Cybersecurity Triple Threat: Zombie Card NFC Exploit, T-Mobile's Scissors Defense, And GitHub's AI Accountability Debate + Video

Introduction

Three distinct cybersecurity stories emerged this week, each exposing a different facet of modern digital risk. Researchers at the University of Massachusetts Amherst demonstrated the “Zombie Card” attack, which revives expired Visa contactless cards for real in-store purchases by rewriting expiration date data transmitted over NFC without breaking any cryptography. Meanwhile, T-Mobile’s cybersecurity team responded to a Salt Typhoon intrusion by physically cutting a compromised router’s network cable with scissors at a Bellevue data center. And GitHub clarified that a critical vulnerability discovered by an autonomous Wiz AI agent—which gained unauthorized access to Snowflake’s internal Jira tickets—was not introduced by GitHub Copilot but was entirely human-authored. These incidents collectively underscore that security failures often arise not from sophisticated technical flaws alone, but from overlooked legacy assumptions, supply chain trust, and the growing tension between AI-assisted development and accountability.

Learning Objectives & Secrets

Objective 1: Master NFC Relay Attack Mechanics — Understand how the Zombie Card attack exploits the disconnect between POS terminal and issuer expiration date verification, enabling expired cards to complete transactions up to $500 using two Android phones as relays.
Objective 2 Secret Tip: Physical Containment as a Last-Resort Tactic — When remote remediation fails and threat actors maintain persistence through trusted third-party connections, physical disconnection may be the only reliable containment option. T-Mobile’s CSO Jeff Simon noted: “There’s nothing that replaces cutting the cord”.
Objective 3 Secret Tip: AI Accountability Requires Human Oversight — The GitHub-Wiz incident proves that autonomous security tools can find critical flaws, but organizations must not automatically attribute vulnerabilities to AI-generated code without proper forensic analysis.

You Should Know

Zombie Card Attack: Exploiting the Expiration Date Verification Gap

The Zombie Card attack, presented at the 35th USENIX Security Symposium (August 12–14, 2026, Baltimore), exploits a fundamental flaw in how Visa contactless transactions handle expiration dates. In a standard Visa contactless transaction, the expiration date appears twice: once in the Application Expiration Date (Tag-Length-Value tag 5F24) consumed by the retail terminal, and once in Track 2 data consumed by the issuer’s authorization system. Visa’s Kernel 3 does not require these two representations to be consistently bound, and the fast Dynamic Data Authentication (DDA) signature the terminal verifies excludes 5F24 entirely.

The attack workflow:

Acquire an expired Visa contactless card whose account remains open under the same Primary Account Number (PAN)—standard practice when issuers send replacement cards.
Set up an NFC relay using two commodity Android phones positioned between the expired card and the POS terminal.
Rewrite the terminal-facing expiration date (5F24) to any future date, leaving Track 2 untouched.
Execute the transaction—the terminal verifies the rewritten future date and approves offline, while the issuer receives Terminal Verification Results set to all zeros and cannot see whether the terminal ran its local expiry check.
Complete purchases up to $500 at retail and grocery merchants.

Linux/Windows Commands for NFC Security Testing:

 Linux - Scan for NFC devices and dump card data (requires libnfc)
nfc-scan-device -v
nfc-list
nfc-poll  Poll for nearby NFC tags

Extract card information
nfc-mfclassic r a dump.mfd  Read MiFare Classic (requires authentication)

For relay testing - setup TCP forwarding between two NFC-enabled devices
 Android-side: Use NFCProxy or similar relay app
 Linux-side: Forward NFC data over network
socat TCP-LISTEN:9999,fork TCP:attacker-phone:9999

Windows (using PowerShell and third-party tools):

 List USB devices (to identify NFC reader)
Get-PnpDevice -PresentOnly | Where-Object { $_.FriendlyName -like "NFC" }

Using libnfc Windows port (if installed)
nfc-scan-device.exe -v
nfc-poll.exe

Mitigation recommendations:

Banks should independently re-check expiry during authorization rather than relying on terminal checks.
POS terminals should cryptographically bind the expiration date across both data representations.
Consumers should destroy expired cards by damaging the chip and magnetic stripe.

T-Mobile’s Scissors Defense: Physical Containment of Salt Typhoon

The Salt Typhoon espionage campaign, attributed to Chinese state-sponsored actors, compromised at least 200 organizations across 80 countries, primarily targeting telecommunications infrastructure. T-Mobile was first publicly connected to the campaign in November 2024. The attackers exploited trusted network relationships—leveraging a compromised provider’s infrastructure to move laterally into T-Mobile’s environment through interconnected carrier-to-carrier connections.

T-Mobile’s security team spent months hunting for intruders before detecting unusual activity on an internal system traced to a router belonging to another, unnamed telecommunications provider. Rather than relying on remote remediation, the team drove to the Bellevue data center and physically cut the compromised router’s network cable with scissors. T-Mobile has reportedly kept the severed cable on display at its headquarters as a trophy.

