• A macOS flaw could give hostile apps the highest system privileges
• An NFC tag could trigger an Android app without owner approval
• Android flaw lets apps change Wi-Fi settings without requesting extra permissions

Russian cybersecurity firm Positive Technologies has claimed it discovered 11 security flaws affecting Android and Apple devices.

The company, which is currently under American sanctions, gave the findings to Russian news agency TASS.

Nine of the flaws affected Apple devices and software, while two affected Android, including Pixel phones, and were reportedly rated high severity.

How a tag and an app exposed Android phones

The first Android flaw let attackers use a crafted NFC tag to fetch, set up, and run an app while the owner approved nothing.

The second flaw allowed an app already on the phone to alter network settings, including joining a chosen Wi-Fi network, without any extra permissions, and also let the app add a certificate or adjust proxy parameters, and neither action required the phone owner to confirm anything.

Google resolved both Android flaws in its September 2026 patches, so devices which have installed those patches should no longer face either problem.

The company describes the tag flaw as especially hazardous since holding a phone near the tag suffices to trigger it.

There was no mention of specific Android versions or Pixel models that were vulnerable, so the number of exposed devices remains unknown, but to be safe from malware attacks, get the latest security patch.

What some Apple flaws allowed

According to TASS, the nine Apple flaws covered higher access rights, privacy exposure, and weakened data safeguards.

One macOS flaw allowed a hostile app to obtain the highest level of control over the computer, and another exposed information the system normally protects. The keys used for access could be deleted without the user approving the action.

Another flaw was found inside the kernel of the operating system and could cause a device to fail or corrupt data held in memory.

Apple has released patches for the flaws, although the company did not say which operating system versions carry the fix.

Devices that never received an update stay exposed to every flaw the firm described, whatever patches the vendors have issued.

Owners of older phones and computers that no longer receive vendor updates face the most uncertainty, because a fix never reaches them.

Android owners should check their software version in system settings to confirm the September 2026 patches arrived on their devices.

Neither Apple nor Google acknowledged the Positive Technologies report as expected, but they both released patches fixing these flaws, which implies that the report is legitimate.

Via 1.ru

• Swedish celebrities are fronting a campaign to be rude to phone scammers
• The majority of Swedish phone scam victims are over 60
• Swedish police state that fraudsters collect around 5.7 billion SEK a year, over £431 million

Swedish celebrities have been hired to help the national government promote the use of profanity when dealing with telephone scammers.

The famously well-mannered Swedes are being encouraged to employ potty-mouthed responses when bothered by vishing scams and other attempts to steal money over the phone.

Swedish law enforcement states that 5.7 billion Swedish krona – £431 million or $575.3 million is stolen every year by fraudsters, many of which operate over the phone. The campaign is targeting over 60s as they are the main target for scammers.

Targeting over 60s

Christina Schollin, Claes Elfsberg, Suzanne Reuter, and Lennart Jähkel are participating in the campaign, which aims to provide elderly Swedes with the confidence to tell phone scammers to “go away” with whatever expletives come to mind.

By aiming for the over 60 demographic, the criminals perpetuating the crimes aim to leverage feelings of trust in institutions, often posing as government agencies or banks, often initiating contact via text message.

When the target calls the number in the message, the scammers employ tried-and-tested scripts to persuade the victim of the importance of their call, applying subtle stress and panic to push them into parting with their cash.

But the campaign is more than about turning Sweden into a land of sewer-minded insults -- over-60s are being educated not just in delivering a timely profanity, but also in recognizing when they are being scammed. With the new campaign, swearing is merely one option. Being confident to simply hang up, or tell a fake cop scammer to go away, are both good alternatives.

Don't be fooled

The notion of being rude to a stranger on the phone is not one that comes naturally to the Swedish people, which is why the campaign has been launched with well-known celebrities. Actress Christina Schollin, journalist Claes Elfsberg, actor Lennart Jähkel, are three of the famous faces, and all have one thing in common; like the key demographic of scam victims, they are over 60.

Swedish comedian and actress Suzanne Reuter is the first to feature, and says "I'm in the police campaign because it's a terrible crime that affects so many people. If I can use my voice to help someone not be fooled, then I want to do it. Many of us are raised to always be polite and accommodating, and there are many of my generation. But today you have to dare to be a little more questioning.”

She adds: “It's not nasty - it's self-protection.”

• Apple patches high-severity CoreGraphics zero-day reportedly exploited against specific targeted individuals
• The vulnerability enables arbitrary code execution through maliciously crafted files on affected Apple devices
• Apple urged users to install the latest security updates, particularly high-value targets facing sophisticated attacks

Apple has released a fix for a zero-day vulnerability it says was allegedly used “in an extremely sophisticated attack against specific targeted individuals”.

The vulnerability was found in iOS 26.7.1 and iPadOS 26.7.1 and users are advised to apply the fix as soon as possible. This is particularly important for high-value targets such as diplomats, dissidents, whistleblowers, political opposition, and journalists.

Zero-day

The vulnerability was found in CoreGraphics, the company’s low-level 2D graphics framework used across different platforms (iOS, iPadOS, macOS, and more). CoreGraphics provides developers with tools they need to draw and render visual elements (lines, shapes, images, and even text), and can handle operations such as colors, transparency, gradients, clipping, etc. It is usually used when developers need more precise control over how something is drawn.

The vulnerability is tracked as CVE-2026-86950, with a severity score of 8.8/10 (high). The National Vulnerability Database (NVD) describes it as an out-of-bounds issue that allows threat actors to execute arbitrary code via a maliciously crafted file. The bug can also be exploited to crash programs and corrupt data. Besides iOS and iPadOS, it was also fixed in macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1.

Here is the full list of affected devices:

iPhone 11 and later

iPad Pro 12.9-inch 3rd generation and later

iPad Pro 11-inch 1st generation and later

iPad Air 3rd generation and later

iPad 8th generation and later

iPad mini 5th generation and later

Mac devices running macOS Sequoia 15.8.1 and Tahoe 26.7.1

Apple fixed it with improved bounds checking, it was said in the security advisory.

Abused in “extremely sophisticated” attacks

What makes this vulnerability stand out in a sea of zero-days is how Apple described observed exploitation attempts.

“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” We don’t know which report Apple is referring to here - we could not find anyone discussing it. The company only said the bug was flagged by Meta Product Security.

This could be deliberate, though. High-profile attacks tend to draw a crowd, as well as increased interest from other threat actors looking to exploit zero-day flaws. Apple is known for hiding details of vulnerabilities until it is confident that a significant majority of affected devices have been patched.

“Extremely sophisticated attacks against specific targeted individuals” is also wording Apple usually uses for state-sponsored espionage attacks against diplomats and politicians, high-value targets such as tech CEOs, journalists, political opponents and dissidents, and similar. Although it is not mentioned in the report, tech companies like Apple and Google tend to notify the victims when they’re being targeted in such attacks.

The last time Apple used similar wording was in February 2026, when it patched CVE-2026-20700. In that incident it also did not discuss the attackers, or the victims, but we do know that it was discovered by Google’s Threat Analysis Group (TAG), a department assigned with investigating primarily state-sponsored hacking campaigns.

CVE-2026-86950 is now the second zero-day vulnerability the company patched this year. Last year, Apple addressed seven zero-day vulnerabilities exploited in the wild: CVE-2025-24085, CVE-2025-24200, CVE-2025-24201, CVE-2025-31200, CVE-2025-31201, CVE-2025-43529, and CVE-2025-14174.

Given the severity of the flaw and what it can be used for, users are advised to apply the patches without delay. Apple users with automatic updates enabled should receive the security fix automatically, but those who haven't yet updated should manually check Settings → General → Software Update and install iOS/iPadOS 26.7.1.

Via BleepingComputer

• AI-powered deepfakes convinced executives to authorize massive overseas fund transfers
• Fraudsters impersonated senior figures through messaging apps and cloned voices
• Incident highlights evolving business email compromise tactics in the AI era

Cybercriminals have tricked a major Italian bank into wiring more than $100 million abroad by targeting executives with AI-powered deepfakes. Some of the money has since been recovered, but a significant portion remains unaccounted for.

The target was Fideuram – Intesa Sanpaolo Private Banking, a very large Italian private-banking and wealth-management group owned by Intesa Sanpaolo. It cannot be considered a “normal” retail bank - its core business is managing investments and wealth for affluent and high-net-worth clients.

According to the latest figures, the bank has around $513.25 billion in assets under management (AUM), more than 7,100 private bankers, and more than $9.85 billion in net profit.

Deepfakes and phone calls

Citing two sources familiar with the matter, Reuters reported that the attack took place in February 2026, while the chairman was ​Paolo Molesini.

Molesini reportedly received a WhatsApp message that seems to have come from Carlo Messina, Intesa Sanpaolo Chief Executive Officer (CEO), who asked him to help with an urgent overseas transaction, to which the victim agreed. He was later contacted by someone claiming to be senior partner at a prominent law firm, to confirm the instruction. This person used AI tools to create a deepfake of the lawyer’s voice, tricking Molesini into thinking the request was authentic.

The chairman then reached out to the bank’s finance department, arranging a series of transactions to foreign account, the majority of which were in mainland China and Hong Kong.

The scam was spotted soon afterwards, and Fideuram moved to block the transaction. With the help of law enforcement in China, Portugal, and Italy, around $60.14 million was recovered. Around $40.8 million remains missing, apparently converted into cryptocurrencies.

Ruining a person's career

​Paolo Molesini announced he was stepping down from roles of president for both Fideuram itself and Intesa Sanpaolo Private Banking a month later, in March 2026, citing “personal reasons”.

According to Reuters, neither Molesini, or any other Fideuram executives are under investigation, but local authorities are apparently investigating a “foreign national living outside Europe” for potential fraud.

In the pre-AI era, this type of fraud was known as Business Email Compromise (BEC). Crooks would break in (or otherwise spoof) the email address of a company’s CEO (or other executive), map out employees working in the finance department, and reach out with instructions for wire transfers. These instructions would explain that the transfer needs to be completed in secrecy, to avoid unnecessary publicity or competitors.

Nowadays, with the advent of artificial intelligence and the ease with which crooks can create deepfake images, voice clones, and even videos, BEC attacks have spread out to instant messaging platforms, voice calls, and even video calls.

Last year, scammers used artificial intelligence to create a deepfake of the voice of an Italian minister, tricking local businessman Massimo Moratti to transfer around $1.13 million to an overseas account. The money was later successfully recovered, it was said.

• ShinyHunters bypass PeopleSoft mitigation rules, reviving exploitation of a critical zero-day vulnerability
• The campaign has expanded globally, targeting organizations across technology, healthcare, government, and other sectors
• Oracle’s original patch remains effective, while organizations should investigate systems and rotate potentially exposed credentials

ShinyHunters have found a way to bypass a mitigation for a zero-day they previously exploited - so now, not only are they back to abusing the same bug, they’ve even expanded their scope to target a much larger pool of organizations.

In June 2026, it was reported that ShinyHunters, the infamous data extortionists, found a Java deserialization vulnerability in Oracle’s PeopleSoft Environment Management Hub (PSEMHUB) servlet that allowed them to achieve web shell deployment or fileless command execution on vulnerable servers.

Oracle PeopleSoft is a suite of enterprise business software used mainly by large organizations, universities, governments, and corporations to manage things like human resources, finance, supply chain, and student administration.

This remote code execution (RCE) bug caused by unsafe deserialization of Java objects in PSEMHUB was exploited for days, targeting higher education institutions, stealing their sensitive files, and enabling extortion campaigns.

Oracle fixed the issue on June 10 2026, bringing the tool to versions 8.61 and 8.62. The bug was assigned an identifier CVE-2026-35273 and was given a severity score of 9.8/10 (critical). The US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on June 12, giving federal agencies a three-day deadline to patch up.

ShinyHunters Return

The company also provided mitigation measures for organizations that were unable to install the patch at the time. However, Mandiant and Google’s Threat Intelligence Group (GTIG) are now reporting that ShinyHunters found a way to bypass these mitigations, and are back to exploiting the flaw against organizations running unpatched versions of the software.

“This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint,” the two organizations said in a new report, stressing that the campaign has now expanded globally.

“The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/,” the researchers said. “Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.”

At first, ShinyHunters were focused mostly on higher education institutions. This time around, though, they’re casting a much wider net, deploying web shells on “dozens of systems globally” including technology, IT services, healthcare, agriculture, transportation, and government.

“Mandiant recommends that organizations running Oracle PeopleSoft take the following immediate actions,” the researchers added.

ShinyHunters are known extortionists. They are using the PeopleSoft vulnerability to gain persistent access and steal credentials, allowing them to move laterally through target environments and exfiltrate sensitive data such as HR or payroll.

Patching works

The good news is that the patch still works. If an organization applied Oracle’s fix for CVE-2026-35273, this WAF bypass should not matter, because it only works around the mitigation, not the underlying vulnerability fix. Therefore, both Google and Mandiant advise, first and foremost, that organizations apply the Oracle Security Alert issued when the zero-day was first disclosed.

Businesses should also disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely, in single-server configurations.

To check whether they were targeted or not, they should search PIA WebLogic access logs for requests to /PSEMHUB) and any percent-encoded variant, and should inspect /webserv//applications/peoplesoft/PSEMHUB.war/ for files that are not part of the shipped product.

Finally, they should rotate all credentials the PeopleSoft application service account can read, and monitor outbound traffic from PeopleSoft hosts to the network indicators listed here.

• Threat actors spoofed major US HR/payroll platforms with fake desktop clients built via Lovable landing pages
• Victims downloaded a modified ScreenConnect build from GitHub, giving attackers hidden, unattended remote access
• Campaign shows ~291 downloads; likely targets payroll staff, enabling potential wire fraud through diverted payments

Cybercriminals are impersonating large American HR and payroll platforms in attacks that are very difficult to spot, new research from Allure has claimed.

Its report revealed how the as-yet unidentified threat actors were found spoofing three major US HR and payroll platforms, likely picked primarily because they offered a cloud-based service accessible through a browser, rather than a standalone desktop app.

The crooks used Lovable (a legitimate AI-powered service for building websites and landing pages with nothing more than prompts, requiring no technical knowledge whatsoever) to create landing pages imitating the legitimate brands, but with a small (yet important) distinction - they offered a desktop client.

No reference points

Since a legitimate desktop client does not exist, there is nothing to compare the malware to. This, Allure says, makes it very difficult for victims to determine they were being targeted. After all, it would make sense for a major HR and payroll platform to have a desktop app at one point, right?

Those that clicked the download button were served an executable from GitHub Releases, a feature of GitHub that developers use to publish specific, packaged versions of their software. You can think of it as the software equivalent of a product download page. Being a legitimate service (and one frequently used to host software like this), it yet raises no suspicions or red flags.

The executable itself is not malicious either, which is probably the cheekiest part of the attack. As such, it flies under the radar of most antivirus or endpoint protection services and can easily be installed on the device.

"Legitimate" tools

Well if it’s not malicious, what is it? And what is the risk?

The program victims end up installing is a variant of ConnectWise’s ScreenConnect, a remote desktop and remote IT support platform used primarily by IT departments and managed service providers (MSP). It is a legitimate tool that allows IT techs to remotely connect to computers and servers, troubleshoot problems, install software and patches, and more.

But because ScreenConnect provides remote, often privileged access to computers, it is an attractive tool for attackers, and is often used in cyberattacks of different nature.

“This build was configured to surreptitiously do the same thing without the user being aware. We extracted the client configuration and the launch parameters. The access mode is set to unattended. The victim-facing indicators are turned off: no “your machine is being controlled” banner, no system-tray icon, no connection balloon,” the researchers said.

In other words, the variant was configured to allow crooks access without notifying the victim in any way.

Allure did not identify the attackers, nor did it discuss the success of the campaign. We don’t know exactly who it targeted (apart that it aims for finance and HR departments), or how many organizations ended up installing ScreenConnect. The researchers said the GitHub downloads page shows 291 downloads, but that doesn’t necessarily have to mean 291 victims, or successful attacks. It is likely that numerous security researchers downloaded the tools, as well as sandboxes, and that many of the victims realized they were attacked before suffering any meaningful damage. Therefore, the actual number of victims is likely significantly smaller.

We also don’t know what the endgame is, although Allure suggests it might be wire fraud:

“Whoever installs it is the person who runs payroll, and unattended access to that machine is a path to diverting or draining an entire company’s payroll,” they said.

“If your company runs a cloud payroll or HR platform, the most useful thing you can do this week is check whether yours actually ships one [desktop client], and tell employees that a download the vendor does not offer is not an upgrade.”

