Fraud Campaigns Evade SIEM with Sophisticated Tactics

A really awesome model developed by Tristan Bunnage! We've increasingly seen highly sophisticated botting campaigns that incorporate RESIP proxies and mature automation capabilities to randomise sign up parameters. While our custom SIEM detection rules catch most, this model-based approach to threat detection closes any gaps and helps detect these campaigns quickly and accurately. A great example of machine learning complimenting traditional detection rules.

Every week I do a deep dive of one fraud or abuse case. This week: 120,000 fake accounts, built to test stolen credit cards. Here's the story & takeaways: ⤵️ 1. Testing the waters 😬 They created 12 accounts with disposable infrastructure (VPN, disposable email) to get a sense of the platform protections. 2. Decoding API parameters 🧑💻: They monitored API in console to see what parameters the API required. Tested it would work. 3. Bypassing 2FA 📧 They used a well known disposable email domain which allows their bot script to query the inbox, get the 2FA and then easily bypass that via API (not even browser open, just straight up automation script). 4. Bypassing IP blocking 🌐 They bought IP blocks from Vultr, Hostroyale Technologies Private Limited and others, kept rotating them (91% of the IPs used exactly once!) 5. Bypassing domain blocking 👾 They kept rotating the disposable domain providers. It was game of whack-a-mole .. kept the customers busy and away from doing actual work on their product. How did we catch them 🥷: 1. The customer checked in the checkout page that Rupt detected a real, valid, and active device attached to their account. If you're doing headless work, you cannot fake this part. 2. Automations lie! They forget to inject what real browsers come loaded with. They mismatch timezones & UA. Rupt sniffs those out too to detect bots! 3. The signals the send are too lazy. Not randomized (almost 100% uniform compared to the general population of users!) Rules worth adding this week 🛠️ 1. Velocity per email domain and IP block, at signup 2. An AI agent that classifies every new email domain the first time you see it 3. Datacenter, VPN and anonymizer scoring 4. Fingerprint consistency and impossible values 5. Bot, headless browser and automation detection 6. A challenge page a script cannot finish on its own (the important one) 7. An API that proves the earlier steps actually happened 8. Automatic tightening while volume is spiking An emailed code proves someone controls a mailbox. A texted code proves someone controls a number. Neither one proves there's a person, and this actor beat every rule above when it ran on its own. Full breakdown in the image. It works whether or not you use Rupt. --- Want these deep dives delivered to your email every week? I'm starting a newsletter here: https://lnkd.in/ganNRHGk .. subscribe and you'll get them fresh as they come out! #rupt #trustbooster

Last week I published a case study on how we caught these guys. 17,000+ IP addresses used in this attack. If you want the list of IPs to add to your risk scoring engine, DM me.

A hacking gang broke into Framework's analytics tool, called Metabase, using a security flaw nobody knew about yet — and stole customer names, email addresses, phone numbers, home addresses, and the IP addresses used to log in. Framework says every customer was affected. Business customers also had company names, VAT numbers, and billing emails exposed. Payment and order details were not taken. If you have a Framework account, change your password now and watch out for suspicious emails or calls pretending to be from them. 🚨 #CyberNewsLive https://lnkd.in/eFFW9dCP

