Today we're launching urlscan Brand AI within our urlscan Pro portal. Brand AI will visually examine websites to determine the name of the brand the website claims to represent, a more robust approach than text-based queries. Read the details in our blog: urlscan.io/blog/2025/07/30/b…

🚩 𝗧𝗵𝗮𝗶 𝗯𝗿𝗼𝗮𝗱𝗯𝗮𝗻𝗱 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝘁𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝘃𝗶𝗮 𝗙𝗼𝗿𝘁𝗶𝗚𝗮𝘁𝗲 𝗦𝗦𝗟-𝗩𝗣𝗡 𝗮𝗻𝗱 𝗠𝗲𝘀𝗵𝗖𝗲𝗻𝘁𝗿𝗮𝗹 An operator left their staging server open on Thai infrastructure. AttackCapture caught it while the intrusion was still live. Inside was the full picture of an attack against one of Thailand's largest fixed-line broadband providers. 298 files, 30 subdirectories, 19 MB. Recon scripts, exploits, brute-force tooling, a live MeshCentral config, and an inventory of machines the operator already controlled. What the toolkit shows: - CVE-2024-21762 used against a FortiGate 60F SSL-VPN, from fingerprinting to full RCE - MeshCentral set up as a backdoor, agents pointed at the operator's own management server under a dedicated device group - devices.json confirms multiple hosts were enrolled and connected at capture time, agents running as root - The provider's RADIUS databases targeted to pull subscriber credentials - A valid OpenVPN certificate from the provider's own PKI, giving persistent access to the network - A cleanup script staged to wipe logs and exploit files while leaving the MeshCentral agent in place Active session cookies for a second, linked provider point to a parallel operation, so this was not a single-org hit. Full breakdown, IOCs, and MITRE mapping here 👇hunt.io/blog/thai-broadband-…

urlscan detected a Mouse System site dropping a malicious ShellA Loader APK, analyzed by Intel471. As traditional phishing pages slow on these Chinese frameworks, threat actors may now be shifting to delivering malicious APKs through the same channels. urlscan.io/pricing/urlscanpr…

🇨🇳 🤖 𝗡𝗘𝗪 𝗥𝗘𝗦𝗘𝗔𝗥𝗖𝗛: 𝗖𝗵𝗶𝗻𝗲𝘀𝗲-𝗦𝗽𝗲𝗮𝗸𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿 𝗨𝘀𝗲𝘀 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀 𝘁𝗼 𝗧𝗮𝗿𝗴𝗲𝘁 𝗚𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗘𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝗔𝘀𝗶𝗮 Our research team identified five exposed open directories revealing a campaign that used an orchestration framework called SecFlow to coordinate Claude, Qwen, and DeepSeek AI workers across intrusions targeting government, education, consular, and healthcare systems in Asia. Key observations: - A shared SOCKS endpoint connected all five workspaces, confirmed through 120 code-search matches on our platform - The deepest compromise hit a Fengtai District government OA environment: command execution, LSASS dumps, registry hives, 822 account records extracted, and a Go implant called SecBox deployed - A Chinese education AI platform was compromised, exposing 23 agent configurations, production credentials, and student profile data across 169 conversations - SecFlow split reconnaissance, exploitation, and reporting across specialist AI workers, with the runtime swapping between Claude, Qwen, and DeepSeek without changing the task interface - GLUTTON webshells transported executable bytecode inside PNG image pixels using XOR encryption, loading directly into memory while the visible server file remained a generic decoder - A fake MySQL deserialization service delivered Linux second-stage payloads to vulnerable Java clients that connected to it - Eight CVEs in active workflows, including Shellshock, Spring4Shell, Ghostcat, Log4Shell, Shiro deserialization, Grafana and Nexus path traversals, and Nacos authentication bypass - The AI's shared context amplified a false positive: an unsupported Shiro success claim persisted and drove 27+ follow-up tasks that produced nothing This is the second separate campaign we've tracked where commercial AI models were used as operational components in intrusions. Different infrastructure and tooling from our July report, but the same pattern. Read the full report here👇 hunt.io/blog/chinese-operato…

This Pro-only Intel Brief is now available on our public blog in a slightly redacted form. Check it out: urlscan.io/blog/2026/09/03/F…

Really cool use of the limited space in the urlscan Pro UI. Use a flip effect to show more metadata about a scan before you open it. Reach out to us if you'd like to take the urlscan Pro platform for a spin.

We pivoted on NS infrastructure to uncover a UK banking phishing network powered by two central panels: FastFlux and FluxPanel. Pages prompt victims for a 6-digit code provided by a phone "advisor" to trigger downloads of a RAT disguised as verification. Report on urlscan Pro.