• Citrix patched two critical zero‑days (CVE‑2026‑88771, CVE‑2026‑88772) in NetScaler ADC/Gateway, both enabling remote code execution
• Exploits already observed; CISA added flaws to KEV catalog with a three‑day patch deadline (Sept 30)
• NetScaler appliances are prime targets due to internet exposure, privileged access, and limited monitoring visibility

Citrix has released a patch for two critical zero-day vulnerabilities apparently being actively exploited in real-life attacks.

In its weekend security advisory, Citrix said it fixed two bugs: CVE-2026-88771 and CVE-2026-88772.

It is now urging organizations to apply the fix as soon as possible and defend their premises from potentially disruptive attacks.

What Citrix fixed

The first issue is an improper input validation vulnerability that allows unauthenticated attackers to execute arbitrary commands remotely. It has a severity score of 9.5/10 (critical). The latter is a buffer overflow/memory-corruption vulnerability in Citrix NetScaler ADC and NetScaler Gateway which could allow attackers to execute malicious code remotely, or trigger Denial of Service (DoS). This one, too, carries a severity score of 9.5/10 (critical).

Both flaws affect Citrix NetScaler ADC and Citrix NetScaler Gateway: ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23.

Citrix released patches for the flaws in NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, as well as the corresponding FIPS builds.

"Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," Citrix said in the security bulletin.

Abused in the wild

Citrix has thus confirmed what was being reported on, earlier. According to BleepingComputer, Citrix admins took to Reddit to report IT suppliers and security teams contacting their organizations and recommending they shut down NetScaler appliances.

"We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately," one administrator wrote. Other admins said similar warnings were coming from law enforcement, national cybersecurity agencies, and CERTs. "We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible," security experts watchTowr said in response to the news.

The US Cybersecurity and Infrastructure Security Agency (CISA) also reacted. Both vulnerabilities were added to its catalog of known exploited flaws (KEV) on Sunday, giving Federal Civilian Executive Branch (FCEB) agencies a three-day deadline (until Wednesday, September 30) to patch up.

The Dutch National Cyber Security Center (NCSC-NL) also reacted fast. Even before Citrix publicly disclosed the flaws, the organization allegedly notified organizations in the country about the zero-days. BleepingComputer said “multiple people shared copies of the notification online, which said the agency had received information from a European partner CERT regarding two vulnerabilities that could independently lead to remote code execution.”

Why target NetScaler

This is not the first time cybercriminals are targeting NetScaler appliances. They are often in the crosshairs because they are tasked with providing remote access to internal applications and desktops, and as such, they are exposed to the internet and can be targeted directly.

That makes any zero-day vulnerabilities in the appliances particularly valuable. Bugs that leak authenticated session tokens, those that allow for authentication bypass, or remote code execution, can provide a foothold inside an organization, without requiring any interaction on the victim side. From there, threat actors could steal credentials, access internal resources, or move laterally to deploy ransomware.

Edge appliances like the Citrix NetScaler are also attractive because they’re somewhat harder to monitor, compared to other endpoints. Organizations usually deploy extensive security tools for computers and servers, leaving specialized networking appliances somewhere in the shadows.

This combination of internet exposure, privileged access, and somewhat limited visibility, makes a serious NetScaler vulnerability particularly attractive to both state-sponsored actors, and profit-oriented groups.

Via BleepingComputer

• Kiteworks warned customers of a “credible” planned cyberattack, urging a nine‑hour precautionary shutdown
• No breaches reported; advisory lifted Sept 27, systems restored, version 9.5.1 deemed secure
• Context recalls Cl0p’s past file‑sharing platform hits, raising speculation about possible resurgence

Secure file sharing company Kiteworks recently told its customers to shut down their servers for nine hours, in anticipation of an incoming cyberattack.

There are no reports of actual attacks - at least not yet, but in a blog post, the company revealed it had received “credible” threat intelligence from federal authorities warning them of a planned attack against the company and its customers.

In response, the company told its customers to shut down their servers for nine hours, depending on their timezone.

What happened?

“Kiteworks is advising customers to facilitate a nine-hour precautionary shutdown window this weekend, in their local time zone,” the announcement reads.

“Customers who self-manage their Kiteworks systems—on-premises or on AWS or Azure—should shut down those systems themselves during this window. Kiteworks will shut down the customer systems it hosts, on behalf of customers, during the same window, so Kiteworks-hosted customers are not required to take any action.”

In the announcement, the company’s Chief Information Security Officer, Frank Balonis, said the measure is proactive rather than reactive, and that there are no ongoing attacks just yet:

“Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we continue to work through the matter with federal intelligence authorities,” Balonis said.

“We have no indication that Kiteworks or our customers’ systems have been compromised, so this advisory is preventative rather than a response to a confirmed breach.”

Citing German media, BleepingComputer said the shutdown window “applies to customer worldwide”, with affected time zones ranging from Australian Eastern Standard Time, to Pacific Daylight Time. In Central Europe, customers were told to shut down between 4 and 10 AM on Saturday. On the east coast of the US, the shutdown window is between 10PM on a Friday, until 4AM on Saturday.

Who could be gearing up for an assault?

Kiteworks is a US-based enterprise security and secure data-sharing platform, which organizations can use to manage sensitive information, especially when ordinary email attachments or consumer file-sharing services aren’t considered secure enough.

Kiteworks says it does not have any fixes in the pipeline and that all known vulnerabilities are accounted for in the latest version 9.5.1. Obviously, customers are advised to run this version instead of older, potentially vulnerable ones, and were told that other subsidiaries such as Zivver, DRACOON, totemo, ownCloud, WAMNET, Maytech, Bonfy.ai, and 123FormBuilder, were not affected.

Secure data-sharing platforms are an attractive target for cybercriminals, given the high-value organizations that use them, as well as the sensitive information they handle. We don’t know who the attackers might be, but there are some strange coincidences occurring at the moment.

Three years ago, a hacking group known as Cl0p struck two major file-sharing platforms: GoAnywhere MFT and MOVEit. The breaches ended up becoming some of the biggest hits in recent history, affecting thousands of customers. Victims ranged from government agencies, schools and healthcare, to major firms like Sony and PricewaterhouseCoopers (PwC).

Cl0p tried to extort many of these companies, even succeeding with some. The cybersecurity community tried to estimate how much money the group stole this way, and the general consensus seems to be anywhere between $40 and $100 million.

In the months and years following these two incidents, Cl0p vanished. The group was no longer making high-level plays, and we’ve not reported on any major breaches since. Until last week, that is, when it was reported that ShinyHunters - currently one of the most active and dangerous data exfiltration organizations around - attacked Cl0p.

ShinyHunters leaked plenty of Cl0p’s sensitive data, saying it did so in retaliation for threats of doxxing and physical violence made by the group. We don’t know if Cl0p was preparing to hit Kiteworks, but we wouldn’t be too surprised if it was an attempted brand management after being somewhat embarrassed by ShinyHunters.

So far, there were no reports of actual breaches at any of Kiteworks’ customers, but we’re continuing to monitor the situation.

The company said that as of September 27 2026, the shutdown recommendation has been lifted for all customers. “If you have not already restarted, you may bring your Kiteworks system back online. Customers with self-hosted Advanced Forms should contact Customer Support for assistance. All systems Kiteworks hosts on customers’ behalf have been brought back up and are operating normally.”

• AI coding agent mishandled Windows junctions, deleting ~48,000 live files and corrupting Git object database
• Incident surfaced on Reddit, with community mocking lack of backups and calling it “classic FAFO”
• Lesson stressed: always use remote version control (e.g., GitHub) before letting AI touch production work

A catastrophic incident caused by an AI coding agent resulted in around 48,000 files being deleted and the repository’s Git object database getting destroyed in the process.

The news of the fiasco, which first surfaced on Reddit, quickly spread throughout the internet, to a mix of laughter and facepalming from the developer community.

A software developer posted a new thread on Reddit to share a recent experience. They tasked an AI coding assistant with a series of repairs to a collection of software they used to analyze historical stock-options data. They told the assistant to make copies of relevant files, work on them, test the repairs, and leave the original working files alone.

Wrong turn at the junction

In total, there were 11 repair jobs running, and while 10 went smoothly, the last one involved rebuilding a testing environment called a “mirror” (a copy of a set of files used for testing). This job was supposed to make a fresh copy of the old testing environment, apply the repairs, and test it without touching the real working files.

The testing environment contained 614 Windows folders called “junctions”. These look like an ordinary folder, but actually point to a separate location on the computer. In this case, they were pointing back to the user’s live working files. When the AI tried to clean out the junctions, it did not recognize them as just pointers, following them into the real filing cabinet and deleting the actual documents.

The cleanup process removed around 55,550 files, of which around 7,300 were supposed to be deleted anyway. The remaining 48,218 files were from the live working environment. Everything happened in the blink of an eye - less than two minutes. The AI was surprisingly honest about what it did. At one point, it told the developer: “Craig — stop and read this. I broke something.”

The computer’s Git repository was also damaged. The index survived, but the underlying stored copies of the files, and the history used to reconstruct them, were all deleted. Git could still list thousands of filenames, but could no longer recover the contents.

Reddit's response

The Reddit post simply exploded. In the five days since it was posted, it garnered more than 1,400 responses. The Reddit bot that summarizes the comments says the overwhelming consensus is that the incident is a “classic FAFO situation and a major skill issue.”

“While everyone is having a good laugh at Claude’s hilariously honest “Craig…. stop and read this. I broke something” message, the community verdict is clear: you got rekt because you didn't follow basic dev practices.”

Redditors shared their experience and told the original poster they were supposed to use Git and push to a remote repository like GitHub constantly. In situations like this one, GitHub is a “save button”, and not having a remote backup for a project with 48k files is “considered peak vibe coder behavior.”

The post has, since then, been deleted - possibly because the original poster took a photo of their screen. “The screenshot police are out in full force,” the Reddit bot said.

“Some helpful souls suggested using file recovery software or Windows Shadow Copy to get your files back, but the main lesson here is to use version control before you let an AI anywhere near your work.”

While AI agents deleting entire archives is not that common, it has happened before.

In late February 2026, Summer Yue, a Meta AI safety/alignment researcher, gave an OpenClaw AI agent access to her Gmail account. She had first tested it on a small “toy” inbox, where everything worked as intended. However, when she moved it to her actual inbox, the agent began bulk-deleting and archiving hundreds of emails, despite her telling it to stop.

• Kaspersky uncovers MacSync, a Mac infostealer delivered via iCloud calendar events and fake apps
• Loader fetches instructions from calendar entries, then deploys malware exfiltrating credentials, wallets, and developer data
• Newer variants add Objective‑C backdoor spoofing Finder, persistence, and expanded targeting of crypto and IT users

Cybercriminals have found a way to use iCloud calendar events and cloud storage to deliver a powerful infostealer to Mac devices.

The malware is called MacSync, and it’s hiding behind fake crypto wallets, or “cracked” commercial software.

Security researchers Kaspersky, who discovered the ongoing campaign, are urging Mac users to exercise caution when downloading programs, especially from third-party websites, and to be very skeptical of apps prompting for their admin password.

Why calendar?

Getting people to download and run malware on their devices is not as easy as it sounds.

The victims need to be somehow tricked into downloading and running an app, and even when they do so, chances are the malicious program will be sniffed out by whatever antivirus solutions the device has running, before it can do any meaningful damage. Also, crooks don’t want to be forced to repeat the process every time they want to deploy a different variant, or type of malware.

So, they resort to all sorts of techniques and workarounds, from DLL sideloading, to malware loaders.

By separating the initial infection and the actual malware, cybercriminals can reduce detection rate and get more flexibility, but it creates a new problem: defenders can monitor the traffic going in and out of different apps and thus detect when a loader is deploying malware.

The challenge then becomes hiding the traffic, and MacSync does it by using the iCloud calendar.

After being downloaded and executed, the loader will reach out to the calendar - which is a totally benign activity that is unlikely to raise any suspicion - and look for a specific public event, pre-built by the attackers. In its description, it will find the instructions, and the location of, the actual infostealer, and deploy it to ultimately compromise the target device. In this case, the location was also in the iCloud.

The loader itself is being advertised through social media, SEO poisoning, and phishing. Victims are directed either to fraudulent websites or social media channels promoting cracked software, or free versions of advanced solutions. In at least one example, Kaspersky saw the loader being advertised as a cryptocurrency wallet. Victims are shown a typical ClickFix error, and told to fix it by pasting a command in the Terminal.

The command deploys the loader which, in turn, installs MacSync.

A "substantial" overhaul

The infostealer emerged in April 2025, and was initially spun out of AMOS, one of the most popular information-stealing variants for the MacOS. It is based on Swift and has, since then, evolved to offer additional capabilities. According to Kaspersky, it can exfiltrate browser history, cookies, saved credentials, cryptocurrency wallet and app data, Telegram data, Keychain data, as well as system and device information. It can exfiltrate SSH, AWS, Kubernetes, Git, and shell configuration files, as well.

Newer variants come with an Objective-C backdoor spoofing the macOS default file manager, Finder. It establishes persistence, terminates notification processes to prevent alerts, and grants the attackers backdoor access, including running AppleScript received from the C2 server, deploying browser extensions, replacing the legitimate Ledger wallet app, collecting additional system information, and more.

Kaspersky also found an undefined command called “live_browser”, which downloads and runs a component named “sn_relay”, whose point has not yet been established.

The new versions “significantly” differ from older ones, Kaspersky said, stressing that the attackers “substantially” overhauled their approach.

“The nature of the data attackers seek to collect from a victim’s device, as well as the categories of applications the stealer disguises itself as, clearly indicates that this malware family primarily targets developers, crypto enthusiasts, and other users associated in some way with IT and the crypto space,” the researchers stressed. “MacSync’s compromise of software developers’ devices poses particular security risks for both end users and corporate systems, opening up expanded opportunities for attackers to further their intrusion.”

The full list of indicators of compromise (IoC) can be found on this link.

• Graz University researchers found decades‑old flaws in file‑notification subsystems across Linux, Windows, macOS, and Android
• Side‑channel attacks can infer keystrokes, visited websites, or even steal credentials via unprivileged access
• Linux shipped partial mitigations (CVE‑2025‑68788); Microsoft and Apple acknowledged but did not patch, demo expected at ACM CCS 2026

Researchers have found a vulnerability in all major operating systems which could, in certain scenarios, allow threat actors to steal login credentials, or track which websites the target is visiting. OS makers, on the other hand, don’t seem all too phased about it.

The bug is described as a side-channel attack - a type of attack in which threat actors simply observe how the system operates and extract valuable secrets through indirect clues. For example, by monitoring how much power the chip takes at any given moment in time, attackers can observe and extract passwords.

It was discovered by security researchers from Austria’s Graz University of Technology: Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss.

Notifying the system

This particular side-channel vulnerability was found in the file-notification subsystem running in pretty much every OS in existence today. The subsystem is built to notify applications when files on a system change. Not what has changed, just that a change occurred. The bug is allegedly quite old, too.

"We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Register.

On Linux, the subsystem is called inotify and it’s been affected since 2005. On Android it’s FileObserver (affected since 2008), and on Windows - ReadDirectoryChangesW - flawed since the year 2000. On MacOS, it’s called FSEvents, vulnerable since 2007.

In the paper, the researchers claim file event information can help attackers conclude what other users on a computer are doing. They can launch an inter-keystroke-timing attack, inferring what users are inputting (both locally and remotely), reveal which websites they visit, and possibly even steal login credentials through UI redress.

The problem stems from the fact that unprivileged users are allowed to access the file notification subsystem. This primarily relates to files that can be read by multiple users, but apparently, there are quite a few files on a system that fall into that category.

No patch

"On Linux, watching a readable directory leaks events on files inside it you cannot even read: watching /dev/input gives a notification on every keystroke, which we turn into a local inter-keystroke timing attack with a 93.1–100% [keystroke accuracy] score across seven users and a remote (SSH) one at 100%,” Neela said.

The percentage range means the attack won’t work in all cases, which is more-or-less standard with side-channel attacks. They are notoriously difficult to pull off, which is also likely why most OS makers barely flinched at the news.

All of them were notified of the findings roughly a year ago, and most of them never bothered to address it. Linux introduced some mitigations, including CVE-2025-68788, which prevents inotify from generating certain “access” and “modify” events for special files. The fix was shipped to multiple kernels and Linux distros, but it addresses only part of the broader attack techniques that the researchers described.

Microsoft and Apple apparently acknowledged the findings, but apart from that - did very little. Microsoft told the researchers the behavior of ReadDirectoryChangesW was "by-design", although the feature is undocumented. They believe the ability to monitor file paths across users is not a vulnerability worthy of a patch. The report does not mention Apple doing anything about it, either.

• WordPress Core flaw CVE‑2026‑87902 (path traversal, 8.1 severity) enables PHP file inclusion and possible RCE
• Patch released in v7.1.2 and backported to 4.7+; exploitation began within hours, now widespread
• Admins must urgently update; interim mitigations include blocking traversal sequences and disabling risky ARP/PHP settings

Hackers are actively exploiting a high severity vulnerability in WordPress that can lead to full website takeover, researchers are saying. A patch is available, and WordPress users are urged to upgrade immediately or risk losing access to their assets.

