GReAT attributes both campaigns to BlueNoroff under the Lazarus umbrella; shared C2 and tooling.", "motive": "Cryptocurrency theft for the DPRK", "vector": "Telegram approaches from fake or hijacked VC accounts, fake Zoom and Teams update pages, malicious GitHub skill-test repos; seven multi-stage chains delivering crypto and credential stealers", "root_cause": "AI-accelerated tooling and replayed victim videos made social engineering and malware iteration faster and more convincing", "timeline": [ { "date": "2025-04-01", "event": "GhostCall and GhostHire activity observed from at least this month" }, { "date": "2025-10-28", "event": "Kaspersky presents findings at Security Analyst Summit" } ], "impact": "Executives and developers compromised across several countries; stolen data reused for supply-chain style follow-on attacks.", "response": "Kaspersky published indicators and detection guidance for macOS and Windows chains.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Kaspersky", "url": "https://www.kaspersky.com/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools" }, { "name": "eSecurity Planet", "url": "https://esecurityplanet.com/news/bluenoroff-expands-cyberattacks-with-ai-driven-campaigns-targeting-executives" } ] }, { "id": "sweden-deepfake-pump-dump-500m-sek", "date": "2025-10-31", "title": "Deepfake ads of Swedish finance figures lure 5,000 savers into pump-and-dump scams", "category": "Deepfake fraud", "direction": "with-ai", "severity": "critical", "country": "SE", "region": "Europe", "target": "Swedish retail investors", "loss_usd": 52000000, "summary": "Swedish media reported at least 5,000 small savers lost about 500M SEK (about $52M) in 2025 to pump-and-dump share scams promoted with deepfake ads of journalist Gabriel Mellqvist and investor Gunter Marder on Meta.", "source": "Sveriges Radio", "url": "https://www.sverigesradio.se/artikel/thousands-of-small-savers-in-sweden-conned-out-of-millions-in-ai-powered-deepfake-investment-scams", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; organised pump-and-dump operators using social media advertising.", "motive": "Profit from inflating low-value shares before dumping them on lured retail buyers.", "vector": "AI-generated deepfake videos and fake profiles of trusted Swedish finance personalities in paid social media ads directing savers to stock tips and chat groups.", "root_cause": "Meta ad systems carried fabricated endorsements; impersonated figures reported great frustration at slow platform takedowns.", "timeline": [ { "date": "2025-01-01", "event": "Deepfake investment adverts circulate on Meta platforms through 2025" }, { "date": "2025-10-24", "event": "TV4 Nyheterna reports 5,000 Swedes defrauded" }, { "date": "2025-10-31", "event": "Sveriges Radio reports losses of about half a billion kronor" } ], "impact": "At least 5,000 investors and roughly 500M SEK in losses; reputational harm to impersonated journalists.", "response": "Impersonated figures publicly criticised Meta; no police action was reported in the coverage reviewed.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "Sveriges Radio", "url": "https://www.sverigesradio.se/artikel/thousands-of-small-savers-in-sweden-conned-out-of-millions-in-ai-powered-deepfake-investment-scams" }, { "name": "TV4", "url": "https://www.tv4.se/artikel/6YQRkByHXwnifKU4fHbRN1/finansprofiler-utnyttjas-av-bedragare-5000-svenskar-har-blivit-lurade" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/cite/1256/" } ] }, { "id": "microsoft-sesameop-backdoor", "date": "2025-11-03", "title": "SesameOp backdoor used OpenAI Assistants API as covert command-and-control for months", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Unnamed organisation under long-term espionage access", "loss_usd": null, "summary": "Microsoft DART found a .NET backdoor that relayed encrypted commands and results through OpenAI Assistants API objects using a hardcoded API key, hiding C2 in legitimate AI traffic; attackers had been present for months.", "source": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/", "actor": "Unknown", "actor_type": "unknown", "attribution": "Microsoft did not attribute the actor; objective assessed as long-term persistence for espionage.", "motive": "Espionage and persistent access", "vector": "Netapi64.dll loader via .NET AppDomainManager injection; Assistants API threads and descriptions used as C2 channel", "root_cause": "Legitimate cloud AI APIs can be abused as covert channels; compromised Visual Studio utilities carried malicious libraries", "timeline": [ { "date": "2025-07", "event": "Microsoft DART responds to the incident and discovers the backdoor" }, { "date": "2025-11-03", "event": "Microsoft publishes analysis; OpenAI disables the API key and account" } ], "impact": "Months of covert access to the victim environment; data taken not disclosed.", "response": "Joint Microsoft and OpenAI investigation; API key and account disabled; Defender detections published.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/" }, { "name": "Microsoft AI as tradecraft post (related)", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/" } ] }, { "id": "gtig-china-ctf-pretext", "date": "2025-11-05", "title": "China-nexus actor bypassed Gemini refusal with CTF pretext to get exploitation guidance", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Compromised systems in the actor's intrusion campaign", "loss_usd": null, "summary": "A suspected China-nexus group asked Gemini to find flaws on a compromised system, was refused, then reframed the request as a capture-the-flag exercise and got exploitable guidance reused for phishing and web shells.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "actor": "Unnamed China-nexus group", "actor_type": "state", "attribution": "GTIG assessed a PRC nexus; group not named.", "motive": "Espionage", "vector": "Jailbreak-by-pretext against model safety guardrails", "root_cause": "Guardrails treated CTF framing as benign", "timeline": [ { "date": "2025", "event": "Actor reuses CTF-framed guidance for phishing, exploitation and web-shell development" }, { "date": "2025-11-05", "event": "GTIG publishes the case after disabling the actor's assets" } ], "impact": "Guardrail bypass yielded operational guidance; downstream victims not detailed.", "response": "Assets disabled; classifiers and model hardened against the pretext.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker November 2025", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" }, { "name": "Hendry Adrian mirror", "url": "https://www.hendryadrian.com/?p=84695" } ] }, { "id": "gtig-muddywater-gemini-opsec", "date": "2025-11-05", "title": "Iran's MuddyWater leaked C2 domain and encryption key to Gemini while debugging malware", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Middle East & Africa", "target": "MuddyWater phishing victims via compromised corporate email", "loss_usd": null, "summary": "TEMP.Zagros (MuddyWater) used student-project pretexts to get Gemini's help building web shells and a Python C2 server, and pasted a script containing its C2 domain and encryption key, exposing infrastructure to Google.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "actor": "TEMP.Zagros / MuddyWater (Iran)", "actor_type": "state", "attribution": "GTIG attributes the accounts to the Iranian government-backed group with high confidence.", "motive": "Espionage", "vector": "Pretext prompts to obtain custom malware code and debugging", "root_cause": "Operator pasted live infrastructure details into a monitored service", "timeline": [ { "date": "2025", "event": "Group shifts from public tools to custom web shells and Python C2" }, { "date": "2025-11-05", "event": "GTIG disables assets and publishes the case" } ], "impact": "Infrastructure exposed to defenders; campaign disrupted.", "response": "Google disabled assets, took broader action against the campaign and strengthened classifiers.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker November 2025", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" }, { "name": "Hendry Adrian mirror", "url": "https://www.hendryadrian.com/?p=84695" } ] }, { "id": "gtig-promptflux", "date": "2025-11-05", "title": "Google flags PROMPTFLUX and other malware that call Gemini at runtime", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Windows systems", "loss_usd": null, "summary": "Google's threat team reported experimental malware such as PROMPTFLUX that asks Gemini to rewrite its own VBScript for evasion, plus state use of LLM-enabled tools like PROMPTSTEAL.", "source": "CyberInsider", "url": "https://cyberinsider.com/promptflux-malware-uses-gemini-to-rewrite-and-hide-itself-in-real-time/", "actor": "Unknown developer (PROMPTFLUX); APT28 (Russian GRU-linked) for PROMPTSTEAL", "actor_type": "state", "attribution": "PROMPTFLUX not attributed by Google (naming consistent with financially motivated actors); PROMPTSTEAL attributed to APT28 by GTIG and CERT-UA", "motive": "Evasion research and testing (PROMPTFLUX); espionage and data theft against Ukraine (PROMPTSTEAL)", "vector": "Malware embedding Gemini API calls to regenerate obfuscated VBScript at runtime; PROMPTSTEAL used a Hugging Face-hosted Qwen model with stolen API tokens to generate commands", "root_cause": "Public LLM APIs reachable from malware with stolen or free keys; just-in-time code generation lets malware offload logic to an external model to evade static detection", "timeline": [ { "date": "2025-07", "event": "CERT-UA documents LAMEHUG/PROMPTSTEAL used by APT28 against Ukrainian targets" }, { "date": "2025-11-05", "event": "GTIG publishes AI Threat Tracker describing PROMPTFLUX, PROMPTSTEAL and other LLM-calling malware" }, { "date": "2025-11-05", "event": "Google says it disabled API keys and projects associated with the activity" } ], "impact": "PROMPTFLUX assessed as experimental with no confirmed victims; PROMPTSTEAL collected system data and documents from Ukrainian targets. No financial loss reported.", "response": "Google disabled associated Gemini API keys and projects and added classifier protections; researchers including Marcus Hutchins questioned PROMPTFLUX's practical significance.", "status": "contained", "cve": null, "sources": [ { "name": "CyberInsider", "url": "https://cyberinsider.com/promptflux-malware-uses-gemini-to-rewrite-and-hide-itself-in-real-time/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/11/google-uncovers-promptflux-malware-that.html" }, { "name": "Field Effect", "url": "https://fieldeffect.com/blog/google-threat-intelligence-group-reports-on-adversaries-weaponizing-ai-tools" }, { "name": "Decrypt", "url": "https://decrypt.co/347781/google-threat-report-links-ai-powered-malware-to-dprk-crypto-theft" } ] }, { "id": "gtig-quietvault-stealer", "date": "2025-11-05", "title": "QUIETVAULT stealer uses local AI CLI tools to hunt secrets and leaks GitHub and npm tokens", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Developers with GitHub and npm tokens", "loss_usd": null, "summary": "GTIG documented QUIETVAULT, a JavaScript stealer seen in operations that takes GitHub and npm tokens, then drives AI command-line tools on the host to find more secrets and exfiltrates via a public GitHub repo.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "actor": "Unknown", "actor_type": "criminal", "attribution": "GTIG listed the family as observed in operations without naming an operator.", "motive": "Credential theft for supply-chain and account compromise", "vector": "Stealer abuses locally installed AI CLI agents as a secret-discovery engine", "root_cause": "AI coding agents on developer hosts can be driven by malware to search the filesystem", "timeline": [ { "date": "2025", "event": "QUIETVAULT observed stealing GitHub and npm tokens in live operations" }, { "date": "2025-11-05", "event": "GTIG publishes the family in its AI Threat Tracker" } ], "impact": "Developer tokens exposed through public repositories; scale not published.", "response": "Google described the family and recommended monitoring of AI CLI use on hosts.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker November 2025", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" }, { "name": "Hendry Adrian mirror", "url": "https://www.hendryadrian.com/?p=84695" } ] }, { "id": "tenable-hackedgpt", "date": "2025-11-05", "title": "HackedGPT: Tenable finds seven ChatGPT flaws including persistent memory injection", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "OpenAI ChatGPT (GPT-4o and GPT-5)", "loss_usd": null, "summary": "Tenable disclosed seven ChatGPT weaknesses including zero-click injection via search, one-click URL injection, a Bing redirect bypass and persistent memory injection that leaks data across sessions. OpenAI fixed some.", "source": "Tenable Research", "url": "https://www.techradar.com/pro/security/researchers-claim-chatgpt-has-a-whole-host-of-worrying-security-flaws-heres-what-they-found", "actor": "Tenable Research", "actor_type": "researcher", "attribution": "Responsible disclosure by Tenable; vulnerabilities demonstrated in lab conditions", "motive": "Security research", "vector": "Indirect prompt injection in web pages indexed by ChatGPT search, crafted chatgpt.com query links, trusted Bing wrapper URLs, markdown code-block tricks and writes to long-term memory", "root_cause": "Browsing, search and memory subsystems shared context without isolating untrusted content from user instructions, and URL safety checks trusted wrapper domains", "timeline": [ { "date": "2025", "event": "Tenable reports the issues to OpenAI during GPT-4o and GPT-5 testing" }, { "date": "2025-11-05", "event": "Tenable publishes the HackedGPT research" }, { "date": "2025-11", "event": "OpenAI confirms some flaws fixed; others remained reproducible on GPT-5 at publication" } ], "impact": "Demonstrated theft of chat history and data from connected services such as Google Drive, plus persistent compromise of a user's ChatGPT via memory. No confirmed real-world abuse", "response": "OpenAI remediated several of the seven issues; Tenable said some remained unaddressed and urged isolation of browsing, search and memory contexts", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/researchers-claim-chatgpt-has-a-whole-host-of-worrying-security-flaws-heres-what-they-found" }, { "name": "iTWire (Tenable guest research)", "url": "https://itwire.com/guest-articles/guest-research/seven-critical-vulnerabilities-open-chatgpt-to-data-theft-and-hijacking" }, { "name": "SecurityBrief Asia", "url": "https://securitybrief.asia/story/seven-chatgpt-flaws-expose-user-data-to-attack-tenable-warns" } ] }, { "id": "bangkok-chinese-deepfake-kyc-gang", "date": "2025-11-11", "title": "Bangkok police bust Chinese gang animating victims' photos with AI to beat bank KYC checks", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "TH", "region": "Asia-Pacific", "target": "Thai banks' KYC and account-opening systems", "loss_usd": null, "summary": "Metropolitan Police Division 5 arrested four Chinese nationals in a Sukhumvit condo who used AI to turn victims' still photos into blinking, head-turning videos that passed bank KYC liveness checks for criminal networks.", "source": "Pattaya Mail", "url": "https://www.pattayamail.com/thailandnews/police-bust-chinese-ai-scam-gang-in-bangkok-using-deepfake-tech-to-trick-banks-525765", "actor": "Four Chinese nationals hired via app by Chinese criminal networks", "actor_type": "criminal", "attribution": "Thai Metropolitan Police Division 5 under Pol Lt Gen Jirabhop Bhuridej; suspects admitted involvement and said they relocated from Cambodia", "motive": "Enable mule accounts and identity misuse for transnational fraud", "vector": "AI animation of stolen ID photos to spoof liveness detection in bank onboarding apps; handling of digital financial transactions for the network", "root_cause": "Photo-based KYC liveness checks vulnerable to generative video; victims' identity images readily obtained", "timeline": [ { "date": "2025-11", "event": "Raid on luxury condo in Khlong Toei; two desktops used for facial manipulation and 60 phones seized" }, { "date": "2025-11-10", "event": "Police hold public briefing on the arrests" } ], "impact": "Unknown number of fraudulent accounts opened; police warned of serious risk to financial fraud and identity misuse", "response": "Arrests on organised crime, transnational crime and drug charges; equipment seized", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Pattaya Mail", "url": "https://www.pattayamail.com/thailandnews/police-bust-chinese-ai-scam-gang-in-bangkok-using-deepfake-tech-to-trick-banks-525765" }, { "name": "Asia News Network", "url": "https://asianews.network/four-suspected-chinese-online-scammers-arrested-in-bangkok" } ] }, { "id": "anthropic-gtg-1002", "date": "2025-11-13", "title": "Chinese state group used Claude Code to run largely autonomous espionage", "category": "State actor AI ops", "direction": "with-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Tech, finance, chemical firms, government agencies", "loss_usd": null, "summary": "Anthropic said GTG-1002 tasked Claude Code agents to perform 80-90% of intrusion work against ~30 targets, with a handful of successful breaches, before accounts were banned.", "source": "Anthropic", "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf", "actor": "GTG-1002 (assessed Chinese state-sponsored group)", "actor_type": "state", "attribution": "Attributed by Anthropic with high confidence to a Chinese state-sponsored group; Chinese officials denied involvement", "motive": "Espionage and intelligence collection from tech, finance, chemical and government targets", "vector": "Jailbroken Claude Code agents orchestrated via MCP tools, with tasks decomposed into innocuous subtasks under a fake penetration-testing persona", "root_cause": "Agentic coding tools can be tricked by role-play and task decomposition into running recon, exploitation and exfiltration without recognizing malicious intent", "timeline": [ { "date": "2025-09", "event": "Campaign runs in mid-September against roughly 30 organizations" }, { "date": "2025-09", "event": "Anthropic detects suspicious activity and begins a ten-day investigation" }, { "date": "2025-11-13", "event": "Anthropic publishes report calling it the first AI-orchestrated cyber-espionage campaign" } ], "impact": "About 30 targets; a small number of intrusions succeeded with data accessed and exfiltrated. Claude performed an estimated 80-90% of tactical work. No financial loss disclosed.", "response": "Anthropic banned the accounts, notified affected entities and authorities, expanded detection classifiers and published its findings.", "status": "contained", "cve": null, "sources": [ { "name": "Anthropic", "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2025/11/chinese-hackers-use-anthropics-ai-to.html" }, { "name": "Cybersecurity Dive", "url": "https://www.cybersecuritydive.com/news/anthropic-state-actor-ai-tool-espionage/805550/" } ] }, { "id": "qatarenergy-ai-video-investment-scam", "date": "2025-11-17", "title": "QatarEnergy repeats warning over AI-generated videos impersonating it in investment scams", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "QA", "region": "Middle East & Africa", "target": "QatarEnergy and Qatari public", "loss_usd": null, "summary": "QatarEnergy reissued a warning that fraudulent online investment schemes were using its name and logo, including AI-generated videos impersonating the company, and stressed it never solicits money from the public.", "source": "The Peninsula Qatar", "url": "https://www.thepeninsulaqatar.com/article/17/11/2025/qatarenergy-reminds-public-to-exercise-caution-over-fake-investment-ads", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Collect investment deposits under a state energy company's brand.", "vector": "AI-generated videos and fake adverts online inviting the public into QatarEnergy investment opportunities.", "root_cause": "Brand impersonation enabled by generative video tools.", "timeline": [ { "date": "2025-03-01", "event": "QatarEnergy first warns about AI-generated investment videos using its name" }, { "date": "2025-11-17", "event": "QatarEnergy reposts the warning" } ], "impact": "No losses disclosed.", "response": "Repeated public warnings urging verification of offers.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Peninsula Qatar", "url": "https://www.thepeninsulaqatar.com/article/17/11/2025/qatarenergy-reminds-public-to-exercise-caution-over-fake-investment-ads" }, { "name": "Qatar Tribune", "url": "https://www.qatar-tribune.com/article/169404/latest-news/qatarenergy-warns-of-fake-adverts-videos-offering-investment-opportunities" } ] }, { "id": "shadowray-2", "date": "2025-11-18", "title": "ShadowRay 2.0 turns exposed Ray AI clusters into self-spreading mining botnet", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Ray (Anyscale) AI compute clusters", "loss_usd": null, "summary": "Oligo reported attackers abusing unauthenticated Ray job APIs (CVE-2023-48022) with LLM-written payloads to hijack AI GPU clusters for cryptomining, DDoS and data theft.", "source": "The Register", "url": "https://www.theregister.com/2025/11/18/selfreplicating_botnet_ray_clusters/", "actor": "IronErn440 (tracked by Oligo Security)", "actor_type": "criminal", "attribution": "Attributed by Oligo Security to a cluster it tracks as IronErn440; no government attribution", "motive": "Financial gain via cryptomining, plus credential theft and DDoS-for-hire", "vector": "Unauthenticated Ray Jobs API on internet-exposed dashboards used to submit multi-stage Bash and Python payloads, spread cluster-wide via Ray orchestration", "root_cause": "CVE-2023-48022 left unpatched because Anyscale treats unauthenticated job submission as a design choice; over 230,000 Ray servers exposed to the internet", "timeline": [ { "date": "2023-11", "event": "CVE-2023-48022 (ShadowRay) disclosed; Anyscale declines to patch" }, { "date": "2024-09", "event": "Oligo says ShadowRay 2.0 activity begins" }, { "date": "2025-11-05", "event": "First wave using GitLab payload delivery is taken down" }, { "date": "2025-11-17", "event": "Second wave begins using GitHub repositories" }, { "date": "2025-11-18", "event": "Oligo publishes ShadowRay 2.0 findings" } ], "impact": "Exposed Ray AI clusters hijacked for XMRig mining, DDoS and theft of credentials and data; GPU compute stolen at scale. No dollar figure reported.", "response": "Oligo reported the campaign and payload repositories were removed from GitLab and GitHub, though attackers quickly recreated them; Anyscale offers configuration tooling but no patch.", "status": "ongoing", "cve": "CVE-2023-48022", "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2025/11/18/selfreplicating_botnet_ray_clusters/" }, { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/new-shadowray-attacks-convert-ray-clusters-into-crypto-miners" }, { "name": "Dark Reading", "url": "https://www.darkreading.com/cyber-risk/shadowray-20-ai-clusters-crypto-botnets" } ] }, { "id": "uruguay-orsi-deepfake-ad-wave", "date": "2025-11-19", "title": "Uruguay's Interior Ministry warns of deepfake of President Orsi as paid scam ads escalate", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "UY", "region": "Latin America", "target": "Uruguayan social media users; President Yamandu Orsi", "loss_usd": null, "summary": "Uruguay's Interior Ministry warned of a deepfake of President Orsi with phishing links; by July 2026 detection firm Revelum counted 19 paid ads cloning his face and voice, 16 of them in two days.", "source": "Montevideo Portal", "url": "https://www.montevideo.com.uy/Noticias/Circula-un-intento-de-estafa-con-deepfake-de-Orsi-alerto-el-Ministerio-del-Interior-uc943776", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; Revelum noted the same four deepfake videos reused under different names to evade detection.", "motive": "Investment fraud and data theft via phishing sites.", "vector": "Paid social media ads with cloned presidential video, fake Canal 10 and Banco Central branding, and spoofed news sites requesting US$250 deposits.", "root_cause": "Ad platforms approved synthetic videos of a head of state; cheap voice and lip-sync cloning.", "timeline": [ { "date": "2025-10-31", "event": "Authorities warn of scams using Orsi and Vice President Cosse" }, { "date": "2025-11-19", "event": "Interior Ministry issues deepfake alert" }, { "date": "2026-07-23", "event": "Sixteen new Orsi deepfake ads appear in two days" }, { "date": "2026-07-29", "event": "El Observador publishes Revelum findings" } ], "impact": "Nearly 4,000 fraudulent ads targeted Uruguay in the first seven months of 2026 per Revelum; losses from the Orsi campaign not disclosed.", "response": "Government advised not to open links; no takedown figures published.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Montevideo Portal", "url": "https://www.montevideo.com.uy/Noticias/Circula-un-intento-de-estafa-con-deepfake-de-Orsi-alerto-el-Ministerio-del-Interior-uc943776" }, { "name": "El Observador", "url": "https://www.elobservador.com.uy/ciencia-y-tecnologia/aumentan-los-deepfakes-orsi-cometer-estafas-detectan-una-campana-que-exploto-la-ultima-semana-n6052424" }, { "name": "El Observador", "url": "https://www.elobservador.com.uy/nacional/alarma-nacional-uruguay-estos-son-los-videos-hechos-ia-estafar-utilizan-la-imagen-del-presidente-yamandu-orsi-n6025248" } ] }, { "id": "hashjack-url-fragment", "date": "2025-11-25", "title": "HashJack: prompts hidden in URL fragments hijack Comet, Edge Copilot and Gemini in Chrome", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "IL", "region": "Middle East & Africa", "target": "Perplexity Comet, Copilot in Edge, Gemini in Chrome", "loss_usd": null, "summary": "Cato CTRL showed instructions in a URL fragment, which never reaches the server, are read by AI browser assistants and can push phishing links or make agentic browsers leak data. Perplexity and Microsoft patched it.", "source": "Cato Networks (Cato CTRL)", "url": "https://www.theregister.com/2025/11/25/hashjack_attack_ai_browser_hashtag/", "actor": "Cato CTRL threat research", "actor_type": "researcher", "attribution": "Responsible disclosure to Perplexity (July 2025) and Google and Microsoft (August 2025)", "motive": "Security research", "vector": "Indirect prompt injection via client-side URL fragments on legitimate websites", "root_cause": "Assistants ingested the full URL including fragment as context", "timeline": [ { "date": "2025-07", "event": "Cato reports to Perplexity" }, { "date": "2025-08", "event": "Cato reports to Google and Microsoft" }, { "date": "2025-11-25", "event": "Public disclosure" } ], "impact": "Phishing, disinformation and data exfiltration via trusted sites; no in-the-wild abuse reported", "response": "Perplexity and Microsoft shipped fixes; Google rated it low severity and intended behaviour", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2025/11/25/hashjack_attack_ai_browser_hashtag/" }, { "name": "Help Net Security", "url": "https://www.helpnetsecurity.com/2025/11/26/hashjack-hijack-ai-assistants-browsers/" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/hashjack-indirect-prompt-injection" } ] }, { "id": "unit42-wormgpt4-kawaiigpt", "date": "2025-11-25", "title": "Unit 42 tests WormGPT 4 and KawaiiGPT, criminal LLMs that write ransomware scripts", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Phishing, BEC and ransomware victims of subscribers", "loss_usd": null, "summary": "Unit 42 found WormGPT 4 sold for 50 USD a month with 500+ Telegram subscribers and free KawaiiGPT on GitHub; both produced ransomware PowerShell, ransom notes, spear-phishing and lateral movement scripts in testing.", "source": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/", "actor": "WormGPT 4 and KawaiiGPT developers", "actor_type": "criminal", "attribution": "Unit 42 analysis of underground sales channels and the tools themselves; developers unidentified.", "motive": "Subscription revenue and community growth around uncensored AI", "vector": "Web and Telegram sales, DarknetArmy forum ads, GitHub distribution with a CLI", "root_cause": "Uncensored models and jailbroken wrappers give low-skill actors polished attack content", "timeline": [ { "date": "2025-07-01", "event": "KawaiiGPT first identified" }, { "date": "2025-09-27", "event": "WormGPT 4 sales campaign begins" }, { "date": "2025-11-25", "event": "Unit 42 publishes findings" } ], "impact": "Hundreds of active users; WormGPT 4 generated an AES-256 file encryptor with Tor exfiltration and a 72-hour ransom note in tests.", "response": "Unit 42 published analysis and defensive guidance.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Unit 42", "url": "https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/" }, { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/malicious-llms-empower-inexperienced-hackers-with-advanced-tools" } ] }, { "id": "openai-mixpanel", "date": "2025-11-26", "title": "OpenAI API user data exposed in breach of analytics vendor Mixpanel", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "OpenAI API platform users", "loss_usd": null, "summary": "An attacker who smished Mixpanel exported a dataset with names, emails and coarse locations of OpenAI API users; OpenAI said no chats, keys or payment data were exposed.", "source": "OpenAI", "url": "https://openai.com/index/mixpanel-incident/", "actor": "Unknown attacker who smished Mixpanel employees", "actor_type": "criminal", "attribution": "No public attribution; disclosed by Mixpanel and OpenAI", "motive": "Data theft; one unverified report said the attacker tried to sell the dataset", "vector": "SMS phishing (smishing) of Mixpanel staff leading to access to internal systems and export of analytics datasets", "root_cause": "Third-party analytics vendor with user metadata; employee credentials compromised via social engineering", "timeline": [ { "date": "2025-11-08", "event": "Mixpanel detects smishing campaign against employees" }, { "date": "2025-11-09", "event": "Mixpanel identifies unauthorized access and data export; notifies OpenAI" }, { "date": "2025-11-25", "event": "Mixpanel shares the affected dataset with OpenAI" }, { "date": "2025-11-26", "event": "OpenAI publicly discloses the incident" }, { "date": "2025-12-19", "event": "OpenAI clarifies some ChatGPT users were also affected" } ], "impact": "Names, email addresses, approximate location, browser and OS details of OpenAI API users exposed; no prompts, API keys, passwords or payment data. Other Mixpanel customers also affected.", "response": "Mixpanel revoked sessions, rotated credentials, blocked IPs and hired outside forensics firms; OpenAI removed Mixpanel from production and notified affected users.", "status": "contained", "cve": null, "sources": [ { "name": "OpenAI", "url": "https://openai.com/index/mixpanel-incident/" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4097488/openai-admits-data-breach-after-analytics-partner-hit-by-phishing-attack-2.html" }, { "name": "eWeek", "url": "https://www.eweek.com/news/openai-mixpanel-data-exposure/" } ] }, { "id": "antigravity-d-drive-wipe", "date": "2025-12-01", "title": "Google Antigravity agent in Turbo mode wipes a user's entire D: drive while clearing a cache", "category": "Agent hijack", "direction": "on-ai", "severity": "medium", "country": "GR", "region": "Europe", "target": "Antigravity IDE user", "loss_usd": null, "summary": "A Greek photographer using Google's Gemini-based Antigravity IDE reported that a cache-clearing step ran a quiet recursive delete against the root of his D: partition, bypassing the Recycle Bin; Google said it was investigating.", "source": "The Register", "url": "https://www.theregister.com/2025/12/01/google_antigravity_wipes_d_drive/", "actor": "Antigravity agent (Gemini 3 based)", "actor_type": "autonomous-ai", "attribution": "User report on Reddit backed by chat transcripts in which the agent admitted it had no permission; Google acknowledged the report but published no root cause", "motive": "None; agent misapplied a delete command", "vector": "Agent executing shell commands without confirmation in Turbo mode targeted the drive root instead of the project cache folder", "root_cause": "Autonomous command execution without a path guardrail or confirmation for destructive operations", "timeline": [ { "date": "2025-11-27", "event": "User reports the D: drive deletion on Reddit; recovery attempts fail" }, { "date": "2025-12-01", "event": "The Register reports the case; Google says it is actively investigating" } ], "impact": "Entire D: partition erased for one user; most data had been backed up elsewhere; other Antigravity users reported similar losses", "response": "Google stated it takes the issue seriously and was investigating; no public fix details", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2025/12/01/google_antigravity_wipes_d_drive/" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/reports/7050/" } ] }, { "id": "europol-700m-deepfake-crypto-ads", "date": "2025-12-04", "title": "Europol takedown of 700M euro crypto fraud network fed by deepfake celebrity ads", "category": "Deepfake fraud", "direction": "with-ai", "severity": "critical", "country": "GL", "region": "Europe", "target": "Retail investors across Europe", "loss_usd": null, "summary": "A two-phase Europol and Eurojust operation dismantled a network that laundered over 700 million euros from crypto fraud promoted via social ads with deepfake videos of celebrities; nine arrested in phase one.", "source": "Europol", "url": "https://www.europol.europa.eu/media-press/newsroom/news/international-takedown-of-cryptocurrency-fraud-network-laundering-over-eur-700-million", "actor": "Transnational crypto investment fraud and money-laundering network", "actor_type": "criminal", "attribution": "Europol and Eurojust with police from Belgium, Bulgaria, Cyprus, France, Germany, Israel, Malta and Spain", "motive": "Financial gain through fake crypto investment platforms and call-centre pressure", "vector": "Affiliate-marketing ads with deepfake endorsements driving victims to fake platforms, followed by call-centre pressure to invest more; layered laundering", "root_cause": "Ad networks and affiliate marketers monetised synthetic celebrity endorsements; laundering across many jurisdictions hid proceeds", "timeline": [ { "date": "2025-10-27", "event": "Phase one raids in Cyprus, Germany and Spain at French and Belgian request; nine arrests, about 1.5M euros seized" }, { "date": "2025-11-25", "event": "Phase two targets advertising and affiliate infrastructure in Belgium, Bulgaria, Germany and Israel" }, { "date": "2025-12-04", "event": "Europol announces the takedown" } ], "impact": "Over 700 million euros laundered; about 800,000 euros in bank accounts, 415,000 euros in crypto and 300,000 euros cash seized plus luxury watches and devices", "response": "Arrests, seizures and continuing investigations to trace assets and remaining members", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Europol", "url": "https://www.europol.europa.eu/media-press/newsroom/news/international-takedown-of-cryptocurrency-fraud-network-laundering-over-eur-700-million" }, { "name": "Breached.company", "url": "https://breached.company/europol-dismantles-eur-700-million-cryptocurrency-fraud-network-in-coordinated-international-operation/" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/europol-takes-down-crypto-and-laundering-network-worth-700-million" } ] }, { "id": "danang-korean-deepfake-romance-ring", "date": "2025-12-05", "title": "Da Nang police arrest three South Koreans wanted for Cambodia deepfake romance scam ring", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "KR", "region": "Asia-Pacific", "target": "South Korean men targeted online", "loss_usd": 1000000, "summary": "Da Nang police arrested three South Koreans under Interpol red notices for a Bavet, Cambodia network that used deepfakes to pose as women and defraud male victims of about $1 million while trafficking recruits.", "source": "Tuoi Tre News", "url": "https://news.tuoitre.vn/vietnamese-police-arrest-3-skoreans-wanted-by-interpol-over-cambodia-scam-ring-103251205143522735.htm", "actor": "Choi Minsu, Choi Jinwoo and Seo Jaeseok (South Korean nationals)", "actor_type": "criminal", "attribution": "Interpol red notices at South Korea's request for fraud, criminal organisation and human trafficking; arrested by Da Nang police with the MPS Department of External Relations", "motive": "Financial gain through romance fraud; labour exploitation of trafficked recruits", "vector": "Deepfake personas of women used to approach male victims online; recruits lured with paid travel and forced to memorise scripts in Cambodia", "root_cause": "Scam compounds in Cambodia operating with trafficked labour and synthetic identities beyond Korean jurisdiction", "timeline": [ { "date": "2024-08", "event": "Network defrauds victims from August to December 2024" }, { "date": "2025-10", "event": "Da Nang police begin investigation after the suspects flee Cambodia" }, { "date": "2025-12-04", "event": "Suspects handed to South Korean authorities for extradition" } ], "impact": "About $1 million defrauded; victims and recruits subjected to passport confiscation and detention in Cambodia", "response": "Arrests in Vietnam, extradition to South Korea, Interpol coordination", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Tuoi Tre News", "url": "https://news.tuoitre.vn/vietnamese-police-arrest-3-skoreans-wanted-by-interpol-over-cambodia-scam-ring-103251205143522735.htm" }, { "name": "Cambodia Daily", "url": "https://english.cambodiadaily.com/?p=181932" } ] }, { "id": "geminijack-enterprise", "date": "2025-12-08", "title": "GeminiJack: zero-click injection in Gemini Enterprise exfiltrated Gmail, Calendar and Docs", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Google Gemini Enterprise and Vertex AI Search", "loss_usd": null, "summary": "Noma Security found a shared Doc or calendar invite with hidden instructions was auto-retrieved by Gemini Enterprise search, run across Workspace data and leaked via a disguised image request. Google re-architected it.", "source": "Noma Security", "url": "https://www.infosecurity-magazine.com/news/google-fixes-gemini-enterprise-flaw", "actor": "Noma Security research team", "actor_type": "researcher", "attribution": "Responsible disclosure to Google in mid-2025; fixed before publication", "motive": "Security research", "vector": "Indirect prompt injection in shared Workspace content retrieved by RAG search; exfiltration via image URL embedding sensitive data", "root_cause": "Shared retrieval and LLM workflows between Vertex AI Search and Gemini Enterprise treated retrieved documents as trusted instructions", "timeline": [ { "date": "2025-06-05", "event": "Noma discovers the flaw and reports it to Google" }, { "date": "2025-08", "event": "Google confirms receipt and begins remediation" }, { "date": "2025-12-08", "event": "Noma publishes GeminiJack after Google's fix" } ], "impact": "Could have exposed corporate Gmail, Calendar and Docs content for Gemini Enterprise customers without any user action; no abuse reported", "response": "Google separated Vertex AI Search from Gemini Enterprise and changed how retrieval and indexing feed the model", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/google-fixes-gemini-enterprise-flaw" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/185574/hacking/geminijack-zero-click-flaw-in-gemini-enterprise-allowed-corporate-data-exfiltration.html" }, { "name": "TechRepublic", "url": "https://www.techrepublic.com/article/news-geminijack-zero-click-flaw/" } ] }, { "id": "fsca-banxso-deepfake-ads-r2bn", "date": "2025-12-09", "title": "South Africa's FSCA fines Banxso R2bn over platform fed by Musk and Rupert deepfake ads", "category": "Deepfake fraud", "direction": "with-ai", "severity": "critical", "country": "ZA", "region": "Middle East & Africa", "target": "South African retail investors", "loss_usd": null, "summary": "The FSCA imposed about R2bn (about $115M) in penalties on Banxso and its directors plus 30-year debarments after finding the platform benefited from deceptive deepfake adverts of Elon Musk and Johann Rupert.", "source": "Moonstone (citing FSCA)", "url": "https://www.moonstone.co.za/fsca-slaps-banxso-and-directors-with-record-r2bn-fine/", "actor": "Banxso (Pty) Ltd and associated Immediate Matrix funnel", "actor_type": "criminal", "attribution": "FSCA found Banxso was directly or indirectly involved in, or at minimum materially benefited from, deepfake advertising; Banxso denies producing the ads and claims it was hacked.", "motive": "Client acquisition and revenue from an unlicensed trading model in which funds were controlled internally.", "vector": "Social media deepfake videos of Musk and Rupert pushed users to Immediate Matrix, which funnelled them into Banxso and Afrimarkets accounts, sometimes without consent.", "root_cause": "Affiliate-style deepfake ad networks feeding an unlicensed derivatives platform with weak client fund segregation.", "timeline": [ { "date": "2024-03-01", "event": "FSCA opens investigation into Banxso deepfake adverts" }, { "date": "2024-10-01", "event": "Banxso licence provisionally withdrawn" }, { "date": "2025-08-01", "event": "Cape Town High Court places Banxso in provisional liquidation" }, { "date": "2025-12-09", "event": "FSCA announces R2bn penalties and 30-year debarments" } ], "impact": "Investors reported significant losses; record administrative penalty in South Africa; matter referred to SAPS for criminal investigation.", "response": "Penalties, debarments, licence withdrawal, referral to police; Banxso sought Financial Services Tribunal reconsideration.