• Kaspersky uncovers MacSync, a Mac infostealer delivered via iCloud calendar events and fake apps
• Loader fetches instructions from calendar entries, then deploys malware exfiltrating credentials, wallets, and developer data
• Newer variants add Objective‑C backdoor spoofing Finder, persistence, and expanded targeting of crypto and IT users

Cybercriminals have found a way to use iCloud calendar events and cloud storage to deliver a powerful infostealer to Mac devices.

The malware is called MacSync, and it’s hiding behind fake crypto wallets, or “cracked” commercial software.

Security researchers Kaspersky, who discovered the ongoing campaign, are urging Mac users to exercise caution when downloading programs, especially from third-party websites, and to be very skeptical of apps prompting for their admin password.

Why calendar?

Getting people to download and run malware on their devices is not as easy as it sounds.

The victims need to be somehow tricked into downloading and running an app, and even when they do so, chances are the malicious program will be sniffed out by whatever antivirus solutions the device has running, before it can do any meaningful damage. Also, crooks don’t want to be forced to repeat the process every time they want to deploy a different variant, or type of malware.

So, they resort to all sorts of techniques and workarounds, from DLL sideloading, to malware loaders.

By separating the initial infection and the actual malware, cybercriminals can reduce detection rate and get more flexibility, but it creates a new problem: defenders can monitor the traffic going in and out of different apps and thus detect when a loader is deploying malware.

The challenge then becomes hiding the traffic, and MacSync does it by using the iCloud calendar.

After being downloaded and executed, the loader will reach out to the calendar - which is a totally benign activity that is unlikely to raise any suspicion - and look for a specific public event, pre-built by the attackers. In its description, it will find the instructions, and the location of, the actual infostealer, and deploy it to ultimately compromise the target device. In this case, the location was also in the iCloud.

The loader itself is being advertised through social media, SEO poisoning, and phishing. Victims are directed either to fraudulent websites or social media channels promoting cracked software, or free versions of advanced solutions. In at least one example, Kaspersky saw the loader being advertised as a cryptocurrency wallet. Victims are shown a typical ClickFix error, and told to fix it by pasting a command in the Terminal.

The command deploys the loader which, in turn, installs MacSync.

A "substantial" overhaul

The infostealer emerged in April 2025, and was initially spun out of AMOS, one of the most popular information-stealing variants for the MacOS. It is based on Swift and has, since then, evolved to offer additional capabilities. According to Kaspersky, it can exfiltrate browser history, cookies, saved credentials, cryptocurrency wallet and app data, Telegram data, Keychain data, as well as system and device information. It can exfiltrate SSH, AWS, Kubernetes, Git, and shell configuration files, as well.

Newer variants come with an Objective-C backdoor spoofing the macOS default file manager, Finder. It establishes persistence, terminates notification processes to prevent alerts, and grants the attackers backdoor access, including running AppleScript received from the C2 server, deploying browser extensions, replacing the legitimate Ledger wallet app, collecting additional system information, and more.

Kaspersky also found an undefined command called “live_browser”, which downloads and runs a component named “sn_relay”, whose point has not yet been established.

The new versions “significantly” differ from older ones, Kaspersky said, stressing that the attackers “substantially” overhauled their approach.

“The nature of the data attackers seek to collect from a victim’s device, as well as the categories of applications the stealer disguises itself as, clearly indicates that this malware family primarily targets developers, crypto enthusiasts, and other users associated in some way with IT and the crypto space,” the researchers stressed. “MacSync’s compromise of software developers’ devices poses particular security risks for both end users and corporate systems, opening up expanded opportunities for attackers to further their intrusion.”

The full list of indicators of compromise (IoC) can be found on this link.

• Graz University researchers found decades‑old flaws in file‑notification subsystems across Linux, Windows, macOS, and Android
• Side‑channel attacks can infer keystrokes, visited websites, or even steal credentials via unprivileged access
• Linux shipped partial mitigations (CVE‑2025‑68788); Microsoft and Apple acknowledged but did not patch, demo expected at ACM CCS 2026

Researchers have found a vulnerability in all major operating systems which could, in certain scenarios, allow threat actors to steal login credentials, or track which websites the target is visiting. OS makers, on the other hand, don’t seem all too phased about it.

The bug is described as a side-channel attack - a type of attack in which threat actors simply observe how the system operates and extract valuable secrets through indirect clues. For example, by monitoring how much power the chip takes at any given moment in time, attackers can observe and extract passwords.

It was discovered by security researchers from Austria’s Graz University of Technology: Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast, and Daniel Gruss.

Notifying the system

This particular side-channel vulnerability was found in the file-notification subsystem running in pretty much every OS in existence today. The subsystem is built to notify applications when files on a system change. Not what has changed, just that a change occurred. The bug is allegedly quite old, too.

"We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Register.

On Linux, the subsystem is called inotify and it’s been affected since 2005. On Android it’s FileObserver (affected since 2008), and on Windows - ReadDirectoryChangesW - flawed since the year 2000. On MacOS, it’s called FSEvents, vulnerable since 2007.

In the paper, the researchers claim file event information can help attackers conclude what other users on a computer are doing. They can launch an inter-keystroke-timing attack, inferring what users are inputting (both locally and remotely), reveal which websites they visit, and possibly even steal login credentials through UI redress.

The problem stems from the fact that unprivileged users are allowed to access the file notification subsystem. This primarily relates to files that can be read by multiple users, but apparently, there are quite a few files on a system that fall into that category.

No patch

"On Linux, watching a readable directory leaks events on files inside it you cannot even read: watching /dev/input gives a notification on every keystroke, which we turn into a local inter-keystroke timing attack with a 93.1–100% [keystroke accuracy] score across seven users and a remote (SSH) one at 100%,” Neela said.

The percentage range means the attack won’t work in all cases, which is more-or-less standard with side-channel attacks. They are notoriously difficult to pull off, which is also likely why most OS makers barely flinched at the news.

All of them were notified of the findings roughly a year ago, and most of them never bothered to address it. Linux introduced some mitigations, including CVE-2025-68788, which prevents inotify from generating certain “access” and “modify” events for special files. The fix was shipped to multiple kernels and Linux distros, but it addresses only part of the broader attack techniques that the researchers described.

Microsoft and Apple apparently acknowledged the findings, but apart from that - did very little. Microsoft told the researchers the behavior of ReadDirectoryChangesW was "by-design", although the feature is undocumented. They believe the ability to monitor file paths across users is not a vulnerability worthy of a patch. The report does not mention Apple doing anything about it, either.

• WordPress Core flaw CVE‑2026‑87902 (path traversal, 8.1 severity) enables PHP file inclusion and possible RCE
• Patch released in v7.1.2 and backported to 4.7+; exploitation began within hours, now widespread
• Admins must urgently update; interim mitigations include blocking traversal sequences and disabling risky ARP/PHP settings

Hackers are actively exploiting a high severity vulnerability in WordPress that can lead to full website takeover, researchers are saying. A patch is available, and WordPress users are urged to upgrade immediately or risk losing access to their assets.

Discovered by security researcher Robert Ressl, the vulnerability in question is tracked as CVE-2026-87902. It is an 8.1/10 (high severity) unauthenticated path traversal flaw affecting WordPress Core. According to WordPress itself, as well as the National Vulnerability Database, the bug can lead to local PHP file inclusion and, in certain scenarios, remote code execution (RCE).

"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories," it was said in the official security advisory.

Achieving RCE

WordPress is the world’s number one website hosting and builder platform, powering more than half of all websites active on the internet right now. However, that doesn’t mean all of them are susceptible to RCE. Only websites ticking these boxes are at risk:

Sites with parent or child themes that have a top-level directory with a name starting with ‘page-’ (for example, ‘page-templates).

Threat actors must target a local .PHP file that exists and is readable by the web server

The web server account must be able to read the included file (for example, pearcmd.php, if PHP’s register_argc_argv setting is active)

WordPress said that both the official PHP image for Docker, and the default cPanel configuration, are affected (users must be running a PHP version before 8.5, though).

The issue was fixed in version 7.1.2, which is now available for download. Fixes were also backported to older versions up to 4.7. Releases before 4.8 are not supported, it was said, and will not be getting a fix.

Attacking vulnerable websites

Wordpress security company Patchstack said the first exploitation attempts started roughly five hours after the patch was released, and these were primarily reconnaissance efforts. In the hours to follow, malicious activity increased tenfold, it was said, as crooks started attempting to deliver malicious payloads to vulnerable websites, as well.

“When this post first went up, every request we had seen was reconnaissance against harmless core files,” Patchstack said. “That is no longer true. Attackers are now including pearcmd.php and using it to write PHP files to disk, and public scanning tooling for this CVE is in circulation.”

At first, Patchstack said the attacks were coming from a handful of IP addresses, and advised website admins to simply block them. However, the attacks have now become rather widespread, meaning blocking individual addresses is no longer a viable strategy. They urge everyone to apply the patch without delay:

“The first evening came from a small cluster of addresses. It is now spread across a few hundred, so blocklisting individual sources is not a strategy. The heaviest talkers at the time of writing:

43.250.53.42

180.251.159.243

195.178.110.247

107.189.14.87

45.61.184.170

92.246.130.76

The file write attempts specifically come from a much smaller subset of those addresses, which is the usual pattern of a few operators acting on results that a much larger scanning population produced.”

Those that cannot update immediately should reject traversal sequences in the pagename parameter, Patchstack added. A real page slug never contains one, they added, meaning it can be blocked without affecting normal traffic. Furthermore, disabling register_argc_argv does not fix the inclusion but it does break the pearcmd chain, which is the difference between an information leak and code execution.

Via BleepingComputer

• Gambit researchers uncovered ongoing AI‑driven skimming campaign stealing 600,000+ payment records since July 2026
• Attackers used three autonomous harnesses (Strix, Cairn, Hermes) to compromise dozens of retail sites cheaply
• Victims include major US firms; campaign shows AI enables faster, persistent, low‑cost cyberattacks at scale

In July 2026, a hacker tasked autonomous AI agents to attack retail organizations around the world, deploy credit card skimmers, and steal payment data.

Since then, the bots launched hundreds of attack projects, compromised dozens of organizations, and stole at least 600,000 payment records - and to make matters worse, the campaign is still live, attacking and breaking into websites as we speak.

All of this was reported by security researchers Gambit, who said they managed to recover the operator’s staging server and through it - reconstruct the ongoing campaign. They also saw the skimmers live on victim websites, and sifted through logs and AI claims found on the attacker’s server. In just five days, between September 10 and 15, the agents made 105 attack waves and compromised 27 organizations “to varying degrees.”

Among the victims are a Fortune 500 hospitality company, a “major” US airline, a large private US industrial supplies distributor, and a US online fashion retailer. One of the AI tools would use a website ranking service to produce a list of potential targets, focusing primarily on those running custom-built software.

A fistful of dollars

But the victims are not the “interesting” part of this story - the attackers are. Gambit believes they are financially motivated Chinese threat actors. They are using three AI “harnesses” (frameworks, essentially), which can run almost the entire attack chain autonomously, striking around 10 companies a day, for a handful of dollars per company.