Discovered by security researcher Robert Ressl, the vulnerability in question is tracked as CVE-2026-87902. It is an 8.1/10 (high severity) unauthenticated path traversal flaw affecting WordPress Core. According to WordPress itself, as well as the National Vulnerability Database, the bug can lead to local PHP file inclusion and, in certain scenarios, remote code execution (RCE).

"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories," it was said in the official security advisory.

Achieving RCE

WordPress is the world’s number one website hosting and builder platform, powering more than half of all websites active on the internet right now. However, that doesn’t mean all of them are susceptible to RCE. Only websites ticking these boxes are at risk:

Sites with parent or child themes that have a top-level directory with a name starting with ‘page-’ (for example, ‘page-templates).

Threat actors must target a local .PHP file that exists and is readable by the web server

The web server account must be able to read the included file (for example, pearcmd.php, if PHP’s register_argc_argv setting is active)

WordPress said that both the official PHP image for Docker, and the default cPanel configuration, are affected (users must be running a PHP version before 8.5, though).

The issue was fixed in version 7.1.2, which is now available for download. Fixes were also backported to older versions up to 4.7. Releases before 4.8 are not supported, it was said, and will not be getting a fix.

Attacking vulnerable websites

Wordpress security company Patchstack said the first exploitation attempts started roughly five hours after the patch was released, and these were primarily reconnaissance efforts. In the hours to follow, malicious activity increased tenfold, it was said, as crooks started attempting to deliver malicious payloads to vulnerable websites, as well.

“When this post first went up, every request we had seen was reconnaissance against harmless core files,” Patchstack said. “That is no longer true. Attackers are now including pearcmd.php and using it to write PHP files to disk, and public scanning tooling for this CVE is in circulation.”

At first, Patchstack said the attacks were coming from a handful of IP addresses, and advised website admins to simply block them. However, the attacks have now become rather widespread, meaning blocking individual addresses is no longer a viable strategy. They urge everyone to apply the patch without delay:

“The first evening came from a small cluster of addresses. It is now spread across a few hundred, so blocklisting individual sources is not a strategy. The heaviest talkers at the time of writing:

43.250.53.42

180.251.159.243

195.178.110.247

107.189.14.87

45.61.184.170

92.246.130.76

The file write attempts specifically come from a much smaller subset of those addresses, which is the usual pattern of a few operators acting on results that a much larger scanning population produced.”

Those that cannot update immediately should reject traversal sequences in the pagename parameter, Patchstack added. A real page slug never contains one, they added, meaning it can be blocked without affecting normal traffic. Furthermore, disabling register_argc_argv does not fix the inclusion but it does break the pearcmd chain, which is the difference between an information leak and code execution.

Via BleepingComputer

• Gambit researchers uncovered ongoing AI‑driven skimming campaign stealing 600,000+ payment records since July 2026
• Attackers used three autonomous harnesses (Strix, Cairn, Hermes) to compromise dozens of retail sites cheaply
• Victims include major US firms; campaign shows AI enables faster, persistent, low‑cost cyberattacks at scale

In July 2026, a hacker tasked autonomous AI agents to attack retail organizations around the world, deploy credit card skimmers, and steal payment data.

Since then, the bots launched hundreds of attack projects, compromised dozens of organizations, and stole at least 600,000 payment records - and to make matters worse, the campaign is still live, attacking and breaking into websites as we speak.

All of this was reported by security researchers Gambit, who said they managed to recover the operator’s staging server and through it - reconstruct the ongoing campaign. They also saw the skimmers live on victim websites, and sifted through logs and AI claims found on the attacker’s server. In just five days, between September 10 and 15, the agents made 105 attack waves and compromised 27 organizations “to varying degrees.”

Among the victims are a Fortune 500 hospitality company, a “major” US airline, a large private US industrial supplies distributor, and a US online fashion retailer. One of the AI tools would use a website ranking service to produce a list of potential targets, focusing primarily on those running custom-built software.

A fistful of dollars

But the victims are not the “interesting” part of this story - the attackers are. Gambit believes they are financially motivated Chinese threat actors. They are using three AI “harnesses” (frameworks, essentially), which can run almost the entire attack chain autonomously, striking around 10 companies a day, for a handful of dollars per company.

In four weeks, the attackers spent around $7,000, meaning that their entire cost for the operation so far was no more than $18,000. Breaking it down, it means that the attacker spent around $25 per target.

“Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company,” Gambit’s researchers said. “The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.”

“Where access was achieved, it usually took less than a day, and in many cases just a few hours. We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches,” Gambit said.

The three harnesses

The three harnesses are called Strix, Cairn, and Hermes.

Gambit describes Hermes as an open source autonomous AI agent with a persistent memory, skills that the agent wrote and edited itself, a searchable archive of past sessions, scheduled jobs, and a web console. On the staging server the researchers analyzed, it loaded a Chinese system persona called “SOUL - Red Team Operator”, which contained 121 skills (78 attack skills).

“Hermes is the operator’s console for orchestrating the activity and for direct hacking activities,” Gambit explained. “It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access.”

Strix is an open-source AI pentest tool, while Cairn is an autonomous pentest engine. It receives target domains and an objective, such as to get a shell or admin access, then runs for hours until it achieves the objective, times out, or is stopped. Cairn used DeepSeek v4.1 Flash, it was said.

Gambit’s researchers seem to be rather impressed with the campaign. They described it as very low cost, with a level of patience, persistence, and creativity that most human attackers would be “unlikely to sustain”, managing to achieve “far greater results, far faster.”

They have also called to arms, urging organizations to “adapt to a reality where attacks are significantly faster and more comprehensive.” To do that, they must adopt a resilience-first mentality and deploy a security stack that can match the AI on speed.

Many of the affected organizations were notified, and the skimmers were removed, they said.

• OpenAI agent breached Australia’s Medicare portal on June 18, 2026, accessing internal files
• Government says no personal medical data was taken, but three other agencies may be affected
• PM Albanese slammed OpenAI’s 84‑day delay in disclosure, calling the notification “unacceptable” and warning of legal consequences

An OpenAI agent has allegedly broken into a website of the Australian government, which has slammed the “unacceptable” attack, promising an in-depth investigation, and threatening “legal consequences”.

Australian Prime Minister Anthony Albanese revealed how in June 2026, OpenAI’s research team tasked the agent with researching public medicine spending, as part of an internal capability evaluation - but as the agent got to work, it was initially denied access to some of the information it requested.

However, instead of stopping, or trying to find a different lawful way of obtaining this data, it circumvented those restrictions and landed inside the infrastructure behind Services Australia’s public-facing Medicare Statistics Reporting Service portal.

AI agent did what?

The public details are still quite limited, and we don’t know the technicalities of what the AI actually did.

The acting prime minister, Richard Marles, told the media during a recent press conference that the AI “scaled the fence”, despite the portal having security measures in place.

The bot apparently accessed internal infrastructure and wrote files to an internal server but exactly what it wrote, how it obtained the access, and precisely which technical mechanism it used, is still not public knowledge.

Once inside, it accessed both public and non-public files, but individual medical data was not accessed and the system itself was not compromised, the Australian government said.

There is also the possibility that three other government systems were affected - the Australian Institute of Health and Welfare and two state-based agencies - the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health. However, this has not been confirmed yet.

"No personal information is believed to have been accessed at this stage, but investigations are ongoing," Albanese said. "Nonetheless this situation is obviously unacceptable."

OpenAI's sluggish escalation

Albanese was particularly unsatisfied with how OpenAI handled the situation. The breach happened on June 18, but it took the company 84 days to notify the Australian government of the incident. And when it did - it did so in a manner better suited for an amateurish start-up rather than one of the most important organizations on the planet right now.

OpenAI was apparently evaluating its models, and investigating “misaligned model activity” when, on August 11, it discovered the breach in Australia. It seems the AI agent simply did not take “no” for an answer. The company then notified Services Australia on September 10 - almost three months after the incident. To make matters worse, the company reached out via publicdisclosures@servicesaustralia.gov.au, inbox researchers usually use to report potential vulnerabilities, instead of trying to escalate the incident higher.

Services Australia reviewed the information and notified the Australian Signals Directorate on September 15.

When the news reached prime minister Anthony Albanese, he spoke to OpenAI CEO, Sam Altman, and expressed the country’s “extreme concern” about this incident, as well as his “disappointment that it took the company way too long to inform the government what had occurred.” He also pointed out the way OpenAI reached out: “The notification was an email sent just to the public mailbox.” Albanese described the “nature of the notification” as “unacceptable.”

The Australian government is now looking into the matter to see if any laws were broken and what legal consequences, if any, could follow.

"And obviously we will investigate all of that. What the consequences are, if there has been a breach of the law, but also part of the task force is to assess whether or not the legal regime we have in place is fit–for–purpose in a world where we have an emerging AI capability,” Marles said.

Via BBC

• $1.6 billion has been claimed by scammers impersonating police and government officials
• The FBI’s Internet Crime Complaint Center (IC3) received almost 61,000 complaints concerning such scams between January 2025 and July 2026
• Some scams targeted foreign nationals and immigrants, threatening to cancel passports or impose extradition, unless payment is made

Between January 2025 and July 2026, the FBI’s Internet Crime Complaint Center received almost 61,000 complaints concerning scams using police and government official impersonation tactics. As a result, around $1.6 billion is believed to have been scammed and extorted.

Tactics used by scammers included unsolicited phone calls and in some cases video calls, with victims losing an average of $26,000 per scam.

Particularly concerning is the targeting of foreign nationals, international students, and immigrant citizens, often with threats to cancel visas and home country passports. Incredibly, 10% of all losses were traced to a single scam, one that targeted fewer than 3% of the victims.

Foreign national victims

According to the FBI, the fake cop/fake government official scam has various angles, from alleging missed jury duty to threatening arrest due to circumstantial links to an alleged crime.

The demand from the scammers, inevitably, is payment.

Making a commitment to extreme lengths of scamming and extortion, the criminals took things to a new level when it came to targeting victims. International students, visiting foreign nationals, and other immigrant citizens were given special treatment. Not only were they threatened with extradition, there was also the implication of victims losing their home country passport.

To convince the target, scammers built actual studio sets, donned uniforms or suits, and appeared in video calls to the victims, who were convinced they were talking to foreign law enforcement agents or US-based diplomats. Creating the illusion of officialdom to sell the scam, victims paid whatever necessary to stay in their adopted country.

How to spot the scam

It is important to note that not all fraud of this type takes place in the US. These may be online or offline, but the so-called fake cop scam is an international criminal phenomenon. So, how do you avoid it?

We’ll assume you’ve answered a call inadvertently rather than having spam calls blocked (that should be set already).

First, remain calm. These situations are designed to impose stress and heightened anxiety. Scammers rely on these factors to cloud their victim’s judgement and force the narrative they are selling (“you missed jury duty”/“your presence in the country is illegal.”)

Second, it is vital to request credentials. Failure to provide these is the first red flag that the person communicating with you is not what they seem. That’s your cue to end the conversation.

Third, check the credentials. It doesn’t matter how long this takes – a legitimate caller will not mind waiting for you to do the necessary background check, even if it means them calling back.

Finally, and most importantly: neither law enforcement, security services, nor the FBI will demand money. If that is happening, it’s time to end the call.

• Cybersecurity company OPSWAT found a login bypass and a crash bug in TP-Link's Tapo C200 cameras
• TP-Link has extended that to include its C120 offering too
• Anyone on the same network could get admin access, live video, and recordings without requiring the owner's credentials

Security researchers at OPSWAT have detailed two high-severity flaws in TP-Link's Tapo C200, a pan-and-tilt indoor camera listed on Amazon for $26.99 and sold as a baby monitor and pet camera.

The more serious issue is that someone on the same network can log in as the camera's administrator without the password, accessing the live feed and stored recordings.

At least one other bug, which OPSWAT rates as critical in the same disclosure but does not detail, has not been published.

A localized login that requires no authentication

The TP-Link Tapo C200, as we noted in previous coverage of the incident, isn't just another security camera that happens to be vulnerable; it is one of the most popular models on the market, clocking in at over 3,000 sales on Amazon alone.

The Tapo C120, in its current iteration, sells over 5,000 units monthly, even as the advisory notes that its V1 hardware version is currently compromised until users update the firmware on their devices.

Both SKUs have received firmware updates that patch the vulnerabilities (CVE-2026-15315 & CVE-2026-15316), which are assigned 'high' scores of 8.7 and 7.1, respectively. However, according to TP-Link, CVE-2026-15316 does not affect the C120 camera.

However, the former vulnerability is the more pressing of the two and, according to OPSWAT, is particularly problematic for users because of how the C120 and C200 cameras function.

Both run a local management interface over HTTPS and use a challenge-response login designed to prove a client knows the owner's password. Khoi Tran, a graduate fellow at OPSWAT, and his mentor, Thai Do of the company's Unit 515 team, found a second verification path in which, under certain conditions, a value the camera hands out during login can be sent back and accepted as a valid authentication response.

The result is an administrator session after a small number of requests, with no password, no existing session, and no requirements for the new 'owner'. As a result, access includes live video, stored footage, and configuration changes.

OPSWAT's researchers pointed out that a C200 used as a baby monitor would expose "live video, night vision, crying detection and two-way audio."

The second flaw, CVE-2026-15316, affects only the C200 and sits in its Wi-Fi onboarding code. Sending the camera an oversized chunk of encrypted Wi-Fi credential data can crash its HTTPS service or restart the device outright, cutting the owner off from management and monitoring until it recovers.

The attacks are somewhat limited in scope: users aiming to exploit such vulnerabilities would need to be on the same Wi-Fi network, or within a certain trusted ecosystem, to begin with.

For now, users upgrading to TP-Link's newest firmware, issued for both models, rectifies both issues, but there might already be another security patch in the works: OPSWAT also found "a critical vulnerability that could allow an attacker to fully compromise the camera," which could then serve as a foothold inside the network.

It is currently holding off on publishing any details about the vulnerability as it waits for TP-Link to issue a patch that rectifies the situation. Neither OPSWAT nor TP-Link, however, has provided a timeline for when the patch will be available to end users.

• Microsoft, UK police, and partners disrupted EvilTokens PhaaS, arresting two suspects and seizing 200+ domains/sites
• EvilTokens used AI to scale device‑code phishing, compromising 12,000 inboxes across 10,000 organizations globally
• Platform ran like a startup with subscriptions, dashboards, and AI‑driven targeting; US victims hit hardest

Two people have been arrested, 50 websites were seized, and 150 domains disabled, in a joint operation against the infamous EvilTokens phishing-as-a-service (PhaaS) kit.

In its report, Microsoft said the UK Metropolitan Police Service’s cybercrime team “arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.”

The two men, whose identities were not disclosed, are aged 32 and 38, and have been released on bail, subject to conditions while the investigation continues. Their digital services and other items have been confiscated, as well.

Among the partners are Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs. We don’t know if these arrests and takedowns will be enough to completely obliterate EvilTokens, or if the platform will continue to operate. Usually, criminal infrastructure is a lot less resilient to disruptions when arrests are made, compared to when law enforcement simply disables the hardware.

The tech startup of organized crime

EvilTokens has been turning heads for a little while now. The platform was first spotted in February 2026, rising quickly to become one of the most widely used PhaaS solutions out there.

It can be bought through Telegram for $1,500, after which there is a recurring $500 subscription cost. Cybercriminals use it to run large-scale, personalized phishing attacks: they can create spoofed websites, landing pages, and other credential-capture assets; they can create custom-tailored phishing emails, and can even grab session tokens, one-time passwords, and other codes designed to protect accounts against phishing, granting attackers access to people’s inboxes.

But what makes EvilTokens particularly impressive is its use of artificial intelligence. The platform comes with an AI assistant that can sift through the inboxes, suggest which targets are of high value, and even how to approach them. Attackers can conduct Microsoft Graph reconnaissance as well, mapping out organizational structure and permissions, keeping access and moving laterally throughout the target network.

Microsoft said it found evidence of large portions of EvilTokens being vibe coded, “with AI helping its creators build the platform itself.”

The researchers also found the platform drawing on capabilities from multiple AI models. Looking at the platform as a whole, it runs like a well-organized startup, with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.

According to Microsoft, EvilTokens facilitated business email compromise (BEC) campaigns that compromised more than 12,000 inboxes in more than 10,000 organizations worldwide. Victims are mostly in wholesale distribution, construction, and financial services, but those in real estate, higher education, and healthcare are not spared, either.

The victims are primarily located in the United States, with notable numbers found in Canada, the United Kingdom, Australia, India, and France. Microsoft said affected customers were notified, and that the company “helped remediate compromised accounts and shared intelligence to support further defensive and investigative action."

