"This is called Google Dorking. If you search inurl:viewerframe?mode=motion , you’ll find live IP camera feeds that weren't password protected."
At its core, this is a used in the CGI (Common Gateway Interface) of a network camera.
The search query is a specific "Google Dork" or search operator used to identify internet-connected surveillance cameras that are accessible without authentication. This query targets web interfaces (specifically legacy or specific brand interfaces) that have motion detection features enabled.
The primary vulnerability being exploited here is or Default Configuration Weaknesses .
“Commander,” the AI said, no longer calm. “It has detected the viewerframe. It is now matching mode.”