TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Trend Micro Research

AI-Powered App Exposes User Data, Creates Risk of Supply Chain Attacks

David Fiser · 2025-09-23 · Read original ↗

ATT&CK techniques detected

5 predictions
T1195.002Compromise Software Supply Chain
72%
“##cure cloud storage, attackers could modify these models or their configurations and infect users unknowingly ( figure 9 ), as in other cases we covered before. this opens the door for various attack execution scenarios, in which malicious actors could : - replace legitimate ai …”
T1525Implant Internal Image
68%
“basic technical knowledge, who could subsequently download and exploit it against the organization. it is not unusual the developers to ignore security standards and embed their over - permissive cloud credentials directly into the code, as we have observed in previous research. …”
T1496Resource Hijacking
55%
“general data protection regulation ( gdpr ), the health insurance portability and accountability act ( hipaa ) in the us, or similar frameworks. this data leakage included thousands of unencrypted personal images uploaded by customers that were sensitive in nature and intended fo…”
T1525Implant Internal Image
53%
“using patented techniques and ai as a core engine ( figure 3 ). the binary analysis showed the application uses a cloud storage account with hardcoded credentials. the storage account was not only used to download ai models and application data ; we found that the account also co…”
T1496Resource Hijacking
51%
“##cure cloud storage, attackers could modify these models or their configurations and infect users unknowingly ( figure 9 ), as in other cases we covered before. this opens the door for various attack execution scenarios, in which malicious actors could : - replace legitimate ai …”

Summary

Trend™ Research’s analysis of Wondershare RepairIt reveals how the AI-driven app exposed sensitive user data due to unsecure cloud storage practices and hardcoded credentials, creating risks of model tampering and supply chain attacks.