Popularizing device-code phishing

Device-code phishing as an attack technique is not that new. More than a year ago, in February 2025, security researchers Huntress reported on Russian threat actors Storm-2372 deploying the same technique, and while it’s been steadily growing in popularity, it wasn’t until EvilTokens’ appearance that it really exploded.

The same researchers said, in June 2026, that EvilTokens was used to run 1,380% more device-code phishing attacks in 2026, compared to the same period last year.

“We’re seeing a clear maturation of the phishing-as-a-service (PhaaS) market as threat actors increasingly integrate AI workflows into their product offerings,” Huntress said in a report.

“The result is directly observable in our telemetry: a 1,380% increase in device code phishing attacks detected between July–December 2025 and January–April 2026, with over 50% of those incidents linked to two major waves of correlated incidents.”

• Burger King Russia’s 2024 breach via Mindbox exposed 3.2 million customer records, now leaked online
• Data includes emails, names, genders, birth dates, phone numbers, and geolocations (2018–2024)
• Payment details weren’t compromised; users warned of phishing and identity theft risks

Back in 2024, the Russian arm of Burger King suffered a data breach at the hands of unknown threat actors - now, that data has finally been leaked online.

In October 2024, Burger King told TASS, Russia’s national news agency, that unidentified hackers attacked Mindbox, a domestic marketing automation platform the company had been using.

Through Mindbox, the crooks managed to obtain sensitive company data, including information belonging to the customers.

As a customer data and marketing automation platform, Mindbox helps businesses gather and use customer information for personalized, omnichannel marketing campaigns. Its tools cover email and SMS campaigns, push notifications, loyalty programs, chatbots, and more. According to the company, more than 1,100 businesses use its platform, including L’Oréal, Panasonic, KFC, JBL and United Colors of Benetton.

One victim in a supply-chain attack

At the time, there was no word on the nature of the information that was taken, apart from the fact that payment information was not compromised.

"Among the victims of the attack may also be the data of customers of the Burger King restaurant chain," the company said at the time.

“Burger King confirms that among the personal data, the accuracy of which is being clarified, there is no information about payment details: open information about transactions is not transmitted or stored by third parties.”

The details about the hack were also not disclosed. We don’t know if the platform contained a zero-day, or if a company employee had their login credentials or session tokens exposed. Third-party supply chain attacks such as this one are common and often rather disruptive, affecting numerous companies using the same tools. For Mindbox, however, there have been no reports of additional victims.

In its 2024 results announcement, Mindbox said the attack was its “first serious information security incident”, which was quickly detected and contained “thanks to threat detection tools.”

In the aftermath of the breach, Mindbox said it “found and eliminated points where employees without access rights to sensitive data could indirectly obtain them,” hinting that the attack was, in fact, an identity-based attack rather than a zero-day exploit.

The company also “changed development processes to find such points before they get into the product,” and reformed Mindbox's internal role system to make permissions stricter and more granular. It also limited project access scenarios, introduced a mechanism for confirming access by another employee, and introduced mandatory two-factor authentication, among other things.

Have you been pwned?

Today, more details were released on Have I Been Pwned?, a website that aggregates information stolen in various hacks and helps people learn if their email addresses and other information had been compromised in the past. According to the newest entry, more than three million people have had their data exposed in this incident:

“The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024,” Have I Been Pwned? writes. “Burger King Russia acknowledged the incident and advised it did not include payment or passport details.”

The latest findings seem to be somewhat in line with what the media reported at the time. According to The Register, initial reports claimed around 5.6 million lines of data as exposed, which included information about a customer’s favorite dish and previous order dates. While this information was not mentioned in the newest report, if every data line includes one email, one name, or one phone number, it could amount to around 5.6 million.

While the information might be a few years old, things like names and birth dates, and genders rarely change, but are vital in identity theft, social engineering, and similar attacks. Burger King users, especially those in Russia, should be wary of incoming email messages, particularly those claiming to come from the fast food chain.

• ShinyHunters defaces FBI’s jobs site, claiming a PeopleSoft zero‑day let them steal 2TB of HR data
• Group says attack is not for ransom but to dispute FBI’s May PSA alleging harassment and swatting tactics
• Experts warn exploit itself is highly valuable; FBI site reclaimed, investigation ongoing into breach claims

The ShinyHunters extortion group is currently doing brand management in the most ShinyHunters way possible - by hacking into the FBI and stealing the agency’s sensitive files.

The Bureau’s jobs site was defaced and replaced with the usual ShinyHunters content - an ASCII image of the group’s logo, and a message saying “This site has been seized by ShinyHunters. Rooting your systems since ‘19 :)”.

But instead of putting the FBI on its data leak site and threatening to release stolen files if a ransom isn’t paid, ShinyHunters started speaking to the press, telling The Register it found a zero-day vulnerability in the Oracle PeopleSoft human resource management system, which allowed them to remotely execute arbitrary code on the underlying server.

They used this ability to (allegedly) steal more than 2TB of sensitive data from the FBI’s servers, including names, addresses, phone numbers, and information on spouses for current, former, and prospective FBI employees.

“We hold data on all FBI employees and applicants,” the spokesperson told The Register, noting they had compromised human resources, MedLink, and Criminal Justice Information Services.

Brand management

The FBI has yet to comment, and so do both Oracle and AWS, but what’s most peculiar about this incident is that it doesn’t seem to be financially motivated.

So far, everything ShinyHunters’ have been doing was for the money. They would break into a company, steal their files, and then pressure the victims into paying a ransom demand in exchange for deleting the stolen information. This time around, the group claims the goal of the attack is to force the FBI to change the record on how it operates.

“This is NOT financially motivated,” the group told The Register. “We want the FBI to correct or retract their statements they made, which included substantial false allegations.”

The statements were made in a security bulletin published on May 15 this year, right after the Canvas attack. In early May 2026 Instructure, the edtech giant behind the popular Canvas learning system, confirmed suffering a cyberattack and losing sensitive customer data. It was later disclosed that some of the world’s top universities, including Harvard, Oxford, and MIT, were among the victims.

The attack was so disruptive that Instructure’s CEO was called to testify in front of the US House Committee on Homeland Security a few weeks later.

On May 15, the FBI issued a public service announcement (PSA) saying ShinyHunters “commonly use harassment strategies” to exert pressure on victims, including “sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting.”

Swatting means calling the police to report criminal activity so severe that the SWAT team is sent. This is usually done to live streamers as a practical, albeit life-threatening, joke.

“Threat actors may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist. Following these pressure tactics, SH actors have sometimes posted exfiltrated data to various iterations of the SH data leak site on the Tor network,” the PSA concluded.

“I have been doing my very best to combat these allegations,” ShinyHunters told the media. “And this is the best way to do it.”

No money?

Not everyone is sold on the idea that ShinyHunters isn’t doing this for the money.

In a statement shared with TechRadar Pro, CTO of Suzu Labs, Denis Calderone, said the claims should be taken with a grain of salt: “I have a hard time believing terabytes of FBI personnel data just sit on a shelf. Foreign intelligence services would love to have it, and having the FBI on their resume makes every future extortion demand more believable, and if the PeopleSoft zero-day is real, the exploit may be worth more than the data. Meanwhile, agents and their spouses could have their home addresses posted publicly within a week if this threat is followed through.”

Calderone also stressed that instead of focusing on the incident, people should be paying more attention to the zero-day.

“If you run PeopleSoft, don't wait for a patch. Get it off the public internet wherever you can, put what has to stay public behind a WAF, and make sure admin components like the /PSEMHUB/ path in their screenshot aren't reachable from outside. Hunt for the June indicators and for SSH attempts against the psoft and oracle accounts. Then ask yourself what your applicant portal can reach. At the FBI, a website built for strangers to upload resumes allegedly led straight into GovCloud.”

The FBI has since reclaimed its website, which now says it is under maintenance.

• Seller claims to be offering Mistral AI's full source code and says the company was breached again after May 2026 attack
• Mistral says an investigation found no evidence of new unauthorized access but has not stated whether the listed code is genuine
• No customer data has surfaced in analyzed samples, and nobody has shown files created after the May incident

A seller on a cybercrime forum says French giant Mistral AI has been hacked again and is offering what they call the company's full source code for sale.

The September 16 2026 post by an account using the handle "mrwho" consists of a listing titled "Selling mistral.ai Source Code" on an English-language cybercrime forum, according to The CyberSec Guru, pricing the material in Monero only before it attempted to steer potential buyers to Session or Telegram.

Mistral AI's own team has refuted this, stating it has "found no evidence to support this claim."

Not Mistral's first hacking-centric PR problem

Mistral's earlier hacking incident is undisputed - in May 2026, the Mini Shai-Hulud supply chain campaign, attributed to the TeamPCP group, spread from compromised TanStack packages to hundreds of npm and PyPI projects.

Mistral's own security advisory MAI-2026-002 says an automated worm led to compromised versions of its SDKs being published for a few hours on May 11 and 12, and that an affected developer device was involved. Microsoft Threat Intelligence found that a poisoned Mistral AI Python package fetched a second-stage credential stealer that allowed the attack to exploit users.

Mistral went further in statements to reporters than in its advisory. It told BleepingComputer that attackers had compromised a codebase management system and "contaminated some of our SDK packages for a brief period," while insisting that hosted services, managed user data, and research and testing environments were untouched. It also told HackRead that only certain non-core repositories were accessed.

TeamPCP, meanwhile, advertised roughly 450 repositories, about 5GB in total, for $25,000, and threatened to dump them for free if no buyer appeared within a week. One can therefore contend that this could be the same dump being remarketed by a different account, and the seller's profile is already suspect.

The CyberSec Guru noted that the account joined in September 2026 and had four posts and a reputation score of 30, despite displaying a top-tier "GOD User" rank. That profile could fit a scam in the making, but as the outlet pointed out, it could also fit a broker fronting for someone else or a freshly minted alias.

HackRead published 24 sample repository names from TeamPCP's May post. FrenchBreaches, which examined the 339-file tree mrwho shared in September, lists several of the same names. At least four of these appear in both: mistral-inference-private, mistral-inference-internal, mistral-finetune-internal, and mistral-common-internal.

This makes it hard to tell whether the purported 'hack' is just a rehash of an existing dump from Mistral's previous breach or a second successful hacking attempt. There is a straightforward test, however: If the September archives contain commits, files, or credentials dated after May 12, or secrets that were still valid after Mistral's cleanup, the seller's claim of a second breach gains real weight. If everything predates the May incident, this is a resale, which is embarrassing for Mistral but not a new security failure.

Of course, locating the archives or examining them would involve paying the ransom in crypto, as required by what could potentially be a scam in the making- a tremendous leap of faith for an account that was created earlier this month, making this essentially a lottery ticket at best for any security researcher attempting to take a closer look.

• More workers are worried about security issues than they were this time last year
• Three in four say their recovery tools are too difficult for them to use
• This report says having strong data storage could help

While many of us typically see security as an IT or a leadership issue, it's actually impacting us more than we'd initially thought. New Object First data found that 91% of workers feel uncomfortably stressed at work because of IT security risks – a seven percentage point increase over last year.

But unfortunately, it's a double-edged sword because it all boils down to AI. Nine in 10 say AI tools have improved their productivity, but seven in 10 say the growth of AI-powered threats is a key driver behind their stress.

Additionally, fewer than one-quarter (24%) believe their organisation is suitably equipped to deal with those threats.

AI-driven security threats are actually impacting you and I

While the risk of cyberattacks (50%) is a leading cause for stress at work, high workloads and understaffing (50%) land in joint-first place. Gaps in backup and recovery effectiveness (41%) and pressure to maintain uptime (44%) are also big headaches for workers, implying pressure isn't coming from direct attacks alone, but workload and operations.

For example, three in four (74%) say that their recovery tools are difficult to use without security expertise, leaving regular knowledge workers at a loss. One in five (19%) even say they feel hopeless and overwhelmed during and after an incident.

Naturally, this stress is impacting productivity, with four in five (78%) remarking that stress negatively affected their job performance. Two in five (39%) even said they'd thought about quitting.

"As critical as technology is to cyber resilience, those responsible for protecting and recovering an organization’s data are just as essential," company CEO David Bennett concluded.

• Attackers spoofed LastPass Authenticator via SEO‑poisoned GitHub pages, delivering malicious ZIP files
• Malware Rapuncel uses DLL sideloading, kills 145 AV products, and steals passwords, wallets, and tokens
• Campaign ongoing for months; LastPass vaults unaffected, but users urged to download only from trusted sources

Be careful when downloading the LastPass Authenticator app - there are impostors out there that can disable your antivirus and wreak havoc on your computer.

LastPass recently discovered an elaborate scheme to get people infected with malware - a spoofed website, SEO poisoning, DLL sideloading, and a malware loader delivering never-before-seen payload that can kill endpoint protection and antivirus solutions.

According to the password manager, users searching for "LastPass Authenticator download" or similar keywords will get a GitHub page rather high on the search engine results pages. At a glance, the page looks almost identical to the authentic LastPass offering - however, it redirects users to a separate one, hosted on attacker-controlled infrastructure and delivering a large .ZIP file with multiple files.

Among the files are two worth paying attention to: vsdbg.exe, and vsdbg.dll. The .EXE one is renamed to look like a LastPass installer, but it’s in fact a legitimate Microsoft debugging tool. This tool is used to run the malware - the vsdbg.dll file. This is a method called “dll sideloading” where the legitimate program will look for a DLL file in the same folder it’s located, rather than the wider device library. Since the DLL is delivered together with the executable, it is the first one to be run, despite the fact that it’s malicious.

Rapuncel

LastPass shared the malware with security researchers Delphos for analysis, and they’ve named it Rapuncel. No AV engines have been able to spot it, when it was first analyzed.

Once Rapuncel runs, it does a number of things. First, it gains admin-level access to run as SYSTEM, and then installs a kernel driver. The driver, disguised as an NVIDIA graphics component, comes with a hardcoded list of 145 antivirus and endpoint security products, and if any of them are found on the device, they are instantly terminated.

After killing antivirus solutions, the malware gets to work, stealing saved passwords from more than 25 browsers (Chrome, Edge, and other popular ones included), cryptocurrency wallet files from more than 30 wallet apps, Discord login tokens, Steam session tokens, Telegram session data, Windows credential store, all documents with words like “password”, “seed”, “wallet”, or “recovery” in their name, screenshots of every monitor connected to the device, as well as a detailed profile of the system.

Once all of this is harvested, the information is compressed into a .ZIP archive and uploaded to a server under the attackers’ control. To add insult to injury, the kernel driver was given code to intercept all web traffic, allowing the attackers to inject ads, or modify search results, at a whim.

Rapuncel comes with a persistence mechanism, as well, to make sure it continues operating even if the victim spots it. Spotting it should not be too difficult, though - if no antivirus programs are allowed to run on a computer, something is definitely not working properly.

Active for months

Still, the malware installs itself as a Windows service that starts automatically at boot, and then loops continuously, checking for security products and killing them as soon as they’re activated. “The machine may remain fully under the attacker's control until the kernel driver is physically removed,” the researchers explained. “This process requires booting the computer into Safe Mode or using an external recovery tool, because normal Windows tools cannot safely remove software operating at that level while the system is running.”

LastPass and Delphos believe the campaign has been active for months, and that it will continue to operate despite disruption efforts:

“The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned,” the researchers said. They stressed that this is “opportunistic brand impersonation” and that LastPass systems and customer vaults have not been compromised or involved in any way.

LastPass said it was one of 40 companies spoofed in this campaign and has urged users to only download apps from reputable, vetted sources.

• Researcher Patrick Wardle finds zero‑day in Meta’s new Muse AI assistant,
• Dubbed not‑a‑mused, the exploit requires local compromise, voice dictation, and app integrations; attackers can hijack tokens and exfiltrate data
• Meta has been informed but no patch yet; flaw highlights risks of AI assistants with broad permissions

Meta’s new Artificial Intelligence (AI) assistant Muse reportedly carried a zero-day vulnerability that allowed attackers to gain access to people’s apps, such as WhatsApp or email.

However, it’s not as straightforward as your usual zero-day - to exploit it, simply deploying malware will not suffice. Certain features need to be enabled, and certain integrations established before the bug could be leveraged.

Not-a-mused

A little background, for context: Meta recently released Muse, describing it as an assistant that can “book appointments, fill out forms, and handle customer service.” It says the tool, available exclusively for the Mac ecosystem for now, “proactively takes tasks off your plate” and makes purchases, generates images, and creates documents.

To do that, however, it needs to connect to apps such as email, WhatsApp, calendar, or social media accounts - and this connection is the first prerequisite needed to exploit the flaw.

The second prerequisite is voice dictation. The vulnerability was found in the way Muse handles commands received via voice, meaning the attacker must piggyback onto voice commands in order to escalate privileges and access other apps and their content.

