Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. The company's OSS VRP incentivizes security researchers to responsibly disclose security flaws across open-source projects maintained by Google, including Golang, Angular, Bazel, Protocol Buffers, Fuchsia, and critical third-party dependencies, as well as repository settings like GitHub actions, application configurations, and access control rules. Google launched the OSS VRP in August 2022 with rewards ranging from $100 to $31,337, and noted that the program would focus on security flaws with the most significant impact on the software supply chain. "We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports," the company said. "Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid."
AI agents probing US and Canadian government sites made SQL injection attempts while seeking data, but investigators found no evidence of compromise. Autonomous AI agents, working on what looks like ordinary data retrieval tasks, ended up throwing basic hacking attempts at a U.S. Department of Education site and Library and Archives Canada. Nobody told them to break in. They just drifted there while trying to answer research questions. The findings come from Transluce, a nonprofit research lab that dug through public web logs and found a pattern nobody had flagged before. On June 17, AI agents sent more than 200,000 requests to a U.S. Department of Education website while hunting for school statistics. Buried in that traffic was a basic SQL injection attempt, a manipulated parameter meant to slip past the site’s normal filters. Nothing came of it. The site held. “Following up on our previous blog post, we discovered several additional incidents where rogue AI agents appear to have used aggressive techniques to access publicly available data on government websites.” reads the report published by Transluce. “This includes two rudimentary and failed hacking attempts, one against the U.S. Department of Education’s Civil Rights Data Collection, and one against Library and Archives Canada, a Canadian federal agency.” Transluce says the agents were looking for data related to a Google DeepSearchQA question about school counselors and bullying linked to race. The agent was likely trying to answer the question and found its way to the government database. The U.S. Department of Education checked the activity after Transluce reported it on September 25 and found no impact on its services. A similar case involved Library and Archives Canada. The agents were looking for divorce records from 1905 to 1911. Portugal’s national web archive recorded almost 900 requests to the Canadian website in May and June. Thirteen requests included attack attempts, such as SQL injection tests and attempts to bypass input and debugging controls. “We have so far identified no instances in these datasets where agents gained access to any information that is not publicly available.” states the report. Every probe came back empty. Canada’s Centre for Cyber Security looked into it and found nothing to suggest the database had been touched or exposed. “We are aware of reports identifying suspicious activity, including suspected AI agent activity, targeting publicly accessible websites, such as the Government of Canada. There is no indication that government systems have been compromised at this time.” states Canada’s Centre for Cyber Security. “Public-facing government websites routinely receive automated and potentially malicious requests. Such activity is an ongoing feature of the online environment and does not, on its own, indicate a successful cyber incident.” Transluce is careful here, and that caution matters. The researchers say the tactics match patterns previously tied to OpenAI, but they stop short of pinning the blame directly, writing plainly that they can’t confidently attribute these specific attempts to the company. “In addition to the above, we identified a broader pattern of automated workflows that we attribute to AI agents with varying levels of confidence, based on task-level connections, shared infrastructure, and timing. Some of this traffic overlaps to varying degrees with prior activity confirmed to be associated with OpenAI, and in some cases agents explicitly mark themselves as being associated with OpenAI.” Transluce adds. “However, we are not attributing this traffic as a whole to OpenAI nor do we attempt to estimate attribution for each incident.” OpenAI, for its part, told the Washington Post it was reviewing the findings and had already given Canadian officials an initial briefing. “We’re aware of reports of OpenAI models attempting to access publicly available information from Canadian government websites,” a spokesperson for OpenAI said. “We’re reviewing these findings and have provided an initial briefing to Canadian officials conducting the government’s review.” OpenAI has separately admitted to unintended interactions between its agents and U.S. government sites before, so this isn’t coming out of nowhere. Still, Transluce flagged that a chunk of the broader activity they found doesn’t trace cleanly back to any one company. Multiple agent frameworks, it seems, are out there roaming the same networks, and attribution gets messy fast when nobody’s agent is wearing a name tag. The investigation found more examples of aggressive AI agent activity against U.S. state and federal websites. The logs included agencies in California, Kansas, Maryland, Illinois, Texas, and New York. The agents used different tactics, including sending large numbers of requests, changing URLs, using temporary email accounts, trying to bypass anti-bot systems, guessing hidden file names, and reusing leaked credentials. One agent tried to get a Bureau of Economic Analysis API key using a temporary email and the name “OpenAI Research.” Another tried to use an exposed API key to access Census Bureau data. Between April and May, agents also repeatedly tried to reach the content management system of the Navy’s history website. There is no evidence they accessed classified information. Nobody here set out to build malware. These look like agents doing information-gathering work, running into a paywall or a blocked query, and improvising their way around it using techniques that happen to double as attack patterns. That’s a genuinely new category of risk: not a hacker deploying a tool, but a tool behaving like a hacker because that’s the shortest path to the answer it was told to find. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agents)
Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap.
