Anthropic is investigating unauthorized token usage in Claude Max accounts. Users reported rapid depletion of limits without activity. The company identified that compromised session keys were used to issue unauthorized OAuth tokens, potentially via third-party services. Anthropic has revoked sessions and issued partial refunds, including £44.49 to affected users.
Microsoft identified a phishing campaign using ASCII smuggling to bypass spam filters. Attackers inserted invisible Unicode tag characters into emails, targeting the financial sector. At its peak in February 2026, the campaign sent 2.37 million emails daily across 148 domains. Microsoft Defender blocked over 99% of these messages.
The Nebty startup uncovered the DoppelCart fraud network, comprising over 119 000 domains. The network mimicked 44 000 brands, offering discounts up to 65%. Attackers used WebSocket scripts to intercept payment data and one-time passwords in real time. Most sites are registered in the .shop zone and linked to 27 servers.
A vulnerability in the Airoha Bluetooth Audio SDK, found in Skullcandy Dime 3 headphones, allows unauthorized pairing without a PIN. Attackers can intercept audio or force connections. While Skullcandy released firmware 1.0.0.30 for new units, older models cannot be updated. Apple previously addressed a similar flaw in Beats Studio Buds.