Now for the flaw itself. It was discovered by security researcher Patrick Wardle, founder of nonprofit Objective-See. He named it “not-a-mused” and says it hides in an undocumented setting called endo_voyager_dictation_endpoint. When a user narrates a voice command, that instruction is sent and processed in the cloud, where Meta can log it. This setting allows the user to change which endpoint receives the dictation.

Which brings us to the third prerequisite. The threat actor must have local access to be able to change this setting in the first place. In other words, the device must already be compromised in some way, either via remote monitoring and management tools, or via low-level malware (or with physical access).

For the sake of the report, let’s say that a theoretical user checks all the right boxes - they’re running a compromised machine and are talking to Muse that’s already connected to other productivity apps. Instead of reaching Meta’s endpoints, the voice commands are first sent to attacker-controlled infrastructure, where the AI assistant, together with the instructions, also sends authentication tokens for the tool.

If the attacker reacts fast enough, they can grab the token and access their target’s AI tool. If it’s connected to other apps, such as WhatsApp or calendar, they can simply prompt it to extract whatever sensitive information is found inside.

Not-a-mused is therefore a combination of data exfiltration and privilege escalation.

Ironing out the kinks

“We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle told Ars Technica.

“So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.” Wardle said he has developed several proof-of-concept attacks that do things like writing malicious files to disk and snapping pictures, in many cases with no indication to even an alert user.

Meta has been informed, but is yet to comment, or issue a patch.

AI assistants are all the rage nowadays. They’ve turned elaborate answer machines into tools that can complete assignments, even more complex ones. They can book flights and restaurant tables, make purchases, schedule and reschedule calls and meetings, and more. However, to do that, these tools need extensive permissions - something the security community is warning of.

While they’re not openly speaking against it, they are advising caution. There are many stories of AI agents either going rogue, or simply being tricked by malicious actors. For example, a hidden prompt in a phishing email can trick an AI agent tasked with summarizing the message into exfiltrating all .PDF documents from the victim’s inbox.

In the early days of agentic AI, there were reports of assistants simply deleting people’s inboxes.

Assistants are likely here to stay, but there are still quite a few kinks to iron before they can hit the mainstream.

• BigCommerce confirms supply‑chain breach via compromised Ribon app credentials affecting merchant storefronts
• Master of Malt notified customers: names, emails, phone numbers, and addresses were exposed
• Attack ran Sept 13–17 2026; ICO notified, law firm warns of phishing risks for affected retailers

Ecommerce platform BigCommerce was recently hit with a cyberattack in which it lost sensitive data belonging to some of its users.

One of the users - online spirits retailer Master of Malt - confirmed the hit and notified its customers that their personally identifiable information (PII) was accessed in the attack.

BigCommerce is an ecommerce platform relatively similar to Shopify. Businesses use it to build and operate online stores without needing to develop the entire commerce infrastructure themselves. It offers features like storefronts, shopping carts, integrations with different payment providers, product inventories, SEO and marketing tools, and more.

The platform has been around since 2009 and according to a late 2024 SEC filing, serves 5,884 accounts with at least one unique enterprise plan subscription. A 2025 press release says BigCommerce is used by “tens of thousands of B2C and B2B companies across 150 countries.”

Software supply chain attack

BigCommerce allows its users to install, among others, a third-party app called Ribon, an ecommerce app providing tools that improve the online shopping experience. Some merchants integrate Ribon into their stores to add different functionality to the customer-facing storefront, and to optimize how visitors interact with different elements of their website. We don’t know exactly how many stores use Ribon.

According to Master of Malt, unidentified threat actors managed to compromise a BigCommerce Application key held by Ribon, and used it to access customer data that was held on their system. The attack took place on Sunday, September 13 2026, until the access was finally revoked four days later, on September 17.

Speaking to BleepingComputer, BigCommerce said credentials for Ribon and Ribon 1.5 were compromised:

"On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts,” the statement reads. "Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," the company told the publication.

The keyword in this statement is “small number of merchant storefronts.” BigCommerce hints that the attack was relatively small in scope and, consequently, in damage. However, in its report Master of Malt says otherwise:

“It’s now clear that we weren’t the target of the attack. The attack was against Ribon, which was installed on hundreds of BigCommerce stores. Once the attackers compromised an access key from Ribon, they used it to access data held inside BigCommerce.”

Names and emails

Whether or not this transforms into a new Snowflake fiasco remains to be seen.

In the meantime, Master of Malt also said BigCommerce notified it that the attack had been stopped and that there was no further risk of compromise. All companies affected by the breach were contacted. As for the spirits retailer, here is what it said about the data exposed in the hit:

“I’m sorry to say that the attackers had access to your name, email address, phone number, and address. However, they were not able to access your password, credit card or other payment information as they are held in a separate system which was never compromised.”

Master of Malt reported the attack to the UK Information Commissioner’s Office (ICO). Law firm Emery Reddy is calling for potential claimants to the incidents, saying that “several retailers” are currently notifying customers about data exposure related to the incident, BleepingComputer reported.

“A number of online retailers that use the BigCommerce e-commerce platform have begun notifying customers of a data breach that originated not with the retailers themselves, but with a third-party application called Ribon,” the law firm says. Emery Reddy also warned of potential phishing and scam attacks.

• CISA added three Linux kernel flaws (CVE‑2025‑39682, CVE‑2026‑53266, CVE‑2025‑39964) to KEV catalog
• Red Hat confirmed active exploitation; agencies given rare three‑day patch deadline expiring Sept 21, 2026
• Bugs enable DoS, privilege escalation, or data corruption; patches available, limited mitigations for two flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux flaws to its Known Exploited Vulnerabilities (KEV) catalog, signaling abuse in the wild and giving government agencies a deadline to patch or stop using the flawed product entirely.

The three bugs in question are tracked as CVE-2025-39682 (severity score 9.8/10 - critical), CVE-2026-53266 (severity score 8.8/10 - high), and CVE-2025-39964 (severity score 7.8/10 - high). All three have already been patched in the Linux kernel. CVE-2025-39682 was fixed in stable releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4, while CVE-2025-39964 was fixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9. CVE-2026-53266 has been fixed upstream and backported to supported stable/distribution kernel branches, including 5.10.259, 6.1.176 and 6.12.94.

The first issue is an improper check for unusual or exceptional conditions vulnerability in the TLS receive patch which could allow unauthenticated threat actors to launch memory disclosure or denial-of-service (DoS) attacks. The second one (CVE-2026-53266) is an out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite patch which allows local attackers to escalate privileges or mount DoS attacks.

The last one (CVE-2025-39964) is a race condition flaw that allows concurrent writes to the same AF_ALG socket, which allows local malicious actors to crash the system or corrupt cryptographic operation results, leading to data integrity issues and possible DoS states.

Attacks in the wild

Red Hat acknowledged that all three are being abused in real-life attacks. “This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority,” it said in all three advisories.

However, there are no details as to who is currently using these exploits, against whom, and to what cause. There are currently no separate reports of cyberattacks referencing any of the abovementioned vulnerabilities.

However, CISA still reacted. All three flaws were added on September 18, 2026, and all three have a small three-day deadline for patching that expires on September 21. Usually, CISA would grant Federal Civilian Executive Branch (FCEB) agencies a three-week deadline to patch up, with just exceptionally dangerous flaws getting a shorter window. That being said, these flaws are likely extremely dangerous.

In theory...

In a hypothetical scenario, a threat actor could target a Linux system using kernel TLS (kTLS) by sending a specially-crafted TLS record that triggers CVE-2025-39682 and causing either a crash, or even arbitrary code execution. Attackers that already have a low privilege foothold on the target endpoint could use CVE_2025-39964 to escalate privileges, while on systems using the affected bridge/netfilter configuration, CVE-2026-53266 could be used for privilege escalation, as well.

According to the Red Hat advisory, there is a chance that CVE-2025-39682 is remotely triggerable, but only when the system is using the affected kTLS receive path. The other two flaws are exclusively local vulnerabilities.

Besides fixes, two out of the three flaws also have possible mitigations. For the improper check one, users should prevent module tls from being loaded. For the out-of-bounds write one, users are advised to disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces. The final vulnerability, currently does not have a working mitigation, and the only way to stay secure is to apply the provided patches.

Linux kernel vulnerabilities are generally considered serious, but the severity still depends on the flaw and how the affected kernel is deployed. Earlier this year, security researchers disclosed four local privilege escalation flaws, called DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).

Via The Hacker News

• HKUST (Guangzhou) and HK PolyU researchers' InjectEave beams a radio carrier at devices so their own circuits leak analog audio
• The leaked audio has already been decrypted by the device itself, making encryption offer no protection against such an approach
• The 30m headline needed a pricey amplifier pushing output to 10 W, while standard ranges of 1 to 6m were measured by detecting a test tone

Researchers at the Hong Kong University of Science and Technology and the Hong Kong Polytechnic University have shown that everyday headphones, a desk phone, and a handful of smart-home gadgets can broadcast what they are doing simply by using a radio signal.

The technique, called InjectEave, was presented at USENIX Security 2026 in Baltimore, and multiple outlets have since covered the researcher's claim that the attack "can recover headphone audio from up to 30 meters away, including through walls".

The claim may be accurate, but it has limitations, including the need for specialized equipment that is often very noticeable in most settings.

An impressive technical show with plenty of limitations in tow

Conventional electromagnetic eavesdropping waits for a device to leak. That works poorly for audio, because speech sits below 20 kHz while a device's wiring radiates efficiently only at megahertz or gigahertz frequencies.

InjectEave chooses to close the gap by transmitting a carrier signal at the target. According to the paper, nonlinear components such as amplifiers, analog-to-digital converters, switching MOSFETs, and power converters mix the secret signal onto that carrier, and the device's own traces and cables radiate the result back to a receiver.

Because the leak happens in the analog path, after audio has been decoded, the project page states that "InjectEave is immune to digital defenses such as encryption, masking, and randomization." Encryption in any form on a wireless headset is irrelevant, since the attack directly targets the signal driving the speaker, not the radio link.

The team demonstrating this used a USRP B210 software-defined radio, two antennas, a Siglent spectrum analyzer, and a laptop to set up their proof of concept, which could, as they noted, "eavesdrop on the majority of these devices from over 2m away and through walls, with a maximum distance of 30m for recovering intelligible headphone audio".

This isn't the first time the technique has been used, even as the researchers have built on it considerably; the idea originates from "The Thing," a Soviet bug given as a gift to the US ambassador in Moscow in 1945, which was passively powered remotely as a listening device.

InjectEve, however, does not involve planting anything; instead, it leverages existing work on interference-induced leakage and impedance-based backscatter, and distinguishes itself by recovering coarse digital data rather than continuous analog waveforms, allowing users to 'listen in' without added steps.

The same approach applies to wired headphones, which are also prone to leaking microphone audio; researchers concluded that their sound cards were the primary source of the leaks, which were being sent back over very short distances.

The threat is somewhat tempered by the fact that it can capture what users hear but, with wireless headphones, cannot hear what the user is saying. The attacker also has to transmit continuously and use a high-powered (10W) transmitter to reach the full 30-meter range, even though capturing and rendering speech is harder than the tones the test used to prove the approach worked.

The attacker also needs to know the target model and profile a matching unit first, although they managed to get a profile to transfer cleanly across three identical UGreen headsets, suggesting this might be easier than one would assume.

The researchers say they reported the findings to the affected manufacturers but, "as we have not yet received a response," withheld the table's frequencies and stripped injection control logic from their released code. One shouldn't be too hopeful, however, as no software update can fix an analog leak, and it is relatively limited in practical abuse cases.

• Hackers are using blockchains to keep malware instructions available after servers disappear
• AI is making blockchain-based malware infrastructure easier for less experienced hackers
• Blockchain traffic is difficult to block without disrupting legitimate cryptocurrency services worldwide

Hackers are increasingly hiding malware instructions inside public blockchains, creating communication channels that can survive the removal of conventional infrastructure.

New figures from Chainalysis claim malicious blockchain activity increased 440%, with daily entries rising from 2.06 to 11.1 after newer AI systems emerged.

The technique gives attackers another way to maintain communication with compromised computers without relying entirely on conventional servers controlled by hosting providers.

Blockchain networks become malware dead drops

Blockchain dead drops use transaction data or smart contracts as lookup points, allowing infected computers to retrieve commands, addresses, or configuration information.

Because blockchain records are distributed across networks, removing a conventional server does not erase information already stored on the ledger.

A North Korean-linked operation associated with UNC5342 uses TRON and Aptos as alternate routes before retrieving encrypted instructions through the BNB Chain.

Its malware can check one network, switch to another when necessary, and retrieve updated addresses without receiving another malware package.

Iranian actors suspected of links to the country's intelligence ministry have embedded encoded routing information inside Bitcoin transactions used for malware retrieval.

Russian-speaking cybercriminals have also commercialized the technique, using Polygon contracts to provide blockchain-backed infrastructure for malware campaigns operated by different customers.

One related operator controls more than 50 BNB Chain resolver contracts while also conducting activity involving fraudulent tokens and clipboard-monitoring malware.

These operations show how blockchain records can function as persistent lookup infrastructure rather than merely serving their conventional financial and transactional purposes.

AI lowers the technical barrier

Chainalysis said the sharp increase in this malicious activity followed the arrival of high-capacity Chinese open models, which placed fewer restrictions on malware development requests.

Before those systems appeared, building reliable blockchain-based malware infrastructure required expertise across malicious software, cryptocurrency networks, and distributed communication systems.

AI tools can reduce that knowledge barrier by helping less experienced operators understand unfamiliar technologies and produce components needed for blockchain communication.

In the second quarter of 2026, state-linked groups accounted for roughly two-thirds of newly observed activity.

Those groups also represent about half of overall observed activity, indicating that blockchain-based malware infrastructure extends beyond conventional cybercriminal operations.

Defenders face difficulties because blocking blockchain traffic could also disrupt legitimate wallets, decentralized applications, exchanges, and decentralized finance services used worldwide.

Attackers can further complicate disruption by operating their own blockchain nodes, reducing dependence on external providers that defenders might otherwise pressure or disable.

Some operators have hidden server addresses inside wallet identifiers without usable private keys, then used zero-value transfers to trigger malware retrieval.

Those transactions leave public records that investigators can examine, potentially providing useful clues even when attackers attempt to conceal their infrastructure.

"While the exploitation of blockchain by state-linked organizations such as North Korea is becoming more sophisticated, on-chain records left by attackers can actually serve as important clues to track them," said Kwon Jun-hyeok, General Manager of Chainalysis Korea.

"Tracking these traces and identifying attackers and related infrastructure through blockchain intelligence will become increasingly important in responding to new cyber threats."

• So-called signal sharing between Microsoft and Google uncovered the RedVDS marketplace was behind large-scale cyber fraud
• RedVDS sold access to virtual machines running unlicensed software from which cybercriminals launched scams and directed attacks
• Threat data was shared securely via the Global Signal Exchange (GSE), a non-profit organization

A major cybercrime marketplace has been taken out of action thanks to cooperation between Microsoft and Google via a secure threat data sharing platform.

Known as the Global Signal Exchange, the collaboration led to the take-down of the RedVDS, an online cybercrime mall supplying virtual machines for launching phishing, business email compromise attacks, and more.

The marketplace – which provided quickly-deleted and therefore virtually untraceable VMs – was meticulously monitored by Microsoft’s security team, Digital Crimes Unit, with both Microsoft and Google suspending the operation and action taken to seize domains and servers.

A secondary case featuring the GSE identified a Microsoft-impersonating tech support scam, resulting, highlighting the importance of secure thread data collaboration platforms.

Digital Crimes Unit

Finding massive scams is not easy. Even with its own Digital Crimes Unit, Microsoft has to rely on information sharing with third party organizations. In this case, the RedVDS marketplace was identified ahead of disruptive action taken by Microsoft in January 2026, which applied to courts in the UK and US to have the RedVDS web domains seized.

Data shared via the GSE enabled Google to follow suit, identifying related accounts on its networks and suspending them. Meanwhile, servers were impounded in Germany, and Europol took action against Europe-based RedVDS servers.

It’s an impressive account of cooperative, decisive action against cybercrime, a collaborative response to what has been described as a “$66 million fraud marketplace.”

An incredible 130,000 organizations were targeted by RedVDS-provided virtual machines between September and December 2025, with 191,000 Microsoft email accounts compromised during this period. All of this access to cybercrime was available from just $24 a month for a basic scam-ready virtual machine.

The importance of collaboration

The Global Signal Exchange is a UK-based non-profit, co-founded with Google in 2025 with the aim of providing real-time monitoring of the cybercrime supply chain.