In four weeks, the attackers spent around $7,000, meaning that their entire cost for the operation so far was no more than $18,000. Breaking it down, it means that the attacker spent around $25 per target.

“Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company,” Gambit’s researchers said. “The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.”

“Where access was achieved, it usually took less than a day, and in many cases just a few hours. We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches,” Gambit said.

The three harnesses

The three harnesses are called Strix, Cairn, and Hermes.

Gambit describes Hermes as an open source autonomous AI agent with a persistent memory, skills that the agent wrote and edited itself, a searchable archive of past sessions, scheduled jobs, and a web console. On the staging server the researchers analyzed, it loaded a Chinese system persona called “SOUL - Red Team Operator”, which contained 121 skills (78 attack skills).

“Hermes is the operator’s console for orchestrating the activity and for direct hacking activities,” Gambit explained. “It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access.”

Strix is an open-source AI pentest tool, while Cairn is an autonomous pentest engine. It receives target domains and an objective, such as to get a shell or admin access, then runs for hours until it achieves the objective, times out, or is stopped. Cairn used DeepSeek v4.1 Flash, it was said.

Gambit’s researchers seem to be rather impressed with the campaign. They described it as very low cost, with a level of patience, persistence, and creativity that most human attackers would be “unlikely to sustain”, managing to achieve “far greater results, far faster.”

They have also called to arms, urging organizations to “adapt to a reality where attacks are significantly faster and more comprehensive.” To do that, they must adopt a resilience-first mentality and deploy a security stack that can match the AI on speed.

Many of the affected organizations were notified, and the skimmers were removed, they said.

• OpenAI agent breached Australia’s Medicare portal on June 18, 2026, accessing internal files
• Government says no personal medical data was taken, but three other agencies may be affected
• PM Albanese slammed OpenAI’s 84‑day delay in disclosure, calling the notification “unacceptable” and warning of legal consequences

An OpenAI agent has allegedly broken into a website of the Australian government, which has slammed the “unacceptable” attack, promising an in-depth investigation, and threatening “legal consequences”.

Australian Prime Minister Anthony Albanese revealed how in June 2026, OpenAI’s research team tasked the agent with researching public medicine spending, as part of an internal capability evaluation - but as the agent got to work, it was initially denied access to some of the information it requested.

However, instead of stopping, or trying to find a different lawful way of obtaining this data, it circumvented those restrictions and landed inside the infrastructure behind Services Australia’s public-facing Medicare Statistics Reporting Service portal.

AI agent did what?

The public details are still quite limited, and we don’t know the technicalities of what the AI actually did.

The acting prime minister, Richard Marles, told the media during a recent press conference that the AI “scaled the fence”, despite the portal having security measures in place.

The bot apparently accessed internal infrastructure and wrote files to an internal server but exactly what it wrote, how it obtained the access, and precisely which technical mechanism it used, is still not public knowledge.

Once inside, it accessed both public and non-public files, but individual medical data was not accessed and the system itself was not compromised, the Australian government said.

There is also the possibility that three other government systems were affected - the Australian Institute of Health and Welfare and two state-based agencies - the New South Wales Bureau of Crime Statistics and Research and the Victorian Department of Health. However, this has not been confirmed yet.

"No personal information is believed to have been accessed at this stage, but investigations are ongoing," Albanese said. "Nonetheless this situation is obviously unacceptable."

OpenAI's sluggish escalation

Albanese was particularly unsatisfied with how OpenAI handled the situation. The breach happened on June 18, but it took the company 84 days to notify the Australian government of the incident. And when it did - it did so in a manner better suited for an amateurish start-up rather than one of the most important organizations on the planet right now.

OpenAI was apparently evaluating its models, and investigating “misaligned model activity” when, on August 11, it discovered the breach in Australia. It seems the AI agent simply did not take “no” for an answer. The company then notified Services Australia on September 10 - almost three months after the incident. To make matters worse, the company reached out via publicdisclosures@servicesaustralia.gov.au, inbox researchers usually use to report potential vulnerabilities, instead of trying to escalate the incident higher.

Services Australia reviewed the information and notified the Australian Signals Directorate on September 15.

When the news reached prime minister Anthony Albanese, he spoke to OpenAI CEO, Sam Altman, and expressed the country’s “extreme concern” about this incident, as well as his “disappointment that it took the company way too long to inform the government what had occurred.” He also pointed out the way OpenAI reached out: “The notification was an email sent just to the public mailbox.” Albanese described the “nature of the notification” as “unacceptable.”

The Australian government is now looking into the matter to see if any laws were broken and what legal consequences, if any, could follow.

"And obviously we will investigate all of that. What the consequences are, if there has been a breach of the law, but also part of the task force is to assess whether or not the legal regime we have in place is fit–for–purpose in a world where we have an emerging AI capability,” Marles said.

Via BBC

• $1.6 billion has been claimed by scammers impersonating police and government officials
• The FBI’s Internet Crime Complaint Center (IC3) received almost 61,000 complaints concerning such scams between January 2025 and July 2026
• Some scams targeted foreign nationals and immigrants, threatening to cancel passports or impose extradition, unless payment is made

Between January 2025 and July 2026, the FBI’s Internet Crime Complaint Center received almost 61,000 complaints concerning scams using police and government official impersonation tactics. As a result, around $1.6 billion is believed to have been scammed and extorted.

Tactics used by scammers included unsolicited phone calls and in some cases video calls, with victims losing an average of $26,000 per scam.

Particularly concerning is the targeting of foreign nationals, international students, and immigrant citizens, often with threats to cancel visas and home country passports. Incredibly, 10% of all losses were traced to a single scam, one that targeted fewer than 3% of the victims.

Foreign national victims

According to the FBI, the fake cop/fake government official scam has various angles, from alleging missed jury duty to threatening arrest due to circumstantial links to an alleged crime.

The demand from the scammers, inevitably, is payment.

Making a commitment to extreme lengths of scamming and extortion, the criminals took things to a new level when it came to targeting victims. International students, visiting foreign nationals, and other immigrant citizens were given special treatment. Not only were they threatened with extradition, there was also the implication of victims losing their home country passport.

To convince the target, scammers built actual studio sets, donned uniforms or suits, and appeared in video calls to the victims, who were convinced they were talking to foreign law enforcement agents or US-based diplomats. Creating the illusion of officialdom to sell the scam, victims paid whatever necessary to stay in their adopted country.

How to spot the scam

It is important to note that not all fraud of this type takes place in the US. These may be online or offline, but the so-called fake cop scam is an international criminal phenomenon. So, how do you avoid it?

We’ll assume you’ve answered a call inadvertently rather than having spam calls blocked (that should be set already).

First, remain calm. These situations are designed to impose stress and heightened anxiety. Scammers rely on these factors to cloud their victim’s judgement and force the narrative they are selling (“you missed jury duty”/“your presence in the country is illegal.”)

Second, it is vital to request credentials. Failure to provide these is the first red flag that the person communicating with you is not what they seem. That’s your cue to end the conversation.

Third, check the credentials. It doesn’t matter how long this takes – a legitimate caller will not mind waiting for you to do the necessary background check, even if it means them calling back.

Finally, and most importantly: neither law enforcement, security services, nor the FBI will demand money. If that is happening, it’s time to end the call.

• Cybersecurity company OPSWAT found a login bypass and a crash bug in TP-Link's Tapo C200 cameras
• TP-Link has extended that to include its C120 offering too
• Anyone on the same network could get admin access, live video, and recordings without requiring the owner's credentials

Security researchers at OPSWAT have detailed two high-severity flaws in TP-Link's Tapo C200, a pan-and-tilt indoor camera listed on Amazon for $26.99 and sold as a baby monitor and pet camera.

The more serious issue is that someone on the same network can log in as the camera's administrator without the password, accessing the live feed and stored recordings.

At least one other bug, which OPSWAT rates as critical in the same disclosure but does not detail, has not been published.

A localized login that requires no authentication

The TP-Link Tapo C200, as we noted in previous coverage of the incident, isn't just another security camera that happens to be vulnerable; it is one of the most popular models on the market, clocking in at over 3,000 sales on Amazon alone.

The Tapo C120, in its current iteration, sells over 5,000 units monthly, even as the advisory notes that its V1 hardware version is currently compromised until users update the firmware on their devices.

Both SKUs have received firmware updates that patch the vulnerabilities (CVE-2026-15315 & CVE-2026-15316), which are assigned 'high' scores of 8.7 and 7.1, respectively. However, according to TP-Link, CVE-2026-15316 does not affect the C120 camera.

However, the former vulnerability is the more pressing of the two and, according to OPSWAT, is particularly problematic for users because of how the C120 and C200 cameras function.

Both run a local management interface over HTTPS and use a challenge-response login designed to prove a client knows the owner's password. Khoi Tran, a graduate fellow at OPSWAT, and his mentor, Thai Do of the company's Unit 515 team, found a second verification path in which, under certain conditions, a value the camera hands out during login can be sent back and accepted as a valid authentication response.

The result is an administrator session after a small number of requests, with no password, no existing session, and no requirements for the new 'owner'. As a result, access includes live video, stored footage, and configuration changes.

OPSWAT's researchers pointed out that a C200 used as a baby monitor would expose "live video, night vision, crying detection and two-way audio."

The second flaw, CVE-2026-15316, affects only the C200 and sits in its Wi-Fi onboarding code. Sending the camera an oversized chunk of encrypted Wi-Fi credential data can crash its HTTPS service or restart the device outright, cutting the owner off from management and monitoring until it recovers.

The attacks are somewhat limited in scope: users aiming to exploit such vulnerabilities would need to be on the same Wi-Fi network, or within a certain trusted ecosystem, to begin with.

For now, users upgrading to TP-Link's newest firmware, issued for both models, rectifies both issues, but there might already be another security patch in the works: OPSWAT also found "a critical vulnerability that could allow an attacker to fully compromise the camera," which could then serve as a foothold inside the network.

It is currently holding off on publishing any details about the vulnerability as it waits for TP-Link to issue a patch that rectifies the situation. Neither OPSWAT nor TP-Link, however, has provided a timeline for when the patch will be available to end users.

• Microsoft, UK police, and partners disrupted EvilTokens PhaaS, arresting two suspects and seizing 200+ domains/sites
• EvilTokens used AI to scale device‑code phishing, compromising 12,000 inboxes across 10,000 organizations globally
• Platform ran like a startup with subscriptions, dashboards, and AI‑driven targeting; US victims hit hardest

Two people have been arrested, 50 websites were seized, and 150 domains disabled, in a joint operation against the infamous EvilTokens phishing-as-a-service (PhaaS) kit.

In its report, Microsoft said the UK Metropolitan Police Service’s cybercrime team “arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.”

The two men, whose identities were not disclosed, are aged 32 and 38, and have been released on bail, subject to conditions while the investigation continues. Their digital services and other items have been confiscated, as well.

Among the partners are Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs. We don’t know if these arrests and takedowns will be enough to completely obliterate EvilTokens, or if the platform will continue to operate. Usually, criminal infrastructure is a lot less resilient to disruptions when arrests are made, compared to when law enforcement simply disables the hardware.

