This week, Tanium’s Cyber Threat Intelligence (CTI) team looks at Whisper Leak, a novel side-channel attack targeting remote language models. Next, we investigate a malicious npm package named “@acitons/artifact,” which poses a risk to GitHub Actions. Finally, we break down a sophisticated phishing campaign that uses the new Quantum Route Redirect tool to target Microsoft 365 users.
Whisper Leak targets remote language models
Microsoft is sharing details of Whisper Leak, which is now exploiting network packet sizes and timing patterns to discover users’ conversation topics, even when traffic is encrypted with TLS.
Microsoft’s report highlights the growing need for language model confidentiality, especially as AI systems are increasingly being used to process sensitive information. Because of this, it is increasingly important for conversations to be secure and for models to have strong privacy protections in place.
Microsoft’s Whisper Leak experiment
Microsoft started by training a binary classifier to differentiate between generalized traffic and a specific target topic.
In this experiment, the target topic was the legality of money laundering. The researchers used a language model to create 100 similar questions about the money laundering topic, with 80 for training and 20 for testing generalization. Microsoft also randomly sampled more than 11,000 unrelated questions for noise prompts.
After gathering the data, Microsoft analyzed three learning models in three different modes. They assessed the performance of each using the Area Under the Precision-Recall Curve (AUPRC) metric to measure the success of a cyberattack for imbalanced datasets.
Most models achieved scores exceeding 98%. Microsoft notes that the unique digital fingerprints produced by conversations on specific topics were distinct enough for its AI-powered eavesdropper to detect during controlled testing.
Whisper Leak: A growing threat
Microsoft simulated a realistic surveillance scenario in which an attacker monitored 10,000 random conversations, with only one containing the target-sensitive topic. In this test, the attacker was able to accurately identify the conversation discussing that topic.
As with many newly reported threats, Microsoft believes that this threat has the potential to get worse as time goes on. Their assessment is that this is a baseline risk level that will improve as threat actors gather more training data and improve their attacks with this information.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Strong encryption like TLS is unable to fully protect privacy when side-channel signals remain exposed. While this attack doesn’t appear to reveal the exact text/chat, it can classify sensitive topics that can still post confidentiality issues, especially for organizations in sectors that have more privacy rules in place. This is a reminder that security must consider metadata leakage, not just content encryption.
Microsoft and other providers have deployed mitigations, but Microsoft still recommends that users should avoid sensitive topics on untrusted networks and consider VPNs or non-streaming models.
@acitons/artifact targets GitHub Actions users
Researchers at Veracode discovered a malicious npm package named “@acitons/artifact,” which targets GitHub Actions users. The package, which typosquats the legitimate “@acitons/artifact” package, aims to exfiltrate encrypted data from CI/CD environments through a post-install script.
Veracode believes the purpose of the malicious package is to “have this script execute during a build of a GitHub-owned repository, exfiltrate the tokens available to the build environment, and then use those tokens to publish new malicious artifacts as GitHub.”
During their investigation, the researchers discovered six versions that came with a post-install hook to execute malware, which Veracode notes was not detected by anti-virus products. The actor has apparently removed the malicious versions.
The package
The researchers at Veracode explored version 4.0.13 of the malicious package, which appears to be for the GitHub Actions Toolkit but contains a clear typosquat in the package name.
Veracode analyzed the binary in VirusTotal and discovered that it wasn’t flagged as malicious at the time of their report. However, a manual review of the file revealed several seemingly malicious aspects including a mechanism to prevent execution after a set date, an obfuscated shell script, and the targeting of only repositories owned by GitHub itself.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Widely trusted ecosystems like npm are now being exploited by threat actors, making dependency hygiene critical.
This actor specifically focused on GitHub Actions, targeting a critical point in the software lifecycle. When these types of attacks happen, actors can steal secrets, inject malicious code into builds, and pivot into production environments, turning a single-dependency mistake into a full-scale breach.
This incident underscores growing software supply chain risks and the need for strict dependency vetting and runtime security controls.
Quantum Route Redirect simplifies phishing
KnowBe4 recently observed a sophisticated phishing campaign that uses Quantum Route Redirect, which is a phishing kit that automates complex attacks and enables cybercriminals to bypass security tools and target Microsoft 365 users globally.
As KnowBe4 explains, its ability to evade detection and weaponize links post-delivery poses a significant risk, requiring a combination of advanced defenses and user awareness.
KnowBe4 has observed compromised victims of this campaign spanning 90 countries. Of the victims, 76% were in the United States.
What is Quantum Route Redirect?
KnowBe4 describes Quantum Route Redirect as an “advanced automation platform that streamlines the entire phishing campaign process, from traffic rerouting to victim tracking.” To date they have identified about 1,000 domains that are being hosted with this platform.
The tool itself is simple and gives its users a preconfigured setup to make it easy to conduct campaigns. It can differentiate between different visitors, separating out different actions for security tools and true intended victims and routing them accordingly. To differentiate, it uses browser fingerprinting and VPN and proxy detection.
Quantum Route Redirect phishing attacks
KnowBe4 first observed phishing attacks leveraging Quantum Route Redirect in early August. According to KnowBe4, each campaign begins with a phishing email that ranges in themes and tactics. Regardless of the theme, in each case the victims are led to a credential harvesting page that is managed by Quantum Route Redirect.
Like other phishing kits, Quantum Route Redirect gives its users a configuration panel to manage their campaigns and provides various helpful features including visitor statistics.
Analyst comments from Tanium’s Cyber Threat Intelligence team
This is yet another phishing kit that lowers the barrier for attackers and opens the door for more frequent and sophisticated campaigns targeting Microsoft 365 environments.
The kit’s ability to weaponize links post-delivery is particularly concerning because it undermines many traditional security layers like URL scanning and sandboxing, revealing the criticality of real-time detection and user resilience.
KnowBe4’s report includes some helpful recommended actions to protect against Quantum Route Redirect.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.