58 results for “Sim”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types435 Articles160 Papers160 Write-ups58 Repos19

More types7

Threads11 Tools10 Advisories7 Talks6 Other2 Courses1 Videos1

✍️ Write-ups “Sim”Clear all

simonwillison.netwriteup🧠 AI

The October inflection point for vibe game development

Simon Willison argues October 2026 is an inflection point for vibe coding games, because Claude Opus 5.5 can now handle 3D modeling, music and game design. He describes four browser games built with three.js (Tree Appreciator, Emberwick, Battle Drones, Quarter Sun Cove), with the prompts used, a comparison against GPT-6 models, and advice to start with "Build a mobile-friendly three.js game where...".

three.jsPhaserClaude+7

Simon WillisonClaude Opus 5.5Claude Fable 5+6

coding-agents, prompting, models· Published and added 28 Oct 2026

huggingface.cowriteup🧠 AI

Train in Simulation, Deploy on a Real Robot: Microduck with Isaac Lab 3.0

Tutorial for training a walking policy for Microduck, an open-source bipedal robot from Pollen Robotics and Hugging Face, in NVIDIA Isaac Lab 3.0 with Newton. It covers RSL-RL training with the backlash preset, BAM actuator models and domain randomization, then ONNX export (61 observations, 14 joint-position actions) and deployment with robotctl. Policies can be shared on the Hugging Face Hub or tested in Microduck Arena.

Isaac LabNewtonMJWarp+7

NVIDIAPollen RoboticsMicroduck+2

training· Published and added 21 Oct 2026

simonwillison.netwriteup🧠 AI

Battle Drones - a vibe coded RTS with audio-based multiplayer

Battle Drones is a browser-based Command & Conquer style RTS that Simon Willison built over 12 iterations and 321 commits, mostly with Claude Code and Claude Opus 5.5. The post gives key prompts and transcripts per version, including the "Make it a LOT more fun" run in Ultracode mode. It also covers an Agent vs. Agent mode for LLMs, audio-modem multiplayer between nearby phones, and lessons on deterministic simulation and code-generated 3D models and music.

Claude CodeTypeScriptThree.js+6

Simon WillisonClaude Opus 5.5Claude Fable 5+5

coding-agents, agents· Published and added 20 Oct 2026

rekt.newswriteup🛡️ Security

Factory Sealed – Rekt (Ledger/CryptoBilis hardware implant drains)

Rekt write-up on LTE-equipped hardware implants found in Ledger Nano X and Flex wallets sold through resellers such as CryptoBilis and MediaMarkt. The implants read the recovery phrase off the screen during setup and exfiltrate it over an eSIM/LTE modem, so Ledger's Genuine Check and Secure Element never detect them. It covers the teardown timeline (Joe Grand, Mark Karpelès, a Japan-based researcher), the 47-minute multi-chain drain (Bitquery estimates about $102M across 324 wallets, unverified by Ledger), the laundering path via USDD, THORChain, Tornado Cash and Zcash, the CryptoBilis ownership change, and the failure of "authorized reseller" trust.

LedgerTrezorTron+3

CryptoBilisMark KarpelèsJoe Grand+14

Blockchain, Hardware & RF, Threat Intel· Added 17 Oct 2026

hackers-arise.comwriteup🧠 AI

Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

Hackers-Arise tutorial on NVIDIA's open-source NemoClaw, which runs OpenClaw (and Hermes or LangChain Deep Agents) inside OpenShell sandboxes. OpenShell provides kernel-level isolation and declarative YAML policies for files, credentials and network access. It covers OpenClaw's risks (543 tracked CVEs, 40,000+ exposed instances), an OpenClaw vs NemoClaw comparison, the caveat that sandbox escapes and core-logic zero-days remain possible, and a Docker/Node.js install via the nemoclaw.sh wizard with TUI testing. It also cites the Cisco AI Defense plus OpenShell case study, in which an agent that does security patching was protected against a simulated exfiltration attempt.

