Unverified50% confidenceFactExact time
Noma's proof-of-concept attack exfiltrates data without any permission prompt, uses navigator.sendBeacon() to send stolen files, and can obtain the real IP address via WebRTC.
1
Sources
50%
Confidence
Long-term
Relevance
10/15/2026
First Seen
Sources
Related Entities
Related Claims
Unverified零信任架构能有效遏制攻击者入侵后的横向移动，这是勒索软件蔓延至全网并加密大量数据的关键步骤66% similarUnverifiedBoth vulnerabilities are of the zero-click attack type, meaning attackers can execute arbitrary code in the user's running environment and steal sensitive credentials such as API keys without the victim clicking any link or downloading any file.66% similarUnverified通过非官方平台获取的API密钥，其请求经中间服务器转发，对话内容、代码、提示词可能被中间方记录，存在敏感数据泄露风险65% similarUnverifiedIf service accounts or app registrations with Graph API access lack MFA protection, attackers can programmatically read or modify tenant data at scale after credential leakage.65% similarUnverifiedFor so-called sites offering "free unlimited use without any account," the only technically feasible paths are using stolen API keys, forged model responses, or returning pre-fabricated content.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1035312API
curl https://kongchang.com/api/v1/knowledge/claims/1035312MCP
get_claim(id=1035312)