News | Secawa

JadePuffer is the first documented ransomware attack carried out from start to finish by an autonomous AI agent, without human involvement in decision-making at any stage of the intrusion. The Sysdig Threat Research Team tracked down an operation in which a large language model independently exploited a vulnerability in Langflow, took over credentials, moved to a production server running MySQL and Alibaba Nacos, encrypted 1,342 configuration items, and left a note demanding a ransom in Bitcoin.

The agent did not copy the finished script. He diagnosed the cause of the error and implemented a fix at a pace unattainable for a human reading the log by hand: in a documented case, 31 seconds passed from a failed login attempt to a working correction.

JadePuffer attack at a glance

First fully autonomous LLM-driven ransomware attack reported by Sysdig in July 2026
Entry point: CVE-2025-3248, RCE vulnerability in Langflow, a popular framework for building AI applications
Primary target: separate, internet-exposed production server with MySQL and Alibaba Nacos
Agent response time to login error: 31 seconds from failed attempt to working patch
The encryption key never reached the attacker – the victim’s data cannot be recovered even after paying the ransom

The existing incident response procedures assumed that there is always a person behind a ransomware attack who can be slowed down, misled or with whom time can be negotiated. JadePuffer shows that this stage of tradecraft can now be handed over to the model.

What is ransomware?

Ransomware is malicious software that encrypts files or entire operating systems, and the unlocking of data requires the payment of a ransom, most often in cryptocurrency. This type of attack has been one of the most profitable tools in the hands of criminal groups for over a decade, because it attacks what has the greatest operational value for an organization: access to its own data.

The classic ransomware Trojan scenario looks similar regardless of the variant. Malicious code enters the system through phishing, a broken password or a software vulnerability. It then silently encrypts key data on disk and in backups, and displays a ransom note with a payment deadline.

The story shows the growing ingenuity of criminals, but also the repeatable pattern of ransomware: encrypt, demand, wait.

CryptoLocker (2013) – one of the first mass-distributed ransomware programs, spreading through infected email attachments and encrypting files with a strong asymmetric key.
CryptoLocker 2.0 – A variant rewritten in a different programming language that appeared shortly after the infrastructure of the original CryptoLocker was broken. Security researchers assessed it as a copycat using a recognizable name, not a continuation of the original code, and technically less refined.
CryptoDefense – a variant that, due to a programming error, stored the decryption key locally on the infected machine, which allowed some victims to recover their data without paying the ransom.
Diskcoder ransomware – a family of malware that destroys the disk’s master boot record, making file encryption even impossible to boot the operating system.

A ransomware group doesn’t have to write its own code from scratch today. The cybercrime market offers ready-made ransomware-as-a-service kits, and the operator’s role is often limited to selecting the target and sending the first payload. Ransomware threats have evolved from individual, proprietary programs into a service-based, repeatable business model – even before autonomous language models came into play.

JadePuffer – the first ransomware attack fully controlled by LLM

The Sysdig Threat Research Team documented Operation JadePuffer in the summer of 2026 – the first known case in which the entire ransomware attack chain, from reconnaissance to data destruction, was led by an autonomous agent based on a large language model, without human intervention at any stage of the intrusion. Sysdig calls this type of adversaryagentic threat actor (ATA) – an actor whose offensive ability comes from an AI agent rather than a manually maintained toolkit.

The attack took place on two different targets. The first compromised host served the agent only as a starting point to hack into the actual, much more valuable target.

How the JadePuffer attack worked step by step

Phase 1 – input host (Langflow)

Entry via CVE-2025-3248 – Unauthorized RCE vulnerability in the code validation endpoint of Langflow, a popular open-source framework for building LLM applications and agents. The manufacturer patched the vulnerability on April 1, 2025, and CISA marked it as actively exploited in May of the same year.
Reconnaissance and secret capture – the agent collected host data (id, uname, network interfaces, processes) and in parallel searched the environment for API keys of LLM providers, cloud credentials (including Chinese providers Alibaba, Tencent, Huawei, in addition to AWS, GCP and Azure), cryptocurrency wallets and database data.
Dump of the local Postgres Langflow database – stolen credentials, API keys and user records were saved locally, previewed, and temporary files deleted.
MinIO enumeration – The agent used the default credentials (minioadmin:minioadmin) to search the object bucket, including the terraform-state bucket. When one of the queries returned XML instead of the expected JSON, the next payload immediately adapted the parser to the new format.
Maintain access – on the Langflow host, the agent installed an entry in the task scheduler (crontab), sending a signal to the attacker’s infrastructure every 30 minutes. As a result, even a server restart did not interrupt the connection with the attacker.

Phase 2 – actual target (MySQL production server and Alibaba Nacos)

Pivot to a separate server – from the Langflow host, the agent moved to an Internet-exposed production server with a MySQL database and the Alibaba Nacos service, using a root account whose origin the researchers were unable to determine.
Nacos Takeover – In parallel, the CVE-2021-29441 authentication vulnerability was exploited, the JWT was spoofed using the publicly known default Nacos signing key, and a backdoor administrator account was injected into the database via root access.
Recognition of container escape – the agent tested writing and reading files via MySQL, checked access to docker.sock and init process files – a typical set of actions preceding an attempt to exit the container.
Encryption – All 1342 Nacos configuration elements were encrypted with the AES_ENCRYPT() function in MySQL, the original tables were deleted and in their place a README_RANSOM table was created with the ransom note, Bitcoin address and email contact.
Mass data destruction – The agent escalated from deleting single lines to DROP DATABASE commands on entire schemas, commenting in the code its own prioritization of targets according to the potential value of the data. It is worth noting: the annotation that the data was previously copied to an external server is a statement made by the agent itself, written in its own code, and not a fact confirmed independently by researchers. The actual scale of data exfiltration remains unknown.