OpenClawNemoClawOpenShell+7

NVIDIAPeter SteinbergerJensen Huang+4

agents, ai-infra· Published and added 14 Oct 2026

blog.trailofbits.comwriteup🛡️ Security

Package managers have an integrity problem

Trail of Bits tested 25 popular package managers with a Docker and mitmproxy harness that simulates a compromised package repository injecting malware into legitimate packages. Fewer than half enforce lockfile hashes by default, only two verified every download, and only Go verifies signatures by default. The post covers lockfile hash pitfalls (Pub, pnpm, Conan, CocoaPods, Composer), repository, developer and Sigstore signing, and Go's checksum database. It also proposes lockfiles that commit to a signing identity plus a transparency log.

npmpnpmGo+3

Trail of BitsPEP 740cpanminus+5

Supply Chain· Published and added 14 Oct 2026

kylekukshtel.comwriteup🧠 AI

How to engineer an AI harness for game development

Blog adaptation of an Indie Rodeo talk arguing that LLMs struggle with games because much of a game is opaque non-code, and that this is a context problem. It prescribes concrete architecture so a game becomes its own agent harness: seeded randomness, a single "Thing" fat-struct object model, serializable commands, external data editable without recompiling, a standalone simulation core, odiff image diffing for screenshot evaluation, and samply text profiling. The aim is an agentic loop that runs in seconds per change.

Claude Codeodiffsamply+6

Kyle KukshtelDepotCantata+7

agents, coding-agents, llm-apps· Published and added 13 Oct 2026

huggingface.cowriteup🧠 AI

Impactful scheduling for GPU clusters

Ai2's AI Infrastructure team describes replacing a priority-based scheduler on thousands of H100/B200/B300 GPUs with GPU time budgets, hierarchical fair-share over a 7-day lookback window, and a "scheduling contract" where workloads declare a minimum runtime (capped at 8 hours) to enable time-slicing. Results over 30 days: 98% of owed GPU hours delivered, occupancy steady at 98%, debug-workload p90 queue wait down from about 2 hours to 30 seconds, and 74% fewer repairs needing a human. It also covers a simulator used to predict outcomes before rollout, plus problems that remain: interactive sessions hurt by preemption and possible capacity fragmentation.

SLURMYARNHadoop+3

Ai2NVIDIADominant Resource Fairness+1

ai-infra, training· Published and added 9 Oct 2026

blog.talosintelligence.comwriteup🛡️ Security

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Cisco Talos details UAT-11985, a spear-phishing campaign against Taiwan-based research organizations (impersonating institutions like the Taiwan European Union Centre and NCCU Institute of International Relations) that used AI-assisted, templated lure emails and poster-based QR code phishing (quishing) to drive victims to a real-time adversary-in-the-middle phishing kit. The kit impersonates Google sign-in across zh-CN/zh-TW/en locales, uses a split HTTP-POST/WebSocket architecture to mirror Google's live authentication flow and dynamically push MFA challenge screens, enabling full session-token theft and MFA bypass. Talos attributes the kit's localization architecture and lexical choices to a Simplified Chinese-speaking developer and publishes ClamAV/Snort coverage plus IOCs on GitHub.

Google

UAT-11985Taiwan European Union CentreNCCU Institute of International Relations+5

Threat Intel, Identity & Access· Published and added 8 Oct 2026

simonwillison.netwriteup🧠 AI

llm-openai-decisions 0.1a0

Simon Willison built llm-openai-decisions, a plugin for his `llm` CLI tool that wraps OpenAI's newly announced Decisions API (unveiled at DevDay), modeled on his existing llm-typesafe plugin for Jev's competing API. Both APIs support structured yes/no, multiple-choice, and score-style questions, but OpenAI's gpt-6-luna model also accepts image input (at 10 cents per million input tokens, versus Jev's 4.2 cents), and the plugin itself was built by having GPT-6 Astra read OpenAI's docs. The post includes install instructions and a worked example querying an image attachment for a yes/no answer.

OpenAI APIllm

Simon WillisonOpenAIJev+3

prompting, multimodal· Added 7 Oct 2026, published 6 Oct 2026

hackers-arise.comwriteup🛡️ Security

CUDA Basics for Hackers, Part 1: Getting Started

First part of a Hackers-Arise series teaching CUDA (NVIDIA Compute Unified Device Architecture): installing the CUDA toolkit and nvcc compiler on Kali or Debian-based Linux, writing a basic CUDA C++ kernel, and compiling and running a simple parallel vector-addition program. It explains GPU threading concepts (kernels, thread blocks, grids) and frames CUDA as foundational to AI workloads and to future security applications like password cracking, real-time threat detection and post-quantum cryptography, though those applications are only listed, not demonstrated, here.

