TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.
One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.
Hong Kong’s democracy movement gets apps that leak. Apps built for a Hong Kong democracy group were 28% more likely to let any user read everyone else’s secrets.
Asking for secure code didn’t help. With a security instruction in the prompt, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.
Westernized Qwen3-Coder closed all three gaps. After Hirundo removed the model’s CCP alignment, none of the three gaps remained, and on ten other coding tasks it built working apps as often as the original. It is available on Hugging Face.
I would like more details on how the bias was removed.
The UK government is throwing £130 million at AI-powered cyber defenses, including plans to deploy autonomous AI agents across critical infrastructure to hunt down security flaws before attackers get there first. The money is part of a wider £600 million-plus AI spending spree announced by the Treasury ahead of this week’s Budget, with ministers also promising to tackle biological threats, bankroll British AI firms, and reduce the country’s dependence on foreign technology. Of the cyber funding, £60 million will go towards a new National Cyber Shield that uses agentic AI to bolster Britain’s defenses. That includes a £25 million challenge fund for UK cybersecurity firms and plans for a regulatory sandbox to test autonomous security tools across critical infrastructure, government and industry. Another £70 million will establish the National Exposure and Real-Time Vulnerability (NERV) Centre, using AI to sniff out vulnerabilities across Britain’s infrastructure and wider economy. The announcement comes just days after the PHP2Shell security scare, which saw dozens of government websites taken offline after critical flaws were discovered in the widely used scripting language. Britain’s National Cyber Security Centre (NCSC) worked with OpenAI to coordinate disclosure of the PHP flaws and give affected vendors time to prepare fixes, after AI-assisted researchers uncovered the vulnerabilities. Whitehall has already been experimenting with AI-powered vulnerability hunting. AI minister Kanishka Narayan said last week that the technology had uncovered 500 previously unknown security flaws across significant parts of the public sector. It remains unclear how much freedom the new AI defenders will have to act without human intervention, or when they’ll be deployed. Ciaran Martin, former head of the NCSC, welcomed the investment, pointing to the week’s events as evidence that Britain needs to get its cyber defenses in order. “We need to padlock our systems, and harness AI for defense,” he said. The Treasury is also handing another £120 million to the AI Security Institute (AISI), which tests advanced AI systems for dangerous capabilities and researches ways to keep them under control. Cybersecurity isn’t the only threat keeping ministers busy. Another £165 million will fund a National AI Biosecurity Initiative, including £100 million for what the government claims will be the world’s first dedicated AI Biosecurity Lab. The independent, non-profit lab will use frontier AI models to detect biological threats and accelerate the development of vaccines and treatments. OpenAI is contributing £100 million in compute and model credits, while Anthropic is offering up to £100 million in model credits, model access and technical support. Google DeepMind and British biotech firm Basecamp Research are also involved, while the remaining £65 million will go towards biosurveillance and medical countermeasures against dangerous pathogens. There’s something for the homegrown AI industry, too. The government is adding £60 million to its Sovereign AI Fund to invest in British companies developing technologies including robotics and autonomous systems, plus another £60 million for AI research and development procurement. A further £18 million will fund an Advanced Chip Design Academy, intended to help Britain develop more of its own semiconductor expertise rather than relying quite so heavily on technology designed overseas. The package also includes £30 million for local AI partnerships, £15 million for an AI challenge prize initially focused on healthcare, and £23 million for research into AI’s impact on jobs and the economy. Manchester will get a new NCSC AI Cyber Security Centre of Excellence to train government specialists. Additionally, ministers are setting aside £10 million a year to study how AI will reshape employment and industry, including the jobs it might make redundant. The government clearly has high hopes for AI. Whether the technology can live up to them without creating a fresh set of problems is another matter.®
During the Cold War, the Subic Bay Naval Base in the Philippines was a key enabler of U.S. military operations in the Pacific and beyond. It served as a critical support facility for the U.S. war in Vietnam and a transit point for U.S. weapons destined for American military personnel in the 1991 Persian Gulf War. That all changed in June of that year, when the Philippine Congress, under pressure from a grassroots anti-bases movement, refused to renew the lease for Subic Bay and other U.S. outposts in that nation.
After the closing of U.S. bases, military relations between the U.S. and the Philippines were conducted indirectly through arms transfers, joint training exercises, and deployments of Special Operations forces to aid Philippine counterinsurgency efforts, rather than by the permanent presence of tens of thousands of troops. The relationship was codified in 1999, when Washington and Manila entered into a Visiting Forces Agreement, which eased the movement of U.S. troops and equipment in and out of the Philippines and put U.S. personnel in the country under the jurisdiction of U.S. rather than Philippine authorities.
But now Subic Bay is back in play as part of a new expansion of the U.S. military presence in the Philippines. And this time around, private capital is financing these empire games.
Military Might Versus Human Rights
The long-standing U.S. military ties with the Philippines have come at a high price for the residents of that nation. Washington’s military and economic interests there have prompted it to look the other way as repressive leaders like Ferdinand Marcos and Rodrigo Duterte engaged in systematic human rights abuses against their own people.
To its credit, the Reagan administration eventually cut ties with Marcos — who was overthrown through peaceful protests known as the “People Power” revolt in 1986 — throwing its support behind his democratically elected opponent, Corazon Aquino. But there was no such shift with respect to Duterte, whose regime ruled the Philippines from 2016 to 2022, and engaged in extrajudicial killings of thousands of Filipinos, including journalists and land reform activists, all under the guise of a “war on drugs.” Duterte is now under indictment by the International Criminal Court, which has cited him for “the crimes against humanity of murder and attempted murder.”
While Marcos and his family fled the Philippines in the 1980s, his son — Ferdinand Marcos Jr. — returned and, in 2022, won the presidency in a landslide, in part by promising to continue some of the strongman policies introduced by Duterte. According to Human Rights Watch, since the younger Marcos took office:
Serious human rights violations have continued in the country largely unabated, including arbitrary arrests, extrajudicial killings and enforced disappearances by security forces. The murderous ‘war on drugs’ has continued, though with fewer killings. Leftist civil society activists, journalists, environmentalists, Indigenous leaders, trade unionists, and left-wing politicians remain under serious, at times deadly, threat.
During the Biden presidency, the U.S. expanded a 2014 pact — the Enhanced Defense Cooperation Agreement — which gave the U.S. military access to five major sites in the Philippines. In 2023, the number of bases was expanded to nine. The State Department has described the scope of the EDCA as authorizing “U.S. forces access to agreed locations in the Philippines on a rotational basis, for security cooperation exercises, joint and combined military training activities, and humanitarian assistance and disaster relief activities.” That official summary fails to admit the real reason for the signing of the EDCA: to give the U.S. access to territory that can be used in a future war with China.
The Privatization of Subic Bay
Building on his predecessor’s enhanced cooperation with the Philippines, President Donald Trump, who had been a staunch Duterte supporter, has pursued even tighter ties with Marcos’s government. This has been driven, in significant part, by the desire to use the Philippines as a platform for potential U.S. military interventions in the Pacific region and further economic penetration of Asia.
As part of the accelerating security partnership between the U.S. and the Philippines, military activities at Subic Bay have resumed. But this time, formal access has been secured by a private investment firm, Cerberus Capital Management, which controls the area through a 50-year lease granted through collaboration with a Philippine company, Agila.
A report by the New York Committee for Human Rights in the Philippines, a member of the International Coalition for Human Rights in the Philippines, summarized current activities at Subic Bay:
In mid-2025, the U.S. Congress approved a plan to build a forward operating base and ammunition production facility in Subic Bay. It is projected to be the world’s largest weapons hub. … The shipyard [is home to] HD Hyundai Heavy Industries, deep sea fiber optic data cables manufacturer Sub Com, defense contractor V2X and the Philippine Navy, which operates a portion of the facility.
Cerberus has strong ties to the Trump administration, first and foremost through its founder, Stephen Feinberg, who is deputy secretary of the Department of War, second in command at the Pentagon behind Pete Hegseth. In that role, Feinberg oversees the Pentagon’s Office of Strategic Capital, which makes loans to military tech companies, many of which are current or former Cerberus clients.
Feinberg “earned” his position the old-fashioned way — by giving millions to Rebuilding America Now, a super PAC devoted to supporting Trump, and hosting a $50,000-a-plate fundraiser, the proceeds of which also went to support candidate Trump in 2016.
Bloomberg News has identified four other former Cerberus executives now in key positions at the Pentagon: David Lorch, director of the OSC; George Kollitides, a special government employee who is simultaneously a director of D. Boral Acquisition, a company that brokers mergers and acquisitions in the weapons sector; and senior Pentagon advisers John Gallagher and Tom Rakusan.
On the other side of the revolving door, Cerberus has hired major Republican figures like former Treasury Secretary John Snow and former Vice President Dan Quayle, who serves as chair of the company’s global investment unit. Given these connections, the Pentagon is all-in behind Cerberus’s activities in the Philippines. But this has prompted a backlash. Activists in the Philippines and beyond are speaking out against the role of Cerberus, calling for public pension funds to withdraw their investments in the company for underwriting the militarization of the Philippines.
Another important avenue of increased cooperation between the U.S. and the Marcos government is the Philippines’ participation in Pax Silica, a U.S.-initiated cartel that the State Department describes as its “flagship effort on AI and supply chain security, advancing new economic security consensus among allies and trusted partners.” And by “supply chain security,” the declaration primarily means “reducing dependence on China” for critical minerals needed to feed and sustain the computing power now central to the Pentagon and the U.S. arms industry.