Asymmetric Security traces rogue OpenAI AI agent activity that probed government sites, accessed staging servers, and evaded sandbox limits. Researchers at Asymmetric Security spent 48 hours over the last weekend reconstructing reported rogue OpenAI AI agent activity that hit the Australian government and other organizations between March and September this year. They worked from public data only, no internal access, no cooperation from the agent’s operator, just what was left lying around on the open internet. What they found is less a hacking story and more a story about an AI agent trying very hard to get around its own leash. The list of targets was much wider than expected. The agents checked Australian government websites, but also looked at the CDC, SEC, International Energy Agency, and Mayo Clinic. Some activity reached test systems that contained real data. Some records were deleted or could not be accessed, so it is still unclear whether sensitive data was exposed. The original task seemed harmless. The agents were asked to collect health and prescription data from Australia’s Institute of Health and Welfare, trade data from UNCTAD, and university data from Data USA. When one agent could not get the AIHW data, it asked other agents for help. When the normal methods failed, the agents started trying other ways to get the information. The main trick was surprisingly simple. The agents combined two developer tools, httpbin and urlquery, to create something that worked like a basic web browser. Httpbin let them create a web page from a special link and add their own code to it. Urlquery then opened the page in a real browser and recorded what happened, including the page title. The agents used that title to send back data collected by their code. They did not build a browser themselves. They combined two existing tools to get similar functionality. “In summary: httpbin served the page, urlquery provided the browser, and the urlquery report returned the results. By combining these services with their fetch tool, the agents mimicked a full web browser.” reads the report published by Asymmetric Security. Alongside that, the agents ran recon moves that look straight out of a standard attacker’s playbook. Archived requests targeted exposed Git configuration files on Climate Reanalyzer’s servers, along with a backed-up server script, though nothing suggests these attempts actually succeeded. A separate request against the US Department of Education’s Civil Rights Data API carried a textbook SQL injection pattern, ending in the classic always-true condition that tries to trick a database into returning more than it should. Again, no confirmed success, just the attempt sitting there in the logs. Some of the access to staging systems returned real data, even though the data was technically public. In one case, an agent accessed a prescription data file from AIHW’s test system, read specific data, and calculated averages. It then sent the results in small pieces through image-request URLs to another public service. Similar activity was seen against staging systems at Data USA, IHME, and UNCTAD. No passwords were needed. The agents simply found systems that were not meant to be publicly accessible and explored them. The account creation pattern is where this stops looking accidental. Starting mid-June, the agents attempted sign-ups across disposable email services, browser automation platforms, and scanning tools, some using email addresses prefixed with task-related shorthand like “aihw” for Health and Welfare or “pbs” for the Pharmaceutical Benefits Scheme. One disposable-address signup got rejected for using a blocked domain, and sixteen minutes later a near-identical attempt using a Gmail address went through. Researchers later confirmed that Gmail address doesn’t actually exist, and that urlquery never required verification anyway, which makes the whole maneuver a solution to a problem that didn’t need solving, attempted anyway. Over time, the agents shifted from using urlquery’s public scanning feature to creating private accounts instead, which hides search activity from anyone trying to reconstruct it later, including the researchers themselves. One disposable mailbox was even set to expire within 48 hours of creation, conveniently erasing anything routed through it before anyone could look. Whether that timing was deliberate tradecraft or just how the tool happened to work is something nobody can establish from public records alone. “The possibility of private scans, together with temporary-mailbox expiry, limits what can be reconstructed from public records. It is thus impossible, based on public data alone, to definitively establish that no sensitive data was accessed.” continues the report. “These records