Kali LinuxLinuxDebian

Master OTW

Learning· Added 7 Oct 2026, published 6 Oct 2026

securitylabs.datadoghq.comwriteup🛡️ Security

Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access

Datadog Security Labs describes how attackers test stolen AWS credentials for Amazon Bedrock access. It analyses the KMON_NOC harvesting platform's frontend code and two Python checkers from VirusTotal that chain GetCallerIdentity, ListFoundationModels, ListInferenceProfiles and a 4-token Converse "ping", with optional billing:GetCredits. Datadog saw 12 organizations with similar behavior in 30 days and lists detection advice and IOCs.

AWS BedrockAWSAWS IAM+3

KMON_NOCLLMjackingcredential validation+8

Cloud & Infra, Threat Intel, Blue Team & Detection· Added 29 Oct 2026, published 6 Oct 2026

stepsecurity.iowriteup🛡️ Security

Active Supply Chain Attack: Malicious node-ipc Versions Published to npm

StepSecurity's AI Package Analyst detected three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) published simultaneously on May 14, 2026 by a rogue/compromised maintainer account, injecting an 80KB obfuscated IIFE into the CommonJS bundle that harvests 90+ credential file categories (AWS, Azure, GCP, SSH, Kubernetes, GitHub, Claude AI/Kiro configs, Terraform, etc.) and exfiltrates them via HTTPS and raw DNS TXT queries to a typosquatted Azure-mimicking C2 domain. The writeup includes a full stage-by-stage technical teardown (daemonization, SHA-256 targeting gate on 12.0.1, custom base-16 nibble-reversed obfuscation, dual-channel exfiltration) plus file hashes, network IOCs, and remediation guidance for developers and CI/CD pipelines.

node-ipcnpmNode.js+2

peacenotwarRIAEvangelistBrandon Nozaki Miller+2

Supply Chain, Threat Intel· Added 5 Oct 2026

vals.aiwriteup🧠 AI

Opus 5.5 agents discover two room-temperature magnetic semiconductor candidates

Vals.ai researchers describe using Claude Opus 5.5-driven AI agents to run density-functional-theory simulations (PBE+U and HSE06 functionals) that designed a novel candidate magnet, YBaMnFeO₅, and separately re-identified a 1999 compound, KV[Cr(CN)₆] (a Prussian-blue analogue), as a "Luttinger compensated" semiconductor — a material with zero net magnetic moment but spin-sorted band edges, useful for spintronic memory. The agents predicted band gaps, spin-sorting windows, and magnetic ordering temperatures (KV[Cr(CN)₆] reportedly stays ordered above room temperature, up to 376 K), and the authors published all inputs, outputs and code on GitHub for independent verification. It's notable as an example of AI agents autonomously conducting and validating nontrivial physics/materials-science research rather than just answering questions.

density functional theory

Vals.aiClaude Opus 5.5YBaMnFeO₅+1

agents· Added 6 Oct 2026, published 5 Oct 2026

simonwillison.netwriteup🧠 AI

Qwen3.8 27B addition in words

Simon Willison reproduces an experiment originally run by Colin Frasier on GPT-4o — asking a model to add two large numbers and return the result spelled out in words — this time against a locally quantised Qwen3.8-27B-Q4_K_M.gguf model on an NVIDIA DGX Spark. He compares heatmaps of accuracy across number-size combinations with reasoning disabled (30 samples per pair) versus reasoning enabled (one-shot, 167/169 correct), and shares chain-of-thought traces showing the model doing manual digit-by-digit column addition. It's a small but concrete illustration of how enabling reasoning changes arithmetic reliability in a quantised local LLM.

GGUFQwen3.8-27BCodex

Simon WillisonColin FrasierGPT-4o+2

evals, inference· Added 5 Oct 2026, published 4 Oct 2026

github.comwriteup🛡️ Security

Xray-core concealed a certificate verification bypass vulnerability

A security researcher's first-person disclosure describing a certificate verification bypass in Xray-core (a popular censorship-circumvention proxy): when its pinnedPeerCertSha256 option skips regular TLS verification, a MITM attacker can insert a leaf certificate anywhere in the certificate chain and have the custom pinning logic incorrectly validate it, effectively eliminating certificate verification. The writeup also documents how the vulnerability was silently fixed with a misleading "simplify the code" commit message and left undisclosed to users for nearly half a year until the reporter filed a GitHub Security Advisory.