"Fraud does not respect company boundaries, and no single organization ever sees the whole picture," noted Emily Taylor, CEO at Oxford Information Labs and Co-Founder of the Global Signal Exchange.

"That is exactly why we built GSE: to give trusted partners a secure way to share what they know, quickly. These two cases are a good example of GSE doing exactly what it was designed to do."

The Global Signal Exchange’s role in the sharing of information between Google and Microsoft has highlighted the importance in such collaborations. Both organizations have stated they plan to continue sharing information through the GSE, whose other partners include Meta, Amazon, Google, among many others.

• ShinyHunters hacked rival gang Cl0p, stealing source code, logs, and onion service keys
• The gang defaced Cl0p’s site via Grav CMS flaw, posting their logo and taunts about past threats
• Feud recalls Conti’s collapse in 2022, raising risk of escalating “cyber war” between criminal groups

Infamous cybercriminal gang Cl0p has seemingly been hacked by an even more infamous data leak collective, ShinyHunters.

The attack is still being pieced together, but it would seem we have true hacker beef on our hands - which just might escalate into a full-blown cyber war.

ShinyHunters has added Cl0p to their data leak site, giving the hacking group 72 hours to pay a ransom or see all their files leaked into the cybercriminal underbelly. The files allegedly stolen in the attack include source code, Grav CMS plugins, system logs, and other information, Cybernews reports. We don’t know how much money ShinyHunters are asking to keep Cl0p’s files private.

Still downloading

"The data we stole includes source codes, gravCMS plugins, and other things. We are still downloading and reviewing them," ShinyHunters allegedly told BleepingComputer.

The group also said they stole everything in the server’s /var/log directory, including system activity records, authentication logs, and IP addresses associated with connections to the server. We doubt this could lead to the identification of any Cl0p members, and even if it could, it would mean very little since the members are likely Russian and thus mostly free to conduct their operations.

Doxxing might help defenders disrupt the group’s infrastructure, though.

Whether or not that will be needed, given ShinyHunters’ activity, remains to be seen. The attackers also said they stole the private keys for Cl0p’s Tor onion service:

"We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL," the group said.

On top of it all, ShinyHunters defaced Cl0p’s website. Allegedly, the group found an unauthenticated file upload flaw in the Grav CMS Cl0p was using, gaining access to their target’s servers, website, and more. Cybernews confirmed the website had been defaced and now holds an ASCII image of ShinyHunters’ logo, and a link to their Tor site. It also displays a large message:

"THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time.” Furthermore, it says “rooting your systems since '19 ;)".

The “maybe don’t try to threaten us next time” message seems to refer to a threat that a Cl0p member made earlier. Apparently, this person threatened violence against ShinyHunters, as well as to expose their identities to the public. The remarks were made during Cl0p’s 2025 Oracle E-Business Suite attacks.

"During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I'll kill you soon," ShinyHunters told BleepingComputer.

Dog eat dog

Cybercriminals often work together. They share resources, rent each other’s services, and often complement their campaigns. However, that doesn’t make them “friends” or “colleagues”, in any way. It is usually just a marriage of convenience that falls apart at the slightest sound of trouble. The last big “feud” we’ve seen was back in 2022, at the very start of the Russian invasion of Ukraine. Back then, a group called Conti publicly declared its “full support” for the Russian government and threatened to use its resources against anyone conducting cyberattacks on Russian infrastructure.

The announcement was a fiasco - many of Conti’s affiliates stopped working with the group, and others were openly attacking it. Soon after, a Ukrainian researcher and an alleged affiliate leaked more than 60,000 messages, exposing the group’s operations and internal organization.

All of this eventually led to Conti’s collapse later that year. However, its members did not disappear - they splintered into multiple groups such as Black Basta, Royal, and Quantum. Some of the crooks engaged in Conti are allegedly still active today.

• Joint report from Japan, US, Germany, and Australia says Contagious Interview stole $10 million in crypto
• NK operatives used fake personas, companies, and “laptop farms” to infiltrate 30,000+ devices in 100 countries
• Agencies urge vigilance: verify applicants’ details, check IPs, validate certifications, and watch for crypto‑based payments

North Korean threat actors behind the infamous “Contagious Interview” campaign have so far compromised more than 30,000 devices across 100 countries, and have robbed around 7,000 people of their hard-earned cryptocurrencies.

The theft has brought more than $10 million to the North Korean government, a new report jointly released by law enforcement agencies in Japan, the United States, Germany, and Australia has found.

Fake everything

Contagious Interview is a hacking campaign running for almost four years now. Sometimes it’s also called Operation DreamJob.

The cybersecurity community in general attributes it to the government of North Korea, although more precise attribution is rather difficult.

Some researchers believe it is being done by the Lazarus Group, one of the largest and most influential state-sponsored actors around.

Others believe different groups are involved, labeled DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, or TAG-121.

Contagious Interview leverages the lack of skilled workers in the West to infiltrate organizations, steal sensitive data and ultimately, money. North Korean operatives would create entire fake personas on social media such as LinkedIn, and would apply to hundreds, if not thousands, of job ads across IT, healthcare, and other industries.

The personas are carefully crafted, using a mix of legitimate information stolen in data breaches (names, SSNs, addresses), and AI-generated images, video, and audio. If hired, the operatives would use their access to infect organizations with malware, steal login credentials and different access, and exfiltrate sensitive files and cryptos.

The operation works the other way around, as well. Crooks would create fake companies and fake job positions, and would then reach out to their targets to offer lucrative positions on exciting projects. As part of the hiring process, the candidates would be asked to download and work on code which, unknown to them, was malicious. The North Koreans would then pivot to their targets’ current employers, resulting in the same outcome.

Laptop farms

One of the ways organizations in the West are trying to combat this issue is by being mindful of the IP address and the location from which their employees are logging on. To work around this challenge, the attackers have set up “laptop farms” - facilities located abroad (usually in countries that don’t have that strict limitations, but are still NK-friendly, such as China), hosting hundreds of laptops. They would then access their targets’ networks through these laptops, to make sure their actual location is never revealed.

The primary targets are individual web designers, engineers, and specialists working in cryptocurrency, blockchain, and Web3 technologies, it was said. Businesses should be wary when they receive numerous applications in a short time, for a position where there are usually very few applicants.

“If possible, verify that IP addresses generally match the applicant’s claimed residence,” the report states. “Carefully check all contact information. Calling an applicant’s phone number may reveal the number is out of service.”

The agencies also warned that trying to get hired is often a group effort: “Even if a single individual appears to be applying, multiple people may be collaborating behind the scenes, inflating the perceived skill set.” Therefore, businesses should verify certifications by checking registration numbers and, in case of any inconsistencies, should ask for detailed explanations.

Asking personal details about the applicant’s hometown, weather, or hobbies, is often a good way to spot a scammer. Finally, it was said that North Korean IT workers tend to favor payment in cryptocurrency, and they may request that remuneration be sent to an account in another person’s name.

Contagious Interview has been ongoing for roughly four years now, and during that time it evolved significantly. Security agencies warn that changes to the standard practice could happen at any time, and that the variations to the theme should be expected.

• Google's Gemini AI broke out of a testing environment and hacked into three third-party companies
• The agents guessed passwords and used a public repository of passwords to hack into computer systems
• The incident occurred in May 2026, with AI testing lab Irregular stating that the incident was caused by the "same issue" that caused incidents by Anthropic and Meta

Google’s Gemini has joined the ranks of AI models that have been involved in testing-turned-breakout events, alongside Meta, Anthropic, and OpenAI.

During capture-the-flag testing by AI lab Irregular, Google’s model autonomously accessed three computer systems belonging to third-party companies by guessing passwords and accessing an online repository of publicly listed passwords.

Google said that the incident occurred in May 2026, potentially marking it as the earliest AI models to escape testing ahead of the other incidents that took place in early July.

Google Gemini jumps the gun

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.”

Google also noted that a bug in the testing environment was responsible for allowing agents access to the internet. Contrary to incidents disclosed by other AI developers, Google’s agents ceased their intrusion once they had determined they had accessed company systems outside of the testing environment.

The testing was being conducted by Israeli AI lab Irregular. Irregular was also conducting the testing of Meta and Anthropic models during AI testing breakouts in July.

“This is the same issue that was already reported and does not represent a materially separate incident,” an Irregular spokesperson said in a statement (via CNBC). “All relevant labs were notified in late July, and affected entities were contacted as part of the investigation.”

Google said it was informed of the incident by Irregular in late July.

Debate over AI safety intensifies

The first disclosures of AI testing break outs - alongside several subsequent disclosures of more recent incidents - have coincided with increasing opposition to AI and the upcoming midterm elections in the United States, where AI has become a make-or-break topic.

The debates currently raging circles around who should control the pace of AI development. Some big tech leaders, such as Nvidia CEO Jensen Huang, have aligned their views with those of President Trump. Trump recently stated that AI development cannot be allowed to slow down because “whoever wins AI, wins!”

Huang’s views follow a similar line. The Nvidia head has argued that AI companies should pace themselves, rather than being subject to oversight. At Dreamforce 2026, he argued that AI companies should, “run as fast as you can...but if you feel at any given point in time the company’s out of control or the product’s not going to be safe, take a pause and make sure you get it right.”

Other AI heads, such as Anthropic’s Dario Amodei and OpenAI’s Sam Altman, are more skeptical. Following the resignation of an Anthropic researcher, Amodei published an essay arguing in favor of ‘pacing the frontier’ - where AI companies slow development to advance alignment and regulation.

Numerous political action committees (PACs) have been channeling millions of dollars of funding into pro-AI candidates, with Nvidia setting up its own PAC to help shift US policy in the company’s favor.

Several previously pro-AI data center candidates have shifted their tone in response to their constituents' views which have become increasingly hostile to AI technology. Numerous states have also rolled-back tax exemptions for AI data centers after seeing billion dollar revenue losses.

As prices rise and the war in Iran continues to push up fuel prices, working class communities are banding together to oppose AI data centers that have pushed up energy costs and bills with new grid connections and unprecedented electricity demands in regions with existing capacity constraints.

• Zimperium zLabs discovered RedHat, a Chinese‑origin Android banking trojan with AI assistant
• AI interprets screen layouts in real‑time, enabling credential theft and bypassing app redesigns
• Distributed via third‑party stores, social media, malvertising, and SMS; persistence blocks uninstall attempts

There is an Android malware out there that comes with an AI assistant that tells it what to do. The assistant seems to be independent of the malware’s operator, allowing the tool to work without requiring the operators to be present in real-time.

The malware in question is called RedHat. It was discovered by security researchers Zimperium zLabs, who believe it is of Chinese origin. It is currently being distributed via third-party app stores, social media, malvertising, and SMS spam, and requires Android’s Accessibility permissions to work.

The malware itself is a typical banking trojan - it creates an invisible overlay every time the victim brings up a banking app, capturing login credentials and one-time passwords, and thus giving attackers direct control over people’s banking accounts.

AI-powered eyes

But what makes RedHat stand out from a sea of Android banking trojans is its AI-powered component. The model serves as a kind of remote “eyes and hands” for controlling the victim’s phone.

Usually, when criminals develop banking trojans, they need to code exact coordinates of the layout for it to work. They need to code where the password is entered, or where the login button is. If the banking app gets redesigned and changes its layout, the malware breaks.

With AI, that is no longer a problem. RedHat gets a picture of what’s on the screen, sends it to the AI assistant, which then instructs the malware on how to proceed.

"RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," Zimperium explained.

The tool also has a few advanced persistence mechanisms, being capable of reinstalling deleted components, and intercepting the uninstall process to cancel it while displaying a fake error message to the victim.

So far, there is no word on who the targets are, or how many people might have been compromised.

Via BleepingComputer

• ESET reports Salt Typhoon shifted focus to Latin America, hitting Argentina, Peru, Venezuela, and others
• Group deployed new SparroWocky backdoor with 30+ commands for profiling, exfiltration, and surveillance
• Researchers link pivot to Trump’s renewed US push in the region, threatening China’s long‑term investments

Salt Typhoon has been reassigned to Latin America, and it’s apparently all due to Donald Trump’s renewed “interest” in the continent.

Cybersecurity researchers ESET have been tracking Salt Typhoon, a Chinese state-sponsored threat actor for years. This is the same group that was seen hacking telecommunication giants and government agencies across the western world since at least 2019.

According to the researchers, from mid-2025 and well into 2026, the group has been targeting a number of Latin American countries: Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. They were seen deploying brand new malware, a backdoor called SparroWocky, that features around 30 commands such as system profiling, file exfiltration, screenshot grabbing, and more. ESET says that around 90% of all Salt Typhoon’s recent activity was devoted to this specific region.

A rare occurrence

The discovery of China-built malware in these countries comes as somewhat of a surprise. Latin America cannot be considered an open ally to the Chinese, but they are quite influential in the region, both economically, and diplomatically. ESET sees the development as a “rare occurrence”, and stresses that this is most likely a response to Trump’s initiatives in the region.

“Donald Trump’s second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications,” ESET says. “We suspect that FamousSparrow’s (their name for Salt Typhoon) activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.”

ESET says the backdoor is being delivered via a trident loader scheme that consists of a legitimate executable, a malicious DLL, and a file containing the encrypted malware. By side-loading the DLL, the crooks can deploy the malware without being spotted.

Via The Register

• FBI and US Coast Guard boarded tanker VL Prosperity after foreign cyber compromise indications
• Iranian media claimed attackers sabotaged engine systems and communications; Kohaku vessel also affected
• No group claimed responsibility; US agencies investigating “malicious cyber activity” on targeted ships

Last month, two tankers heading for the United States were hit by a cyberattack, forcing the FBI and Coast Guard to board at least one of the vessels and investigate.

The first vessel is called VL Prosperity, which was allegedly transporting 2.3 million barrels of oil. It is a Liberian crude oil tanker, travelling from Egypt’s Sidi Kerir Oil Terminal towards Galveston, Texas, where it was supposed to dock on August 24. On its route, lasting roughly 25 days, it passed through the Strait of Gibraltar.

Some three days before arriving, it requested assistance from law enforcement, prompting a “highly specialized team” of FBI and Coast Guard cyber experts to board. The ship is currently sitting in the Gulf of Mexico.

Iranians (indirectly) claiming responsibility

“On August 21, a highly specialized team – comprised of USCG Law Enforcement personnel, USCG Cyber Protection Team members, a vessel inspector, and FBI Cyber Action Team operators – embarked the vessel to conduct a comprehensive cyber security boarding and investigation,” a US Coast Guard spokesperson told Cybernews.

The spokesperson also said the team’s activity is “designed to ensure the integrity of the vessel’s operational and information technology systems." The Coast Guard apparently saw “indications that the vessel’s network were compromised by foreign cyber actors.” It later described the incident as “malicious cyber activity.”

The second vessel in question is called Kohaku, flying under the flag of the Marshall Islands. It was travelling towards Texas to load liquefied petroleum gas, as per Wall Street Journal, and has been sitting near Malta for the past couple of days. At press time (Friday morning), it was travelling through the East Mediterranean Sea.

So far, no threat actors have publicly claimed responsibility for these attacks. However, the Iranian Mehr News Agency allegedly hinted the attack was a “message from Iran’s “Resistance Front” to Washington and the broader Middle East.”

The same publication - also the first one to report on the incident and name VL Prosperity as one of the victims - said the attackers infiltrated engine-room systems, reduced the engine’s cooling flow, increased the engine speed, and disabled the ship’s fuel and engine-oil tank, all citing an unnamed crew member. Apparently, the ship’s communications were knocked offline for a day and a half, as well.

Via Cybernews

• CISA urged organizations to deploy honeypots, lures, and honeytokens as cyber decoys
• Decoys complement Zero Trust by detecting LOTL activity and producing high‑fidelity alerts
• Guidance outlines tripwires, breadcrumbs, MITRE ATT&CK/Engage steps for scalable implementation

The US Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to deploy honeypots and various lures to better detect cyber-intrusions and keep hackers busy with spoofed materials. To that end, it recently published a new guidance to help businesses of different sizes and cybersecurity maturity implement these “cyber decoy strategies”.

“Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data,.” CISA said in a new security advisory.

“Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI). As organizations adopt Zero Trust models, they should assume that a malicious threat actor may gain some level of access to their environment and plan accordingly.”

Tripwires, breadcrumbs, and honeytokens

CISA’s advisory hints that Zero Trust is the preferred way to go about securing corporate infrastructure. Zero Trust treats no user, device, or network segment as inherently trustworthy and requires organizations to operate on the assumption that compromise is inevitable, it says. If you want to learn more, read our in-depth guide on what ZTNA is.

However, it adds that cyber decoys are consistent with this paradigm and complement ZTNA by supporting continuous monitoring and verification, creating high-fidelity alerts for suspicious activity, reducing alert fatigue, and helping defenders detect post-compromise activity such as adversary LOTL techniques. They are also incremental, cost-effective, and scalable, and can be introduced into the cybersecurity tech stack without major architectural changes.

