Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai
Summary: Researchers Ian Carroll and Sam Curry guessed the password "123456" for McDonald's account at AI hiring chatbot maker Paradox.ai, exposing 64 million records including applicants' names, email addresses and phone numbers. Separately, breach-tracking data showed a Paradox.ai administrator in Vietnam was infected by "Nexus Stealer" malware at the end of June 2025, exposing hundreds of mostly poor and recycled passwords, including credentials to the company's Okta SSO platform and Atlassian account.
What's compelling: The stolen credentials included the administrator's Okta SSO password and authentication cookies valid until December 2025, and the same seven-digit password was used across Paradox.ai accounts for Fortune 500 customers including Aramark, Lockheed Martin, Lowes and Pepsi. Infostealer infections are among the leading causes of data breaches and ransomware attacks today, and remote access to the compromised administrator's device was reportedly offered for sale.
Read the original at Krebs on Security ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026