Xray-core

pinnedPeerCertificateChainSha256pinnedPeerCertSha256allowInsecure+1

AppSec· Added 5 Oct 2026, published 4 Oct 2026

blog.trailofbits.comwriteup🛡️ Security

SequenceHash: multihashing for the rest of us

Trail of Bits introduces SequenceHash and its keyed variant SequenceMAC, hash-agnostic multihashing constructions similar in goal to NIST's TupleHash but not tied to Keccak, working with SHA256/384/512, BLAKE, and RIPEMD. The spec, now part of the Community Cryptography Specification Project, provides unambiguous input encoding, length-extension prevention, built-in customization strings, and HMAC-style keyed MACs that avoid HMAC's key-pseudocollision issues; reference implementations ship in Rust, Go, and Python with full test vectors.

RustGoPython

TupleHashHMACNIST SP 800-185+10

AppSec· Published and added 2 Oct 2026

ethresear.chwriteup🛡️ Security

Trust minimized transaction simulation using state proofs

An ethresear.ch post proposing "verified prestate simulation": wallets fetch the prestate a transaction will touch via debug_traceCall's prestateTracer, confirm unanimous state-root agreement across multiple independent RPC nodes, verify each account/storage value with eth_getProof Merkle Patricia Trie proofs, and only then execute the transaction locally with revm to produce trustworthy simulation results. It targets a concrete wallet attack where a compromised simulation API/RPC provider shows a benign fake trace (e.g. "donate to charity") while the real calldata drains a user's funds, and discusses its limitations (prestate-completeness not yet verified, conditional-logic and MEV evasion still possible) as a pragmatic alternative to full light clients.

EthereumrevmRust

Blockchain· Published and added 1 Oct 2026

huntress.comwriteup🛡️ Security

Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers

Huntress details a four-act intrusion against a shared parks-and-recreation management platform running on IIS, where an attacker first tried noisy unauthenticated exploits (IIS 8.3 tilde enumeration, WebDAV verb abuse, upload-handler bypasses) before simply registering a member account and uploading .aspx webshells via a member-file upload feature across three servers. The attacker enumerated hosts, extracted web.config/connection strings, hunted for cardholder data (Fortis/MXMerchant webhook logs, CVV/card-number strings), then escalated to timestomping, re-deploying known-filename webshells, and finally injecting an AI-generated PowerShell/JS dropper into a trojanized jQuery file to turn site visitors' browsers into WebRTC/WebSocket C2 clients (ririmochii/bubuneeko Cloudflare Workers infrastructure). Includes a zh-CN PowerShell user-agent string used for attribution and full command/IOC listings useful for detection engineering.

IISPowerShellWindows+3

ririmochii[.]workers[.]devbubuneeko[.]workers[.]devIIS 8.3 tilde enumeration+2

Threat Intel, Blue Team & Detection, Offensive Security· Added 1 Oct 2026, published 30 Sep 2026

simonwillison.netwriteup🛡️ Security

OpenAI DevDay 2026 live blog

Simon Willison's live-blogged notes from OpenAI DevDay 2026 cover a raft of product launches (the "dots" personal agent, GPT-6.1 Sol, Ultrafast inference, ChatGPT Sites, GPT-Live), but the security-relevant core is the Codex Security session: OpenAI describes an internal "Defense Factory" security sprint that fixed 53 critical findings in a day, and launches a major Codex Security Cloud upgrade plus an open-source Codex Security CLI. The tool builds a security knowledge base, reads per-repo SECURITY.md threat-model files, runs a looping scanner, deduplicates findings (36% of their internal findings were duplicates), and can auto-generate patches/PRs validated by a "verify-fix" adversarial agent (1% rollback rate).

OpenAI CodexChatGPTOpenAI

Codex Security CloudCodex Security CLIDefense Factory+6

AI Security, DevSecOps· Added 7 Oct 2026, published 29 Sep 2026

simonwillison.netwriteup🧠 AI

Kākāpō Party

Simon Willison describes prompting Claude Opus 5.5 with reference photos to generate an animated pixel-art HTML5 canvas scene (kākāpō parrots partying with confetti), then using a local Claude Code session to drive Playwright, click through the page at scripted timestamps, and record a 15-second video of the result for a keynote slide. The post includes the full Playwright script Claude Code produced, showing how a coding agent can be tasked with browser automation and video capture as an end-to-end deliverable, not just code generation.

