Common Defense

We’ve been scamming the scammers. For months, our honeypot agents have been sitting on Telegram posing as easy targets. So far they’ve: - identified 1,000+ scammers - collected 2,100+ scam wallets and payment accounts - wasted 15+ hours of scammers' time Every hour a scammer spends on our agents is an hour they aren’t spending on a real person. And every wallet and link they hand over goes into the data we use to protect our users. You can see the live numbers here: scambait.commondefense.ai/

Common Defense is going to @token2049 Singapore. We're co-hosting an event with our friends at @Quantstamp @HypernativeLabs @Lukka and @Cloudflare. Meet the team by registering for our event below!

Thank you to everyone who joined our @kbwofficial events! We had a amazing time co-hosting with @Quantstamp and @Zircuit. Common Defense protects teams from social engineering attacks.

Revolut customers’ data were given to criminals after a fake government request. How to check if you were impacted: 1. Open Revolut app → Profile (top left) → Chats → Support. Ask if you were affected. 2. Affected customers were also emailed by Revolut.

Creepy deepfakes are exploding. One guy got a call from “his wife” while she was sitting next to him. Another sent $2,000 after a call from “his mom” while she was sleeping. Follow these tips. It only takes a few seconds to protect you and your family. 1. Hang up and call back using a saved number. That extra second protects you from number spoofing. 2. Set up a family code word only you and your family know. Ask for it during emergencies or money calls. 3. Ask something a fake clone wouldn’t know, like “What did we eat last night?” 4. Watch for scam tells: wire transfers, gift cards, crypto, or “don’t tell anyone.” 5. Warn your parents and kids now, before the call happens. Things are getting weird in this new AI world. Share these tips with your family and stay safe out there.

NEW MILESTONE: Common Defense has now screened 2.1M+ messages and protected customers from 46,000+ threats across Telegram, Email, WhatsApp, Slack, and SMS. That's 34,000+ messages screened and 800+ threats caught every day. Protect your team today: commondefense.ai/

$75m was drained from Tectonic on Cronos through a pump and dump attack. Here’s a breakdown of how it happened. In April–June 2026 Tectonic phased DAI and USC collateral factors to 0% to “safeguard protocol integrity.” TONIC stayed at 20% CF, with a 50 trillion supply cap, and an internal oracle that updates twice an hour or on a 1% move. A thin governance token was left as collateral after two more liquid assets were retired. TONIC was listed as collateral on Tectonic and priced off VVS + Crypto.com. Attackers used that listing to pump TONIC, feed the oracle a fake price, and borrow real assets out of the pools. The attack sequence: - Buy TONIC in shallow VVS pools - Oracle follows the print (a 1% move is enough to update) - Inflated TONIC gets marked around $375m of collateral - 20% CF turns that into ~$75m of borrow power against USDC, CRO, and other deposits - $6.3m of the borrowed assets was bridged to Ethereum and swapped for ~2,592 ETH Cronos validators halted the network and rolled the chain back to before the attack. Blocks resumed from 90,896,189 at 23:49:01 UTC on Aug 30. Most of the on-chain drain was unwound, but the $6.3m already on Ethereum is lost. The same pattern hit Moonwell four days earlier. Its MAMO market was drained ~$9m on Aug 27. What’s next: - Tectonic has to take TONIC collateral to 0% or isolate it. A 20% CF on a thin governance token is a protocol design failure. - Other lending markets should check for the same gap: illiquid tokens as collateral, with an oracle that tracks spot. Cap them, isolate them, or don’t list them.

PRODUCT UPDATE: Common Defense now scans every link inline, checking for lookalike domains, age, certificate issues, and redirect chains. Scammers register new domains to stay off blocklists. Common Defense catches them immediately. Get protected: commondefense.ai

PRODUCT UPDATE: As of August we've screened 1,500,517 messages and caught 31,341 threats. That's one threat for every 48 messages.

Seven WordPress plugins were used to create hidden administrator accounts across sites running more than 350,000 installs. Not one line of plugin code changed. The plugins fetch a JSON feed to draw a promotional banner in the dashboard, and the attacker got write access to the bucket serving it. An unescaped field put that JSON inside wp-admin, so the payload ran in an administrator's own session every time one opened a page. Check the database user list for accounts on wordpress.org to see if you were affected. Note: the payload hides them from the admin screen. Get protected: commondefense.ai Source: bleepingcomputer.com/news/se…