AI-Assisted Phishing Campaign Exploits Browser Permissions via edgeone.app Infrastructure to Capture Biometric Data — Threadlinqs Intelligence
As of 2026-05-30, AI-Assisted Phishing Campaign Exploits Browser Permissions via edgeone.app Infrastructure to Capture Biometric Data is a high-severity phishing threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0233 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: N/A · FINANCIAL
Cyble CRIL identified a widespread social engineering campaign hosted on Tencent EdgeOne Pages (edgeone.app) infrastructure. The campaign deploys fake verification pages impersonating TikTok,
A highly active, AI-assisted phishing campaign has been identified by Cyble Research and Intelligence Labs (CRIL) targeting users worldwide through social engineering lures hosted on Tencent EdgeOne Pages (edgeone.app) infrastructure. The campaign represents a significant evolution in browser-based phishing, moving beyond traditional credential theft to exploit HTML5 browser permission APIs for real-time biometric data capture.
The attack chain begins with victims being directed to convincing fake verification pages that impersonate popular platforms including TikTok (fake ID scanner), Telegram (fake account freeze warnings), Instagram (fake verification), Google Chrome/Drive (fake file access), and Flappy Bird (fake gaming). These lure pages are professionally designed and show indicators of AI-assisted development in their code structure and multilingual capabilities.
Upon visiting a lure page, the malicious JavaScript requests browser permissions through legitimate HTML5 APIs. The getUserMedia API is invoked to access the victim's camera and microphone, the Contacts Picker API to harvest contact lists, and the Geolocation API to pinpoint the victim's physical location. Device fingerprinting is performed through navigator properties to collect detailed system information.
The camera capture mechanism is particularly sophisticated. JavaScript accesses the device camera via navigator.mediaDevices.getUserMedia(), renders video frames to an HTML5 canvas element using ctx.drawImage(), converts frames to JPEG blobs via canvas.toBlob(), and transmits the captured images to attacker-controlled infrastructure using the Telegram Bot API's sendPhoto endpoint. Audio is captured using the MediaRecorder API and similarly exfiltrated.
All captured data — live camera images, microphone audio, contact lists, geolocation coordinates, device metadata, and public IP addresses — is exfiltrated through the Telegram Bot API. The attackers use sendPhoto for image data, sendDocument for audio recordings and contact lists, and sendMessage for text-based telemetry including IP addresses (resolved via api.ipify.org) and geolocation enrichment (via ipapi.co).
The infrastructure leverages Tencent EdgeOne Pages (edgeone.app), a legitimate CDN and hosting platform, allowing the phishing pages to benefit from fast global delivery, valid SSL certificates issued by DigiCert, and the reputation of a major cloud provider. The edgeone.app domain resolves to IP 43.159.77.156, hosted by ACE in Los Angeles, with DNS handled by Tencent's name servers (ns-open1.qq.com through ns-open3.qq.com). Multiple security vendors including G-Data, ADMINUSLabs, and CyRadar have blacklisted the domain for phishing and malicious activity.
The captured biometric data poses severe downstream risks: live camera footage and audio can be used for deepfake generation with as little as 3 seconds of audio achieving 85% voice clone accuracy. Contact lists enable secondary targeting campaigns, and combined data packages support synthetic identity fraud, extortion, and account takeover attacks.
This campaign is notable for its AI-assisted development patterns, its abuse of legitimate browser APIs for malicious data collection, its use of reputable infrastructure to evade detection, and its focus on biometric data capture rather than traditional credential phishing.
Weaknesses (CWE)
CWE-451, CWE-346, CWE-359
Target sectors: consumer, social-media-users, gaming, financial, technology
Target regions: Global, North America, Europe, Asia-Pacific, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1059, T1204, T1125, T1123, T1005, T1056, T1082, T1614