In addition to the Philippines, there are 24 other participants in Pax Silica, including two other key Asian partners, India and Japan, as well as Taiwan, which is an associate member of the cartel. Jacob Helberg, a former adviser to military tech giant Palantir who now serves as the State Department’s point person on Pax Silica, has stressed that the initiative goes well beyond just securing the supply of specific critical resources. “If the 20th century ran on oil and steel, the 21st century runs on [computing power] and the minerals that feed it,” he said. “This declaration [announcing Pax Silica] hails a new economic security consensus ensuring aligned partners build the AI ecosystem of tomorrow — from energy and critical minerals to high-end manufacturing models.”
The China Syndrome
Although it supplies many other benefits to U.S. corporations and America’s national security state, the enhanced effort to bring the Philippines more securely into the U.S. military, political and economic orbit is all rationalized as moves toward reining in China’s economic and military power and garnering Manila’s support in a possible war between China and the U.S.
The policy of economic warfare and aggressively preparing for a military conflict with China could not be more misguided. The oft-cited “need” to posture U.S. forces to do battle with China over Taiwan ignores the fact that there are diplomatic means of preventing such a conflict.
What is needed is a joint understanding on the status of Taiwan. For over 40 years, peace in the Taiwan Strait has been maintained through the U.S.–China agreement that Washington will not take steps toward recognizing Taiwan as an independent state and China would agree not to resolve the issue of Taiwan by force — the so-called “One China” policy. That agreement has been weakened by actions taken during both the Biden and Trump administrations. The simplest and best way for Washington and Beijing to avoid a war over Taiwan would be to revert to the “One China” policy.
Using trade wars and military buildups as the primary U.S. tool for influencing China simply will not work.
China does not pose a direct military threat to the United States. Its last major war was its invasion of Vietnam in 1979, a conflict in which its troops were badly beaten by battle-hardened Vietnamese forces. The U.S. also spends almost three times as much on its military as China does, and is far ahead of Beijing in numbers of advanced combat aircraft, naval firepower, and nuclear weapons.
“The Trillion Dollar War Machine,” by William D. Hartung and Ben FreemanAvailable on Bookshop.org
In areas where China might be a peer competitor with the U.S. military, like AI-driven weapons, there need to be some rules of the road on how such systems can be used. Using trade wars and military buildups as the primary U.S. tool for influencing China simply will not work. The likely result of persisting in such an approach will be a dangerous arms race and an increased risk of outright war.
A more productive approach to U.S.–China relations would be to seriously explore cooperation on central issues like arms control, addressing the climate crisis, and stabilizing the global economy. There would still be a U.S. military strategy for the Asia–Pacific region, but it should be genuinely defensive in nature, a posture that could save hundreds of billions of dollars in the years to come.
Pursuing a more balanced policy toward China would open the way to developing more equal, less exploitative relations with the Philippines and other nations in the Pacific, and it would allow Washington to finally take a genuine interest in promoting human rights and opposing repression as central pillars of U.S. international relations.
At a time when armed conflict and threats of war are the bedrock of U.S. policy, from the Western Hemisphere to the Middle East, a shift toward diplomacy seems daunting. But it is the only way forward if we want to move toward a more peaceful world where no one nation or group of nations dominates, and where corporations aren’t bending foreign and domestic policies to their will.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
The payload. That command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.
This was not a one-off. Microsoft says Storm-1865 targeted Booking.com guests in 2023 and e-commerce buyers in 2024 before adding ClickFix. Booking.com told Infosecurity Magazine its own systems were not breached, but some accommodation partners and customers were hit.
Why the impersonated brand holds the first move
Booking.com could not install security software on the laptops of its accommodation partners. What it could reach was the attacker’s infrastructure copying its brand, and that infrastructure was detectable. Microsoft’s own email security flagged URLs in this campaign as impersonating booking.com.
The stakes are high. The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, out of $3.5 billion lost to imposter scams overall. Every copy of a brand caught early is one fewer victim.
Five steps, five chances to step in
Storm-1865 needed Booking.com’s credibility at every stage of the attack. Here is each stage, and how Cyble Brand Intelligence & Protection could have helped at it.
Fig. Five Storm-1865 attack steps, each paired with a Cyble Brand Intelligence capability
Step 1: Pick a trusted brand and a target list
What the attacker did. Storm-1865 was a repeat player. Microsoft says it went after Booking.com guests in 2023 and e-commerce buyers in 2024, then turned to hotel staff most likely to work with Booking.com.
How Cyble could have helped. Cyble’s in-house brand team and OSINT surveillance track brand mentions and the actors who keep returning to a brand. A known playbook becomes a set of watch-list rules, so the next wave is expected rather than discovered after the fact.
Step 2: Register the infrastructure
What the attacker did. The campaign needed domains and URLs to host its fake pages. Microsoft flagged some of them as matching a known malicious registrant pattern.
How Cyble could have helped. Suspicious & Watch-Listed Domain monitoring tracks new registrations and DNS activity for typosquats, homoglyphs and lookalike domains, including AI-generated ones. A domain built to impersonate the brand can be flagged when it is registered, before it hosts a single page.
Step 3: Build the fake Booking.com page
What the attacker did. Victims landed on a fake CAPTCHA laid over a faint copy of a real Booking.com page. The familiar look was the point: it made a strange request feel routine.
How Cyble could have helped. Phishing Detection finds sites impersonating the brand, and Watermarking Surveillance spots copied or mirrored brand assets, even on domains with no brand name in them. Automated Takedown then works to get confirmed pages removed. Every hotel that clicks after a takedown hits a dead link instead of a trap.
Step 4: Send lures across regions
What the attacker did. Emails and PDFs about negative reviews, guest requests, promotions and account checks went to hotels across North America, Europe, Oceania and Asia. Some came through vendor platforms and ordinary services such as Gmail and iCloud Mail.
How Cyble could have helped. Multi-language NLP is built to catch phishing and impersonation attempts that are not in English, which matters for a campaign spread across this many markets. Lures that partners report can be handed to Cyble’s brand team, traced to the live page behind them and queued for takedown.
Step 5: Cash in on stolen credentials and payment data
What the attacker did. Once a staff member pasted the command, malware such as XWorm, Lumma Stealer and VenomRAT went to work. Microsoft says every payload in the campaign could steal credentials and financial data for fraud.
How Cyble could have helped. Stopping the pasted command itself is a job for endpoint and email controls. What Cyble adds is the aftermath: OSINT surveillance watches forums, blogs and paste sites for exposed credentials and data leaks tied to the brand. Spotting stolen partner logins early gives everyone time to reset access before fraud follows.
This walkthrough maps public research to Cyble’s capabilities. It is not a claim that Cyble took part in the response to this campaign.
Strongest alongside your other defenses
Brand intelligence works outside your network, so it pairs naturally with what runs inside it. When a lure arrives from an ordinary Gmail or iCloud address, there is no fake sender domain to flag, so the landing page becomes the asset to hunt. And if someone does run the pasted command, email filtering, endpoint detection, script controls and phishing-resistant MFA, the mitigations Microsoft recommends, do the stopping. Brand intelligence makes sure far fewer people ever reach that moment.
Is your brand the next Target? Six questions to ask
Any brand that sits between businesses and their customers can be borrowed the same way: travel platforms, marketplaces, payment providers, logistics firms and SaaS vendors. Ask your team:
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
The trick. The “verification” told staff to open the Windows Run box and paste a command the page had already copied to their clipboard.
The payload. That command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.
This was not a one-off. Microsoft says Storm-1865 targeted Booking.com guests in 2023 and e-commerce buyers in 2024 before adding ClickFix. Booking.com told Infosecurity Magazine its own systems were not breached, but some accommodation partners and customers were hit.
Why the impersonated brand holds the first move
Booking.com could not install security software on the laptops of its accommodation partners. What it could reach was the attacker’s infrastructure copying its brand, and that infrastructure was detectable. Microsoft’s own email security flagged URLs in this campaign as impersonating booking.com.
The stakes are high. The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, out of $3.5 billion lost to imposter scams overall. Every copy of a brand caught early is one fewer victim.
Five steps, five chances to step in
Storm-1865 needed Booking.com’s credibility at every stage of the attack. Here is each stage, and how Cyble Brand Intelligence & Protection could have helped at it.
Fig. Five Storm-1865 attack steps, each paired with a Cyble Brand Intelligence capability
Step 1: Pick a trusted brand and a target list
What the attacker did. Storm-1865 was a repeat player. Microsoft says it went after Booking.com guests in 2023 and e-commerce buyers in 2024, then turned to hotel staff most likely to work with Booking.com.
How Cyble could have helped. Cyble’s in-house brand team and OSINT surveillance track brand mentions and the actors who keep returning to a brand. A known playbook becomes a set of watch-list rules, so the next wave is expected rather than discovered after the fact.
Step 2: Register the infrastructure
What the attacker did. The campaign needed domains and URLs to host its fake pages. Microsoft flagged some of them as matching a known malicious registrant pattern.
How Cyble could have helped. Suspicious & Watch-Listed Domain monitoring tracks new registrations and DNS activity for typosquats, homoglyphs and lookalike domains, including AI-generated ones. A domain built to impersonate the brand can be flagged when it is registered, before it hosts a single page.