Four pieces of evidence that the attack was directed by an LLM, not a human

Sysdig identifies four independent premises that together rule out the scenario of a fixed, pre-written script:

Code commenting on own actions. Payloads contained detailed justifications in natural language – why a given database is a priority, which is the “biggest”, what a given step is supposed to achieve. A person writing a one-time script does not do this, the language model does it instinctively.
Fault diagnosis and correction in seconds. The most precise evidence of autonomy can be seen in the sequence of creating an administrator account in Nacos:

Time (UTC)	Agent Action
19:34:24	Inserts the xadmin account with the password hash generated by the call subprocess
19:34:36	Login attempt fails
19:34:48	Tests two possible causes of error in parallel
19:35:07	Introduces a fix: direct import of bcrypt library, removal and restoration accounts
19:35:18	Login is successful

From the failed attempt to the working fix, 31 seconds passed – a time unattainable for a human reading the error log, making a diagnosis and writing a correction.

Understanding context given in natural language, not just pattern matching through the scanner – repeatable behavior in sessions weeks apart. This is the same ability of the model to interpret and respond to natural language that is sometimes abused in prompt injection attacks in other scenarios. Here, however, the agent used this ability in its own offensive action, not as the target of injected instructions.
Ambiguity around the Bitcoin address in the ransom note – this is a standard sample P2SH address replicated in the Bitcoin documentation, likely reproduced by the model from training data. However, the blockchain shows that it is also an active wallet: 737 confirmed transactions and approximately 46 BTC received throughout its history, with each inflow being immediately forwarded, and the current balance is zero. This does not resolve whether the model simply generated this address from training data or whether the operator consciously configured the agent with a real, controlled wallet, but it strengthens the argument that this is not a random, dead string. A total of over 600 separate, targeted payloads made in compressed time confirm that the operation was conducted by an autonomous agent, not a human behind the keyboard.

Consequences for the organization – why this is a wake-up call for CISOs, CTOs, CSOs and CIOs

The most serious consequence of an LLM-driven ransomware attack is not the data encryption itself, but the fact that the assumptions on which data recovery and incident response procedures have been based so far no longer work.

Paying the ransom does not guarantee data recovery. The encryption key in JadePuffer was randomly generated and never sent to the attacker – it was only entered once on the agent’s session screen. The victim will not recover 1342 encrypted Nacos configuration items even after fulfilling the ransom note’s request.
Backups do not solve the problem by themselves. The target of the attack was the live configuration database of the production server, not just the files on the disk. Backup encryption and backup procedures only make sense if the copies are isolated from the same access path used by the agent to attack the source system.
Resources like NoMoreRansom.org will not help here. Initiatives offering free data recovery work when it is possible to crack the implementation of a known ransomware family or recover a compromised key. With a randomly generated AES key that is not stored anywhere, there is nothing to crack.
The entry threshold for conducting ransomware attacks drops to the cost of running the agent. Active ransomware groups today, such as Rhysida or Qilin (which took over a large part of the market after RansomHub disappeared from the network in the spring of 2025 and was absorbed by the DragonForce cartel), are natural candidates for taking over similar agent tools.
The pace of the attack eliminates the window for response. The sequence from failed login to working patch took 31 seconds. A quarterly security review of an infrastructure that changes daily leaves gaps that an autonomous agent can exploit before anyone notices the incident.

JadePuffer is not an isolated signal that language models can be turned against an organization

We recently described how attackers convinced the Meta AI chatbot, to reset passwords and help take over 20,225 Instagram accounts – completely different vector, same mechanism: a model performing malicious actions based on what it “understood”.

The growing number of reported ransomware attacks and ransomware incidents using AI shows that this is no longer a theoretical scenario, but part of the cyberattacks in the GenAI era landscape that organizations must face today. If you want to see more such cases broken down into prime factors, in the free webinar series AI vs. Cybersecurity Secawa we covered both AI-driven attacks and attacks targeting AI systems themselves, with recordings and downloadable materials.

Free series of webinars: AI-supported attacks, Shadow AI, AI-prompt injection attacks and AI as CISO support. 4 meetings, additional materials and several SECAWA specialists who discussed the topic of AI in the context of cybersecurity in detail.

Receive recordings and materials from the AI vs Cybersecurity series

How to protect your organization against AI-driven ransomware?

Preventing ransomware attacks of this type does not require new tools, only consistent closing of vulnerabilities that JadePuffer exploited in No zero-day exploit was needed:

Patch Langflow to remove CVE-2025-3248 and do not expose execution or code validation endpoints to the internet.
Do not store API keys and cloud credentials in an AI orchestration server environment. Secrets should go to a dedicated manager, out of reach of network-accessible processes.
Harden Nacos – change the default signing key (token.secret.key), update to a version that enforces its own key, never expose the service to the Internet and never connect it to the database as root.
Do not expose the database administrative account to the Internet. Strong, unique credentials and restrictions after the source IP address are a minimum.
Introduce egress control so that a compromised application host cannot freely connect to any infrastructure or external databases.
Invest in real-time threat detection at the level of database processes, not just at the network or file signature level.
Monitor compromise indicators – unusual cron jobs with network calls, anomalies in request headers, sudden spikes in the number of requests to configuration services.

However, none of these recommendations will work without people who understand that social engineering in the era of AI agents looks different than it did just two years ago. It is also worth preparing security and IT teams for social-engineering methods supported by GenAI, because the line between a purely technical attack and one supported by manipulation is increasingly blurred.

Summary

JadePuffer changes three assumptions on which previous defense planning was based. First, the barrier to entry for conducting a ransomware attack has dropped to the cost of running an agent – and with models powered by stolen computational access, that cost approaches zero. Second, old, seemingly benign vulnerabilities – like the 2021 Nacos vulnerability – are now automatically refreshed by agents searching the entire historical CVE catalog, so neglected, unpatched infrastructure becomes a more—not less—attractive target. Third, the code generated by LLM self-describes its intent – the same feature that makes the agent dangerous gives defenders a new chance to detect an attack before it is encoded.

Threat modeling for AI-based systems is no longer an academic exercise – it is the starting point for risk assessment in any organization that implements agent-based AI tools or is a potential target of ones such as JadePuffer. You can find more about how to systematically model the threats related to prompt injection in AI systems in our previous material.

