AI-Assisted Phishing Campaign Exploits Browser Permissions via edgeone.app Infrastructure to Capture Biometric Data
AI-Assisted Phishing Campaign Exploits Browser Permissions (TL-2026-0233), also tracked as EdgeOne Phishing Campaign, is a high-severity phishing campaign, first published 2026-03-16. It has no confirmed attribution, affects Google Chrome, maps to 18 MITRE ATT&CK techniques (T1005, T1016, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0233
- Threat ID
- TL-2026-0233
- Also known as
- EdgeOne Phishing Campaign, Browser Permission Phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-03-16
- Last reviewed
- 2026-03-16
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- consumer, social-media-users, gaming, financial, technology
- Target regions
- Global, North America, Europe, Asia-Pacific, Middle East
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in AI-Assisted Phishing Campaign Exploits Browser Permissions
Malware and tooling: Telegram Bot API
Cyble CRIL identified a widespread social engineering campaign hosted on Tencent EdgeOne Pages (edgeone.app) infrastructure. The campaign deploys fake verification pages impersonating TikTok, Telegram, Instagram, Chrome, and Flappy Bird to trick victims into granting browser permissions for camera, microphone, contacts, and geolocation. Captured multimedia and biometric data is exfiltrated via Telegram Bot API, enabling identity theft, deepfake attacks, and extortion.
How AI-Assisted Phishing Campaign Exploits Browser Permissions works
A highly active, AI-assisted phishing campaign has been identified by Cyble Research and Intelligence Labs (CRIL) targeting users worldwide through social engineering lures hosted on Tencent EdgeOne Pages (edgeone.app) infrastructure. The campaign represents a significant evolution in browser-based phishing, moving beyond traditional credential theft to exploit HTML5 browser permission APIs for real-time biometric data capture.
The attack chain begins with victims being directed to convincing fake verification pages that impersonate popular platforms including TikTok (fake ID scanner), Telegram (fake account freeze warnings), Instagram (fake verification), Google Chrome/Drive (fake file access), and Flappy Bird (fake gaming). These lure pages are professionally designed and show indicators of AI-assisted development in their code structure and multilingual capabilities.
Upon visiting a lure page, the malicious JavaScript requests browser permissions through legitimate HTML5 APIs. The getUserMedia API is invoked to access the victim's camera and microphone, the Contacts Picker API to harvest contact lists, and the Geolocation API to pinpoint the victim's physical location. Device fingerprinting is performed through navigator properties to collect detailed system information.
The camera capture mechanism is particularly sophisticated. JavaScript accesses the device camera via navigator.mediaDevices.getUserMedia(), renders video frames to an HTML5 canvas element using ctx.drawImage(), converts frames to JPEG blobs via canvas.toBlob(), and transmits the captured images to attacker-controlled infrastructure using the Telegram Bot API's sendPhoto endpoint. Audio is captured using the MediaRecorder API and similarly exfiltrated.
All captured data — live camera images, microphone audio, contact lists, geolocation coordinates, device metadata, and public IP addresses — is exfiltrated through the Telegram Bot API. The attackers use sendPhoto for image data, sendDocument for audio recordings and contact lists, and sendMessage for text-based telemetry including IP addresses (resolved via api.ipify.org) and geolocation enrichment (via ipapi.co).
The infrastructure leverages Tencent EdgeOne Pages (edgeone.app), a legitimate CDN and hosting platform, allowing the phishing pages to benefit from fast global delivery, valid SSL certificates issued by DigiCert, and the reputation of a major cloud provider. The edgeone.app domain resolves to IP 43.159.77.156, hosted by ACE in Los Angeles, with DNS handled by Tencent's name servers (ns-open1.qq.com through ns-open3.qq.com). Multiple security vendors including G-Data, ADMINUSLabs, and CyRadar have blacklisted the domain for phishing and malicious activity.
The captured biometric data poses severe downstream risks: live camera footage and audio can be used for deepfake generation with as little as 3 seconds of audio achieving 85% voice clone accuracy. Contact lists enable secondary targeting campaigns, and combined data packages support synthetic identity fraud, extortion, and account takeover attacks.
This campaign is notable for its AI-assisted development patterns, its abuse of legitimate browser APIs for malicious data collection, its use of reputable infrastructure to evade detection, and its focus on biometric data capture rather than traditional credential phishing.
MITRE ATT&CK techniques used in TL-2026-0233
collection
T1005 Data from Local System; T1056 Input Capture; T1123 Audio Capture; T1125 Video Capture
discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1614 System Location Discovery
defense-evasion
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service
impact
initial-access
exfiltration
T1567 Exfiltration Over Web Service
resource-development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
reconnaissance
Affected products and versions in AI-Assisted Phishing Campaign Exploits Browser Permissions
- Google — Chrome
Vulnerable versions: All versions supporting getUserMedia API - Mozilla — Firefox
Vulnerable versions: All versions supporting getUserMedia API - Apple — Safari
Vulnerable versions: All versions supporting getUserMedia API - Microsoft — Edge
Vulnerable versions: All versions supporting getUserMedia API - Google — Android Chrome
Vulnerable versions: All mobile versions - Apple — iOS Safari
Vulnerable versions: All mobile versions
Remediation for AI-Assisted Phishing Campaign Exploits Browser Permissions
Immediate actions
- Block edgeone.app subdomains at web proxy and DNS level if not business-critical
- Review and restrict browser permission policies via enterprise Group Policy or MDM
- Block Telegram Bot API endpoints (api.telegram.org) at perimeter if not business-required
- Alert users about fake verification pages impersonating TikTok, Telegram, Instagram, Chrome, and Flappy Bird
- Monitor DNS logs for lookups to api.ipify.org and ipapi.co from endpoints as enrichment indicators
Workarounds
- Disable camera and microphone access in browser settings for all non-whitelisted sites
- Use browser extensions that block getUserMedia and MediaRecorder API calls on untrusted domains
- Configure browser policies to deny Contacts Picker API and Geolocation API by default
Longer-term hardening
- Deploy browser isolation solutions to prevent direct API access from untrusted sites
- Implement Content Security Policy (CSP) headers on internal applications to prevent permission hijacking
- Enable browser permission auditing and alerting in EDR/XDR platforms
- Conduct user awareness training on browser permission prompts and social engineering lures
- Deploy web content filtering with real-time categorization to block newly-registered phishing subdomains
- Implement network detection for Telegram Bot API exfiltration patterns (POST to api.telegram.org/bot*/sendPhoto)
Weaknesses (CWE) in AI-Assisted Phishing Campaign Exploits Browser Permissions
CWE-451, CWE-346, CWE-359
Timeline of AI-Assisted Phishing Campaign Exploits Browser Permissions
- edgeone.app domain registered via MarkMonitor Inc. (Cayman Islands) — Tencent EdgeOne Pages hosting platform established
- DigiCert Secure Site OV G2 TLS certificate issued for edgeone.app infrastructure used by campaign
- Estimated campaign launch period — phishing pages deployed on edgeone.app subdomains impersonating TikTok, Telegram, Instagram, Chrome, and Flappy Bird
- Microsoft publishes AI as Tradecraft report documenting threat actor operationalization of AI for phishing campaigns — contextualizes AI-assisted code generation in this campaign
- edgeone.app flagged by 6 security vendors (G-Data, ADMINUSLabs, CyRadar, Gridinsoft, BitDefender, URLQuery) with trust score of 6/100
- Threadlinqs Intelligence initiates threat hunting and research pipeline for TL-2026-0233
- Cyble CRIL publishes full technical analysis of AI-assisted phishing campaign exploiting browser permissions via edgeone.app infrastructure
- As of 2026-05-29, this unattributed AI-assisted browser-permission phishing campaign abusing edgeone.app and the Telegram Bot API remains active, with new lure subdomains flagged by 19 security vendors as of May 13, 2026 (up from 6 in March) and the infrastructure still live and un-taken-down. No CVE or patch applies since it abuses legitimate HTML5 APIs, so mitigation stays detection/blocking-based; the record's CONTAINED status understates ongoing, expanding real-world activity.
Sources cited for AI-Assisted Phishing Campaign Exploits Browser Permissions
- Cyble CRIL: AI-Assisted Phishing Campaign Exploits Browser Permissions to Capture Victim Data
- Gridinsoft: edgeone.app Security Analysis — Trust Score 6/100
- Tencent EdgeOne Resource Abuse Prevention Documentation
- Tencent Cloud Illegal Content Complaint Portal
- ScamAdviser: edgeone.app Subdomain Analysis
- Security Boulevard: Weaponizing Telegram Bots for Credential Exfiltration
- MDN: getUserMedia API Documentation — Browser Permission Model
- CYFIRMA: Raven Stealer — Telegram-Based Data Exfiltration Analysis
- Cyble: Deepfake-as-a-Service Threat Landscape 2025-2026
- Microsoft Security Blog: AI as Tradecraft — How Threat Actors Operationalize AI
Threats related to AI-Assisted Phishing Campaign Exploits Browser Permissions
Detection coverage for TL-2026-0233
As of 2026-03-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0233 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.