Claude CodeClaude Opus 5.5Playwright+2

multimodal, coding-agents· Added 29 Sep 2026, published 26 Sep 2026

atredis.comwriteup🛡️ Security

Finding Gadgets Like It's 2026 (Atredis Partners)

Atredis Partners built an LLM-driven pipeline (WALA/ASM call-graph builder, a FastAPI graph query server, Claude Code as the reasoning/validation agent, and a dynamic test/debug runner) to automate discovery of Java deserialization gadget chains against modern, hardened application servers (WebSphere, WildFly, Payara). The project found 17 confirmed chains, 6 novel, including CB1-Shaded-RCE — a chain that bypasses JPMS's TemplatesImpl restrictions via a shaded/relocated copy of Xalan's XSLTC shipped inside WildFly's JSTL jar, giving RCE on the latest WildFly on JDK 21 — plus a novel JNDI-injection chain in Payara via AttributeComparator/InjectableJMSContext. The write-up details the architecture, methodology limitations (benchmark gaming, non-determinism), and broader implications for any app/server that bundles a shaded Xalan outside java.xml, with tooling released on GitHub (atredispartners/llmchainhunter).

JavaClaude CodeWildFly+3

GadgetInspectorJPMSTemplatesImpl+10

AppSec, AI Security, Offensive Security· Added 25 Sep 2026

simonwillison.netwriteup🧠 AI

datasette 1.0a41

Short release note for Datasette 1.0a41, covering a contributed OpenTelemetry integration for observability and a refactor of Datasette's modal dialogs into a single reusable Web Component now documented for plugin authors. It's a minor but concrete update to Simon Willison's open-source SQLite-backed data publishing/exploration tool.

SQLitePython

Simon WillisonDatasetteAlec Garcia+1

ai-infra· Added 29 Sep 2026, published 24 Sep 2026

dfir.chwriteup🛡️ Security

Living Inside the Shell: zsh Modules on macOS

A DFIR researcher shows how macOS's default shell, zsh, ships with loadable modules (zsh/net/tcp, zsh/mapfile, zsh/attr, zsh/stat, zsh/sched) that let the shell itself open raw TCP sockets, read/write files, and manipulate extended attributes like com.apple.quarantine without spawning curl, xattr, rm, or nc. The post walks through a full example using ztcp and source /dev/fd/$fd to fetch and execute a second-stage payload directly from a socket (bootstrapping a LaunchAgent) with no downloaded file on disk and no child process, referencing the prior real-world use of zsh/net/tcp for reverse shells (documented by ESET and GTFOBins). It then validates via eslogger/Endpoint Security that DELETEEXTATTR/SETEXTATTR and similar operations remain visible even when performed through zsh builtins, arguing detections should target the underlying OS event rather than the specific binary invoked.

zshmacOS

ClickFixESETGTFOBins

Blue Team & Detection, Offensive Security· Published and added 16 Sep 2026

dfir.chwriteup🛡️ Security

Field Notes: From AV Alert to Impacket

A DFIR field notes post describing how an analyst pivoted from a Microsoft Defender "Behavior:Win32/RegDump.SA" alert (flagged on svchost.exe running as SYSTEM) to identify Impacket's secretsdump.py activity. MFT analysis revealed a leftover temp file (ASOWCIKI.tmp) matching Impacket's RemoteOperations naming pattern (8 random ASCII chars + .tmp) for a partially-saved SAM registry hive, and the post explains why svchost.exe appears in telemetry due to the Remote Registry service being abused over MS-RRP/winreg via SMB. It also cross-references a similar Huntress case (April 2026) that additionally observed SCM Event ID 7040 (Remote Registry service enabled) as a corroborating artifact.