The tech startup of organized crime

EvilTokens has been turning heads for a little while now. The platform was first spotted in February 2026, rising quickly to become one of the most widely used PhaaS solutions out there.

It can be bought through Telegram for $1,500, after which there is a recurring $500 subscription cost. Cybercriminals use it to run large-scale, personalized phishing attacks: they can create spoofed websites, landing pages, and other credential-capture assets; they can create custom-tailored phishing emails, and can even grab session tokens, one-time passwords, and other codes designed to protect accounts against phishing, granting attackers access to people’s inboxes.

But what makes EvilTokens particularly impressive is its use of artificial intelligence. The platform comes with an AI assistant that can sift through the inboxes, suggest which targets are of high value, and even how to approach them. Attackers can conduct Microsoft Graph reconnaissance as well, mapping out organizational structure and permissions, keeping access and moving laterally throughout the target network.

Microsoft said it found evidence of large portions of EvilTokens being vibe coded, “with AI helping its creators build the platform itself.”

The researchers also found the platform drawing on capabilities from multiple AI models. Looking at the platform as a whole, it runs like a well-organized startup, with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.

According to Microsoft, EvilTokens facilitated business email compromise (BEC) campaigns that compromised more than 12,000 inboxes in more than 10,000 organizations worldwide. Victims are mostly in wholesale distribution, construction, and financial services, but those in real estate, higher education, and healthcare are not spared, either.

The victims are primarily located in the United States, with notable numbers found in Canada, the United Kingdom, Australia, India, and France. Microsoft said affected customers were notified, and that the company “helped remediate compromised accounts and shared intelligence to support further defensive and investigative action."

Popularizing device-code phishing

Device-code phishing as an attack technique is not that new. More than a year ago, in February 2025, security researchers Huntress reported on Russian threat actors Storm-2372 deploying the same technique, and while it’s been steadily growing in popularity, it wasn’t until EvilTokens’ appearance that it really exploded.

The same researchers said, in June 2026, that EvilTokens was used to run 1,380% more device-code phishing attacks in 2026, compared to the same period last year.

“We’re seeing a clear maturation of the phishing-as-a-service (PhaaS) market as threat actors increasingly integrate AI workflows into their product offerings,” Huntress said in a report.

“The result is directly observable in our telemetry: a 1,380% increase in device code phishing attacks detected between July–December 2025 and January–April 2026, with over 50% of those incidents linked to two major waves of correlated incidents.”

• Burger King Russia’s 2024 breach via Mindbox exposed 3.2 million customer records, now leaked online
• Data includes emails, names, genders, birth dates, phone numbers, and geolocations (2018–2024)
• Payment details weren’t compromised; users warned of phishing and identity theft risks

Back in 2024, the Russian arm of Burger King suffered a data breach at the hands of unknown threat actors - now, that data has finally been leaked online.

In October 2024, Burger King told TASS, Russia’s national news agency, that unidentified hackers attacked Mindbox, a domestic marketing automation platform the company had been using.

Through Mindbox, the crooks managed to obtain sensitive company data, including information belonging to the customers.

As a customer data and marketing automation platform, Mindbox helps businesses gather and use customer information for personalized, omnichannel marketing campaigns. Its tools cover email and SMS campaigns, push notifications, loyalty programs, chatbots, and more. According to the company, more than 1,100 businesses use its platform, including L’Oréal, Panasonic, KFC, JBL and United Colors of Benetton.

One victim in a supply-chain attack

At the time, there was no word on the nature of the information that was taken, apart from the fact that payment information was not compromised.

"Among the victims of the attack may also be the data of customers of the Burger King restaurant chain," the company said at the time.

“Burger King confirms that among the personal data, the accuracy of which is being clarified, there is no information about payment details: open information about transactions is not transmitted or stored by third parties.”

The details about the hack were also not disclosed. We don’t know if the platform contained a zero-day, or if a company employee had their login credentials or session tokens exposed. Third-party supply chain attacks such as this one are common and often rather disruptive, affecting numerous companies using the same tools. For Mindbox, however, there have been no reports of additional victims.

In its 2024 results announcement, Mindbox said the attack was its “first serious information security incident”, which was quickly detected and contained “thanks to threat detection tools.”

In the aftermath of the breach, Mindbox said it “found and eliminated points where employees without access rights to sensitive data could indirectly obtain them,” hinting that the attack was, in fact, an identity-based attack rather than a zero-day exploit.

The company also “changed development processes to find such points before they get into the product,” and reformed Mindbox's internal role system to make permissions stricter and more granular. It also limited project access scenarios, introduced a mechanism for confirming access by another employee, and introduced mandatory two-factor authentication, among other things.

Have you been pwned?

Today, more details were released on Have I Been Pwned?, a website that aggregates information stolen in various hacks and helps people learn if their email addresses and other information had been compromised in the past. According to the newest entry, more than three million people have had their data exposed in this incident:

“The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024,” Have I Been Pwned? writes. “Burger King Russia acknowledged the incident and advised it did not include payment or passport details.”

The latest findings seem to be somewhat in line with what the media reported at the time. According to The Register, initial reports claimed around 5.6 million lines of data as exposed, which included information about a customer’s favorite dish and previous order dates. While this information was not mentioned in the newest report, if every data line includes one email, one name, or one phone number, it could amount to around 5.6 million.

While the information might be a few years old, things like names and birth dates, and genders rarely change, but are vital in identity theft, social engineering, and similar attacks. Burger King users, especially those in Russia, should be wary of incoming email messages, particularly those claiming to come from the fast food chain.

• ShinyHunters defaces FBI’s jobs site, claiming a PeopleSoft zero‑day let them steal 2TB of HR data
• Group says attack is not for ransom but to dispute FBI’s May PSA alleging harassment and swatting tactics
• Experts warn exploit itself is highly valuable; FBI site reclaimed, investigation ongoing into breach claims

The ShinyHunters extortion group is currently doing brand management in the most ShinyHunters way possible - by hacking into the FBI and stealing the agency’s sensitive files.

The Bureau’s jobs site was defaced and replaced with the usual ShinyHunters content - an ASCII image of the group’s logo, and a message saying “This site has been seized by ShinyHunters. Rooting your systems since ‘19 :)”.

But instead of putting the FBI on its data leak site and threatening to release stolen files if a ransom isn’t paid, ShinyHunters started speaking to the press, telling The Register it found a zero-day vulnerability in the Oracle PeopleSoft human resource management system, which allowed them to remotely execute arbitrary code on the underlying server.

They used this ability to (allegedly) steal more than 2TB of sensitive data from the FBI’s servers, including names, addresses, phone numbers, and information on spouses for current, former, and prospective FBI employees.

“We hold data on all FBI employees and applicants,” the spokesperson told The Register, noting they had compromised human resources, MedLink, and Criminal Justice Information Services.

Brand management

The FBI has yet to comment, and so do both Oracle and AWS, but what’s most peculiar about this incident is that it doesn’t seem to be financially motivated.

So far, everything ShinyHunters’ have been doing was for the money. They would break into a company, steal their files, and then pressure the victims into paying a ransom demand in exchange for deleting the stolen information. This time around, the group claims the goal of the attack is to force the FBI to change the record on how it operates.

“This is NOT financially motivated,” the group told The Register. “We want the FBI to correct or retract their statements they made, which included substantial false allegations.”

The statements were made in a security bulletin published on May 15 this year, right after the Canvas attack. In early May 2026 Instructure, the edtech giant behind the popular Canvas learning system, confirmed suffering a cyberattack and losing sensitive customer data. It was later disclosed that some of the world’s top universities, including Harvard, Oxford, and MIT, were among the victims.

The attack was so disruptive that Instructure’s CEO was called to testify in front of the US House Committee on Homeland Security a few weeks later.

On May 15, the FBI issued a public service announcement (PSA) saying ShinyHunters “commonly use harassment strategies” to exert pressure on victims, including “sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting.”

Swatting means calling the police to report criminal activity so severe that the SWAT team is sent. This is usually done to live streamers as a practical, albeit life-threatening, joke.

“Threat actors may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist. Following these pressure tactics, SH actors have sometimes posted exfiltrated data to various iterations of the SH data leak site on the Tor network,” the PSA concluded.

“I have been doing my very best to combat these allegations,” ShinyHunters told the media. “And this is the best way to do it.”

No money?

Not everyone is sold on the idea that ShinyHunters isn’t doing this for the money.

In a statement shared with TechRadar Pro, CTO of Suzu Labs, Denis Calderone, said the claims should be taken with a grain of salt: “I have a hard time believing terabytes of FBI personnel data just sit on a shelf. Foreign intelligence services would love to have it, and having the FBI on their resume makes every future extortion demand more believable, and if the PeopleSoft zero-day is real, the exploit may be worth more than the data. Meanwhile, agents and their spouses could have their home addresses posted publicly within a week if this threat is followed through.”

Calderone also stressed that instead of focusing on the incident, people should be paying more attention to the zero-day.

“If you run PeopleSoft, don't wait for a patch. Get it off the public internet wherever you can, put what has to stay public behind a WAF, and make sure admin components like the /PSEMHUB/ path in their screenshot aren't reachable from outside. Hunt for the June indicators and for SSH attempts against the psoft and oracle accounts. Then ask yourself what your applicant portal can reach. At the FBI, a website built for strangers to upload resumes allegedly led straight into GovCloud.”

The FBI has since reclaimed its website, which now says it is under maintenance.

• ESET finds nearly half (49%) of UK SMBs have experienced an incident in the past year
• Phishing, unpatched vulnerabilities, weak passwords, and a lack of monitoring often to blame
• AI-powered tools will prove a much bigger challenge for SMBs

British small businesses are being hit by more cyberattacks than ever before, and the increasing use of AI technology by hackers could put more of them at risk, experts have warned.

ESET’s 2026 SMB Cyber Risk Report found that nearly half (49%) of UK SMBs have experienced an incident in the past year, with 13% of those experiencing more than one incident.

Many of the 500 UK SMBs surveyed expressed fears that the situation is only going to get worse, as criminals employ new AI-assisted tools to launch more powerful attacks.

SMBs at risk

The top security concern for SMBs was AI-powered malware, with the most common causes of attack found to be phishing, unpatched vulnerabilities, weak passwords, and a lack of monitoring.

Security should be an important consideration for businesses of all sizes, but with so many plates to spin, can go neglected in some SMBs.

This isn't the only challenge they face, as the report also flagged issues such as a struggle to keep up with the latest cybersecurity threats, staying the pace with new technologies like AI, vulnerability and patch management, and a lack of skills in the workforce.

The findings are especially concerning as SMBs make up more than half of UK turnover in the UK private sector - around £2.8 trillion, and so are often popular targets for hackers.

It isn't all bad news though, as in order to help resolve security challenges, over half (55%) of UK SMBs said they expect to increase cybersecurity budgets over the next 12 months, with top investment priorities including employee training and awareness and cloud security.