🎥 Operation CameraSwarm: over 14,000 Dahua cameras compromised across Ukraine and Russia NEW RESEARCH: A single operator left their entire working directory exposed on an open HTTP server. We crawled it and recovered 2,616 files, 407 MB, the full toolkit behind a 35-day camera-compromise campaign. The scanning ran global, but the confirmed compromises landed in 🇺🇦 Ukraine and 🇷🇺 Russia, with Ukraine holding the largest share. What we found: → 14,530+ devices compromised in 35 days, the brute-force engine alone reaching 12,324 unique addresses → 1,923 cameras carrying a persistent backdoor account installed over RPC, surviving a password change and, on most firmware, a factory reset → 283 cameras reached by serial number alone through the cloud relay, most requiring no authentication to open a channel → A separate Windows stealer staged on the same host, unrelated to the camera activity → The toolkit assembled from at least six upstream developers' work, not authored from scratch We assess with moderate confidence the toolkit was built to hand access to a third party, based on its transferable recovery-code design and enterprise-format export pipeline. Full breakdown, indicators, and mitigations 👇 hunt.io/blog/operation-camer…

This report is now available on our public blog as well: urlscan.io/blog/2026/08/17/I…

urlscan Pro University is officially LIVE! Master urlscan search through hands-on challenges - from basic to advanced Discover typosquat detection, threat verdicts, and phish hunting. Solve challenges, submit flags, track your progress. pro.urlscan.io/university

🇷🇺 𝗜𝗻𝘀𝗶𝗱𝗲 𝗮 𝗥𝘂𝘀𝘀𝗶𝗮𝗻-𝗦𝗽𝗲𝗮𝗸𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿'𝘀 𝗧𝗼𝗼𝗹𝗸𝗶𝘁 𝗳𝗼𝗿 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗶𝗻𝗴 𝗨𝗸𝗿𝗮𝗶𝗻𝗶𝗮𝗻 𝗜𝗣 𝗖𝗮𝗺𝗲𝗿𝗮𝘀 Our research team pulled apart two open directories and reconstructed how one operator found, exploited, and watched internet-exposed cameras across Ukraine. The whole toolkit was sitting in the operator's own files. What we found: → Two open directories recovered through our Attack Capture system, exposing the operator's own tooling and workflow → A custom project (the operator named it camview) that wraps the open-source Ingram scanner to exploit Hikvision and Dahua devices → The operator's own logs of live viewing sessions, 58 Ukrainian cameras opened as live video, not exposure inferred from a scan → Bash history capturing Tor-routed attempts against Ukrainian government and military sites, outcomes not confirmed → A second, separately run directory, tied to the first only by the shared scanner, building SOCKS5 proxies from compromised routers across 15 European countries → No state attribution. The value is the host-level view of how these camera operations get built and run Full breakdown and IOCs here 👇 hunt.io/blog/russian-speakin…

There's a new public blog post about a phishing framework targeting multiple brands from the financial services sector. Check it out to understand how we hunt for threats using the urlscan Platform: urlscan.io/blog/2026/08/04/P…

New Research: We’ve uncovered two active phishing clusters (GSVerify & Knock) targeting YouTube creators with fake copyright strike lures and advanced Browser-in-the-Browser (BitB) Google login modals. The detailed report is available on urlscan Pro.

Interested in learning about How AI can Help Detect Modern Web-based Threats? Johannes Gilger, CEO of @urlscanio, will join us on #ThursDef tomorrow at 12:30pm CT! Secure your spot – register here: thursdef.com #ThursdayDefensive #cybersecurity #infosec

👻 Open Directory Stages NGINX Rift and Ghost CMS Exploits, Targeting 11 Countries We found an open directory on a Singapore VPS (165.154.236[.]93): an attack server that was also set up to receive reverse shells. One host, seven exploits, wired to verify its own blind attempts over DNS callbacks. On the box: - NGINX Rift (CVE-2026-42945), a long-standing heap overflow, and Ghost CMS blind SQLi (CVE-2026-26980) - Splunk, PaperCut, Samba, WebLogic, D-Link NAS tooling alongside them - OOB DNS callbacks to per-target subdomains to check whether blind attempts landed - A full AdaptixC2 build and SuperShell install files - Country and sector target lists: government, universities, healthcare, finance across 11 countries Simplified Chinese comments and the use of Goby and Supershell suggest an operator comfortable with the language. That is a comfort signal, not attribution or a state nexus. 👉 Full research: hunt.io/blog/open-directory-… #nginx #ghostcms #threatintel #threathunting #cybersecurity #opendir

Mark your calendars!

