{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/api/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-40525"}],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["CVE-2026-40525","authentication-bypass","openviking","api"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOpenViking, a bot management framework, contains a critical authentication bypass vulnerability (CVE-2026-40525) affecting versions prior to commit c7bb167. Specifically, the VikingBot OpenAPI HTTP route surface fails to enforce authentication when the \u003ccode\u003eapi_key\u003c/code\u003e configuration value is either unset or configured as an empty string. This vulnerability enables remote attackers with network access to the exposed OpenViking service to bypass authentication controls and execute privileged bot-control functionalities. This includes submitting attacker-controlled prompts, creating or manipulating bot sessions, and gaining unauthorized access to downstream tools, integrations, secrets, and sensitive data that the bot has access to. Given the potential for broad impact and ease of exploitation, this vulnerability poses a significant risk to organizations using vulnerable versions of OpenViking.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable OpenViking instance with an exposed VikingBot OpenAPI endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker checks the \u003ccode\u003eapi_key\u003c/code\u003e configuration on the target, either through misconfiguration or default settings, it\u0026rsquo;s found to be unset or empty.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request to the VikingBot OpenAPI endpoint, omitting the required \u003ccode\u003eX-API-Key\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eDue to the authentication bypass, the vulnerable OpenViking instance processes the attacker\u0026rsquo;s request without proper authentication.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes the exposed bot-control functionalities to submit malicious prompts.\u003c/li\u003e\n\u003cli\u003eAttacker creates or hijacks bot sessions, leveraging the compromised session to access downstream systems.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the bot\u0026rsquo;s permissions to access internal tools, integrations, and secrets, potentially escalating privileges.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates sensitive data or compromises downstream systems accessible to the bot.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-40525 allows attackers to completely bypass authentication controls and gain full access to bot control functionalities within the OpenViking framework. This could lead to unauthorized access to sensitive data, compromise of downstream systems and integrations, and potential financial loss. The CVSS v3.1 base score for this vulnerability is 9.1, highlighting its critical severity and the potential for widespread damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade OpenViking to a version containing commit c7bb167 or later to patch CVE-2026-40525.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, configure a strong, unique \u003ccode\u003eapi_key\u003c/code\u003e value within the OpenViking configuration to mitigate the authentication bypass.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;OpenViking Authentication Bypass Attempt\u0026rdquo; to detect unauthorized requests to the VikingBot API endpoint lacking the \u003ccode\u003eX-API-Key\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP requests to the VikingBot OpenAPI endpoint without the \u003ccode\u003eX-API-Key\u003c/code\u003e header to identify potential exploitation attempts using the \u0026ldquo;OpenViking API requests without API Key\u0026rdquo; Sigma rule.\u003c/li\u003e\n\u003cli\u003eReview access logs for downstream systems connected to OpenViking for any unauthorized activity originating from the OpenViking server following potential exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-17T19:16:39Z","date_published":"2026-04-17T19:16:39Z","id":"/briefs/2024-02-openviking-auth-bypass/","summary":"OpenViking versions prior to commit c7bb167 are vulnerable to an authentication bypass that allows remote attackers to invoke privileged bot-control functionality without authentication when the api_key configuration is unset or empty, potentially leading to unauthorized access to downstream systems and data.","title":"OpenViking Authentication Bypass Vulnerability (CVE-2026-40525)","url":"https://feed.craftedsignal.io/briefs/2024-02-openviking-auth-bypass/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["idor","cross-tenant","api","paperclip","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA critical vulnerability exists in the Paperclip control-plane API, specifically in versions prior to 2026.416.0. The vulnerability allows a board user with membership in one company (e.g., Company A) to manipulate agent API keys for agents belonging to a different company (e.g., Company B). This is due to an Insecure Direct Object Reference (IDOR) in the \u003ccode\u003e/agents/:id/keys\u003c/code\u003e routes (GET, POST, DELETE) where the API only validates the user\u0026rsquo;s board-type session but fails to verify access to the company owning the target agent. By exploiting this flaw, an attacker can mint a new agent API key for an agent in the victim tenant, granting them full agent-level access within that tenant. This cross-tenant compromise allows the attacker to execute workflows, read data, and call any endpoint authorized for agents in the victim tenant, effectively breaching tenant isolation. The vulnerability was introduced due to missing company access checks in the key-management routes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker authenticates as a board user within Company A.