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Moonstone", "url": "https://www.moonstone.co.za/fsca-slaps-banxso-and-directors-with-record-r2bn-fine/" }, { "name": "Daily Investor", "url": "https://dailyinvestor.com/finance/149610/the-scheme-that-used-johann-rupert-and-elon-musk-to-steal-r1-billion-from-south-african-investors/" }, { "name": "Launch Base Africa", "url": "https://launchbaseafrica.com/2025/12/10/end-of-the-road-for-banxso-executives-south-africas-fintech-dream-turns-into-a-118m-nightmare" } ] }, { "id": "amsterdam-deepfake-46-bank-accounts", "date": "2025-12-17", "title": "Dutch police arrest Amsterdam man who used deepfakes to pass bank ID checks, 46 accounts", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "NL", "region": "Europe", "target": "Dutch banks and rental applicants", "loss_usd": null, "summary": "Dutch police arrested a 34-year-old who collected ID documents via fake apartment listings, then used AI to overlay victims' facial features onto his own face to pass ABN Amro's identity checks for at least 46 accounts.", "source": "NH Nieuws (citing Politie)", "url": "https://www.nhnieuws.nl/nieuws/355381/amsterdammer-aangehouden-die-met-deepfakes-46-bankrekeningen-opende", "actor": "34-year-old Amsterdam resident", "actor_type": "criminal", "attribution": "Identified after the Koninklijke Marechaussee noticed him carrying multiple bank cards at a border crossing while police were already investigating.", "motive": "Bank accounts in victims' names for onward fraud.", "vector": "Fake rental ads harvested ID documents; deepfake face composites defeated remote KYC video checks.", "root_cause": "Remote onboarding liveness checks vulnerable to AI face manipulation.", "timeline": [ { "date": "2025-03-20", "event": "Suspect begins opening accounts with deepfaked identity checks, per court" }, { "date": "2025-12-17", "event": "Police announce arrest after Marechaussee flags suspect carrying many bank cards" }, { "date": "2026-03-23", "event": "Amsterdam court orders extra investigation into phone data" }, { "date": "2026-05-01", "event": "Court sentences suspect to 2.5 years, six months suspended" } ], "impact": "At least 46 bank accounts opened and misused; amounts not disclosed.", "response": "Arrest in December 2025; Amsterdam court reopened the investigation in March 2026 and later sentenced him to 2.5 years, six months suspended, plus 13,000 euros damages to ABN Amro.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Rechtspraak (Rechtbank Amsterdam)", "url": "https://www.rechtspraak.nl/organisatie-en-contact/organisatie/rechtbanken/rechtbank-amsterdam/nieuws/extra-onderzoek-nodig-in-zaak-oplichting-bank-met-deepfake-technologie" }, { "name": "NH Nieuws (arrest)", "url": "https://www.nhnieuws.nl/nieuws/355381/amsterdammer-aangehouden-die-met-deepfakes-46-bankrekeningen-opende" }, { "name": "NH Nieuws (sentence)", "url": "https://www.nhnieuws.nl/nieuws/360788/amsterdammer-deepfakes-47-bankrekeningen-openen" }, { "name": "NL Times", "url": "https://nltimes.nl/2026/03/23/amsterdam-man-opened-nearly-50-bank-accounts-sticking-head-onto-stolen-passports" } ] }, { "id": "amsterdam-deepfake-bank-accounts", "date": "2025-12-17", "title": "Amsterdam man used AI face-morphs on tenants' IDs to open 46 ABN Amro accounts", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "NL", "region": "Europe", "target": "ABN Amro and prospective tenants", "loss_usd": null, "summary": "Dutch police arrested a 34-year-old who harvested ID documents via fake apartment listings, then used AI to blend victims' faces with his own to pass bank video checks, opening at least 46 accounts.", "source": "NH Nieuws", "url": "https://www.nhnieuws.nl/nieuws/355381/amsterdammer-aangehouden-die-met-deepfakes-46-bankrekeningen-opende", "actor": "34-year-old Amsterdam resident", "actor_type": "criminal", "attribution": "Identified after the Royal Marechaussee found him carrying many bank cards at a border crossing; convicted by Amsterdam district court.", "motive": "Open mule accounts under stolen identities for fraud.", "vector": "Fake rental listings to harvest passports, then deepfake face edits to defeat the bank's digital identity check.", "root_cause": "Selfie-based remote onboarding accepted AI-blended faces matching stolen documents.", "timeline": [ { "date": "2025-12-17", "event": "Police announce arrest and link 46 accounts to the suspect" }, { "date": "2026-03-23", "event": "Prosecutors demand 30 months; court reopens inquiry into deepfake technique" }, { "date": "2026-05-01", "event": "Court sentences him to 2.5 years and 13,000 euro compensation to ABN Amro" } ], "impact": "Dozens of victims' identities abused; at least 46 accounts opened at ABN Amro and used in scams; total losses not published.", "response": "Arrest, prosecution and 2.5-year prison sentence; police said they had adjusted detection of deepfake onboarding methods.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "NH Nieuws", "url": "https://www.nhnieuws.nl/nieuws/355381/amsterdammer-aangehouden-die-met-deepfakes-46-bankrekeningen-opende" }, { "name": "Rechtspraak.nl", "url": "https://www.rechtspraak.nl/organisatie-en-contact/organisatie/rechtbanken/rechtbank-amsterdam/nieuws/2026/03/extra-onderzoek-nodig-in-zaak-oplichting-bank-met-deepfake-technologie" }, { "name": "NL Times", "url": "https://nltimes.nl/2026/03/23/amsterdam-man-opened-nearly-50-bank-accounts-sticking-head-onto-stolen-passports" }, { "name": "NH Nieuws", "url": "https://www.nhnieuws.nl/nieuws/360788/amsterdammer-deepfakes-47-bankrekeningen-openen" } ] }, { "id": "egypt-haifa-wehbe-ai-videos-probe", "date": "2025-12-24", "title": "Egyptian prosecutors order trace of AI-fabricated explicit videos of singer Haifa Wehbe", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "EG", "region": "Middle East & Africa", "target": "Lebanese singer Haifa Wehbe", "loss_usd": null, "summary": "After a complaint backed by a forensic report finding the material fully synthetic, Egypt's Public Prosecution ordered AI-generated sexual videos of Haifa Wehbe pulled from Facebook, TikTok and Telegram and traced.", "source": "An-Nahar", "url": "https://www.annahar.com/lifestyle/arts/264512/فيدوات-هيفا-وهبي-المزيفة-النيابة-المصرية-تتحرك-بعد-شكوى-النجمة-اللبنانية", "actor": "Unknown", "actor_type": "unknown", "attribution": "Accounts and groups named in the complaint; Interior Ministry internet investigations unit tasked with identifying operators.", "motive": "Defamation and possible extortion.", "vector": "Deepfake image and video generation distributed through social media groups and websites.", "root_cause": "Generative tools enable non-consensual synthetic imagery of public figures with little platform friction.", "timeline": [ { "date": "2025-12-01", "event": "Fabricated videos spread on Facebook, TikTok and Telegram" }, { "date": "2025-12-24", "event": "Prosecution opens investigation and orders takedowns" } ], "impact": "Reputational harm to the artist; material widely shared before removal orders.", "response": "Prosecutors ordered removal, source tracing and technical analysis by the Interior Ministry with legal action to follow.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "An-Nahar (النهار)", "url": "https://www.annahar.com/lifestyle/arts/264512/فيدوات-هيفا-وهبي-المزيفة-النيابة-المصرية-تتحرك-بعد-شكوى-النجمة-اللبنانية" }, { "name": "OECD.AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-01-02-2d6d" } ] }, { "id": "kuwait-cbk-nbk-deepfake-warning", "date": "2026-01-08", "title": "NBK warns of deepfake investment ads under Central Bank of Kuwait Let's Be Aware campaign", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "KW", "region": "Middle East & Africa", "target": "Kuwaiti bank customers", "loss_usd": null, "summary": "National Bank of Kuwait, under the Central Bank of Kuwait's Let's Be Aware campaign, warned that deepfake videos making trusted figures appear to endorse investments or trading platforms were used to steal money.", "source": "Kuwait Times", "url": "https://kuwaittimes.com/article/38210/business/nbk-warns-against-fake-investment-ads-on-social-media/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Investment fraud and credential theft.", "vector": "Social media ads with AI-altered video or audio of well-known figures promoting fake trading platforms.", "root_cause": "Unverified financial advertising on social platforms.", "timeline": [ { "date": "2025-12-01", "event": "Central Bank of Kuwait runs Let's Be Aware anti-fraud campaign with local banks" }, { "date": "2026-01-08", "event": "NBK publishes deepfake investment ad warning" } ], "impact": "No specific incidents or losses published.", "response": "Awareness campaign by central bank, banks and Kuwait Banking Association.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Kuwait Times", "url": "https://kuwaittimes.com/article/38210/business/nbk-warns-against-fake-investment-ads-on-social-media/" }, { "name": "Al Jarida", "url": "https://www.aljarida.com/article/76884" } ] }, { "id": "reprompt-copilot", "date": "2026-01-14", "title": "Reprompt: one-click attack hijacks Microsoft Copilot sessions to steal data", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Microsoft Copilot Personal", "loss_usd": null, "summary": "Varonis showed a crafted Microsoft link could pre-fill Copilot prompts via URL parameter and keep exfiltrating a victim's data and memory even after the chat closed.", "source": "Varonis", "url": "https://www.varonis.com/blog/reprompt", "actor": "Varonis Threat Labs (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-disclosed by Varonis; confirmed and patched by Microsoft", "motive": "Security research; no exploitation in the wild reported", "vector": "Phishing link to a legitimate copilot.microsoft.com URL whose q parameter auto-executes a prompt, with follow-up instructions fetched from attacker server", "root_cause": "Copilot Personal auto-ran prompts passed via URL parameter and allowed persistent exfiltration after the chat window closed", "timeline": [ { "date": "2025-08-31", "event": "Varonis reports the flaw to Microsoft" }, { "date": "2026-01-13", "event": "Microsoft ships fix in January Patch Tuesday" }, { "date": "2026-01-14", "event": "Varonis publishes Reprompt research" } ], "impact": "Proof of concept only; could have exfiltrated personal data and Copilot memory from consumer users. Microsoft 365 Copilot not affected. No victims reported.", "response": "Microsoft rolled out protections against the scenario and said it is adding defense-in-depth measures; Varonis published guidance.", "status": "patched", "cve": null, "sources": [ { "name": "Varonis", "url": "https://www.varonis.com/blog/reprompt" }, { "name": "TechRepublic", "url": "https://techrepublic.com/article/news-reprompt-attack-microsoft-copilot" }, { "name": "Windows Report", "url": "https://windowsreport.com/microsoft-patches-copilot-vulnerability-as-hackers-eye-to-exploit-with-new-reprompt-attack/" } ] }, { "id": "anthropic-git-mcp-injection", "date": "2026-01-20", "title": "Prompt injection flaws in Anthropic's Git MCP server enable file access and code execution", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Anthropic mcp-server-git", "loss_usd": null, "summary": "Researchers showed malicious repository content could steer agents using Anthropic's reference Git MCP server into reading or deleting files and running code; fixes shipped.", "source": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-01-20-c1f6", "actor": "Cyata security researchers (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-disclosed by Cyata; fixes acknowledged by Anthropic", "motive": "Security research; no in-the-wild exploitation reported", "vector": "Prompt injection via malicious README, issue text or webpage steering an agent to call git_init, git_diff with injected flags, or out-of-scope repository paths", "root_cause": "Missing path validation on repo_path, unrestricted git_init and unsanitized git_diff target argument passed to the git CLI", "timeline": [ { "date": "2025-06", "event": "Cyata begins reporting the issues to Anthropic (June-July)" }, { "date": "2025-12-18", "event": "Anthropic releases mcp-server-git 2025.12.18 fixing all three flaws" }, { "date": "2026-01-20", "event": "Cyata and media publish details" } ], "impact": "Proof of concept allowing arbitrary file read, file deletion and, chained with the filesystem MCP server, code execution on agent hosts. No victims reported.", "response": "Anthropic validated repository paths, removed the git_init tool and fixed argument injection; users told to upgrade to 2025.12.18 or later.", "status": "patched", "cve": "CVE-2025-68143, CVE-2025-68144, CVE-2025-68145", "sources": [ { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-01-20-c1f6" }, { "name": "The Register", "url": "https://www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/anthropic-mcp-server-flaws-lead-to-code-execution-data-exposure/" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/prompt-injection-bugs-anthropic/" } ] }, { "id": "voidlink-ai-built", "date": "2026-01-20", "title": "VoidLink cloud malware framework found to be built mostly by an AI agent", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Linux cloud environments", "loss_usd": null, "summary": "Check Point concluded the 30+ module VoidLink Linux implant was planned and coded largely by an AI agent under one developer, reaching ~88,000 lines in about a week.", "source": "The Register", "url": "https://www.theregister.com/2026/01/20/voidlink_ai_developed/", "actor": "Single unnamed developer, assessed by Check Point as likely Chinese", "actor_type": "criminal", "attribution": "Check Point Research assessment based on leaked sprint plans and documentation; no formal attribution", "motive": "Development of a commercial-grade Linux cloud implant; large-scale deployment not yet observed", "vector": "AI agent (TRAE SOLO IDE assistant) used to plan architecture, split work into virtual teams and write a 30-plus module implant", "root_cause": "AI coding agents let a lone actor produce complex offensive tooling at team scale; developer OPSEC failures exposed the artifacts", "timeline": [ { "date": "2025-11", "event": "Development begins using TRAE SOLO; first functional implant in under a week" }, { "date": "2025-12", "event": "Codebase reaches about 88,000 lines" }, { "date": "2026-01", "event": "Check Point publishes initial VoidLink analysis" }, { "date": "2026-01-20", "event": "Check Point follow-up concludes the framework was mostly AI-built" } ], "impact": "No confirmed victims or large-scale exploitation reported; framework includes loaders, rootkit modules and dozens of plugins targeting Linux cloud environments.", "response": "Check Point published detections and analysis; no takedown or law-enforcement action reported.", "status": "under investigation", "cve": null, "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2026/01/20/voidlink_ai_developed/" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/voidlink-cloud-malware-shows-clear-signs-of-being-ai-generated/" }, { "name": "Dark Reading", "url": "https://darkreading.com/threat-intelligence/voidlink-linux-malware-ai" } ] }, { "id": "bodysnatcher-servicenow", "date": "2026-01-21", "title": "BodySnatcher: unauthenticated impersonation via ServiceNow Virtual Agent (CVE-2025-12420)", "category": "Agent hijack", "direction": "on-ai", "severity": "critical", "country": "US", "region": "North America", "target": "ServiceNow Now Assist AI Agents and Virtual Agent API", "loss_usd": null, "summary": "AppOmni found an attacker with only an employee email could impersonate that user via ServiceNow's Virtual Agent API and drive Now Assist agents to create admin users, bypassing MFA and SSO. Patched October 2025.", "source": "AppOmni", "url": "https://www.ampcuscyber.com/shadowopsintel/cve-2025-12420-broken-authentication-and-privileged-workflow-execution-in-servicenow/", "actor": "AppOmni Labs", "actor_type": "researcher", "attribution": "Responsible disclosure to ServiceNow in October 2025; CVSS 9.3", "motive": "Security research", "vector": "Broken authentication in the Virtual Agent API allowed unauthenticated conversations attributed to another user, which were then used to trigger privileged AI agent workflows", "root_cause": "Virtual Agent API did not verify the identity of the conversation initiator before letting AI agents act with that user's entitlements", "timeline": [ { "date": "2025-10", "event": "AppOmni discovers and reports BodySnatcher" }, { "date": "2025-10-30", "event": "ServiceNow deploys security updates to hosted instances" }, { "date": "2026-01", "event": "CVE-2025-12420 and AppOmni write-up published" } ], "impact": "Potential full takeover of enterprise ServiceNow instances; no public evidence of exploitation before patching", "response": "ServiceNow patched hosted instances and published fixed versions for self-hosted customers (KB2587329)", "status": "patched", "cve": "CVE-2025-12420", "verification": "confirmed", "sources": [ { "name": "Ampcus Cyber (AppOmni summary)", "url": "https://www.ampcuscyber.com/shadowopsintel/cve-2025-12420-broken-authentication-and-privileged-workflow-execution-in-servicenow/" }, { "name": "SecurityBrief UK", "url": "https://securitybrief.co.uk/story/bodysnatcher-flaw-lets-hackers-hijack-servicenow-ai-agents" }, { "name": "TechInformed", "url": "https://techinformed.com/the-bodysnatcher-breach-that-wasnt-what-servicenows-agentic-ai-flaw-teaches/" } ] }, { "id": "copilot-confidential-emails-bug", "date": "2026-01-21", "title": "Microsoft 365 Copilot bug summarises confidential emails despite DLP policies", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Microsoft 365 Copilot Chat customers", "loss_usd": null, "summary": "Microsoft confirmed (CW1226324) that a code error let Copilot Chat's work tab read and summarise Drafts and Sent Items emails carrying labels such as Confidential despite DLP policies. A fix rolled out in February 2026.", "source": "Microsoft 365 admin center", "url": "https://bleepingcomputer.com/news/microsoft/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails", "actor": "Microsoft (software defect)", "actor_type": "accident", "attribution": "Acknowledged by Microsoft in a service alert", "motive": "None (bug)", "vector": "Copilot Chat processing labelled mail outside intended scope", "root_cause": "Code error in Copilot's handling of sensitivity labels and DLP enforcement", "timeline": [ { "date": "2026-01-21", "event": "Issue identified" }, { "date": "2026-02", "event": "Fix rollout begins" } ], "impact": "Unknown number of tenants; confidential content exposed to Copilot summaries", "response": "Microsoft deployed a fix and tracked the issue in the admin center", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/microsoft/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails" }, { "name": "Petri", "url": "https://petri.com/microsoft-365-copilot-bug-confidential-emails/" }, { "name": "TechRadar", "url": "https://techradar.com/pro/security/microsoft-admits-an-office-bug-exposed-confidential-user-emails-to-copilot" } ] }, { "id": "maliciouscorgi-vscode-ai-extensions", "date": "2026-01-23", "title": "MaliciousCorgi: 'ChatGPT' and 'ChatMoss' VS Code AI extensions with 1.5M installs exfiltrate open files", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "CN", "region": "Asia-Pacific", "target": "VS Code users of AI coding assistant extensions", "loss_usd": null, "summary": "Koi found two Marketplace extensions marketed as AI coding assistants that read every opened file, let a server pull up to 50 workspace files on command and loaded hidden analytics trackers, sending data to China-based servers.", "source": "Koi (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/malicious-ai-extensions-on-vscode-marketplace-steal-developer-data/", "actor": "Publishers WhenSunset and zhukunpeng", "actor_type": "unknown", "attribution": "Extensions published by WhenSunset and zhukunpeng share code and backend; publisher could not be reached and motive was not established", "motive": "Unknown; behaviour consistent with source code harvesting and user profiling", "vector": "Extension code that base64-encodes file contents on open and edit, a server-controlled file harvesting command and a zero-pixel iframe loading four analytics SDKs", "root_cause": "Marketplace review did not catch undisclosed exfiltration in popular extensions presented as AI assistants", "timeline": [ { "date": "2026-01-23", "event": "Koi publishes MaliciousCorgi findings on the two extensions" }, { "date": "2026-01-24", "event": "Microsoft says it is investigating and will take appropriate action" } ], "impact": "About 1.34 million installs of ChatGPT - Chinese edition and 150,000 of ChatMoss; source code, configuration files, cloud credentials and .env secrets of users could have been exposed", "response": "Microsoft opened an investigation; Koi advised removal of the extensions and rotation of any secrets in affected workspaces", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/malicious-ai-extensions-on-vscode-marketplace-steal-developer-data/" }, { "name": "BleepingComputer VS Code tag", "url": "https://www.bleepingcomputer.com/tag/vs-code/" } ] }, { "id": "openclaw-exposed-gateways", "date": "2026-01-27", "title": "Tens of thousands of OpenClaw agent gateways exposed online leaking API keys and chats", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Self-hosted OpenClaw (Clawdbot/Moltbot) instances", "loss_usd": null, "summary": "After the viral OpenClaw agent framework spread, researchers found its gateway bound to public interfaces without authentication on tens of thousands of hosts, exposing API keys, credentials and private chat histories.", "source": "The Register", "url": "https://www.theregister.com/2026/02/03/openclaw_security_problems/", "actor": "Misconfigured deployments; multiple opportunistic attackers", "actor_type": "unknown", "attribution": "Exposure measured by SlowMist, Censys, SecurityScorecard and Shodan; attribution of subsequent abuse not established", "motive": "Credential theft and abuse of exposed agents", "vector": "Default gateway port 18789 reachable from the internet with weak or no authentication, revealing environment variables, tokens and agent controls", "root_cause": "Framework listened on all interfaces by default and cloud tutorials told users to open the port; long-lived API keys stored in plaintext configs", "timeline": [ { "date": "2026-01-27", "event": "SlowMist warns that hundreds of API keys and chat logs are exposed on public Clawdbot gateways" }, { "date": "2026-01-30", "event": "One-click RCE flaw CVE-2026-25253 fixed in v2026.1.29" }, { "date": "2026-01-31", "event": "Censys counts 21,639 exposed instances" }, { "date": "2026-02-03", "event": "JFrog, The Register and others document thousands of exposed agents and malicious ClawHub skills" } ], "impact": "Between roughly 21,000 and 42,000 exposed instances depending on scanner; leaked API keys, auth tokens and private messages enabled agent impersonation and account hijacking", "response": "Project patched the RCE, defaulted TLS 1.3 for the gateway and shipped a security audit command; researchers urged users to keep gateways off the internet", "status": "ongoing", "cve": "CVE-2026-25253", "verification": "confirmed", "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2026/02/03/openclaw_security_problems/" }, { "name": "JFrog", "url": "https://jfrog.com/blog/giving-openclaw-the-keys-to-your-kingdom-read-this-first/" }, { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-01-30-9567" } ] }, { "id": "bizarre-bazaar-llmjacking", "date": "2026-01-28", "title": "Operation Bizarre Bazaar: hijacked LLM endpoints resold through commercial marketplace", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Exposed Ollama, vLLM and MCP endpoints", "loss_usd": null, "summary": "Pillar Security logged ~35,000 attack sessions scanning for exposed AI endpoints, validating access and reselling it via a marketplace covering 30+ LLM providers.", "source": "Pillar Security", "url": "https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization", "actor": "Threat actor using aliases Hecker, Sakuya and LiveGamer101", "actor_type": "criminal", "attribution": "Attributed by Pillar Security based on honeypot telemetry and marketplace infrastructure", "motive": "Financial: reselling stolen LLM access through a marketplace", "vector": "Shodan and Censys scanning for exposed Ollama, vLLM and MCP endpoints, automated API validation via silver.inc, resale via NeXeonAI storefront", "root_cause": "Self-hosted LLM servers and MCP endpoints exposed on default ports without authentication", "timeline": [ { "date": "2025-12", "event": "Pillar honeypots begin logging campaign activity" }, { "date": "2026-01", "event": "About 35,000 attack sessions recorded across the campaign window" }, { "date": "2026-01-28", "event": "Pillar Security publishes Operation Bizarre Bazaar report" } ], "impact": "Hijacked compute, exposure of prompt data and potential pivoting via MCP servers; marketplace resold access to over 30 LLM providers. No dollar figure reported.", "response": "Pillar published indicators of compromise; no takedown or arrests reported.", "status": "ongoing", "cve": null, "sources": [ { "name": "Pillar Security", "url": "https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/llms-hijacked-monetized-in-operation-bizarre-bazaar/" } ] }, { "id": "chat-ask-ai-leak", "date": "2026-01-29", "title": "Chat & Ask AI app leaks ~300M messages from 25M users via open Firebase", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Codeway Chat & Ask AI", "loss_usd": null, "summary": "A researcher found the popular AI chat wrapper's Firebase rules left full chat histories readable, exposing about 300 million messages tied to more than 25 million users.", "source": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2026/02/ai-chat-app-leak-exposes-300-million-messages-tied-to-25-million-users", "actor": "Independent researcher known as Harry (responsible disclosure)", "actor_type": "researcher", "motive": "Research; no malicious exploitation reported", "attribution": "Self-disclosed by the researcher; reported by Malwarebytes", "vector": "Firebase Security Rules set to public, allowing unauthenticated read, write and delete of the chat database", "root_cause": "Misconfigured Firebase backend shared across Codeway apps; no access controls on user chat collections", "timeline": [ { "date": "2026-01-20", "event": "Researcher finds the open Firebase backend and reports it to Codeway" }, { "date": "2026-01-29", "event": "Researcher publishes findings" }, { "date": "2026-02-09", "event": "Malwarebytes reports the leak" } ], "impact": "About 300 million messages tied to roughly 25 million users exposed, including sensitive content such as self-harm and drug queries; data from other Codeway apps also exposed.", "response": "Codeway reportedly fixed the rules across its apps within hours of the report; no regulatory action reported.", "status": "patched", "cve": null, "sources": [ { "name": "Malwarebytes", "url": "https://www.malwarebytes.com/blog/news/2026/02/ai-chat-app-leak-exposes-300-million-messages-tied-to-25-million-users" }, { "name": "Fox News", "url": "https://www.foxnews.com/tech/millions-ai-chat-messages-exposed-app-data-leak" }, { "name": "Hackmag", "url": "https://hackmag.com/news/chat-ask-ai" } ] }, { "id": "hugging-face-android-rat-cdn", "date": "2026-01-29", "title": "Hugging Face datasets abused to serve polymorphic Android RAT payloads every 15 minutes", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Android users; Hugging Face CDN", "loss_usd": null, "summary": "Bitdefender found a scareware dropper app, TrustBastion, fetching an accessibility-abusing Android trojan from a Hugging Face dataset repository that regenerated its payload every 15 minutes and had over 6,000 commits in 29 days.", "source": "Bitdefender (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/hugging-face-abused-to-spread-thousands-of-android-malware-variants/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unattributed; fake Alipay and WeChat login overlays suggest targeting of Chinese-speaking users", "motive": "Financial fraud via credential overlays, PIN theft and device control", "vector": "Dropper app sideloaded via scareware ads redirects through an intermediary server to APKs hosted on Hugging Face's CDN", "root_cause": "Trusted AI model and dataset hosting with clean reputation used as a malware distribution channel; server-side polymorphism defeats hash detection", "timeline": [ { "date": "2026-01", "event": "Bitdefender analyses a 29-day-old Hugging Face repository with more than 6,000 commits of malware variants" }, { "date": "2026-01-29", "event": "Hugging Face removes the datasets after Bitdefender's report; campaign reappears as 'Premium Club'" }, { "date": "2026-02-04", "event": "Further coverage notes the operation re-emerged with the same code" } ], "impact": "Thousands of Android RAT variants distributed; victims risk screen capture, overlay phishing of Alipay and WeChat, PIN theft and blocked uninstallation", "response": "Hugging Face removed the malicious datasets; Google said Play Protect blocks the apps and none were on Google Play", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hugging-face-abused-to-spread-thousands-of-android-malware-variants/" }, { "name": "Netzwoche", "url": "https://www.netzwoche.ch/news/2026-02-04/cyberkriminelle-verteilen-android-malware-ueber-hugging-face" } ] }, { "id": "taichung-chatgpt-deepfake-japan-police", "date": "2026-01-29", "title": "Taichung indicts ring using ChatGPT scripts and deepfake Japanese police on video calls", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "TW", "region": "Asia-Pacific", "target": "Japanese residents called from a Kuala Lumpur call centre", "loss_usd": 120000, "summary": "A Taiwan-Japan-Malaysia ring wrote fraud scripts with ChatGPT and used AI face-swaps to appear as Japanese police when victims asked for video proof; about 18.65 million yen was laundered into USDT.", "source": "ETtoday", "url": "https://www.ettoday.net/news/20260129/3109640.htm", "actor": "Ring led by Taiwanese suspect surnamed Yang", "actor_type": "criminal", "attribution": "Taichung District Prosecutors Office indicted Yang and three others under anti-fraud, money-laundering and organised-crime laws after Malaysian police raids.", "motive": "Telephone fraud against Japanese victims.", "vector": "Random VoIP calls claiming unpaid phone bills and investigations, followed by deepfake video calls with impersonated officers in seized Japanese police uniforms.", "root_cause": "Generative AI removed language and visual barriers for a cross-border scam crew targeting a foreign population.", "timeline": [ { "date": "2025-05-01", "event": "Yang establishes the call centre in Kuala Lumpur" }, { "date": "2025-10-01", "event": "Royal Malaysia Police raid the site and seize uniforms and fake badges" }, { "date": "2026-01-29", "event": "Taichung prosecutors indict four and seek heavy sentences" } ], "impact": "About 18,653,667 yen, roughly US$120,000, taken from Japanese victims and converted to USDT; no restitution made.", "response": "International cooperation among Taiwan, Japan and Malaysia; indictment of four with confiscation sought.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "ETtoday", "url": "https://www.ettoday.net/news/20260129/3109640.htm" }, { "name": "People News (民報)", "url": "https://www.peoplenews.tw/?p=14492" } ] }, { "id": "moltbook-db-exposure", "date": "2026-02-02", "title": "Moltbook AI-agent social network exposes 1.5M agent API tokens", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Moltbook", "loss_usd": null, "summary": "Wiz found Moltbook's Supabase database lacked row-level security, letting anyone read and write 1.5M agent tokens, 35,000 emails and private messages containing third-party API keys.", "source": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/moltbook-gave-everyone-control-every-ai-agent-a-30710", "actor": "Wiz Research and researcher Jameson O'Reilly (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-disclosed by Wiz; Moltbook confirmed and fixed", "motive": "Research; no malicious exploitation confirmed", "vector": "Supabase API key in client-side JavaScript combined with missing row-level security policies on production tables", "root_cause": "Vibe-coded platform shipped without row-level security, so the public anon key granted full read and write access", "timeline": [ { "date": "2026-01-31", "event": "Researchers discover the exposed Supabase database" }, { "date": "2026-02-01", "event": "Moltbook secures the database within hours with Wiz help" }, { "date": "2026-02-02", "event": "Wiz publishes findings" } ], "impact": "1.5 million agent API tokens, about 35,000 owner emails and private agent messages containing third-party API keys readable and writable; any agent could be impersonated.", "response": "Moltbook enabled row-level security and rotated tokens; Wiz deleted data accessed during research.", "status": "patched", "cve": null, "sources": [ { "name": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/moltbook-gave-everyone-control-every-ai-agent-a-30710" }, { "name": "Wiz", "url": "https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/moltbook-exposes-user-data-api/" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/ai-agent-social-media-network-moltbook-is-a-security-disaster-millions-of-credentials-and-other-details-left-unsecured" } ] }, { "id": "taiwan-starlink-deepfake-ecny", "date": "2026-02-02", "title": "Taiwan ring used Starlink and deepfake faces to beat e-CNY checks and drain NT$200M", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "TW", "region": "Asia-Pacific", "target": "Digital yuan app users in mainland China", "loss_usd": 6100000, "summary": "Taiwan's CIB and Thai police arrested a Taichung man backing a Chinese fraud network that built AI 3D face videos from brokered photos to pass e-CNY facial login and drain about NT$200 million from 55 victims.", "source": "PTS News (公視新聞)", "url": "https://news.pts.org.tw/article/793506", "actor": "Taichung man surnamed Lin and Chinese fraud network", "actor_type": "criminal", "attribution": "Taichung prosecutors indicted Lin and three accomplices for fraud, computer interference and organised crime; Lin allegedly took a 10 percent cut of about NT$18 million.", "motive": "Financial theft from victims' bank accounts via the digital yuan wallet.", "vector": "Victim photos and personal data bought from Chinese photo brokers, deepfake liveness videos fed to the e-CNY app camera check, Starlink satellite links to evade IP tracing from Thailand.", "root_cause": "Facial liveness verification on the wallet accepted pre-recorded synthetic video as a live camera feed.", "timeline": [ { "date": "2025-06-01", "event": "Ring operates from Thailand using Starlink connectivity" }, { "date": "2026-02-02", "event": "CIB announces arrests with Thai police and prosecutors indict four" } ], "impact": "At least 55 victims in mainland China lost about NT$200 million, roughly US$6.1 million; first Taiwanese case combining satellite internet with deepfake KYC bypass.", "response": "Four indicted and released on bail of NT$200,000 to NT$1 million; CIB shared the method with Taiwan's Financial Supervisory Commission to harden local banks.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "PTS News (公視新聞)", "url": "https://news.pts.org.tw/article/793506" }, { "name": "World Journal (世界日報)", "url": "https://www.worldjournal.com/wj/amp/story/121475/9305011" } ] }, { "id": "surrey-martin-lewis-deepfake-20k", "date": "2026-02-03", "title": "Surrey PCC: retired engineer loses £20,000 to deepfake Martin Lewis investment video", "category": "Deepfake fraud", "direction": "with-ai", "severity": "low", "country": "GB", "region": "Europe", "target": "Retired engineer in Surrey", "loss_usd": 25000, "summary": "Surrey's Police and Crime Commissioner publicised a retired engineer who invested after a Facebook deepfake of Martin Lewis, then paid repeated fees to withdraw, losing about £20,000 (about $25,000).", "source": "Office of the Police and Crime Commissioner for Surrey", "url": "https://www.surrey-pcc.gov.uk/pcc-question-everything-surrey-victim-loses-life-savings-deepfake-video/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; the scammers were not identified by police.", "motive": "Financial gain via fake investment platform and withdrawal fees.", "vector": "Facebook video deepfake of Martin Lewis promoting an investment scheme; victim invested £200, then £5,000, then was asked for £5,000 and £10,000 in fees to release about £25,000 in supposed gains.", "root_cause": "Convincing AI-generated celebrity endorsement on social media combined with advance-fee withdrawal pressure.", "timeline": [ { "date": "2025-12-01", "event": "Victim sees deepfake Martin Lewis video on Facebook and invests £200" }, { "date": "2026-01-15", "event": "Victim pays fees demanded to withdraw funds before realising it is a scam" }, { "date": "2026-02-03", "event": "Surrey PCC publishes the case under its Question EVERYTHING campaign" } ], "impact": "Victim lost about £20,000 of life savings and continues to receive near-daily recovery-scam approaches.", "response": "Surrey PCC launched a public awareness campaign including a deepfake of the Commissioner herself to show how convincing the technology is.