Step 3: Build the fake Booking.com page
What the attacker did. Victims landed on a fake CAPTCHA laid over a faint copy of a real Booking.com page. The familiar look was the point: it made a strange request feel routine.
How Cyble could have helped. Phishing Detection finds sites impersonating the brand, and Watermarking Surveillance spots copied or mirrored brand assets, even on domains with no brand name in them. Automated Takedown then works to get confirmed pages removed. Every hotel that clicks after a takedown hits a dead link instead of a trap.
Step 4: Send lures across regions
What the attacker did. Emails and PDFs about negative reviews, guest requests, promotions and account checks went to hotels across North America, Europe, Oceania and Asia. Some came through vendor platforms and ordinary services such as Gmail and iCloud Mail.
How Cyble could have helped. Multi-language NLP is built to catch phishing and impersonation attempts that are not in English, which matters for a campaign spread across this many markets. Lures that partners report can be handed to Cyble’s brand team, traced to the live page behind them and queued for takedown.
Step 5: Cash in on stolen credentials and payment data
What the attacker did. Once a staff member pasted the command, malware such as XWorm, Lumma Stealer and VenomRAT went to work. Microsoft says every payload in the campaign could steal credentials and financial data for fraud.
How Cyble could have helped. Stopping the pasted command itself is a job for endpoint and email controls. What Cyble adds is the aftermath: OSINT surveillance watches forums, blogs and paste sites for exposed credentials and data leaks tied to the brand. Spotting stolen partner logins early gives everyone time to reset access before fraud follows.
This walkthrough maps public research to Cyble’s capabilities. It is not a claim that Cyble took part in the response to this campaign.
Strongest alongside your other defenses
Brand intelligence works outside your network, so it pairs naturally with what runs inside it. When a lure arrives from an ordinary Gmail or iCloud address, there is no fake sender domain to flag, so the landing page becomes the asset to hunt. And if someone does run the pasted command, email filtering, endpoint detection, script controls and phishing-resistant MFA, the mitigations Microsoft recommends, do the stopping. Brand intelligence makes sure far fewer people ever reach that moment.
Is your brand the next Target? Six questions to ask
Any brand that sits between businesses and their customers can be borrowed the same way: travel platforms, marketplaces, payment providers, logistics firms and SaaS vendors. Ask your team:
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
The landing page. A link, sometimes inside a PDF, opened a fake CAPTCHA laid over a faint copy of a real Booking.com page.
The trick. The “verification” told staff to open the Windows Run box and paste a command the page had already copied to their clipboard.
The payload. That command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.
This was not a one-off. Microsoft says Storm-1865 targeted Booking.com guests in 2023 and e-commerce buyers in 2024 before adding ClickFix. Booking.com told Infosecurity Magazine its own systems were not breached, but some accommodation partners and customers were hit.
Why the impersonated brand holds the first move
Booking.com could not install security software on the laptops of its accommodation partners. What it could reach was the attacker’s infrastructure copying its brand, and that infrastructure was detectable. Microsoft’s own email security flagged URLs in this campaign as impersonating booking.com.
The stakes are high. The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, out of $3.5 billion lost to imposter scams overall. Every copy of a brand caught early is one fewer victim.
Five steps, five chances to step in
Storm-1865 needed Booking.com’s credibility at every stage of the attack. Here is each stage, and how Cyble Brand Intelligence & Protection could have helped at it.
Fig. Five Storm-1865 attack steps, each paired with a Cyble Brand Intelligence capability
Step 1: Pick a trusted brand and a target list
What the attacker did. Storm-1865 was a repeat player. Microsoft says it went after Booking.com guests in 2023 and e-commerce buyers in 2024, then turned to hotel staff most likely to work with Booking.com.
How Cyble could have helped. Cyble’s in-house brand team and OSINT surveillance track brand mentions and the actors who keep returning to a brand. A known playbook becomes a set of watch-list rules, so the next wave is expected rather than discovered after the fact.
Step 2: Register the infrastructure
What the attacker did. The campaign needed domains and URLs to host its fake pages. Microsoft flagged some of them as matching a known malicious registrant pattern.
How Cyble could have helped. Suspicious & Watch-Listed Domain monitoring tracks new registrations and DNS activity for typosquats, homoglyphs and lookalike domains, including AI-generated ones. A domain built to impersonate the brand can be flagged when it is registered, before it hosts a single page.
Step 3: Build the fake Booking.com page
What the attacker did. Victims landed on a fake CAPTCHA laid over a faint copy of a real Booking.com page. The familiar look was the point: it made a strange request feel routine.
How Cyble could have helped. Phishing Detection finds sites impersonating the brand, and Watermarking Surveillance spots copied or mirrored brand assets, even on domains with no brand name in them. Automated Takedown then works to get confirmed pages removed. Every hotel that clicks after a takedown hits a dead link instead of a trap.
Step 4: Send lures across regions
What the attacker did. Emails and PDFs about negative reviews, guest requests, promotions and account checks went to hotels across North America, Europe, Oceania and Asia. Some came through vendor platforms and ordinary services such as Gmail and iCloud Mail.
How Cyble could have helped. Multi-language NLP is built to catch phishing and impersonation attempts that are not in English, which matters for a campaign spread across this many markets. Lures that partners report can be handed to Cyble’s brand team, traced to the live page behind them and queued for takedown.
Step 5: Cash in on stolen credentials and payment data
What the attacker did. Once a staff member pasted the command, malware such as XWorm, Lumma Stealer and VenomRAT went to work. Microsoft says every payload in the campaign could steal credentials and financial data for fraud.
How Cyble could have helped. Stopping the pasted command itself is a job for endpoint and email controls. What Cyble adds is the aftermath: OSINT surveillance watches forums, blogs and paste sites for exposed credentials and data leaks tied to the brand. Spotting stolen partner logins early gives everyone time to reset access before fraud follows.
This walkthrough maps public research to Cyble’s capabilities. It is not a claim that Cyble took part in the response to this campaign.
Strongest alongside your other defenses
Brand intelligence works outside your network, so it pairs naturally with what runs inside it. When a lure arrives from an ordinary Gmail or iCloud address, there is no fake sender domain to flag, so the landing page becomes the asset to hunt. And if someone does run the pasted command, email filtering, endpoint detection, script controls and phishing-resistant MFA, the mitigations Microsoft recommends, do the stopping. Brand intelligence makes sure far fewer people ever reach that moment.
Is your brand the next Target? Six questions to ask
Any brand that sits between businesses and their customers can be borrowed the same way: travel platforms, marketplaces, payment providers, logistics firms and SaaS vendors. Ask your team:
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
The lure. Emails styled as Booking.com messages about negative guest reviews, guest enquiries, promotion offers or account verification.
The landing page. A link, sometimes inside a PDF, opened a fake CAPTCHA laid over a faint copy of a real Booking.com page.
The trick. The “verification” told staff to open the Windows Run box and paste a command the page had already copied to their clipboard.
The payload. That command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.
This was not a one-off. Microsoft says Storm-1865 targeted Booking.com guests in 2023 and e-commerce buyers in 2024 before adding ClickFix. Booking.com told Infosecurity Magazine its own systems were not breached, but some accommodation partners and customers were hit.
Why the impersonated brand holds the first move
Booking.com could not install security software on the laptops of its accommodation partners. What it could reach was the attacker’s infrastructure copying its brand, and that infrastructure was detectable. Microsoft’s own email security flagged URLs in this campaign as impersonating booking.com.
The stakes are high. The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, out of $3.5 billion lost to imposter scams overall. Every copy of a brand caught early is one fewer victim.
Five steps, five chances to step in
Storm-1865 needed Booking.com’s credibility at every stage of the attack. Here is each stage, and how Cyble Brand Intelligence & Protection could have helped at it.
Fig. Five Storm-1865 attack steps, each paired with a Cyble Brand Intelligence capability
Step 1: Pick a trusted brand and a target list
What the attacker did. Storm-1865 was a repeat player. Microsoft says it went after Booking.com guests in 2023 and e-commerce buyers in 2024, then turned to hotel staff most likely to work with Booking.com.
How Cyble could have helped. Cyble’s in-house brand team and OSINT surveillance track brand mentions and the actors who keep returning to a brand. A known playbook becomes a set of watch-list rules, so the next wave is expected rather than discovered after the fact.
Step 2: Register the infrastructure
What the attacker did. The campaign needed domains and URLs to host its fake pages. Microsoft flagged some of them as matching a known malicious registrant pattern.
How Cyble could have helped. Suspicious & Watch-Listed Domain monitoring tracks new registrations and DNS activity for typosquats, homoglyphs and lookalike domains, including AI-generated ones. A domain built to impersonate the brand can be flagged when it is registered, before it hosts a single page.
Step 3: Build the fake Booking.com page
What the attacker did. Victims landed on a fake CAPTCHA laid over a faint copy of a real Booking.com page. The familiar look was the point: it made a strange request feel routine.
How Cyble could have helped. Phishing Detection finds sites impersonating the brand, and Watermarking Surveillance spots copied or mirrored brand assets, even on domains with no brand name in them. Automated Takedown then works to get confirmed pages removed. Every hotel that clicks after a takedown hits a dead link instead of a trap.