\u003c/li\u003e\n\u003cli\u003eThe attacker discovers or obtains the UUID of an agent belonging to Company B.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a POST request to \u003ccode\u003e/agents/\u0026lt;VICTIM_COMPANY_B_AGENT_ID\u0026gt;/keys\u003c/code\u003e with a name to create a new API key.\u003c/li\u003e\n\u003cli\u003eThe server, lacking proper authorization checks, creates a new API key associated with the victim agent\u0026rsquo;s \u003ccode\u003ecompanyId\u003c/code\u003e and returns the cleartext token.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the newly minted agent token in the \u003ccode\u003eAuthorization\u003c/code\u003e header to authenticate subsequent requests.\u003c/li\u003e\n\u003cli\u003eThe server\u0026rsquo;s authentication middleware incorrectly sets the \u003ccode\u003ereq.actor\u003c/code\u003e to an agent type associated with the victim\u0026rsquo;s company.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully accesses resources and executes actions within Company B\u0026rsquo;s tenant, bypassing company access checks.\u003c/li\u003e\n\u003cli\u003eThe attacker can enumerate and revoke existing keys using the \u003ccode\u003e/agents/:id/keys\u003c/code\u003e and \u003ccode\u003e/agents/:id/keys/:keyId\u003c/code\u003e endpoints, causing denial of service to legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to a full cross-tenant compromise. An attacker can gain unauthorized access to any tenant within the Paperclip instance, provided they have a minimal valid account (board user in any company) and a victim agent UUID. This allows the attacker to execute workflows, read sensitive data, and call any authorized endpoint within the victim tenant, leading to complete confidentiality, integrity, and availability loss. Furthermore, the attacker can revoke legitimate agent keys, resulting in a denial of service. This represents a scope change, where a vulnerability in Company A\u0026rsquo;s scoping checks results in catastrophic impact within Company B\u0026rsquo;s tenant.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement explicit company-access checks on the \u003ccode\u003e/agents/:id/keys\u003c/code\u003e (GET, POST) and \u003ccode\u003e/agents/:id/keys/:keyId\u003c/code\u003e (DELETE) routes before interacting with the service layer. This directly addresses the core issue as described in the advisory\u0026rsquo;s \u0026ldquo;Recommended Fix\u0026rdquo; section.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Paperclip Cross-Tenant API Key Creation\u003c/code\u003e to identify unauthorized API key creation attempts.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Paperclip Cross-Tenant API Access\u003c/code\u003e to detect unauthorized access using stolen agent tokens.\u003c/li\u003e\n\u003cli\u003eUpgrade to npm/@paperclipai/server version 2026.416.0 or later to patch the vulnerability as mentioned in the advisory\u0026rsquo;s \u0026ldquo;Affected Packages\u0026rdquo; section.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-16T22:49:46Z","date_published":"2026-04-16T22:49:46Z","id":"/briefs/2026-04-paperclip-idor/","summary":"A Paperclip API vulnerability allows a board user from one company to create, list, and revoke agent API keys in another company, leading to full cross-tenant compromise due to insufficient authorization checks on `/agents/:id/keys` routes.","title":"Paperclip Cross-Tenant Agent API Key IDOR Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-paperclip-idor/"},{"_cs_actors":["Kimsuky","Black Banshee","Velvet Chollima","Emerald Sleet","Thallium"],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["kimsuky","dropbox","api","command-and-control","exfiltration"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eKimsuky, a North Korean APT group, has been observed utilizing malware that leverages the Dropbox API for command and control (C2). This allows the malware to blend in with legitimate network traffic, making detection more challenging. The malware uses the Dropbox API to upload stolen data and download commands from the attackers. This method provides a covert channel for exfiltration and control, bypassing traditional network-based security measures. The group has been known to target South Korean entities, but the scope of targeting may extend beyond this region. This technique has been observed starting in early 2026.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is gained through an unconfirmed vector, such as spear phishing or watering hole attacks, delivering an initial downloader.\u003c/li\u003e\n\u003cli\u003eThe downloader executes and establishes persistence, potentially by creating scheduled tasks or modifying registry keys.\u003c/li\u003e\n\u003cli\u003eThe malware initializes the Dropbox API, authenticating with stolen or embedded API keys.\u003c/li\u003e\n\u003cli\u003eThe malware enumerates files on the compromised system, targeting documents, credentials, and other sensitive data.\u003c/li\u003e\n\u003cli\u003eStolen data is compressed and encrypted before being uploaded to a designated Dropbox folder controlled by the attacker, using the Dropbox API.\u003c/li\u003e\n\u003cli\u003eThe malware periodically checks the attacker\u0026rsquo;s Dropbox folder for new commands, also using the Dropbox API.\u003c/li\u003e\n\u003cli\u003eDownloaded commands are decrypted and executed on the compromised system, enabling actions such as remote code execution or further data exfiltration.