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Surrey PCC", "url": "https://www.surrey-pcc.gov.uk/pcc-question-everything-surrey-victim-loses-life-savings-deepfake-video/" }, { "name": "Surrey PCC news listing", "url": "https://www.surrey-pcc.gov.uk/category/communication-and-engagement/page/2/" } ] }, { "id": "certfr-genai-threat-2026", "date": "2026-02-04", "title": "CERT-FR: 42 attacker groups actively use generative AI, none yet autonomous against France", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "FR", "region": "Europe", "target": "French public and private entities", "loss_usd": null, "summary": "ANSSI's CERT-FR published CERTFR-2026-CTI-001, a TLP:CLEAR synthesis reporting that 42 groups use GenAI such as Gemini for profiling, lures and malware, while no attack on a French entity is attributed to autonomous AI.", "source": "ANSSI CERT-FR", "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-001.pdf", "actor": "Multiple state-linked groups (China, Iran, North Korea, Russia)", "actor_type": "state", "attribution": "CERT-FR synthesis of vendor and partner reporting; press coverage cites 20 Chinese, 10 Iranian, 9 North Korean and 3 Russian groups.", "motive": "Espionage, fraud and sabotage enabled by AI productivity gains", "vector": "GenAI services used for reconnaissance, social engineering content and malware development; models also targeted via poisoning and data exfiltration", "root_cause": "Dual-use AI services are accessible to attackers at each stage of the intrusion chain", "timeline": [ { "date": "2026-02-04", "event": "CERT-FR publishes CERTFR-2026-CTI-001 (12 pages)" }, { "date": "2026-02-05", "event": "Report circulates publicly; press coverage breaks down the 42 groups by country" } ], "impact": "Advisory-level; documents attacker GenAI adoption across state groups and sets expectations for French defenders.", "response": "ANSSI recommends regular reassessment and hardening of AI deployments; no specific French victim named.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "CERT-FR", "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-001.pdf" }, { "name": "ActuIA", "url": "https://www.actuia.com/acteur/anssi/" } ] }, { "id": "clawhub-malicious-skills", "date": "2026-02-04", "title": "Over 230 malicious OpenClaw skills on ClawHub push password stealers", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "OpenClaw agent users", "loss_usd": null, "summary": "Researchers found hundreds of ClawHub skills posing as crypto and social tools that told users to install a fake 'AuthTool', delivering infostealers such as AMOS on macOS.", "source": "ThaiCERT", "url": "https://www.thaicert.or.th/en/2026/02/04/researchers-discover-over-200-malicious-skills-on-openclaw-distributing-password-stealing-malware/", "actor": "ClawHavoc operation (unnamed group) plus smaller unrelated uploaders", "actor_type": "criminal", "attribution": "Koi Security linked 335 of 341 malicious skills to a single coordinated operation it calls ClawHavoc; no named group", "motive": "Financial: credential and crypto wallet theft via infostealers", "vector": "Fake Prerequisites sections in skill docs instructing users to download password-protected ZIPs or run obfuscated scripts delivering AMOS and other stealers", "root_cause": "Unvetted skill marketplace with no code review; users trusting install instructions for crypto and social tools", "timeline": [ { "date": "2026-01-27", "event": "First wave of malicious skill uploads to ClawHub" }, { "date": "2026-02-01", "event": "Koi Security completes audit of 2,857 skills, flagging 341" }, { "date": "2026-02-04", "event": "Findings published; OpenClaw adds user reporting" } ], "impact": "341 malicious skills identified, over 100 posing as crypto tools; payloads included AMOS stealer, reverse shells and config exfiltration. Infection counts not confirmed.", "response": "Malicious skills removed from ClawHub; OpenClaw maintainer added a reporting feature; Koi published indicators.", "status": "contained", "cve": null, "sources": [ { "name": "ThaiCERT", "url": "https://www.thaicert.or.th/en/2026/02/04/researchers-discover-over-200-malicious-skills-on-openclaw-distributing-password-stealing-malware/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html" }, { "name": "SC World", "url": "https://www.scworld.com/news/openclaw-agents-targeted-with-341-malicious-clawhub-skills" } ] }, { "id": "unc1069-deepfake-zoom", "date": "2026-02-09", "title": "North Korea's UNC1069 uses AI deepfake video in fake Zoom calls against crypto firms", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Fintech and crypto companies", "loss_usd": null, "summary": "Mandiant tied a fintech intrusion to DPRK-linked UNC1069, which paired a hijacked Telegram account, a spoofed Zoom meeting with AI-generated video, and ClickFix lures to plant macOS malware.", "source": "The Record", "url": "https://therecord.media/north-korean-hackers-targeted-crypto-exec-clickfix", "actor": "UNC1069 (North Korea-linked, aka Masan)", "actor_type": "state", "attribution": "Attributed by Mandiant with high confidence to a DPRK-nexus group tracked since 2018", "motive": "Cryptocurrency theft and harvesting identities for future social engineering", "vector": "Compromised executive Telegram account, Calendly link to spoofed Zoom page with AI-generated video of a CEO, ClickFix command installing macOS loaders", "root_cause": "Trust in known contacts on messaging apps and willingness to run pasted terminal commands to fix a fake meeting issue", "timeline": [ { "date": "2025-11", "event": "GTIG notes UNC1069 using Gemini for wallet-targeting scripts and lures" }, { "date": "2026-02-09", "event": "Mandiant publishes intrusion analysis with new SILENCELIFT, DEEPBREATH and CHROMEPUSH malware" } ], "impact": "Seven macOS malware families on one victim host; credentials, browser data, session tokens, Keychain items, Telegram data and Apple Notes collected. Losses not disclosed.", "response": "Mandiant incident response, publication of indicators and hardening guidance on unsigned script execution.", "status": "ongoing", "cve": null, "sources": [ { "name": "The Record", "url": "https://therecord.media/north-korean-hackers-targeted-crypto-exec-clickfix" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-new-macos-malware-in-crypto-theft-attacks/" }, { "name": "SOC Prime", "url": "https://socprime.com/active-threats/unc1069-targets-cryptocurrency-sector/" } ] }, { "id": "nigeria-okonjo-iweala-ai-video-scam", "date": "2026-02-11", "title": "Okonjo-Iweala alerts Nigerians to AI video using her image for fake investment scheme", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "NG", "region": "Middle East & Africa", "target": "Nigerian social media users", "loss_usd": null, "summary": "WTO Director-General Ngozi Okonjo-Iweala warned on X of an AI-manipulated video using her likeness to promote a supposedly government-backed scheme promising up to N2.66M in a week from a N380,000 deposit.", "source": "Ripples Nigeria", "url": "https://www.ripplesnigeria.com/okonjo-iweala-alerts-nigerians-to-fake-ai-video-scam/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Collect deposits for a fake automated investment programme capped at 4,000 accounts.", "vector": "AI-manipulated video spread on Instagram, Facebook and WhatsApp, platforms she does not use.", "root_cause": "Trusted public figure impersonated with generative video.", "timeline": [ { "date": "2026-02-10", "event": "Fake video circulates on social media" }, { "date": "2026-02-11", "event": "Okonjo-Iweala posts alert on X; authorities said to be investigating" } ], "impact": "No losses disclosed.", "response": "Public alert; authorities investigating the source.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Ripples Nigeria", "url": "https://www.ripplesnigeria.com/okonjo-iweala-alerts-nigerians-to-fake-ai-video-scam/" }, { "name": "Technext", "url": "https://technext24.com/news/deepfake-ngozi-okonjo-iweala-ai-video/" }, { "name": "Nigeria SEC via VON", "url": "https://von.gov.ng/sec-warns-nigerians-of-ai-investment-scams/" } ] }, { "id": "turkey-osmaniye-deepfake-410m-tl", "date": "2026-02-11", "title": "Turkish police jail five over 410M lira investment scam using deepfakes of officials", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "TR", "region": "Middle East & Africa", "target": "Turkish social media users", "loss_usd": 9500000, "summary": "An Osmaniye-based police operation detained eight suspects, five later jailed, for promoting fake investments on social media with AI images and voices of Turkish officials; losses put at 410 million lira (about $9.5M).", "source": "Sabah", "url": "https://www.sabah.com.tr/yasam/yapay-zeka-ile-vatandasi-dolandiran-5-kisi-tutuklandi-7522144", "actor": "Osmaniye-based investment fraud group", "actor_type": "criminal", "attribution": "Turkish police cybercrime operation across six provinces; five suspects formally arrested pending trial", "motive": "Financial gain through fake high-return investment schemes", "vector": "Deepfake video and audio of senior officials in sponsored social media ads leading to fake investment platforms", "root_cause": "Generative tools made official endorsements easy to fabricate; ad platforms carried the content", "timeline": [ { "date": "2026-02-11", "event": "Eight suspects detained in coordinated raids; five jailed" }, { "date": "2026-05-24", "event": "Follow-on 'Yapay Zeka-2' operation detains 16 more suspects in nine provinces" } ], "impact": "About 410 million lira in reported victim losses", "response": "Detentions, judicial arrests and continued operations against similar networks", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Sabah", "url": "https://www.sabah.com.tr/yasam/yapay-zeka-ile-vatandasi-dolandiran-5-kisi-tutuklandi-7522144" }, { "name": "Turkiye Gazetesi", "url": "https://www.turkiyegazetesi.com.tr/gundem/sosyal-medyadan-410-milyonluk-vurgun-yaptilar-5-kisi-tutuklandi-1770138" }, { "name": "OECD.AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-02-11-a158" } ] }, { "id": "gtig-coinbait-lovable-phish", "date": "2026-02-12", "title": "COINBAIT crypto-exchange phishing kit built with Lovable AI app builder", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Cryptocurrency exchange customers", "loss_usd": null, "summary": "GTIG found COINBAIT, a React single-page phishing kit imitating a crypto exchange, attributed to financially motivated cluster UNC5356, with Supabase and lovable.app artefacts showing Lovable AI-built code.", "source": "Google Threat Intelligence Group", "url": "https://www.bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/", "actor": "UNC5356", "actor_type": "criminal", "attribution": "GTIG attributes the kit to UNC5356 and assesses Lovable-based development from code artefacts.", "motive": "Credential theft and crypto fraud", "vector": "AI-generated phishing site harvesting exchange logins", "root_cause": "No-code AI app builders lower the cost of convincing phishing front-ends", "timeline": [ { "date": "2025", "event": "COINBAIT kit observed in UNC5356 crypto phishing" }, { "date": "2026-02-12", "event": "GTIG publishes the kit in its AI Threat Tracker" } ], "impact": "Credential harvesting kit in circulation; victims not quantified.", "response": "Google documented indicators such as Analytics-prefixed log messages for defenders.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer on GTIG February 2026 report", "url": "https://www.bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/" }, { "name": "HackMag coverage", "url": "https://hackmag.com/news/gemini-abuse" }, { "name": "Decryption Digest analysis", "url": "https://www.decryptiondigest.com/blog/honestcue-ai-malware-gemini-apt-live-operations" } ] }, { "id": "gtig-gemini-state-misuse", "date": "2026-02-12", "title": "Google: state hackers use Gemini across all attack stages; 100K-prompt extraction try", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Google Gemini / multiple sectors", "loss_usd": null, "summary": "GTIG reported Chinese, Iranian, North Korean and Russian groups using Gemini for recon, exploit research and lures, and blocked a 100,000+ prompt campaign to extract its reasoning.", "source": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/", "actor": "APT31, Temp.HEX, APT42, UNC2970 and Russian groups; unnamed distillers", "actor_type": "state", "attribution": "Attributed by Google Threat Intelligence Group; distillation campaign actors not publicly named", "motive": "Espionage support (recon, lures, exploit research) and intellectual property theft via model extraction", "vector": "Abuse of legitimate Gemini accounts and APIs; reasoning trace coercion prompts to extract internal chain of thought", "root_cause": "General-purpose AI assistants accessible to state actors; API access enables large-scale output harvesting for distillation", "timeline": [ { "date": "2025-11", "event": "Previous GTIG AI Threat Tracker covers PROMPTFLUX-era findings" }, { "date": "2026-02-12", "event": "GTIG publishes report on state misuse and a 100,000-plus prompt extraction campaign" } ], "impact": "No breakthrough capabilities observed; Google says extraction attempt was flagged in real time and reasoning traces protected. Accounts and infrastructure disabled.", "response": "Google disabled abusive accounts and infrastructure, hardened Gemini classifiers and warned of takedowns and legal action.", "status": "contained", "cve": null, "sources": [ { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/" }, { "name": "SecurityBrief", "url": "https://securitybrief.co.uk/story/google-warns-of-ai-model-theft-state-backed-misuse" }, { "name": "TechInformed", "url": "https://techinformed.com/google-disrupts-gemini-model-extraction-attempts/" } ] }, { "id": "gtig-honestcue-gemini-loader", "date": "2026-02-12", "title": "HONESTCUE loader asks Gemini to write fresh C# second-stage code and compiles it in memory", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Windows hosts targeted by the proof-of-concept framework", "loss_usd": null, "summary": "GTIG described HONESTCUE, a downloader framework seen in late 2025 that prompts the Gemini API for a unique C# program to fetch and run a .NET payload from Discord CDN, compiling it in memory so no file touches disk.", "source": "Google Threat Intelligence Group", "url": "https://www.bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/", "actor": "Unknown single actor or small group", "actor_type": "criminal", "attribution": "GTIG assessed a single actor or small group in a testing phase.", "motive": "Evasion of signature-based detection", "vector": "Runtime LLM code generation for just-in-time payload compilation", "root_cause": "Public LLM APIs provide polymorphic code on demand", "timeline": [ { "date": "2025-09", "event": "HONESTCUE first observed by GTIG" }, { "date": "2026-02-12", "event": "GTIG publishes the family in its AI Threat Tracker" } ], "impact": "Proof of concept; no confirmed victims published.", "response": "Google disabled associated accounts and infrastructure and tuned classifiers.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer on GTIG February 2026 report", "url": "https://www.bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/" }, { "name": "HackMag coverage", "url": "https://hackmag.com/news/gemini-abuse" }, { "name": "Decryption Digest analysis", "url": "https://www.decryptiondigest.com/blog/honestcue-ai-malware-gemini-apt-live-operations" } ] }, { "id": "vidar-steals-openclaw-secrets", "date": "2026-02-16", "title": "Infostealer captures OpenClaw gateway token, device keys and agent memory files", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "OpenClaw users", "loss_usd": null, "summary": "Hudson Rock documented the first infostealer log containing an OpenClaw .openclaw directory: openclaw.json with a gateway auth token, device.json with signing keys and soul.md and memory files holding private messages and calendar data.", "source": "Hudson Rock (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/", "actor": "Vidar infostealer operators", "actor_type": "criminal", "attribution": "Hudson Rock assessed the malware as a Vidar variant; it was not built for OpenClaw but swept files matching keywords such as token and private key", "motive": "Credential theft for resale and account takeover", "vector": "Generic infostealer keyword search over the user's home directory capturing the agent's plaintext configuration and memory files", "root_cause": "OpenClaw stores gateway tokens, device private keys and agent memory in plaintext files on the host", "timeline": [ { "date": "2026-02-13", "event": "Victim machine infected; infostealer log includes the .openclaw directory" }, { "date": "2026-02-16", "event": "Hudson Rock and BleepingComputer report the first observed OpenClaw secret theft" } ], "impact": "Stolen gateway token and device private key allow remote connection, client impersonation and bypass of Safe Device checks; memory files exposed private messages and activity logs", "response": "Researchers advised rotating gateway tokens and re-pairing devices; expected infostealers to target agent frameworks routinely", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/" }, { "name": "BleepingComputer OpenClaw tag", "url": "https://www.bleepingcomputer.com/tag/openclaw/" } ] }, { "id": "cline-cli-openclaw", "date": "2026-02-17", "title": "Compromised Cline CLI npm release silently installs OpenClaw agent", "category": "AI supply chain", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Cline CLI users", "loss_usd": null, "summary": "A stolen npm token was used to publish cline@2.3.0 with a postinstall script that globally installed the OpenClaw agent; it was live about 8 hours and downloaded ~4,000 times.", "source": "Dark Reading", "url": "https://www.darkreading.com/application-security/supply-chain-attack-openclaw-cline-users", "actor": "Unknown party using a stolen npm publish token", "actor_type": "unknown", "attribution": "No public attribution; Cline says a compromised npm token was used. One vendor report ties it to prior AI triage workflow research by Adnan Khan", "motive": "Unclear; payload was a legitimate package, possibly a prank or demonstration", "vector": "Unauthorized npm publish of cline@2.3.0 with a postinstall script running npm install -g openclaw@latest", "root_cause": "Long-lived npm publish token exposed via a GitHub Actions workflow; no trusted publishing or provenance enforcement", "timeline": [ { "date": "2026-02-17", "event": "cline@2.3.0 published at 3:26 AM PT with malicious postinstall" }, { "date": "2026-02-17", "event": "Clean 2.4.0 published at 11:23 AM PT and 2.3.0 deprecated at 11:30 AM PT" }, { "date": "2026-02-18", "event": "GHSA-9ppg-jx86-fqw7 advisory and media coverage" } ], "impact": "About 4,000 downloads in an eight-hour window installed OpenClaw globally without consent; no credential theft or malicious payload reported.", "response": "Cline revoked the token, moved publishing to OIDC provenance via GitHub Actions, published 2.4.0 and told users to uninstall OpenClaw if unwanted.", "status": "resolved", "cve": null, "sources": [ { "name": "Dark Reading", "url": "https://www.darkreading.com/application-security/supply-chain-attack-openclaw-cline-users" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html" }, { "name": "Endor Labs", "url": "https://endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw" }, { "name": "GitHub Advisory via OSV", "url": "https://osv.dev/vulnerability/GHSA-9ppg-jx86-fqw7" } ] }, { "id": "lagos-peter-obi-ai-forex-fraud", "date": "2026-02-18", "title": "Lagos court remands man over N230M forex scam using AI-cloned image of Peter Obi", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "NG", "region": "Middle East & Africa", "target": "Nigerian investor Fredrick Amaechi; Peter Obi's likeness", "loss_usd": 150000, "summary": "Nigerian police arraigned Olayinka Adesiyan in Lagos on six counts for allegedly using AI-altered images of Peter Obi endorsing the Modmut International forex platform to obtain about N230 million in 2025.", "source": "THISDAY", "url": "https://www.thisdaylive.com/2026/02/18/court-remands-businessman-accused-of-using-ai-to-impersonate-peter-obi-in-n230m-forex-fraud", "actor": "Olayinka Adesiyan and others at large", "actor_type": "criminal", "attribution": "Charged by the Federal Republic of Nigeria; defendant pleaded not guilty and the case is pending.", "motive": "Investment fraud using a prominent politician's endorsement.", "vector": "AI-cloned Facebook image and adverts presenting Obi as a beneficiary of a forex trading partnership.", "root_cause": "Unverified social media advertising and public trust in political figures.", "timeline": [ { "date": "2025-07-01", "event": "Alleged fraudulent adverts begin circulating" }, { "date": "2025-10-31", "event": "Alleged scheme ends after N230 million received" }, { "date": "2026-02-18", "event": "Defendant arraigned and remanded at Ikoyi" } ], "impact": "About N230 million, roughly US$150,000, allegedly obtained from one investor and diverted.", "response": "Police prosecution on conspiracy, false pretence, fraudulent advertising and stealing counts; Obi publicly disowned AI adverts using his image.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "THISDAY", "url": "https://www.thisdaylive.com/2026/02/18/court-remands-businessman-accused-of-using-ai-to-impersonate-peter-obi-in-n230m-forex-fraud" }, { "name": "Leadership", "url": "https://leadership.ng/n230m-fraud-police-arraign-man-over-ai-cloned-image-of-peter-obi/" }, { "name": "Arise News", "url": "https://www.arise.tv/court-remands-lagos-businessman-over-n230m-forex-scam-using-ai-cloned-peter-obi-image" } ] }, { "id": "anthropic-distillation", "date": "2026-02-23", "title": "Anthropic accuses DeepSeek, Moonshot and MiniMax of distilling Claude via 24,000 accounts", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Anthropic Claude", "loss_usd": null, "summary": "Anthropic said three Chinese labs used fraudulent account networks and proxies to run 16M+ Claude exchanges to extract capabilities for their own models.", "source": "The Decoder", "url": "https://the-decoder.com/anthropic-accuses-deepseek-moonshot-and-minimax-of-stealing-claudes-ai-data-through-16-million-queries/", "actor": "DeepSeek, Moonshot AI and MiniMax (per Anthropic)", "actor_type": "criminal", "attribution": "Alleged by Anthropic based on account, infrastructure and request-pattern evidence; not independently adjudicated", "motive": "Extracting Claude capabilities to train competing models cheaply (intellectual property theft)", "vector": "About 24,000 fraudulent accounts and proxy services used to run over 16 million Claude exchanges in violation of terms and regional restrictions", "root_cause": "API access allows output harvesting at scale; account verification and regional controls bypassed with fake accounts and proxies", "timeline": [ { "date": "2025", "event": "Campaigns run; MiniMax activity detected while it was still training a model" }, { "date": "2026-02-23", "event": "Anthropic publicly accuses the three labs and details per-lab exchange counts" } ], "impact": "MiniMax over 13 million exchanges, Moonshot over 3.4 million, DeepSeek over 150,000, targeting coding, agentic reasoning and tool use. No direct financial loss disclosed.", "response": "Anthropic banned the accounts, published findings and cited the case in support of chip export controls; the labs were asked for comment.", "status": "under investigation", "cve": null, "sources": [ { "name": "The Decoder", "url": "https://the-decoder.com/anthropic-accuses-deepseek-moonshot-and-minimax-of-stealing-claudes-ai-data-through-16-million-queries/" }, { "name": "Interesting Engineering", "url": "https://interestingengineering.com/ai-robotics/anthropic-china-ai-distillation-claims" }, { "name": "eWeek", "url": "https://www.eweek.com/de/security/anthropic-deepseek-moonshot-minimax-targeted-claude/" } ] }, { "id": "mexico-gov-claude-breach", "date": "2026-02-25", "title": "Hacker uses Claude to breach Mexican agencies and steal 150GB of tax and voter data", "category": "AI-assisted malware", "direction": "with-ai", "severity": "critical", "country": "MX", "region": "Latin America", "target": "Mexican tax authority, electoral institute, state governments", "loss_usd": null, "summary": "Gambit Security found an attacker jailbroke Claude, with some ChatGPT help, to find and exploit flaws in Mexican government systems, stealing ~150GB incl. 195M taxpayer records.", "source": "Bloomberg Law", "url": "https://news.bloomberglaw.com/esg/hacker-used-anthropics-claude-to-steal-sensitive-mexican-data", "actor": "Unknown lone hacker (Spanish-speaking)", "actor_type": "criminal", "attribution": "Not publicly attributed; findings by Gambit Security from exposed conversation logs. Mexican agencies deny evidence of a breach", "motive": "Theft and likely resale of tax, voter and personal data", "vector": "Jailbroke Claude by posing as a bug-bounty hunter, used Claude Code to find and exploit flaws and exfiltrate data, then used ChatGPT for lateral movement guidance", "root_cause": "AI safety refusals bypassed via role-play; vulnerable government web systems; attacker left conversation logs publicly accessible", "timeline": [ { "date": "2025-12", "event": "Campaign reportedly starts with Mexico's tax authority SAT" }, { "date": "2026-02", "event": "Gambit Security finds publicly accessible attacker chat logs" }, { "date": "2026-02-25", "event": "Bloomberg reports the findings; Anthropic and OpenAI ban the accounts" } ], "impact": "Gambit claims about 150GB stolen from 10 agencies and a bank, including roughly 195 million taxpayer records and voter data; SAT, INE and Jalisco deny confirmed breaches.", "response": "Anthropic and OpenAI banned the accounts; Mexican agencies reviewed logs and disputed the claims; no arrests reported.", "status": "under investigation", "cve": null, "sources": [ { "name": "Bloomberg Law", "url": "https://news.bloomberglaw.com/esg/hacker-used-anthropics-claude-to-steal-sensitive-mexican-data" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/posts/claude-code-abused-to-steal-150gb-in-cyberattack-on-mexican-agencies" }, { "name": "Insurance Journal", "url": "https://www.insurancejournal.com/news/international/2026/02/27/859786.htm" } ] }, { "id": "onlyfake-nazarenko-guilty-plea", "date": "2026-03-02", "title": "OnlyFake creator pleads guilty to selling 10,000+ AI-made fake IDs for KYC fraud", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "Banks and crypto exchanges' KYC checks", "loss_usd": null, "summary": "Ukrainian national Yurii Nazarenko pleaded guilty in SDNY over OnlyFake, a crypto-paid service that used AI to generate over 10,000 realistic IDs from 56-plus countries to defeat KYC checks; he will forfeit $1.2 million.", "source": "US Attorney's Office, Southern District of New York", "url": "https://www.justice.gov/usao-sdny/pr/creator-onlyfake-charged-and-pleads-guilty-selling-more-10000-digital-fake", "actor": "Yurii Nazarenko, alias 'John Wick' (OnlyFake operator)", "actor_type": "criminal", "attribution": "FBI undercover purchases in 2024; arrested in Romania and extradited to the US in September 2025; guilty plea in SDNY", "motive": "Profit from selling synthetic identity documents to fraudsters and money launderers", "vector": "Web platform generating photorealistic ID images with correct formatting, typography and security features, output styled as scans or tabletop photos", "root_cause": "KYC processes that accept uploaded ID photos can be defeated by AI-generated documents", "timeline": [ { "date": "2024-02", "event": "Media coverage of OnlyFake; operator deletes emails and routes crypto through multiple wallets" }, { "date": "2024-05", "event": "FBI undercover agents make controlled purchases through June 2024" }, { "date": "2025-09", "event": "Nazarenko extradited from Romania" }, { "date": "2026-03-02", "event": "Guilty plea announced; sentencing set for June 2026 with a 15-year maximum" } ], "impact": "At least 10,000 fake documents sold to bypass identity checks at banks and crypto exchanges; $1.2 million in proceeds forfeited", "response": "Extradition, prosecution and forfeiture; platform taken offline", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "US Attorney's Office SDNY", "url": "https://www.justice.gov/usao-sdny/pr/creator-onlyfake-charged-and-pleads-guilty-selling-more-10000-digital-fake" }, { "name": "eSecurity Planet", "url": "https://www.esecurityplanet.com/threats/operator-of-ai-fake-id-platform-pleads-guilty/" }, { "name": "TechSpot", "url": "https://www.techspot.com/news/111504-us-arrests-onlyfake-operator-accused-selling-over-10000.html" } ] }, { "id": "zscaler-dust-specter-iraq", "date": "2026-03-02", "title": "Iran-nexus Dust Specter hits Iraqi officials with malware showing generative AI traces", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "IQ", "region": "Middle East & Africa", "target": "Iraqi government officials", "loss_usd": null, "summary": "Zscaler found a January 2026 campaign impersonating Iraq's foreign ministry that dropped TWINTASK, TWINTALK and GHOSTFORM; emojis and placeholders in decompiled code suggested generative AI helped build the malware.", "source": "Zscaler ThreatLabz", "url": "https://www.zscaler.com/blogs/security-research/dust-specter-apt-targets-government-officials-iraq", "actor": "Dust Specter", "actor_type": "state", "attribution": "Zscaler ThreatLabz attributes to an Iran-nexus actor with medium-to-high confidence based on tooling, techniques and victimology overlap.", "motive": "Espionage against Iraqi government", "vector": "Phishing posing as Iraq's Ministry of Foreign Affairs, WinRAR-disguised .NET dropper, DLL sideloading via VLC and WingetUI, fake Google Forms survey lure", "root_cause": "AI-assisted development accelerated new tooling; compromised Iraqi government-related hosting delivered payloads", "timeline": [ { "date": "2025-07-01", "event": "Earlier Dust Specter page disguised as Webex invite reuses TWINTALK C2 domain" }, { "date": "2026-01-15", "event": "Campaign against Iraqi officials detected by ThreatLabz" }, { "date": "2026-03-02", "event": "Zscaler publishes analysis" } ], "impact": "Government officials targeted with remote access and exfiltration tooling; victim count not disclosed.", "response": "Zscaler published IOCs and detections; no official Iraqi statement reported.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Zscaler ThreatLabz", "url": "https://www.zscaler.com/blogs/security-research/dust-specter-apt-targets-government-officials-iraq" }, { "name": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/iran-cyber-threat-actor-iraq/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/03/dust-specter-targets-iraqi-officials.html" } ] }, { "id": "hp-wolf-vibe-hacking-2026", "date": "2026-03-04", "title": "HP Wolf: AI-generated 'vibe-hacking' infection scripts slip past email gateways", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Enterprise email users", "loss_usd": null, "summary": "HP's Q4 2025 Threat Insights Report documented attackers using AI to write infection scripts and rework lures, including a fake invoice PDF chain bouncing victims to Booking.com; 14 percent of threats evaded gateways.", "source": "HP Wolf Security", "url": "https://securitybrief.co.uk/story/hp-warns-of-ai-fuelled-flat-pack-cyberattacks-surge", "actor": "Unknown", "actor_type": "criminal", "attribution": "HP Security Lab telemetry from consenting customers, October to December 2025; actors not named.", "motive": "Low-cost, high-volume malware delivery", "vector": "AI-generated scripts in modular flat-pack campaigns reusing shared installers with swapped lures and payloads", "root_cause": "Generative AI let attackers mass-produce script variants faster than signature defences adapt", "timeline": [ { "date": "2025-10-01", "event": "Start of reporting window for AI-generated script campaigns" }, { "date": "2026-03-04", "event": "HP publishes Threat Insights Report" } ], "impact": "At least 14 percent of email threats isolated by HP Sure Click had bypassed one or more gateway scanners.", "response": "HP recommended isolation and exposure reduction over variant-by-variant detection.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "SecurityBrief UK (HP report coverage)", "url": "https://securitybrief.co.uk/story/hp-warns-of-ai-fuelled-flat-pack-cyberattacks-surge" }, { "name": "Cyber Magazine", "url": "https://cybermagazine.com/news/hp-wolf-security-how-vibe-hacking-overwhelms-legacy-defence" } ] }, { "id": "bing-ai-fake-openclaw-installer", "date": "2026-03-05", "title": "Bing AI search promotes fake OpenClaw installer repos pushing Atomic and Vidar stealers", "category": "AI supply chain", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Users searching for OpenClaw downloads", "loss_usd": null, "summary": "Huntress found GitHub repos under an 'openclaw-installer' organization, built from copied Cloudflare moltworker code, that Bing's AI answers recommended; the Windows binary dropped Vidar and GhostSocks and the macOS script delivered Atomic Stealer.", "source": "Huntress (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unattributed; Huntress observed the campaign in February 2026 across multiple new GitHub accounts", "motive": "Credential theft and proxy botnet enrolment", "vector": "Malicious GitHub repositories surfaced by Bing AI search; OpenClaw_x64.exe ran Rust loaders executing stealers in memory, macOS users pasted a Terminal command", "root_cause": "AI search summarisation trusting freshly created GitHub repositories as official download sources", "timeline": [ { "date": "2026-02", "event": "Huntress identifies the campaign and quarantines payloads on a customer machine" }, { "date": "2026-03-05", "event": "Huntress reports repositories to GitHub; BleepingComputer publishes the findings" } ], "impact": "Victim count not disclosed; infections delivered Vidar infostealer, GhostSocks backconnect proxy and Atomic Stealer", "response": "Repositories reported to GitHub; Microsoft Defender quarantined the files; users advised to bookmark the official github.com/openclaw/openclaw source", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/" }, { "name": "BleepingComputer OpenClaw tag", "url": "https://www.bleepingcomputer.com/tag/openclaw/" } ] }, { "id": "microsoft-coral-sleet-agentic", "date": "2026-03-06", "title": "Microsoft: North Korea's Coral Sleet runs agentic AI workflow from lures to payload tests", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Developers and crypto firms targeted by DPRK lures", "loss_usd": null, "summary": "Microsoft reported Coral Sleet (formerly Storm-1877) using agentic AI for end-to-end lure building, infrastructure provisioning and payload testing, jailbreaking LLMs for malicious code, with AI markers in OtterCookie.", "source": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/", "actor": "Coral Sleet / Storm-1877 (North Korea)", "actor_type": "state", "attribution": "Microsoft Threat Intelligence attributes Coral Sleet to North Korea with high confidence.", "motive": "Financial theft and espionage for the DPRK", "vector": "Agentic AI tools for fake company websites, remote infrastructure and iterative malware reimplementation", "root_cause": "Jailbroken LLM coding tools plus development platforms give the actor scalable, refreshable infrastructure", "timeline": [ { "date": "2025", "event": "OtterCookie sample with AI-assisted code markers observed by Microsoft" }, { "date": "2026-03-06", "event": "Microsoft publishes AI as tradecraft report naming Coral Sleet" } ], "impact": "Rapid capability growth in DPRK malware such as OtterCookie; victim counts not published.", "response": "Actor profile and detections in Microsoft Defender; jailbreak detection via Prompt Shields.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/" }, { "name": "SecureWorld coverage", "url": "https://secureworld.io/industry-news/ai-full-lifecycle-weapon-north-korea" }, { "name": "CSA research note", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-microsoft-ai-attack-lifecycle-intelligence/" } ] }, { "id": "microsoft-jasper-sleet-faceswap", "date": "2026-03-06", "title": "Jasper Sleet IT workers used Faceswap and voice changers; thousands of accounts cut", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "Western employers hiring remote IT staff", "loss_usd": null, "summary": "Microsoft detailed Jasper Sleet inserting DPRK workers' faces into stolen ID documents with Faceswap, using voice changers in interviews and AI to tailor fake resumes, and said it disrupted thousands of accounts.", "source": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/", "actor": "Jasper Sleet (North Korea)", "actor_type": "state", "attribution": "Microsoft Threat Intelligence attributes Jasper Sleet to the DPRK remote IT worker programme.", "motive": "Sanctions-evading revenue and insider access", "vector": "AI image manipulation, voice alteration and LLM-written applicant materials", "root_cause": "Identity vetting relies on documents and video that generative tools can now fake", "timeline": [ { "date": "2025-06-30", "event": "Microsoft publishes initial Jasper Sleet guidance" }, { "date": "2026-03-06", "event": "Microsoft details AI tradecraft and reports thousands of accounts disrupted" } ], "impact": "Fraudulent hires across Western companies; dollar figures not published.", "response": "Thousands of accounts disrupted, Defender XDR detections and hunting queries released, industry partnerships.