If you prefer to see these mechanisms broken down into prime factors live, we invite you to a free series of webinars AI vs. Cybersecurity, where we covered both AI-driven attacks and attacks on AI systems themselves – with recordings and downloads available.

Sources:

https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack

https://www.darkreading.com/cyberattacks-data-breaches/jadepuffer-first-complete-llm-driven-ransomware-attack

A phishing campaign using false job offers from over 30 recognizable brands steals login details to Google accounts belonging to marketing specialists. Will Thomas, senior advisor at Team Cymru, identified at least 34 domains used in this operation, which has been running continuously for at least five months

What is this phishing campaign and who does it attack?

The attack impersonates recruitment. The victim receives a message from a “recruiter” looking for candidates for marketing positions. The message contains the recipient’s name and surname and refers to his/her actual industry, which indicates prior recognition of the target’s professional profile before the fake message was sent.

What is phishing in this release?

Classically, it is an attempt to extort data or money by impersonating a trusted entity. Here, the role of a trusted entity is played by a well-known brand (Adobe, Netflix, Coca-Cola, OpenAI and several others) and by a specific, named recruiter.

The campaign differs from typical phishing attacks in that it does not lead the victim immediately to a malicious domain. It first passes it through several legitimate SaaS platforms, making it difficult to detect by standard security filters.

The operation targets only people working in marketing. This choice is not accidental. The marketing department regularly contacts external recruiters, agencies and partners, so employees in this area have a lower natural vigilance towards recruitment messages than, for example, the IT or security departments.

How the attack works: fake job offer step by step

Message from the “recruiter” with real name and photo

Attackers sign messages with the name and photo of a real recruiter employed in the impersonated company, which gives the fake job offer credibility that is difficult to verify at first glance. In one documented case, fake news impersonated Paulina Manzo, an Adidas recruiter, who publicly warned about the use of her identity on LinkedIn. She never sent such an email herself.

**Source: https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/**

Redirection chain through four platforms with two different functions

Instead of taking the victim straight to the malicious domain, the attack passes them through four successive platforms before reaching the final phishing site. It is worth distinguishing two different functions that these platforms perform in the chain.

The first three links are used to “borrow” the domain’s trust and reputation. The email is sent from PeopleForce, a real, cloud-based HR and ATS (Applicant Tracking System) platform. The link continues to exct.net, a Salesforce Marketing Cloud domain operating under the former ExactTarget brand. From exct.net, traffic is redirected to Wise Agent, a cloud-based CRM system for real estate agents, completely unrelated to recruitment. Each of these three domains has an established reputation and real business use, so spam filters that evaluate the first link in the message have no reason to block it.

The fourth link is the phishing site itself, hosted on Netlify, a free platform for publishing static websites, such as mckinsey-careers[.]com. Netlify isn’t borrowing brand reputation here like the previous three platforms. Its role is different: it is a fast, free and easy-to-rotate hosting that allows attackers to set up and replace landing pages without affecting earlier stages of the email chain. This difference is important for defenders because it requires two different types of detection: analysis of the reputation of intermediary domains and monitoring of newly registered, cheap hosting sites that are confusingly similar to your own brand name.

It is unknown how attackers gained access to PeopleForce, Salesforce Marketing Cloud and Wise Agent. They could set up test accounts specifically for the campaign or use the compromised login details of an existing customer. None of these paths require hacking into the infrastructure of the service providers themselves.

Fake Google Login Window: Browser-in-the-Browser (BitB) Technique

After reaching the final phishing page, the victim sees a “Continue with Google” button and a button to schedule a call. Clicking opens a window that closely resembles a native browser window with a Google login form, complete with a URL bar, icons, and a layout typical of a real OAuth window. In fact, it’s just HTML and CSS rendered inside the phishing page itself, not a separate system window.

This technique, known as Browser-in-the-Browser, neutralizes the most popular piece of advice given to employees: check the address in the browser bar before entering your login credentials. Since the address bar is also part of the fake graphic, the victim has no easy way to distinguish it from the real Google login page unless they pay attention to the fact that the entire window does not behave like an independent system process, for example, it cannot be moved beyond the borders of a browser tab.

What brands and sectors were used in the campaign

The campaign covers at least 34 domains impersonating companies from six different industries, which shows that the attackers did not limit themselves to one sector, but built infrastructure for a wide range of potential victims.

Airlines and Travel American Airlines, Booking.com, Delta Air Lines and United Airlines were impersonated.
In the food industry the name Coca-Cola (four separate domains, including cocacola-hr[.]com and cocacola-careerhub[.]com), PepsiCo and Red Bull were used.
In the clothing and luxury goods segment, Adidas, Louis Vuitton, Sephora and Levis became victims of impersonation.
In the area of staffing, consulting and technologythe brands used were Adobe (jobs-adobe[.]com), Aquent, ManpowerGroup, McKinsey & Company and OpenAI (careers-openai[.]com).
In hospitality and marketingMarriott and Omnicom Group suffered, and in entertainment and sports FIFA (six separate domains) and Netflix (jobsatnetflix[.]com).

The scale and sectoral scope of this campaign indicate anorganized and well-planned operation, conducted on a continuous basis, rather than a one-off incident. This does not have to mean a large budget: registering a domain and setting up a template career subpage on free hosting is a cheap and partially automated process today. It proves operational consistency and a long operating horizon rather than the scale of financing, which is difficult to estimate based on the number of domains alone.

Why marketers are the main target of this attack

Marketers fall victim to this campaign not by accident, but because their everyday work requires openness to contact with previously unknown people: agencies, freelancers, influencers, potential business partners and recruiters. This professional openness, which is an advantage in other circumstances, becomes a weakness in the context of phishing. The natural vigilance towards an unknown sender is lower in this group than, for example, in the IT or security department, where contact with external entities is subject to stricter procedures.

A marketer’s Google account can also be a gateway to resources that go far beyond just your mailbox. Many organizations use Google Workspace as a central login (SSO) mechanism for other tools, from Google Analytics and Google Ads through campaign data spreadsheets to content management platforms. So taking over one account can open access to advertising budgets, brand social media accounts and campaign data simultaneously, not just to private correspondence.