Claude can now log into your accounts. It never sees the password. 1Password shipped this yesterday. Claude asks for a login, you approve with Touch ID, and 1Password injects the credential straight into the page. The password and the OTP never enter Claude's context, its memory, or Anthropic's systems. Claude only knows which login it used. Every agent session gets its own minted cryptographic identity, and the channel between the desktop app and the browser extension is end to end encrypted with a Noise-based protocol. The relay sitting in between is blind. It cannot read or alter anything crossing it. Best detail: during the fill, the one moment the credential actually exists in the page, the agent gets put to sleep. It stops reading the page until 1Password reports a result. On success the credential is gone before the agent looks again. On failure, every filled value is wiped before control returns. That's taint avoidance. The agent is never in the room when the secret is. Now read what 1Password says in its own accepted risks section: "the agent acts inside the signed-in session. 1Password's guarantees cover the storage, approval, delivery, and filling of credentials, not the agent's behaviour once a session exists." So the password is safe. The authority behind it is still handed to a model that reads untrusted web pages for a living. Anthropic's own red teaming took prompt injection success from 23.6% to 11.2% with mitigations, and to 1.4% on their newest model. Better. Not zero. Last week I wrote that the model's safety training is not your security boundary, the harness is. This is that idea shipped as a product. The credential stopped being data the model holds and became a capability the harness brokers. Short lived, scoped, brokered at runtime, never resident. Exactly what we've done for service accounts for a decade, just for a new kind of identity. The confused deputy problem doesn't disappear here. It just stops carrying your password around. Would you hand an agent your accounts on these terms, or is the post-login authority still too much? #security #ai #claude #backend

I asked a client how many agents they had running. They told me eleven. Then we pulled the gateway logs. Nobody had lied to me. Eleven was the number on the intake form, and the intake form was the only list anyone had. The agents that never filed one were invisible by design. Snyk measured this across 500+ assessments this year. A system-level AI bill of materials surfaces a footprint roughly 3x larger than model-only counts. Security teams are seeing about a third of what they actually run. The Cloud Security Alliance put it at 82% of organizations carrying unknown agents, and 65% having had an agent-related incident in twelve months. Here is what I think that means, and it isn't what the category is selling. Agent governance is not primarily a policy problem. It is a discovery and enforcement-location problem. Redpanda said the quiet part cleanly this month: if the agent can see the policy, it isn't governance. Four positions survive that standard. The Four Cs: 1. Census. Where does the inventory come from? If an agent has to register to be governed, the list is a self-report. Every vendor shipping this month derives it from traffic or SIEM logs instead. None of them ask the agent. That's the tell. 2. Chokepoint. Where is policy evaluated? In-prompt rules and guard models live inside the agent's address space. Enforcement belongs on the wire, at the MCP boundary, authored by the data owner and attached to the resource, not configured per agent by whoever built it. 3. Custody. Where does the evidence land? A dashboard owned by the system you're auditing is not evidence. Append-only, in your account. As of August 2, that is an EU AI Act question with a 3%-of-turnover answer. 4. Cutoff. Can you stop it without the agent agreeing? A kill switch that runs through the agent's own loop is a request. Revoke at the chokepoint instead. The pattern underneath is one question. The Cooperation Test: does this control still work if the agent actively tries to route around it? Airlock's own launch note is the reason it matters. Agents pursue alternative paths rather than stopping when blocked. A control that assumes a blocked agent gives up is modeling a program that doesn't exist. What I'd actually do: - Diff your registry against gateway traffic. The delta is your real risk report. - Run the revocation drill on one production agent and time it. If the answer is "we'd redeploy," you don't have a cutoff. Gartner puts the average F500 at 150,000+ agents by 2028, with 13% confident in their governance. Of your agent controls, how many would survive an agent that didn't cooperate? (Full breakdown in the comments.) #AgenticAI #EnterpriseAI #AIAgents #AIGovernance #MCP

You made a real business decision on survey data, and part of that data came from bots that were never your customers at all. Good research is worth paying for because it reflects real people. That is exactly why it gets attacked. When a survey or panel offers a reward for taking part, fraudsters point automated accounts and proxy farms at it to collect the incentive at scale, submitting fake and duplicate responses by the hundred. To your platform, each one looks like another participant. To your analysis, they are noise dressed up as signal, and they quietly pull your averages, your segments, and your conclusions away from the truth. The worst part is that you cannot tell which responses to trust, so you end up trusting all of them. The tell is not in the answers. It is in the connection each response comes from. Real respondents come from ordinary home and mobile connections, spread out. Fraud comes from a small set of connections working many accounts, usually proxies or datacenters, which are servers and services used to hide the real source and run accounts in bulk. IPGeolocation.io's IP Security API reads the connection behind each response and returns a risk score from 0 to 100, and flags whether it is a VPN or proxy, or a datacenter, with the provider name and a confidence level. With that, you can protect the quality of the data before it reaches your analysis: 1. Flag or block responses coming from proxies and datacenters 2. Catch bursts of entries that share the same suspicious networks 3. Keep incentive rewards going to real participants, not automated accounts Research is only as good as the people behind it. Fake respondents are how good research quietly goes wrong. How are you keeping fake respondents out of your survey data today? #MarketResearch #DataQuality #SurveyResearch #FraudPrevention

