We're launching urlscan Labs to bring new and experimental features to our most advanced customers earlier. As part of the launch, we're making three new tools available: * File uploads for malicious SMS / short messages. * Multisearch * Auto-Screenshots urlscan.io/blog/2026/10/08/u…

Fun project of the day - send your URLscan pages through a DGX spark and have it add it's own analysis into your browser. Works to summarise searches, individual scans, and even individual tabs within pages. (Purely a silly PoC for now)

🤖𝗡𝗲𝘄 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝗜𝗻𝘀𝗶𝗱𝗲 𝗮 𝗣𝗮𝗽𝗲𝗿𝗖𝘂𝘁 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿’𝘀 𝗔𝗜 𝗧𝗼𝗼𝗹𝗸𝗶𝘁: 𝗔𝗴𝗲𝗻𝘁 𝗜𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗶𝗼𝗻𝘀, 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗖𝗼𝗱𝗲, 𝗮 𝗦𝗲𝗰𝗼𝗻𝗱 𝗥𝗖𝗘, 𝗮𝗻𝗱 𝗩𝗶𝗰𝘁𝗶𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝟰𝟱+ 𝗖𝗼𝘂𝗻𝘁𝗿𝗶𝗲𝘀 After GreyNoise and Blackpoint Cyber published on the PaperCut campaign, our team used AttackCapture to dig into the infrastructure and recovered new intelligence from the operator’s own files. Three open directories on the attacker’s server were still in use when we pulled them What we found: ➜ A second RCE path through PaperCut’s XML-RPC API, independent of the Tapestry vulnerability chain ➜ The full AI agent instructions (19KB, Russian and English) directing a DeepSeek model through OpenAI Codex with up to 25 concurrent subagents ➜ Custom Rust credential collectors targeting Windows LSA secrets, plus chisel/cron persistence for reverse SOCKS5 tunnels ➜ Packaged victim kits covering 46 Active Directory domains, ready for reuse ➜ 1,005 hosts in the recon pool across 45+ countries, with 45 targets confirmed to have live internal pivots at time of capture This wasn’t a smash-and-grab... The operator’s own journal entries show an iterative process: batching targets, retrying failures, debugging tooling, and reorganizing victim lists with minimal human intervention. Our research reconstructs the full pipeline from the attacker’s own files 👇 hunt.io/blog/inside-papercut…

Thread 🧵 1/ NEW REPORT: Billions of advertising auctions determine in real time which ads we see on websites and in apps every day. Our latest research shows how the same data fueling this advertising ecosystem is being used to profile millions of users and silently infect targets with zero-click mercenary spyware, a novel attack technique we call "Adfection.” Read the report: citizenlab.ca/research/how-d…

Here is a small but powerful improvement to our community platform: As you enter a hostname, domain, or full URL for scanning, we can already show you whether we have scanned it before and whether we had detections of malicious activity on the domain/URL.

We're launching urlscan Labs to bring new and experimental features to our most advanced customers earlier. As part of the launch, we're making three new tools available: * File uploads for malicious SMS / short messages. * Multisearch * Auto-Screenshots urlscan.io/blog/2026/10/08/u…

🇧🇷 𝗠𝗮𝗽𝗽𝗶𝗻𝗴 𝗕𝗿𝗮𝗭𝗲𝘁𝘀𝘂 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗕𝗲𝘆𝗼𝗻𝗱 𝘁𝗵𝗲 𝗣𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗜𝗢𝗖𝘀 On 31 August, Group-IB published research on BraZetsu, a Nuitka-compiled Python framework it attributes to the Brazilian actor Exilware. The tool feeds a shop that sells access to compromised Windows hosts. We ran the published indicators against our certificate inventory. Here's what came back: → c2.installscenter[.]com was already serving TLS on a second VPS, 80.78.27[.]252 (Njalla), from 4 April. That's almost five months before the disclosure → The same host presented painel.installscenter[.]com on ports 8083 and 8443, so panel and C2 shared one apex and one IP → The original seed IP switched to a Hestia Control Panel certificate named painel.seu-dominio[.]com in February, seen 17 times through mid-March → From 26 March the C2 hostname resolved to Cloudflare, but the origin kept presenting the same certificates to our scans until June → Hashes rotated across five versions in four months. The painel. and c2. naming on non-standard ports held from February to June The post includes four HuntSQL queries, a timeline, new IOCs, ATT&CK mapping and detection logic. Read the full research 👇 hunt.io/blog/brazetsu-access…

Check out our new blog layout. If you're a visual person, then this should help you navigate what we have been up to much more quickly 🥳 - urlscan.io/blog/

The urlscan Threat Research Team analyzed 75,000+ scans to surface the web's most referenced crypto addresses. Our findings uncover live EtherHiding smart contracts on Base, Polygon, and BSC Testnet using on-chain storage to evade traditional takedowns. Report on urlscan Pro.