Step-by-Step Physical Containment Protocol:

Detection: Identify suspicious traffic patterns—unusual routing changes, unexpected outbound connections, or configuration modifications on network devices.
Tracing: Map the attack path through interconnected infrastructure. Use network flow data and logging to locate the compromised device.
Assessment: Determine if remote remediation (e.g., disabling ports, revoking credentials, pushing firewall rules) is sufficient or if the attacker maintains persistent access.
Physical Response: If remote controls are compromised, dispatch authorized personnel to the data center to physically disconnect the compromised device.
Forensic Preservation: Secure the disconnected device for forensic analysis without risk of remote tampering or data destruction.
Post-Incident: Harden network segmentation, restrict unnecessary management interfaces, and require phishing-resistant MFA for privileged access.

Linux Commands for Network Monitoring and Detection:

 Monitor network connections and routing changes
sudo tcpdump -i any -1n 'host <suspicious-ip>'
sudo netstat -tunap | grep ESTABLISHED
sudo ss -tunap | grep -E 'ESTAB|SYN_SENT'

Monitor routing table changes
sudo ip route show table all
sudo watch -1 5 'ip route show table all'  Watch for unauthorized route changes

Detect ARP spoofing or unusual MAC addresses
sudo arp-scan --local
sudo tcpdump -i eth0 -1n 'arp'

Check for unauthorized listening ports
sudo lsof -i -P -1 | grep LISTEN
sudo netstat -tulpn | grep LISTEN

Windows PowerShell Commands:

 Monitor network connections
Get-1etTCPConnection | Where-Object { $_.State -eq "Established" }
netstat -ano | findstr ESTABLISHED

Check routing table
Get-1etRoute | Format-Table -AutoSize

Monitor for new listening ports
Get-1etTCPConnection | Where-Object { $_.State -eq "Listen" }

Check for unusual processes
Get-Process | Where-Object { $_.CPU -gt 50 }
wmic process get name,parentprocessid,processid

Key Lessons:

Trusted third-party connections create attack paths that bypass internal controls.
Organizations should validate containment capabilities by regularly testing incident response plans.
Network segmentation between sensitive systems and third-party environments reduces lateral movement risk.

GitHub Denies AI Caused Bug: The Accountability Problem

An autonomous AI tool developed by Wiz successfully identified and exploited a critical GitHub Actions workflow vulnerability in a public Snowflake repository, gaining unauthorized access to the company’s internal Jira tickets. The vulnerability was initially reported as a flaw introduced by GitHub Copilot. However, GitHub clarified to SecurityWeek that the vulnerable code snippet was entirely human-authored.

This incident highlights a growing crisis in open-source and bug bounty programs. In 2025, 20% of bug bounty submissions were AI-generated, with the overall valid submission rate dropping to just 5%. Linux creator Linus Torvalds publicly condemned AI-generated bug reports in May 2026. Projects like cURL killed their bug bounty programs because 20% of submissions were “AI slop,” and GitHub shipped new repository settings allowing maintainers to disable pull requests from strangers.

Step-by-Step Security Assessment for AI-Generated Code:

Code Review: Manually review all AI-generated or AI-assisted code contributions before merging. Do not assume AI-generated code is secure.

Vulnerability Scanning: Use SAST/DAST tools to scan AI-generated code for common vulnerabilities.

Using Semgrep for static analysis
semgrep --config auto ./src

Using Bandit for Python security scanning
bandit -r ./src -f json -o bandit-report.json

Dependency Checking: AI models may suggest outdated or vulnerable dependencies.

Python
safety check -r requirements.txt

Node.js
npm audit
npx snyk test

General
trivy fs ./ --severity HIGH,CRITICAL

Behavioral Testing: Test AI-generated code paths with unexpected inputs to identify injection or logic flaws.
Forensic Attribution: When vulnerabilities are found, trace the code’s origin to determine if AI or human introduced the flaw.
Policy Implementation: Establish clear policies for AI-assisted development, including mandatory human review and signature requirements.

GitHub Actions Security Hardening:

 Example secure GitHub Actions workflow with restricted permissions
name: Secure CI
on: [push, pull_request]

permissions:
contents: read  Least privilege principle
id-token: write  Only if OIDC is used
pull-requests: write  Only if needed

jobs:
security-scan:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- uses: actions/checkout@v4

OIDC authentication instead of hardcoded secrets
- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
aws-region: us-east-1

Security scanning with SARIF upload
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'sarif'
output: 'trivy-results.sarif'

<ul>
<li>name: Upload SARIF to GitHub Security
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'

4. Additional Threats in the Weekly Roundup

CISA Warns of Actively Exploited Ray Vulnerability: CISA mandated federal agencies prioritize fixing CVE-2025-62593, a severe code injection vulnerability in Ray-Project Ray, after threat actors were observed actively abusing it. The RondoDox botnet is exploiting this alongside 173 other distinct exploits to compromise vulnerable edge devices.

Evooo1Bot Linux Botnet: FortiGuard Labs is tracking Evooo1Bot, a highly modular Linux botnet targeting internet-facing devices by exploiting over a dozen known CVEs. Beyond standard DDoS capabilities, it includes an SSH brute-forcer, credential sniffer, and SOCKS5 relay module to convert infected hosts into persistent proxy nodes.