Step 4: Send lures across regions
What the attacker did. Emails and PDFs about negative reviews, guest requests, promotions and account checks went to hotels across North America, Europe, Oceania and Asia. Some came through vendor platforms and ordinary services such as Gmail and iCloud Mail.
How Cyble could have helped. Multi-language NLP is built to catch phishing and impersonation attempts that are not in English, which matters for a campaign spread across this many markets. Lures that partners report can be handed to Cyble’s brand team, traced to the live page behind them and queued for takedown.
Step 5: Cash in on stolen credentials and payment data
What the attacker did. Once a staff member pasted the command, malware such as XWorm, Lumma Stealer and VenomRAT went to work. Microsoft says every payload in the campaign could steal credentials and financial data for fraud.
How Cyble could have helped. Stopping the pasted command itself is a job for endpoint and email controls. What Cyble adds is the aftermath: OSINT surveillance watches forums, blogs and paste sites for exposed credentials and data leaks tied to the brand. Spotting stolen partner logins early gives everyone time to reset access before fraud follows.
This walkthrough maps public research to Cyble’s capabilities. It is not a claim that Cyble took part in the response to this campaign.
Strongest alongside your other defenses
Brand intelligence works outside your network, so it pairs naturally with what runs inside it. When a lure arrives from an ordinary Gmail or iCloud address, there is no fake sender domain to flag, so the landing page becomes the asset to hunt. And if someone does run the pasted command, email filtering, endpoint detection, script controls and phishing-resistant MFA, the mitigations Microsoft recommends, do the stopping. Brand intelligence makes sure far fewer people ever reach that moment.
Is your brand the next Target? Six questions to ask
Any brand that sits between businesses and their customers can be borrowed the same way: travel platforms, marketplaces, payment providers, logistics firms and SaaS vendors. Ask your team:
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Booking.com’s systems were never breached. Its name was. Storm-1865 spent months borrowing Booking.com’s identity to get into hotel computers, and every step of that borrowing left traces on the open internet.
The open internet is exactly where Cyble Brand Intelligence & Protection works. Walk through the campaign one step at a time, and at each step there is a point where it could have spotted the attacker, cut the attack short or limited the damage.
What happened
From December 2024, a group Microsoft tracks as Storm-1865 posed as Booking.com to target hotel and hospitality staff across North America, Europe, Oceania and South and Southeast Asia. Microsoft Threat Intelligence published its findings on March 13, 2025, and said the campaign was still running as of February 2025.
The attack had four moving parts:
The lure. Emails styled as Booking.com messages about negative guest reviews, guest enquiries, promotion offers or account verification.
The landing page. A link, sometimes inside a PDF, opened a fake CAPTCHA laid over a faint copy of a real Booking.com page.
The trick. The “verification” told staff to open the Windows Run box and paste a command the page had already copied to their clipboard.
The payload. That command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.
This was not a one-off. Microsoft says Storm-1865 targeted Booking.com guests in 2023 and e-commerce buyers in 2024 before adding ClickFix. Booking.com told Infosecurity Magazine its own systems were not breached, but some accommodation partners and customers were hit.
Why the impersonated brand holds the first move
Booking.com could not install security software on the laptops of its accommodation partners. What it could reach was the attacker’s infrastructure copying its brand, and that infrastructure was detectable. Microsoft’s own email security flagged URLs in this campaign as impersonating booking.com.
The stakes are high. The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, out of $3.5 billion lost to imposter scams overall. Every copy of a brand caught early is one fewer victim.
Five steps, five chances to step in
Storm-1865 needed Booking.com’s credibility at every stage of the attack. Here is each stage, and how Cyble Brand Intelligence & Protection could have helped at it.
Fig. Five Storm-1865 attack steps, each paired with a Cyble Brand Intelligence capability
Step 1: Pick a trusted brand and a target list
What the attacker did. Storm-1865 was a repeat player. Microsoft says it went after Booking.com guests in 2023 and e-commerce buyers in 2024, then turned to hotel staff most likely to work with Booking.com.
How Cyble could have helped. Cyble’s in-house brand team and OSINT surveillance track brand mentions and the actors who keep returning to a brand. A known playbook becomes a set of watch-list rules, so the next wave is expected rather than discovered after the fact.
Step 2: Register the infrastructure
What the attacker did. The campaign needed domains and URLs to host its fake pages. Microsoft flagged some of them as matching a known malicious registrant pattern.
How Cyble could have helped. Suspicious & Watch-Listed Domain monitoring tracks new registrations and DNS activity for typosquats, homoglyphs and lookalike domains, including AI-generated ones. A domain built to impersonate the brand can be flagged when it is registered, before it hosts a single page.
Step 3: Build the fake Booking.com page
What the attacker did. Victims landed on a fake CAPTCHA laid over a faint copy of a real Booking.com page. The familiar look was the point: it made a strange request feel routine.
How Cyble could have helped. Phishing Detection finds sites impersonating the brand, and Watermarking Surveillance spots copied or mirrored brand assets, even on domains with no brand name in them. Automated Takedown then works to get confirmed pages removed. Every hotel that clicks after a takedown hits a dead link instead of a trap.
Step 4: Send lures across regions
What the attacker did. Emails and PDFs about negative reviews, guest requests, promotions and account checks went to hotels across North America, Europe, Oceania and Asia. Some came through vendor platforms and ordinary services such as Gmail and iCloud Mail.
How Cyble could have helped. Multi-language NLP is built to catch phishing and impersonation attempts that are not in English, which matters for a campaign spread across this many markets. Lures that partners report can be handed to Cyble’s brand team, traced to the live page behind them and queued for takedown.
Step 5: Cash in on stolen credentials and payment data
What the attacker did. Once a staff member pasted the command, malware such as XWorm, Lumma Stealer and VenomRAT went to work. Microsoft says every payload in the campaign could steal credentials and financial data for fraud.
How Cyble could have helped. Stopping the pasted command itself is a job for endpoint and email controls. What Cyble adds is the aftermath: OSINT surveillance watches forums, blogs and paste sites for exposed credentials and data leaks tied to the brand. Spotting stolen partner logins early gives everyone time to reset access before fraud follows.
This walkthrough maps public research to Cyble’s capabilities. It is not a claim that Cyble took part in the response to this campaign.
Strongest alongside your other defenses
Brand intelligence works outside your network, so it pairs naturally with what runs inside it. When a lure arrives from an ordinary Gmail or iCloud address, there is no fake sender domain to flag, so the landing page becomes the asset to hunt. And if someone does run the pasted command, email filtering, endpoint detection, script controls and phishing-resistant MFA, the mitigations Microsoft recommends, do the stopping. Brand intelligence makes sure far fewer people ever reach that moment.
Is your brand the next Target? Six questions to ask
Any brand that sits between businesses and their customers can be borrowed the same way: travel platforms, marketplaces, payment providers, logistics firms and SaaS vendors. Ask your team:
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Booking.com’s systems were never breached. Its name was. Storm-1865 spent months borrowing Booking.com’s identity to get into hotel computers, and every step of that borrowing left traces on the open internet.
The open internet is exactly where Cyble Brand Intelligence & Protection works. Walk through the campaign one step at a time, and at each step there is a point where it could have spotted the attacker, cut the attack short or limited the damage.
What happened
From December 2024, a group Microsoft tracks as Storm-1865 posed as Booking.com to target hotel and hospitality staff across North America, Europe, Oceania and South and Southeast Asia. Microsoft Threat Intelligence published its findings on March 13, 2025, and said the campaign was still running as of February 2025.
The attack had four moving parts:
The lure. Emails styled as Booking.com messages about negative guest reviews, guest enquiries, promotion offers or account verification.
The landing page. A link, sometimes inside a PDF, opened a fake CAPTCHA laid over a faint copy of a real Booking.com page.
The trick. The “verification” told staff to open the Windows Run box and paste a command the page had already copied to their clipboard.
The payload. That command used mshta.exe to pull commodity malware, including XWorm, Lumma Stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all built to steal credentials and payment data.
This was not a one-off. Microsoft says Storm-1865 targeted Booking.com guests in 2023 and e-commerce buyers in 2024 before adding ClickFix. Booking.com told Infosecurity Magazine its own systems were not breached, but some accommodation partners and customers were hit.
Why the impersonated brand holds the first move
Booking.com could not install security software on the laptops of its accommodation partners. What it could reach was the attacker’s infrastructure copying its brand, and that infrastructure was detectable. Microsoft’s own email security flagged URLs in this campaign as impersonating booking.com.
The stakes are high. The US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, out of $3.5 billion lost to imposter scams overall. Every copy of a brand caught early is one fewer victim.
Five steps, five chances to step in
Storm-1865 needed Booking.com’s credibility at every stage of the attack. Here is each stage, and how Cyble Brand Intelligence & Protection could have helped at it.
Fig. Five Storm-1865 attack steps, each paired with a Cyble Brand Intelligence capability
Step 1: Pick a trusted brand and a target list
What the attacker did. Storm-1865 was a repeat player. Microsoft says it went after Booking.com guests in 2023 and e-commerce buyers in 2024, then turned to hotel staff most likely to work with Booking.com.
How Cyble could have helped. Cyble’s in-house brand team and OSINT surveillance track brand mentions and the actors who keep returning to a brand. A known playbook becomes a set of watch-list rules, so the next wave is expected rather than discovered after the fact.