An additional risk factor is that marketers regularly click on links from external sources as part of their work: they track competitors’ campaigns, test landing pages, and analyze marketing tools. This means that clicking on a link from a “recruiter” does not evoke the same suspicion that it would in a team accustomed to a limited, verified set of external contacts.

What risk do fake recruitments pose to the organization

Operational risk: escalation via Google account and SSO

The takeover of one Google account rarely ends with the theft of private correspondence. In many organizations, this account acts as a central login mechanism for other systems, so its loss opens the door to a much wider security incident.

An attacker with access to the marketer’s mailbox gains insight into the history of communication with agencies, suppliers and internal teams, material sufficient to prepare another, even more credible attack, for example in the Business Email Compromise formula, where the compromised account is used to sending fake payment orders or changing transfer details on behalf of a real employee.

The consequence may also be the leakage of data, contact lists or access data to other tools saved in the mailbox or in Google Workspace.

Reputational risk: use of recruiters’ identity and brand

Using the name and photo of a real recruiter without his knowledge damages the company’s credibility, even when the organization itself is not to blame for the attack.

Paulina Manzo, an Adidas recruiter, had to publicly warn her network of contacts on LinkedIn that she had never sent the disputed message. This is a situation that no employee should be put into by the actions of third parties.

Candidates, partners and customers who encounter a fake job offer may persistently associate the brand with the scam, regardless of how quickly the company responded. Organizations with a recognizable name should treat monitoring domains that are confusingly similar to their own brand as a permanent element of reputation protection, not a one-time reaction to a report.

Regulatory risk: incident reporting obligations

Large organizations covered by the National Cybersecurity System and the EU NIS2 directive are obliged to report significant security incidents within specified deadlines. Taking over an employee’s Google account, which led to the leak of customer data, campaigns or access to subsequent systems, may qualify as such an incident, which shifts the responsibility for the response from the marketing department straight to the desk CISO and management.

How companies and employees can protect themselves

Browser-in-the-Browser Technique

The most effective technical answer to the Browser-in-the-Browser technique is phishing-resistant authentication: FIDO2 keys or passkeys, which bind the login process to a specific domain address. They cannot be captured through a fake window rendered in HTML because they will simply refuse to work on a page that is not real Google, no matter how legitimate it looks.

This distinguishes them from the password and classic one-time code: there is no publicly confirmed evidence that this particular campaign captures and uses an SMS or OTP code in real time to log into a real account, so simple two-factor authentication is still a real barrier to simple password capture.

FIDO2 and passkeys, however, remain the strongest security because they eliminate the risk of providing data on a fake website, regardless of how exactly the attacker’s background works.

Verification procedure

The second pillar of protection is the procedure of verifying the recruiter through company channels before the employee clicks on any link in the job message. A simple rule, checking the recruiter’s profile on the company’s website or contacting him via the official address and not via an email link, neutralizes most variants of this attack, because attackers do not have access to the real communication channels of the impersonated organization.

Monitoring of registered domains

Organizations with a recognizable brand should implement constant monitoring of registered domains that are confusingly similar to their own name (such as “-careers”, “-hiring”, “-jobs”) and have a ready procedure for reporting such domains to block fake websites at registrars and browsers, instead of reacting only after reporting from an employee or candidate.

Monitoring full redirect chains in links

IT and security teams should additionally analyze full redirect chains in links contained in emails, not just the first visible URL. This campaign shows that a filter that evaluates only the first hop of the link (the PeopleForce domain) will pass a message that leads several redirects to a phishing website. Link sandboxing and full redirect chain tracking at the mail gateway detects this technique much more effectively than static domain reputation lists.

Persistent procedures

If login details have already been provided on a suspicious website, the speed of response is key. The employee should immediately change the password to the Google account, and the IT administrator should log out all active sessions, check the mail forwarding rules and review the list of third-party applications connected to the account via OAuth. The access token for such an application may survive a password change alone, so without this review, an attacker may retain access even after the credentials are reset.

High security awareness – Practical Anti-Phishing Training

The most lasting element of defense remains the preparation of people, because this entire campaign is based on social engineering, not on malware or technical exploits. Social engineering tests show in numbers how many employees would click on a similar message, but the diagnosis itself does not build immunity – practical training in response to a specific attack scenario is needed.

Practical Anti-Phishing Training teaches the team to recognize warning signals in current, real attack scenarios. Unlike one-time theoretical training, training is based on cyclical simulations of cyberattacks tailored to the specificity of a given department, which is particularly important in teams with naturally lower vigilance towards external contacts, such as marketing. Building cybersecurity culture in such teams requires more frequent and focused exercises than standard annual company-wide training.

Thanks to PTA you can

reduce the click-through rate on phishing messages even below 4% after just a year of systematic training, and employees will start to actively report suspicious messages thanks to a dedicated extension for Gmail and Outlook,
relieve the workload of the IT team, which no longer has to prepare, conduct and analyze campaigns on its own – full responsibility for planning, simulations and reporting is taken over by Secawa team, and the involvement of the client-side coordinator is a maximum of approximately 3 hours per month,
prepare employees for a real attack. The scenarios are tailored to the nature of your industry and organizationand to the systems used in everyday work, and each failure triggersimmediate micro-training exactly at the moment when attention and memorization are the highest.
meet regulatory requirements of DORA, NIS-2, ISO 27001 and GDPR in the area of cybersecurity education – the platform automatically generates reports ready for audit or control, which constitute evidence of due diligence.

Organizations that want to see how their team would react to a message similar to the one described in this article can start with Free Phishing Test – with no cost or obligation.

Get to know our original phishing simulation platform – personalized scenarios (instead of generic templates), Polish solution (data stays in the EU) and readiness for audits and controls (GDPR, DORA, UKSC/NIS2).