Linux/Windows Commands for Botnet Detection:

 Linux - Check for unusual outbound connections
sudo netstat -tunap | grep -vE '127.0.0.1|::1'
sudo ss -tunap | grep -vE '127.0.0.1|::1'

Check for SOCKS proxies or unusual listening ports
sudo lsof -i -P -1 | grep -E 'LISTEN|1080|9050|9150'

Check for SSH brute-force attempts
sudo grep "Failed password" /var/log/auth.log | tail -20
sudo journalctl -u ssh -f | grep "Failed"

Check for cron jobs (persistence mechanism)
sudo crontab -l
sudo ls -la /etc/cron

Windows PowerShell:

 Check for unusual outbound connections
Get-1etTCPConnection | Where-Object { $<em>.RemoteAddress -1e "127.0.0.1" -and $</em>.State -eq "Established" }

Check for SSH or proxy services
Get-Service | Where-Object { $_.DisplayName -match "SSH|Proxy|SOCKS" }

Check scheduled tasks for persistence
Get-ScheduledTask | Where-Object { $_.State -1e "Disabled" }

5. Threema DDoS Attack and Upstream Traffic Filtering

Encrypted messaging provider Threema endured significant service disruptions following sustained DDoS attacks targeting its infrastructure and colocation partner. The company stabilized operations by implementing specialized upstream traffic filtering to block malicious requests before they could reach and overload servers.

Step-by-Step DDoS Mitigation with Upstream Filtering:

Identify Attack Vectors: Analyze traffic patterns to distinguish legitimate from malicious requests.
Coordinate with ISP/Colocation Provider: Request upstream filtering at the network edge.

Implement Rate Limiting: Configure rate limits on edge devices.

Linux - Rate limiting with iptables (limit SYN packets)
sudo iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --syn -j DROP

Limit connections from a single IP
sudo iptables -A INPUT -p tcp -m connlimit --connlimit-above 10 -j REJECT

Deploy Web Application Firewall (WAF): Configure WAF rules to block malicious patterns.
Traffic Scrubbing: Use cloud-based DDoS protection services (Cloudflare, Akamai, AWS Shield) to scrub malicious traffic.
Monitoring: Continuously monitor traffic baselines and alert on anomalies.

What Undercode Say

Key Takeaway 1: Legacy Assumptions Are the Weakest Link — The Zombie Card attack succeeded not because of broken cryptography but because of inconsistent expiration date verification between POS terminals and issuing banks. Organizations must audit assumptions baked into legacy protocols, not just patch known vulnerabilities. The fact that Visa’s Kernel 3 sets Terminal Verification Results to all zeros means banks cannot see whether terminals performed expiry checks—a design choice that turns a feature into a critical flaw.
Key Takeaway 2: Physical Security Still Matters in the Digital Age — T-Mobile’s response proves that when remote access is compromised, physical control is the ultimate backup. In an era of cloud-everything, security teams must not forget the data center floor. The Salt Typhoon campaign exploited trusted network relationships between telecom providers—a reminder that supply chain trust is only as strong as the weakest partner. Organizations should regularly test “cut the cord” scenarios in incident response drills.

Analysis: The common thread across all three stories is the failure of assumptions. Banks assumed expiration dates would be checked consistently. T-Mobile assumed trusted carrier connections were secure. GitHub users assumed AI-generated code was the culprit when a human introduced the flaw. As AI tools become more prevalent in development, distinguishing human from AI-introduced vulnerabilities becomes critical. The Evooo1Bot and RondoDox botnets remind us that automated, scalable attacks remain the dominant threat vector. Meanwhile, the Medusa ransomware advisory shows that even well-known threats continuously evolve with new evasion techniques. Security professionals must adopt a “trust but verify” mindset across all layers—from payment protocols to network infrastructure to AI-assisted code.

Prediction

+1 The Zombie Card disclosure will accelerate the migration to tokenization and dynamic CVV for contactless payments, reducing reliance on static expiration dates for authentication. Expect major card networks to mandate cryptographic binding of expiration date fields within 12-18 months.
+1 Physical containment tactics like T-Mobile’s cable-cutting will become a formalized incident response procedure for organizations with on-premises infrastructure, with “physical disconnection playbooks” becoming standard in IR frameworks.
-1 The AI-generated bug report crisis will worsen before it improves. As AI coding tools become more ubiquitous, bug bounty programs will face even higher volumes of low-quality submissions, potentially forcing more programs to shut down or implement strict AI-detection filters.
-1 The Salt Typhoon campaign’s success in compromising 200+ organizations across 80 countries will embolden state-sponsored actors to further exploit trusted third-party relationships, particularly in telecommunications and critical infrastructure sectors.
-1 Without industry-wide standardization of NFC transaction validation, the Zombie Card attack vector could be weaponized by organized crime groups targeting retailers, potentially causing millions in fraud losses before countermeasures are widely deployed.

▶️ Related Video (78% Match):

https://www.youtube.com/watch?v=4cW0FPCJIXY

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eDevEpfS – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post