“It’s true that AI will help cybercriminals to speed up their attacks against UK businesses. But the core tactics used like phishing or exploiting software vulnerabilities will largely stay the same,” explains Jake Moore, Global Cybersecurity Advisor at ESET.

“Until organisations can improve their security by locking down the basics, smaller businesses will be easy pickings for cybercriminals looking to steal sensitive data and turn a profit.”

• Seller claims to be offering Mistral AI's full source code and says the company was breached again after May 2026 attack
• Mistral says an investigation found no evidence of new unauthorized access but has not stated whether the listed code is genuine
• No customer data has surfaced in analyzed samples, and nobody has shown files created after the May incident

A seller on a cybercrime forum says French giant Mistral AI has been hacked again and is offering what they call the company's full source code for sale.

The September 16 2026 post by an account using the handle "mrwho" consists of a listing titled "Selling mistral.ai Source Code" on an English-language cybercrime forum, according to The CyberSec Guru, pricing the material in Monero only before it attempted to steer potential buyers to Session or Telegram.

Mistral AI's own team has refuted this, stating it has "found no evidence to support this claim."

Not Mistral's first hacking-centric PR problem

Mistral's earlier hacking incident is undisputed - in May 2026, the Mini Shai-Hulud supply chain campaign, attributed to the TeamPCP group, spread from compromised TanStack packages to hundreds of npm and PyPI projects.

Mistral's own security advisory MAI-2026-002 says an automated worm led to compromised versions of its SDKs being published for a few hours on May 11 and 12, and that an affected developer device was involved. Microsoft Threat Intelligence found that a poisoned Mistral AI Python package fetched a second-stage credential stealer that allowed the attack to exploit users.

Mistral went further in statements to reporters than in its advisory. It told BleepingComputer that attackers had compromised a codebase management system and "contaminated some of our SDK packages for a brief period," while insisting that hosted services, managed user data, and research and testing environments were untouched. It also told HackRead that only certain non-core repositories were accessed.

TeamPCP, meanwhile, advertised roughly 450 repositories, about 5GB in total, for $25,000, and threatened to dump them for free if no buyer appeared within a week. One can therefore contend that this could be the same dump being remarketed by a different account, and the seller's profile is already suspect.

The CyberSec Guru noted that the account joined in September 2026 and had four posts and a reputation score of 30, despite displaying a top-tier "GOD User" rank. That profile could fit a scam in the making, but as the outlet pointed out, it could also fit a broker fronting for someone else or a freshly minted alias.

HackRead published 24 sample repository names from TeamPCP's May post. FrenchBreaches, which examined the 339-file tree mrwho shared in September, lists several of the same names. At least four of these appear in both: mistral-inference-private, mistral-inference-internal, mistral-finetune-internal, and mistral-common-internal.

This makes it hard to tell whether the purported 'hack' is just a rehash of an existing dump from Mistral's previous breach or a second successful hacking attempt. There is a straightforward test, however: If the September archives contain commits, files, or credentials dated after May 12, or secrets that were still valid after Mistral's cleanup, the seller's claim of a second breach gains real weight. If everything predates the May incident, this is a resale, which is embarrassing for Mistral but not a new security failure.

Of course, locating the archives or examining them would involve paying the ransom in crypto, as required by what could potentially be a scam in the making- a tremendous leap of faith for an account that was created earlier this month, making this essentially a lottery ticket at best for any security researcher attempting to take a closer look.

• More workers are worried about security issues than they were this time last year
• Three in four say their recovery tools are too difficult for them to use
• This report says having strong data storage could help

While many of us typically see security as an IT or a leadership issue, it's actually impacting us more than we'd initially thought. New Object First data found that 91% of workers feel uncomfortably stressed at work because of IT security risks – a seven percentage point increase over last year.

But unfortunately, it's a double-edged sword because it all boils down to AI. Nine in 10 say AI tools have improved their productivity, but seven in 10 say the growth of AI-powered threats is a key driver behind their stress.

Additionally, fewer than one-quarter (24%) believe their organisation is suitably equipped to deal with those threats.

AI-driven security threats are actually impacting you and I

While the risk of cyberattacks (50%) is a leading cause for stress at work, high workloads and understaffing (50%) land in joint-first place. Gaps in backup and recovery effectiveness (41%) and pressure to maintain uptime (44%) are also big headaches for workers, implying pressure isn't coming from direct attacks alone, but workload and operations.

For example, three in four (74%) say that their recovery tools are difficult to use without security expertise, leaving regular knowledge workers at a loss. One in five (19%) even say they feel hopeless and overwhelmed during and after an incident.

Naturally, this stress is impacting productivity, with four in five (78%) remarking that stress negatively affected their job performance. Two in five (39%) even said they'd thought about quitting.

"As critical as technology is to cyber resilience, those responsible for protecting and recovering an organization’s data are just as essential," company CEO David Bennett concluded.

• Attackers spoofed LastPass Authenticator via SEO‑poisoned GitHub pages, delivering malicious ZIP files
• Malware Rapuncel uses DLL sideloading, kills 145 AV products, and steals passwords, wallets, and tokens
• Campaign ongoing for months; LastPass vaults unaffected, but users urged to download only from trusted sources

Be careful when downloading the LastPass Authenticator app - there are impostors out there that can disable your antivirus and wreak havoc on your computer.

LastPass recently discovered an elaborate scheme to get people infected with malware - a spoofed website, SEO poisoning, DLL sideloading, and a malware loader delivering never-before-seen payload that can kill endpoint protection and antivirus solutions.

According to the password manager, users searching for "LastPass Authenticator download" or similar keywords will get a GitHub page rather high on the search engine results pages. At a glance, the page looks almost identical to the authentic LastPass offering - however, it redirects users to a separate one, hosted on attacker-controlled infrastructure and delivering a large .ZIP file with multiple files.

Among the files are two worth paying attention to: vsdbg.exe, and vsdbg.dll. The .EXE one is renamed to look like a LastPass installer, but it’s in fact a legitimate Microsoft debugging tool. This tool is used to run the malware - the vsdbg.dll file. This is a method called “dll sideloading” where the legitimate program will look for a DLL file in the same folder it’s located, rather than the wider device library. Since the DLL is delivered together with the executable, it is the first one to be run, despite the fact that it’s malicious.

Rapuncel

LastPass shared the malware with security researchers Delphos for analysis, and they’ve named it Rapuncel. No AV engines have been able to spot it, when it was first analyzed.

Once Rapuncel runs, it does a number of things. First, it gains admin-level access to run as SYSTEM, and then installs a kernel driver. The driver, disguised as an NVIDIA graphics component, comes with a hardcoded list of 145 antivirus and endpoint security products, and if any of them are found on the device, they are instantly terminated.

After killing antivirus solutions, the malware gets to work, stealing saved passwords from more than 25 browsers (Chrome, Edge, and other popular ones included), cryptocurrency wallet files from more than 30 wallet apps, Discord login tokens, Steam session tokens, Telegram session data, Windows credential store, all documents with words like “password”, “seed”, “wallet”, or “recovery” in their name, screenshots of every monitor connected to the device, as well as a detailed profile of the system.

Once all of this is harvested, the information is compressed into a .ZIP archive and uploaded to a server under the attackers’ control. To add insult to injury, the kernel driver was given code to intercept all web traffic, allowing the attackers to inject ads, or modify search results, at a whim.

Rapuncel comes with a persistence mechanism, as well, to make sure it continues operating even if the victim spots it. Spotting it should not be too difficult, though - if no antivirus programs are allowed to run on a computer, something is definitely not working properly.

Active for months

Still, the malware installs itself as a Windows service that starts automatically at boot, and then loops continuously, checking for security products and killing them as soon as they’re activated. “The machine may remain fully under the attacker's control until the kernel driver is physically removed,” the researchers explained. “This process requires booting the computer into Safe Mode or using an external recovery tool, because normal Windows tools cannot safely remove software operating at that level while the system is running.”

LastPass and Delphos believe the campaign has been active for months, and that it will continue to operate despite disruption efforts:

“The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned,” the researchers said. They stressed that this is “opportunistic brand impersonation” and that LastPass systems and customer vaults have not been compromised or involved in any way.

LastPass said it was one of 40 companies spoofed in this campaign and has urged users to only download apps from reputable, vetted sources.

• Researcher Patrick Wardle finds zero‑day in Meta’s new Muse AI assistant,
• Dubbed not‑a‑mused, the exploit requires local compromise, voice dictation, and app integrations; attackers can hijack tokens and exfiltrate data
• Meta has been informed but no patch yet; flaw highlights risks of AI assistants with broad permissions

Meta’s new Artificial Intelligence (AI) assistant Muse reportedly carried a zero-day vulnerability that allowed attackers to gain access to people’s apps, such as WhatsApp or email.

However, it’s not as straightforward as your usual zero-day - to exploit it, simply deploying malware will not suffice. Certain features need to be enabled, and certain integrations established before the bug could be leveraged.

Not-a-mused

A little background, for context: Meta recently released Muse, describing it as an assistant that can “book appointments, fill out forms, and handle customer service.” It says the tool, available exclusively for the Mac ecosystem for now, “proactively takes tasks off your plate” and makes purchases, generates images, and creates documents.

To do that, however, it needs to connect to apps such as email, WhatsApp, calendar, or social media accounts - and this connection is the first prerequisite needed to exploit the flaw.

The second prerequisite is voice dictation. The vulnerability was found in the way Muse handles commands received via voice, meaning the attacker must piggyback onto voice commands in order to escalate privileges and access other apps and their content.

Now for the flaw itself. It was discovered by security researcher Patrick Wardle, founder of nonprofit Objective-See. He named it “not-a-mused” and says it hides in an undocumented setting called endo_voyager_dictation_endpoint. When a user narrates a voice command, that instruction is sent and processed in the cloud, where Meta can log it. This setting allows the user to change which endpoint receives the dictation.

Which brings us to the third prerequisite. The threat actor must have local access to be able to change this setting in the first place. In other words, the device must already be compromised in some way, either via remote monitoring and management tools, or via low-level malware (or with physical access).

For the sake of the report, let’s say that a theoretical user checks all the right boxes - they’re running a compromised machine and are talking to Muse that’s already connected to other productivity apps. Instead of reaching Meta’s endpoints, the voice commands are first sent to attacker-controlled infrastructure, where the AI assistant, together with the instructions, also sends authentication tokens for the tool.

If the attacker reacts fast enough, they can grab the token and access their target’s AI tool. If it’s connected to other apps, such as WhatsApp or calendar, they can simply prompt it to extract whatever sensitive information is found inside.

Not-a-mused is therefore a combination of data exfiltration and privilege escalation.

Ironing out the kinks

“We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle told Ars Technica.

“So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.” Wardle said he has developed several proof-of-concept attacks that do things like writing malicious files to disk and snapping pictures, in many cases with no indication to even an alert user.

Meta has been informed, but is yet to comment, or issue a patch.

AI assistants are all the rage nowadays. They’ve turned elaborate answer machines into tools that can complete assignments, even more complex ones. They can book flights and restaurant tables, make purchases, schedule and reschedule calls and meetings, and more. However, to do that, these tools need extensive permissions - something the security community is warning of.