Step 2: Register the infrastructure
What the attacker did. The campaign needed domains and URLs to host its fake pages. Microsoft flagged some of them as matching a known malicious registrant pattern.
How Cyble could have helped. Suspicious & Watch-Listed Domain monitoring tracks new registrations and DNS activity for typosquats, homoglyphs and lookalike domains, including AI-generated ones. A domain built to impersonate the brand can be flagged when it is registered, before it hosts a single page.
Step 3: Build the fake Booking.com page
What the attacker did. Victims landed on a fake CAPTCHA laid over a faint copy of a real Booking.com page. The familiar look was the point: it made a strange request feel routine.
How Cyble could have helped. Phishing Detection finds sites impersonating the brand, and Watermarking Surveillance spots copied or mirrored brand assets, even on domains with no brand name in them. Automated Takedown then works to get confirmed pages removed. Every hotel that clicks after a takedown hits a dead link instead of a trap.
Step 4: Send lures across regions
What the attacker did. Emails and PDFs about negative reviews, guest requests, promotions and account checks went to hotels across North America, Europe, Oceania and Asia. Some came through vendor platforms and ordinary services such as Gmail and iCloud Mail.
How Cyble could have helped. Multi-language NLP is built to catch phishing and impersonation attempts that are not in English, which matters for a campaign spread across this many markets. Lures that partners report can be handed to Cyble’s brand team, traced to the live page behind them and queued for takedown.
Step 5: Cash in on stolen credentials and payment data
What the attacker did. Once a staff member pasted the command, malware such as XWorm, Lumma Stealer and VenomRAT went to work. Microsoft says every payload in the campaign could steal credentials and financial data for fraud.
How Cyble could have helped. Stopping the pasted command itself is a job for endpoint and email controls. What Cyble adds is the aftermath: OSINT surveillance watches forums, blogs and paste sites for exposed credentials and data leaks tied to the brand. Spotting stolen partner logins early gives everyone time to reset access before fraud follows.
This walkthrough maps public research to Cyble’s capabilities. It is not a claim that Cyble took part in the response to this campaign.
Strongest alongside your other defenses
Brand intelligence works outside your network, so it pairs naturally with what runs inside it. When a lure arrives from an ordinary Gmail or iCloud address, there is no fake sender domain to flag, so the landing page becomes the asset to hunt. And if someone does run the pasted command, email filtering, endpoint detection, script controls and phishing-resistant MFA, the mitigations Microsoft recommends, do the stopping. Brand intelligence makes sure far fewer people ever reach that moment.
Is your brand the next Target? Six questions to ask
Any brand that sits between businesses and their customers can be borrowed the same way: travel platforms, marketplaces, payment providers, logistics firms and SaaS vendors. Ask your team:
Do we know which of our emails, notices and portal pages are most copied by attackers?
Are we alerted when a domain containing our name, or a homoglyph of it, is registered?
Can we spot a cloned page even when it sits on an unrelated domain or free hosting?
How long does it take us to get a confirmed phishing page taken down?
Do our partners know how to report a suspicious message that uses our name?
Do we watch criminal forums and channels for kits or templates built around our brand?
If more than two answers are “no” or “not sure,” the attacker’s preparation phase is happening without anyone watching.
The takeaway
Look back at the five steps and a pattern stands out. Storm-1865 needed Booking.com’s credibility at every one of them, and every one left a trace outside the victims’ networks.
With Cyble Brand Intelligence & Protection watching, each trace becomes a chance to step in: a repeat actor on the watch list, a lookalike domain flagged at registration, a cloned page taken down, a lure traced to its source, a leaked login caught early. If your partners and customers trust your name, Cyble helps make sure nobody else gets to use it.
Cyble, Brand Intelligence & Protection datasheet v1.1, August 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversight or well-designed policies.
Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles.
First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules.
You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints.
Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Let’s take a closer look at these solutions and technologies.
Popular AI applications and services in organizations
Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendors’ products installed at the time of the study.
#
AI product
1
Claude
2
Claude Code
3
Codex
4
OpenCode
5
Zed
6
Wispr Flow
7
LM Studio
8
ZCode
9
Chatbox
10
Cherry Studio
The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow).
According to open sources, these are the most widely used AI services in 2026:
Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 (download)
* Data for previous quarters was updated and may differ slightly from previously published data.
Application Control and Web Control
To enforce the organization’s security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization.
Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use.
This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees.
Here is what this functionality looks like to KSC administrators:
KL categories available when configuring Application Control
For details on how to configure Application Control in KSC, follow this link.
In Kaspersky Endpoint Security (KES), Application Control can operate in two modes:
Denylist. In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode.
Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules.
Below are the steps to configure Application Control to block AI tools.
Configuring Application Control for the AI Tools category in KES
With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesn’t start.
KES notification about an attempt to launch an AI agent
The View applications drop-down list shows products for a specific vendor.
Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning.
KES notification about an attempt to access a prohibited web resource
When configuring access, the administrator can block websites that provide AI as a service.
Website categories
For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control.
Kaspersky Endpoint Detection and Response
To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesn’t fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity.
Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events.
For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device.
In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task.
We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys.
The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation.
The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the user’s data.
The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way.
Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API.
The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix:
AI agent profiles on Kaspersky TIP
The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for.
Claude profile on Kaspersky TIP
The description also lists ways to detect the software through standard system auditing mechanisms:
Windows: events from standard audit logs and Sysmon events
Linux: syscall audit events and Sysmon events
Network auditing: a set of protocols and the traffic generated by the software
The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts.
Detection section in the Claude profile
Hunt Hub
In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand.
This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups.
In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents.
Rules in the Hunt Hub repository
The rule card provides:
Detailed description
Rule’s severity level, confidence level, and alert format
Detection tips
Description of possible false positives
Platforms the rule can run on
Tactics, techniques, and sub-techniques covered by the rule
Groups that use the technique covered by the rule
Detection logic that shows what exactly triggers the rule
Detection rule card in Hunt Hub
Kaspersky Scan Engine
Skills are a key component of the AI agent ecosystem. They’re prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents.
Detection of a malicious agent skill in Kaspersky Scan Engine
Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so it’s critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size.
Detection of an LLM with malicious code in Kaspersky Scan Engine
Conclusion
AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this:
Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity.
Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host.
Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources.
Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs.
When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
State Sen. Brent Taylor, R-Memphis, interacts with protesters as he leaves the Senate chamber after a special session of the state legislature to redraw the U.S. congressional voting map in Nashville, Tennessee, in May. George Walker IV/AP
Not two weeks after the Tennessee legislature carved Memphis into three congressional districts this spring, in a move designed to eliminate Democratic representation, Republican state Sen. Brent Taylor made his electoral expectations clear in a photo posted on social media.
Taylor and U.S. Rep. Tim Burchett, a fellow Republican, sat side by side on the U.S. Capitol steps. “My friend Tim Burchett showing me the dadgum ropes,” Taylor wrote in a Facebook post.
On May 7, the same day that the new districts were approved, Taylor had announced his bid to represent the redrawn Congressional District 9, which for more than four decades had stood as the state’s sole majority Black district. During that time, it covered mostly the Memphis area; it now stretches across half the state and is majority white.
Taylor, 58, already has a track record with many of the voters he is now seeking to represent in Washington, D. C.: In his nearly four years as a state senator, he has taken steps to strip authority from local officials elected by many of those same voters. With the backing of a Republican supermajority, Taylor, who is white, pushed through half a dozen laws that superseded the power and priorities of local politicians.
Around the country, state legislatures from both parties have used preemption laws to control local governments. That tactic has been embraced by Republican-dominated statehouses in recent years as a way to restrict the ability of Democratic-led cities to enact policies state leaders disagree with, including protections for civil rights, public health and workers.
Memphis has long struggled with high rates of violent crime that have begun to fall only in the last couple of years. This is where Taylor focused his legislative efforts. He led the charge to prohibit judges from considering a defendant’s ability to pay when making bail decisions. He has tried to oust Steve Mulroy, the first Democrat elected as Shelby County district attorney in 25 years, and pushed through legislation authorizing the state to review every decision made by his office. And he co-sponsored a law that voided the Memphis City Council’s ban on police stops for minor traffic infractions, which had been passed after the 2023 beating death of Black motorist Tyré Nichols.
The question of how to keep communities safe has drawn divergent political approaches in Memphis — from Mulroy’s focus on rehabilitation as part of his effort to lower violent crime, to Taylor’s emphasis on aggressive prosecution and incarceration. Those approaches can mean very different experiences for the people of Memphis, which makes up most of Shelby County. Some elected officials and criminal justice experts warn that the laws Taylor has championed will embolden police to detain drivers without justification and the criminal justice system to lock up more people for longer periods in the already overcrowded county jail, where more than 65 people have died since 2018.
“I think he’s very dangerous for Shelby County, and he’s going to be very dangerous for the Ninth District if he gets elected,” said former Shelby County General Sessions Court Judge Bill Anderson, referring to how Taylor’s policies could especially harm Black men. Anderson retired in May 2025 after clashing publicly with Taylor over bail reform measures. (Anderson supported them; Taylor opposed them.)
Taylor is favored to win because of redistricting by Tennessee Republicans after a U.S. Supreme Court ruling in April made it harder to challenge gerrymandering that dilutes the Black vote. The Mississippi native, who lives in an antebellum-style mansion in a tiny and heavily white community east of Memphis, has loaned his congressional campaign $1.5 million. The candidate made millions after selling his funeral home businesses to a private equity firm.