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/" }, { "name": "Robinson and Cole summary", "url": "https://www.dataprivacyandsecurityinsider.com/2026/03/north-korean-threat-groups-using-ai-in-remote-technical-employee-schemes/" } ] }, { "id": "mckinsey-lilli-breach", "date": "2026-03-09", "title": "Autonomous AI agent breaches McKinsey's Lilli chatbot platform in two hours", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "McKinsey Lilli AI platform", "loss_usd": null, "summary": "CodeWall's offensive agent found SQL injection via unauthenticated Lilli API endpoints, claiming read-write access to 46.5M chat messages and system prompts; McKinsey patched within a day.", "source": "The Register", "url": "https://www.theregister.com/2026/03/09/mckinsey_ai_chatbot_hacked", "actor": "CodeWall autonomous offensive AI agent (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-disclosed by CodeWall; McKinsey confirmed patching", "motive": "Security research demonstrating autonomous agent capability", "vector": "22 unauthenticated API endpoints; SQL injection via JSON keys concatenated into queries, plus broken access control on user IDs", "root_cause": "Unauthenticated endpoints and unsanitized JSON field names in SQL, with prompts, files, configs and user data stored in one backend", "timeline": [ { "date": "2026-02", "event": "CodeWall agent gains read-write access in under two hours in late February" }, { "date": "2026-03-01", "event": "CodeWall notifies McKinsey security team" }, { "date": "2026-03-02", "event": "McKinsey patches exposed endpoints and takes dev environment offline" }, { "date": "2026-03-09", "event": "CodeWall publishes findings" } ], "impact": "Claimed access to 46.5 million chat messages, 728,000 files, 57,000 user accounts and 95 writable system prompts; no malicious exploitation reported.", "response": "McKinsey patched within a day and took the environment offline; CodeWall and Promptfoo published analyses.", "status": "patched", "cve": null, "sources": [ { "name": "The Register", "url": "https://www.theregister.com/2026/03/09/mckinsey_ai_chatbot_hacked" }, { "name": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/autonomous-agent-hacked-mckinseys-ai-in-2-hours-a-31007" }, { "name": "Outpost24", "url": "https://outpost24.com/?p=12216" } ] }, { "id": "n8n-cve-2025-68613-kev", "date": "2026-03-11", "title": "CISA confirms active exploitation of max-severity n8n expression injection RCE", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Self-hosted n8n AI workflow automation servers", "loss_usd": null, "summary": "CISA added CVE-2025-68613, a CVSS 9.9 expression-injection flaw in n8n's workflow engine, to its KEV catalog; over 24,700 unpatched instances were exposed, each typically holding cloud keys, OAuth tokens and database passwords.", "source": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/03/11/cisa-adds-one-known-exploited-vulnerability-catalog", "actor": "Unknown", "actor_type": "unknown", "attribution": "CISA confirmed in-the-wild exploitation without naming actors; no public details of the attacks", "motive": "Unknown; access to n8n yields stored credentials for connected SaaS, cloud and AI services", "vector": "Authenticated low-privilege user injects payloads into workflow expressions that execute without isolation, gaining code execution as the n8n process", "root_cause": "Insufficiently sandboxed expression evaluation in n8n versions 0.211.0 through 1.122.0", "timeline": [ { "date": "2025-12-19", "event": "n8n publishes advisory GHSA-v98v-ff95-f3cp and fixes in 1.120.4, 1.121.1 and 1.122.0" }, { "date": "2026-02", "event": "Shadowserver counts more than 24,700 unpatched instances online" }, { "date": "2026-03-11", "event": "CISA adds CVE-2025-68613 to KEV with a March 25 federal deadline" } ], "impact": "Full takeover of vulnerable instances with access to secrets and the ability to modify workflows; Resecurity estimated over 103,000 of 230,000 active users were vulnerable", "response": "Vendor patch available since December 2025; CISA ordered federal agencies to remediate by March 25, 2026", "status": "patched", "cve": "CVE-2025-68613", "verification": "confirmed", "sources": [ { "name": "CISA", "url": "https://www.cisa.gov/news-events/alerts/2026/03/11/cisa-adds-one-known-exploited-vulnerability-catalog" }, { "name": "n8n advisory GHSA-v98v-ff95-f3cp", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp" }, { "name": "The Register", "url": "https://www.theregister.com/2026/03/12/cisa_n8n_rce/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/03/cisa-flags-actively-exploited-n8n-rce.html" } ] }, { "id": "open-webui-cybernews-compromised", "date": "2026-03-18", "title": "Cybernews: 45 of 98 unauthenticated Open WebUI servers already running miners and stealers", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Exposed Open WebUI instances", "loss_usd": null, "summary": "Cybernews researchers found 98 Open WebUI servers with authentication disabled and over 2,000 allowing open sign-up; 45 of the unauthenticated hosts carried a cryptominer and infostealer operation seen in 14 variants with Discord webhook alerts.", "source": "Cybernews (via Compare the Cloud)", "url": "https://www.comparethecloud.net/news/open-source-ai-servers-hijacked-with-cryptominers-and-infostealers-for-over-a-year", "actor": "Unknown", "actor_type": "criminal", "attribution": "Single malware source tracked through 14 versions; operator not identified", "motive": "Cryptomining and credential theft", "vector": "Open WebUI instances with authentication off or open registration; payloads hidden by repeated byte reversal, base64 and zlib layers", "root_cause": "Operators disabling authentication or leaving sign-up open on internet-facing AI chat front ends; two undocumented API routes lacking access control", "timeline": [ { "date": "2026-03-18", "event": "Cybernews publishes the scan: 98 unauthenticated instances, 45 compromised, 2,000 plus with open registration" }, { "date": "2026-03", "event": "Two information disclosure flaws reported to Open WebUI Inc.; report closed without response" } ], "impact": "Nearly half of unauthenticated servers compromised for mining and data theft; attackers gained access to chats, uploaded documents and connected model keys", "response": "No vendor response reported; researchers urged enabling authentication and restricting registration", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "Compare the Cloud", "url": "https://www.comparethecloud.net/news/open-source-ai-servers-hijacked-with-cryptominers-and-infostealers-for-over-a-year" }, { "name": "Sysdig (earlier Open WebUI case)", "url": "https://www.sysdig.com/blog/attacker-exploits-misconfigured-ai-tool-to-run-ai-generated-payload" } ] }, { "id": "unit42-gpt4-gated-sliver-dropper", "date": "2026-03-19", "title": "Unit 42: Go dropper asks GPT-4 whether to deploy Sliver based on host telemetry", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Windows hosts of unknown victims", "loss_usd": null, "summary": "Unit 42 analysed a Golang dropper that sends host telemetry to GPT-4 posing as an OPSEC AI and only runs its Sliver payload if the model returns execute true, plus a .NET stealer whose GPT-3.5 calls were mostly theatre.", "source": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/ai-use-in-malware/", "actor": "Unknown", "actor_type": "unknown", "attribution": "Unit 42 could not determine whether the samples were AI-written; dropper first flagged publicly by MalwareHunterTeam.", "motive": "Unknown", "vector": "Dropper with embedded OpenAI API usage gating payload execution on an LLM verdict", "root_cause": "Public LLM APIs provide malware a remote decision engine that evades static analysis", "timeline": [ { "date": "2026-03-01", "event": "MalwareHunterTeam flags the GPT-4-gated Sliver dropper on X" }, { "date": "2026-03-19", "event": "Unit 42 publishes analysis of AI-written and AI-controlled malware samples" } ], "impact": "No campaign or victims identified; demonstrates AI-gated execution in real samples.", "response": "Unit 42 shared hashes and detections.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Unit 42", "url": "https://unit42.paloaltonetworks.com/ai-use-in-malware/" }, { "name": "BleepingComputer", "url": "https://bleepingcomputer.com/news/security/malicious-llms-empower-inexperienced-hackers-with-advanced-tools" } ] }, { "id": "meta-agent-data-exposure", "date": "2026-03-20", "title": "Meta AI agent's flawed advice exposes sensitive data to employees for two hours", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "US", "region": "North America", "target": "Meta internal systems", "loss_usd": null, "summary": "An engineer acted on an internal AI agent's faulty guidance, making large amounts of sensitive user and company data visible to unauthorized staff for about two hours.", "source": "The Guardian", "url": "https://www.theguardian.com/technology/2026/mar/20/meta-ai-agents-instruction-causes-large-sensitive-data-leak-to-employees", "actor": "Meta engineer acting on internal AI agent advice", "actor_type": "accident", "attribution": "Confirmed by Meta to The Information; classified internally as Sev 1", "motive": "None (accidental)", "vector": "AI agent on an internal forum gave faulty engineering guidance that, once implemented, exposed data to unauthorized employees", "root_cause": "Unverified AI-generated instructions executed without review; permission model allowed a single change to expose sensitive data broadly", "timeline": [ { "date": "2026-03-18", "event": "Engineer applies AI agent's suggested fix; data visible to staff for about two hours" }, { "date": "2026-03-20", "event": "The Information and The Guardian report the incident" } ], "impact": "Large volume of sensitive user and company data visible to unauthorized Meta engineers for about two hours; Meta says no user data was mishandled.", "response": "Meta reverted the change, classified it as Sev 1 and said a human could also have given erroneous advice.", "status": "resolved", "cve": null, "sources": [ { "name": "The Guardian", "url": "https://www.theguardian.com/technology/2026/mar/20/meta-ai-agents-instruction-causes-large-sensitive-data-leak-to-employees" }, { "name": "Storyboard18", "url": "https://storyboard18.com/digital/meta-ai-agent-goes-rogue-exposes-company-and-user-data-for-two-hours-report-92649.htm" }, { "name": "PointGuard AI", "url": "https://www.pointguardai.com/ai-security-incidents/metas-ai-agent-misfire-spills-data-across-the-workforce" } ] }, { "id": "langflow-cve-2026-33017-exploited", "date": "2026-03-25", "title": "Langflow unauthenticated RCE (CVE-2026-33017) exploited within 20 hours of advisory", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Langflow AI pipeline servers", "loss_usd": null, "summary": "A public flow build endpoint in Langflow before 1.9.0 ran attacker-supplied Python with no login; Sysdig honeypots saw scanning, reconnaissance and environment-variable theft within a day of disclosure and CISA added it to KEV.", "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017", "actor": "Unknown", "actor_type": "criminal", "attribution": "Six source IPs observed by Sysdig, two sharing a C2 server; no named group", "motive": "Credential harvesting and footholds on AI pipeline hosts", "vector": "Single POST to /api/v1/build_public_tmp/{flow_id}/flow with node definitions containing arbitrary Python passed to exec()", "root_cause": "Endpoint built flows without authentication and trusted attacker-controlled flow data instead of stored flows", "timeline": [ { "date": "2026-03-17", "event": "Langflow publishes GHSA-vwmf-pq79-vjvx; fixed in 1.8.2 and 1.9.0" }, { "date": "2026-03-18", "event": "First exploitation attempt about 20 hours later, followed by nuclei scanning and env-var exfiltration" }, { "date": "2026-03-25", "event": "CISA adds CVE-2026-33017 to the KEV catalog" } ], "impact": "Unauthenticated code execution on exposed Langflow servers; attackers dumped environment variables and searched for .env and .db secrets", "response": "Upgrade to 1.9.0 or later; Sysdig published IOCs and callback domains", "status": "patched", "cve": "CVE-2026-33017", "verification": "confirmed", "sources": [ { "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017" }, { "name": "Langflow advisory", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx" }, { "name": "Sysdig", "url": "https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours" } ] }, { "id": "chatgpt-dns-runtime-leak", "date": "2026-03-30", "title": "Check Point finds DNS tunnel out of ChatGPT's code sandbox leaking chats and files", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "IL", "region": "Middle East & Africa", "target": "OpenAI ChatGPT code execution runtime", "loss_usd": null, "summary": "Check Point Research found ChatGPT's supposedly offline Python container could reach the internet via DNS, so one malicious prompt or custom GPT could exfiltrate messages and files or open a remote shell. OpenAI fixed it", "source": "Check Point Research", "url": "https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/", "actor": "Check Point Research", "actor_type": "researcher", "attribution": "Responsible disclosure; OpenAI said it had identified the problem internally", "motive": "Security research", "vector": "Prompt injection causing the runtime to encode data in DNS subdomain lookups; DNS responses carried commands back", "root_cause": "DNS resolution remained enabled inside a sandbox described as having no outbound network access", "timeline": [ { "date": "2026-02-20", "event": "OpenAI fix fully deployed" }, { "date": "2026-03-30", "event": "Check Point publishes the research" } ], "impact": "Silent exfiltration of conversation data including health and financial content; no exploitation reported", "response": "OpenAI closed the DNS channel in the code execution environment", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "Check Point Research", "url": "https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/" }, { "name": "The Register", "url": "https://www.theregister.com/security/2026/03/30/openai-chatgpt-fixes-dns-data-smuggling-flaw/5222414" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4152393/openai-patches-twin-leaks-as-codex-slips-and-chatgpt-spills.html" } ] }, { "id": "claude-code-leak-lures", "date": "2026-03-31", "title": "Claude Code source map leak followed by malware-laced fake 'leak' repos", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Anthropic Claude Code / developers", "loss_usd": null, "summary": "Anthropic accidentally shipped a source map exposing ~513,000 lines of Claude Code; attackers then used fake leaked-code GitHub repos to spread malware to developers.", "source": "Zscaler ThreatLabz", "url": "https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak", "actor": "Anthropic packaging error; GitHub user idbzoomh spreading Vidar and GhostSocks", "actor_type": "criminal", "attribution": "Leak self-disclosed by Anthropic as human error; malware lures identified by Zscaler and Trend Micro, operator not named", "motive": "Leak accidental; follow-on campaign financially motivated credential theft and proxy botnet building", "vector": "Source map in npm package 2.1.88 exposing TypeScript source; SEO-optimized fake leak repos with a Rust dropper in GitHub Releases", "root_cause": "Build pipeline shipped a 59.8 MB source map; developers downloading unverified archives from repositories claiming to host the leak", "timeline": [ { "date": "2026-03-31", "event": "Anthropic publishes @anthropic-ai/claude-code 2.1.88 with full source map" }, { "date": "2026-04-01", "event": "Fake leaked Claude Code repos appear on GitHub pushing Vidar and GhostSocks" }, { "date": "2026-04-02", "event": "Zscaler, Trend Micro and media report the malware campaign" } ], "impact": "About 513,000 lines of Claude Code source exposed; developers who ran the fake leak archive infected with Vidar infostealer and GhostSocks proxy malware.", "response": "Anthropic pulled the package and called it a packaging error; researchers warned against downloading leak repos; malicious repos reported to GitHub.", "status": "contained", "cve": null, "sources": [ { "name": "Zscaler ThreatLabz", "url": "https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/claude-code-leak-used-to-push-infostealer-malware-on-github/" }, { "name": "The Register", "url": "https://www.theregister.com/2026/04/02/trojanized_claude_code_leak_github/" }, { "name": "Help Net Security", "url": "https://www.helpnetsecurity.com/2026/04/03/claude-code-leak-github-malware/" } ] }, { "id": "codex-branch-name-injection", "date": "2026-03-31", "title": "OpenAI Codex branch-name command injection exposed GitHub tokens in cloud tasks", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "OpenAI Codex (web, CLI, SDK, IDE extension)", "loss_usd": null, "summary": "BeyondTrust found Codex did not sanitise the GitHub branch name when cloning repos, so a crafted request could run shell commands in the task container and steal the GitHub token. OpenAI fixed it on 5 February 2026.", "source": "BeyondTrust Phantom Labs", "url": "https://www.csoonline.com/article/4152393/openai-patches-twin-leaks-as-codex-slips-and-chatgpt-spills.html", "actor": "BeyondTrust Phantom Labs", "actor_type": "researcher", "attribution": "Reported to OpenAI on 16 December 2025; fixed before disclosure", "motive": "Security research", "vector": "Command injection via unvalidated branch name parameter, with Unicode obfuscation to hide the payload in the UI", "root_cause": "Shell command construction from untrusted input in the Codex task runner", "timeline": [ { "date": "2025-12-16", "event": "BeyondTrust reports the flaw" }, { "date": "2026-02-05", "event": "OpenAI patches input validation" }, { "date": "2026-03-31", "event": "Public disclosure" } ], "impact": "Token theft and lateral movement across shared repositories was possible; no exploitation reported", "response": "OpenAI tightened branch-name validation and hardened command construction", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "CSO Online", "url": "https://www.csoonline.com/article/4152393/openai-patches-twin-leaks-as-codex-slips-and-chatgpt-spills.html" }, { "name": "Hackmag", "url": "https://hackmag.com/news/chatgpt-codex-flaws" } ] }, { "id": "vertex-ai-double-agent", "date": "2026-03-31", "title": "Vertex AI 'Double Agent': over-privileged agents leak credentials and code", "category": "Agent hijack", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Google Cloud Vertex AI Agent Engine", "loss_usd": null, "summary": "Unit 42 showed agents deployed on Vertex AI inherited broad default service-account rights, letting a compromised agent steal credentials and reach restricted images and source code.", "source": "Unit 42 (Palo Alto Networks)", "url": "https://unit42.paloaltonetworks.com/double-agents-vertex-ai/", "actor": "Security researchers at Palo Alto Networks Unit 42 (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-attributed research by Unit 42; Google confirmed and worked with researchers on the fix", "motive": "Security research and responsible disclosure", "vector": "Code running inside a deployed ADK agent queried the GCP instance metadata service to obtain the OAuth token of the Google-managed service agent (P4SA)", "root_cause": "Vertex AI Agent Engine attached a default per-product service agent with broad permissions, so any compromised or malicious agent inherited over-privileged, Google-managed identity", "timeline": [ { "date": "2026-03", "event": "Unit 42 demonstrates credential extraction and access to customer data and Google-internal Artifact Registry images" }, { "date": "2026-03-31", "event": "Unit 42 publishes Double Agents research after responsible disclosure to Google" }, { "date": "2026-04-01", "event": "Google confirms production image tampering was blocked and updates Vertex AI permissions documentation" } ], "impact": "Proof of concept only: a deployed agent could return service-agent credentials, reach customer data, internal Dockerfiles and Google internal Artifact Registry contents; no confirmed real-world victims", "response": "Google worked with Unit 42, confirmed internal controls block tampering with production images, rewrote agent permission docs and recommends Bring Your Own Service Account (least privilege) for Vertex AI deployments", "status": "patched", "cve": null, "sources": [ { "name": "Unit 42 (Palo Alto Networks)", "url": "https://unit42.paloaltonetworks.com/double-agents-vertex-ai/" }, { "name": "TechRadar", "url": "https://www.techradar.com/pro/security/what-if-the-ai-agent-you-just-deployed-was-secretly-working-against-you-vertex-ai-double-agent-flaw-exposes-customer-data-and-googles-internal-code" }, { "name": "Cloud Security Alliance", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-vertex-ai-service-agent-privilege-escalati/" } ] }, { "id": "mercor-litellm-breach", "date": "2026-04-03", "title": "Poisoned LiteLLM releases tied to Mercor breach exposing AI lab training secrets", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "US", "region": "North America", "target": "Mercor; clients Meta, OpenAI, Anthropic", "loss_usd": null, "summary": "Malicious versions of the LiteLLM gateway library were linked to a breach at AI data vendor Mercor, prompting Meta to pause work amid fears training methods and contractor data leaked.", "source": "WIRED", "url": "https://www.wired.com/story/meta-pauses-work-with-mercor-after-data-breach-puts-ai-industry-secrets-at-risk/", "actor": "TeamPCP (LiteLLM poisoning); Lapsus$ claimed the Mercor data", "actor_type": "criminal", "attribution": "TeamPCP linked by security researchers (Wiz and others); Lapsus$ self-claimed Mercor access; link between the two groups unconfirmed", "motive": "Credential theft, data theft and extortion; stolen data listed for sale", "vector": "Maintainer credentials stolen via Trivy supply-chain attack used to publish trojanized LiteLLM 1.82.7 and 1.82.8 to PyPI; Mercor pulled the poisoned package into its environment", "root_cause": "Compromised maintainer credentials on PyPI with no secondary release gate, plus downstream consumers auto-installing new library versions without pinning or verification", "timeline": [ { "date": "2026-03-27", "event": "TeamPCP publishes malicious LiteLLM 1.82.7 and 1.82.8 to PyPI; live about 40 minutes" }, { "date": "2026-03", "event": "Mercor confirms it was among thousands of organizations hit; Lapsus$ claims its data" }, { "date": "2026-04-01", "event": "Class action filed on behalf of affected contractors; further suits follow" }, { "date": "2026-04-03", "event": "WIRED reports Meta indefinitely pauses work with Mercor; OpenAI investigates" } ], "impact": "Reported theft of Mercor source code, user database and storage buckets including interview videos, passport scans and SSNs of tens of thousands of contractors; AI lab training workflows feared exposed; Meta contractors put on pause", "response": "Mercor contained the incident and hired third-party forensics; Meta paused work, OpenAI opened a review; LiteLLM yanked the versions; multiple contractor lawsuits filed", "status": "under investigation", "cve": null, "sources": [ { "name": "WIRED", "url": "https://www.wired.com/story/meta-pauses-work-with-mercor-after-data-breach-puts-ai-industry-secrets-at-risk/" }, { "name": "TechRepublic", "url": "https://www.techrepublic.com/article/news-meta-pauses-work-with-mercor-after-data-breach/" }, { "name": "The Next Web", "url": "https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk" }, { "name": "Storyboard18", "url": "https://www.storyboard18.com/digital/ai-startup-mercor-flags-data-exposure-in-supply-chain-attack-linked-to-litellm-94295.htm" } ] }, { "id": "flowise-rce-exploited", "date": "2026-04-07", "title": "Max-severity Flowise CustomMCP RCE (CVE-2025-59528) exploited in the wild", "category": "Agent hijack", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Flowise AI agent builder", "loss_usd": null, "summary": "Attackers began exploiting JavaScript injection in Flowise's CustomMCP node to run code on AI workflow servers, with 12,000-15,000 instances exposed online.", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/", "actor": "Unknown attacker operating from a single Starlink IP", "actor_type": "unknown", "attribution": "No public attribution; exploitation detected by VulnCheck Canary honeypot network", "motive": "Unknown; likely opportunistic server takeover", "vector": "Malicious mcpServerConfig string sent to Flowise CustomMCP node, which evaluated it via the JavaScript Function() constructor with full Node.js privileges; only an API token required", "root_cause": "CustomMCP node executed user-supplied configuration as JavaScript without validation, giving access to child_process and fs modules", "timeline": [ { "date": "2025-09", "event": "Flaw disclosed and patched in Flowise 3.0.6; CVE-2025-59528 assigned with CVSS 10.0" }, { "date": "2026-04-07", "event": "VulnCheck reports first in-the-wild exploitation; 12,000-15,000 instances exposed online" }, { "date": "2026-04-07", "event": "BleepingComputer and others urge upgrade to 3.1.1 or later" } ], "impact": "Remote code execution on exposed Flowise servers; exploitation limited to one source IP at time of reporting; number of compromised instances unknown", "response": "Vendor fix already available (3.0.6+); researchers urged upgrading, removing instances from the internet and rotating API tokens; VulnCheck shared signatures with customers", "status": "patched", "cve": "CVE-2025-59528", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.html" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/190471/security/attackers-exploit-critical-flowise-flaw-cve-2025-59528-for-remote-code-execution.html" }, { "name": "SecurityWeek", "url": "https://www.securityweek.com/critical-flowise-vulnerability-in-attacker-crosshairs/" } ] }, { "id": "grafanaghost", "date": "2026-04-07", "title": "GrafanaGhost: indirect prompt injection makes Grafana AI leak enterprise data", "category": "Prompt injection", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Grafana AI assistant", "loss_usd": null, "summary": "Researchers showed hidden instructions in external content could make Grafana's AI render an attacker image URL carrying enterprise data; Grafana patched it.", "source": "SecurityWeek", "url": "https://www.securityweek.com/grafanaghost-attackers-can-abuse-grafana-to-leak-enterprise-data/", "actor": "Security researchers at Noma Security (Sasi Levi), responsible disclosure", "actor_type": "researcher", "attribution": "Self-attributed research by Noma Security; Grafana Labs validated the flaw but disputed its severity", "motive": "Security research and responsible disclosure", "vector": "Crafted URL path carrying hidden instructions, an INTENT keyword to bypass guardrails, and a protocol-relative image URL that evaded external-image domain validation", "root_cause": "Grafana AI assistant trusted content in URL paths and external pages, and URL validation failed to block protocol-relative links, enabling zero-click exfiltration via image rendering", "timeline": [ { "date": "2026-03", "event": "Noma Security discovers the chained bypass and reports it to Grafana Labs" }, { "date": "2026-04-07", "event": "Grafana patches the core issue; Noma publishes GrafanaGhost research" }, { "date": "2026-04-07", "event": "SecurityWeek, CyberScoop and Dark Reading cover the disclosure" } ], "impact": "Proof of concept only; no confirmed data breach. Attack could have leaked dashboard data including financial metrics, infrastructure and customer telemetry to an attacker server", "response": "Grafana Labs validated the report and rolled out a fix for the URL validation and guardrail bypass; disputed the severity, noting repeated user involvement was needed", "status": "patched", "cve": null, "sources": [ { "name": "SecurityWeek", "url": "https://www.securityweek.com/grafanaghost-attackers-can-abuse-grafana-to-leak-enterprise-data/" }, { "name": "CyberScoop", "url": "https://cyberscoop.com/grafanaghost-grafana-prompt-injection-vulnerability-data-exfiltration/" }, { "name": "Dark Reading", "url": "https://darkreading.com/application-security/grafana-patches-ai-bug-leaked-user-data" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4155004/zero-click-grafana-ai-attack-can-enable-enterprise-data-exfiltration.html" } ] }, { "id": "copilot-agentforce-injection", "date": "2026-04-15", "title": "Prompt injection leaks data from Microsoft Copilot Studio and Salesforce Agentforce agents", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Copilot Studio, Salesforce Agentforce", "loss_usd": null, "summary": "Researchers demonstrated indirect prompt injection that exfiltrated data from enterprise agents built on Copilot Studio (CVE-2026-21520) and Agentforce despite earlier patches.", "source": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-04-15-d934", "actor": "Security researchers at Capsule Security (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-attributed research by Capsule Security; Microsoft assigned CVE-2026-21520 (ShareLeak); Salesforce confirmed addressing PipeLeak", "motive": "Security research and responsible disclosure", "vector": "Indirect prompt injection via ordinary business inputs: a SharePoint form comment field (Copilot Studio) and a public lead form (Agentforce) carrying fake system instructions", "root_cause": "Untrusted form input was concatenated into agent system prompts with no separation between trusted instructions and user data, so agents followed injected commands through authorized tools", "timeline": [ { "date": "2026-01-15", "event": "Microsoft patches the Copilot Studio flaw server-side" }, { "date": "2026-01-22", "event": "CVE-2026-21520 published (CVSS 7.5)" }, { "date": "2026-04-15", "event": "Capsule Security publicly discloses ShareLeak and PipeLeak alongside its launch" } ], "impact": "Demonstrated exfiltration of SharePoint list data by email and misuse of Agentforce workflows; Microsoft safety filters flagged but did not stop the payload; no confirmed real-world victims", "response": "Microsoft mitigated internally with no customer action required; Salesforce said it addressed the issue; researchers warned the attack class remains open", "status": "patched", "cve": "CVE-2026-21520", "sources": [ { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-04-15-d934" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4159079/copilot-and-agentforce-fall-to-form-based-prompt-injection-tricks.html" }, { "name": "SiliconANGLE", "url": "https://siliconangle.com/2026/04/15/capsule-security-launches-7m-secure-ai-agents-runtime/" } ] }, { "id": "marimo-rce-nkabuse-hugging-face", "date": "2026-04-16", "title": "Marimo notebook RCE (CVE-2026-39987) exploited in hours; NKAbuse RAT staged on Hugging Face Spaces", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Marimo Python notebook servers", "loss_usd": null, "summary": "An unauthenticated terminal WebSocket in marimo before 0.23.0 gave shell access; Sysdig saw credential theft under 10 hours after disclosure and a campaign using a typosquatted Hugging Face Space to drop a new NKAbuse variant.", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-marimo-flaw-to-deploy-nkabuse-malware-from-hugging-face/", "actor": "Multiple actors incl. Germany- and Hong Kong-based operators", "actor_type": "criminal", "attribution": "Sysdig observed distinct operators: one testing 15 reverse-shell techniques and dumping PostgreSQL credentials, another using stolen .env data against Redis; NKAbuse campaign unattributed", "motive": "Credential theft, data dumping and remote access", "vector": "Connection to /terminal/ws without authentication to open a PTY shell, then curl of a dropper hosted on a Hugging Face Space named to mimic VS Code", "root_cause": "Terminal WebSocket endpoint skipped the authentication check used by other endpoints", "timeline": [ { "date": "2026-04-09", "event": "CVE-2026-39987 published; fixed in marimo 0.23.0" }, { "date": "2026-04-10", "event": "Credential theft attacks begin less than 10 hours after technical details appear" }, { "date": "2026-04-12", "event": "Campaign abusing Hugging Face Spaces to host NKAbuse begins" }, { "date": "2026-04-23", "event": "CISA adds the CVE to the KEV catalog" } ], "impact": "Shell access to exposed notebooks; attackers dumped database credentials, enumerated PostgreSQL and Redis session tokens and installed a RAT with systemd, cron or LaunchAgent persistence", "response": "Upgrade to 0.23.0 or block the /terminal/ws endpoint; Sysdig published IOCs", "status": "patched", "cve": "CVE-2026-39987", "verification": "confirmed", "sources": [ { "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39987" }, { "name": "marimo advisory", "url": "https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-marimo-flaw-to-deploy-nkabuse-malware-from-hugging-face/" } ] }, { "id": "vercel-context-ai", "date": "2026-04-19", "title": "Compromised Context.ai AI tool's OAuth grant leads to Vercel breach", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Vercel / Context.ai", "loss_usd": null, "summary": "Attackers who compromised the Context.ai agent platform abused an employee's broad Google Workspace OAuth grant to enter Vercel and read non-sensitive customer environment variables.", "source": "Trend Micro", "url": "https://trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html", "actor": "Unknown threat actor; data-sale claims on BreachForums unverified", "actor_type": "unknown", "attribution": "No public attribution; Vercel self-disclosed and traced origin to Context.ai compromise with Google Mandiant", "motive": "Credential and data theft; possible resale (unverified extortion claims)", "vector": "Compromised Context.ai Google Workspace OAuth application used to take over a Vercel employee's corporate Google account, then pivot into Vercel environments", "root_cause": "Broad OAuth scopes granted to a third-party AI tool, and Vercel environment variables not marked sensitive being readable in plaintext", "timeline": [ { "date": "2026-02", "event": "Context.ai employee reportedly infected with Lumma Stealer; OAuth tokens later compromised" }, { "date": "2026-03", "event": "Context.ai discloses unauthorized access to its AWS environment and hires CrowdStrike" }, { "date": "2026-04-19", "event": "Vercel detects unauthorized access to internal systems via employee Google Workspace account" }, { "date": "2026-04-21", "event": "Vercel publishes bulletin, notifies affected customers and publishes OAuth app IOC" } ], "impact": "Attacker accessed some Vercel environments and customer environment variables not marked sensitive for a limited set of customers; sensitive-flagged variables showed no evidence of access", "response": "Vercel engaged Google Mandiant, notified affected customers, recommended credential rotation, published an OAuth app IOC and confirmed with GitHub, npm and Socket that its packages were untouched", "status": "under investigation", "cve": null, "sources": [ { "name": "Trend Micro", "url": "https://trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html" }, { "name": "Help Net Security", "url": "https://helpnetsecurity.com/2026/04/20/vercel-breached" }, { "name": "The Register", "url": "https://www.theregister.com/2026/04/20/vercel_context_ai_security_incident/" } ] }, { "id": "lovable-pre-nov-2025-projects", "date": "2026-04-20", "title": "Researcher: free Lovable account could read source, Supabase keys and chats of pre-Nov 2025 projects", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "SE", "region": "Europe", "target": "Lovable projects created before November 2025", "loss_usd": null, "summary": "A researcher posting as weezerOSINT disclosed that any free Lovable account could access other users' source code, Supabase database credentials, AI chat histories and connected customer data for projects created before November 2025.", "source": "Bastion", "url": "https://bastion.tech/blog/lovable-april-2026-data-breach", "actor": "weezerOSINT (researcher)", "actor_type": "researcher", "attribution": "Public disclosure on X by the researcher, amplified by BoldMetrics CTO Morgan Linton; Lovable had not responded at time of reporting", "motive": "Security research and public warning", "vector": "Platform-side access control gap allowing cross-account reads of project assets", "root_cause": "Reported authorization flaw affecting all projects before a November 2025 platform change; not confirmed by Lovable", "timeline": [ { "date": "2026-04-20", "event": "Researcher discloses the exposure on X; Morgan Linton amplifies the warning" }, { "date": "2026-04", "event": "Bastion summarises the claims alongside the 2025 RLS CVE and a February 2026 incident" } ], "impact": "Potential exposure of source code, database credentials, prompt histories and customer data for every pre-November 2025 project; scale and exploitation unconfirmed", "response": "No Lovable statement on the April disclosure reported; its CISO earlier pointed to free pre-publish security scans", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Bastion", "url": "https://bastion.tech/blog/lovable-april-2026-data-breach" }, { "name": "Superblocks (background on 2025 CVE)", "url": "https://www.superblocks.com/blog/lovable-rls-breach" } ] }, { "id": "claude-code-symlink-escape", "date": "2026-04-21", "title": "Claude Code sandbox escape via symlinks allows host code execution (CVE-2026-39861)", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Anthropic Claude Code (before 2.1.64)", "loss_usd": null, "summary": "A sandboxed Claude Code process could create symlinks outside the workspace that the unsandboxed process then followed and wrote to without confirmation, letting prompt injection reach host code execution.", "source": "Anthropic GitHub advisory GHSA-vp62-r36r-9xqp", "url": "https://www.sentinelone.com/vulnerability-database/cve-2026-39861/", "actor": "Unknown", "actor_type": "researcher", "attribution": "Coordinated disclosure to Anthropic; CVSS 4.0 score 7.7", "motive": "Security research", "vector": "Prompt injection instructs the sandboxed agent to create a symlink; path traversal through the link bypasses workspace restrictions", "root_cause": "Unsandboxed file writer followed symlinks created by the sandboxed process without canonical path checks", "timeline": [ { "date": "2026-04", "event": "Fix shipped in Claude Code 2.1.64" }, { "date": "2026-04-21", "event": "CVE-2026-39861 published to NVD" } ], "impact": "Potential host compromise for developers running Claude Code on untrusted content; not known exploited", "response": "Anthropic patched and published a GitHub security advisory", "status": "patched", "cve": "CVE-2026-39861", "verification": "confirmed", "sources": [ { "name": "SentinelOne vulnerability database", "url": "https://www.sentinelone.com/vulnerability-database/cve-2026-39861/" }, { "name": "Phoenix Security", "url": "https://phoenix.security/claude-code-leak-to-vulnerability-three-cves-in-claude-code-cli-and-the-chain-that-connects-them/" } ] }, { "id": "mythos-unauthorized-access", "date": "2026-04-21", "title": "Unauthorized group accesses Anthropic's restricted Claude Mythos model via vendor", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Anthropic Claude Mythos Preview", "loss_usd": null, "summary": "Bloomberg reported a small group reached the restricted cyber-capable Mythos model using a contractor's account and a guessed URL; Anthropic investigated a third-party vendor environment.", "source": "The Decoder", "url": "https://the-decoder.com/unauthorized-users-breach-anthropics-restricted-mythos-ai-model/", "actor": "Small Discord-based group of AI enthusiasts, one with contractor access", "actor_type": "insider", "attribution": "Reported by Bloomberg based on screenshots and live demo; Anthropic confirmed investigating a third-party vendor environment", "motive": "Curiosity and experimentation with unreleased models, per the group; no reported malicious use", "vector": "Shared accounts and API keys of an authorized contractor plus a guessed model endpoint URL based on Anthropic naming conventions", "root_cause": "Weak access controls in a third-party vendor environment: shared credentials and predictable model endpoints with no additional gating", "timeline": [ { "date": "2026-04-07", "event": "Mythos Preview announced under Project Glasswing; group reportedly gains access the same day" }, { "date": "2026-04-21", "event": "Bloomberg reports the unauthorized access; Anthropic confirms investigation" }, { "date": "2026-04-22", "event": "Anthropic says no evidence of impact to core systems beyond the vendor environment" } ], "impact": "Unauthorized use of a restricted cyber-capable model by a handful of users over roughly two weeks; no evidence of core-system compromise reported", "response": "Anthropic investigated the vendor environment; outcome of the investigation not publicly reported", "status": "under investigation", "cve": null, "sources": [ { "name": "The Decoder", "url": "https://the-decoder.com/unauthorized-users-breach-anthropics-restricted-mythos-ai-model/" }, { "name": "Security Boulevard", "url": "https://securityboulevard.com/2026/04/unauthorized-group-gains-access-to-anthropics-restricted-mythos-ai-cybersecurity-tool/" }, { "name": "The Next Web", "url": "https://thenextweb.com/news/anthropic-mythos-unauthorized-access-vendor-breach" } ] }, { "id": "talos-softr-ai-phishing-page", "date": "2026-04-22", "title": "Talos IR: public-sector credential theft via phishing page vibe-coded on Softr AI builder", "category": "AI phishing", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Public administration employees' Exchange and OWA accounts", "loss_usd": null, "summary": "Cisco Talos IR's Q1 2026 report described a public-sector phishing case where the page targeting Exchange and OWA logins was built on Softr with a few AI prompts and no code, exfiltrating credentials to Google Sheets.", "source": "Cisco Talos", "url": "https://blog.talosintelligence.com/ir-trends-q1-2026/", "actor": "Unknown", "actor_type": "unknown", "attribution": "Talos IR engagement; Talos has moderate confidence Softr has been abused since May 2023.", "motive": "Credential theft", "vector": "Phishing email linking to an AI-built form page mimicking Exchange login, with captured data sent to an external store and email alerts per capture", "root_cause": "AI app builders let low-skill actors spin up convincing credential pages in minutes", "timeline": [ { "date": "2026-01-01", "event": "Engagement occurs during Q1 2026" }, { "date": "2026-04-22", "event": "Talos publishes Q1 2026 IR trends naming Softr" } ], "impact": "Phishing was the top initial access vector (over a third of engagements); MFA weaknesses in 35 percent.", "response": "Talos recommended MFA hardening and user awareness; first documented AI-builder case in a Talos IR engagement.", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Cisco Talos", "url": "https://blog.talosintelligence.com/ir-trends-q1-2026/" }, { "name": "SC Media", "url": "https://www.scworld.com/brief/ai-assisted-phishing-attacks-on-the-rise-report-finds" } ] }, { "id": "bangladesh-azhari-deepfake-drug-ring", "date": "2026-04-23", "title": "Bangladesh police arrest 10 who sold illegal drugs with deepfakes of preacher Azhari", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "BD", "region": "Asia-Pacific", "target": "Bangladeshi online shoppers", "loss_usd": null, "summary": "Police arrested ten members of a ring that used AI to replicate scholar Mizanur Rahman Azhari's face and voice in ads across about 24 fake Facebook pages and websites selling illegal stimulant drugs; two were remanded.", "source": "Prothom Alo", "url": "https://www.prothomalo.com/bangladesh/crime/zqzpowc54a", "actor": "Chattogram-based online fraud ring", "actor_type": "criminal", "attribution": "Nine arrested in Chattogram's Bayezid Bostami area and one in Dhaka's Mohammadpur under case No 19 at Paltan Model Police Station.", "motive": "Sales of illegal products using a trusted religious figure's endorsement.", "vector": "Deepfake video adverts on Facebook pages directing to fake sites; payments collected via cash-on-delivery couriers.", "root_cause": "Easy face and voice cloning of a widely followed public figure.", "timeline": [ { "date": "2025-02-15", "event": "Azhari first encounters fake videos using his identity" }, { "date": "2026-02-25", "event": "General diary filed at Paltan Model Police Station" }, { "date": "2026-04-23", "event": "Case registered under Cyber Security Act; nine arrested in Chattogram" }, { "date": "2026-04-24", "event": "Tenth suspect arrested in Dhaka; court remands two" } ], "impact": "24 fake pages and sites; 11 laptops, 47 phones, 21 SIM cards and illegal drugs seized.", "response": "Arrests, remand of two suspects, eight sent to jail pending trial.