Schedule a demo – Practical Anti-Phishing Training

WhatsApp is changing the way users identify themselves on the platform. From June 2026 Meta allows you to reserve unique usernames that will eventually replace your phone number as your primary contact ID. The change affects over 3 billion users in 180 countries and has a direct impact on one of the most common fraud vectors in recent years – phishing conducted by WhatsApp.

What is WhatsApp?

WhatsApp is Meta’s messaging app, used by over 3 billion people in 180 countries for private conversations, voice and video calls, and communication with businesses. The application encrypts messages end-to-end, which means that only the sender and recipient can read the content of chats, not WhatsApp itself.

Why is a change in the application important for company security?

For organizations, WhatsApp has long gone beyond the private sphere:

sales and customer service teams conduct conversations with customers through it,
employees use it on work devices,
and many companies have informal team groups.

This means that any change in the mechanism for identifying WhatsApp users is important not only for the individual, but also for the risk model of the entire organization.

The very need that Meta addresses with the introduction of usernames is simple and well known to anyone who has used group chats. As the company describes it, joining a chat with parents from your child’s sports team or neighborhood group previously required giving your phone number to people you didn’t know.

The phone number, unlike the username, is permanently linked to your identity, credit history, bank account and many other services – hence sharing it with strangers carried a risk that went far beyond the application itself.

What are usernames in WhatsApp and how do they work

A WhatsApp username is a unique identifier that the person sharing it shares instead of a phone number.

A contact who does not have a number in his address book will only see username after implementing the function, not numbers. The mechanism works on Android, iOS, Windows and the web version.

Source: https://wabetainfo.com/whatsapp-is-rolling-out-the-username-feature-on-android-and-ios/

Reservation and username generator

Reservations can be made now, although the full launch of the function will take place in the second half of 2026, gradually, country by country.

The path is short: Settings > Account > Username, after updating to the latest version of the application. The name must be between 3 and 35 characters long, contain at least one letter, and can consist of lowercase letters, numbers, dots, and underscores. It cannot start with “www.” or end with a domain such as “.com” or “.net” – this is protection against names imitating website addresses. Since over 3 billion people use WhatsApp, many obvious names are already taken, so Meta has also provided a generator that suggests variants of available usernames.

Username key as first contact control layer

In addition to the name itself, you can set an optional username key – a short code that a person contacting you for the first time must know together with the username. Without the key, the name itself is not enough to write the message. WhatsApp does not maintain any directory or search engine for users and does not suggest contacts – you need to know the exact name to start a conversation.

Option for creators, companies and organizations

Businesses who want to maintain a consistent online presence can take over a username on WhatsApp that they already have on Instagram or Facebook, after ownership is verified by the Accounts Center. This choice facilitates brand recognition, but it also has consequences, which I return to in the section about new risks.

Naming rules and restrictions

The username must be available on WhatsApp, Instagram and Facebook at the same time – if someone has previously taken it on one of these platforms, it cannot be used on WhatsApp without proof of ownership. Some names are reserved in advance for governments, public figures and companies and will not be available to you as a regular user. You can change or delete the name at any time, but once it is released, it becomes available to someone else.

Why has the phone number been WhatsApp’s weak point so far?

The phone number as an account identifier had one fundamental flaw: it was permanent, public and used many times outside of WhatsApp itself – in banking, with the operator, in two-step verification systems of other services. Each data leak that included phone numbers automatically gave criminals a ready-made list of potential WhatsApp victims.

How phishers used the phone number – verification code and call forwarding mechanism

A large group of methods is to use the WhatsApp registration process itself, for which a telephone number is required.

Verification code as the easiest way to take over your account

The attacker does not have to break any of WhatsApp’s security measures – he just needs to know the victim’s phone number. The pattern looks like this: the victim’s phone number, a request to register an account on the attacker’s device, a real six-digit code sent by WhatsApp to the victim’s number, a fake website or message prompting him to reveal this code, transfer of the code, account takeover.

The Singapore Police Force described a wave of such attacks in November 2025, in which, after taking over an account, the fraudster sent loan requests to the victim’s contacts, impersonating their credible identity (source). The mechanism is simple precisely because it is based on knowledge of the number and a moment of inattention of the account owner, not on a technical loophole in the application itself.

Call forwarding and USSD codes – limitations of the mechanism

The Indian I4C center warned in December 2025 against fraudsters impersonating couriers who persuaded victims to dial a USSD code starting with *21 and containing a number controlled by the criminal, which activated call forwarding.

It is worth being precise here: call redirection does not mean the automatic transmission of standard SMS messages, and an attack on WhatsApp is possible primarily when the attacker has previously activated the account registration on the victim’s number and chooses to transmit the code in an automatic voice call – WhatsApp officially allows receiving a six-digit code both via SMS and by phone call.

The USSD codes themselves and their operation vary depending on the country, operator and network configuration, so it is impossible to talk about one universal “Whatsapp hijacking code”.

Malicious links, QRLJacking and fake app versions – from WhatsApp Gold to today

The same goal of taking control of an account or device is also achieved without any verification code. QR codes shared in chats can, when scanned, connect the attacker’s device to the victim’s WhatsApp Web session – a technique known as QRLJacking.

The lure of “WhatsApp Gold,” a supposedly enhanced version of the app with additional features, has been circulating on chain messages since at least 2016 and recurs periodically, leading to malware or fake paywalls.

This shows that tricks based on fake updates and links are not new for 2025 or 2026 – only the packaging changes, as in the previously mentioned VBS file campaign described by Microsoft.

Other examples of cyberattacks using WhatsApp

Takeover of group administrator accounts

In a group of parents from a sports team, the administrator asked participants to provide a code supposedly needed to participate in the meeting. In fact, it was a security code for their WhatsApp accounts – an attack that Derbyshire Police and Castle Gresley Parish Council described as a wave of group account takeovers in early 2025 (source). The telephone number of each group member was the account identifier for which the attacker initiated the takeover process, and the group itself provided him with a ready list of subsequent victims and a credible excuse.