Taylor’s opponent is state Rep. Justin J. Pearson, a 31-year-old Black Democrat who has taken a very different approach to what the district needs. Pearson has called for addressing the root causes of crime by improving schools and economic opportunities instead of a singular focus on incarceration. He first made national headlines for his role in stopping the construction of an oil pipeline in a Black Memphis neighborhood. He is also one of two Democratic legislators expelled by the Republican supermajority after leading a protest calling for gun control following a 2023 school shooting. With deep family roots in southwest Memphis, Pearson has positioned himself as the better fit for the historically Democratic Ninth Congressional District. He has also received support from national Democrats and has outraised Taylor in campaign donations.
Democratic congressional candidate state Rep. Justin J. Pearson speaks to supporters after an election night watch party for the state’s primaries in Memphis, Tennessee, in August.Kevin Wurm/MLK50/CatchLight Local/Report for America
Taylor, who declined to be interviewed for this story, has said that the laws he has championed prioritize public safety. He did not respond to detailed questions.
But John Pfaff, a professor at Fordham School of Law who has studied how state preemption laws impact prosecutors, said tough-on-crime laws like the ones Taylor helped pass have historically been “a form of social control against disliked minority groups” under the guise of public safety. Non-urban voters, Pfaff said, “do feel, however incorrectly, sort of victimized by expanding civil rights” that urban voters choose. While these voters cannot cast ballots in city elections, he said, they have another path by which to exert power: “If the suburbs and rural areas control the governor’s mansion and the state legislature, they then can use their power there through preemption laws that finally tell Memphis what they want Memphis to do.”
Prohibiting Limits on Police Traffic Stops
In January 2023, the month Taylor took office, the nation was shaken by video of violent policing in Memphis.
A street surveillance camera and police body cameras captured what happened after undercover Memphis police officers pulled over 29-year-old Nichols just a few blocks from his mother’s home. For three minutes, officers repeatedly punched the unarmed man in the face, hit him with a baton and kicked him as he screamed for his mom. Nichols would die from his injuries in the hospital three days later.
After pressure from Nichols’ family and community organizers, the Memphis City Council unanimously passed an ordinance in April of that year barring police from pulling motorists over for minor traffic violations, such as a broken tail light, as a pretext for investigating an unrelated, more serious crime. Research shows that these stops are disproportionately used to detain Black drivers, undermine the public’s trust in police and create unnecessary police encounters that can turn deadly.
RowVaughn Wells, center, with family, friends and supporters during a community rally and celebration of what would have been Tyré Nichols’ 32nd birthday outside of the I Am a Man Plaza in Memphis in June 2025.Brad Vest for MLK50
Taylor, who had been in the state Senate for a few months when the city ordinance passed, said it made the public less safe by limiting the potential for police to investigate more serious crimes. The next year, he and state Rep. John Gillespie, a Shelby County Republican, sponsored legislation that prohibited local government from curbing law enforcement’s ability to conduct traffic stops, effectively undoing Memphis’ ordinance.
Nichols’ mother, RowVaughn Wells, pleaded with lawmakers to drop the bill. Speaking on the Senate floor, Taylor responded, saying that as a funeral home director, he empathized with the Nichols’ family, but “we can’t let that empathy, Mr. Speaker, cloud our judgment in protecting 7 million Tennesseans.”
Taylor’s intervention suggests “that Memphis voters don’t know what their best interests are,” said Martavius Jones, who was chair of the Memphis City Council when the city ordinance passed. “What we were trying to do would not jeopardize the safety of anyone — not even in Memphis, but much less the rest of the population of Tennessee.”
Tennessee Gov. Bill Lee, a Republican, told reporters before signing the law that no one should limit police in their enforcement methods and officers should be held accountable for their actions.
“I think what’s most important for us to remember is that we can give law enforcement tools,” Lee said, “but we’ve got to hold law enforcement to a standard of using those tools appropriately, where there’s an appropriate interaction with the public.”
Eight months after Tennessee lawmakers passed Taylor’s preemption bill, the U.S. Department of Justice released its investigation of the Memphis Police Department, finding that its aggressive traffic enforcement had harmed Memphians. The Justice Department recommended that the city limit the use of pretextual stops. Such police activity enabled the “regular use of excessive force with impunity” and unlawfully discriminated against Black residents, the Biden administration’s report said. When President Donald Trump took office in 2025, his Justice Department retracted those findings.
Over the last year, law enforcement has ramped up the use of such stops, especially in immigration enforcement, as Trump’s Memphis Safe Task Force — a collection of more than two dozen state and federal law enforcement agencies, including the National Guard — descended upon the city. Taylor supported the effort, testifying before the U.S. Senate days before it began that the task force would “succeed in doing the hard work to infiltrate gangs and arrest more routine criminals.”
Unprecedented Scrutiny of a District Attorney
Since his first year in the state Senate, Taylor had also been working to displace the decision-making authority of another locally elected office: district attorneys, especially Mulroy, one of Tennessee’s two Democratic county prosecutors. Taylor called him a “far-left zealot” who “has the potential to make the scourge of violent crime even worse.”
Shelby County District Attorney Steve Mulroy speaks at a vigil for the third anniversary of Nichols’ death in Memphis in January.Andrea Morales/MLK50
In 2023, Taylor sponsored a law that transferred the power to review certain death penalty cases from county prosecutors, who are elected, to the state attorney general, who is appointed by the state Supreme Court. While the law applied statewide, it disproportionately impacted Shelby County, where half of the state’s 40 death row prisoners were prosecuted. The law, Mulroy said at the time, “effectively disenfranchises the voters” who chose their district attorney.
Taylor would go on to further weaken Mulroy’s office following Trump’s 2025 deployment of his crime task force to Memphis. As arrests soared, Taylor worked to place the district attorney’s decisions under unprecedented scrutiny, saying he wanted to ensure that the prosecution of task force cases was as aggressive as the task force itself.
One new law, co-sponsored by Taylor, authorized the state attorney general to review every case that comes through Mulroy’s office, including those that stem from arrests made by Trump’s task force, “to ensure the proper administration of justice necessary to protect the safety of the community.” The dispositions of each case, along with bail recommendations, would be reported to legislative leaders.
Republican state Rep. Andrew Farmer, who introduced the bill in the House, noted that it is designed to ensure that “all crimes that deserve to be prosecuted are prosecuted.”
Mulroy is “just going to have to work harder and ensure that people are continuing to stay safe,” Farmer said on the House floor. “We want Memphis to continue on the path that it’s going — up.”
The state’s district attorneys general conference, led by Republican former District Attorney Stephen Crump, opposed an early version of the bill, which would have applied to district attorneys across the state, because it could lead prosecutors to second-guess their decisions. He dropped his objections after the bill was narrowed to apply to only Mulroy.
That law has another provision aimed at Mulroy as well: If he declines to prosecute specific categories of crime, the state attorney general can ask the state Supreme Court to intervene by installing a temporary district attorney who would then decide whether to prosecute. Taylor has long sought to limit Mulroy’s authority, and the provision would be a way to do so. Mulroy said the effect would be “an unelected shadow DA operating in parallel to the duly elected DA.”
“Prosecutorial discretion and prosecutorial independence is a key fundamental part of our criminal justice system,” Mulroy said. “It’s clear under both the text of the Tennessee constitution and Tennessee Supreme Court case law, and this bill does great violence to those principles.”
Taylor co-sponsored a second law, passed in May, that requires Mulroy’s office to report to the state and the U.S. Department of Justice within 10 business days every time it has entered into a plea deal, or dismissed or lowered the charges on a felony offense that resulted from a task force arrest.
“Memphis residents deserve confidence that the significant investments being made to combat violent crime are matched with accountability at every level of the justice system,” Gillespie, who co-sponsored the bill in the House, said at the time.
Mulroy has sued to stop both laws, claiming they are unconstitutional because they unfairly single out Shelby County and create an administrative burden. The lawsuit is pending in state court. Meanwhile, Mulroy has objected to his staff spending time on the reporting requirements, which he called “pointless busywork.”
Mulroy’s election in 2022 as the county’s first Democratic district attorney in more than two decades came on the heels of a year with a record number of homicides. But Republicans’ tough-on-crime approach had grown unpopular with voters, and Mulroy vowed to be an alternative. He promised to deprioritize the prosecution of low-level offenses such as marijuana possession and shoplifting; emphasize rehabilitation such as drug treatment, mental health counseling and job training; and establish a unit to examine the validity of convictions.
One of the people who campaigned for him was William Arnold, who had spent nearly seven years in state prison before his conviction was dismissed following examination by a Davidson County conviction review unit. The community organizer said he saw Mulroy’s candidacy as a way to “support someone who could help Memphians in a different way.”
To see Mulroy’s power being muted by Taylor is disheartening, Arnold said. But that is not surprising to him, given how the state legislature has long treated the predominantly Black city, including replacing the Memphis Shelby County Schools’ elected board with a state-appointed one.
William Arnold, who spent nearly seven years incarcerated for a crime he did not commit, is now a community organizer and a supporter of Mulroy.Brandon Dill for MLK50
Bail Calculator Scrapped
Among the preemptive legislation Taylor has sponsored, a 2023 effort stood out: the dismantling of a bipartisan effort to ensure Shelby County’s bail practices did not discriminate against poor people, who are disproportionately Black.