The guidance can be found on this link (PDF). It introduces different decoy concepts such as tripwires, breadcrumbs, and honeytokens, and uses the MITRE Engage and MITRE ATT&CK frameworks to provide the steps needed to plan, implement, and refine these operations.

• Sublime researchers warn ICS phishing via calendar invites is surging ~33,000% since May 2026
• Attacks bypass filters, trick users into installing RMM tools like ScreenConnect for full compromise
• Defenses: scrutinize suspicious invites, verify senders, and treat ICS attachments with caution

ICS phishing - the type of phishing that abuses calendar files (.ics) is set to increase by around 33,000% between May and September 2026. This is according to a new report by cybersecurity researchers Sublime, who argue that this type of phishing has finally “hit the mainstream”.

The methodology is simple - the attacker uses a free service, such as Gmail, and sends a calendar invite to the target. Since both services are legitimate and free, the attacks bypass most email security filters and can be done at scale with close to zero cost.

Furthermore, the victim is exposed to the attack twice: once in the inbox, and once in their calendar. Inside the calendar invite is usually a link to download a maliciously configured remote management and monitoring (RMM) solution such as ScreenConnect. The attackers can use the tool to take over the compromised endpoint, deploying stage-two malware such as infostealers or ransomware, and grabbing passwords, documents, and other valuable secrets.

Spiking in popularity

ICS phishing started increasing in popularity roughly a year ago, but has been really picking up speed lately. Between May and June it increased 282%, and between June and July - 338%.

Between July and August it rose 1,216%, and in just the first half of September it rose 1,426% over the full month of August. Projections for the entire month of September, over August, are 2,852%, Sublime says.

“The jumps in August and September appear to be indicators that this attack type has finally hit the mainstream,” the researchers explained. “To really drive that point home, the increase from May to September is projected to be ~33,000%.”

Defending against these attacks is best done with a little common sense, the researchers conclude. Users should be mindful of the telltale signs, such as suspicious CTAs, suspicious senders, and the usual financial urgency.

• Security researchers used Claude Opus 5 to hijack an OpenAI employee's ChatGPT account
• Exploit abused an image processing flaw on OpenAI community forums to gain full repo access
• The entire timeline from vulnerability discovery to repo access took less than 72 hours

While taking part in an OpenAI bug bounty program, a group of Hacktron security researchers managed to compromise an internal OpenAI ChatGPT account and access internal company code on Github.

According to the Wall Street Journal, who first reported the incident, the researchers used a “special version” of Anthropic’s Claude made available to “qualified cybersecurity practitioners” to pull off the attack.

The researchers initially attempted to use Claude Opus 4.8 to create a breach, but faced multiple setbacks as the model “struggled across several sessions to produce a working exploit.” But the release of Opus 5 changed everything.

OpenAI breach part of wider libheif exploit

The breach started with a libheif exploit that abuses a flaw in the .heic/.heif/.avif image file format decoder and encoder. While this exploit allowed Hacktron to breach OpenAI, libheif is also used across other platforms and software including Slack, Meta, GitHub Enterprise, Ruby on Rails, and more.

To start, the researchers first noted that the OpenAI community forum relies on the Discourse platform, which in turn relies on FastImage for image checks. But FastImage does not support .heif image files, and these are passed on to ImageMagick for conversion instead.

Developing a working code-execution exploit that abused this relation between ImageMagick and libheif with Opus 4.8 “wasn’t fruitful”, the researchers said, but on the same day Anthropic released Claude Opus 5.

With Opus 5, the researchers managed to create a working local remote code execution (RCE) using the same premise by setting an AI agent in a loop to exploit a local Discourse Cloud instance.

The successful Discourse exploit was then used against the OpenAI community forums, where the researchers hijacked an OpenAI employee’s ChatGPT account. The employee had connected their ChatGPT Codex with the company’s Github, allowing the researchers full repo access.

Exploit needed just a few hours of human interaction

Where the researchers spent hours struggling to create a working exploit with Opus 4.8, the release of Opus 5 showed that “every new model is getting increasingly capable." It took the agent running on Opus 5 just a few hours to develop a working exploit.

The full timeline from initial discovery of the exploit to OpenAI repo access took just 72 hours, researchers noted.

The researchers also said that the entire OpenAI and Discourse hack “took a few days for an agent, and just a few hours of human time” in order to be successful. Furthermore, their research into the libheif exploit against organizations such as Slack, Zoom, Meta “took two-months, cost less than $3,000 in tokens in total, and was conducted by three researchers.”

“The AI started almost blind and adapted the exploit for each company within one or two days,” the researchers said. “We are not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed.”

In return for exposing the vulnerabilities, Hacktron was awarded a $6,500 bounty from OpenAI, and the libheif vulnerability has been patched.

AI agents are the future, for better or for worse

Hacktron's exploit demonstration shows how prevalent AI agents are becoming in cybersecurity. Where they have been lauded by AI companies to provide productivity bonuses and efficiency increases to workers, the same can be said for attackers.

The fact that it took just 72 hours from exploit discovery to full repo access highlights the dangers. By setting an AI agent to run on a continuous loop until it creates a workable exploit dramatically shifts the exploit timeline from weeks or months in the case of non-AI assisted attacks to mere hours for attackers aided by agents.

This is a similar circumstance to OpenAI's own accidental breach of Hugging Face during testing of AI agents. The agents were essentially told to complete a test scenario by any means necessary, which the agents interpreted as permission to go beyond their alignment and hack into a third-party environment that they thought held the key to solving their task.

"AI has been changing the threat landscape for a while now, and the defence landscape with it," Spencer Starkey, Executive VP EMEA at SonicWall said. "But there's a conversation we're not having loudly enough: do you actually want your security platform to have been built by AI, with no human track record behind it?"

"It looks compelling. You have low cost, high margins, slick interface. But what happens when something goes wrong at 02:00 in the morning and you need someone who knows the product, knows your environment, and has seen that problem before? An AI-built platform with zero employees can't give you that.

"Why go with an established vendor when a newer option does 90% of the same things for half the price? It's a fair question. But the 10% you're trading away is usually accountability, resilience, and institutional knowledge. Exactly what matters most when you're under attack.

"It looks like due diligence is eroding, and that worries me. Shiny and affordable is a powerful combination…for magpies. But in cyber security, the cost of a bad supplier decision doesn't show up until the moment you can least afford it, so don’t be a magpie," Starkey concluded.

• US law enforcement seized Nightmare Stresser domains, a long‑running DDoS‑for‑hire platform
• Service enabled hundreds of thousands of attacks since 2022; FBI banner now replaces sites
• Part of Operation PowerOFF, which has seized 100+ domains and charged 12 people so far

US law enforcement agencies disrupted yet another Distributed Denial of Service for hire (DDoS-for-hire) platform. In a press release published earlier this week on the District of Alaska’s Attorney General’s Office website, it was said that two internet domains associated with the Nightmare Stresser service were seized.

Describing it as “one of the world’s longest running Distributed Denial of Service for hire services,” the DoJ says Nightmare Stresser was used in “hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022”.

Services such as this one are called “booters” or “stressers”, and are often advertised as legitimate, allowing users to stress-test their websites against possible DDoS attacks.

No arrests

However, researchers have warned on multiple occasions that this is merely a cover for what’s essentially illegal activity. These platforms rent their services to anyone, including cybercriminals, and have been used to disrupt and take businesses, public organizations, and individuals offline, causing reputational and financial harm.

Nightmare Stresser’s two domains were seized - nightmare-stresser[.]com and nightmarestresser[.]org. Visiting these sites now shows the usual FBI defacement banner saying, “This website has been seized as part of a coordinated law enforcement action taken against illegal DDoS-for-hire services.”

To run DDoS attacks, threat actors need infrastructure - hundreds of thousands of internet-connected devices infected with malware that forces them to direct their traffic towards a single point. The DoJ’s announcement says nothing about the infrastructure being dismantled, or the malware used to create Nightmare Stresser being discovered or sinkholed. It also does not mention any arrests being made, so it is safe to assume Nightmare Stresser will be back to its usual shenanigans sooner, rather than later.

Still, the press release says that the takedown is part of Operation PowerOFF, an ongoing campaign aimed at dismantling DDoS-for-hire infrastructure worldwide, as well as “holding accountable the administrators and users of these illegal services.”

So far, more than 100 domains were seized as part of the effort, and 12 people were charged.

Via The Hacker News

• Helpfeel confirmed a Sept 11 breach compromising 23.62M records tied to Gyazo users
• Stolen data includes PII, login/session IDs, Google SSO tokens, and 490M image metadata records
• Payment info safe, but private images may have been exposed; viewing disabled pending investigation

A Japanese customer-support and knowledge-base company suffered a cyberattack recently in which it lost millions of user records, including personally identifiable information (PII) and, possibly, customer photographs.

The company in question is called Helpfeel. It is an established organization with more than 200 employees, operating as a combination of a modern help center, intelligent search, and an AI support agent. It runs an image-sharing service called Gyazo. According to a breach notification published earlier this week, the breach happened on September 11, when an unidentified threat actor abused a vulnerability to upload malware, gain access to the service’s servers, and run arbitrary commands on them.

A subsequent investigation determined that the attacker compromised 23.62 million records. Multiple records are tied to the same user, and many of the records were generated by customers without user accounts, so the actual number of affected individuals is not yet determined (but it’s definitely less than 23.6 million).

Image metadata exposed, too

The compromised records fall into these categories: names, emails, password hashes, user IDs, device IDs, login session IDs, X integration tokens, email addresses associated with Google SSO, profile information, language preferences, registration date and time, login date and time, subscription plan, billing status (without credit card numbers), and usage statistics.

“We have confirmed that no payment information, including credit card numbers, was disclosed without authorization,” Helpfeel confirmed.

PII aside, the attackers also accessed image metadata. Roughly 490 million records associated with images registered in or before January 2019 were compromised, including image IDs, source IP address used for the upload, user-agents, EXIF location data, OCR text extracted from the images, image titles, source URLs, and hashed passphrases for private images.

Since some of this metadata is used to generate image URLs, Helpfeel does not rule out the possibility that the attackers viewed actual images, as well. “We have temporarily disabled viewing of some images to prevent further harm,” it said. “As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation.”

Via The Hacker News

• Cisco fixed critical ISE flaw (CVE‑2026‑76460) allowing unauthenticated API authentication bypass
• Actively exploited; no workarounds exist—patching is the only mitigation, per Cisco PSIRT
• CISA added to KEV catalog, mandating federal agencies patch or disable ISE by Sept 19, 2026

Cisco has fixed a maximum-severity vulnerability found in its Identity Services Engine (ISE) that is being actively exploited in attacks.

ISE is the company’s Network Access Control (NAC) and identity-based policy platform which decides who or what is allowed onto a company’s network, and what they’re allowed to access inside.

“A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication,” the company said in a security advisory.

Abused in the wild

“This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”

The bug in question is tracked as CVE-2026-76460. It was given a severity score of 10/10 (critical), and was said it affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.

In the same advisory, Cisco said its Product Security Incident Response Team (PSIRT) was aware of active exploitation and urged customers to upgrade to a fixed software release as soon as possible. There are no workarounds available for this flaw, and a patch is the only solution. The full list of vulnerable versions and the corresponding patches can be found on this link.

At the same time, the US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal agencies a three-day deadline to patch, or stop using ISE entirely. The deadline expires on September 19, 2026.

Cisco has shared Indicators of Compromise (IoC) and advised defenders to hunt for suspicious usernames in access.log files on every node. It also recommended re-imaging nodes and restoring them from backups, in case of a breach.

Via BleepingComputer

• Check Point warns scammers spoof airline customer support on social media to steal payment data
• Hundreds of fake accounts created daily, luring frustrated passengers into private chats or forms
• Campaign active since 2024; mirrors earlier fake support scams seen during crypto wallet fraud

Scammers are now posing as customer support for airlines, tricking already frustrated customers into sharing payment details and possibly losing money, too.

People who have had poor experiences flying would often vent their frustration on social media, be it X, Facebook, Instagram, or any other platform. They would tag the company and demand help, or at least an explanation. However, according to new research from security experts Check Point, the airline’s social media department is not the only one monitoring these complaints - hackers do it, too.

Not only are they monitoring the channels, they are actively preparing to hop in and talk to the customers.

Years-old campaign

Every day, hundreds of new social media accounts are created - some are built to spoof the airlines themselves, others are built to look as if they’re used by the airlines’ customer support or similar department. When the customer leaves a post or a comment, the criminals swoop in, publicly apologizing for the inconvenience, and offering assistance in a different, private channel. Sometimes those are the platform’s DMs, and sometimes it is WhatsApp or a different platform entirely.

The end result differs from case to case. Sometimes, the criminals would try to get the victims to share their personal and payment information and would later try to make a wire transfer. In other instances, the crooks would prepare a fake form for the victims to fill out, possibly creating a database for later use.

Check Point doesn’t know exactly when the campaign started but found some of the impersonation accounts dating back to before 2024, with the majority being created either in 2024, or later. “This suggests that the activity has accelerated over the past two years. The campaign remains highly active, with hundreds of new accounts appearing daily and new scam techniques continuing to emerge,” they said.

However, we can confirm that this type of fraud has been around for a lot longer than that. Fake customer support scams were rampant on X even in 2021, during the crypto ICO craze, during which crooks were taking advantage of people losing access to their wallets, or making transactions towards nonexistent wallet addresses in the same way.

• Spain’s data protection agency (AEPD) reported its first breach carried out by an autonomous AI agent
• Agent chained multiple attack stages: accessed public files, scanned systems, exploited a flaw, and modified data
• AEPD urged businesses to factor AI‑driven attacks into risk assessments, stressing faster response and stronger identity controls

A Spanish company was apparently hit with a data breach conducted by an autonomous AI agent.

Earlier this week Francisco Pérez Bes, president and deputy of the Spanish data protection agency (AEPD) published a new article on the agency’s blog, saying it “received the first notification of a personal data breach in which the incident was reportedly carried out using an artificial intelligence agent powered by a well-known large language model.”

As per Pérez Bes, the agent first used the target’s “publicly accessible files”, through which it was able to log into its system. From the inside, the agent then started scanning for vulnerabilities and after finding one, used it to modify personal data and gain access to invoices.

A call to action

The author stresses that there is very little known about this incident and that a thorough investigation is currently ongoing. He pointed out that the attack doesn’t imply the AI model or the provider’s infrastructure were compromised or malicious by design, but said that the attack was “significant from a data protection perspective,” since the AI agent was used to chain together multiple stages of the attack.

For Pérez, the attack is a call to action - businesses need to rethink how they assess and manage security risks. He claims businesses need to “explicitly account for AI-assisted and AI-driven attacks when assessing the risks associated with personal-data processing,” and need to reassess their response times.

“Procedures designed around manually executed attacks may not be sufficient when an AI agent can analyze multiple assets at once, test different avenues of attack, and rapidly adapt its behavior based on what it finds.”

He also stressed the “growing importance of digital identities and credentials,” since an AI agent with an account or an API key “can operate at machine speed and move across different services before an organization has time to detect the anomalous activity.”

Via The Register

• The US Treasury's FinCEN arm asks financial institutions to file scam center suspicious activity reports under a new keyword
• FinCEN says that it flagged financial moves across 33,904 different filings, but actual losses might differ significantly, as the approach is prone to double-counting transactions
• Only 1,300 institutions filed reports, with 10,082 (29.7%) of them centering around exploitation of the elderly by scammers

The US Treasury's Financial Crimes Enforcement Network has issuespublished an alert and a companion data analysis telling banks, credit unions, digital asset exchanges, and securities firms that it needs sharper reporting on the overseas scam centers that it says target Americans at an industrial scale.

FinCEN puts total damages, per its reporting mechanism, at roughly $12.7 billion linked to suspected digital asset investment scams between September 2023 and the end of 2025.

The number comes from adding up the dollar values of 33,904 Bank Secrecy Act filings that referenced the keyword from its 2023 "pig butchering" alert, which may be overstated, as it includes both attempted and successful transactions as well as both inbound and outbound reports, often of the same transactions, causing significant overlap.

FinCEN's new requirement is a keyword

While the $12.7 billion is a measure of what institutions have flagged and is prone to double-counting and errors, victim losses, a significant chunk of which go unreported, may be considerably higher.

This has prompted Gene Lange, who effectively works as the Under Secretary for Terrorism and Financial Intelligence, to call these scams "one of the most significant fraud threats facing Americans today."

It has also prompted a new suspicious activity report keyword: "FIN-2026-SCAMCENTERS," which institutions are expected to use to indicate that a scam center is potentially involved.

FinCEN also wants chat logs, scammer phone numbers, social media handles, wallet addresses, transaction hashes, and the URLs victims were told to deposit into, filed in the structured cyber indicator fields rather than left out.

