Automated Exfiltration of Financial Spend Data via jq and Tunnel API

Duo Tech@duotech

•updated Aug 10, 2026•3•0•4

Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.