Under state law, magistrates are to “impose the least onerous conditions” when deciding bail and should set bail “as low as the court determines is necessary” to assure the defendant returns to court.
But in practice, hundreds of people were being detained at the Shelby County Jail simply because they couldn’t afford bail, according to Just City, a Memphis criminal justice reform organization, which along with the American Civil Liberties Union threatened to sue the county in 2021 for violating existing state law. Being jailed while awaiting trial can cause arrestees to lose jobs and child custody, the organizations argued.
In August 2022, the organizations and county officials — including Mulroy’s predecessor, Republican District Attorney Amy Weirich — agreed on a new bail order that included an “ability to pay” calculator.
That tool quickly drew Taylor’s ire, and by the following January he had co-sponsored a bill to kill it, characterizing the calculator in a Senate Judiciary Committee meeting as a way of “essentially asking defendants how much money they happen to have in their pocket so that they can make bail.”
The bill’s supporters said judges should prioritize public safety when deciding whether to release defendants. “There is blood running in the streets of Memphis today because they’re letting people out,” state Rep. William Lamberth, a Republican, said on the House floor.
State law requires judges, when setting bail, to consider several factors, including a defendant’s financial condition. And Josh Spickler, executive director of Just City, said that’s exactly what the tool helped judges do.
Under Taylor’s law, however, “the defendant’s ability to pay shall not be considered.”
“That tied our hands as judges,” Anderson, the former Shelby County judge, said in an interview.
A 2025 University of Memphis study found that the median bail amount increased after Taylor’s law took effect. And the law’s impact falls hardest on Black residents, Anderson said, because they are more likely to be low-income and make up a disproportionate share of Shelby County jail occupants.
“To those of us in the system, it’s obvious what he’s doing,” said Anderson, who resigned in 2025 with six years left of his eight-year term. “He called them reform acts, but they’re not reform.”
Angelina Resendiz’s voice on the phone was frantic. She was calling a friend from the barracks room of Jermiah Copeland, a fellow sailor at Naval Station Norfolk in Virginia. They had spent the evening together, kissing and drinking, and now Resendiz, 21, needed to leave.
It was the last time anyone would hear from her. When Resendiz’s friend arrived at the barracks 15 minutes later, the pair was nowhere to be found.
“The Navy failed her,” Resendiz’s mother, Esmerelda Castle, told The Intercept. After her daughter’s disappearance, friends and family spent a week scrambling to find Resendiz. Castle found the Navy’s reports in that time unclear, delayed, or downright false.
A first-of-its-kind Intercept investigation has found critical shortcomings in the U.S. military’s procedures for documenting and preserving records of homicides that result from domestic abuse, including intimate partner violence. The Pentagon’s mandated reports to Congress appear to substantially undercount these killings, omitting nearly half of cases.
In the six years before Copeland’s murder of Resendiz, the Pentagon recorded 41 domestic abuse-related homicides committed by service members. The Intercept identified nearly twice as many: at least 73 potential cases involving 79 victims — almost all of them women — during the same period. Reports for fiscal year 2025, when Resendiz was murdered, are due in November.
The Intercept examined publicly available news articles, obituaries, court records, memorials, and other data to investigate the specifics behind the Defense Department’s numbers. Reporters also used data obtained through a Freedom of Information Act request on Army noncombat fatalities to match names, because some news coverage did not mention the victims’ and alleged perpetrators’ military service.
A killing qualified for the dataset if it occurred in fiscal years 2019 to 2024; if the perpetrator was a member of the military at the time of the crime; and if the case involved a homicide. The database only includes cases where a victim of the violence had dated or was in a romantic relationship with the suspected perpetrator, and it includes multiple women living abroad who were foreign citizens dating American troops.
In the fiscal years since the second Trump administration took power, The Intercept found at least 10 service women or women working for the Defense Department have died from intimate partner and domestic violence, six of them killed by male co-workers. An additional 10 civilian women have been killed by male military personnel in intimate partner violence-related homicides during the same period.
A Pentagon spokesperson acknowledged The Intercept’s queries about the discrepancy in homicide rates but did not respond to detailed questions before publication.
“At this moment in our country’s history, I am afraid these numbers are going to increase even further,” said Jacquelyn Campbell, a professor at Johns Hopkins University’s School of Nursing who has been studying domestic violence in the military for decades. “We need primary prevention for everyone in the military and their partners.”
The findings come in the wake of President Donald Trump’s August announcement of a Military Spouse Commission, led by Jennifer Hegseth, the wife of Defense Secretary Pete Hegseth, and other high-level military leaders. The commission’s mandate is to guide policy around issues affecting military families. Though intimate partner violence and spousal abuse have concerned military family advocates for decades and thousands of new cases are reported each year, the commission does not mention the issue as one of its areas of focus.
The Navy and DoD have said in public statements and communication with members of Congress and Castle that while “proper procedures were followed” following the death of Resendiz, they have identified several processes that require further review.
“What Are the Statistics?”
Copeland killed Resendiz on May 29, 2025. In the days after Resendiz’s disappearance, her friends filed missing person reports and called Castle in Texas, who in turn called the Navy. None of them knew that Resendiz was dead.
The Navy’s official timeline of events says it did not start investigating her disappearance as a crime until a missing person’s report was filed on the 31st, and that Castle did not reach out until that day. Phone records she shared with The Intercept and members of Congress show she started calling on the 29th.
“I was told she was found, and that the original missing person’s report was exaggerated,” Castle recalled. “I didn’t think for a second that the Navy would lie to me.
“I was told she was found, and that the original missing person’s report was exaggerated.”
Technically, Resendiz had been found — a Navy chief searching for her had seen Resendiz’s body packed under the covers in Copeland’s bed around 10 a.m. on the day of her disappearance. They assumed she was asleep, according to evidence later revealed during trial. But as Castle tells it — including in a congressional inquiry she wrote requesting a deeper investigation— a Navy chief claimed on the phone to have spoken to her daughter in Copeland’s room.
She had been dead for hours.
“He had Angie wrapped up in a blanket on his bed,” said Castle. “It was against policy for her to be in the barracks. And they just turned their backs and left.”
Intimate partner violence in the military has long been a problem with unclear signs of progress. Killings in the 1990s on bases such as Fort Campbell made national headlines, leading Congress to establish the Defense Task Force on Domestic Violence in 2000.
Campbell, the nursing professor, was part of the effort, which issued over 200 suggestions for improvement by 2003. “Most of the recommendations we made a long time ago were never implemented,” she said. For one, she’d repeatedly requested better recordkeeping.
“One of the things I kept asking was, ‘What are the statistics on intimate partner homicide in the military?’ We could never get them,” Campbell said. “And in the military’s suicide reports, you cannot determine how many suicides were part of homicide–suicides, where a service member killed a civilian wife or partner before killing himself.”
This lack of clarity sounded familiar to Priscilla Rodriguez, who spent 10 years in the Marine Corps before working in strategic communications for the Navy.
“The command chose not to pursue military legal action.”
Rodriguez experienced domestic violence that met the Defense Department’s criteria from her husband, an active-duty Marine at the time, according to documents reviewed by The Intercept. Her husband pleaded guilty to misdemeanor child abuse in civilian courts, and military legal authorities recommended domestic violence charges. “The command chose not to pursue military legal action,” Rodriguez said.
The Intercept’s analysis of the rates of domestic abuse reported in Pentagon data found intimate partner violence among married military couples was at least four times higher than the civilian rate. The Pentagon does not report the rate of abuse involving unmarried intimate partners, like Resendiz and Copeland.
Gaps like these make it difficult to have a thorough reckoning of the problem’s scale. “When accountability is inconsistent,” Rodriguez said, “it sends a message that abuse can and will remain hidden.”
Defense Secretary Pete Hegseth serves Thanksgiving meals to service members in Washington, D.C., on Nov. 28, 2025. He was joined by his wife, Jennifer Hegseth.Photo: Master Sgt. William Blankenship/U.S. Air Force photo Joint Task Force DC
“I Knew My Kid Was Not Coming Back”
Copeland kept Resendiz’s corpse hidden in his barracks room for four days, until June 2, 2025, when he put her body into a duffel bag and dumped it in a wooded area behind a nearby elementary school.
By then, he was being questioned by the Naval Criminal Investigative Service on her whereabouts, and Castle was still wondering about her daughter’s safety. She’d asked naval authorities to have her daughter give her a call, and when it never came, she contacted the base again.
A Navy official suggested her daughter may have gone AWOL.
“I didn’t believe that,” Castle said. “My kid is scared to miss work. She won’t take off.”
Castle flew to Virginia herself.
Resendiz had been dead for a week. Castle felt she wasn’t getting the information she needed after the Navy and local authorities had put out a statewide missing person’s alert. She requested that she be let into her daughter’s barracks room.
“I didn’t want anyone else touching her stuff,” Castle said. “It was how she left it. There was still paint out; she had started painting again. Her yoga mat was still out. She had planned on returning. I knew my kid was not coming back.”
She spent two more days in Virginia searching for her daughter, talking to local news, and asking naval authorities to give more updates.
“They didn’t declare her AWOL or dead,” Castle said. “They said she was duty status unknown. I was worried they were going to wash their hands of her.”
On June 7, Castle flew back to Texas. Police found Resendiz’s body in the duffel bag two days later.