\u003c/li\u003e\n\u003cli\u003eThe cycle of data exfiltration and command execution continues, allowing the attacker to maintain persistent access and control over the compromised system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful attacks can lead to significant data breaches, intellectual property theft, and espionage. Kimsuky\u0026rsquo;s targeting of South Korean entities suggests a focus on political and strategic intelligence gathering. The use of Dropbox as a C2 channel allows the attackers to remain undetected for extended periods, maximizing the impact of the compromise. The number of victims is currently unknown, but the potential for widespread compromise is high.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor network traffic for unusual API calls to Dropbox, especially from unknown or suspicious processes (see: \u0026ldquo;Detect Suspicious Dropbox API Usage\u0026rdquo; Sigma rule).\u003c/li\u003e\n\u003cli\u003eImplement strict access controls and monitoring for Dropbox API usage within the organization.\u003c/li\u003e\n\u003cli\u003eInvestigate and block any suspicious processes attempting to access Dropbox API endpoints.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-19T12:00:00Z","date_published":"2026-03-19T12:00:00Z","id":"/briefs/2026-03-kimsuky-dropbox-api/","summary":"Kimsuky is using malware that leverages the Dropbox API for command and control, enabling file exfiltration and remote code execution.","title":"Kimsuky Malware Using Dropbox API for Command and Control","url":"https://feed.craftedsignal.io/briefs/2026-03-kimsuky-dropbox-api/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Okta"],"_cs_severities":["medium"],"_cs_tags":["okta","api","token","revocation","identity"],"_cs_type":"advisory","_cs_vendors":["Okta"],"content_html":"\u003cp\u003eThis alert focuses on detecting the revocation of Okta API tokens. Okta API tokens are used to authenticate and authorize applications to access Okta\u0026rsquo;s APIs. When a token is revoked, it means that the token is no longer valid and can no longer be used to access Okta\u0026rsquo;s APIs. This can happen for a number of reasons, including: a user manually revoking the token, an administrator revoking the token, or Okta automatically revoking the token due to inactivity or security concerns. Detecting API token revocations is crucial because it can indicate that a token has been compromised and is being used by an attacker. A revoked token could be a sign of successful lateral movement or data exfiltration attempts within the Okta environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: An attacker gains unauthorized access to an Okta API token through methods like phishing, credential stuffing, or malware.\u003c/li\u003e\n\u003cli\u003eAPI Usage: The attacker uses the stolen API token to access Okta\u0026rsquo;s APIs, potentially gathering sensitive information or modifying user accounts.\u003c/li\u003e\n\u003cli\u003eAnomaly Detection: Okta\u0026rsquo;s security mechanisms or custom alerts identify unusual activity associated with the API token, such as access from unfamiliar locations or excessive API calls.\u003c/li\u003e\n\u003cli\u003eInvestigation Triggered: Security personnel initiate an investigation based on the flagged anomalous activity.\u003c/li\u003e\n\u003cli\u003eToken Revocation: As part of the incident response process, the compromised API token is manually or automatically revoked to prevent further unauthorized access. This action generates a \u0026ldquo;system.api_token.revoke\u0026rdquo; event in the Okta system log.\u003c/li\u003e\n\u003cli\u003ePost-Revocation Analysis: Security teams analyze the events leading up to the token revocation to identify the root cause of the compromise and assess the scope of the attacker\u0026rsquo;s activities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful compromise of an Okta API token can lead to significant damage, including unauthorized access to sensitive user data, modification of user accounts and permissions, and disruption of critical business operations. If not detected promptly, attackers can leverage compromised tokens to escalate privileges, move laterally within the Okta environment, and potentially gain access to other connected systems. A single compromised API token could affect hundreds or thousands of users, depending on the scope of access granted to the token.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect \u003ccode\u003esystem.api_token.revoke\u003c/code\u003e events in Okta logs.\u003c/li\u003e\n\u003cli\u003eInvestigate any detected \u003ccode\u003esystem.api_token.revoke\u003c/code\u003e events to determine the cause of the revocation and assess the potential impact.\u003c/li\u003e\n\u003cli\u003eReview Okta system logs for anomalous activity prior to the token revocation to identify the source of the compromise.\u003c/li\u003e\n\u003cli\u003eImplement multi-factor authentication (MFA) for all Okta users to reduce the risk of credential compromise.\u003c/li\u003e\n\u003cli\u003eRegularly audit and review Okta API tokens to identify and revoke unused or overly permissive tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-okta-api-token-revoked/","summary":"Detection of Okta API token revocation events, indicating potential unauthorized access or compromise.","title":"Okta API Token Revoked","url":"https://feed.craftedsignal.io/briefs/2024-01-okta-api-token-revoked/"}],"language":"en","title":"CraftedSignal Threat Feed — Api","version":"https://jsonfeed.org/version/1.1"}