🇨🇳 🤖 𝗦𝘂𝘀𝗽𝗲𝗰𝘁𝗲𝗱 𝗖𝗵𝗶𝗻𝗲𝘀𝗲 𝗼𝗽𝗲𝗿𝗮𝘁𝗼𝗿𝘀 𝘄𝗶𝗿𝗲𝗱 𝗖𝗹𝗮𝘂𝗱𝗲 𝗖𝗼𝗱𝗲 𝗮𝗻𝗱 𝗗𝗲𝗲𝗽𝗦𝗲𝗲𝗸 𝗶𝗻𝘁𝗼 𝗮 𝗹𝗶𝘃𝗲 𝗴𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗶𝗻𝘁𝗿𝘂𝘀𝗶𝗼𝗻 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻 In June 2026, a pivot off known TencShell C2 infrastructure covered by Cato Networks, led our research team to an open directory exposing an active intrusion. Inside were victim source code, custom exploits, operator logs, and cloned login pages, with the attack notes written in Simplified Chinese. The part that caught our attention was the tooling. Claude Code and DeepSeek-v4-pro were running as working parts of the operation, not sitting off to the side. What we found: → Claude Code handled execution and session persistence while DeepSeek-v4-pro drove the reasoning, a split documented across the recovered logs → Hands-on exploitation of government systems in Afghanistan, Thailand, and Taiwan, plus recon and staged phishing against U.S. government portals → A single HTTP header fingerprint pivoted out to 13 Hong Kong servers across four ASNs → Scanning of 5,890+ government hosts across 10 countries with a custom Python scoring script → A parallel run at financial services firms across Europe, Australia, and Asia → A likely second C2 framework, Gshell, with no prior public reporting we could find This lines up with Anthropic's November 2025 disclosure of a China-linked operation that leaned on Claude Code for large-scale intrusions. 👉 Read the full research and IOCs: hunt.io/blog/chinese-operato…

𝗛𝘂𝗻𝘁 𝟯.𝟬 𝗶𝘀 𝗹𝗶𝘃𝗲. 𝗣𝘂𝗹𝗹 𝘁𝗵𝗲 𝘁𝗵𝗿𝗲𝗮𝗱. 🚀 Most threat hunting tools stop at the lookup. You get a result, maybe a tag, and then you're on your own figuring out what connects to what. We built v3 to fix that. Every indicator, whether it's an IP, a domain, or a hash, should open into the full picture automatically. 👉 Here's what's new: hunt.io/blog/introducing-hun… → 60+ API endpoints across C2, AttackCapture, Vulnerability Intel, SQL, and more → Remote MCP server, connect Claude or other AI tools straight to Hunt data → Cloudflare Buster turns one domain into a full infrastructure cluster → Passive DNS History gives you a real timeline of DNS changes, not just a point-in-time snapshot → Attack Reports turns exposed attacker directories into structured campaign reports, tied to specific IPs, IOCs, and CVEs → Exploit Capture indexes 54,000+ AI-classified files staged in attacker open directories right now → Provider Radar now includes Registrar intelligence, catching domain provisioning patterns before those domains go live in an attack → Flattened data architecture so HuntSQL joins are finally possible, no workarounds → And much more! And the best part: you get 14 days free, no credit card needed. Open an account and start hunting today 👇 portal.hunt.io/sign-up

New TI report 🚨 Mouse System ("Phoenix" / "Haozi") is a full-feature phishing platform with admin panels, tokenised APIs, and modular campaign management. One of the more mature ecosystems we've tracked. Analysis + detections 👇 urlscan.io/pricing/urlscanpr…

New report 🚨 CY-Kit leverages socket-based communication and structured config files to manage phishing workflows. A flexible framework built for scalable campaign execution. The report is available on our public blog: urlscan.io/blog/2026/06/22/C…

🇮🇷 𝗔𝗯𝗮𝗯𝗶𝗹 𝗼𝗳 𝗠𝗶𝗻𝗮𝗯 𝗘𝘅𝗽𝗼𝘀𝗲𝗱: 𝗟𝗔 𝗠𝗲𝘁𝗿𝗼 𝗦𝗖𝗔𝗗𝗔 𝗕𝗮𝗰𝗸𝘂𝗽𝘀 𝗮𝗻𝗱 𝗜𝘀𝗿𝗮𝗲𝗹𝗶 𝗩𝗶𝗰𝘁𝗶𝗺 𝗗𝗮𝘁𝗮 𝗟𝗲𝗳𝘁 𝗢𝗽𝗲𝗻 𝗼𝗻 𝗮𝗻 𝗜𝗿𝗮𝗻𝗶𝗮𝗻 𝗦𝘁𝗮𝗴𝗶𝗻𝗴 𝗦𝗲𝗿𝘃𝗲𝗿 A pro-Iranian group called Ababil of Minab claimed destructive intrusions against targets in the US, Israel, Saudi Arabia, and Turkey, including a breach LA Metro confirmed in April. A later public report described the campaign but held back the rest of the victims. We found the operator's staging server sitting wide open and read the list ourselves. What AttackCapture captured at 5.255.127[.]55:8020: → 2,238 files across 545 subdirectories, around 5 GB of exfiltrated data → Over 1 GB of LA Metro SQL Server backups covering transit ops, personnel records, SCADA configs, and yard management → Named victims the public report withheld: Ruppin Academic Center, bac(.)org(.)il, adabroker(.)com(.)tr, courier(.)co(.)il, Ifat Media Group → The custom Flask receiver, the operator's bash history, plaintext Chrome password dumps, VPN credentials, and switch configs → A 404 handler that quietly redirected to fbi(.)gov to look harmless The server stayed up for at least four weeks, into late May, after the public report dropped and after the group went quiet on Telegram. That mistake handed us the full picture. Full research here 👇: hunt.io/blog/ababil-of-minab…