While they’re not openly speaking against it, they are advising caution. There are many stories of AI agents either going rogue, or simply being tricked by malicious actors. For example, a hidden prompt in a phishing email can trick an AI agent tasked with summarizing the message into exfiltrating all .PDF documents from the victim’s inbox.

In the early days of agentic AI, there were reports of assistants simply deleting people’s inboxes.

Assistants are likely here to stay, but there are still quite a few kinks to iron before they can hit the mainstream.

• BigCommerce confirms supply‑chain breach via compromised Ribon app credentials affecting merchant storefronts
• Master of Malt notified customers: names, emails, phone numbers, and addresses were exposed
• Attack ran Sept 13–17 2026; ICO notified, law firm warns of phishing risks for affected retailers

Ecommerce platform BigCommerce was recently hit with a cyberattack in which it lost sensitive data belonging to some of its users.

One of the users - online spirits retailer Master of Malt - confirmed the hit and notified its customers that their personally identifiable information (PII) was accessed in the attack.

BigCommerce is an ecommerce platform relatively similar to Shopify. Businesses use it to build and operate online stores without needing to develop the entire commerce infrastructure themselves. It offers features like storefronts, shopping carts, integrations with different payment providers, product inventories, SEO and marketing tools, and more.

The platform has been around since 2009 and according to a late 2024 SEC filing, serves 5,884 accounts with at least one unique enterprise plan subscription. A 2025 press release says BigCommerce is used by “tens of thousands of B2C and B2B companies across 150 countries.”

Software supply chain attack

BigCommerce allows its users to install, among others, a third-party app called Ribon, an ecommerce app providing tools that improve the online shopping experience. Some merchants integrate Ribon into their stores to add different functionality to the customer-facing storefront, and to optimize how visitors interact with different elements of their website. We don’t know exactly how many stores use Ribon.

According to Master of Malt, unidentified threat actors managed to compromise a BigCommerce Application key held by Ribon, and used it to access customer data that was held on their system. The attack took place on Sunday, September 13 2026, until the access was finally revoked four days later, on September 17.

Speaking to BleepingComputer, BigCommerce said credentials for Ribon and Ribon 1.5 were compromised:

"On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts,” the statement reads. "Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," the company told the publication.

The keyword in this statement is “small number of merchant storefronts.” BigCommerce hints that the attack was relatively small in scope and, consequently, in damage. However, in its report Master of Malt says otherwise:

“It’s now clear that we weren’t the target of the attack. The attack was against Ribon, which was installed on hundreds of BigCommerce stores. Once the attackers compromised an access key from Ribon, they used it to access data held inside BigCommerce.”

Names and emails

Whether or not this transforms into a new Snowflake fiasco remains to be seen.

In the meantime, Master of Malt also said BigCommerce notified it that the attack had been stopped and that there was no further risk of compromise. All companies affected by the breach were contacted. As for the spirits retailer, here is what it said about the data exposed in the hit:

“I’m sorry to say that the attackers had access to your name, email address, phone number, and address. However, they were not able to access your password, credit card or other payment information as they are held in a separate system which was never compromised.”

Master of Malt reported the attack to the UK Information Commissioner’s Office (ICO). Law firm Emery Reddy is calling for potential claimants to the incidents, saying that “several retailers” are currently notifying customers about data exposure related to the incident, BleepingComputer reported.

“A number of online retailers that use the BigCommerce e-commerce platform have begun notifying customers of a data breach that originated not with the retailers themselves, but with a third-party application called Ribon,” the law firm says. Emery Reddy also warned of potential phishing and scam attacks.

• CISA added three Linux kernel flaws (CVE‑2025‑39682, CVE‑2026‑53266, CVE‑2025‑39964) to KEV catalog
• Red Hat confirmed active exploitation; agencies given rare three‑day patch deadline expiring Sept 21, 2026
• Bugs enable DoS, privilege escalation, or data corruption; patches available, limited mitigations for two flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux flaws to its Known Exploited Vulnerabilities (KEV) catalog, signaling abuse in the wild and giving government agencies a deadline to patch or stop using the flawed product entirely.

The three bugs in question are tracked as CVE-2025-39682 (severity score 9.8/10 - critical), CVE-2026-53266 (severity score 8.8/10 - high), and CVE-2025-39964 (severity score 7.8/10 - high). All three have already been patched in the Linux kernel. CVE-2025-39682 was fixed in stable releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4, while CVE-2025-39964 was fixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9. CVE-2026-53266 has been fixed upstream and backported to supported stable/distribution kernel branches, including 5.10.259, 6.1.176 and 6.12.94.

The first issue is an improper check for unusual or exceptional conditions vulnerability in the TLS receive patch which could allow unauthenticated threat actors to launch memory disclosure or denial-of-service (DoS) attacks. The second one (CVE-2026-53266) is an out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite patch which allows local attackers to escalate privileges or mount DoS attacks.

The last one (CVE-2025-39964) is a race condition flaw that allows concurrent writes to the same AF_ALG socket, which allows local malicious actors to crash the system or corrupt cryptographic operation results, leading to data integrity issues and possible DoS states.

Attacks in the wild

Red Hat acknowledged that all three are being abused in real-life attacks. “This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority,” it said in all three advisories.

However, there are no details as to who is currently using these exploits, against whom, and to what cause. There are currently no separate reports of cyberattacks referencing any of the abovementioned vulnerabilities.

However, CISA still reacted. All three flaws were added on September 18, 2026, and all three have a small three-day deadline for patching that expires on September 21. Usually, CISA would grant Federal Civilian Executive Branch (FCEB) agencies a three-week deadline to patch up, with just exceptionally dangerous flaws getting a shorter window. That being said, these flaws are likely extremely dangerous.

In theory...

In a hypothetical scenario, a threat actor could target a Linux system using kernel TLS (kTLS) by sending a specially-crafted TLS record that triggers CVE-2025-39682 and causing either a crash, or even arbitrary code execution. Attackers that already have a low privilege foothold on the target endpoint could use CVE_2025-39964 to escalate privileges, while on systems using the affected bridge/netfilter configuration, CVE-2026-53266 could be used for privilege escalation, as well.

According to the Red Hat advisory, there is a chance that CVE-2025-39682 is remotely triggerable, but only when the system is using the affected kTLS receive path. The other two flaws are exclusively local vulnerabilities.

Besides fixes, two out of the three flaws also have possible mitigations. For the improper check one, users should prevent module tls from being loaded. For the out-of-bounds write one, users are advised to disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces. The final vulnerability, currently does not have a working mitigation, and the only way to stay secure is to apply the provided patches.

Linux kernel vulnerabilities are generally considered serious, but the severity still depends on the flaw and how the affected kernel is deployed. Earlier this year, security researchers disclosed four local privilege escalation flaws, called DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).

Via The Hacker News

• HKUST (Guangzhou) and HK PolyU researchers' InjectEave beams a radio carrier at devices so their own circuits leak analog audio
• The leaked audio has already been decrypted by the device itself, making encryption offer no protection against such an approach
• The 30m headline needed a pricey amplifier pushing output to 10 W, while standard ranges of 1 to 6m were measured by detecting a test tone

Researchers at the Hong Kong University of Science and Technology and the Hong Kong Polytechnic University have shown that everyday headphones, a desk phone, and a handful of smart-home gadgets can broadcast what they are doing simply by using a radio signal.

The technique, called InjectEave, was presented at USENIX Security 2026 in Baltimore, and multiple outlets have since covered the researcher's claim that the attack "can recover headphone audio from up to 30 meters away, including through walls".

The claim may be accurate, but it has limitations, including the need for specialized equipment that is often very noticeable in most settings.

An impressive technical show with plenty of limitations in tow

Conventional electromagnetic eavesdropping waits for a device to leak. That works poorly for audio, because speech sits below 20 kHz while a device's wiring radiates efficiently only at megahertz or gigahertz frequencies.

InjectEave chooses to close the gap by transmitting a carrier signal at the target. According to the paper, nonlinear components such as amplifiers, analog-to-digital converters, switching MOSFETs, and power converters mix the secret signal onto that carrier, and the device's own traces and cables radiate the result back to a receiver.

Because the leak happens in the analog path, after audio has been decoded, the project page states that "InjectEave is immune to digital defenses such as encryption, masking, and randomization." Encryption in any form on a wireless headset is irrelevant, since the attack directly targets the signal driving the speaker, not the radio link.

The team demonstrating this used a USRP B210 software-defined radio, two antennas, a Siglent spectrum analyzer, and a laptop to set up their proof of concept, which could, as they noted, "eavesdrop on the majority of these devices from over 2m away and through walls, with a maximum distance of 30m for recovering intelligible headphone audio".

This isn't the first time the technique has been used, even as the researchers have built on it considerably; the idea originates from "The Thing," a Soviet bug given as a gift to the US ambassador in Moscow in 1945, which was passively powered remotely as a listening device.

InjectEve, however, does not involve planting anything; instead, it leverages existing work on interference-induced leakage and impedance-based backscatter, and distinguishes itself by recovering coarse digital data rather than continuous analog waveforms, allowing users to 'listen in' without added steps.

The same approach applies to wired headphones, which are also prone to leaking microphone audio; researchers concluded that their sound cards were the primary source of the leaks, which were being sent back over very short distances.

The threat is somewhat tempered by the fact that it can capture what users hear but, with wireless headphones, cannot hear what the user is saying. The attacker also has to transmit continuously and use a high-powered (10W) transmitter to reach the full 30-meter range, even though capturing and rendering speech is harder than the tones the test used to prove the approach worked.

The attacker also needs to know the target model and profile a matching unit first, although they managed to get a profile to transfer cleanly across three identical UGreen headsets, suggesting this might be easier than one would assume.

The researchers say they reported the findings to the affected manufacturers but, "as we have not yet received a response," withheld the table's frequencies and stripped injection control logic from their released code. One shouldn't be too hopeful, however, as no software update can fix an analog leak, and it is relatively limited in practical abuse cases.

• Hackers are using blockchains to keep malware instructions available after servers disappear
• AI is making blockchain-based malware infrastructure easier for less experienced hackers
• Blockchain traffic is difficult to block without disrupting legitimate cryptocurrency services worldwide

Hackers are increasingly hiding malware instructions inside public blockchains, creating communication channels that can survive the removal of conventional infrastructure.

New figures from Chainalysis claim malicious blockchain activity increased 440%, with daily entries rising from 2.06 to 11.1 after newer AI systems emerged.

The technique gives attackers another way to maintain communication with compromised computers without relying entirely on conventional servers controlled by hosting providers.

Blockchain networks become malware dead drops

Blockchain dead drops use transaction data or smart contracts as lookup points, allowing infected computers to retrieve commands, addresses, or configuration information.

Because blockchain records are distributed across networks, removing a conventional server does not erase information already stored on the ledger.

A North Korean-linked operation associated with UNC5342 uses TRON and Aptos as alternate routes before retrieving encrypted instructions through the BNB Chain.

Its malware can check one network, switch to another when necessary, and retrieve updated addresses without receiving another malware package.

