Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s Android app.

The researcher, Robert Wiggins, found the password with help from AI. It gave him access to an internal Applebee’s customer database. A password written directly into an app’s code or configuration is known as a hardcoded credential. Anyone who extracts it may be able to use it to access the system.

The exposed database contained:

• Names, email addresses, and email-verification status
• Dates of birth, phone numbers, and ZIP codes
• Veteran status
• Account-creation dates and login counts
• IP addresses from customers’ most recent logins, which can indicate their approximate location

TechCrunch independently checked Wiggins’ findings. It created an Applebee’s account with dummy information, which Wiggins successfully retrieved from the database.

According to TechCrunch, Wiggins could not find a suitable way to report the issue to Applebee’s or its parent company, Dine Brands, so he asked the publication to help contact them. TechCrunch held its story until the fix was confirmed. Applebee’s confirmed on October 29 that it had addressed the issue.

It’s unclear how many customers’ records were in the database. Dine Brands says it has not found evidence of unauthorized access, but its investigation is ongoing.

How to stay safe

The database fields described by TechCrunch did not include payment card details or account passwords. That does not tell us whether anyone accessed the database before the fix, so customers should watch for targeted scams.

Names, email addresses, phone numbers, and other personal details could help scammers make messages look relevant and convincing.

• Be wary of unexpected Applebee’s-themed emails, texts, or calls. Be especially skeptical of messages offering refunds or compensation, warning that your account will be closed, or asking you to “verify” payment details.
• Check security notices through a route you trust. Open the app directly or visit Applebee’s website yourself rather than following a link in an unexpected message. If necessary, contact the company using details you find independently.
• Unsure whether a message is a scam? Check it with Malwarebytes’ Scam Guard for an assessment and advice on what to do next.
• When sharing personal information, consider why the company needs it and whether you trust it to keep the information safe.

Unsure where a link goes? We’ll check it.

Check now

Attackers are impersonating major companies and recruiters to target marketing professionals, using trusted services and browser tricks to make the scam look legitimate.

A BleepingComputer article detailing the campaign found at least 34 domains impersonating high-value companies, including Netflix, Coca-Cola, Adidas, and FIFA.

The lure is a fake job interview or scheduling request from a “recruiter” representing one of these major companies. The impersonating website then shows the victim a fake Google sign-in pop-up built inside the page, rather than a real browser window.

To avoid detection, the attackers route victims through a chain of legitimate services before they reach the phishing site. So, instead of going straight from A to D, you go A → B → C → D. In phishing, attackers use this to make the final malicious site look less suspicious, because the victim passes through legitimate-looking services first.

“The operation is abusing the legitimate cloud-based PeopleForce human resources platform and a domain associated with the Salesforce Marketing Cloud service before redirecting the recipient to a malicious landing page.”

BleepingComputer noted that the campaign has been running for at least five months and primarily targets people in marketing roles. We know from our own investigations that job-themed phishing is extremely common and is likely especially effective while entry-level positions remain highly competitive and AI continues to shape the job market.

How to stay safe

Campaigns like these show how AI-enabled scams reshape scams, identity theft, and the ways attackers exploit trust.

As Stefan Dasic wrote in a post about a similar campaign that phished for Facebook credentials:

“The best protection isn’t spotting the fake—it’s knowing that no legitimate hiring process will ever require you to authenticate through an unfamiliar page, whether it’s dressed up as Google, Facebook, or anything else. When in doubt, close the tab, go to the company’s website yourself, and apply the old-fashioned way.”

Other useful tips include:

• Don’t click links or open attachments in unsolicited job offers.
• Use a password manager. It won’t autofill your Google username and password on a fake website.
• Use an up-to-date, real-time anti-malware solution with web protection.

Pro tip: Malwarebytes Scam Guard would have helped identify this attack as a scam.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders.

The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42.