A History of Violence
Jermiah Copeland was convicted of Resendiz’s murder on June 8, 2026. According to evidence entered into court records in his murder trial, he had also been accused of two instances of domestic violence, three sexual assaults, indecent recordings, and other crimes from during and before his Navy service.
“He had a history of violence against women starting in high school,” Castle said. “And was still allowed to join with the charges against him. Then he was accused of raping another service member, and he was transferred. There were no safeguards in place at the new command.”
The absence of safeguards against intimate partner violence in the military is part of a broader set of structural and cultural failings, experts told The Intercept.
“There are many disincentives for a couple, particularly when one or both partners are on active duty, to seek help,” Campbell said. “Active-duty women who were being abused told us: ‘If my commanding officer knew, I would never get the next promotion.’ There is considerable stigma, even for the victim. That makes the violence much more likely to escalate and makes it more likely that we eventually end up with homicides.”
A previous Intercept investigation found active-duty Army women were more likely to be killed by fellow service members than by enemy combatants and had a higher per capita risk of homicide than their fellow male soldiers between the years 2011 and 2025.
More than 70 percent of the victims had an intimate relationship with the perpetrator at some point. Army women faced an intimate partner homicide rate at least three times higher than women nationally; controlling for those killed by service men and male veterans alone, it was double.
The military’s systems for identifying and responding to abuse, meanwhile, have come under repeated scrutiny. A 2021 Government Accountability Office report found the department “has not collected and reported accurate data for all domestic abuse allegations received,” leaving it unable to assess the scope of alleged abuse.
The same can be said for homicides.
Almost a third of the 79 victims The Intercept found were killed in murder–suicides. Firearms were used in over two-thirds of the fatalities. Twenty-five of the victims were service members. Multiple homicides involved corollary victims who were not partners, including children, who research shows make up a sizable amount of intimate partner violence-related deaths.
In response to The Intercept’s questions, the Department of Defense stated that data in its domestic abuse reports does not constitute estimates, as it is only using aggregated data from the Family Advocacy Program Central Registry, a database run by the DoD. It further stated it did not have any more information to share on the matter.
“Right now, unless an incident is reported to the Family Advocacy Program,” said Campbell, “nobody knows about it. Those reports are only the tip of the iceberg.”
Data tracking failures have had deadly consequences. The Air Force failed to submit the criminal history of a former service member convicted of assaulting his wife and stepson to a federal database that could have prevented him from purchasing firearms. In 2017, he killed 26 people in Sutherland Springs, Texas.
When Rodriguez reported her own abuse to the DoD, she felt that they didn’t consider the previous information they had available. Installation-level committees review reported allegations and determine whether they meet criteria to be input into the central registry. But the process is plagued with issues, experts who spoke to the Intercept revealed, from investigation procedures to data tracking.
“I was terrified to disclose the full extent of the abuse I was experiencing,” Rodriguez said. “What stands out to me now is that the Family Advocacy Program already had access to my husband’s history. Given that history, I believe the conversation should have been much broader than simply asking whether I wanted to report anything. I left that initial interaction without understanding what support existed or how I could safely leave.”
While navigating her own case, Rodriguez was also watching the same problem surface through her communications work for the Navy.
“It felt completely disconnected from the reality my family and so many others were living.”
“Headlines I monitored involved active duty and Marine veterans accused of intimate partner homicide,” Rodriguez said. “At the same time, I reviewed serious incident reports that were elevated to senior leadership. … The narrative often indicated that intimate partner violence or domestic violence was a contributing or co-occurring factor.”
Navy criminal investigative data showed domestic violence-related deathsincreasing as Rodriguez was trying to raise the issue in 2022. She tried to compile domestic violence awareness resources, but she recalled being told the need wasn’t there.
“I was told there was ‘no demand signal,’” Rodriguez said. “It felt completely disconnected from the reality my family and so many others were living.”
Castle feels that the knowledge of Copeland’s history of abuse could have saved her daughter’s life.
“No one knew anything about him,” Castle said. “The leadership created an environment that allowed him to harm women.”
Winnable Cases
Since her daughter’s murder, Castle has been at work pushing the Navy and Defense Department to strengthen their responses to intimate partner violence. Her work led to the Navy changing its policies in July on how it transfers sailors with allegations of sexual violence.
Her wins, including potential plans by the Navy to change how it classifies missing sailors, are the latest in a long string of limited efforts toward progress.
“Records are important,” said Castle. “With my daughter, they didn’t want to classify her case properly at first. For the military, if something isn’t in a database, it doesn’t exist.”
Following the high-profile 2020 murder of Army Spc. Vanessa Guillén at Fort Hood — and two years after domestic violence became classified as a crime under the Uniform Code of Military Justice — Congress gave independent military prosecutors the power to decide which cases to bring to trial.
And while domestic violence prosecutions increased, military prosecutions of sexual assault — often related to intimate partner violence — fell by almost 60 percent in the past five years, based on data from its annual sexual assault prevention reports. A 20 percent drop occurred from 2024–2025 alone, and The Intercept’s analysis of military court data shows the trend is continuing into 2026.
“In the Pete Hegseth era, sexual assault prosecutions have dropped significantly. Domestic violence is essentially filling that gap,” said Paul Newell, an Army veteran and activist who tracks military suicide, sexual assault, and domestic violence while engaging with members of Congress on the issue.
“In the Pete Hegseth era, sexual assault prosecutions have dropped significantly.”
Newell thinks the trial counsel’s office is “going for what they feel are stronger, more winnable cases,” he said. “They’ll tell you that their conviction rates at trial are still high, which shows that really, they’re just getting rid of the bad cases,” he said. “But we’re not down 60 percent in sexual assaults happening.”
The Pentagon stated in response to The Intercept’s questions that it does not have any additional information to share on why prosecution rates for certain crimes are dropping.
The Intercept also discovered preferential treatment in trial outcomes: Analyzing over 650 military court cases with guilty verdicts from 2021 on, reporters found less senior Navy, Marine, and Army service members had higher chances of losing their benefits and received more jail time after being convicted for domestic violence. Senior ranks closest to retirement received the best conviction outcomes, even compared to those of the same rank as them who had fewer years in service.
Newell feels that these discrepancies give perpetrators increased power over their victims. “The justice system should not take time in service into consideration since that’s prioritizing the perpetrator. If the punishment for domestic violence is a discharge where you lose benefits, it should be applied equally.”
In April, Hegseth directed installation commanders to allow service members to request permission to carry privately owned firearms on bases while off duty. He framed the change as a way to protect service members from attacks on military installations.
Campbell disagrees.
“I have reviewed far too many domestic violence homicide records,” Campbell said. “It is clear to me that, in many cases, there might have been a fight, and somebody might have been hit, but nobody would have died if there had not been a gun right there.”
Rodriguez, who is now studying public health, is calling for recurring anonymous surveys using specific questions to measure the prevalence of intimate partner violence, standardized tracking, independent evaluation, and public reporting.
Castle is still mourning her daughter and still pushing the Navy to reveal the full details about the investigation into her death. To add to the insult, she remembered the shock she felt late last June, when the Navy sent Resendiz home to Texas in a casket. Naval officials had told Castle that everything was taken care of, she recalled, including cleaning the body.
The Navy acknowledges that it failed to clearly inform Castle of her daughter’s true state. She was returned to Texas in decay, her body crawling with maggots.
“There’s nothing that can be done for her,” said Castle. “That’s injustice, and that’s what drives me. None of these women volunteered to be violated in this way.”
How we analyzed the data
Reporters searched through multiple databases to identify the number of potential victims of intimate partner violence, using definitions provided byhealthandpolicy researchalongsidegovernment organizations, comparing it to the last six years of available DoD reporting from 2019 through 2024.The case of a U.S. Air Force airman whokidnapped and murdered a Mennonite womanin 2020 didn’t meet criteria because evidence revealed no previous or current relationship. The case of a soldierwho was convicted a year laterof the murder of a woman in Texas did,as evidence indicated they had a relationship before the woman’s death.
Cases were broken down by the year of the offense, gender of the alleged perpetrator and victim, and branch of the perpetrator and victim, if applicable.
To analyze court data, reporters from The Intercept pulled all court cases pertaining to domestic violence from the years 2021 to 2026 from the websitesof the Air Force,Navy/Marines, andU.S. Army. Navy/Marine data was only available starting in 2021.
Data included the offense type, rank of the accused, and whether the cases ended in acquittal, dismissal, or conviction. For those convicted, the analysis included the amount of jail time given and whether offenders received a punitive discharge, which costs them military retirement and other benefits.
Retirement eligibilitywascalculatedbased on pay information provided in court documents, which in the militaryis based on years served. Air Force data could not be used for this analysis due to a lack of documentation and apparent discrepancies between thenumber of cases reported to Congressand those available on the Air Force portal.
To obtain the number of cases the DoD is prosecuting for sexual assault, reportersutilized Annex Bof the DoD’s Annual Report on Sexual Assault in the Military to calculate the number of unrestricted reports made to military authorities and the amount sent to the military justice system to begin the judicial process.
The 988 Suicide & Crisis Lifeline offers 24-hour support for those experiencing suicidal thoughts or for those close to them, by chat, text, or telephone. Service members can dial 988 and press 1 to reach the Military and Veterans Crisis Line. Support is free and confidential.