Iranian actors suspected of links to the country's intelligence ministry have embedded encoded routing information inside Bitcoin transactions used for malware retrieval.

Russian-speaking cybercriminals have also commercialized the technique, using Polygon contracts to provide blockchain-backed infrastructure for malware campaigns operated by different customers.

One related operator controls more than 50 BNB Chain resolver contracts while also conducting activity involving fraudulent tokens and clipboard-monitoring malware.

These operations show how blockchain records can function as persistent lookup infrastructure rather than merely serving their conventional financial and transactional purposes.

AI lowers the technical barrier

Chainalysis said the sharp increase in this malicious activity followed the arrival of high-capacity Chinese open models, which placed fewer restrictions on malware development requests.

Before those systems appeared, building reliable blockchain-based malware infrastructure required expertise across malicious software, cryptocurrency networks, and distributed communication systems.

AI tools can reduce that knowledge barrier by helping less experienced operators understand unfamiliar technologies and produce components needed for blockchain communication.

In the second quarter of 2026, state-linked groups accounted for roughly two-thirds of newly observed activity.

Those groups also represent about half of overall observed activity, indicating that blockchain-based malware infrastructure extends beyond conventional cybercriminal operations.

Defenders face difficulties because blocking blockchain traffic could also disrupt legitimate wallets, decentralized applications, exchanges, and decentralized finance services used worldwide.

Attackers can further complicate disruption by operating their own blockchain nodes, reducing dependence on external providers that defenders might otherwise pressure or disable.

Some operators have hidden server addresses inside wallet identifiers without usable private keys, then used zero-value transfers to trigger malware retrieval.

Those transactions leave public records that investigators can examine, potentially providing useful clues even when attackers attempt to conceal their infrastructure.

"While the exploitation of blockchain by state-linked organizations such as North Korea is becoming more sophisticated, on-chain records left by attackers can actually serve as important clues to track them," said Kwon Jun-hyeok, General Manager of Chainalysis Korea.

"Tracking these traces and identifying attackers and related infrastructure through blockchain intelligence will become increasingly important in responding to new cyber threats."

• So-called signal sharing between Microsoft and Google uncovered the RedVDS marketplace was behind large-scale cyber fraud
• RedVDS sold access to virtual machines running unlicensed software from which cybercriminals launched scams and directed attacks
• Threat data was shared securely via the Global Signal Exchange (GSE), a non-profit organization

A major cybercrime marketplace has been taken out of action thanks to cooperation between Microsoft and Google via a secure threat data sharing platform.

Known as the Global Signal Exchange, the collaboration led to the take-down of the RedVDS, an online cybercrime mall supplying virtual machines for launching phishing, business email compromise attacks, and more.

The marketplace – which provided quickly-deleted and therefore virtually untraceable VMs – was meticulously monitored by Microsoft’s security team, Digital Crimes Unit, with both Microsoft and Google suspending the operation and action taken to seize domains and servers.

A secondary case featuring the GSE identified a Microsoft-impersonating tech support scam, resulting, highlighting the importance of secure thread data collaboration platforms.

Digital Crimes Unit

Finding massive scams is not easy. Even with its own Digital Crimes Unit, Microsoft has to rely on information sharing with third party organizations. In this case, the RedVDS marketplace was identified ahead of disruptive action taken by Microsoft in January 2026, which applied to courts in the UK and US to have the RedVDS web domains seized.

Data shared via the GSE enabled Google to follow suit, identifying related accounts on its networks and suspending them. Meanwhile, servers were impounded in Germany, and Europol took action against Europe-based RedVDS servers.

It’s an impressive account of cooperative, decisive action against cybercrime, a collaborative response to what has been described as a “$66 million fraud marketplace.”

An incredible 130,000 organizations were targeted by RedVDS-provided virtual machines between September and December 2025, with 191,000 Microsoft email accounts compromised during this period. All of this access to cybercrime was available from just $24 a month for a basic scam-ready virtual machine.

The importance of collaboration

The Global Signal Exchange is a UK-based non-profit, co-founded with Google in 2025 with the aim of providing real-time monitoring of the cybercrime supply chain.

"Fraud does not respect company boundaries, and no single organization ever sees the whole picture," noted Emily Taylor, CEO at Oxford Information Labs and Co-Founder of the Global Signal Exchange.

"That is exactly why we built GSE: to give trusted partners a secure way to share what they know, quickly. These two cases are a good example of GSE doing exactly what it was designed to do."

The Global Signal Exchange’s role in the sharing of information between Google and Microsoft has highlighted the importance in such collaborations. Both organizations have stated they plan to continue sharing information through the GSE, whose other partners include Meta, Amazon, Google, among many others.

• ShinyHunters hacked rival gang Cl0p, stealing source code, logs, and onion service keys
• The gang defaced Cl0p’s site via Grav CMS flaw, posting their logo and taunts about past threats
• Feud recalls Conti’s collapse in 2022, raising risk of escalating “cyber war” between criminal groups

Infamous cybercriminal gang Cl0p has seemingly been hacked by an even more infamous data leak collective, ShinyHunters.

The attack is still being pieced together, but it would seem we have true hacker beef on our hands - which just might escalate into a full-blown cyber war.

ShinyHunters has added Cl0p to their data leak site, giving the hacking group 72 hours to pay a ransom or see all their files leaked into the cybercriminal underbelly. The files allegedly stolen in the attack include source code, Grav CMS plugins, system logs, and other information, Cybernews reports. We don’t know how much money ShinyHunters are asking to keep Cl0p’s files private.

Still downloading

"The data we stole includes source codes, gravCMS plugins, and other things. We are still downloading and reviewing them," ShinyHunters allegedly told BleepingComputer.

The group also said they stole everything in the server’s /var/log directory, including system activity records, authentication logs, and IP addresses associated with connections to the server. We doubt this could lead to the identification of any Cl0p members, and even if it could, it would mean very little since the members are likely Russian and thus mostly free to conduct their operations.

Doxxing might help defenders disrupt the group’s infrastructure, though.

Whether or not that will be needed, given ShinyHunters’ activity, remains to be seen. The attackers also said they stole the private keys for Cl0p’s Tor onion service:

"We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL," the group said.

On top of it all, ShinyHunters defaced Cl0p’s website. Allegedly, the group found an unauthenticated file upload flaw in the Grav CMS Cl0p was using, gaining access to their target’s servers, website, and more. Cybernews confirmed the website had been defaced and now holds an ASCII image of ShinyHunters’ logo, and a link to their Tor site. It also displays a large message:

"THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time.” Furthermore, it says “rooting your systems since '19 ;)".

The “maybe don’t try to threaten us next time” message seems to refer to a threat that a Cl0p member made earlier. Apparently, this person threatened violence against ShinyHunters, as well as to expose their identities to the public. The remarks were made during Cl0p’s 2025 Oracle E-Business Suite attacks.

"During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I'll kill you soon," ShinyHunters told BleepingComputer.

Dog eat dog

Cybercriminals often work together. They share resources, rent each other’s services, and often complement their campaigns. However, that doesn’t make them “friends” or “colleagues”, in any way. It is usually just a marriage of convenience that falls apart at the slightest sound of trouble. The last big “feud” we’ve seen was back in 2022, at the very start of the Russian invasion of Ukraine. Back then, a group called Conti publicly declared its “full support” for the Russian government and threatened to use its resources against anyone conducting cyberattacks on Russian infrastructure.

The announcement was a fiasco - many of Conti’s affiliates stopped working with the group, and others were openly attacking it. Soon after, a Ukrainian researcher and an alleged affiliate leaked more than 60,000 messages, exposing the group’s operations and internal organization.

All of this eventually led to Conti’s collapse later that year. However, its members did not disappear - they splintered into multiple groups such as Black Basta, Royal, and Quantum. Some of the crooks engaged in Conti are allegedly still active today.

• Joint report from Japan, US, Germany, and Australia says Contagious Interview stole $10 million in crypto
• NK operatives used fake personas, companies, and “laptop farms” to infiltrate 30,000+ devices in 100 countries
• Agencies urge vigilance: verify applicants’ details, check IPs, validate certifications, and watch for crypto‑based payments

North Korean threat actors behind the infamous “Contagious Interview” campaign have so far compromised more than 30,000 devices across 100 countries, and have robbed around 7,000 people of their hard-earned cryptocurrencies.

The theft has brought more than $10 million to the North Korean government, a new report jointly released by law enforcement agencies in Japan, the United States, Germany, and Australia has found.

Fake everything

Contagious Interview is a hacking campaign running for almost four years now. Sometimes it’s also called Operation DreamJob.

The cybersecurity community in general attributes it to the government of North Korea, although more precise attribution is rather difficult.

Some researchers believe it is being done by the Lazarus Group, one of the largest and most influential state-sponsored actors around.

Others believe different groups are involved, labeled DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, or TAG-121.

Contagious Interview leverages the lack of skilled workers in the West to infiltrate organizations, steal sensitive data and ultimately, money. North Korean operatives would create entire fake personas on social media such as LinkedIn, and would apply to hundreds, if not thousands, of job ads across IT, healthcare, and other industries.

The personas are carefully crafted, using a mix of legitimate information stolen in data breaches (names, SSNs, addresses), and AI-generated images, video, and audio. If hired, the operatives would use their access to infect organizations with malware, steal login credentials and different access, and exfiltrate sensitive files and cryptos.

The operation works the other way around, as well. Crooks would create fake companies and fake job positions, and would then reach out to their targets to offer lucrative positions on exciting projects. As part of the hiring process, the candidates would be asked to download and work on code which, unknown to them, was malicious. The North Koreans would then pivot to their targets’ current employers, resulting in the same outcome.

Laptop farms

One of the ways organizations in the West are trying to combat this issue is by being mindful of the IP address and the location from which their employees are logging on. To work around this challenge, the attackers have set up “laptop farms” - facilities located abroad (usually in countries that don’t have that strict limitations, but are still NK-friendly, such as China), hosting hundreds of laptops. They would then access their targets’ networks through these laptops, to make sure their actual location is never revealed.

The primary targets are individual web designers, engineers, and specialists working in cryptocurrency, blockchain, and Web3 technologies, it was said. Businesses should be wary when they receive numerous applications in a short time, for a position where there are usually very few applicants.

“If possible, verify that IP addresses generally match the applicant’s claimed residence,” the report states. “Carefully check all contact information. Calling an applicant’s phone number may reveal the number is out of service.”

The agencies also warned that trying to get hired is often a group effort: “Even if a single individual appears to be applying, multiple people may be collaborating behind the scenes, inflating the perceived skill set.” Therefore, businesses should verify certifications by checking registration numbers and, in case of any inconsistencies, should ask for detailed explanations.

Asking personal details about the applicant’s hometown, weather, or hobbies, is often a good way to spot a scammer. Finally, it was said that North Korean IT workers tend to favor payment in cryptocurrency, and they may request that remuneration be sent to an account in another person’s name.

Contagious Interview has been ongoing for roughly four years now, and during that time it evolved significantly. Security agencies warn that changes to the standard practice could happen at any time, and that the variations to the theme should be expected.

• Google's Gemini AI broke out of a testing environment and hacked into three third-party companies
• The agents guessed passwords and used a public repository of passwords to hack into computer systems
• The incident occurred in May 2026, with AI testing lab Irregular stating that the incident was caused by the "same issue" that caused incidents by Anthropic and Meta

Google’s Gemini has joined the ranks of AI models that have been involved in testing-turned-breakout events, alongside Meta, Anthropic, and OpenAI.

During capture-the-flag testing by AI lab Irregular, Google’s model autonomously accessed three computer systems belonging to third-party companies by guessing passwords and accessing an online repository of publicly listed passwords.

Google said that the incident occurred in May 2026, potentially marking it as the earliest AI models to escape testing ahead of the other incidents that took place in early July.

Google Gemini jumps the gun

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.”

Google also noted that a bug in the testing environment was responsible for allowing agents access to the internet. Contrary to incidents disclosed by other AI developers, Google’s agents ceased their intrusion once they had determined they had accessed company systems outside of the testing environment.

The testing was being conducted by Israeli AI lab Irregular. Irregular was also conducting the testing of Meta and Anthropic models during AI testing breakouts in July.

“This is the same issue that was already reported and does not represent a materially separate incident,” an Irregular spokesperson said in a statement (via CNBC). “All relevant labs were notified in late July, and affected entities were contacted as part of the investigation.”

Google said it was informed of the incident by Irregular in late July.

Debate over AI safety intensifies

The first disclosures of AI testing break outs - alongside several subsequent disclosures of more recent incidents - have coincided with increasing opposition to AI and the upcoming midterm elections in the United States, where AI has become a make-or-break topic.

The debates currently raging circles around who should control the pace of AI development. Some big tech leaders, such as Nvidia CEO Jensen Huang, have aligned their views with those of President Trump. Trump recently stated that AI development cannot be allowed to slow down because “whoever wins AI, wins!”

Huang’s views follow a similar line. The Nvidia head has argued that AI companies should pace themselves, rather than being subject to oversight. At Dreamforce 2026, he argued that AI companies should, “run as fast as you can...but if you feel at any given point in time the company’s out of control or the product’s not going to be safe, take a pause and make sure you get it right.”

Other AI heads, such as Anthropic’s Dario Amodei and OpenAI’s Sam Altman, are more skeptical. Following the resignation of an Anthropic researcher, Amodei published an essay arguing in favor of ‘pacing the frontier’ - where AI companies slow development to advance alignment and regulation.

Numerous political action committees (PACs) have been channeling millions of dollars of funding into pro-AI candidates, with Nvidia setting up its own PAC to help shift US policy in the company’s favor.

Several previously pro-AI data center candidates have shifted their tone in response to their constituents' views which have become increasingly hostile to AI technology. Numerous states have also rolled-back tax exemptions for AI data centers after seeing billion dollar revenue losses.

As prices rise and the war in Iran continues to push up fuel prices, working class communities are banding together to oppose AI data centers that have pushed up energy costs and bills with new grid connections and unprecedented electricity demands in regions with existing capacity constraints.

• Zimperium zLabs discovered RedHat, a Chinese‑origin Android banking trojan with AI assistant
• AI interprets screen layouts in real‑time, enabling credential theft and bypassing app redesigns
• Distributed via third‑party stores, social media, malvertising, and SMS; persistence blocks uninstall attempts

There is an Android malware out there that comes with an AI assistant that tells it what to do. The assistant seems to be independent of the malware’s operator, allowing the tool to work without requiring the operators to be present in real-time.

The malware in question is called RedHat. It was discovered by security researchers Zimperium zLabs, who believe it is of Chinese origin. It is currently being distributed via third-party app stores, social media, malvertising, and SMS spam, and requires Android’s Accessibility permissions to work.

The malware itself is a typical banking trojan - it creates an invisible overlay every time the victim brings up a banking app, capturing login credentials and one-time passwords, and thus giving attackers direct control over people’s banking accounts.

AI-powered eyes

But what makes RedHat stand out from a sea of Android banking trojans is its AI-powered component. The model serves as a kind of remote “eyes and hands” for controlling the victim’s phone.

Usually, when criminals develop banking trojans, they need to code exact coordinates of the layout for it to work. They need to code where the password is entered, or where the login button is. If the banking app gets redesigned and changes its layout, the malware breaks.

With AI, that is no longer a problem. RedHat gets a picture of what’s on the screen, sends it to the AI assistant, which then instructs the malware on how to proceed.

"RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," Zimperium explained.

The tool also has a few advanced persistence mechanisms, being capable of reinstalling deleted components, and intercepting the uninstall process to cancel it while displaying a fake error message to the victim.

So far, there is no word on who the targets are, or how many people might have been compromised.

Via BleepingComputer

• ESET reports Salt Typhoon shifted focus to Latin America, hitting Argentina, Peru, Venezuela, and others
• Group deployed new SparroWocky backdoor with 30+ commands for profiling, exfiltration, and surveillance
• Researchers link pivot to Trump’s renewed US push in the region, threatening China’s long‑term investments

Salt Typhoon has been reassigned to Latin America, and it’s apparently all due to Donald Trump’s renewed “interest” in the continent.

Cybersecurity researchers ESET have been tracking Salt Typhoon, a Chinese state-sponsored threat actor for years. This is the same group that was seen hacking telecommunication giants and government agencies across the western world since at least 2019.

According to the researchers, from mid-2025 and well into 2026, the group has been targeting a number of Latin American countries: Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. They were seen deploying brand new malware, a backdoor called SparroWocky, that features around 30 commands such as system profiling, file exfiltration, screenshot grabbing, and more. ESET says that around 90% of all Salt Typhoon’s recent activity was devoted to this specific region.

A rare occurrence

The discovery of China-built malware in these countries comes as somewhat of a surprise. Latin America cannot be considered an open ally to the Chinese, but they are quite influential in the region, both economically, and diplomatically. ESET sees the development as a “rare occurrence”, and stresses that this is most likely a response to Trump’s initiatives in the region.

“Donald Trump’s second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications,” ESET says. “We suspect that FamousSparrow’s (their name for Salt Typhoon) activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.”

ESET says the backdoor is being delivered via a trident loader scheme that consists of a legitimate executable, a malicious DLL, and a file containing the encrypted malware. By side-loading the DLL, the crooks can deploy the malware without being spotted.

Via The Register

• FBI and US Coast Guard boarded tanker VL Prosperity after foreign cyber compromise indications
• Iranian media claimed attackers sabotaged engine systems and communications; Kohaku vessel also affected
• No group claimed responsibility; US agencies investigating “malicious cyber activity” on targeted ships

Last month, two tankers heading for the United States were hit by a cyberattack, forcing the FBI and Coast Guard to board at least one of the vessels and investigate.

The first vessel is called VL Prosperity, which was allegedly transporting 2.3 million barrels of oil. It is a Liberian crude oil tanker, travelling from Egypt’s Sidi Kerir Oil Terminal towards Galveston, Texas, where it was supposed to dock on August 24. On its route, lasting roughly 25 days, it passed through the Strait of Gibraltar.

Some three days before arriving, it requested assistance from law enforcement, prompting a “highly specialized team” of FBI and Coast Guard cyber experts to board. The ship is currently sitting in the Gulf of Mexico.

Iranians (indirectly) claiming responsibility

“On August 21, a highly specialized team – comprised of USCG Law Enforcement personnel, USCG Cyber Protection Team members, a vessel inspector, and FBI Cyber Action Team operators – embarked the vessel to conduct a comprehensive cyber security boarding and investigation,” a US Coast Guard spokesperson told Cybernews.

The spokesperson also said the team’s activity is “designed to ensure the integrity of the vessel’s operational and information technology systems." The Coast Guard apparently saw “indications that the vessel’s network were compromised by foreign cyber actors.” It later described the incident as “malicious cyber activity.”

The second vessel in question is called Kohaku, flying under the flag of the Marshall Islands. It was travelling towards Texas to load liquefied petroleum gas, as per Wall Street Journal, and has been sitting near Malta for the past couple of days. At press time (Friday morning), it was travelling through the East Mediterranean Sea.

So far, no threat actors have publicly claimed responsibility for these attacks. However, the Iranian Mehr News Agency allegedly hinted the attack was a “message from Iran’s “Resistance Front” to Washington and the broader Middle East.”

The same publication - also the first one to report on the incident and name VL Prosperity as one of the victims - said the attackers infiltrated engine-room systems, reduced the engine’s cooling flow, increased the engine speed, and disabled the ship’s fuel and engine-oil tank, all citing an unnamed crew member. Apparently, the ship’s communications were knocked offline for a day and a half, as well.

Via Cybernews

• A new report has warned that efforts to install Chinese AI within Venezuela's surveillance network could still go ahead
• The plans were drawn up before former-President Nicolás Maduro was ousted by the US
• Report warns there has been no shift in policy, and calls on the US to take action

When the United States decided to oust and capture Venezuelan President Nicolás Maduro in a daring nighttime operation, the capital of Caracas was turned to complete darkness as the United States Cyber Command allegedly knocked power generation offline.

But this goes beyond giving US troops favorable conditions to infiltrate Maduro's compound. Since coming to power in 2013, Maduro had been building a huge surveillance network to help keep an eye on and - if necessary - quell opposition. A surveillance network that could capture the whole operation on tape.

But as a President at odds with the US, Maduro sourced much of the surveillance tech from China with future plans to integrate banned Chinese AI systems into the network. While Venezuela may have changed allegiances, a new report from the Australian Strategic Policy Institute (ASPI) has warned that the implementation of Chinese AI could still go ahead.

Venezuela looks to integrate Chinese AI into surveillance infrastructure

ASPI’s latest report, titled ‘Warning signals: Venezuela and the risk of Chinese AI-enabled digital authoritarianism’ [PDF], warns that before the ousting of Maduro, then Vice-President Delcy Rodríguez sought to sign “an agreement to adopt Chinese-built AI systems … to use Chinese AI to enhance existing state-sponsored surveillance.”

Following the operation to remove Maduro, Rodríguez was installed as the Venezuelan President just two days after. But since then ASPI warns that there has been nothing to signal a change in direction from Rodríguez’s plans, meaning that the US could be heading a nation filled with Chinese AI-assisted surveillance tech.

“Venezuela will become one of the first countries outside China to import China’s new generation of LLM-based AI systems for surveillance and control, and the most advanced adopter in the Western Hemisphere,” the report states.

In the immediate aftermath of the likely fixed 2024 Venezuelan presidential elections, protesters and dissidents were identified online and subsequently monitored using video and drone surveillance. Numerous protest leaders disappeared, likely captured by the authorities for their activities.

Plans to adopt Chinese AI technologies as part of Venezuela’s surveillance network would likely enable the state to continue repressing opposition. “Chinese or other AI tools could strengthen a domestically directed apparatus already used to manage dissent, restrict information and preserve political power,” the report says.

One of the companies looking to provide its technology for use in Venezuela is iFlytek. The US held iFlytek as a responsible party during China’s attempts to round up and detain the Uyghur Muslim in the Xinjiang region, and banned the sale of the company’s products in the US in 2019.

