AI-driven attackers exploit APIs via APK analysis
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
JPCERT/CC found attackers using AI-assisted vulnerability scanning and APK reverse-engineering to exploit APIs, causing data leaks at multiple Japanese and overseas organizations.
JPCERT/CC investigated attack infrastructure behind a series of unauthorized access incidents affecting multiple Japanese organizations and some overseas services, first alerted on October 8, 2026. The attackers used AI to scan for known vulnerabilities and conducted attacks via web and mobile APIs. Investigators found that attackers reverse-engineered Android APK files—including Flutter-based apps using tools such as Blutter (for AOT-compiled Dart code) and jadx—to identify embedded API authentication secrets, request-signing logic, and API endpoints, which could then be abused to access production APIs without the legitimate application. One server contained a Python-based SSRF testing script and evidence of SSRF probing against discovered APIs.
A separate, related server contained tooling for attacking web applications, MySQL, Jenkins, and email gateways, along with EDR evasion artifacts and web shells apparently deployed on compromised internal networks, indicating attackers sought to escalate from initial API/web compromise to broader internal access. Three attacker-controlled IP addresses were identified as part of this infrastructure.
JPCERT/CC recommends defenders avoid embedding private keys or long-lived credentials in mobile/client applications, enforce server-side authentication and authorization rather than relying on client-side request signing or obfuscation, implement API rate limiting and anomaly monitoring, and restrict/validate SSRF-prone API destinations including redirect targets. The agency is soliciting further threat-hunting collaboration from researchers to identify additional attack servers.
Detection guidance
SSRF Probing Against Web/API Endpoints via Internal or Metadata Targets in Query String
Web server requests whose query string carries cloud metadata hosts or SSRF-style URL schemes (gopher, dict, file), matching the SSRF probing against discovered APIs described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSRF Probing Against Web/API Endpoints via Internal or Metadata Targets in
Query String
id: 1833d3b2-979a-539c-ba4c-7ef477bcb76b
status: experimental
description: Detects web or API requests whose query string contains cloud metadata
service addresses or SSRF-style URL schemes (gopher, dict, file). This matches the
SSRF probing of discovered APIs seen in the attacker activity. Review the source
for repeated attempts across many endpoints.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 169.254.169.254
- metadata.google.internal
- 100.100.100.200
- gopher://
- gopher%3A%2F%2F
- dict://
- dict%3A%2F%2F
- file:///
- file%3A%2F%2F%2F
condition: selection
falsepositives:
- Authorized vulnerability scanners or penetration tests against the API
- Legitimate webhook or URL-preview features that accept a metadata hostname during
testing
level: medium
author: Vorant
references:
- https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,724 reports from 143 sources, 498 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs