Security · October 22, 2026
NICT Identifies A2B Attack as Cause of Recent Personal Data Leaks
The National Institute of Information and Communications Technology has identified a specific attack method known as the App-to-Backend attack as a primary cause of recent personal information leaks affecting multiple organizations. This security incident involves the exploitation of vulnerabilities in mobile applications to access backend servers without proper authentication.
Researchers at the institute revealed that the attack technique, abbreviated as A2B, leverages compromised Android applications to establish unauthorized connections with backend systems. The method allows attackers to bypass standard security checks by using the application itself as a trusted conduit to the server infrastructure. This approach effectively masks the malicious activity as legitimate application traffic.
The vulnerability stems from insufficient validation of API requests on the server side. When an application communicates with a backend server, the system often assumes that any request coming from the official application is trustworthy. Attackers exploit this assumption by reverse-engineering the application to extract authentication tokens or API keys, which are then used to send fraudulent requests directly to the server. The server processes these requests without verifying the true origin or intent of the user.
This security flaw echoes lessons from two decades ago regarding Flash-based vulnerabilities, where similar trust assumptions led to widespread exploitation. Despite historical precedents, many developers continue to implement backend systems that rely solely on client-side authentication mechanisms. The current incidents demonstrate that the industry has not fully internalized the principle that client-side code cannot be trusted to enforce security policies.
The institute emphasized that simply obfuscating application code or implementing basic integrity checks is insufficient to prevent A2B attacks. Effective mitigation requires server-side validation of every request, including rigorous verification of user identity and transaction context. Organizations must assume that any data or credentials extracted from a client application could be in the hands of malicious actors.
Recent investigations suggest that the scale of these breaches may be larger than initially reported, as many organizations remain unaware that their systems have been compromised through this method. The subtlety of the attack makes detection challenging, as the traffic appears normal to standard monitoring tools. Security teams need to implement advanced behavioral analysis to identify anomalies in API usage patterns that might indicate an ongoing A2B attack.
The findings highlight a critical gap in current cybersecurity practices, particularly in the development of mobile applications and their associated backend services. Developers are urged to adopt a zero-trust architecture where no component, whether inside or outside the network perimeter, is automatically trusted. This approach requires continuous verification of every transaction and strict enforcement of least-privilege access controls.
As artificial intelligence tools become more prevalent in both attack and defense strategies, the complexity of securing API endpoints will likely increase. Attackers may use AI to automate the reverse-engineering process, while defenders can leverage machine learning to detect sophisticated attack patterns. However, fundamental security principles remain unchanged: never trust the client, always validate inputs, and implement robust server-side controls.