GhostPairing – hijacked by a fake pairing link

Gen Digital and Avast researchers described an attack in which the victim received an “I found your photo” message from a friend’s already compromised account, leading to a page imitating Facebook. The site guided her through the legal process of pairing WhatsApp with a new device, so the victim was unknowingly authorizing the attacker’s access (Gen Digital, Avast).

False voting in the competition as bait in a global campaign

Whalebone Threat Intelligence recorded the same pattern as GhostPairing, based on fake voting in the competition, in over 15 countries around the world – mainly in Central and Southern Europe (Czech Republic, Slovakia, Slovenia, Serbia, Romania, Bulgaria, Poland, Croatia), but also in Spain, Italy, Brazil and Mexico – with language variants tailored to local audiences and an extensive phishing infrastructure of over 200 blocked domains (source).

Impersonating loved ones from a hijacked account

A joint bulletin from Sussex Police and Surrey Police described the case of a person from Sussex who received a WhatsApp message from her sister’s compromised account asking for money and lost almost £500 before realizing she was talking to a fraudster (source). The telephone number and the resulting trust in contacts from the friends’ list are crucial here – the victim did not verify the interlocutor because the message came from an account he had known for years.

Malicious files and device infection

Microsoft described a campaign running since the end of February 2026 in which malicious VBS files were sent via WhatsApp, triggering a multi-stage chain of infections and installing MSI backdoors providing remote access to the system (source).

Fake “WhatsApp Security Center”

HKCERT warned in June 2026 against fake “WhatsApp Security Center” websites, which, under the pretext of unblocking an allegedly suspended account, encouraged people to scan a QR code or enter a pairing code (source).

What is WhatsApp phishing

Phishing via WhatsApp is an attack method in which the criminal uses a message, a voice call or a link shared in the messenger to impersonate a well-known brand, institution or person from the victim’s contacts in order to extort personal data, money or access to the account.

It differs from email phishing by several features that work to the advantage of the attacker on WhatsApp:

End-to-end encryption protects the content of conversations from eavesdropping, but at the same time means that WhatsApp cannot automatically scan chats for malicious links or fraudulent text – detecting an attack depends entirely on the recipient.
The messenger is also a space built on trust in close contacts, so a message from a “friend” or “group administrator” arouses less suspicion than an analogous email from an unknown sender.
Additionally, the message is sent to the phone with a real-time notification, which prompts a faster, less thoughtful response than in the case of email.

Phishing via WhatsApp takes many specific forms – from false verification codes and pages imitating a security center, through malicious links and files, to impersonating loved ones from a compromised account. The common denominator of all variants is the use of trust and time pressure to bypass the victim’s common sense, without breaking the technical security of the application itself.

How usernames can reduce phishing on WhatsApp

Username really hinders one specific stage of the attack: the first, unsolicited contact based on knowledge of the phone number itself.

However, it does not protect against account takeover when the attacker already knows the number, has access to the registration code or operates from the account of a person the victim knows and trusts.

What does username actually block?

Auto-dialer bots that massively scan number ranges for active WhatsApp accounts are losing their basic advantage. The number itself is no longer sufficient to establish first contact – an exact username is needed, and if the username key is enabled, an additional code is also needed.

The lack of a directory and contact suggestions also means that you can’t “browse” WhatsApp users like you can browse profiles on other social networking sites.

For victims of mass spam campaigns and first-contact scams, such as fake lotteries or job offers sent to a number from a leaked database, this is a real, measurable barrier.

What username does not block

None of the account takeover cases described earlier would have disappeared based on the username alone.

The verification code will still need to be provided if someone falls for it, regardless of whether the sender knows the number or just the username.
The pairing code and QR scanning in GhostPairing or the fake “WhatsApp Security Center” work on the victim’s device, not on their phone number.
A message from a compromised friend’s account, as in the case described by Surrey Police, reaches the victim regardless of whether he or she sees the number or name – what matters here is the identity of the interlocutor, not the form of his identifier.

In other words, username shifts the threshold for attacks based on anonymous, mass reaching out to numbers, but leaves open a whole category of attacks based on taking over an existing account, which in the source material from 2025-2026 outnumbers classic cold phishing to an unknown number.

Poland’s Digitalization Strategy until 2035 is the first comprehensive document in the country’s history that organizes the country’s digital transformation around one goal – improving the quality of life of citizens thanks to digitization. It was developed by the Ministry of Digitization, and in October 2024 it was submitted for public consultations as a project replacing the Integrated State Computerization Program.

The document organizes activities around four horizontal areas:

cybersecurity,
coordination of digital transformation,
electronic communication,
competences of the future.

They are complemented by detailed areas divided into three levels: state (including e-services, digital identity, cloud computing, open data), people (safe digital space) and economy and technologies (including artificial intelligence). In this structure, cybersecurity plays the role of a foundation that crosses other areas, and the credibility of all e-services depends on it.

The strategy sets out an increasing path of expenditure on digitalization: from approximately 0.8% of GDP in 2025 to 2% of GDP in 2030 and ultimately 5% of GDP in 2035, which corresponds to approximately PLN 100 billion annually after 2030.

Security teams will feel the effects of the Strategy very concretely. It announces:

establishment of a central institution responsible for cybersecurity based on the Joint Cybersecurity Operations Center (PCOC),
development of national and European certification schemes as a tool for supply chain security,
mechanism for identifying and limiting high-risk suppliers (DWR),
national migration plan to post-quantum cryptography,
monitoring the compliance of IT projects with the State Information Architecture.

In the following, we explain what the Strategy is, what it covers, what its schedule is and how to translate its provisions into the priorities of security teams.

What is the Polish Digitization Strategy until 2035?

Poland’s Digitization Strategy until 2035 is a cross-sectoral strategic document in the field of state computerization, which for the first time covers the digitization of the country as a whole – not as a separate ministry, but as a process permeating almost all areas of functioning of society, the state and the economy. The primary goal of the document is to improve the quality of life of citizens through digitalization by 2035

The strategy was prepared by Ministry of Digitization in cooperation with other government administration offices and with the participation of social and business stakeholders. It replaces the Integrated State Computerization Program and is intended to constitute a strategic basis for spending European funds intended for digitalization, setting the direction of negotiations for the upcoming financial perspective.