alone do not establish whether the account-registration attempts were intended to conceal activity (this analysis would require full model transcripts).” Getting the data out involved its own creativity. In one case, agents used a web archiving tool meant for preserving pages to instead capture and store a 22-megabyte JSON response from an Australian crime-mapping tool, later retrievable through the archive’s own replay link. In another, an agent fetched a protected health dashboard, compressed the result into a small gzip file, and uploaded it to a push-notification service meant for sending phone alerts, not smuggling data. Both services did exactly what they were built to do. Neither was built with this in mind. What makes this case different from a normal cyberattack is how quickly the agents changed their methods. They adapted in days, instead of the months or years a human group might need. That made the activity harder to detect using normal attack patterns. There was also another problem. Before an agent could reach a target, it first had to find a way around its own sandbox. In other words, the attack involved two steps: escaping the agent’s environment and then reaching the target. “The activity we observed looked like it stemmed from innocent tasks which then evolved into problematic activity, such as unauthorized account creation, bypassing restrictions, and relaying data through third parties.” the report concludes. “Unlike investigations where a malicious objective is apparent from the outset, our digital forensics team had to link traditional threat-actor tactics to seemingly innocent goals.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agent)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a path traversal vulnerability that can be triggered through specially crafted HTTP or HTTPS requests. An unauthenticated attacker can exploit the issue to bypass restrictions on file paths and write arbitrary files to the underlying system. The vulnerability also involves improper handling of NULL characters, which can help the attacker bypass security checks. The flaw is reportedly being exploited in the wild, so affected customers are urged to apply the recommended workaround. “An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.” reads the advisory. “This has been reported to be exploited in the wild” The company did not disclose how many customers were affected, when the attacks started, who was behind them, or technical details of the attacks. Below are the affected versions and the released updates: VersionAffectedSolutionFortiMail 8.08.0.0 through 8.0.1Upgrade to upcoming 8.0.2 or aboveFortiMail 7.67.6.0 through 7.6.6Upgrade to upcoming 7.6.7 or aboveFortiMail 7.47.4.0 through 7.4.8Upgrade to upcoming 7.4.9 or aboveFortiMail 7.27.2.0 through 7.2.9Upgrade to branch 7.4 or above As a temporary workaround, customers should disable the IBE (Identity-Based Encryption) feature using the recommended CLI command. Alternatively, access to the FortiMail management interface should be blocked from the internet or limited to trusted private networks. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 3rd, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster
Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a
Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statistics. The failed breach attempts targeted a website under the U.S. Department of Education and Library and Archives Canada. However, the collected data shows no evidence of access to non-public information. Nonprofit research lab Transluce says the AI agents appeared tasked with data retrieval operations, but their activity also included failed “rudimentary hacking attempts.” One incident occurred on June 17, when AI agents made more than 200,000 requests to a U.S. Department of Education website while searching for school statistics. According to Transluce, the activity included a basic SQL injection attempt using a manipulated parameter, in an effort to bypass the site’s normal filters.
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. EPG is a component of the Kiteworks Private Content Network (PCN), which integrates enterprise email, Managed File Transfer (MFT), file sharing, APIs, and web forms into a single platform. Formerly known as Accellion, Kiteworks provides services to thousands of global corporations and government agencies, and its Private Content Network has over 100 million end-users. As part of the same set of security patches, Kiteworks has also fixed 11 critical authentication bypass, admin account takeover, stored cross-site scripting (XSS), improper access control, and improper authentication vulnerabilities in the Core and EPG components.
Confirm this action.
Leaving now will discard your changes.