What Investigators Found

On October 21, 2026, Japan's JPCERT/CC published an investigation into servers associated with reported unauthorised access and information leaks at multiple Japanese organisations. JPCERT said it had confirmed use of artificial intelligence to scan known weaknesses and conduct API-related attacks, and had identified infrastructure that also targeted services intended for users outside Japan. The blog follows an alert issued on October 8.

How Mobile Applications Enter The Picture

The researchers found Android application packages, or APK files, on systems under investigation. Their analysis suggests attackers inspected how apps communicated with backend services and tested the exposed APIs. Files and tools associated with reverse engineering Flutter-based applications appeared on one server. JPCERT also described evidence of server-side request forgery testing, a category of weakness that can allow a server to be induced into sending unintended requests.

Why The Findings Matter

A mobile app can have a polished interface and still expose backend functions that need strong server-side authentication and authorisation. Reverse engineering a publicly distributed application may reveal endpoint names and request formats. Those details are not necessarily secret, so API security should not depend on keeping app code or request structure hidden. The international reach of the observed infrastructure also matters: the activity was not limited to Japanese services.

Practical Defensive Steps

Inventory external APIs used by mobile and web clients. Require authorisation checks for every sensitive operation on the server, rate-limit abusive requests, and look for unusual sequences of endpoint discovery or automated access. Verify that backend services cannot reach sensitive internal resources through untrusted URLs. Where an organisation suspects related activity, preserve application, identity and proxy logs and coordinate with its incident-response team.

Evidence Boundaries

JPCERT reports findings from particular servers and investigations. That does not mean every AI-assisted scan was successful or that a specific product is compromised. Its analysis of tools and artefacts should be read as evidence of observed techniques rather than a universal attack pattern.