# AI-driven attackers exploit APIs via APK analysis

Published: 2026-10-21 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/2360ffdb-b3f7-5e4e-bc9e-9ec6af7ead88/ai-driven-attackers-exploit-apis-via-apk-analysis

> JPCERT/CC found attackers using AI-assisted vulnerability scanning and APK reverse-engineering to exploit APIs, causing data leaks at multiple Japanese and overseas organizations.

JPCERT/CC investigated attack infrastructure behind a series of unauthorized access incidents affecting multiple Japanese organizations and some overseas services, first alerted on October 8, 2026. The attackers used AI to scan for known vulnerabilities and conducted attacks via web and mobile APIs. Investigators found that attackers reverse-engineered Android APK files—including Flutter-based apps using tools such as Blutter (for AOT-compiled Dart code) and jadx—to identify embedded API authentication secrets, request-signing logic, and API endpoints, which could then be abused to access production APIs without the legitimate application. One server contained a Python-based SSRF testing script and evidence of SSRF probing against discovered APIs.

A separate, related server contained tooling for attacking web applications, MySQL, Jenkins, and email gateways, along with EDR evasion artifacts and web shells apparently deployed on compromised internal networks, indicating attackers sought to escalate from initial API/web compromise to broader internal access. Three attacker-controlled IP addresses were identified as part of this infrastructure.

JPCERT/CC recommends defenders avoid embedding private keys or long-lived credentials in mobile/client applications, enforce server-side authentication and authorization rather than relying on client-side request signing or obfuscation, implement API rate limiting and anomaly monitoring, and restrict/validate SSRF-prone API destinations including redirect targets. The agency is soliciting further threat-hunting collaboration from researchers to identify additional attack servers.

## Detection guidance (public sample)

### SSRF Probing Against Web/API Endpoints via Internal or Metadata Targets in Query String

ATT&CK: T1190

Web server requests whose query string carries cloud metadata hosts or SSRF-style URL schemes (gopher, dict, file), matching the SSRF probing against discovered APIs described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SSRF Probing Against Web/API Endpoints via Internal or Metadata Targets in
  Query String
id: 1833d3b2-979a-539c-ba4c-7ef477bcb76b
status: experimental
description: Detects web or API requests whose query string contains cloud metadata
  service addresses or SSRF-style URL schemes (gopher, dict, file). This matches the
  SSRF probing of discovered APIs seen in the attacker activity. Review the source
  for repeated attempts across many endpoints.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - 169.254.169.254
    - metadata.google.internal
    - 100.100.100.200
    - gopher://
    - gopher%3A%2F%2F
    - dict://
    - dict%3A%2F%2F
    - file:///
    - file%3A%2F%2F%2F
  condition: selection
falsepositives:
- Authorized vulnerability scanners or penetration tests against the API
- Legitimate webhook or URL-preview features that accept a metadata hostname during
  testing
level: medium
author: Vorant
references:
- https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. A free account opens it.

Source reporting: https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2360ffdb-b3f7-5e4e-bc9e-9ec6af7ead88/ai-driven-attackers-exploit-apis-via-apk-analysis.
In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup