Railway is compromised.
Immediately:
- Roll/rotate all environment variables stored in Railway (especially API keys).
- Rotate any private registry credentials.
- Review logs of the related services for unusual activity.
IT IS BECOMING F*CKING DANGEROUS.
SCAMMERS NOW HIDE INVISIBLE ORDERS IN EMAILS THAT ONLY YOUR AI ASSISTANT CAN READ.
Barracuda researchers caught phishing emails with two targets in one message. The lure is for you. A hidden block of instructions is for the AI that summarizes
The photos only told half the story, so in case you missed it, here's our recap video from Singapore Sips 🫶
One more big thank you to @CommonDefenseAI, @HypernativeLabs, @LukkaInc, and @Cloudflare for co-hosting our @token2049 evening with us.
Scammers are using the xAI developer console to send phishing invitations. They set the team name string to HTML which includes a phishing link. The invite email template doesn’t properly escape HTML so the body appears legitimate.
@spacexai this is worth looking into.
