6 casos · pág. 1/1
Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the lar…
On October 6, 2026, ASOS app users received a push notification stating the company had been hacked, sent by attackers who gained access to third-party customer messaging platforms used by ASOS. The note, addressed to ASOS's DPO and IT team, claimed the Snowflake instance was "fully compromised" and threatened a leak unless ASOS engaged. …
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
Check Point Research reports that commercial antidetect browsers Kameleo, AdsPower and MultiLogin are widely referenced on Russian-language underground forums and are used for account takeover, carding, fraudulent loan applications, ad-revenue fraud and coordinated inauthentic behavior (CIB). The tools spoof browser fingerprints, manage p…
Threat actors are abusing the open source AI platform Cairn, an agent-coordination engine usable as an autonomous penetration testing tool, to automate attacks on hundreds of websites worldwide. AI security firm Norforge found the activity after threat actors left their Cairn panels exposed, following a Gambit Security report on attackers…
