Phishing Attack Exploits Open‑Source Project’s Cloud Signup Flow

An attacker exploited the open‑source, cloud‑hosted version of the Kaneo project to create 942 workspaces and send 14,520 phishing invitations in a single three‑hour window on May 28. The bot accounts used disposable email domains and crafted workspace names that mimicked legitimate banking or crypto messages, then sent invites that linked to the real Kaneo site with a malicious payload. The attack leveraged the fact that the signup flow allowed unverified users to send invitations using a verified Resend domain, with no rate limiting or captcha. Kaneo’s owner revoked the Resend API keys and deleted the bot accounts and workspaces in a single Postgres transaction, but the damage was already done. In response, the team added captcha, disposable‑email blocking, rate limits on the invite endpoint, a workspace‑name filter, and disabled guest accounts from sending invites. The incident highlighted the risk of providing a fully functional SaaS tier without a hardened multi‑tenant threat model. The cleanup took about an hour, and the hardening measures were deployed the following day. The incident serves as a cautionary tale for open‑source projects that offer a hosted cloud version.