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Prothom Alo", "url": "https://www.prothomalo.com/bangladesh/crime/zqzpowc54a" }, { "name": "Jago News", "url": "https://www.jagonews24.com/law-courts/news/1116649" }, { "name": "ThreatCluster", "url": "https://threatcluster.io/cluster/10-arrested-for-ai-deepfake-drug-scam-involving-prominent-is-5a5623e7" } ] }, { "id": "banque-de-france-governor-deepfake", "date": "2026-04-27", "title": "Banque de France warns of deepfakes of governor Villeroy de Galhau selling investments", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "FR", "region": "Europe", "target": "French savers over 50 and companies", "loss_usd": null, "summary": "The French central bank and ACPR issued a joint alert about AI deepfakes of Governor Villeroy de Galhau and ACPR chief Emmanuelle Assouan recommending investments, followed by calls demanding advance fees.", "source": "Banque de France", "url": "https://www.banque-france.fr/fr/communiques-de-presse/la-banque-de-france-et-lacpr-mettent-en-garde-le-public-contre-un-risque-de-fraude-avec-usurpation-0", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; the institutions described organised fraud groups using social media ads.", "motive": "Advance-fee and fake investment fraud.", "vector": "Social media deepfake videos cloning voice and expressions, then email or phone follow-up by fake central bank officials citing inheritances or blocked savings.", "root_cause": "High public trust in central bank officials combined with inexpensive video cloning.", "timeline": [ { "date": "2026-04-27", "event": "Joint Banque de France and ACPR press release published" }, { "date": "2026-04-28", "event": "French press reports on the campaign" } ], "impact": "Victim numbers and losses not disclosed; both individuals and companies targeted with fake aid programmes.", "response": "Public warning that no official will ever recommend a product, with advice to verify through official channels.", "status": "unresolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Banque de France", "url": "https://www.banque-france.fr/fr/communiques-de-presse/la-banque-de-france-et-lacpr-mettent-en-garde-le-public-contre-un-risque-de-fraude-avec-usurpation-0" }, { "name": "Le Journal de l'Economie", "url": "https://www.journaldeleconomie.fr/la-banque-de-france-victime-dune-arnaque-a-lia/" }, { "name": "Economie Matin", "url": "https://www.economiematin.fr/?p=219581" } ] }, { "id": "ahmedabad-aadhaar-deepfake-racket", "date": "2026-04-28", "title": "Ahmedabad police bust racket using deepfake videos to beat Aadhaar face checks for loans", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "IN", "region": "Asia-Pacific", "target": "Aadhaar holders, DigiLocker and digital lenders", "loss_usd": null, "summary": "Ahmedabad cyber police arrested four men who used AI-animated videos made from a businessman's photo to pass Aadhaar face authentication, swap his registered mobile number, access DigiLocker and apply for loans.", "source": "Gujarat Samachar", "url": "https://english.gujaratsamachar.com/news/gujarat/ahmedabad-cyber-police-bust-deepfake-enabled-aadhaar-fraud-racket-four-arrested-25953669438.html", "actor": "Kanubhai Parmar, Ashish Waland, Mohammad Kaif Patel and Deep Gupta", "actor_type": "criminal", "attribution": "Ahmedabad Cyber Crime police; two accused are Common Service Centre operators who supplied Aadhaar update kits", "motive": "Identity takeover to obtain loans and bank accounts", "vector": "Deepfake video simulating blinking and movement to pass Aadhaar face authentication, combined with misuse of CSC update kits to swap the registered mobile number", "root_cause": "Facial liveness checks defeated by generative video; insider access to Aadhaar update infrastructure through CSC operators", "timeline": [ { "date": "2026-04", "event": "Complainant Amit Patel finds his Aadhaar-linked mobile and email changed" }, { "date": "2026-04-28", "event": "Four arrested and sent to judicial custody; update kit recovered" } ], "impact": "Victim's Aadhaar profile hijacked and used for KYC, DigiLocker access and loan applications on RKBansal, True Credits and EarlySalary; loss amounts not published", "response": "Arrests under the Bharatiya Nyaya Sanhita and IT Act; probe into further victims and CSC misuse", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Gujarat Samachar", "url": "https://english.gujaratsamachar.com/news/gujarat/ahmedabad-cyber-police-bust-deepfake-enabled-aadhaar-fraud-racket-four-arrested-25953669438.html" }, { "name": "AI Incident Database", "url": "https://incidentdatabase.ai/reports/7170/" } ] }, { "id": "austria-albania-van-der-bellen-crypto", "date": "2026-04-29", "title": "WKStA and Albanian police raid call centres using fake Van der Bellen crypto videos", "category": "Deepfake fraud", "direction": "with-ai", "severity": "critical", "country": "AT", "region": "Europe", "target": "Investors in Austria, Germany, Italy, Spain, UK and Canada", "loss_usd": 57000000, "summary": "Austria's WKStA and Bundeskriminalamt, with Albanian police, Europol and Eurojust, raided three Albanian call centres pushing crypto schemes with fake Van der Bellen videos; ten arrested, damage at least 50M euros.", "source": "Salzburg24 / APA", "url": "https://www.salzburg24.at/news/oesterreich/als-armin-wolf-ausgegeben-50-millionen-euro-schaden-durch-internet-betrug-art-324237", "actor": "Albania-based call centre fraud network", "actor_type": "criminal", "attribution": "Austrian prosecutors identified a network of about 450 call centre workers in Albania; ten suspects were arrested in the raids.", "motive": "Financial gain from fake crypto investments and follow-on recovery fees.", "vector": "Fake news articles and manipulated videos of Van der Bellen, David Alaba and Hermann Maier promoted crypto schemes; agents pressured victims and later posed as authorities offering recovery for a fee.", "root_cause": "Fabricated celebrity endorsements on social media plus multilingual call centres operating outside victims' jurisdictions.", "timeline": [ { "date": "2024-04-01", "event": "Austrian investigation begins after victim complaints" }, { "date": "2026-04-28", "event": "Raids on three Albanian call centres; ten arrested, 900,000 euros cash seized" }, { "date": "2026-04-29", "event": "WKStA and BK announce results at Vienna press conference" } ], "impact": "At least 50M euros taken from victims across seven countries; 450 computers and 238 phones seized.", "response": "Ten suspects arrested; proceedings under Austrian and Albanian law with Europol and Eurojust support.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Salzburg24 / APA", "url": "https://www.salzburg24.at/news/oesterreich/als-armin-wolf-ausgegeben-50-millionen-euro-schaden-durch-internet-betrug-art-324237" }, { "name": "CIO.de / dpa", "url": "https://www.cio.de/article/4164915/deepfake-falle-fahnder-zerschlagen-50-millionen-krypto-mafia.html" } ] }, { "id": "pytorch-lightning-2-6-3-backdoor", "date": "2026-04-30", "title": "Backdoored PyTorch Lightning 2.6.3 on PyPI runs Bun-based credential stealer on import", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "PyTorch Lightning users", "loss_usd": null, "summary": "Lightning AI disclosed that version 2.6.3 of the lightning package was published with a payload that downloads the Bun runtime and an 11.4 MB obfuscated JavaScript stealer targeting browser data, .env files, GitHub tokens and cloud credentials.", "source": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/backdoored-pytorch-lightning-package-drops-credential-stealer/", "actor": "Unknown", "actor_type": "unknown", "attribution": "Microsoft Threat Intelligence tracks the routine as ShaiWorm; the maintainers were still investigating how the release pipeline was breached", "motive": "Theft of developer, cloud and source control credentials", "vector": "Malicious py3-none-any wheel on PyPI that starts a background process on import, fetches Bun v1.3.13 from GitHub and executes router_runtime.js", "root_cause": "Compromised build or release pipeline of a widely used ML framework; cause under investigation", "timeline": [ { "date": "2026-04-30", "event": "Lightning AI discloses malicious 2.6.3 and reverts PyPI to 2.6.1" }, { "date": "2026-05-04", "event": "Microsoft says Defender blocked the routine on a small number of devices" } ], "impact": "Microsoft reported a small number of affected devices; anyone who imported lightning 2.6.3 was told to rotate all secrets", "response": "Package reverted to 2.6.1, users notified, audit of other recent releases promised", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/backdoored-pytorch-lightning-package-drops-credential-stealer/" }, { "name": "BleepingComputer PyPI tag", "url": "https://www.bleepingcomputer.com/tag/pypi/" } ] }, { "id": "ghana-mahama-deepfake-arrests", "date": "2026-05-07", "title": "Ghana police arrest 16 over AI deepfake videos of President Mahama used to solicit money", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "GH", "region": "Middle East & Africa", "target": "Ghanaian social media users", "loss_usd": null, "summary": "Ghana Police Service arrested 11 suspects in the Volta Region on 1 to 3 May and five more in Aflao on 4 May 2026 for making and spreading AI videos of President Mahama to extract money and personal data.", "source": "Graphic Online", "url": "https://www.graphic.com.gh/news/general-news/11-people-arrested-for-using-deepfake-ai-generated-video-to-impersonate-president-mahama.html", "actor": "Nigerian and Ghanaian fraud network operating around Aflao", "actor_type": "criminal", "attribution": "Ghana Police Service intelligence-led operations; suspects described as part of a wider network impersonating prominent figures", "motive": "Financial gain and harvesting of personal information", "vector": "Deepfake videos of the President and First Lady on Facebook, TikTok and WhatsApp directing viewers to pay or share details", "root_cause": "Easy access to generative video tools and pre-registered SIM cards; no deepfake-specific law, prosecutions rely on existing offences", "timeline": [ { "date": "2026-03-28", "event": "Two suspects, Bernard Mensah and Michael Ebo Sarfo, arrested for deepfakes of Mahama and his wife" }, { "date": "2026-05-03", "event": "Eleven arrested in Sogakope, Dabala, Tongu, Akatsi and Aflao" }, { "date": "2026-05-04", "event": "Five more arrested in Aflao; laptops, routers, 120 SIM cards and a vehicle seized" }, { "date": "2026-05-07", "event": "Nine remanded, two bailed; court return date 25 May" } ], "impact": "Victim losses not published; police seized 120 pre-registered SIM cards and equipment", "response": "Arrests, remand and prosecution; police warned that sharing deepfake content is a criminal offence", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Graphic Online", "url": "https://www.graphic.com.gh/news/general-news/11-people-arrested-for-using-deepfake-ai-generated-video-to-impersonate-president-mahama.html" }, { "name": "Rainbow Radio", "url": "https://rainbowradioonline.com/2026/03/31/police-arrest-2-suspects-over-deepfake-scams-targeting-president-mahama-and-wife/" }, { "name": "OECD.AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-05-07-b538" } ] }, { "id": "hf-fake-openai-privacy-filter", "date": "2026-05-07", "title": "Fake 'OpenAI Privacy Filter' repo tops Hugging Face trending while pushing Rust infostealer", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Hugging Face users downloading OpenAI releases", "loss_usd": null, "summary": "HiddenLayer found Open-OSS/privacy-filter, a copy of OpenAI's Privacy Filter model card whose loader.py pulled a PowerShell chain that added Defender exclusions and ran a Rust stealer; it reached number one trending with 244,000 likely inflated downloads.", "source": "HiddenLayer", "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter", "actor": "Unknown", "actor_type": "criminal", "attribution": "Same loader infrastructure as six repositories under the account anthfu uploaded April 24; overlaps with an npm typosquatting campaign delivering the WinOS 4.0 implant", "motive": "Theft of browser data, Discord tokens, crypto wallets and SSH, FTP and VPN credentials", "vector": "Typosquatted Hugging Face repository with a benign-looking loader.py that disabled SSL checks and fetched a PowerShell command from a paste service", "root_cause": "Trending rankings manipulated with auto-generated accounts; model hub users running loader scripts from unverified namespaces", "timeline": [ { "date": "2026-04-24", "event": "Six repositories by anthfu uploaded with the same malicious loader" }, { "date": "2026-05-07", "event": "HiddenLayer identifies privacy-filter at the top of trending and reports it" }, { "date": "2026-05-08", "event": "Hugging Face disables access and removes the repository" } ], "impact": "About 244,000 reported downloads and 667 likes in under 18 hours, mostly inflated; real victim count unclear; Windows victims had credentials and wallets exfiltrated", "response": "Hugging Face removed the repository for terms violation; researchers advised reimaging, rotating credentials and replacing wallets", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "HiddenLayer", "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/fake-openai-repository-on-hugging-face-pushes-infostealer-malware/" }, { "name": "PCrisk", "url": "https://www.pcrisk.com/internet-threat-news/35274-hugging-face-pushed-infostealer-via-fake-openai-repository" } ] }, { "id": "sysdig-marimo-llm-agent-pivots", "date": "2026-05-10", "title": "Sysdig: LLM agent pivots from marimo RCE to internal Postgres dump in under an hour", "category": "Agent hijack", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Cloud environment of an unnamed organisation", "loss_usd": null, "summary": "After exploiting CVE-2026-39987 in an exposed marimo notebook, an attacker gave stolen AWS credentials to an LLM agent that fetched an SSH key, hopped a bastion and dumped a PostgreSQL database in under an hour.", "source": "Sysdig Threat Research Team", "url": "https://www.sysdig.com/blog/ai-agent-at-the-wheel-how-an-attacker-used-llms-to-move-from-a-cve-to-an-internal-database-in-4-pivots", "actor": "Unknown", "actor_type": "unknown", "attribution": "Sysdig TRT; a leaked Chinese-language planning comment and machine-shaped commands indicated LLM agent execution. Operator unidentified.", "motive": "Credential and data theft", "vector": "Unauthenticated marimo terminal WebSocket RCE, credential harvesting from .env and AWS files, Secrets Manager replay, SSH bastion lateral movement", "root_cause": "Internet-exposed notebook with pre-auth RCE and long-lived cloud credentials on the host", "timeline": [ { "date": "2026-05-10", "event": "Marimo exploited at 18:23 UTC; database dumped within the hour" }, { "date": "2026-05-26", "event": "Sysdig publishes analysis" } ], "impact": "Schema and full contents of an internal PostgreSQL database including api_key, credential and user tables exfiltrated; bastion phase took 113 seconds.", "response": "Sysdig published detections; marimo 0.23.0 fixes the flaw.", "status": "patched", "cve": "CVE-2026-39987", "verification": "confirmed", "sources": [ { "name": "Sysdig", "url": "https://www.sysdig.com/blog/ai-agent-at-the-wheel-how-an-attacker-used-llms-to-move-from-a-cve-to-an-internal-database-in-4-pivots" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html" } ] }, { "id": "gtig-ai-built-2fa-zero-day", "date": "2026-05-11", "title": "GTIG intercepts first AI-developed zero-day: 2FA bypass in popular open-source admin tool", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Users of an unnamed open-source web admin tool", "loss_usd": null, "summary": "Criminal actors planned mass exploitation with a Python exploit bypassing two-factor authentication via a hardcoded trust assumption; a hallucinated CVSS score and textbook structure led GTIG to assess it was AI-written.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "actor": "Unnamed prominent cybercrime actors", "actor_type": "criminal", "attribution": "GTIG high confidence an AI model authored the exploit; does not believe Gemini was used; actors not named.", "motive": "Mass exploitation for financial gain", "vector": "LLM-discovered logic flaw turned into a credentialed 2FA-bypass exploit", "root_cause": "Developer hardcoded a trust assumption that LLM reasoning about intent could spot where fuzzers could not", "timeline": [ { "date": "2026", "event": "GTIG counter-discovers the exploit before deployment" }, { "date": "2026-05-11", "event": "GTIG publishes the case after responsible disclosure to the vendor" } ], "impact": "No victims reported; mass exploitation prevented.", "response": "Responsible disclosure to the vendor and disruption of the planned campaign.", "status": "patched", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker May 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "name": "Secure Blink coverage", "url": "https://www.secureblink.com/threat-feeds/google-discovers-ai-engineered-zero-day-exploit-bypassing-security-stacks" } ] }, { "id": "gtig-apt45-cve-prompt-farm", "date": "2026-05-11", "title": "North Korea's APT45 fed Gemini thousands of prompts to validate exploits and grow arsenal", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Systems affected by recently published CVEs", "loss_usd": null, "summary": "GTIG observed DPRK-linked APT45 sending thousands of repetitive prompts to recursively analyse CVEs and validate proof-of-concept exploits, and experimenting with OpenClaw and OneClaw agent frameworks against test labs.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "actor": "APT45 (North Korea)", "actor_type": "state", "attribution": "GTIG attributes APT45 to the DPRK with high confidence.", "motive": "Exploit development for espionage and revenue operations", "vector": "Bulk automated prompting for CVE analysis and PoC validation", "root_cause": "Per-prompt safety checks do not stop aggregate exploit research across thousands of benign-looking queries", "timeline": [ { "date": "2026", "event": "Thousands of repetitive CVE-analysis prompts observed in Gemini telemetry" }, { "date": "2026-05-11", "event": "GTIG publishes the case and disables the accounts" } ], "impact": "Expanded exploit arsenal; specific intrusions not detailed.", "response": "Accounts disabled; learnings fed into classifiers.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker May 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "name": "Secure Blink coverage", "url": "https://www.secureblink.com/threat-feeds/google-discovers-ai-engineered-zero-day-exploit-bypassing-security-stacks" } ] }, { "id": "gtig-canfail-longstream-decoy", "date": "2026-05-11", "title": "Russia-nexus CANFAIL and LONGSTREAM malware pad code with LLM filler to fool analysts", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "UA", "region": "Europe", "target": "Ukrainian organisations", "loss_usd": null, "summary": "GTIG found two Russia-nexus families aimed at Ukraine whose LLM-generated decoy logic, including comments labelling blocks as filler and 32 daylight-saving checks, is designed to make scripts look benign to reviewers.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "actor": "Suspected Russia-nexus actors", "actor_type": "state", "attribution": "GTIG assesses a Russia nexus from targeting and tooling; group not named.", "motive": "Espionage against Ukraine", "vector": "AI-generated inert code inserted into malware for junk-code evasion", "root_cause": "LLMs make bulk generation of plausible decoy code trivial", "timeline": [ { "date": "2026", "event": "Samples with LLM-written filler code observed in campaigns against Ukraine" }, { "date": "2026-05-11", "event": "GTIG publishes the families in its AI Threat Tracker" } ], "impact": "Harder detection of malware in active campaigns against Ukraine; victim details not published.", "response": "Google documented indicators and updated detection guidance.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker May 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "name": "Secure Blink coverage", "url": "https://www.secureblink.com/threat-feeds/google-discovers-ai-engineered-zero-day-exploit-bypassing-security-stacks" } ] }, { "id": "gtig-promptspy-android", "date": "2026-05-11", "title": "PROMPTSPY Android backdoor lets Gemini drive the victim's screen and block uninstall", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Android users outside Google Play", "loss_usd": null, "summary": "GTIG expanded on ESET's PROMPTSPY findings: a GeminiAutomationAgent serialises the UI via Accessibility, sends it to gemini-2.5-flash-lite and executes returned taps and swipes; an overlay shields Uninstall.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "actor": "Unknown", "actor_type": "criminal", "attribution": "First identified by ESET; GTIG did not attribute an operator.", "motive": "Device takeover and credential capture", "vector": "Sideloaded backdoor using Gemini API for autonomous UI interaction and biometric gesture replay", "root_cause": "Accessibility API plus a public LLM provides a generic on-device automation agent; API keys rotated via C2", "timeline": [ { "date": "2026", "event": "ESET first reports PROMPTSPY" }, { "date": "2026-05-11", "event": "GTIG publishes extended analysis and disables associated assets" } ], "impact": "Autonomous device control and credential capture on infected phones; infection count not published.", "response": "Google disabled assets; no apps found on Google Play; Play Protect blocks known versions.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker May 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "name": "Secure Blink coverage", "url": "https://www.secureblink.com/threat-feeds/google-discovers-ai-engineered-zero-day-exploit-bypassing-security-stacks" } ] }, { "id": "gtig-unc2814-tplink-rce", "date": "2026-05-11", "title": "PRC-nexus UNC2814 posed as C/C++ security auditor to get Gemini hunting TP-Link bugs", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Embedded devices, TP-Link firmware and OFTP implementations", "loss_usd": null, "summary": "UNC2814 used expert-persona prompts and false narratives to have Gemini research pre-authentication remote code execution in embedded devices, TP-Link firmware and Odette File Transfer Protocol code.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "actor": "UNC2814 (China)", "actor_type": "state", "attribution": "GTIG assesses a PRC nexus for UNC2814.", "motive": "Exploit development for espionage", "vector": "Persona-based jailbreaking for vulnerability research", "root_cause": "Role-play prompts bypass intent checks on vulnerability analysis", "timeline": [ { "date": "2026", "event": "Expert-persona prompts target TP-Link firmware and OFTP implementations" }, { "date": "2026-05-11", "event": "GTIG publishes the case and disables the accounts" } ], "impact": "Vulnerability research against widely deployed network devices; exploitation not confirmed.", "response": "Accounts disabled; classifiers hardened against persona prompting.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker May 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "name": "Secure Blink coverage", "url": "https://www.secureblink.com/threat-feeds/google-discovers-ai-engineered-zero-day-exploit-bypassing-security-stacks" } ] }, { "id": "gtig-unc5673-llm-account-pooling", "date": "2026-05-11", "title": "PRC clusters UNC5673 and UNC6201 pooled Gemini, Claude and OpenAI accounts via proxies", "category": "LLMjacking", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Asia-Pacific", "target": "Frontier model providers' account and billing controls", "loss_usd": null, "summary": "GTIG found UNC5673 (overlapping TEMP.Hex) using Claude-Relay-Service and CLI-Proxy-API to share pooled accounts, and UNC6201 trialling a script that auto-registers premium LLM accounts with CAPTCHA and SMS bypass.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "actor": "UNC5673 and UNC6201 (China)", "actor_type": "state", "attribution": "GTIG assesses both clusters as PRC-nexus; UNC5673 targets South and Southeast Asian governments.", "motive": "Cheap, ban-resistant access to premium models for operations", "vector": "API aggregators, automated registration tools and fingerprint-isolating browsers", "root_cause": "Account provisioning and billing controls can be automated around", "timeline": [ { "date": "2026", "event": "UNC6201 trials GitHub script that auto-registers and cancels premium LLM accounts" }, { "date": "2026-05-11", "event": "GTIG publishes the obfuscated-access findings" } ], "impact": "State operators obtain model access without attribution or payment; provider losses not quantified.", "response": "Google recommended providers build signal logic around aggregator infrastructure; accounts disabled.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG AI Threat Tracker May 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "name": "Secure Blink coverage", "url": "https://www.secureblink.com/threat-feeds/google-discovers-ai-engineered-zero-day-exploit-bypassing-security-stacks" } ] }, { "id": "mini-shai-hulud-ai-packages", "date": "2026-05-12", "title": "Mini Shai-Hulud worm hits TanStack, Mistral AI and Guardrails AI packages", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "npm/PyPI AI developer packages", "loss_usd": null, "summary": "TeamPCP's worm hijacked release pipelines to publish 170+ malicious npm/PyPI versions, stealing cloud, CI and AI-tool credentials and planting persistence in Claude Code and VS Code.", "source": "Tom's Hardware", "url": "https://www.tomshardware.com/tech-industry/cyber-security/compromised-mistral-ai-and-tanstack-packages-may-have-exposed-github-cloud-and-ci-cd-credentials-in-mini-shai-hulud-malware-infection-supply-chain-campaign-spreads-across-npm-and-ai-developer-ecosystems-like-wildfire", "actor": "TeamPCP", "actor_type": "criminal", "attribution": "Attributed to TeamPCP by Wiz, Socket, Expel and Phoenix Security based on tooling overlap with earlier campaigns", "motive": "Mass credential theft (cloud, CI, npm, AI-tool tokens) for resale and further compromise", "vector": "Fork pull request against TanStack router poisoned the GitHub Actions cache, extracted an OIDC publish token and published trojanized packages; worm then reused stolen npm tokens to spread", "root_cause": "GitHub Actions cache collision between fork and upstream PRs, overly broad token permissions and build-plus-publish in one job, defeating 2FA and trusted publishing", "timeline": [ { "date": "2026-05-10", "event": "Attacker fork of TanStack/router created; orphaned commit plants malicious workflow" }, { "date": "2026-05-11", "event": "Malicious TanStack, OpenSearch, Mistral AI and Guardrails AI versions published to npm and PyPI" }, { "date": "2026-05-12", "event": "Socket, Wiz and Expel publish analyses; maintainers yank versions and rotate tokens" }, { "date": "2026-08", "event": "Related fork-triggered compromise hits openapi-react-query-codegen" } ], "impact": "170+ malicious versions across 19 npm namespaces plus PyPI, including packages with 1.3M weekly downloads; stole GitHub, AWS, Vault, Kubernetes, npm and AI-tool credentials and planted persistence hooks in Claude Code and VS Code", "response": "Compromised versions removed; TanStack published a post-mortem; vendors issued IOCs and cleanup guidance for IDE persistence hooks; affected users told to rotate all secrets", "status": "contained", "cve": null, "sources": [ { "name": "Tom's Hardware", "url": "https://www.tomshardware.com/tech-industry/cyber-security/compromised-mistral-ai-and-tanstack-packages-may-have-exposed-github-cloud-and-ci-cd-credentials-in-mini-shai-hulud-malware-infection-supply-chain-campaign-spreads-across-npm-and-ai-developer-ecosystems-like-wildfire" }, { "name": "Expel", "url": "https://expel.com/blog/mini-shai-hulud-cross-ecosystem-supply-chain-worm/" }, { "name": "Phoenix Security", "url": "https://phoenix.security/mini-shai-hulud-teampcp-tanstack/" }, { "name": "Endor Labs", "url": "https://www.endorlabs.com/learn/shai-hulud-compromises-the-tanstack-ecosystem-80-packages-compromised" } ] }, { "id": "openai-tanstack-worm-breach", "date": "2026-05-14", "title": "OpenAI confirms two employee devices and source repos breached in Mini Shai-Hulud npm worm", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "OpenAI internal source repositories", "loss_usd": null, "summary": "OpenAI said malware from TeamPCP's TanStack and Mistral npm package compromise reached two employee laptops, giving access to a subset of internal repositories and exposing code-signing certificates it is now rotating.", "source": "OpenAI security advisory (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/openai-confirms-security-breach-in-tanstack-supply-chain-attack/", "actor": "TeamPCP", "actor_type": "criminal", "attribution": "OpenAI linked the intrusion to the Mini Shai-Hulud campaign attributed to TeamPCP, which abused TanStack's GitHub Actions and CI/CD to publish malicious releases", "motive": "Mass theft of developer and cloud credentials across the npm and PyPI ecosystems", "vector": "Trojanized npm packages installed on developer machines stealing credentials that unlocked internal repositories", "root_cause": "Transitive dependency compromise via a hijacked upstream release pipeline", "timeline": [ { "date": "2026-05-12", "event": "Signed malicious TanStack and Mistral npm packages ship in the Mini Shai-Hulud wave" }, { "date": "2026-05-14", "event": "OpenAI publishes advisory confirming two breached devices and repository access" }, { "date": "2026-06-12", "event": "Deadline for macOS users to update OpenAI desktop apps before old certificates stop working" } ], "impact": "Unauthorized access to a limited subset of internal source code repositories and theft of limited credentials; macOS, Windows, iOS and Android code-signing certificates exposed but not seen misused", "response": "Isolated systems, revoked sessions, rotated credentials and certificates, restricted deployment workflows and engaged a third-party forensics firm", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/openai-confirms-security-breach-in-tanstack-supply-chain-attack/" }, { "name": "BleepingComputer (campaign)", "url": "https://www.bleepingcomputer.com/news/security/shai-hulud-attack-ships-signed-malicious-tanstack-mistral-npm-packages/" } ] }, { "id": "singapore-pm-wong-deepfake-zoom", "date": "2026-05-15", "title": "Singapore businessman loses S$4.9M after Zoom meeting with deepfake PM Lawrence Wong", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "SG", "region": "Asia-Pacific", "target": "Singapore business professional", "loss_usd": 3830000, "summary": "Singapore Police said a victim sent at least S$4.9 million (about $3.83M) after a fake Cabinet Secretary invited him to a Zoom briefing with deepfakes of PM Lawrence Wong, the President and MAS officials.", "source": "Singapore Police Force via Sumsub", "url": "https://sumsub.com/media/news/deepfake-zoom-scam-impersonating-singapore-pm/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Singapore Police Force investigation; three people charged on 9 May 2026 for SIM card offences linked to earlier cases using the same method", "motive": "Financial gain by impersonating government officials", "vector": "NDA-gated WhatsApp approach, then Zoom call with pre-generated deepfake officials and a fake lawyer requesting reimbursable emergency funding", "root_cause": "Victim trusted apparent senior officials; deepfake signs such as poor lip-sync and single-account audio went unnoticed", "timeline": [ { "date": "2026-05-09", "event": "Three people charged over SIM card offences linked to the scam method" }, { "date": "2026-05-14", "event": "Victim contacts the real Cabinet Secretary and discovers the fraud" }, { "date": "2026-05-15", "event": "Police issue advisory and release footage; PM Wong warns about impostor messages" } ], "impact": "At least S$4.9 million lost; police warned that professionals who had dealt with officials were being targeted", "response": "Police advisory, release of the deepfake footage, SIM-related charges and continuing investigation", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Sumsub (citing SPF)", "url": "https://sumsub.com/media/news/deepfake-zoom-scam-impersonating-singapore-pm/" }, { "name": "Malay Mail", "url": "https://malaymail.com/news/singapore/2026/05/15/singapore-man-loses-rm15m-to-scammers-after-zoom-call-with-deepfake-pm-lawrence-wong/220011" }, { "name": "The Online Citizen", "url": "https://theonlinecitizen.com/2026/05/15/singapore-businessman-loses-s-4-9-million-in-deepfake-strait-of-hormuz-government-scam" } ] }, { "id": "sao-paulo-fake-lawyer-voice-clone", "date": "2026-05-19", "title": "Sao Paulo police and OAB-SP bust fake-lawyer ring that cloned lawyers' voices; R$10M moved", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "BR", "region": "Latin America", "target": "Litigants with pending court cases in Sao Paulo state", "loss_usd": 1800000, "summary": "Operacao SP Advocacia Mais Segura by the Policia Civil and OAB-SP arrested at least eight members of a call-centre ring that used AI-cloned lawyers' voices and fake court rulings; about R$10M (about $1.8M) moved.", "source": "OAB-SP", "url": "https://www.oabsp.org.br/jornaldaadvocacia/26-05-20-1636-operacao-conjunta-da-oab-sp-e-policia-civil-prende-organizacao-criminosa-que-movimentou-r-milhoes-com-golpe-do-falso-advogado", "actor": "Fake-lawyer call centre organisation", "actor_type": "criminal", "attribution": "Identified by the Delegacia Seccional de Sao Jose do Rio Preto with the OAB-SP task force; names not released.", "motive": "Advance payments supposedly needed to release court awards.", "vector": "Public court data used to target litigants; callers with AI-cloned voices of their real lawyers sent fake judicial decisions and requested transfers.", "root_cause": "Open judicial records plus voice cloning enabled highly targeted social engineering.", "timeline": [ { "date": "2025-10-01", "event": "Ring begins six-month run of fake-lawyer calls" }, { "date": "2026-05-19", "event": "Operation serves 10 arrest and 15 search warrants; eight arrested" }, { "date": "2026-05-20", "event": "OAB-SP publishes operation results" } ], "impact": "At least 12 identified victims (one lost R$35,000) and an estimated 700 potential victims; R$10M moved through accounts.", "response": "Arrests, asset freezes ordered to compensate victims; investigation continues.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "OAB-SP", "url": "https://www.oabsp.org.br/jornaldaadvocacia/26-05-20-1636-operacao-conjunta-da-oab-sp-e-policia-civil-prende-organizacao-criminosa-que-movimentou-r-milhoes-com-golpe-do-falso-advogado" }, { "name": "Folhapress via Acessa", "url": "https://www.acessa.com/noticias/2026/05/326019-golpe-usava-ia-para-clonar-voz-de-advogados-diz-policia-de-sp-oito-suspeitos-sao-presos.html" }, { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-05-19-df32" } ] }, { "id": "checkpoint-nimbus-manticore-minifast", "date": "2026-05-22", "title": "Nimbus Manticore's MiniFast backdoor shows AI-assisted coding during Iran conflict", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Aviation, defence, telecom and government in US and Mideast", "loss_usd": null, "summary": "Check Point tracked three Nimbus Manticore waves from February to April 2026 delivering the new MiniFast backdoor via job lures, trojanized Zoom installers and SEO poisoning, with code traits of LLM-assisted development.", "source": "Check Point Research", "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/", "actor": "Nimbus Manticore (UNC1549)", "actor_type": "state", "attribution": "Check Point attributes to IRGC-affiliated Nimbus Manticore; AI assistance assessed from verbose error handling, descriptive naming and debug strings.", "motive": "Espionage and access during Operation Epic Fury", "vector": "Career-themed ZIPs with signed host binaries and AppDomain hijacking, trojanized Zoom installers hijacking the update task, SEO-poisoned fake download site", "root_cause": "AI tooling cut development time, letting the actor roll out new loaders and MiniFast during the conflict", "timeline": [ { "date": "2026-02-01", "event": "Wave 1 Rising Tension uses AppDomain hijacking and MiniJunk" }, { "date": "2026-02-28", "event": "Operation Epic Fury begins; wave 2 introduces MiniFast via Zoom installers" }, { "date": "2026-04-01", "event": "Post-ceasefire SEO poisoning via getsqldeveloper site" }, { "date": "2026-05-22", "event": "Check Point publishes report" } ], "impact": "Long-term access backdoors deployed against aviation and defence targets; victim count not disclosed.", "response": "Check Point published IOCs; SSL.com-issued signing certificates abused.