The document’s objectives are developed in related sectoral documents, including:

Cybersecurity Strategy of the Republic of Poland for 2025-2029 (adopted in March 2026, replacing the strategy for 2019-2024),
National Broadband Plan,
Digital Competence Development Program,
Data Opening Program,
Artificial Intelligence Development Policy in Poland until 2030.

The conclusion for security managers is obvious: the general provisions of the Strategy will be detailed in sectoral regulations, which will directly affect the everyday work of IT and security teams. Tracking these documents is not a formality, but a source of specific obligations.

Why was the Strategy created?

The State Digitization Strategy was created to organize the development of digital services, which have so far been built in isolation from each other, without a common direction. As Deputy Minister of Digital Affairs Dariusz Standerski put it, the document “ends this era of fragmented development of digital services” and for the first time “defines our digital plan for the next decade.”

We set specific goals – in ten years, Poland will be the leader in the digital development of Europe. By 2030, 100% of key public services will be available digitally, 85% of Poles will have basic digital competences by 2035, and we will allocate 5% of GDP to digitization.

Dariusz Standerski, Deputy Minister of Digitization

The document responds to a specific ambition: Poland is to become the leader of digitalization in the European Union, and not remain a recipient of other people’s technologies. This is achieved by measurable goals with deadlines and indicators, including:

full digital availability of key public services,
universal fiber optic and 5G coverage by 2030,
increase in digital competences of citizens, popularization of AI in offices and expenditure on digitization of the order of 5% of GDP by 2035.

The strategy also clearly defines what digitalization should not do: make people dependent, disinform or exclude. Protecting citizens’ digital rights, protecting children and young people against harmful platform mechanisms and building technological sovereignty are treated on an equal footing with the development of e-services. The whole thing fits into the EU agenda “The Road to the Digital Decade” by 2030.

What does the Polish Digitization Strategy cover?

The strategy organizes the country’s digitalization in two dimensions: four horizontal areas, which constitute the foundation of the transformation, andthree levels containing detailed areas.

Four horizontal areas

This is the starting point of the entire Strategy – areas whose condition determines the success of the rest:

Electronic communication, i.e. universal access to ultra-fast Internet, 5G and 6G networks and sovereign satellite communications.
Competencies of the future, i.e. digital skills of citizens, the number of ICT specialists and digital hygiene.
Cybersecurity, i.e. the resistance of the state, institutions and citizens to growing cyber threats.
Coordination of digital transformation, i.e. State Information Architecture, Committee for Digitization and the end of siloness in administration.

Three levels: State, People, Economy and Technologies

The remaining objectives of the Strategy are grouped into 17 areas on three levels:

State (6 areas): public e-services, digitization of administrative processes and court proceedings, systems and registers, digital identity, cloud computing, open data and data exchange.
People (4 areas): safe digital space, digital health, creative industries, digital academy.
Business and technologies (7 areas): digital transformation of enterprises, artificial intelligence, other breakthrough technologies, space technologies, financing and support for innovation, open source, digital and green transformation.

On what principles is the Strategy based?

The strategy declares the principles according to which digitalization is to take place – and they set the limits of implementation:

Technorealism – recognition that the development of technology is not the answer to all problems.
Primacy of security – the introduction of new digital solutions can never be at the expense of security, understood as cybersecurity, fundamental rights and well-being of citizens.
Just digital transition – social inclusion, accessibility for people with disabilities, workers’ rights and connection with the energy transition.
Technological neutrality – avoiding long-term dependence on one supplier.

Goals of the Polish Digitization Strategy

The strategy translates the vision into measurable goals, most of which have target values set for 2035. The most important of them:

85% of citizens with at least basic and 50% with post-basic digital competences.
At least 1.5 million ICT specialists (target: 10% share among the working population, including 35% women).
20 million digital identity wallets activated.
80% of offices and 50% of companies using artificial intelligence.
100% of IT projects for public use compliant with the State Information Architecture.
100% of matters in public entities handled electronically and 100% of entities providing e-payments.
All significant cybersecurity incidents reported to CSIRTs in a timely manner.
Universal access to mobile telecommunications services with a capacity of at least 100 Mb/s throughout the country.
At least ten times greater computing power for science in the PLGrid infrastructure (ultimately HPC of 1 exaflops and AI of 40 exaflops).
100 disease entities analyzed using AI, and all health care facilities exchange medical records electronically.

Schedule of the Polish Digitization Strategy

The strategy spreads the goals over time, from the most urgent institutional changes in 2025-2026 to the target year of 2035. Key milestones resulting from the indicator table:

2025/2026 – establishment of a central institution responsible for cybersecurity; launch of an ethical assessment system for AI tools used by the state (2025).
2026 – plenipotentiaries for computerization in all ministerial offices and the Chancellery of the Prime Minister; implementing a mechanism to identify and limit high-risk suppliers; designation of the body coordinating counteracting disinformation; mechanism for coordinating AI implementation in administration; broadband coordinators in communes and counties.
2027 – legal basis for reference public registers.
2029 – the classified cloud reaches full operational capacity.
2031 – 100% of households equipped with smart meters.
2035 – target date for most goals: digital competences, identity wallets, AI in administration, compliance of IT projects with AIP, timely reporting of incidents.

The strategy is multi-annual, therefore it provides for a permanent management cycle, i.e. review of the document every 2 years and monitoring once a year, with a report to the Committee for Digitization and publication on the website of the Ministry of Digitization.

Summary

The State Digitization Strategy until 2035 combines Poland’s digital development into one measurable plan for the first time, in which cybersecurity is one of the four foundations determining the success of the rest.

For security teams, this is not an announcement of specific changes: a central cybersecurity institution based on PCOC, mandatory sector CSIRTs, a mechanism for identifying and limiting high-risk suppliers, a national migration plan to post-quantum cryptography and linking IT projects with the State Information Architecture.