At any moment last week, about a thousand live business calls were listed in a database that any tl;dv user could read. 🎙️ AI notetaker exposed 181,874 meetings: A missing security rule on tl;dv let any authenticated user query every meeting on the platform, across 84,312 users and 35,003 domains. Records carried the creator's email and the conference ID, which for calls in progress was a joinable Meet or Teams room. The researcher reported it in January. It was still open six months later. 📊 Metabase zero-day hits Framework and Tally: Attackers exploited a flaw in the analytics tool both companies use. Metabase notified Framework on August 6 that its instance had been accessed on August 3. Stolen Framework records include names, email addresses, login IP addresses, phone numbers and billing details. 📋 Beacon CRM breach hits UK charities: Several charities have confirmed data theft following a breach at the CRM provider they share. Beacon's incident page was set to noindex, keeping it out of search results. Framework heard from its vendor in three days. The other two disclosures took a researcher and a search engine to surface. If one of your SaaS providers had a breach this morning, who in your organization would see it? Full breakdown in the slides. Sources in the comments. #DataProtection #CyberSecurity

One sentence from this post stood out to me: "Identity decides who is allowed. It doesn't enforce what the Agent actually does." As organizations embrace Agentic AI, security can no longer stop at authentication. The next evolution of Zero Trust will be centered on continuous verification of actions, not just identities. This is especially relevant for Banking, Telecom, and OT environments, where a single autonomous action can have significant business impact. Curious to hear how others are thinking about securing AI agents in production.

A week ago, this was a story about one company being breached, Hugging Face. Today Reuters reported a second. The same OpenAI agent that broke into Hugging Face also reached a customer running on Modal. Strip away that it was an AI, and this looks familiar. Something found a way in at Hugging Face through a poisoned dataset, at Modal through an unauthenticated endpoint a customer had exposed. Then it moved, took credentials, and reached what it could. That is the shape of almost every serious breach. The only new part is that the intruder was a model running at machine speed, and there are now millions of them with that skill. So stop treating entry as the thing you prevent. You will not. A capable agent, like any capable hacker armed with an advanced LLM, will keep finding a door. A phished credential, an exposed endpoint, a vulnerable dependency. Entry is a given now. What decides whether entry becomes a headline is what the intruder can reach once inside. Here is what an enterprise can do about that this week. 1. Assume they are already in, and cut lateral movement. Put default-deny between your workloads so a compromised one reaches only the systems it truly needs. Start around the crown jewels, your identity stores, data platforms, and finance systems. One foothold should stay one foothold. 2. Govern what leaves. Every workload should reach only the outside destinations it actually needs, and nothing else. Egress control is the line between an intrusion and a data breach. It is the last thing standing between a compromised box and your data leaving the building. 3. Measure the blast radius of your most critical systems, then shrink it. Take your top handful of workloads and map everything they can reach, inside and out. Close the paths that exist only because no one ever said no. Report that number and drive it down. None of this depends on catching the attack in progress, and that is the point. The set of places an intruder can reach is fixed by your architecture before they ever arrive. That is your blast radius, and in most cloud environments today, the existing blast radius is unnecessarily large. The discipline that bounds it is Communication Governance, explicit and default-deny policy on what every workload can reach and what can reach it. This is measured in days, not quarters, and almost no one has done it. The teams that start this week are the ones who will not be writing the next disclosure. When something authorized in your environment goes somewhere no one expected, what can it reach? While Aviatrix provides this capability, this isn’t a sales pitch. The question stands on its own.