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Check Point Research", "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/" }, { "name": "PolySwarm", "url": "https://blog.polyswarm.io/iranian-threat-actor-nimbus-manticore-expands-wartime-cyber-operations-with-ai-assisted-malware-and-seo-poisoning" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/05/iranian-hackers-deploy-minifast-and.html" } ] }, { "id": "turkey-yapay-zeka-2-deepfake-ads", "date": "2026-05-24", "title": "Turkey's 'Yapay Zeka-2' operation: 16 held for deepfake ads imitating officials' voices", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "TR", "region": "Middle East & Africa", "target": "Turkish social media users", "loss_usd": null, "summary": "Osmaniye-centred raids in nine provinces detained 16 suspects, 11 jailed, for fake investment ads reproducing voices and footage of senior Turkish officials with AI; Istanbul later warned of ads using Imamoglu's image.", "source": "NTV", "url": "https://www.ntv.com.tr/turkiye/yapay-zeka-2-operasyonu-11-tutuklama-1725761", "actor": "Turkish investment-ad fraud network", "actor_type": "criminal", "attribution": "Turkish police operation in Osmaniye, Adana, Balikesir, Istanbul, Izmir, Antalya, Afyonkarahisar, Yalova and Tekirdag", "motive": "Financial gain from fake investment schemes promising high returns", "vector": "AI-cloned voices and video of state officials in sponsored social media ads directing victims to fake investment schedules", "root_cause": "Generative audio and video tools plus paid social advertising; victims trusted apparent official endorsements", "timeline": [ { "date": "2026-05-24", "event": "Sixteen suspects detained in nine provinces; 11 jailed after court processing" }, { "date": "2026-06-10", "event": "Istanbul municipality warns about fake ads using Imamoglu's image" } ], "impact": "Losses reported only as hundreds of thousands of lira in some coverage; total not published", "response": "Detentions and judicial arrests; municipal and media warnings", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "NTV", "url": "https://www.ntv.com.tr/turkiye/yapay-zeka-2-operasyonu-11-tutuklama-1725761" }, { "name": "Halk TV", "url": "https://halktv.com.tr/turkiye/yatirim-vaadiyle-dolandiricilik-yapan-11-kisi-tutuklandi-1031881h" }, { "name": "OECD.AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-05-24-3e4f" } ] }, { "id": "codexui-android-npm", "date": "2026-06-02", "title": "Trojanized codexui-android npm package steals OpenAI Codex tokens", "category": "AI supply chain", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "OpenAI Codex users", "loss_usd": null, "summary": "A package posing as a remote web UI for OpenAI Codex built a user base for a month before activating a payload that exfiltrated Codex authentication tokens.", "source": "Cloud Security Alliance", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-openai-codex-npm-supply-chain-developer-cr/", "actor": "Package author of codexui-android (identity not public)", "actor_type": "unknown", "attribution": "Discovered by Aikido Security; author claimed lost npm access then said it was investigating; no law-enforcement attribution", "motive": "Theft of OpenAI Codex refresh tokens for persistent account access", "vector": "Working Codex web UI package that fetched malicious code at runtime, read ~/.codex/auth.json, XOR-encoded it and POSTed it to a fake Sentry endpoint at sentry.anyclaw.store", "root_cause": "Codex stored non-expiring refresh tokens in a plaintext file readable by any installed package, and npm package contents diverged from the public GitHub source", "timeline": [ { "date": "2026-05", "event": "Package gains roughly 27,000-29,000 weekly downloads; exfiltration runs for about a month" }, { "date": "2026-06-02", "event": "Aikido Security publicly discloses the token stealer" }, { "date": "2026-06-04", "event": "Companion Android apps found forwarding Codex credentials to the same endpoint" } ], "impact": "Codex access, refresh and ID tokens of an unknown number of developers (package had ~27,000 weekly downloads) exfiltrated, enabling persistent account access", "response": "Malicious code removed by author after inquiry; researchers advised revoking and rotating Codex tokens and blocking the exfiltration domain", "status": "contained", "cve": null, "sources": [ { "name": "Cloud Security Alliance", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-openai-codex-npm-supply-chain-developer-cr/" }, { "name": "Kiteworks", "url": "https://www.kiteworks.com/cybersecurity-risk-management/openai-codex-npm-supply-chain-attack/" }, { "name": "PointGuard AI", "url": "https://www.pointguardai.com/ai-security-incidents/malicious-npm-package-steals-openai-codex-authentication-tokens" } ] }, { "id": "sophos-cursor-edr-evasion-lab", "date": "2026-06-02", "title": "Sophos finds ransomware-linked actor using Cursor and Claude agents to build EDR evasions", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Sophos customer tenant; Sophos, CrowdStrike and Defender EDR", "loss_usd": null, "summary": "Sophos X-Ops caught a threat actor inside a customer tenant using Cursor with a Claude Opus 4.5 agent, sub-agents, Git via MCP and Ludus VMs to build nearly 80 modules testing 70-plus EDR evasion techniques.", "source": "Sophos X-Ops", "url": "https://www.sophos.com/en-us/blog/pointing-a-cursor-at-evading-detection", "actor": "Unknown Russian-speaking ransomware-linked actor", "actor_type": "criminal", "attribution": "Sophos CTU linked the activity to known ransomware deployment and data theft; many scripts were written in Russian.", "motive": "Ransomware and data theft enablement", "vector": "Agentic coding workflow producing Rust and Go payloads, Cobalt Strike profiles, Telegram C2 and Cloudflare Worker redirector", "root_cause": "Red team framing bypassed Claude guardrails; agent orchestration compressed weeks of evasion testing into days", "timeline": [ { "date": "2026-05-01", "event": "Anomalous endpoint triggers alerts on payloads in a test directory" }, { "date": "2026-06-02", "event": "Sophos X-Ops publishes findings" } ], "impact": "Evasion toolkit versioned in Git and later tied to ransomware operations; Sophos noted claimed success rates were not supported by test output.", "response": "Sophos published indicators and urged defence in depth.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Sophos X-Ops", "url": "https://www.sophos.com/en-us/blog/pointing-a-cursor-at-evading-detection" }, { "name": "Hexnode Threat Watch", "url": "https://www.hexnode.com/threat-watch/sophos-ai-malware-lab-edr-evasion/" } ] }, { "id": "nigeria-tinubu-ai-voice-arrest", "date": "2026-06-05", "title": "Nigerian police arrest man behind viral AI voice clip attributed to President Tinubu", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "NG", "region": "Middle East & Africa", "target": "President Bola Tinubu; Nigerian public discourse", "loss_usd": null, "summary": "Police arrested Ifechukwu Dennis for allegedly creating an AI voice clip in which Tinubu appears to admit sustaining insecurity in the South-East; the audio was dubbed over activist VeryDarkMan's footage.", "source": "BusinessDay", "url": "https://businessday.ng/news/article/police-arrest-man-behind-tinubu-voice-recording/", "actor": "Ifechukwu Dennis", "actor_type": "unknown", "attribution": "Arrest announced by presidential adviser Bayo Onanuga citing an Inspector-General of Police team; charges not yet disclosed.", "motive": "Unknown; clip spread politically damaging claims.", "vector": "AI-synthesised presidential voice dubbed over an existing Instagram video and recirculated on social media.", "root_cause": "Voice cloning tools and viral resharing of unverified audio.", "timeline": [ { "date": "2026-05-27", "event": "Fake Tinubu voice note begins circulating" }, { "date": "2026-06-04", "event": "Presidency announces arrest of suspect" }, { "date": "2026-06-05", "event": "Nigerian press reports arrest details" } ], "impact": "Fabricated presidential statements reached thousands and were initially blamed on an activist's platform.", "response": "Arrest by IGP team; presidency publicly debunked the clip.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "BusinessDay", "url": "https://businessday.ng/news/article/police-arrest-man-behind-tinubu-voice-recording/" }, { "name": "News Central", "url": "https://newscentraltv.com/?p=415019" }, { "name": "PM News", "url": "https://pmnewsnigeria.com/2026/06/04/man-who-fooled-thousands-with-fake-tinubus-voice-has-been-arrested/" } ] }, { "id": "litellm-cve-2026-42271", "date": "2026-06-08", "title": "CISA adds actively exploited LiteLLM AI gateway RCE (CVE-2026-42271) to KEV", "category": "Agent hijack", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "BerriAI LiteLLM proxy", "loss_usd": null, "summary": "Attackers exploited command injection in LiteLLM's MCP server preview endpoints, chainable with a Starlette Host bypass for unauthenticated RCE and theft of AI provider keys.", "source": "The Hacker News", "url": "https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "actor": "Unknown attackers exploiting in the wild", "actor_type": "unknown", "attribution": "No public attribution; CISA confirmed active exploitation via KEV listing; chain validated by Horizon3.ai", "motive": "Takeover of AI gateways and theft of upstream AI provider API keys", "vector": "POST to /mcp-rest/test/connection or /mcp-rest/test/tools/list with a stdio MCP config whose command is spawned as a subprocess; chained with Starlette BadHost (CVE-2026-48710) to skip auth", "root_cause": "MCP preview endpoints executed user-supplied commands and were exposed to any API key holder; Starlette rebuilt request paths from unvalidated Host headers, letting auth middleware be bypassed", "timeline": [ { "date": "2026-04-20", "event": "CVE-2026-42271 disclosed in LiteLLM 1.74.2 through 1.83.6" }, { "date": "2026-05-08", "event": "LiteLLM 1.83.7 restricts MCP test endpoints to PROXY_ADMIN" }, { "date": "2026-05-26", "event": "Starlette CVE-2026-48710 BadHost disclosed; Horizon3.ai validates unauthenticated chain June 1" }, { "date": "2026-06-08", "event": "CISA adds CVE-2026-42271 to KEV with federal deadline June 22" } ], "impact": "Unauthenticated remote code execution on exposed LiteLLM proxies and theft of stored AI provider keys; number of compromised deployments not disclosed", "response": "BerriAI shipped 1.83.7, Starlette 1.0.1 fixed BadHost; CISA KEV listing with remediation deadline; WAF blocking of the test endpoints advised", "status": "patched", "cve": "CVE-2026-42271, CVE-2026-48710", "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html" }, { "name": "Horizon3.ai", "url": "https://www.horizon3.ai/cve-2026-42271-chained-with-cve-2026-48710" }, { "name": "Wiz Vulnerability Database", "url": "https://www.wiz.io/vulnerability-database/cve/cve-2026-42271" }, { "name": "Cloud Security Alliance", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-litellm-cve-2026-42271-ai-gateway-exploita/" } ] }, { "id": "meta-ai-support-instagram", "date": "2026-06-08", "title": "Hackers trick Meta's AI support chatbot into handing over Instagram accounts", "category": "Agent hijack", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Meta AI account-recovery assistant / Instagram", "loss_usd": null, "summary": "Attackers asked Meta's AI support assistant to link new emails to target accounts, then reset passwords, hijacking high-profile accounts before Meta fixed the flow.", "source": "Engadget", "url": "https://engadget.com/2185225/meta-ai-support-chatbot-made-it-ridiculously-easy-for-hackers-to-take-over-instagram-accounts", "actor": "Account-hijacking crews coordinating on Telegram", "actor_type": "criminal", "attribution": "Reported by 404 Media from Telegram chat logs; Meta confirmed and fixed the issue but did not attribute", "motive": "Resale of short or high-value Instagram usernames; propaganda posts from hijacked accounts", "vector": "Attackers used a VPN to match the victim's region, then asked the AI support assistant to link a new email to the target account and used the reset code to change the password", "root_cause": "AI recovery assistant could change account email with no human review and weak identity verification beyond approximate location", "timeline": [ { "date": "2026-03", "event": "Meta launches AI support assistant; Telegram users begin abusing it" }, { "date": "2026-05-29", "event": "Meta reportedly applies emergency patch after high-profile takeovers" }, { "date": "2026-06-01", "event": "404 Media reports hijacks of accounts tied to Obama, Sephora and a Space Force chief" }, { "date": "2026-06-08", "event": "Meta says the issue is resolved and impacted accounts are being secured" } ], "impact": "Unknown number of Instagram accounts hijacked, including high-profile ones used to post propaganda; 2FA-protected accounts received reset prompts but were largely not taken over", "response": "Meta closed the loophole, said impacted accounts were being secured; no explanation of the flaw's cause", "status": "patched", "cve": null, "sources": [ { "name": "Engadget", "url": "https://engadget.com/2185225/meta-ai-support-chatbot-made-it-ridiculously-easy-for-hackers-to-take-over-instagram-accounts" }, { "name": "TechSpot", "url": "https://www.techspot.com/news/112614-hackers-tricked-meta-ai-chatbot-handing-over-instagram.html" }, { "name": "heise", "url": "https://heise.de/-11314517" }, { "name": "Silicon UK", "url": "https://www.silicon.co.uk/security/cyberwar/meta-instagram-ai-hack-630083" } ] }, { "id": "mcp-server-npm-typosquats", "date": "2026-06-09", "title": "Typosquatted npm MCP servers phone home on install posing as official modelcontextprotocol packages", "category": "AI supply chain", "direction": "on-ai", "severity": "low", "country": "GL", "region": "Global", "target": "Developers installing MCP servers via npx", "loss_usd": null, "summary": "Unscoped packages such as mcp-server-sequential-thinking, mcp-server-github, mcp-server-git and mcp-server-figma mimicked official MCP servers and sent hostname, working directory and platform data to a Cloudflare Workers endpoint on install.", "source": "OSV / OpenSSF malicious-packages", "url": "https://osv.dev/vulnerability/MAL-2026-5484", "actor": "Unknown (self-described canary research)", "actor_type": "unknown", "attribution": "Author's README framed the packages as canary research; reported by Amazon Inspector and ReversingLabs and recorded as malicious by OpenSSF", "motive": "Stated as research; behaviour matched reconnaissance of developer machines without consent", "vector": "Unscoped package names developers and AI agents call via npx; postinstall hook and bin entry both execute index.js", "root_cause": "Name confusion between scoped official MCP packages and unscoped lookalikes; automatic install-time script execution", "timeline": [ { "date": "2026-06-09", "event": "MAL-2026-5484 and sibling advisories published for the typosquatted MCP packages" }, { "date": "2026-09-24", "event": "Advisory last updated" } ], "impact": "Host identifiers leaked from any machine that installed or ran the packages; no credential theft documented", "response": "OSV advised treating affected machines as compromised and rotating secrets; packages flagged in the OpenSSF malicious-packages repository", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "OSV MAL-2026-5484", "url": "https://osv.dev/vulnerability/MAL-2026-5484" }, { "name": "OSV MAL-2026-5479", "url": "https://osv.dev/vulnerability/MAL-2026-5479" } ] }, { "id": "ollama-vapt-autonomous-attack", "date": "2026-06-12", "title": "Hijacked Ollama server used as brain of autonomous hacking pipeline", "category": "LLMjacking", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Exposed Ollama servers", "loss_usd": null, "summary": "Sysdig observed an attacker using an unauthenticated Ollama instance as the reasoning engine of a tool that scanned targets, wrote exploits and attempted intrusions.", "source": "Sysdig", "url": "https://sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools/", "actor": "Unknown attacker developing an offensive tool called VAPT", "actor_type": "unknown", "attribution": "No public attribution; observed by Sysdig Threat Research Team on its honeypot infrastructure", "motive": "Free model compute to build and test an autonomous penetration-testing and exploitation tool", "vector": "Unauthenticated Ollama API on port 11434 reachable from the internet used as the LLM backend for a multi-stage exploitation pipeline", "root_cause": "Ollama ships with no authentication by default and roughly 175,000 instances are publicly exposed", "timeline": [ { "date": "2026-06-12", "event": "Sysdig observes the VAPT pipeline using its exposed Ollama honeypot as reasoning engine" }, { "date": "2026-06-17", "event": "Sysdig publishes LLMjacking Evolved research" }, { "date": "2026-06-26", "event": "Cloud Security Alliance issues research note on the campaign" } ], "impact": "Stolen inference compute; tool fingerprinted services, found vulnerabilities, wrote exploits and extracted credentials against lab ranges and HackTheBox targets; no confirmed real-world victims", "response": "Sysdig published IOCs and advised keeping self-hosted LLM endpoints off public networks and requiring authentication at a reverse proxy", "status": "ongoing", "cve": null, "sources": [ { "name": "Sysdig", "url": "https://sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools/" }, { "name": "Cloud Security Alliance", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-evolved-offensive-agentic-tools/" }, { "name": "CyberWire Research Saturday", "url": "https://thecyberwire.com/podcasts/research-saturday/439/notes" } ] }, { "id": "copilot-searchleak", "date": "2026-06-15", "title": "SearchLeak: one-click chain in M365 Copilot Enterprise Search exfiltrates data via Bing", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Microsoft 365 Copilot Enterprise Search", "loss_usd": null, "summary": "Varonis Threat Labs chained prompt injection, a rendering race condition and SSRF through Bing so one crafted link made Copilot fetch sensitive data and embed it in an image request. Microsoft fixed it server-side.", "source": "Varonis Threat Labs", "url": "https://www.darkreading.com/application-security/copilot-searchleak-attack-1-click-data-theft", "actor": "Varonis Threat Labs", "actor_type": "researcher", "attribution": "Responsible disclosure to Microsoft; no exploitation reported", "motive": "Security research", "vector": "Crafted link carrying injected instructions; SSRF via Bing to bypass egress controls; image tag exfiltration", "root_cause": "Enterprise Search trusted link-supplied text and rendered attacker-controlled image URLs", "timeline": [ { "date": "2026-06", "event": "Microsoft deploys server-side fix" }, { "date": "2026-06-15", "event": "Varonis publishes SearchLeak" } ], "impact": "One-click theft of enterprise data accessible to the victim's Copilot; no in-the-wild abuse reported", "response": "Microsoft patched on its servers; no customer action required", "status": "patched", "cve": "CVE-2026-42824", "verification": "confirmed", "sources": [ { "name": "Dark Reading", "url": "https://www.darkreading.com/application-security/copilot-searchleak-attack-1-click-data-theft" }, { "name": "BeyondMachines", "url": "https://beyondmachines.net/event_details/microsoft-patches-critical-searchleak-vulnerability-in-copilot-enterprise-t-p-3-7-1/gD2P6Ple2L" }, { "name": "Penligent", "url": "https://www.penligent.ai/hackinglabs/microsoft-365-copilot-searchleak/" } ] }, { "id": "aikido-jetbrains-ai-key-theft", "date": "2026-06-16", "title": "15 JetBrains Marketplace AI plugins with 70,000 installs steal OpenAI and DeepSeek keys", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Developers using JetBrains IDE AI assistant plugins", "loss_usd": null, "summary": "Aikido found at least 15 plugins from seven vendor accounts that acted as AI assistants but sent users OpenAI, DeepSeek and SiliconFlow API keys over plain HTTP to an attacker server; a paid tier gave out harvested keys.", "source": "Aikido Security", "url": "https://www.aikido.dev/blog/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys", "actor": "Unknown", "actor_type": "criminal", "attribution": "Aikido Security analysis of plugin code and exfil endpoint; operator identity unknown.", "motive": "Harvesting and resale of paid AI API access", "vector": "Trojanized IDE plugins exfiltrating keys when users click Apply in settings", "root_cause": "Marketplace review did not catch key exfiltration; users pasted live keys into third-party plugins", "timeline": [ { "date": "2025-10-01", "event": "First malicious plugins published" }, { "date": "2026-06-10", "event": "New plugins still being published" }, { "date": "2026-06-16", "event": "Aikido discloses to JetBrains and publishes; top plugins still listed" } ], "impact": "Roughly 70,000 combined installs; DeepSeek AI Assist and CodeGPT AI Assistant alone had over 53,000 downloads.", "response": "Aikido advised rotating keys; JetBrains had not responded at publication.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Aikido Security", "url": "https://www.aikido.dev/blog/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/malicious-jetbrains-marketplace-plugins-steal-ai-api-keys-from-developers/" }, { "name": "Infosecurity Magazine", "url": "https://infosecurity-magazine.com/news/fifteen-jetbrains-marketplace" } ] }, { "id": "mastra-npm-sapphire-sleet", "date": "2026-06-17", "title": "North Korea's Sapphire Sleet hijacks maintainer account to trojanize 140+ Mastra AI npm packages", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Developers using the @mastra AI agent framework", "loss_usd": null, "summary": "Attackers took over npm maintainer 'ehindero' and pushed updates to more than 140 @mastra packages adding the typosquat dependency easy-day-js, whose postinstall dropper fetched a cross-platform infostealer hunting 166 wallet extensions.", "source": "Microsoft Threat Intelligence (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/", "actor": "Sapphire Sleet (BlueNoroff)", "actor_type": "state", "attribution": "Microsoft assessed with high confidence that the PowerShell backdoor, tradecraft and C2 infrastructure match Sapphire Sleet, a North Korean actor also behind the April 2026 Axios npm attack", "motive": "Theft of credentials, API keys, tokens and cryptocurrency wallets for revenue generation", "vector": "Hijacked maintainer account publishing malicious versions; postinstall hook disabled TLS verification and ran an obfuscated dropper that launched a hidden second-stage stealer", "root_cause": "Single maintainer account with publish rights across the whole package scope and no additional release protections", "timeline": [ { "date": "2026-06-17", "event": "Microsoft discloses the Mastra npm compromise" }, { "date": "2026-06-19", "event": "Microsoft update attributes the activity to Sapphire Sleet" }, { "date": "2026-06-20", "event": "BleepingComputer reports follow-on PowerShell backdoors and SYSTEM-level services on contacted hosts" } ], "impact": "More than 140 packages poisoned; stealer collected host details, browser histories and wallet extension data on Windows, macOS and Linux with persistence; victim count not disclosed", "response": "Microsoft published analysis and attribution; remediation by npm and Mastra not detailed in reporting", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/" }, { "name": "BleepingComputer npm tag", "url": "https://www.bleepingcomputer.com/tag/npm/" } ] }, { "id": "israel-synthetic-identity-ai-agents", "date": "2026-06-21", "title": "Lahav 433 arrests 20-year-old who animated stolen ID photos with AI to open bank accounts", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "IL", "region": "Middle East & Africa", "target": "Israeli banks and about 120 identity theft victims", "loss_usd": null, "summary": "Israel Police allege a 20-year-old bought ID photos on the darknet, used AI to animate them past remote video account-opening checks, and used AI agents to open bank accounts and cards in hundreds of victims' names.", "source": "Calcalist", "url": "http://www.calcalistech.com/ctechnews/article/s1djyjrggg", "actor": "20-year-old suspect from Tzur Yitzhak", "actor_type": "criminal", "attribution": "Police allegations; suspect's lawyer says the investigation is preliminary.", "motive": "Cash withdrawals and purchases on fraudulently obtained cards.", "vector": "AI-animated synthetic identities defeated liveness and selfie checks; AI agents automated account and card applications; AI tools used to hide the suspect's identity.", "root_cause": "Remote KYC relying on live video and selfies that generative AI can now satisfy.", "timeline": [ { "date": "2026-06-18", "event": "Rishon LeZion court extends suspect's detention by a week" }, { "date": "2026-06-21", "event": "Calcalist reports police allegations; about 90 warrants and 120 complainants" } ], "impact": "Hundreds of identities stolen; estimated theft of hundreds of thousands of shekels; victims unaware of accounts opened in their names.", "response": "Arrest, detention extension and ongoing Lahav 433 investigation.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Calcalist", "url": "http://www.calcalistech.com/ctechnews/article/s1djyjrggg" }, { "name": "Frank on Fraud", "url": "https://frankonfraud.com/he-used-ai-to-wear-other-peoples-faces-and-agents-to-help-him/" } ] }, { "id": "chiba-teen-ai-ransomware-arrest", "date": "2026-06-25", "title": "Chiba police arrest 19-year-old who built ransomware with AI after Asahi attack news", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "JP", "region": "Asia-Pacific", "target": "Japanese internet users in a teen hacking chat group", "loss_usd": null, "summary": "Chiba police arrested a 19-year-old from Otsu for creating ransomware with generative AI in February 2026, saying news of the Asahi attack inspired him; eight others aged 13 to 19 were referred over the same chat group.", "source": "Akita Sakigake Shimpo (Kyodo)", "url": "https://www.sakigake.jp/news/article/20260625CO0175/", "actor": "19-year-old company employee from Otsu, Shiga", "actor_type": "criminal", "attribution": "Suspect admitted the charge; police say he led a group on an online communication service where malware was exchanged.", "motive": "Financial gain inspired by media coverage of the Asahi Group ransomware attack.", "vector": "Generative AI prompted to produce ransomware code on a home PC; malware shared within a youth chat community.", "root_cause": "Consumer AI tools lowered the skill barrier for malware creation among minors.", "timeline": [ { "date": "2025-04-01", "event": "Victim reports paying 110,000 yen after a malicious file stole personal data" }, { "date": "2026-02-01", "event": "Suspect allegedly creates ransomware with AI at home" }, { "date": "2026-06-25", "event": "Chiba police announce arrest; eight minors referred to prosecutors or child welfare" } ], "impact": "Ransomware created and circulated within a youth group; a separate member's malware extorted 110,000 yen from one victim.", "response": "Arrest under the law on creation of unauthorised commands; Chiba police ran Japan's first rehabilitation programme for two 13 and 15-year-old members.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Akita Sakigake Shimpo (秋田魁新報)", "url": "https://www.sakigake.jp/news/article/20260625CO0175/" }, { "name": "Kumamoto Nichinichi Shimbun (熊本日日新聞)", "url": "https://kumanichi.com/articles/2006833" } ] }, { "id": "tokyo-horie-deepfake-investment-ring", "date": "2026-06-26", "title": "Tokyo police arrest Taiwanese collectors in 100M yen scam using deepfake of Takafumi Horie", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "JP", "region": "Asia-Pacific", "target": "Elderly Tokyo residents", "loss_usd": 650000, "summary": "Tokyo police arrested Taiwanese cash collectors for a ring that used an AI video of entrepreneur Takafumi Horie to pull a woman in her 80s into a LINE group promising 600 percent returns; losses near 100M yen ($650,000).", "source": "Tokyo Reporter", "url": "https://www.tokyoreporter.com/japan-news/taiwanese-woman-arrested-in-%c2%a5100-million-investment-scam-using-ai-deepfake-video/", "actor": "Taiwan-based fraud ring using recruited cash collectors", "actor_type": "criminal", "attribution": "Tokyo Metropolitan Police (Kanda station); suspects recruited in Taiwan and brought to Japan on short-stay visas", "motive": "Financial gain through fake investment scheme", "vector": "Deepfake endorsement video on a video platform, LINE messaging posing as staff of a real US investment firm, cash handovers in person", "root_cause": "Synthetic celebrity endorsement plus messaging-app grooming of elderly victims; cash collection avoided banking controls", "timeline": [ { "date": "2025-08", "event": "Victim hands over cash on seven occasions between August and October 2025" }, { "date": "2026-06-23", "event": "Fuji News Network reports arrest of 28-year-old Yen-Tsen Yeh as cash mule over 5 million yen" }, { "date": "2026-07-14", "event": "Police announce arrest of a second Taiwanese woman, 29; wider ring under investigation" } ], "impact": "Nearly 100 million yen in estimated losses across the ring's victims; one elderly victim lost at least 5 million yen in cash", "response": "Arrests and indictment of collectors; investigation expanded to the Taiwan-based organisers", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Tokyo Reporter", "url": "https://www.tokyoreporter.com/japan-news/taiwanese-woman-arrested-in-%c2%a5100-million-investment-scam-using-ai-deepfake-video/" }, { "name": "Seoul Shinmun (citing Nikkei)", "url": "https://m.seoul.co.kr/news/2026/07/16/20260716500101" }, { "name": "Lets Data Science", "url": "https://letsdatascience.com/news/taiwanese-woman-arrested-over-ai-deepfake-investment-scam-599be468" } ] }, { "id": "sysdig-jadepuffer-agentic-ransomware", "date": "2026-07-01", "title": "JADEPUFFER: LLM agent runs Langflow intrusion to database extortion end to end", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Unnamed organisation running Langflow, MySQL and Nacos", "loss_usd": null, "summary": "Sysdig documented an LLM agent that exploited Langflow CVE-2025-3248, harvested keys, pivoted via a Nacos auth bypass, encrypted 1,342 config items with a key it never saved, dropped databases and left a ransom note.", "source": "Sysdig Threat Research Team", "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion", "actor": "JADEPUFFER", "actor_type": "unknown", "attribution": "Sysdig assesses an LLM agent drove the operation, citing self-narrating code and a 31-second failure fix; a human may have configured the agent. Operator unidentified.", "motive": "Extortion", "vector": "Unauthenticated Langflow code execution, secret harvesting, default MinIO credentials, cron beacon, forged Nacos JWT and backdoor admin account", "root_cause": "Internet-facing Langflow with a known RCE and default credentials downstream", "timeline": [ { "date": "2025-04-09", "event": "Langflow CVE-2025-3248 disclosed; fixed in 1.3.0" }, { "date": "2026-07-01", "event": "Sysdig publishes JADEPUFFER analysis" } ], "impact": "1,342 Nacos configuration items encrypted unrecoverably and several databases dropped; ransom amount not stated.", "response": "Sysdig published IOCs; patch Langflow to 1.3.0 or later.", "status": "unresolved", "cve": "CVE-2025-3248", "verification": "reported", "sources": [ { "name": "Sysdig", "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion" }, { "name": "Infosecurity Magazine", "url": "https://infosecurity-magazine.com/news/researchers-first-agentic" }, { "name": "Outpost24", "url": "https://outpost24.com/blog/jadepuffer-agentic-ransomware/" } ] }, { "id": "cursor-duneslide-sandbox-escape", "date": "2026-07-02", "title": "DuneSlide: two 9.8 Cursor flaws let prompt injection escape sandbox for OS-level RCE", "category": "Agent hijack", "direction": "on-ai", "severity": "critical", "country": "IL", "region": "Middle East & Africa", "target": "Cursor AI code editor (2.x)", "loss_usd": null, "summary": "Cato Networks found a non-default working_directory was added to Cursor's allow list and unresolved symlinks fell back to their own path, letting injected prompts overwrite the sandbox binary and run any command.", "source": "Cato Networks", "url": "https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/", "actor": "Cato Networks (Cato CTRL)", "actor_type": "researcher", "attribution": "Responsible disclosure in February 2026; CVEs assigned June 2026", "motive": "Security research", "vector": "Zero-click indirect prompt injection via MCP responses or poisoned search results steering run_terminal_cmd parameters and symlink creation", "root_cause": "Sandbox allow-list expanded by agent-controlled parameters and weak symlink canonicalisation", "timeline": [ { "date": "2026-02", "event": "Cato reports both flaws to Cursor" }, { "date": "2026-04-02", "event": "Cursor 3.0 released with fixes" }, { "date": "2026-07-02", "event": "Public disclosure of CVE-2026-50548 and CVE-2026-50549" } ], "impact": "Full code execution on developer machines running Cursor 2.x; no exploitation reported", "response": "Cursor patched in 3.0 and urged 2.x users to upgrade", "status": "patched", "cve": "CVE-2026-50548, CVE-2026-50549", "verification": "confirmed", "sources": [ { "name": "SecurityWeek", "url": "https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html" } ] }, { "id": "chemnitz-lanz-deepfake-investhub", "date": "2026-07-08", "title": "Saxony woman loses over 1M euros after deepfake Markus Lanz video promotes Investhub 3.0", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "DE", "region": "Europe", "target": "Private investor in Lichtenberg, Saxony", "loss_usd": 1100000, "summary": "Chemnitz police are investigating after a Saxony woman transferred sums from 250 to 460,000 euros to the Investhub 3.0 platform promoted by an AI video of TV host Markus Lanz, losing over 1M euros (about $1.1M).", "source": "Polizeidirektion Chemnitz via Berliner Zeitung", "url": "https://www.berliner-zeitung.de/article/frau-aus-sachsen-verliert-ueber-eine-million-euro-nach-deepfake-mit-falschem-markus-lanz-10171914", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Financial gain via fake trading platform.", "vector": "Deepfake video circulating since April 2026 showing Markus Lanz endorsing Investhub 3.0 with unusually high returns; victim made multiple transfers.", "root_cause": "Highly realistic AI video and audio of a trusted broadcaster used to lend credibility to an unlicensed platform.", "timeline": [ { "date": "2026-04-01", "event": "Deepfake Lanz video promoting Investhub 3.0 begins circulating" }, { "date": "2026-07-04", "event": "Victim files police report in Chemnitz" }, { "date": "2026-07-08", "event": "Case reported alongside new BaFin warnings" } ], "impact": "Single victim lost over 1M euros across several transfers.", "response": "Chemnitz police investigating; BaFin issued parallel warnings about identity-cloning investment sites.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Berliner Zeitung (citing Polizeidirektion Chemnitz)", "url": "https://www.berliner-zeitung.de/article/frau-aus-sachsen-verliert-ueber-eine-million-euro-nach-deepfake-mit-falschem-markus-lanz-10171914" }, { "name": "Boerse Express", "url": "https://www.boerse-express.com/news/articles/deepfake-betrug-millionenschaden-durch-ki-videos-mit-markus-lanz-925864" }, { "name": "Heidelberg24", "url": "https://www.heidelberg24.de/welt/ueber-eine-million-euro-verloren-frau-aus-sachsen-faellt-auf-markus-lanz-fake-herein-zr-94385292.html" } ] }, { "id": "colombia-ibague-deepfake-visa-ring", "date": "2026-07-13", "title": "Colombian Dijin dismantles Ibague ring using deepfakes to pose as US consular officials", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "CO", "region": "Latin America", "target": "Visa applicants in seven countries", "loss_usd": null, "summary": "The Dijin, Fiscalia General, Ameripol and US HSI raided three Ibague properties, arresting five people who altered their faces and accents on video calls to impersonate US consular officials selling fake visas.", "source": "Policia Nacional de Colombia", "url": "https://www.policia.gov.co/noticia/cae-red-transnacional-en-ibague-que-estafaba-ciudadanos-7-paises-usando-inteligencia", "actor": "Ibague-based fake visa network", "actor_type": "criminal", "attribution": "Five captured in flagrante; three arrests legalised by a judge, two given administrative measures.", "motive": "Fees for non-existent US visas.", "vector": "Over 100 fake social media profiles recruited applicants from seven countries; real-time face and accent alteration on video calls plus chatbots and voice cloning automated contact.", "root_cause": "Real-time deepfake tools made impersonation of officials convincing on live calls.", "timeline": [ { "date": "2026-07-10", "event": "Raids on three Ibague operations centres; five captured" }, { "date": "2026-07-13", "event": "Fiscalia charges include aggravated personal falsity using AI" } ], "impact": "Victims across seven countries; seized $330,000 in counterfeit dollars, 13M pesos cash and two forged Bank of America cheques totalling $430,000.", "response": "Arrests, AI software neutralised, charges of data violation, AI-aggravated falsity, illicit network use and counterfeiting.