IIRC Log4j roughly allowed loading arbitrary code from a URL. The mere process of trying to access that URL would cause a DNS request to the canary token domain

IIRC Log4j roughly allowed loading arbitrary code from a URL. The mere process of trying to access that URL would cause a DNS request to the canary token domain. I discovered that one of the major 2FA code SMS delivery gateways was actually susceptible to Log4j, where I could have potentially gotten a shell on their were, were I to have made an effort to. That could have allowed me to intercept all 2FA codes from major financial institutions that utilized the service to deliver 2FA codes to their customers. On the underground fraudsters would have paid handsomely to be able to get past 2FA on accounts they had stolen creds for, without even having to SIM swap. It goes to show how these services can be used for many purposes, offensive and defensive.