Institutions to volunteer more information to stop scams

The move is part of its push to have institutions volunteer more information under the US Patriot Act, as it aims to confront what is a growing intelligence problem: scammers tend to route victims through several institutions in sequence; most filers see only one slice of a scam's lifecycle and often have difficulty tracing it all the way.

For example, a crypto exchange might see a customer buying USDT and sending it off-platform, a bank might see a wire to that exchange, and a brokerage might see a retirement account liquidated. None of them would have the bigger picture of what essentially happened or what triggered the transaction.

Combined, with properly linked information, it makes it much easier to identify a potential scam; separately, these incidents can inflate the number of reports, which often aren't linked, and investigations can lack insight into the origin or final destination of the funds.

FinCEN's Rapid Response Program has interdicted $1.8 billion and recovered just over $1 billion for 5,790 US victims since 2015, which, against the flagged totals, is a very limited recovery at best compared with the actual funds at stake. This highlights a larger fundamental problem: institutions mostly detect these schemes after the money is gone, and reporting them correctly and thoroughly may yield limited dividends at best against an industry that has morphed, relatively unchecked, into a multi-billion-dollar juggernaut.

• A pseudonymous GitHub account has published what it calls a reconstruction of Stuxnet malware that purportedly took out a fifth of Iran's centrifuges before being discovered
• The original source has never surfaced, and the 'Stuxnet' moniker that the account uses comes from Symantec's coining of the name weeks after it was discovered
• The code remains unverified and untested, with some users indicating that it is likely an AI-generated replication of the original binaries' behavior, which has been widely documented

A GitHub account has published what it describes as a faithful reconstruction of Stuxnet, the worm that sabotaged Iranian uranium-enrichment centrifuges.

It also became the first piece of software widely accepted as having caused physical destruction in the real world, highlighting how malicious software can often do much more harm to people and hardware than just stealing or manipulating data.

The repository surfaced via a Show HN submission, which mainstream media outlets then picked up, highlighting the as-yet-unknown researcher's reverse-engineered code.

Not the first or last Stuxnet repository

The original Stuxnet source, written by whoever built it, has never been leaked and did not leak last week. The repository's README explicitly states that it is a reconstruction assembled from decompiled binaries, and those binaries have been in public circulation since Belarusian firm VirusBlokAda pulled samples from an Iranian customer's machines in June 2010.

Everything that followed, including Symantec's W32.Stuxnet Dossier and Ralph Langner's To Kill a Centrifuge, was built on those samples and how they reacted in test environments.

This is also not the first time readable C-language code aiming to replicate Stuxnet has been published online. Malware researcher Amr Thabet published a decompilation of the MRxNet rootkit carrying a 2010 to 2011 copyright notice. Christian Roggia followed with a dropper decompilation called open-myrtus, copyrighted 2012 to 2014, which has since been forked into a long chain of repositories.

The irony is that if such code were a faithful replication of the infamous malware, it would not have mentioned "Stuxnet" in multiple places, including registry keys. This is because the moniker is not one the developers likely used, but one Symantec switched to from its original 'W32.Temphid' identifier.

The thread where it was first brought to attention by a user called Sadpainy also has mixed views from developers, many of whom have branded it 'AI slop' or a 'fake' that relies on a mixture of already existing repositories, even as the about page on its GitHub repo states that it was reproduced by the researcher for educational purposes and is designed to only work on Windows XP and Windows 7.

For those looking to test it, a virtual machine might be their best bet, especially given Stuxnet's ability to physically damage hardware, but it is also a stark reminder of what a rogue AI agent could do if left unchecked without specific instructions or safeguards.

• UK NCSC, FBI, and Dutch AIVD warn Iran is using Chosen Brick malware against dissidents and journalists
• Malware steals files, captures audio, grabs WhatsApp/Telegram data, and can wipe systems entirely
• Operatives rely on social engineering; agencies urge awareness, MFA, updates, and endpoint monitoring

Iranian hackers are targeting “enemies of the state”, both local and foreign, with advanced malware capable of spying on the victims and stealing their sensitive files, experts have warned.

This is according to a new security advisory, published jointly by the UK National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service (AIVD), which noted how Iranian operatives would first do extensive research into their victims - dissidents, activists, and journalists - deemed a risk to the regime.

After learning as much about their targets as possible, they reach out via social media, either as someone the victims know, or as technical support for the platform they’re currently using, engaging in extended conversation until the victim lowers their guard. At one point, the attackers will try to share a piece of malware with the victims, tracked as Chosen Brick.

A thousand victims

This malware, designed primarily for the Windows platform, has a long list of capabilities, including enumerating running processes and system information, capturing screen content, enabling the microphone to capture audio content, capturing a copy of Telegram and WhatsApp data from web browsers, downloading additional files and malware, deleting files, stealing email content, and ultimately - wiping the entire computer system. The operatives communicate with the malware using Telegram, it was said.

“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” the three agencies said in the report. “In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”

In the advisory, the three agencies said the best defense is to simply be more aware of social engineering. However, there are also a few technical mitigations that can help, including following NCSC advice on staying safe online, keeping all devices up-to-date (ideally through automatic updates), using antivirus software, and not disabling smart screen warnings on file downloads.

Finally, it would be wise to enable phishing-resistant MFA, make sure devices are managed with appropriate controls, turn on email scanning, deploy endpoint and network monitoring, and conduct a search for the IoCs.

Via The Register

• CenterPoint Energy confirmed a cyberattack via exposed API, with customer data stolen
• Threat actor claims 7.49M files including IDs, SSNs, billing data, and transaction records
• Operations unaffected; investigation ongoing, regulators notified, customers to be informed

CenterPoint Energy has confirmed suffering a cyberattack and data theft, days after a criminal advertised the stolen files on an underground hacking forum.

CenterPoint Energy is a large US energy utility company that delivers electricity and natural gas to homes and businesses. It employs roughly 8,800 people and operates around $48.3 billion in assets, as of June 2026.

Recently, a threat actor posted a new thread on a dark web forum, saying they stole 7.49 million CenterPoint files from a poorly secured API, The Register reports. They said that the data included customer names and contact details, billing data, move-in dates, driver’s license information, and the last four digits of Social Security numbers (SSN).

Incurring expenses

No independent investigators have confirmed these claims just yet, and the company said it was investigating the matter. In a new 8-K document filed with the US Securities and Exchange Commission (SEC) on September 14, the company said that it “became aware of an online post by a third party claiming to have obtained a data set containing certain of the company’s customer information.”

It activated its incident response protocols and kicked off an investigation with the help of third-party cybersecurity experts.

“While the investigation remains ongoing, the company has determined that an unauthorized third party obtained personal information relating to a portion of the company’s customers through one of the company’s external facing systems,” the filing reads. “The company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law.” The police and regulatory agencies have been notified.

While the attack did not impact CenterPoint’s operations, which continue as usual, it did incur certain expenses, the company concluded. It stressed that it will likely incur even more expenses as the investigation continues.

Via The Register

• Opswat found two flaws in TP‑Link Tapo C200 cameras: auth bypass (CVE‑2026‑15315) and DoS (CVE‑2026‑15316)
• Bugs let attackers hijack admin sessions or crash devices; millions of users potentially exposed
• TP‑Link patched with firmware V5_1.4.6 on Aug 18, 2026; users urged to update immediately

Security researchers found a pair of vulnerabilities in popular smart cameras, which could allow threat actors to peep into people’s homes and businesses.

Earlier this week, Opswat disclosed finding two bugs in the TP-Link Tapo C200 smart security camera - an authentication bypass flaw, and a denial-of-service vulnerability. The former is tracked as CVE-2026-15315 and was given a severity score of 8.7/10 (high). Opswat says the bug allows unauthenticated attackers to obtain valid admin sessions without having a password, which would allow them to manage the device and even watch the stream.

The latter is tracked as CVE-2026-15316. With a severity score of 7.1/10 (high), this bug allows threat actors to send oversized crypted ciphertext values that may trigger exception handling failures and cause the affected device to crash or restart. “Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers,” according to the NVD.

Patching the bugs

The C200 is a mass-market product, advertised as a security camera, a baby monitor, or a pet camera, with motion detection, 1080p video, 2-way audio, night vision, cloud & SD card storage, and integrations with both Alexa and Google Home.

Opswat disclosed their findings to TP-Link in mid-April this year, which started working on a fix in early July this year. On August 18, 2026, TP-Link released firmware version V5_1.4.6, which addressed both flaws. Users are advised to install the fix as soon as possible.

The researchers did not discuss if the flaws were being abused in the wild, or to what extent. We do know that TP-Link Tapo cameras are rather popular, with the C200 model being relatively widely sold. According to TP-Link, the Tapo app has more than 13 million users, while the Google Play Store shows 10+ million downloads.

On Amazon, the C200 specifically is listed as the #1 top rated product in its category, with more than 3,000 purchases this month alone.

"Camera bugs always get attention because of the "spy factor," but they usually sound cooler and scarier than they actually are," said Dahvid Schloss, OSCP, Chief Operating Officer at Suzu Labs. "The main reason not to "worry" about this one is that running this exploit requires local network access, so a threat actor has to be on your Wi-Fi or already own a device that is.

"If someone's made it that far into your network, they're not after the baby monitor. Now, if the camera was port-forwarded to the internet, that's a bigger design issue and probably should be a concern, but not a common setup for the everyday home user. Either way, I'd still patch the camera, but it's pretty low on the totem pole of what a cybercriminal wants."

"I'm quite curious about the undisclosed vulnerability that reportedly allows full compromise and a foothold to pivot from," Schloss added. "Based on what was reported, I would guess the exploit would be a command injection or a memory-safety bug in the same management service, chained behind that auth bypass to get code execution as root, where they then dropped a static binary to return a shell on the device whose firmware ships with almost no tooling. That attack chain isn't uncommon on cheap, older consumer IoT devices where security wasn't top of mind, but if that's the case here, seeing it hold up on a modern TP-Link device would be a bit of a blast from the past.

• Defiant warned of active exploitation of WooCommerce Wholesale Lead Capture Plugin flaw (CVE‑2026‑27540)
• Critical unauthenticated file‑upload bug lets attackers deploy PHP webshells for site takeover
• Patch released in Feb 2026 (v2.0.3.2); Wordfence blocked 100,000+ attacks, users urged to update and check uploads

A critical vulnerability in a popular WooCommerce plugin is being actively exploited to upload malware and possibly take over entire websites, security experts have warned.

The plugin in question is called Wholesale Lead Capture Plugin for WooCommerce. It adds a dedicated registration and onboarding system for wholesale and B2B customers, letting businesses collect company and other custom information, review applications, assign wholesale user roles, and automate registration and onboarding emails.

It is a premium plugin that costs between $99 and $600 and which, according to the Wordpress store page, has more than 20,000 active installations.

A thousand victims

The plugin was vulnerable to an unauthenticated arbitrary file-upload flaw which, as the name suggests, allows unauthenticated parties to upload arbitrary files, including PHP webshells and executable code that can result in full site takeover. It is tracked as CVE-2026-27540 and carries a severity score of 9.0/10 (critical).

Versions 2.0.3.1 and older were said to be affected. Version 2.0.3.2, released on February 20, was said to have addressed the bug, meaning the patch has been available for almost half a year. However, WordPress security outfit Defiant said its Wordfence web application firewall blocked more than 100,000 attacks, and Wordfence added that it observed two attack spikes - one between June 4 and 17, and another one between July 1 and August 30.

In these incidents, the attackers were mostly uploading reconnaissance webshells, possibly mapping out the landscape before deploying more serious malware.

“The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site,” the researchers said.

If you are running the plugin, it is advised you update it to the newest version as soon as possible, and check upload directories for unexpected, or recently created, PHP files.

Via BleepingComputer

• Elastic Security Labs uncovered REF9334, a Brazilian banking malware campaign active since May 2025
• Malware “Kremlin” deploys fake docs and malicious Chrome/Edge extensions to steal banking data
• 1,515 infections found, 98% in Brazil

Security researchers from Elastic Security Labs have discovered a new Brazilian banking malware campaign that uses browser extensions to compromise users and steal sensitive information.

In an in-depth report published earlier this week, the researchers said the campaign has been active since at least May 2025. Dubbed REF9334, the campaign uses fake banking, invoice, and business documents, to trick victims into installing malware which, in turn, deploys a malicious extension in Chrome and Edge browsers.

The researchers named the malware “Kremlin”, and say it can steal browser credentials, cookies, session information, monitor browser activity, grab screenshots, and steal information from websites that the victims visit. But the goal of the campaign is primarily to target Brazilian bank users.

A thousand victims

The malware really makes an effort to hide and persist in the target environment. For example, it first checks to see if it’s in a sandbox and if so - it simply won’t run. If instead it determines that it’s running on a real user’s computer, it will deploy an extension with the name “AVSync System Inc.” in an attempt to trick the victim into thinking they have an antivirus addon running in the browser.

It also doesn’t use a fixed C2 server, but rather stores the information on the Ethereum blockchain, since it’s a lot harder to disrupt the communication between the operators and the infected machines that way.

During their investigation, Elastic researchers were able to take control of a domain that the malware used and discovered that it had infected 1,515 systems. Almost all of them (98%) were located in Brazil. They were also able to register the network canary domain and point it to their webhost, which resulted in the loader assuming it was in a sandbox. This also meant “the infections have not moved past the initial access”, Elastic explained.

The full list of indicators of compromise can be found on this link.

Via The Hacker News

• China’s state security minister Chen Yixin urged global AI guardrails, calling it a new arms race
• He outlined five risks: ideological manipulation, infrastructure attacks, data leaks, development gaps, and espionage
• US officials likewise warn against losing AI dominance to China, intensifying geopolitical rivalry

China’s Minister of State Security has called for global regulation and guardrails on Artificial Intelligence (AI), as the nascent technology turns into a “new arena for strategic rivalry among major powers”. In other words, the AI race is the new arms race and humanity needs rules before it spirals out of control.

Chen Yixin made the claims in a new article on China Cyberspace, a journal run by internet watchdog body the Cyberspace Administration of China.

In the article, Chen highlighted five key risks of AI development:

1. Ideological security risk
2. Critical information infrastructure risk
3. Data leaks risk
4. Development gap risk
5. Espionage risk

Ideological security risk

Artificial Intelligence could be “leveraged by hostile forces” to create fake news and other harmful information, systematically creating discontent and dividing the population, Chen said.

Discussing risks to critical information infrastructure, he said that as models advance, the barrier to entry lowers, making disruptive cyberattacks quicker and easier to pull off.

“Foreign intelligence agencies are heavily exploiting smart web crawlers, data mining and profiling technologies to harvest sensitive information, including critical state data, business secrets, and personal information,” he said.

He also warned that people are recklessly sharing sensitive data with foreign AI tools, which could result in catastrophic data leaks. Apparently, open source agents like OpenClaw often come with vulnerabilities that could result in remotely-triggered data spills.

When it comes to the development gap risk, Yixin warned that a handful of major players are severing the global AI supply chain and creating a monopoly of closed-source ecosystems. Finally, he urged for the creation of early-warning mechanisms and public advisories which should name and shame foreign nation-state actors using AI for espionage, data theft, and disinformation campaigns.

US vs China

Expectedly, Yixin did not name any specific countries, but it’s easy to read the United States’ name between the lines, the South China Morning Post hints in its report, adding that the US administration recently warned it could not allow China surpassing it on AI development.

Indeed, less than a week ago, US Treasury Secretary Scott Bessent said the country would face dire consequences should it lose the AI race against China. "There is no day after tomorrow if China wins at this," Bessent said at a Breitbart News event in Washington, Bloomberg reported. "If they were to pull away from us on AI, then nothing else would matter."

The US has been at a trade war with China (among other countries) for years now. During Donald Trump’s first term, he blacklisted numerous Chinese hardware manufacturers, warning that Chinese-built 5G infrastructure could be abused to install backdoors and allow the Chinese government to spy on US communications. Huawei, ZTE, and TikTok bore the brunt of these accusations, which the Chinese government vehemently denied.

In his second term, Trump also declared a national emergency and banned all foreign bulk-power systems from being imported, installed, or used in the country. In a signed executive order, Trump said that during his first term, he found “that the bulk-power system could be a target of those seeking to commit malicious acts against the United States, including malicious cyber activities, because of the significant risks that a successful attack would have on our economy, human health and safety, and national defense.”

President Trump also said there were “minimal restrictions” on both acquisition and operation of these foreign-produced systems. As a result, the situation “constitutes an unusual and extraordinary threat … to the national security, foreign policy, and economy of the United States.”

While the AI race is intensifying, developers are calling for a slowdown and better guardrails. Some developers estimated that AI could end humanity in a few decades, urging the industry to slow down and only develop systems they are confident they can control.