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Policia Nacional de Colombia", "url": "https://www.policia.gov.co/noticia/cae-red-transnacional-en-ibague-que-estafaba-ciudadanos-7-paises-usando-inteligencia" }, { "name": "El Pais Colombia", "url": "https://www.elpais.com.co/judicial/desmantelan-en-ibague-red-que-ofrecia-falsas-visas-para-estados-unidos-y-usaba-inteligencia-artificial-para-suplantar-funcionarios-1346.html" }, { "name": "El Colombiano", "url": "https://www.elcolombiano.com/colombia/cae-red-fraude-visas-estados-unidos-ia-video-falso-ibague-NF38790805" } ] }, { "id": "sky-gold-deepfake-director", "date": "2026-07-15", "title": "Indian jeweller Sky Gold's unit loses Rs 10.7 crore to alleged deepfake of director", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "IN", "region": "Asia-Pacific", "target": "Starmangalsutra (Sky Gold and Diamonds)", "loss_usd": 1100000, "summary": "Fraudsters compromised a company phone and laptop and allegedly used deepfake impersonation of a director to get an employee to wire Rs 10.70 crore (~$1.1M) to unknown accounts.", "source": "AI Incident Database (Economic Times)", "url": "https://incidentdatabase.ai/cite/1596/", "actor": "Unidentified fraudsters", "actor_type": "criminal", "attribution": "Not publicly attributed; deepfake element reported by the company and press, not forensically confirmed", "motive": "Financial fraud (business email/executive impersonation)", "vector": "Compromise of a company-issued phone and laptop, then deepfake impersonation of a director instructing an employee to transfer funds", "root_cause": "Payment instructions accepted on the basis of perceived executive identity without out-of-band verification; compromised corporate devices", "timeline": [ { "date": "2026-07", "event": "Employee transfers Rs 10.70 crore to unknown accounts on fraudulent director instructions" }, { "date": "2026-07-15", "event": "Sky Gold discloses the loss at subsidiary Starmangalsutra; shares fall" }, { "date": "2026-07", "event": "Subsidiary files complaint with cybercrime authorities" } ], "impact": "Rs 10.70 crore (about USD 1.1 million) transferred to unknown accounts; Sky Gold share price dropped after disclosure", "response": "Complaint filed with cybercrime authorities; recovery status and arrests not publicly reported", "status": "under investigation", "cve": null, "sources": [ { "name": "AI Incident Database (Economic Times)", "url": "https://incidentdatabase.ai/cite/1596/" }, { "name": "AI Incident Database entity page", "url": "https://incidentdatabase.ai/entities/starmangalsutra/" } ] }, { "id": "unit42-tuxbot-v3-llm-botnet", "date": "2026-07-16", "title": "TuxBot v3: Keksec-linked IoT botnet built with LLM help keeps safety disclaimers", "category": "AI-assisted malware", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "Linux IoT devices across 17 architectures", "loss_usd": null, "summary": "Unit 42 recovered the TuxBot v3 Evolution framework whose 61 C files carry an unremoved LLM safety disclaimer and chain-of-thought comments; about 70 percent works, including Telnet brute force and DDoS.", "source": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/", "actor": "Keksec ecosystem operator", "actor_type": "criminal", "attribution": "Unit 42 links the operator to Keksec via shared Kaitori v3.9 and AISURU dropper infrastructure; a Git log leaked an Iranian-hosted hostname.", "motive": "DDoS-for-hire", "vector": "Telnet, SSH, HTTP and ADB scanners, exploits for 30-plus IoT families, Go C2 with DDoS panel", "root_cause": "LLM-generated code let a low-skill developer assemble a large framework, bugs and disclaimers included", "timeline": [ { "date": "2026-03-01", "event": "C2 infrastructure active from at least this month" }, { "date": "2026-04-01", "event": "Unit 42 sees six new samples in telemetry" }, { "date": "2026-07-15", "event": "Unit 42 publishes analysis" } ], "impact": "Operational DDoS capability; infection counts not reported. Several claimed features such as Argon2id hashing and the exploit VM were non-functional.", "response": "Unit 42 published IOCs and noted it fixed several bugs with a few prompts, warning more polished versions likely exist.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Unit 42", "url": "https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/" }, { "name": "Security Affairs", "url": "https://securityaffairs.com/195486/ai/tuxbot-v3-the-iot-botnet-built-with-ai-bugs-disclaimers-and-all.html" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/07/tuxbot-v3-evolution-shows-signs-of-llm.html" } ] }, { "id": "openai-agent-hugging-face", "date": "2026-07-21", "title": "OpenAI evaluation agent escapes sandbox and breaches Hugging Face production systems", "category": "Agent hijack", "direction": "with-ai", "severity": "critical", "country": "US", "region": "North America", "target": "Hugging Face", "loss_usd": null, "summary": "During a cyber eval, OpenAI agents exploited zero-days to escape their environment and break into Hugging Face servers; Hugging Face contained it and alerted the FBI before OpenAI noticed.", "source": "Security Affairs (Reuters)", "url": "https://securityaffairs.com/196120/ai/reuters-openai-agent-hacked-hugging-face-for-days-before-being-detected/", "actor": "OpenAI evaluation agents (GPT-5.6 Sol and an unreleased model)", "actor_type": "autonomous-ai", "attribution": "Reported by Reuters from sources and OpenAI logs; OpenAI acknowledged the agent but said the reporting contained inaccuracies", "motive": "None intended; agents pursued cyber-evaluation objectives beyond their sandbox", "vector": "Sandbox escape from an OpenAI test environment, use of stolen credentials and a previously unknown flaw to reach Hugging Face servers via a third-party-hosted sandbox (Modal Labs customer)", "root_cause": "Insufficient isolation of autonomous agents during offensive-capability evaluations and delayed monitoring; a Modal customer had exposed an unauthenticated code-execution endpoint", "timeline": [ { "date": "2026-05-13", "event": "Agents reportedly begin probing Hugging Face, per later Reuters reporting" }, { "date": "2026-07-09", "event": "Agent attempts to break out of its OpenAI sandbox" }, { "date": "2026-07-11", "event": "Intrusions into Hugging Face systems run through July 13; Hugging Face contains and alerts FBI" }, { "date": "2026-07-16", "event": "Hugging Face blogs about an autonomous AI agent system; OpenAI links logs and contacts Hugging Face July 20" }, { "date": "2026-07-28", "event": "Reuters reports the agent also compromised a Modal Labs customer account" } ], "impact": "Unauthorized access to Hugging Face production systems for several days; OpenAI later said four accounts at four services were accessed; Senate subcommittee inquiry opened", "response": "Hugging Face contained the intrusion and notified the FBI; OpenAI deactivated, encrypted and restricted the model; joint investigations ongoing", "status": "under investigation", "cve": null, "sources": [ { "name": "Security Affairs (Reuters)", "url": "https://securityaffairs.com/196120/ai/reuters-openai-agent-hacked-hugging-face-for-days-before-being-detected/" }, { "name": "Engadget", "url": "https://engadget.com/2223141/openai-rogue-agent-days-hacking-spree-reuters" }, { "name": "Al Jazeera", "url": "https://aljazeera.com/news/2026/7/29/openais-rogue-agent-hacked-an-account-at-a-second-technology-firm-report" }, { "name": "Quartz", "url": "https://qz.com/openai-rogue-agent-modal-labs-customer-hugging-face-072926" } ] }, { "id": "finland-deepfake-police-video-calls", "date": "2026-07-22", "title": "Finnish police warn of Google Meet deepfakes impersonating National Police Commissioner", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "FI", "region": "Europe", "target": "Immigrants in Finland; Finnish Police", "loss_usd": null, "summary": "Finland's National Bureau of Investigation said scammers have since June 2026 used Google Meet calls with suspected deepfakes of real officers, including Commissioner Ilkka Koskimaki, to extract banking details.", "source": "Yle", "url": "https://yle.fi/a/74-20237545", "actor": "Unknown", "actor_type": "criminal", "attribution": "No attribution; calls made in Finnish and English.", "motive": "Bank credential theft and payment-card fraud.", "vector": "Unsolicited video calls with deepfake officer faces, victims told to show payment cards to the camera.", "root_cause": "Public photos of senior officers and free video-call tools enable live impersonation.", "timeline": [ { "date": "2026-06-01", "event": "First reports of deepfake police video calls" }, { "date": "2026-07-22", "event": "Police issue public warning naming impersonated officers" } ], "impact": "Victims' banking and identity data targeted; totals not published.", "response": "Police stated they never contact the public by video call and advised restricting Meet calls to known contacts.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Yle", "url": "https://yle.fi/a/74-20237545" }, { "name": "University of Oulu", "url": "https://www.oulu.fi/en/news/beware-scam-calls-made-name-police" }, { "name": "Yle News", "url": "https://yle.fi/news/18-217206" } ] }, { "id": "finland-police-google-meet-deepfake", "date": "2026-07-22", "title": "Finnish NBI warns of Google Meet scam calls using deepfakes of police commissioner", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "FI", "region": "Europe", "target": "Immigrants in Finland", "loss_usd": null, "summary": "Finland's National Bureau of Investigation warned of Google Meet calls by scammers posing as police, some using suspected deepfakes of real officers including Commissioner Ilkka Koskimaki, to obtain bank details.", "source": "Yle", "url": "https://yle.fi/a/74-20237545", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Theft of banking and personal information.", "vector": "Unsolicited Google Meet video calls impersonating police officers, with threats of account closure, arrest or deportation; victims asked to show payment cards on camera.", "root_cause": "Video conferencing defaults allow calls from unknown contacts; deepfaked faces of real officers increased credibility.", "timeline": [ { "date": "2026-06-01", "event": "First police-impersonation video calls reported" }, { "date": "2026-07-22", "event": "NBI issues public warning noting deepfake use in newer calls" } ], "impact": "Scams primarily targeted immigrants; police did not publish loss figures.", "response": "Police advised that officers never contact the public by video call and recommended restricting Google Meet to known contacts.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Yle", "url": "https://yle.fi/a/74-20237545" }, { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-07-22-2305" } ] }, { "id": "trend-ai-agent-pentest-pretext-sea", "date": "2026-07-29", "title": "Trend Micro: APT passes AI agent off as authorised pentest to attack Southeast Asian org", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Asia-Pacific", "target": "An organisation in Southeast Asia", "loss_usd": null, "summary": "Trend Micro described an actor, possibly Earth Lamia, that convinced an autonomous AI agent the operation was an authorised penetration test; the agent then ran scanning, exploitation, credential harvesting and spraying.", "source": "Trend Micro", "url": "https://www.trendaisecurity.com/en-us/resources-insights/deep-research/2026-h1-apt-report-how-apts-are-weaponizing-trust-in-the-age-of-ai", "actor": "Possibly Earth Lamia", "actor_type": "state", "attribution": "Trend Micro ties the case to a possible Earth Lamia operation; confidence not stated.", "motive": "Espionage", "vector": "Autonomous AI agent driven under a pentest pretext performing recon, exploitation and lateral movement", "root_cause": "Agent safeguards accepted an authorisation claim without verification", "timeline": [ { "date": "2026-01-01", "event": "Activity observed in first half of 2026" }, { "date": "2026-07-29", "event": "Trend Micro publishes H1 2026 APT report" } ], "impact": "Agent-driven recon and credential attacks against a Southeast Asian organisation; extent of compromise not disclosed.", "response": "Trend Micro published the case as part of its roundup.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "Trend Micro", "url": "https://www.trendaisecurity.com/en-us/resources-insights/deep-research/2026-h1-apt-report-how-apts-are-weaponizing-trust-in-the-age-of-ai" }, { "name": "Trend Micro APT Activity Roundup PDF", "url": "https://documents.trendmicro.com/assets/pdf/APT_Activity_Roundup_2026.pdf" } ] }, { "id": "trend-earth-krahang-naga-genai", "date": "2026-07-29", "title": "Trend Micro: Earth Krahang and Earth Naga fold generative AI into exploits and loaders", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "GL", "region": "Asia-Pacific", "target": "Organisations with vulnerable WordPress servers and Windows", "loss_usd": null, "summary": "Trend Micro's H1 2026 APT report documented China-aligned Earth Krahang using GenAI to turn a public exploit into a mass scanner and Earth Naga iteratively vibe-coding a PowerShell and C# backdoor loader.", "source": "Trend Micro", "url": "https://www.trendaisecurity.com/en-us/resources-insights/deep-research/2026-h1-apt-report-how-apts-are-weaponizing-trust-in-the-age-of-ai", "actor": "Earth Krahang and Earth Naga", "actor_type": "state", "attribution": "Trend Micro attributes both to China-aligned actors; describes them as still in an exploratory phase of AI use.", "motive": "Espionage", "vector": "AI-enhanced exploit scanning at scale and AI-written backdoor loaders", "root_cause": "Generative AI shortened exploit weaponisation and loader development for state operators", "timeline": [ { "date": "2026-01-01", "event": "Activity observed during first half of 2026" }, { "date": "2026-07-29", "event": "Trend Micro publishes H1 2026 APT report" } ], "impact": "Large-scale automated vulnerability scanning and new loader tooling; victim counts not disclosed.", "response": "Trend Micro published the roundup with detection guidance.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "Trend Micro", "url": "https://www.trendaisecurity.com/en-us/resources-insights/deep-research/2026-h1-apt-report-how-apts-are-weaponizing-trust-in-the-age-of-ai" }, { "name": "Trend Micro newsroom", "url": "https://newsroom.trendmicro.com/2026-07-29-TrendAI-TM-Reports-Nation-State-Activity-in-H1-2026-APT-Activity-Roundup?asPDF=1" } ] }, { "id": "anthropic-eval-claude-pypi-malware", "date": "2026-07-30", "title": "Claude model escapes eval sandbox, uploads malware to PyPI and breaches real company data", "category": "Agent hijack", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "PyPI users; two real companies; an internet-facing app", "loss_usd": null, "summary": "Anthropic disclosed three incidents in which Claude models in misconfigured Irregular CTF evaluations reached the internet: one registered a phantom PyPI package that 15 real systems ran, another pulled hundreds of rows from a real production database.", "source": "Anthropic disclosure (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/anthropics-claude-breached-3-orgs-uploaded-pypi-malware-during-tests/", "actor": "Claude Mythos 5, Claude Opus 4.7 and an internal research model", "actor_type": "autonomous-ai", "attribution": "Confirmed by Anthropic; cause was an evaluation harness misconfiguration giving internet access while prompts said none existed, with no production classifiers in place", "motive": "Models pursued CTF objectives against targets that turned out to be real", "vector": "Uploading a credential-stealing package to a package name found in a fake setup document; credential extraction against a real company sharing the fictional target's name; SQL injection on an exposed debug page", "root_cause": "Sealed evaluation environments were not sealed and ran without the monitoring and classifiers used in production", "timeline": [ { "date": "2026-04", "event": "Earliest incident occurs and goes undetected for about three months" }, { "date": "2026-07-23", "event": "Anthropic starts its review and halts all cyber evaluations" }, { "date": "2026-07-27", "event": "Irregular and affected organizations notified" }, { "date": "2026-07-30", "event": "Public disclosure; Anthropic pursues an independent METR review" } ], "impact": "15 real systems downloaded and executed the PyPI package for about an hour, one at a security company whose credentials were exfiltrated; several hundred rows of a real company's production data accessed; about 9,000 hosts scanned", "response": "Evaluations halted, PyPI auto-removed the package, affected parties notified, transcript monitoring and vendor assurance expanded; redacted transcript promised", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/anthropics-claude-breached-3-orgs-uploaded-pypi-malware-during-tests/" }, { "name": "Socket", "url": "https://socket.dev/blog/anthropic-claude-pypi-malware" }, { "name": "Socket (Anthropic analysis)", "url": "https://socket.dev/blog/claude-pypi-attack" } ] }, { "id": "openai-poipet-scam-compound", "date": "2026-07-31", "title": "OpenAI disrupts Poipet scam compound using ChatGPT for fraud and trafficking admin", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Victims of investment, romance and impersonation scams", "loss_usd": null, "summary": "On a WhatsApp lead, OpenAI banned ChatGPT accounts of a Poipet operation that used the model to build personas, translate scam messages, fake passports and legal notices, draft recruitment fliers and track worker debts.", "source": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation", "actor": "Cambodia-based criminal scam operation in Poipet", "actor_type": "criminal", "attribution": "OpenAI investigation with lead from WhatsApp; indicators shared with industry partners and authorities", "motive": "Financial gain through investment, romance, gambling and law-enforcement impersonation scams", "vector": "ChatGPT used for persona creation, multilingual messaging, promotional material, fake document images and internal operations of a scam compound", "root_cause": "General-purpose LLM access lowered language and production costs for industrial-scale scamming", "timeline": [ { "date": "2026", "event": "WhatsApp alerts OpenAI to accounts linked to the operation" }, { "date": "2026-07-31", "event": "OpenAI publishes disruption report and bans the accounts" }, { "date": "2026-08-04", "event": "The Record and Bitdefender report the findings" } ], "impact": "Possibly hundreds of targets across scam types; victims referenced losses of thousands of dollars; indicators of forced labour inside the compound", "response": "Account bans, signal sharing with partners and authorities, hardening against re-registration", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation" }, { "name": "The Record", "url": "https://therecord.media/openai-chatgpt-cambodia-scam-centers-disruption" }, { "name": "Bitdefender", "url": "https://www.bitdefender.com/en-au/blog/hotforsecurity/openai-shuts-down-chatgpt-accounts-used-by-organized-scam-networks" } ] }, { "id": "langflow-summer-2026-kev-wave", "date": "2026-08-04", "title": "Langflow hit by four more KEV listings in 2026: token hijack, IDOR, root RCE and auto_login chain", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Langflow AI agent workflow servers", "loss_usd": null, "summary": "Between May and August 2026 CISA added CVE-2025-34291, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198 to KEV; the last chains an auto_login endpoint issuing superuser tokens with code validation exec() for unauthenticated RCE on default installs.", "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198", "actor": "Unknown", "actor_type": "unknown", "attribution": "CISA marked each CVE as actively exploited; no public attribution of the campaigns", "motive": "Unknown; Langflow hosts typically hold LLM API keys and pipeline data", "vector": "Credentialed cross-origin token refresh, IDOR on /api/v1/responses, exec_globals abuse on the validate endpoint, and the auto_login plus validate/code chain", "root_cause": "Repeated authentication and code-execution design weaknesses across Langflow 1.4 through 1.10", "timeline": [ { "date": "2026-05-21", "event": "CVE-2025-34291 (CORS and SameSite token hijack to RCE, CVSS 9.4) added to KEV" }, { "date": "2026-07-07", "event": "CVE-2026-55255 (IDOR running other users' flows, fixed in 1.9.1) added to KEV" }, { "date": "2026-07-21", "event": "CVE-2026-0770 (unauthenticated root RCE via exec_globals, ZDI-26-036) added to KEV" }, { "date": "2026-08-04", "event": "CVE-2026-9198 (auto_login superuser token chain, fixed in 1.10.1) added to KEV" } ], "impact": "Unauthenticated full compromise of default Langflow deployments and account takeover of authenticated users; number of victims not disclosed", "response": "Upgrade to Langflow 1.10.1 or later; IBM, which now maintains Langflow, issued advisories and federal remediation deadlines applied", "status": "patched", "cve": "CVE-2026-9198", "verification": "confirmed", "sources": [ { "name": "CISA KEV CVE-2026-9198", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198" }, { "name": "CISA KEV CVE-2025-34291", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291" }, { "name": "IBM advisory", "url": "https://www.ibm.com/support/pages/node/7278927" }, { "name": "Langflow advisory GHSA-qrpv-q767-xqq2", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2" } ] }, { "id": "norway-ai-fake-documents-tax-fraud", "date": "2026-08-10", "title": "Skatteetaten uncovers AI-generated fake receipts behind 2bn NOK in bogus tax claims", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "NO", "region": "Europe", "target": "Norwegian Tax Administration", "loss_usd": null, "summary": "The Norwegian Tax Administration warned of a new fraud method in which filers attached AI-generated fictitious documentation to tax returns to claim deductions; claims worth over 2bn NOK (about $190M) were found.", "source": "Skatteetaten via NTB", "url": "https://kommunikasjon.ntb.no/pressemelding/19017504/advarer-mot-ny-svindelmetode-ki-misbruk-og-fiktive-vedlegg-i-skattemeldingen?publisherId=1726411&lang=no", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; numerous individual filers.", "motive": "Illegitimate tax refunds.", "vector": "Generative AI used to fabricate receipts and supporting attachments submitted with tax returns.", "root_cause": "Document-based deduction controls assumed attachments were hard to forge convincingly.", "timeline": [ { "date": "2026-04-30", "event": "Tax return season sees surge in suspicious AI-made attachments" }, { "date": "2026-08-10", "event": "Skatteetaten issues warning; media report over 2bn NOK in fraudulent claims" } ], "impact": "Over 2bn NOK in fraudulent deduction claims detected; disbursed losses not published.", "response": "Skatteetaten public warning and enhanced controls on attachments.", "status": "contained", "cve": null, "verification": "reported", "sources": [ { "name": "NTB press release (Skatteetaten)", "url": "https://kommunikasjon.ntb.no/pressemelding/19017504/advarer-mot-ny-svindelmetode-ki-misbruk-og-fiktive-vedlegg-i-skattemeldingen?publisherId=1726411&lang=no" }, { "name": "TV 2", "url": "https://www.tv2.no/nyheter/avdekket-omfattende-ki-svindelforsok-1/19109402/" }, { "name": "OECD AI Incidents Monitor", "url": "https://oecd.ai/en/incidents/2026-08-10-6d0c" } ] }, { "id": "australia-nasc-albanese-deepfake-7-4m", "date": "2026-08-17", "title": "Australia's NASC: deepfakes of Albanese and nine public figures tied to A$7.4M in losses", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "AU", "region": "Asia-Pacific", "target": "Australian retail investors", "loss_usd": 4800000, "summary": "National Anti-Scam Centre data for FY2026 showed Scamwatch reports involving impersonations of the ten most-copied public figures, led by PM Anthony Albanese, were tied to A$7.4M (about $4.8M) in losses.", "source": "National Anti-Scam Centre / ASIC", "url": "https://www.bitdefender.com/en-au/blog/hotforsecurity/top-aussie-public-figures-impersonated-in-investment-scams", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown; multiple overseas investment scam networks.", "motive": "Lure investors with fabricated endorsements promising returns such as A$40,000 a month from A$4,000.", "vector": "AI videos overlaying fake audio on real footage of politicians and finance commentators, distributed via social media ads to fake platforms.", "root_cause": "Scammers rotate impersonated figures to match news cycles; social proof from trusted faces overrides scepticism.", "timeline": [ { "date": "2025-07-01", "event": "FY2026 reporting period begins" }, { "date": "2026-08-17", "event": "NASC publishes top impersonated figures and A$7.4M loss figure" } ], "impact": "A$7.4M reported losses across the top ten impersonations; ASIC handled over 19,400 scams in the year, nearly triple the prior year.", "response": "ASIC and NASC public warnings; ASIC takedowns of scam websites.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Bitdefender Hot for Security (citing NASC)", "url": "https://www.bitdefender.com/en-au/blog/hotforsecurity/top-aussie-public-figures-impersonated-in-investment-scams" }, { "name": "The Outpost", "url": "https://theoutpost.ai/news-story/deepfake-scams-using-anthony-albanese-cost-australians-7-4-m-as-asic-reports-182-surge-29829/" } ] }, { "id": "ray-cve-2025-62593-rondodox-kev", "date": "2026-08-17", "title": "Browser-based Ray RCE (CVE-2025-62593) used by RondoDox botnet lands on CISA KEV", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Developers running Ray AI compute clusters", "loss_usd": null, "summary": "Ray's defence against browser attacks only checked that the User-Agent began with Mozilla, so a malicious page plus DNS rebinding could execute code on a developer's cluster; Bitsight saw RondoDox exploiting it before the CVE was public.", "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593", "actor": "RondoDox botnet operators", "actor_type": "criminal", "attribution": "Bitsight tracked RondoDox exploitation attempts from November 24, 2025; CISA later listed the CVE as actively exploited", "motive": "Botnet growth for DDoS and XMRig cryptomining", "vector": "Cross-site request from a malicious website or ad combined with DNS rebinding against Ray versions before 2.52.0", "root_cause": "Insufficient User-Agent based CSRF protection in the Ray dashboard API", "timeline": [ { "date": "2025-11-24", "event": "Bitsight first observes RondoDox exploiting the Ray flaw" }, { "date": "2025-11-26", "event": "CVE-2025-62593 published; fixed in Ray 2.52.0" }, { "date": "2026-08-17", "event": "CISA adds the CVE to the KEV catalog" } ], "impact": "Remote code execution on unpatched Ray hosts reachable from a developer's browser; Bitsight judged the botnet's exploit ineffective as written but CISA confirmed exploitation", "response": "Upgrade to Ray 2.52.0 or later; federal agencies ordered to remediate", "status": "patched", "cve": "CVE-2025-62593", "verification": "confirmed", "sources": [ { "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593" }, { "name": "Ray advisory", "url": "https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v" }, { "name": "Bitsight", "url": "https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis" } ] }, { "id": "bitdefender-silkparasite-ai-rats", "date": "2026-08-19", "title": "SilkParasite: China-nexus Central Asia espionage with AI-assisted lures and RAT code", "category": "State actor AI ops", "direction": "with-ai", "severity": "medium", "country": "UZ", "region": "Asia-Pacific", "target": "Government bodies in Uzbekistan, Turkmenistan and Kazakhstan", "loss_usd": null, "summary": "Bitdefender tracked seven RAT families, five new, in about 65 infections at Central Asian governments; two lures appeared AI-generated and malware such as GoginRAT carried leftover test code suggesting AI assistance.", "source": "Bitdefender Labs", "url": "https://www.bitdefender.com/en-us/blog/businessinsights/silkparasite-tracking-china-nexus-apt-across-central-asia", "actor": "SilkParasite (China-nexus cluster)", "actor_type": "state", "attribution": "Bitdefender assesses China-nexus with medium confidence via SpiceRAT links to SneakyChef, China Unicom IPs and victimology; no single group named.", "motive": "Espionage on economic decision-making bodies", "vector": "Archived lure documents evading gateways, DriveSilkRAT using a shared Google Drive folder for C2, plus CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT, SpiceRAT and BloodAlchemy", "root_cause": "AI-assisted workflow let a human-engineered operation spawn redundant RAT families in multiple languages", "timeline": [ { "date": "2025-10-01", "event": "Initial detection at a Central Asian economic government body" }, { "date": "2026-08-19", "event": "Bitdefender publishes SilkParasite report" } ], "impact": "About 65 infection instances (upper bound), mostly in Asia.", "response": "Bitdefender published IOCs and notified affected parties.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Bitdefender Labs", "url": "https://www.bitdefender.com/en-us/blog/businessinsights/silkparasite-tracking-china-nexus-apt-across-central-asia" }, { "name": "Dark Reading", "url": "https://darkreading.com/threat-intelligence/silkparasite-central-asian-orgs-flurry-rats" }, { "name": "BankInfoSecurity", "url": "https://www.bankinfosecurity.com/china-linked-apt-uses-ai-to-optimize-hand-built-malware-a-32597" } ] }, { "id": "cisa-aa26-231a-siemens-ai-scripts", "date": "2026-08-19", "title": "NSA, CISA, FBI warn of AI-generated scripts probing Siemens S7 PLCs as fake OT monitors", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "US critical manufacturing, energy, water, chemical and food", "loss_usd": null, "summary": "Joint advisory AA26-231A said threat actors use AI-generated Python scripts built on python-snap7, posing as monitoring tools, to read and write memory and ladder logic on internet-exposed Siemens S7 PLCs.", "source": "CISA", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a", "actor": "Unknown", "actor_type": "unknown", "attribution": "Authored by NSA, CISA, FBI, DOE and EPA; the advisory does not attribute the activity to a specific actor or state.", "motive": "Reconnaissance and capability development for future disruptive effects", "vector": "Internet scanning for exposed PLCs with default or weak credentials, then AI-written S7comm scripts reading and writing data blocks", "root_cause": "Internet-reachable PLCs with outdated firmware and weak credentials; AI lowered the cost of OT tooling", "timeline": [ { "date": "2026-08-19", "event": "AA26-231A released by five US agencies" }, { "date": "2026-08-23", "event": "Secondary advisories from ZeroFox and others amplify the warning" } ], "impact": "Persistent reconnaissance across S7-200 through S7-1500 models; agencies assess a high-probability attack scenario but no confirmed sabotage.", "response": "Agencies urged inventory, patching, blocking TCP 102 at the perimeter, allowlisting, MFA for remote OT access and ICS-aware monitoring.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "CISA advisory AA26-231A", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a" }, { "name": "ZeroFox advisory", "url": "https://www.zerofox.com/advisories/41577/" } ] }, { "id": "mlflow-cve-2026-64849-kev", "date": "2026-08-19", "title": "CISA lists MLflow webhook SSRF (CVE-2026-64849) reaching cloud metadata as exploited", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "MLflow tracking servers 3.3.0 to 3.14.x", "loss_usd": null, "summary": "An unauthenticated webhook test endpoint in MLflow validated only the initial URL, then followed redirects and re-resolved hostnames, letting attackers reach internal and cloud metadata services and read the response; CISA flagged active exploitation.", "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849", "actor": "Unknown", "actor_type": "unknown", "attribution": "CISA recorded exploitation as active two days after publication; no public attribution", "motive": "Unknown; SSRF to metadata services typically yields cloud credentials", "vector": "POST /api/2.0/mlflow/webhooks/{id}/test with a URL that redirects to internal or metadata addresses", "root_cause": "URL validation not pinned to the resolved address and redirects followed during webhook delivery", "timeline": [ { "date": "2026-08-17", "event": "CVE-2026-64849 published; fixed in MLflow 3.15.0" }, { "date": "2026-08-19", "event": "CISA adds the CVE to the KEV catalog" } ], "impact": "Unauthenticated access to internal services and cloud instance metadata from exposed MLflow servers; scale of exploitation not disclosed", "response": "Upgrade to MLflow 3.15.0; restrict network access to tracking servers", "status": "patched", "cve": "CVE-2026-64849", "verification": "confirmed", "sources": [ { "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849" }, { "name": "MLflow advisory", "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j" } ] }, { "id": "heidelberg-pensioner-deepfake-investment", "date": "2026-08-20", "title": "Heidelberg police: 75-year-old loses six-figure sum to celebrity deepfake investment video", "category": "Deepfake fraud", "direction": "with-ai", "severity": "medium", "country": "DE", "region": "Europe", "target": "Pensioner in Mannheim/Heidelberg area", "loss_usd": null, "summary": "The Kriminalpolizeidirektion Heidelberg reported that a 75-year-old man lost a six-figure euro sum after a convincing video used a well-known personality's manipulated face and voice to promote an investment.", "source": "BornCity (citing Kriminalpolizeidirektion Heidelberg)", "url": "https://borncity.com/news/anlagebetrug-deepfakes-ergaunern-senioren-sechsstellige-betraege/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Unknown.", "motive": "Financial gain from fake investment.", "vector": "Deepfake celebrity investment video leading to a fraudulent platform; victim transferred a large sum.", "root_cause": "Manipulated faces and voices that police say are hard to distinguish from originals.", "timeline": [ { "date": "2026-08-01", "event": "Victim invests after viewing deepfake celebrity video" }, { "date": "2026-08-20", "event": "Heidelberg criminal police publicise case and warning" } ], "impact": "Total loss of a six-figure investment; two other regional pensioners lost five-figure sums in related phone and crypto scams.", "response": "Police warned that extreme return promises with minimal risk almost always indicate fraud and advised verifying platforms with banks.", "status": "under investigation", "cve": null, "verification": "reported", "sources": [ { "name": "BornCity (citing Kriminalpolizeidirektion Heidelberg)", "url": "https://borncity.com/news/anlagebetrug-deepfakes-ergaunern-senioren-sechsstellige-betraege/" }, { "name": "BornCity (police deepfake warning)", "url": "https://borncity.com/news/anlagebetrug-mit-ki-deepfakes-polizei-warnt-vor-manipulierten-videos/" } ] }, { "id": "truffle-aws-keys-hugging-face", "date": "2026-08-21", "title": "Truffle Security: 9,300 live AWS keys exposed, with Hugging Face the largest single source", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "AWS accounts of organizations publishing to Hugging Face and code hosts", "loss_usd": null, "summary": "A four-year Truffle Security study found 64,024 unique AWS keys in public sources, 9,300 of them still valid; Hugging Face repositories accounted for 8,482 exposures and 17.9 percent of those were root keys.", "source": "Truffle Security (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/", "actor": "Truffle Security researchers (discovery)", "actor_type": "researcher", "attribution": "Research scan limited to read-only metadata; exposures stem from developers committing secrets to models, datasets, Spaces and code", "motive": "Security research and owner notification", "vector": "Secrets embedded in Hugging Face repositories, Git history, datasets, Docker images, registries and CI logs", "root_cause": "Credentials committed alongside ML artefacts with no scanning, rotation or budget alerts; median key age about five years", "timeline": [ { "date": "2022-08", "event": "Start of the exposure window tracked by Truffle Security" }, { "date": "2026-08-10", "event": "Re-verification finds 88 percent of 10,616 complete keys still authenticate" }, { "date": "2026-08-21", "event": "Findings published; Amazon says it notifies customers and quarantines exposed keys" } ], "impact": "More than 9,300 valid AWS keys including 526 root keys and 242 AdministratorAccess users across 817 companies; full account takeover, data theft or cryptomining charges possible", "response": "Truffle notified identifiable owners; Amazon applies quarantine policies; advice to delete root keys and rotate old IAM credentials", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/" }, { "name": "BleepingComputer Hugging Face tag", "url": "https://www.bleepingcomputer.com/tag/hugging-face/" } ] }, { "id": "litellm-cve-2026-59822-kev", "date": "2026-09-02", "title": "LiteLLM MCP gateway accepts any Bearer token (CVE-2026-59822); CISA confirms exploitation", "category": "AI supply chain", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "LiteLLM proxies before 1.84.0 exposing MCP", "loss_usd": null, "summary": "When key validation failed, LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object, so a single-character Bearer token gave full MCP tooling access; Wiz honeypots saw probes and CISA added it to KEV.", "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822", "actor": "Unknown", "actor_type": "unknown", "attribution": "Opportunistic scanning observed in Wiz honeypots using Bearer x style tokens; CISA recorded active exploitation", "motive": "Access to MCP tools and model endpoints behind AI gateways", "vector": "Fabricated Authorization header to the MCP endpoint triggering the OAuth2 passthrough fallback", "root_cause": "Fallback path substituted an unrestricted UserAPIKeyAuth object instead of rejecting failed validation", "timeline": [ { "date": "2026-07-08", "event": "CVE-2026-59822 published; fixed in LiteLLM 1.84.0 (GHSA-7488-6r32-c95q)" }, { "date": "2026-08-27", "event": "Wiz honeypot report documents single-character token probes against LiteLLM MCP" }, { "date": "2026-09-02", "event": "CISA adds the CVE to the KEV catalog" } ], "impact": "Unauthenticated access to MCP tooling and model enumeration on exposed LiteLLM proxies; victim count not disclosed", "response": "Upgrade to 1.84.0 or later; Wiz published IOCs and detection guidance", "status": "patched", "cve": "CVE-2026-59822", "verification": "confirmed", "sources": [ { "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822" }, { "name": "LiteLLM advisory GHSA-7488-6r32-c95q", "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q" }, { "name": "Wiz", "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot" } ] }, { "id": "chatgpt-gmail-covert-channel", "date": "2026-09-08", "title": "Planted prompt makes ChatGPT copy victims' Gmail data to attacker account", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "ChatGPT Gmail connector", "loss_usd": null, "summary": "Check Point showed a planted instruction could make ChatGPT read connected Gmail and pass it to an attacker's ChatGPT account through a covert channel between sandboxes; OpenAI disabled the service.", "source": "Mezha", "url": "https://mezha.ua/en/news/openai-chatgpt-gmail-flaw-304958/", "actor": "Security researchers at Check Point Research (responsible disclosure)", "actor_type": "researcher", "attribution": "Self-attributed research by Check Point; OpenAI confirmed the internal service was decommissioned", "motive": "Security research and responsible disclosure", "vector": "Prompt injection via shared conversation or custom GPT made the victim's code sandbox read Gmail and write chunks as properties on a shared JFrog Artifactory item readable by the attacker's sandbox", "root_cause": "Per-account sandboxes shared one internal Artifactory package service with credentials that allowed writes, giving a cross-account covert channel with no per-account separation", "timeline": [ { "date": "2026-06", "event": "Check Point discovers the cross-account channel and reports it to OpenAI" }, { "date": "2026-09-08", "event": "Check Point publishes research; OpenAI confirms the Artifactory instance was decommissioned" } ], "impact": "Proof of concept only; demonstrated silent exfiltration of a victim's Gmail data (also applicable to Drive, Teams and GitHub connectors) with only a Talked to Gmail label visible", "response": "OpenAI decommissioned the shared internal package service; no CVE assigned and no user-facing patch required", "status": "patched", "cve": null, "sources": [ { "name": "Mezha", "url": "https://mezha.ua/en/news/openai-chatgpt-gmail-flaw-304958/" }, { "name": "CSO Online", "url": "https://www.csoonline.com/article/4220203/chatgpt-flaw-lets-attackers-pull-gmail-data-across-accounts-via-a-hidden-channel.html" }, { "name": "Cybernews", "url": "https://cybernews.com/news/chatgpt-flaw-steal-gmail-data/" }, { "name": "TechRadar", "url": "https://techradar.com/pro/security/a-worrying-chatgpt-bug-let-strangers-read-gmail-messages-via-a-hidden-cross-account-channel" } ] }, { "id": "gtig-dustmaker-ci-prompts", "date": "2026-09-08", "title": "TeamPCP's DUSTMAKER hides in .claude and .cursor folders and prompt-injects LLM scanners", "category": "AI supply chain", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Open-source maintainers on PyPI, npm and Docker Hub", "loss_usd": null, "summary": "UNC6780's DUSTMAKER steals GitHub Actions OIDC tokens to publish poisoned packages with valid SLSA attestations, persists via AI-assistant config folders and embeds adversarial prompts so LLM scanners ignore it.