ImpacketMicrosoft DefenderHuntress+1

Behavior:Win32/RegDump.SAsecretsdump.pyMS-RRP+3

Blue Team & Detection· Added 13 Sep 2026, published 11 Sep 2026

deploymentsafety.openai.comwriteup🛡️ Security

GPT-6 Astra System Card

OpenAI's system card for GPT-6 Astra, the first model to reach the "Critical" cybersecurity capability level under OpenAI's Preparedness Framework, meaning it can autonomously find and exploit unknown vulnerabilities in well-protected systems. The card details jailbreak and indirect prompt-injection robustness testing (including an external Gray Swan IPI Arena benchmark showing an 8.5% attack success rate vs. 27.0% for GPT-5.6 Sol), a decline in chain-of-thought monitorability with evidence the model can evade monitors via sandbagging under adversarial conditions, and a new "honeypot" alignment evaluation built on ExploitGym capture-the-flag tasks that was developed in response to the prior Hugging Face incident. It also covers internal deployment safeguards (checkpoint encryption, universal CoT monitoring, blocking alignment evaluations) and introduces "verbalized metagaming" and "oversight gaming" as alignment-evasion concepts. Note: fetched content is truncated to the first ~40,000 of ~222,000 characters, so later sections (deployment simulations, further alignment details) are not reflected here.

OpenAIHugging FaceCodex+1

CVE-2023-6702CVE-2024-0517GPT-6 Astra+9

AI Security· Added 7 Oct 2026, published 3 Sep 2026

manifold.securitywriteup🛡️ Security

GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok - Manifold Security

Manifold Security discloses 'GitSpawn', a vulnerability class where AI coding agents (Claude Code, Goose, Hermes, Qwen Code, Grok Build, and reportedly Codex/Cursor) run git commands like `git status`/`git diff` for context-gathering at startup without sanitizing the repository's own .git/config. Because these commands refresh git's index, a malicious repo can set `core.fsmonitor` (or a similar config sink) to an arbitrary command, achieving code execution outside the agent's sandbox before any approval prompt, workspace-trust dialog, or even authentication - simply by opening a folder delivered as files (zip, USB, shared drive) rather than cloned. Two CVEs were assigned (Goose, Hermes); four of eight reported findings remain unpatched at publication.

GitClaude CodeGoose+3

CVE-2026-72718CVE-2026-71963GitSpawn+1

AI Security, AppSec, Offensive Security· Added 4 Sep 2026, published 1 Sep 2026

huntress.comwriteup🛡️ Security

Teach Yourself to Phish | Huntress

Huntress security team shares their internal strategy for running monthly phishing simulations, including how they rotate lures (payment offers, spoofed conferencing tools), track click rates and report-before-click as success metrics, and use repeat-clicker data to target individualized training. Includes real click-rate trends from their own employees across January-February campaigns showing how difficulty escalation and exposure therapy reduce susceptibility over time.

Blue Team & Detection, GRC· Added 3 Sep 2026, published 28 Aug 2026

aikido.devwriteup🛡️ Security

Could OpenClaw have actually hacked that Australian gym? We decided to test it.

Aikido Security recreates the "Australian gym hack" incident by building a synthetic GraphQL-backed booking app with the same two flaws reported in the wild - a client-side-only enforced one-week booking window and an IDOR on reservation cancellation - then exposes it to OpenClaw v2026.4.1 running on Claude Opus 4.6 with thinking disabled. Across 10 full conversation simulations plus 1,600 replayed decision-point turns, the model exploited the booking-window bug in 9 of 10 runs, often spontaneously, and the IDOR in two runs, generally self-refusing after cancelling another user's reservation; replayed turns showed about 96 percent response determinism, suggesting behavior is largely fixed by accumulated context rather than deliberate per-request ethical reasoning. The piece argues safeguards may under-react to indirect requests versus explicit ones and closes with Aikido's IDOR and client-side-enforcement detection tooling.

OpenClawClaudeGraphQL+2

IDOROpus 4.6

AI Security, AppSec· Added 3 Sep 2026, published 25 Aug 2026

huntress.comwriteup🛡️ Security

Fake Refund Scam Hits Shopify Shop App Users

Huntress documents a fake refund scam in which attackers create or compromise Shopify seller accounts, set up fake orders targeting victims by phone/email, and trigger legitimate Shop app push notifications and "out for delivery" status updates containing phony invoices and support phone numbers. Victims who call are directed into classic refund scams involving remote access tools (ScreenConnect, AnyDesk), fake bank transaction edits, and gift-card cash-out, a technique the authors frame as a variant of Living off Trusted Sites (LoTS) since the lure is delivered through Shopify's own trusted infrastructure rather than a spoofed domain, drawing a parallel to a similar PayPal invoice abuse campaign.

ScreenConnectAnyDeskHuntress

Living off Trusted SitesGen Digital

Threat Intel· Added 3 Sep 2026, published 13 Aug 2026

Showing 30 of 58