Using the new @urlscanio Files feature, I recently uncovered a targeted Indian eChallan malware campaign! 📱 🇮🇳 🎯 Here is how the attack chain unfolded:

Our follow-up to reporting by @Manifold_ai_sec about how agents were using the urlscan platform to bypass sandbox restrictions and access websites. We discovered additional activity and the use of burner and presumably compromised API credentials: urlscan.io/blog/2026/10/01/A…

The path traversal URLs are in Nightingale's public dataset of the swarm that OpenAI acknowledged. The attempts don't appear to have worked. Our writeup manifold.security/blog/ai-ag…

🚩 𝗧𝗵𝗮𝗶 𝗯𝗿𝗼𝗮𝗱𝗯𝗮𝗻𝗱 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝘁𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝘃𝗶𝗮 𝗙𝗼𝗿𝘁𝗶𝗚𝗮𝘁𝗲 𝗦𝗦𝗟-𝗩𝗣𝗡 𝗮𝗻𝗱 𝗠𝗲𝘀𝗵𝗖𝗲𝗻𝘁𝗿𝗮𝗹 An operator left their staging server open on Thai infrastructure. AttackCapture caught it while the intrusion was still live. Inside was the full picture of an attack against one of Thailand's largest fixed-line broadband providers. 298 files, 30 subdirectories, 19 MB. Recon scripts, exploits, brute-force tooling, a live MeshCentral config, and an inventory of machines the operator already controlled. What the toolkit shows: - CVE-2024-21762 used against a FortiGate 60F SSL-VPN, from fingerprinting to full RCE - MeshCentral set up as a backdoor, agents pointed at the operator's own management server under a dedicated device group - devices.json confirms multiple hosts were enrolled and connected at capture time, agents running as root - The provider's RADIUS databases targeted to pull subscriber credentials - A valid OpenVPN certificate from the provider's own PKI, giving persistent access to the network - A cleanup script staged to wipe logs and exploit files while leaving the MeshCentral agent in place Active session cookies for a second, linked provider point to a parallel operation, so this was not a single-org hit. Full breakdown, IOCs, and MITRE mapping here 👇hunt.io/blog/thai-broadband-…

urlscan detected a Mouse System site dropping a malicious ShellA Loader APK, analyzed by Intel471. As traditional phishing pages slow on these Chinese frameworks, threat actors may now be shifting to delivering malicious APKs through the same channels. urlscan.io/pricing/urlscanpr…

🇨🇳 🤖 𝗡𝗘𝗪 𝗥𝗘𝗦𝗘𝗔𝗥𝗖𝗛: 𝗖𝗵𝗶𝗻𝗲𝘀𝗲-𝗦𝗽𝗲𝗮𝗸𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗼𝗿 𝗨𝘀𝗲𝘀 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀 𝘁𝗼 𝗧𝗮𝗿𝗴𝗲𝘁 𝗚𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗘𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 𝗔𝗰𝗿𝗼𝘀𝘀 𝗔𝘀𝗶𝗮 Our research team identified five exposed open directories revealing a campaign that used an orchestration framework called SecFlow to coordinate Claude, Qwen, and DeepSeek AI workers across intrusions targeting government, education, consular, and healthcare systems in Asia. Key observations: - A shared SOCKS endpoint connected all five workspaces, confirmed through 120 code-search matches on our platform - The deepest compromise hit a Fengtai District government OA environment: command execution, LSASS dumps, registry hives, 822 account records extracted, and a Go implant called SecBox deployed - A Chinese education AI platform was compromised, exposing 23 agent configurations, production credentials, and student profile data across 169 conversations - SecFlow split reconnaissance, exploitation, and reporting across specialist AI workers, with the runtime swapping between Claude, Qwen, and DeepSeek without changing the task interface - GLUTTON webshells transported executable bytecode inside PNG image pixels using XOR encryption, loading directly into memory while the visible server file remained a generic decoder - A fake MySQL deserialization service delivered Linux second-stage payloads to vulnerable Java clients that connected to it - Eight CVEs in active workflows, including Shellshock, Spring4Shell, Ghostcat, Log4Shell, Shiro deserialization, Grafana and Nexus path traversals, and Nacos authentication bypass - The AI's shared context amplified a false positive: an unsupported Shiro success claim persisted and drove 27+ follow-up tasks that produced nothing This is the second separate campaign we've tracked where commercial AI models were used as operational components in intrusions. Different infrastructure and tooling from our July report, but the same pattern. Read the full report here👇 hunt.io/blog/chinese-operato…

This Pro-only Intel Brief is now available on our public blog in a slightly redacted form. Check it out: urlscan.io/blog/2026/09/03/F…

Really cool use of the limited space in the urlscan Pro UI. Use a flip effect to show more metadata about a scan before you open it. Reach out to us if you'd like to take the urlscan Pro platform for a spin.

We pivoted on NS infrastructure to uncover a UK banking phishing network powered by two central panels: FastFlux and FluxPanel. Pages prompt victims for a 6-digit code provided by a phone "advisor" to trigger downloads of a RAT disguised as verification. Report on urlscan Pro.

🎥 Operation CameraSwarm: over 14,000 Dahua cameras compromised across Ukraine and Russia NEW RESEARCH: A single operator left their entire working directory exposed on an open HTTP server. We crawled it and recovered 2,616 files, 407 MB, the full toolkit behind a 35-day camera-compromise campaign. The scanning ran global, but the confirmed compromises landed in 🇺🇦 Ukraine and 🇷🇺 Russia, with Ukraine holding the largest share. What we found: → 14,530+ devices compromised in 35 days, the brute-force engine alone reaching 12,324 unique addresses → 1,923 cameras carrying a persistent backdoor account installed over RPC, surviving a password change and, on most firmware, a factory reset → 283 cameras reached by serial number alone through the cloud relay, most requiring no authentication to open a channel → A separate Windows stealer staged on the same host, unrelated to the camera activity → The toolkit assembled from at least six upstream developers' work, not authored from scratch We assess with moderate confidence the toolkit was built to hand access to a third party, based on its transferable recovery-code design and enterprise-format export pipeline. Full breakdown, indicators, and mitigations 👇 hunt.io/blog/operation-camer…

This report is now available on our public blog as well: urlscan.io/blog/2026/08/17/I…