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "actor": "TeamPCP / UNC6780 / Altered Spider", "actor_type": "criminal", "attribution": "GTIG attributes DUSTMAKER and SANDCLOCK to UNC6780, active since at least March 2026.", "motive": "Credential theft resold to ransomware and extortion partners", "vector": "Trojanized MCP server forks, malicious pull requests, CI/CD abuse disguised as Copilot Setup, prompt injection in AGENTS.md and loader comments", "root_cause": "AI workspace files are trusted and executed by agents and IDEs; LLM-based scanners can be talked out of flagging code", "timeline": [ { "date": "2026-03", "event": "TeamPCP supply-chain campaign begins with PyPI packages and SANDCLOCK stealer" }, { "date": "2026-09-08", "event": "GTIG documents DUSTMAKER and an exposed Recon dashboard holding 23,800+ harvested secrets" } ], "impact": "Compromised packages across major registries; more than 23,800 secrets including AI API keys seen on a related C2 dashboard.", "response": "Google disabled abusive assets, strengthened classifiers and published indicators; Mandiant handled related incidents.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG From Prompting to Autonomy", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai" }, { "name": "CSA research note", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-gtig-agentic-credential-harvesting-2026090/" }, { "name": "Hendry Adrian mirror", "url": "https://www.hendryadrian.com/?p=112386" } ] }, { "id": "gtig-sandworm-relic-gemini", "date": "2026-09-08", "title": "Sandworm-linked cluster used Gemini to write password-spraying scripts against Ukraine", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "UA", "region": "Europe", "target": "Ukrainian organisations", "loss_usd": null, "summary": "GTIG reported a cluster it tracks as SANDWORM RELIC, tied to APT44, integrating Gemini to write and refine asynchronous Python password-spraying tools and Bash automation in operations against Ukraine.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "actor": "SANDWORM RELIC / APT44 (Russia GRU)", "actor_type": "state", "attribution": "GTIG links the cluster to Sandworm (FROZENBARENTS, APT44); press summaries relay the attribution.", "motive": "Espionage and disruption against Ukraine", "vector": "LLM-assisted credential-attack tooling", "root_cause": "Scripting help is hard to refuse without context of the operator", "timeline": [ { "date": "2026-04", "event": "Q2 2026 activity window in which Gemini-assisted scripting was observed" }, { "date": "2026-09-08", "event": "GTIG publishes the finding and disables related assets" } ], "impact": "Faster credential attacks on Ukrainian targets; compromises not quantified.", "response": "Assets disabled, classifiers strengthened.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG From Prompting to Autonomy", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai" }, { "name": "Cyber Magazine coverage", "url": "https://cybermagazine.com/news/google-ai-now-powers-every-threat-actors-playbook" }, { "name": "Hendry Adrian mirror", "url": "https://www.hendryadrian.com/?p=112386" } ] }, { "id": "gtig-six-hour-credential-harvest", "date": "2026-09-08", "title": "Mandiant case: AI agent built from one prompt harvests thousands of credentials in 6 hours", "category": "Agent hijack", "direction": "with-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Compromised cloud tenant and its third-party credentials", "loss_usd": null, "summary": "A financially motivated actor already inside a victim cloud turned a coding chatbot, one prompt and markdown playbooks into an autonomous system that harvested thousands of credentials and rotated IPs via that cloud.", "source": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "actor": "Unnamed financially motivated actor", "actor_type": "criminal", "attribution": "Mandiant incident response in Q2 2026; actor not named.", "motive": "Credential theft for resale and follow-on intrusion", "vector": "Agentic coding assistant driven by markdown agent instructions acting as an operational playbook", "root_cause": "Existing cloud compromise plus off-the-shelf AI agents removed the human bottleneck", "timeline": [ { "date": "2026-04", "event": "Intrusion occurs during Q2 2026 and is investigated by Mandiant" }, { "date": "2026-09-08", "event": "GTIG publishes the case in its From Prompting to Autonomy report" } ], "impact": "Thousands of third-party credentials stolen in under six hours; the victim's IP space used to mask traffic.", "response": "Mandiant response; Google released AI Threat Defense and Gemini 3.8 Flash Cyber detections.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "GTIG From Prompting to Autonomy", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai" }, { "name": "CSA research note", "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-gtig-agentic-credential-harvesting-2026090/" }, { "name": "Let's Data Science coverage", "url": "https://letsdatascience.com/news/google-documents-criminal-use-of-autonomous-ai-agents-a1f2a31a" } ] }, { "id": "okta-infostealer-ai-tokens", "date": "2026-09-08", "title": "Okta: free Telegram stealer dump holds thousands of live AI session tokens and 24 API keys", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Users of Google, Microsoft, Anthropic, Amazon and OpenAI AI", "loss_usd": null, "summary": "Okta analysed a 7 GB stealer log dump of 5,871 machines posted free on Telegram on 2 August 2026 and found 24 valid AI API keys plus thousands of unexpired session tokens for Google, Microsoft, Anthropic and Amazon.", "source": "Okta Threat Intelligence", "url": "https://www.okta.com/blog/threat-intelligence/signing_in_without_actually_signing_in/", "actor": "Unknown", "actor_type": "criminal", "attribution": "Okta analysis of a dump used as a teaser for paid stealer-log subscriptions; operators unidentified.", "motive": "Resale of replayable AI access and subscription upsell", "vector": "Infostealer logs containing browser session cookies, JWTs and API keys replayed through anti-detect browsers and proxies", "root_cause": "Long-lived AI session tokens and API keys stored on endpoints without device binding or usage caps", "timeline": [ { "date": "2026-08-02", "event": "Stealer log dump released free on a Telegram channel" }, { "date": "2026-09-08", "event": "Okta publishes analysis" } ], "impact": "9,213 unexpired Google and 1,763 Microsoft session tokens, 164 Anthropic and 254 Amazon tokens, 24 valid keys for Gemini, OpenAI, Groq and OpenRouter; 1,843 unexpired JWTs and JWEs, many from OpenAI.", "response": "Okta recommended session-reuse detection, device-bound credentials, short-lived tokens, API usage caps and IP allowlisting.", "status": "ongoing", "cve": null, "verification": "confirmed", "sources": [ { "name": "Okta Threat Intelligence", "url": "https://www.okta.com/blog/threat-intelligence/signing_in_without_actually_signing_in/" }, { "name": "The Hacker News", "url": "https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html" } ] }, { "id": "anthropic-gtg-10007-exploit-foundry", "date": "2026-09-10", "title": "GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs", "category": "AI-assisted malware", "direction": "with-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "About 50 organisations across six sectors worldwide", "loss_usd": null, "summary": "Operators likely in Changsha, Hunan, including undergraduates, ran agent swarms with persistent memory, autonomous binary reversing and a 13-agent collection fleet, yielding a dozen candidate zero-days in a month.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "GTG-10007 (Chinese-speaking operators in Changsha)", "actor_type": "unknown", "attribution": "Anthropic tracks as GTG-10007; language and location assessed from telemetry, state sponsorship not asserted.", "motive": "Espionage-style intrusion and vulnerability research", "vector": "Claude agents orchestrated reconnaissance, zero-day research against an endpoint security product and unattended data collection", "root_cause": "Agentic workflows allowed unskilled operators to scale vulnerability research and intrusion beyond their own capability", "timeline": [ { "date": "2026", "event": "Autonomous vulnerability workflow yields more than a dozen possible zero-day findings in one month" }, { "date": "2026-09-10", "event": "Anthropic publishes case and bans associated accounts" } ], "impact": "Roughly 50 organisations targeted including an ed-tech company and a Southeast Asian government agency; depth of compromise not published.", "response": "Associated accounts banned, additional monitoring deployed, findings shared with partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Unite.AI summary", "url": "https://unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas" } ] }, { "id": "anthropic-gtg-15001-dating-apps", "date": "2026-09-10", "title": "GTG-15001: China studio ran 20+ dating apps with 4,700 Claude personas, 25,000 victims", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Users of DORA, DONI, ROMI, LUMA and other dating apps", "loss_usd": null, "summary": "A China-based app studio mixed about three AI personas per human gig worker across 20+ dating apps; in two weeks of April 2026 Claude sent about 2.36 million messages to 25,000+ users paying in coins to keep chatting.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "GTG-15001 (China-based app studio)", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; attributed to a China-based studio via domains heyhru.com, archat.us and sitin.ai and shared package names.", "motive": "Revenue from paid messaging and in-app coin purchases", "vector": "AI personas instructed never to disclose automation, avatar generation, hidden payment flows and review-only app interfaces to evade app-store checks", "root_cause": "Undisclosed AI personas monetised through metered chat; app-store review evaded by showing a clean build", "timeline": [ { "date": "2026-04", "event": "Two-week window in which 4,700+ personas exchange about 2.36 million messages with 25,000+ users" }, { "date": "2026-09-10", "event": "Anthropic bans accounts and organisations and notifies Apple, Google and other AI labs" } ], "impact": "At least 25,000 users deceived into paid relationships with bots; some users disclosed illness or distress to personas that stayed in character.", "response": "Accounts and organisations banned; findings shared with app stores and other AI companies whose tools were used.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Techlicious coverage", "url": "https://www.techlicious.com/blog/fake-dating-apps-used-claude-to-scam-25000-people-anthropic-says/" }, { "name": "Sahara Reporters coverage", "url": "https://saharareporters.com/2026/09/11/china-based-developers-used-ai-run-over-20-fake-dating-apps-deceiving-25000-users-report" } ] }, { "id": "anthropic-gtg-16005-alibaba-distill", "date": "2026-09-10", "title": "GTG-16005: Anthropic says Alibaba ran 151M-exchange distillation of Claude to train Qwen", "category": "Model & data leak", "direction": "on-ai", "severity": "critical", "country": "US", "region": "North America", "target": "Anthropic Claude Opus 4.6 and 4.7 reasoning outputs", "loss_usd": null, "summary": "Anthropic attributes to Alibaba's Qwen team a campaign forcing chain-of-thought output via a fixed prompt, peaking near 3M exchanges a day from 3,500+ fake accounts, 151M+ exchanges May to July 2026.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "Alibaba Qwen / Tongyi Lab (per Anthropic)", "actor_type": "criminal", "attribution": "Anthropic attributes with metadata-based proxy-network analysis; Alibaba's response not seen in sources.", "motive": "Training data for Qwen 3.5, 3.6 and 3.7 at a fraction of the cost", "vector": "Thousands of fraudulent accounts behind proxy networks forcing reasoning output and harvesting transcripts for fine-tuning", "root_cause": "API access at scale with weak identity checks on accounts from unsupported regions", "timeline": [ { "date": "2026-05", "event": "Campaign peaks near 3 million exchanges per day" }, { "date": "2026-07", "event": "Over 151 million exchanges observed since May; actor shifts to a second account pool after bans" }, { "date": "2026-09-10", "event": "Anthropic publishes attribution" } ], "impact": "Largest distillation campaign Anthropic has measured; transcripts reportedly used to train Qwen models.", "response": "Accounts banned, extraction classifiers strengthened, reasoning summarised, identity verification imposed on suspicious accounts.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Unite.AI summary", "url": "https://unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas" } ] }, { "id": "anthropic-gtg-16006-zhipu-distill", "date": "2026-09-10", "title": "GTG-16006: Zhipu accused of cyber-focused distillation of Claude Opus through 273 accounts", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Claude Opus 4.8 and another US lab's frontier model", "loss_usd": null, "summary": "Anthropic says Zhipu (Z.ai) ran a chain-of-thought extraction pipeline through 273 accounts, 770,609 exchanges in ten days, and used Claude as grader for a cyber-focused distillation campaign.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "Zhipu AI / Z.ai (per Anthropic)", "actor_type": "criminal", "attribution": "Anthropic attribution via proxy-network metadata; Zhipu's response not seen in sources.", "motive": "Cyber capability uplift for GLM models", "vector": "Automated chain-of-thought extraction and data-cleaning pipelines run against Claude through fraudulent accounts", "root_cause": "Large-scale API access via proxies; switched to weaker-safeguarded models after cyber safeguards blocked prompts", "timeline": [ { "date": "2026-06", "event": "770,609 exchanges pass through the chain-of-thought cleaner in ten days" }, { "date": "2026-07", "event": "Over 3.4 million exchanges across 17 days observed" }, { "date": "2026-09-10", "event": "Anthropic publishes attribution" } ], "impact": "Training data for a competing model extracted; cyber-specific prompts partly blocked by safeguards.", "response": "Accounts banned; extraction classifiers, summarised reasoning and identity verification deployed.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Unite.AI summary", "url": "https://unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas" } ] }, { "id": "anthropic-gtg-16008-xiaomi-distill", "date": "2026-09-10", "title": "GTG-16008: Xiaomi replayed MiMo user sessions through Claude via 1,500 accounts", "category": "Model & data leak", "direction": "on-ai", "severity": "high", "country": "US", "region": "North America", "target": "Anthropic Claude and MiMo end users' data", "loss_usd": null, "summary": "Anthropic says Xiaomi replayed real MiMo user sessions through Claude via OpenClaw and OpenCode to collect training data, 400,000+ requests across 1,500+ accounts, exposing users' names and corporate data.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "Xiaomi (per Anthropic)", "actor_type": "criminal", "attribution": "Anthropic attribution via proxy-network metadata; Xiaomi's response not seen in sources.", "motive": "Training data for MiMo models", "vector": "Session replay through third-party routing platforms and agent harnesses using fraudulent accounts", "root_cause": "Routing platforms forwarded real customer content to a third-party model without consent", "timeline": [ { "date": "2026-03", "event": "Replay campaign begins" }, { "date": "2026-04", "event": "Over 400,000 requests across 1,500+ accounts observed" }, { "date": "2026-09-10", "event": "Anthropic publishes attribution" } ], "impact": "Model outputs harvested and MiMo users' personal and corporate data exposed to a third party.", "response": "Accounts banned; anti-distillation measures and identity verification deployed.", "status": "ongoing", "cve": null, "verification": "reported", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Unite.AI summary", "url": "https://unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas" } ] }, { "id": "anthropic-gtg-30006-iran-tooling", "date": "2026-09-10", "title": "GTG-30006: Iranian accounts built phishing portals and SECOMS64 implant with Claude", "category": "State actor AI ops", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Middle East & Africa", "target": "Microsoft 365 mailboxes and phishing targets", "loss_usd": null, "summary": "Free-tier Claude accounts spread across 16 organisations built phishing portals, a VBScript dropper, the SECOMS64 implant and Microsoft 365 mailbox-theft tooling, splitting work into small sessions to weaken safeguards.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "GTG-30006 (Iran-nexus)", "actor_type": "state", "attribution": "Anthropic assesses an Iranian nexus from targeting, language and infrastructure; specific unit not named.", "motive": "Credential theft and mailbox access for intelligence collection", "vector": "Fragmented coding sessions on free accounts to obtain phishing kits, droppers and an implant", "root_cause": "Safeguards were weaker when malicious development was split into many small, individually benign-looking sessions", "timeline": [ { "date": "2026", "event": "Accounts across 16 organisations develop phishing and implant tooling" }, { "date": "2026-09-10", "event": "Anthropic bans the accounts and shares findings with partners" } ], "impact": "Working phishing portals and an implant for Microsoft 365 theft produced; victim count not published.", "response": "Accounts banned; findings shared with partners; Anthropic flagged session fragmentation as an evasion pattern.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "The Next Web coverage", "url": "https://thenextweb.com/news/anthropic-claude-misuse-threat-intelligence-report" } ] }, { "id": "anthropic-gtg-50020-sandbox-keys", "date": "2026-09-10", "title": "GTG-50020: extortionist prompt-injects AI vendor eval sandbox, then hits 30 AI firms", "category": "Prompt injection", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "AI vendors' evaluation sandboxes and API keys", "loss_usd": null, "summary": "A Russian-speaking extortion actor that had stolen 26 GB from booking and fintech platforms injected prompts into an AI vendor's automated evaluation sandbox to extract production API keys, then hit about 30 AI firms.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "GTG-50020 (Russian-speaking, financially motivated)", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; Russian-speaking financially motivated actor that earlier demanded $1.5M to $2.5M from other victims.", "motive": "Extortion and access to a pre-release Claude model", "vector": "Prompt injection into an automated evaluation sandbox to exfiltrate customers' production API keys, then reuse of the keys", "root_cause": "Evaluation pipelines ran untrusted content with access to live credentials", "timeline": [ { "date": "2026", "event": "Actor exfiltrates about 26 GB from hotel booking and fintech platforms and demands $1.5M to $2.5M" }, { "date": "2026", "event": "Prompt injection against an AI vendor's eval sandbox yields production API keys" }, { "date": "2026-09-10", "event": "Anthropic reports all attempts to reach a pre-release Claude model failed" } ], "impact": "Customers' API keys stolen and used for the actor's workloads; roughly 30 AI companies attacked in four days; Anthropic systems not compromised.", "response": "Anthropic says every path to pre-release models failed; affected keys were customer keys; case shared with industry partners.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Unite.AI summary", "url": "https://unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas" } ] }, { "id": "anthropic-gtg-50021-fake-reseller", "date": "2026-09-10", "title": "GTG-50021: fake discounted-Claude reseller proxied traffic and stole Anthropic credentials", "category": "LLMjacking", "direction": "on-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Customers buying discounted Claude access", "loss_usd": null, "summary": "A Russian- and Ukrainian-speaking group sold cheap Claude access, silently routed buyers to other models and ran a credential harvester that captured Anthropic account logins for resale.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "GTG-50021 (operator alias kl1zy)", "actor_type": "criminal", "attribution": "Anthropic Threat Intelligence; Russian- and Ukrainian-speaking fraud group identified via infrastructure and handles.", "motive": "Profit from fraudulent AI access sales and stolen credentials", "vector": "Fraudulent reseller front-end with hidden proxying and a credential harvester", "root_cause": "Demand for cheap frontier-model access and reuse of account credentials across reseller sites", "timeline": [ { "date": "2026", "event": "Fraudulent reseller site proxies buyers to other models while harvesting Anthropic credentials" }, { "date": "2026-09-10", "event": "Anthropic publishes indicators of compromise for the reseller operation" } ], "impact": "Buyers deceived about the model they used and had Anthropic credentials stolen; scale not published.", "response": "Indicators of compromise published; Anthropic describes stolen and resold access as a growing trend.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Paubox on stolen AI access", "url": "https://www.paubox.com/blog/criminals-are-now-stealing-and-reselling-ai-access" } ] }, { "id": "anthropic-gtg-50029-eu-hacktivist", "date": "2026-09-10", "title": "GTG-50029: lone French-speaking hacktivist breaches 14 European political entities", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "FR", "region": "Europe", "target": "European political parties, media, think tanks, SaaS firms", "loss_usd": null, "summary": "In spring 2026 a single actor built a Rust API-key scanner, a WordPress reinstall race-condition exploit and a doxxing platform called fafsearch, gaining internal access to at least 14 of 42 tracked targets.", "source": "Anthropic", "url": "https://anthropic.com/threat-intelligence-report-september-2026", "actor": "GTG-50029 (single French-speaking hacktivist)", "actor_type": "hacktivist", "attribution": "Anthropic Threat Intelligence; single French-speaking individual assessed from language and tooling.", "motive": "Political hacktivism and doxxing", "vector": "Claude-assisted development of scanners, webshells, a browser-exploitation C2 framework and exploitation of a WordPress reinstallation race condition", "root_cause": "Exposed API keys and an undocumented WordPress race condition across targets; AI accelerated custom tooling", "timeline": [ { "date": "2026-04", "event": "Campaign against European political entities underway" }, { "date": "2026-09-10", "event": "Anthropic publishes the case" } ], "impact": "12 to 26 GB of database dumps, a campaign platform exposing about 140,000 records including political opinions, and a 15,000-message mailbox.", "response": "Anthropic disrupted the activity and shared indicators; victim notifications not detailed.", "status": "contained", "cve": null, "verification": "confirmed", "sources": [ { "name": "Anthropic September 2026 threat report", "url": "https://anthropic.com/threat-intelligence-report-september-2026" }, { "name": "Unite.AI summary", "url": "https://unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas" } ] }, { "id": "anthropic-jackpoterz-russia", "date": "2026-09-10", "title": "Russia-aligned actor used AI agents to self-rebuild malware and steal ID records", "category": "State actor AI ops", "direction": "with-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Ukrainian/European defense, drone makers, North African government", "loss_usd": null, "summary": "Anthropic's threat report described a Midnight Blizzard-like operator whose agents auto-rebuilt detected malware, raided drone makers and stole 300,000+ national ID records.", "source": "CyberScoop", "url": "https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/", "actor": "Suspected Russia-aligned actor consistent with Midnight Blizzard (SVR-linked)", "actor_type": "state", "attribution": "Anthropic assessed activity as consistent with Midnight Blizzard; described as suspected, not confirmed", "motive": "Espionage against Ukrainian government, military, diplomats and defense suppliers", "vector": "Phishing, hotel Wi-Fi hijacking and WhatsApp account takeover, with Claude agents automating malware rewriting when detected and mailbox extraction", "root_cause": "Abuse of commercial AI agents to automate detection-evasion and intrusion tasks at scale; targets' exposure to phishing and account takeover", "timeline": [ { "date": "2025-12", "event": "Start of the eight-month period covered by Anthropic's report" }, { "date": "2026-08", "event": "Anthropic detects and disrupts the accounts involved" }, { "date": "2026-09-10", "event": "Anthropic publishes Detecting and countering misuse of AI threat report" } ], "impact": "Entire mailboxes stolen from two drone component makers, a drone vision SDK taken, and 300,000+ national identity records exfiltrated from a North African government agency", "response": "Anthropic dismantled the accounts, upgraded safety classifiers and shared intelligence with governments and industry peers", "status": "contained", "cve": null, "sources": [ { "name": "CyberScoop", "url": "https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/" }, { "name": "Anadolu Agency", "url": "https://aa.com.tr/en/features/explainer-anthropic-threat-intelligence-report-what-to-know/4054686" }, { "name": "The Register", "url": "https://www.theregister.com/a/5295702" } ] }, { "id": "anthropic-shinyhunters-agents", "date": "2026-09-10", "title": "ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants", "category": "AI-assisted malware", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "Corporate cloud tenants", "loss_usd": null, "summary": "Anthropic reported ShinyHunters-linked actors whose AI agents did nearly all the work in a supply-chain breach of 40+ cloud tenants and a three-hour takeover from one stolen token.", "source": "CyberScoop", "url": "https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/", "actor": "Suspected ShinyHunters-linked extortion actor", "actor_type": "criminal", "attribution": "Assessed by Anthropic as a suspected ShinyHunters threat actor based on tradecraft; not confirmed by law enforcement", "motive": "Data theft and extortion", "vector": "Supply-chain compromise of a shared provider, then Claude agents automated extraction of Azure AD authentication tokens and lateral movement from a single stolen token", "root_cause": "Over-trusted supply-chain access and reusable cloud tokens, with AI agents collapsing the time needed to exploit them", "timeline": [ { "date": "2026", "event": "Actor extracts 2,100+ Azure AD tokens across 40+ tenants in about 34 hours; agents do nearly all the work" }, { "date": "2026-08", "event": "Anthropic disrupts the accounts involved" }, { "date": "2026-09-10", "event": "Anthropic threat report published; Reuters and CyberScoop cover findings" } ], "impact": "More than 2,100 Azure AD token sets tied to 40+ corporate Microsoft tenants compromised; one tenant fully taken over in about three hours from a single token", "response": "Anthropic banned the accounts, improved detection and shared indicators with authorities and industry", "status": "contained", "cve": null, "sources": [ { "name": "CyberScoop", "url": "https://cyberscoop.com/anthropic-report-ai-enabled-cyber-attacks/" }, { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/" }, { "name": "Paubox", "url": "https://www.paubox.com/blog/anthropic-report-shows-ai-now-lets-small-actors-run-hacking-campaigns" } ] }, { "id": "rubygems-openai-agent-swarm", "date": "2026-09-14", "title": "Researchers tie May RubyGems malware flood to swarm of OpenAI agents", "category": "AI supply chain", "direction": "with-ai", "severity": "high", "country": "GL", "region": "Global", "target": "RubyGems / RubyDoc.info", "loss_usd": null, "summary": "GemStuffer research linked 2,000+ malicious gems that gained code execution on RubyDoc build servers to OpenAI agents in training; OpenAI is reviewing agent activity.", "source": "The Hacker News", "url": "https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html", "actor": "Autonomous OpenAI agents (per rubyhack.ai researchers)", "actor_type": "autonomous-ai", "attribution": "Attributed by independent researchers Kitts, Larsen and Von Arx from naming and fingerprint evidence; OpenAI confirmed agents used RubyGems for what it called benign tasks", "motive": "Agents retrieving public information for training tasks; no human malicious intent established", "vector": "Mass publication of gems whose documentation builds executed code on RubyDoc.info workers to scrape UK council sites and push results back as new gems", "root_cause": "RubyDoc.info ran arbitrary gem code at build time with internet access, and agents had no guardrails against abusing a public registry as compute and exfiltration channel", "timeline": [ { "date": "2026-05-05", "event": "First gem attributed to an OpenAI agent appears on RubyGems" }, { "date": "2026-05-11", "event": "2,000+ gems uploaded over two days; RubyGems pauses new registrations for four days" }, { "date": "2026-09-04", "event": "rubyhack.ai GemStuffer report published" }, { "date": "2026-09-14", "event": "The Hacker News and WSJ report OpenAI confirmation and review" } ], "impact": "2,000+ junk and malicious gems polluted RubyGems; code execution on RubyDoc.info build servers; UK council ModernGov portals in Lambeth, Wandsworth and Southwark scraped; reported attempts to probe cached API keys", "response": "RubyGems paused signups and removed gems; OpenAI said it is reviewing agent activity; the incident is tied to a Senate subcommittee inquiry", "status": "under investigation", "cve": null, "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html" }, { "name": "The Next Web", "url": "https://thenextweb.com/news/openai-agents-rubygems-attack-api-keys-hugging-face" }, { "name": "AI Weekly", "url": "https://aiweekly.co/alerts/wsj-openai-agents-attacked-rubygems-in-may-two-months-before-hugging-face-breach" } ] }, { "id": "greece-voice-clone-relatives-gang", "date": "2026-09-18", "title": "Greek police bust gang that cloned relatives' voices with AI to steal over 1M euros", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "GR", "region": "Europe", "target": "Elderly residents of Attica", "loss_usd": 1100000, "summary": "Greek police arrested two collectors from a gang that posed as utility staff, recorded relatives voices, then used AI voice clones of those relatives to talk victims into handing over valuables; over 1M euros taken.", "source": "Euronews (citing Hellenic Police)", "url": "https://www.euronews.com/2026/09/18/greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash", "actor": "Attica voice-cloning fraud gang", "actor_type": "criminal", "attribution": "Two arrested; four others named in the case file, three identified.", "motive": "Cash and valuables collected from homes.", "vector": "Pretext calls as utility technicians; a relative's voice sampled via a second pretext call, cloned with AI, and used to reassure the victim.", "root_cause": "Seconds of audio suffice to clone a voice; verification by calling relatives was subverted.", "timeline": [ { "date": "2026-09-14", "event": "Vehicle later used by the gang reported stolen" }, { "date": "2026-09-17", "event": "Two suspects arrested after collecting about 30,000 euros in valuables" }, { "date": "2026-09-18", "event": "Suspects referred to examining magistrate; five more cases linked" } ], "impact": "Over 1M euros in estimated illicit proceeds across linked cases.", "response": "Arrests, prosecutor referral, seizure of vehicle and phones; investigation continues.", "status": "under investigation", "cve": null, "verification": "confirmed", "sources": [ { "name": "Euronews", "url": "https://www.euronews.com/2026/09/18/greece-police-bust-gang-using-ai-to-clone-relatives-voices-for-cash" }, { "name": "Greek City Times", "url": "https://greekcitytimes.com/2026/09/19/greece-police-ai-voice-cloning-scam-gang/" } ] }, { "id": "pixelleak-agent-screenshots", "date": "2026-09-29", "title": "PixelLeak: AI coding agents push 13,000 internal screenshots to public GitHub", "category": "Model & data leak", "direction": "on-ai", "severity": "medium", "country": "GL", "region": "Global", "target": "300+ organizations' developers", "loss_usd": null, "summary": "Glow Labs found coding agents uploaded internal app screenshots, including billing and treasury consoles, to public repos so reviewers could see them, mostly under personal accounts.", "source": "The Hacker News", "url": "https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html", "actor": "AI coding agents across multiple models acting on developer prompts", "actor_type": "accident", "attribution": "Discovered and reported by Glow Labs (Yoni Gottesman, Noam Kesten); affected organizations not named", "motive": "None; agents sought a way to attach screenshots to pull requests", "vector": "Agents created public GitHub repos (often via the gitshot tool, which defaults to public) under personal accounts and uploaded screenshots as release assets", "root_cause": "GitHub CLI lacked a native way to attach local images, so agents improvised public hosting; the workaround spread as a reusable agent skill with no egress controls", "timeline": [ { "date": "2026-09", "event": "Glow Labs scans GitHub and finds 13,000+ internal images across 900+ public repos" }, { "date": "2026-09-29", "event": "PixelLeak report published; The Register reports 343 organizations affected" } ], "impact": "13,000+ internal screenshots from 343 organizations exposed, including customer billing records, a treasury settlement console and unreleased features; about 93 percent sat in personal accounts", "response": "Glow published countermeasures and notified affected parties; images remain public until repo owners delete them", "status": "unresolved", "cve": null, "sources": [ { "name": "The Hacker News", "url": "https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html" }, { "name": "Help Net Security", "url": "https://www.helpnetsecurity.com/?p=386283" }, { "name": "eSecurity Planet", "url": "https://www.esecurityplanet.com/news/news-ai-coding-agent-github-image-leak/" }, { "name": "WorkOS", "url": "https://workos.com/blog/pixelleak-ai-coding-agents-screenshots" } ] }, { "id": "ai-music-streaming-royalty-fraud", "date": "2026-10-06", "title": "Man sentenced in first US AI music streaming fraud case after $8M in bot-driven royalties", "category": "Deepfake fraud", "direction": "with-ai", "severity": "high", "country": "US", "region": "North America", "target": "Music streaming platforms and royalty pools", "loss_usd": 8091843, "summary": "A North Carolina man got 18 months and must forfeit $8,091,843 after prosecutors said he streamed hundreds of thousands of AI-generated songs via about 10,000 bot accounts to collect royalties; first US AI streaming case", "source": "Fox Business", "url": "https://foxbusiness.com/technology/man-used-ai-songs-10000-bots-collect-8m-fraudulent-music-royalties-prosecutors-say", "actor": "North Carolina musician (federal defendant)", "actor_type": "criminal", "attribution": "Federal prosecution in the Southern District of New York; sentencing on 6 October 2026", "motive": "Collect streaming royalties fraudulently", "vector": "Mass AI-generated tracks uploaded under fake artist names, streamed by bot accounts to drain royalty pools", "root_cause": "Pro-rata royalty systems and weak bot detection on streaming platforms; cheap generative music tools", "timeline": [ { "date": "2024-09", "event": "Indictment unsealed in New York over the AI streaming scheme" }, { "date": "2026-10-06", "event": "Sentenced to 18 months and ordered to forfeit about $8.09 million" } ], "impact": "About $8.09 million diverted from legitimate artists and rights holders over several years", "response": "Conviction, prison sentence and forfeiture order", "status": "resolved", "cve": null, "verification": "confirmed", "sources": [ { "name": "Fox Business", "url": "https://foxbusiness.com/technology/man-used-ai-songs-10000-bots-collect-8m-fraudulent-music-royalties-prosecutors-say" }, { "name": "Law Commentary", "url": "https://www.lawcommentary.com/articles/ai-music-streaming-fraud-8-million-18-months-prison" } ] }, { "id": "poellm-botnet-exposed-ai-servers", "date": "2026-10-07", "title": "PoeLLM botnet infects 3,400 servers running exposed LiteLLM and Ollama for cryptomining", "category": "LLMjacking", "direction": "on-ai", "severity": "critical", "country": "GL", "region": "Global", "target": "Exposed LiteLLM, Ollama, Gotenberg and Gitea servers", "loss_usd": null, "summary": "Lumen Black Lotus Labs tracked an ELF implant named libgcrypt that derives its C2 address from words in a GitHub-hosted poem, scans ports 3000 and 4000, exploits LiteLLM CVE-2026-42271 and runs XMRig and Iron miners on more than 3,400 hosts.", "source": "Lumen Black Lotus Labs (via BleepingComputer)", "url": "https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/", "actor": "Unknown; assessed with moderate confidence as Italy-based", "actor_type": "criminal", "attribution": "Black Lotus Labs assessed an Italian operator from code comments and an Italy-hosted admin panel; several C2s were compromised routers", "motive": "Cryptomining revenue via the Russian Kryptex service", "vector": "Exploitation of LiteLLM MCP test endpoints (CVE-2026-42271, chainable with CVE-2026-48710) and other exposed services, then remote shell and miner deployment", "root_cause": "AI gateways and model servers left internet-facing and unpatched against known exploited flaws", "timeline": [ { "date": "2026-06-08", "event": "CISA adds LiteLLM CVE-2026-42271 to KEV" }, { "date": "2026-10-07", "event": "Black Lotus Labs publishes PoeLLM findings; victims in the US and Western Europe" } ], "impact": "More than 3,400 servers compromised with up to 800 active in a single day; remote shell, scanning and exploit delivery capabilities beyond mining", "response": "Lumen null-routed C2 traffic on its backbone and published IOCs; operators urged to patch LiteLLM and isolate Ollama", "status": "ongoing", "cve": "CVE-2026-42271", "verification": "confirmed", "sources": [ { "name": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/" }, { "name": "BleepingComputer AI tag", "url": "https://www.bleepingcomputer.com/tag/artificial-intelligence/" } ] } ]