This week’s cybersecurity news highlights token theft, phishing techniques, and vulnerabilities in various devices.
This week’s cybersecurity landscape has been marred by alarming incidents involving token theft, phishing schemes, and device vulnerabilities.
- Unauthorized token deductions were reported by Claude Max premium users.
- Invisible Unicode characters are being used to bypass phishing defenses.
- A network of over 119,000 counterfeit online stores has been uncovered, targeting credit card information.
- A vulnerability in Skullcandy Dime 3 headphones allows unauthorized access and sound interception.
Claude Max Users Face Unauthorized Token Deductions
Users of Claude Max have experienced unexpected deductions of tokens from their accounts, even when they were inactive. This issue was highlighted by TechCrunch.
On August 4, Grant De Swaardt, an AI consultant from the UK, noticed an unusual increase in token usage on his account without any activity. Despite disconnecting linked software, the token consumption persisted.
“During the most illustrative control period, usage jumped from 45% to 55%, even though I had not done any work,” De Swaardt noted.
Although Anthropic, the company behind Claude, suspended the account and issued a partial refund, they revealed that a compromised session key had enabled unauthorized access, although they could not determine how the breach occurred. The lack of detailed usage tracking meant the issue could have gone unnoticed for an extended period.
Many users reported similar experiences, with sudden spikes in token usage and unauthorized charges appearing on their cards. One user indicated their token usage rose from 0% to 100% in a short time without any activity.
De Swaardt ultimately canceled his subscription, expressing concerns about user protection.
Phishing Campaign Uses Invisible Unicode Characters
Microsoft experts have identified a significant phishing campaign utilizing a method known as "ASCII smuggling," which embeds invisible Unicode characters into text to evade filters.
This technique altered words in a way that kept them visually intact while allowing them to bypass spam detection systems. The financial sector, particularly focusing on loans and investments, was the main target of this campaign, which peaked at 2.37 million emails sent daily from various domains.
Microsoft Defender managed to block over 99% of these phishing attempts by analyzing domain reputation and sender history, advising users to treat emails containing tag block characters as suspicious.
Discovery of a Fraudulent Network of Online Stores
A German startup, Nebty, has uncovered a massive fraudulent network named DoppelCart, consisting of over 119,000 fake online stores, with around 105,000 still operational.
Most of these sites were registered under the .shop domain and were linked to just 27 servers. The fraudsters replicated catalogs and designs from over 44,000 legitimate brands, offering discounts to lure victims.
These counterfeit stores intercepted sensitive customer data during transactions by embedding malicious scripts on payment pages, allowing attackers to capture credit card details and bypass security measures.
Despite efforts to shut down these sites, the main hosting provider has not responded. In response, researchers have created a public database to help brands verify if they are being impersonated.
Skullcandy Dime 3 Headphones Vulnerability
A serious flaw in Skullcandy Dime 3 headphones has been reported, allowing nearby attackers to connect without user consent or PIN codes. This issue stems from a vulnerability in the Bluetooth Audio SDK.
The headphones accept pairing requests from unauthorized devices automatically, enabling hackers to intercept audio and stream their own content. This vulnerability has been patched in newer firmware versions, but older models remain at risk.
The widespread nature of this flaw in the Airoha platform affects several audio devices, pointing to a broader security concern in the industry.
In other news, the U.S. Senate is set to investigate OpenAI following recent incidents, while various security breaches continue to emerge across the tech landscape.