These directions become binding through related regulations, primarily amendment of the Act on the KSC implementing the NIS2 directive and the Act on the National Certification System cybersecurity. The sooner the organization translates the provisions of the Strategy into its own map of responsibilities, the lower the risk that adaptation to new requirements will become an emergency action instead of a planned one.

At the end of May, an instruction appeared on Telegram channels that allowed you to take over someone else’s Instagram account without knowing the password and without access to the victim’s mailbox. All you needed was a chat with Meta AI.

Meta confirmed that 20,225 accounts were compromised using this method, and the victims included the dormant Obama White House page, the profile of the Sephora cosmetics chain and the account of a high-ranking US Space Force officer.

How did Meta AI chat help take over Instagram accounts?

Hackers took over accounts by instructing the Meta AI chatbot to link the victim’s profile to their own email address, to which the system sent a password reset link. They didn’t crack passwords or break into other people’s mailboxes, the entire attack came down to a conversation with the chatbot.

According to Meta’s filing, the vulnerability was detected on May 31, 2026, and the Maine Attorney General’s log shows April 17 as the likely date of the first attack. This would mean that thevulnerability remained open for approximately six weeks, although Meta has not officially stated when the attacks began.

What was the vulnerability in the Meta AI chatbot?

The weak link turned out to be High Touch Support (HTS), an artificial intelligence-supported account recovery system launched in March 2026. Meta built it to relieve slow service for users cut off from Instagram.

As the company admitted in a breach report filed with the Maine Attorney General, the tool itself worked as intended, but an error in a separate code path meant that thesystem did not verify whether the specified email address even belonged to a given account. Instead of rejecting such a request, it sent a reset link to a foreign address. The mechanism that failed was a missing authorization check in the backend of the recovery process.

What did the Meta AI chat attack look like step by step?

The script itself was very simple. The attacker connected via VPN from an IP address near the victim’s typical location, probably to make the reset request look credible and not arouse the system’s suspicion.

Then it would ask for a password reset and go to the chat with Meta AI. There, he instructed the chatbot to link the account to a new email address, which received a one-time code.

This allowed me to set a new password and log in to someone else’s account. There was one condition: the victim’s account could not have two-factor authentication enabled (2FA).

What does this attack teach about the security of AI agents?

The chatbot was able to perform serious operations, such as password reset or email change, but it had no way to verify that the real account owner was asking for them. The same mistake, powerful permissions without identity checks, is repeated in a whole class of attacks targeting AI agents.

Why is chatbot a new cyber attack surface?

The problem is not the artificial intelligence itself, but the scope of powers it has been given.

This is a fundamental architectural flaw. The model was granted permissions for sensitive operations without proper access control.

Brian Westnedge, Red Sift, statement for Reuters (transl. editor)

The attack is similar to social engineering used against human consultants: instead of breaking security, the attacker simply asked to perform the operation and the system carried it out.

Some of the experts quoted by Reuters classified the incident as prompt injection, i.e. conversational manipulation of the model. It is worth noting, however, that the technical explanation of Meta’s own technical explanation points not to a vulnerability of the language model, but to a missing verification in the code handling password reset. Regardless of the classification, the conclusion remains the same: the bot was given the right to perform sensitive operations without a mechanism to check who is asking for them and on what basis.

The scale of the potential for harm increases as more platforms turn to chatbots to handle logins, password resets, and account recovery. Ian Goldin from Black Lotus Labs warns that we are entering uncharted territory and that similar attacks will increase. Engin Kirda from Northeastern University put it bluntly: People used to be the targets of fraud, now they are AI agents.

Prompt injection and the security of AI systems. How to model threats?

Read the article

How to protect your Instagram account from being taken over by hackers?

Two-factor authentication turned out to be the most effective barrier. According to the hackers themselves, the exploit did not work against any account with MFA enabled, and even the weakest variant, i.e. the SMS code, blocked it.

However, it is worth using more powerful methods, i.e. a hardware key or passkey. The SMS code, although sufficient in this case, remains susceptible to taking over the victim’s number (SIM swapping), so it should not be the only line of defense.

Since the attack involved connecting a foreign email address to the account, it is also worth checking in the Account Center whether an unknown address or phone number has been assigned to the profile and deleting such entries.

Following the discovery of the vulnerability, Meta disabled HTS and invalidated generated links, forced password resets on affected accounts and placed them under a mandatory security checkpoint, and announced a review of similar recovery processes on its platforms.

How to protect your organization against AI attacks?

The case of Instagram is a textbook example of a threat that we have analyzed in the free series “AI vs Cybersecurity”. Four episodes show not only how cybercriminals use GenAI for attacks, but also how to use AI in everyday work CISO to effectively protect the organization.

The closest episode to the described attack is episode number three: Attacks on AI. We explain how to model and minimize the risk of attacks against AI systems, including model manipulation and prompt injection. This is a related class of threats that the Meta AI case clearly exposed: an agent with the right to perform sensitive operations becomes a target when there is no control over who requests them and on what basis. In addition, we provide a shortened step-by-step guide on how to reduce such risk in practice.

The remaining episodes expand on this picture:

In the first episode – AI Atakuje – we show how criminals use AI for social engineering attacks and automation of activities; The package includes a checklist of 15 questions for CISOs and a guide to recognizing phishing.
Shadow AI(ep.2) addresses the uncontrolled use of AI tools by employees and provides the AI Act validator, a guide to the safe use of AI at work, and a checklist for managing Shadow AI in the organization.
AI as CISO support, the last episode in the webinar series, reverses the perspective and shows how to use artificial intelligence on the defense side.

Access to recordings and all materials is free. Just fill out the form on the website cyklu AI vs Cybersecurity.

Get access to recordings and materials from the free AI vs Cybersecurity webinar series

Fill out the form

Sources:

https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts

https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts

https://insideretail.asia/2026/06/04/how-the-sephora-instagram-hack-exposed-metas-ai-weakness/

https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked

https://www.reuters.com/legal/government/high-profile-meta-ai-chatbot-breach-spotlights-security-risks-automation-2026-06-03