Moving Venezuela away from China

The ASPI report calls upon US Secretary of State Marco Rubio to spearhead efforts to dismantle the surveillance network and prevent the import of Chinese AI systems into Venezuela’s apparatus.

“China’s leaders appear to understand that assets and investments of its national champions are at risk in Venezuela. Beijing’s approach seems to be, in part, strengthening oversight of state-owned assets abroad to assist in risk protection and management,” the report states.

The report states that dismantling Venezuela’s surveillance infrastructure would align efforts to combat Chinese surveillance tech, and encourage others to dismantle mass-surveillance systems. The dismantling of Venezuela’s surveillance infrastructure would also help position the US’s image as a liberator, rather than just a new face of an old regime.

But the slight irony therein is juxtaposed with the US’s own current surveillance woes, especially in the wake of opposition to Flock camera systems, and AI companies refusing to provide government access to their models for domestic surveillance purposes.

• CISA urged organizations to deploy honeypots, lures, and honeytokens as cyber decoys
• Decoys complement Zero Trust by detecting LOTL activity and producing high‑fidelity alerts
• Guidance outlines tripwires, breadcrumbs, MITRE ATT&CK/Engage steps for scalable implementation

The US Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to deploy honeypots and various lures to better detect cyber-intrusions and keep hackers busy with spoofed materials. To that end, it recently published a new guidance to help businesses of different sizes and cybersecurity maturity implement these “cyber decoy strategies”.

“Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data,.” CISA said in a new security advisory.

“Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI). As organizations adopt Zero Trust models, they should assume that a malicious threat actor may gain some level of access to their environment and plan accordingly.”

Tripwires, breadcrumbs, and honeytokens

CISA’s advisory hints that Zero Trust is the preferred way to go about securing corporate infrastructure. Zero Trust treats no user, device, or network segment as inherently trustworthy and requires organizations to operate on the assumption that compromise is inevitable, it says. If you want to learn more, read our in-depth guide on what ZTNA is.

However, it adds that cyber decoys are consistent with this paradigm and complement ZTNA by supporting continuous monitoring and verification, creating high-fidelity alerts for suspicious activity, reducing alert fatigue, and helping defenders detect post-compromise activity such as adversary LOTL techniques. They are also incremental, cost-effective, and scalable, and can be introduced into the cybersecurity tech stack without major architectural changes.

The guidance can be found on this link (PDF). It introduces different decoy concepts such as tripwires, breadcrumbs, and honeytokens, and uses the MITRE Engage and MITRE ATT&CK frameworks to provide the steps needed to plan, implement, and refine these operations.

• Sublime researchers warn ICS phishing via calendar invites is surging ~33,000% since May 2026
• Attacks bypass filters, trick users into installing RMM tools like ScreenConnect for full compromise
• Defenses: scrutinize suspicious invites, verify senders, and treat ICS attachments with caution

ICS phishing - the type of phishing that abuses calendar files (.ics) is set to increase by around 33,000% between May and September 2026. This is according to a new report by cybersecurity researchers Sublime, who argue that this type of phishing has finally “hit the mainstream”.

The methodology is simple - the attacker uses a free service, such as Gmail, and sends a calendar invite to the target. Since both services are legitimate and free, the attacks bypass most email security filters and can be done at scale with close to zero cost.

Furthermore, the victim is exposed to the attack twice: once in the inbox, and once in their calendar. Inside the calendar invite is usually a link to download a maliciously configured remote management and monitoring (RMM) solution such as ScreenConnect. The attackers can use the tool to take over the compromised endpoint, deploying stage-two malware such as infostealers or ransomware, and grabbing passwords, documents, and other valuable secrets.

Spiking in popularity

ICS phishing started increasing in popularity roughly a year ago, but has been really picking up speed lately. Between May and June it increased 282%, and between June and July - 338%.

Between July and August it rose 1,216%, and in just the first half of September it rose 1,426% over the full month of August. Projections for the entire month of September, over August, are 2,852%, Sublime says.

“The jumps in August and September appear to be indicators that this attack type has finally hit the mainstream,” the researchers explained. “To really drive that point home, the increase from May to September is projected to be ~33,000%.”

Defending against these attacks is best done with a little common sense, the researchers conclude. Users should be mindful of the telltale signs, such as suspicious CTAs, suspicious senders, and the usual financial urgency.

• Security researchers used Claude Opus 5 to hijack an OpenAI employee's ChatGPT account
• Exploit abused an image processing flaw on OpenAI community forums to gain full repo access
• The entire timeline from vulnerability discovery to repo access took less than 72 hours

While taking part in an OpenAI bug bounty program, a group of Hacktron security researchers managed to compromise an internal OpenAI ChatGPT account and access internal company code on Github.

According to the Wall Street Journal, who first reported the incident, the researchers used a “special version” of Anthropic’s Claude made available to “qualified cybersecurity practitioners” to pull off the attack.

The researchers initially attempted to use Claude Opus 4.8 to create a breach, but faced multiple setbacks as the model “struggled across several sessions to produce a working exploit.” But the release of Opus 5 changed everything.

OpenAI breach part of wider libheif exploit

The breach started with a libheif exploit that abuses a flaw in the .heic/.heif/.avif image file format decoder and encoder. While this exploit allowed Hacktron to breach OpenAI, libheif is also used across other platforms and software including Slack, Meta, GitHub Enterprise, Ruby on Rails, and more.

To start, the researchers first noted that the OpenAI community forum relies on the Discourse platform, which in turn relies on FastImage for image checks. But FastImage does not support .heif image files, and these are passed on to ImageMagick for conversion instead.

Developing a working code-execution exploit that abused this relation between ImageMagick and libheif with Opus 4.8 “wasn’t fruitful”, the researchers said, but on the same day Anthropic released Claude Opus 5.

With Opus 5, the researchers managed to create a working local remote code execution (RCE) using the same premise by setting an AI agent in a loop to exploit a local Discourse Cloud instance.

The successful Discourse exploit was then used against the OpenAI community forums, where the researchers hijacked an OpenAI employee’s ChatGPT account. The employee had connected their ChatGPT Codex with the company’s Github, allowing the researchers full repo access.

Exploit needed just a few hours of human interaction

Where the researchers spent hours struggling to create a working exploit with Opus 4.8, the release of Opus 5 showed that “every new model is getting increasingly capable." It took the agent running on Opus 5 just a few hours to develop a working exploit.

The full timeline from initial discovery of the exploit to OpenAI repo access took just 72 hours, researchers noted.

The researchers also said that the entire OpenAI and Discourse hack “took a few days for an agent, and just a few hours of human time” in order to be successful. Furthermore, their research into the libheif exploit against organizations such as Slack, Zoom, Meta “took two-months, cost less than $3,000 in tokens in total, and was conducted by three researchers.”

“The AI started almost blind and adapted the exploit for each company within one or two days,” the researchers said. “We are not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed.”

In return for exposing the vulnerabilities, Hacktron was awarded a $6,500 bounty from OpenAI, and the libheif vulnerability has been patched.

AI agents are the future, for better or for worse

Hacktron's exploit demonstration shows how prevalent AI agents are becoming in cybersecurity. Where they have been lauded by AI companies to provide productivity bonuses and efficiency increases to workers, the same can be said for attackers.

The fact that it took just 72 hours from exploit discovery to full repo access highlights the dangers. By setting an AI agent to run on a continuous loop until it creates a workable exploit dramatically shifts the exploit timeline from weeks or months in the case of non-AI assisted attacks to mere hours for attackers aided by agents.

This is a similar circumstance to OpenAI's own accidental breach of Hugging Face during testing of AI agents. The agents were essentially told to complete a test scenario by any means necessary, which the agents interpreted as permission to go beyond their alignment and hack into a third-party environment that they thought held the key to solving their task.

"AI has been changing the threat landscape for a while now, and the defence landscape with it," Spencer Starkey, Executive VP EMEA at SonicWall said. "But there's a conversation we're not having loudly enough: do you actually want your security platform to have been built by AI, with no human track record behind it?"

"It looks compelling. You have low cost, high margins, slick interface. But what happens when something goes wrong at 02:00 in the morning and you need someone who knows the product, knows your environment, and has seen that problem before? An AI-built platform with zero employees can't give you that.

"Why go with an established vendor when a newer option does 90% of the same things for half the price? It's a fair question. But the 10% you're trading away is usually accountability, resilience, and institutional knowledge. Exactly what matters most when you're under attack.

"It looks like due diligence is eroding, and that worries me. Shiny and affordable is a powerful combination…for magpies. But in cyber security, the cost of a bad supplier decision doesn't show up until the moment you can least afford it, so don’t be a magpie," Starkey concluded.

• US law enforcement seized Nightmare Stresser domains, a long‑running DDoS‑for‑hire platform
• Service enabled hundreds of thousands of attacks since 2022; FBI banner now replaces sites
• Part of Operation PowerOFF, which has seized 100+ domains and charged 12 people so far

US law enforcement agencies disrupted yet another Distributed Denial of Service for hire (DDoS-for-hire) platform. In a press release published earlier this week on the District of Alaska’s Attorney General’s Office website, it was said that two internet domains associated with the Nightmare Stresser service were seized.

Describing it as “one of the world’s longest running Distributed Denial of Service for hire services,” the DoJ says Nightmare Stresser was used in “hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022”.

Services such as this one are called “booters” or “stressers”, and are often advertised as legitimate, allowing users to stress-test their websites against possible DDoS attacks.

No arrests

However, researchers have warned on multiple occasions that this is merely a cover for what’s essentially illegal activity. These platforms rent their services to anyone, including cybercriminals, and have been used to disrupt and take businesses, public organizations, and individuals offline, causing reputational and financial harm.

Nightmare Stresser’s two domains were seized - nightmare-stresser[.]com and nightmarestresser[.]org. Visiting these sites now shows the usual FBI defacement banner saying, “This website has been seized as part of a coordinated law enforcement action taken against illegal DDoS-for-hire services.”

To run DDoS attacks, threat actors need infrastructure - hundreds of thousands of internet-connected devices infected with malware that forces them to direct their traffic towards a single point. The DoJ’s announcement says nothing about the infrastructure being dismantled, or the malware used to create Nightmare Stresser being discovered or sinkholed. It also does not mention any arrests being made, so it is safe to assume Nightmare Stresser will be back to its usual shenanigans sooner, rather than later.

Still, the press release says that the takedown is part of Operation PowerOFF, an ongoing campaign aimed at dismantling DDoS-for-hire infrastructure worldwide, as well as “holding accountable the administrators and users of these illegal services.”

So far, more than 100 domains were seized as part of the effort, and 12 people were charged.

Via The Hacker News

• Helpfeel confirmed a Sept 11 breach compromising 23.62M records tied to Gyazo users
• Stolen data includes PII, login/session IDs, Google SSO tokens, and 490M image metadata records
• Payment info safe, but private images may have been exposed; viewing disabled pending investigation

A Japanese customer-support and knowledge-base company suffered a cyberattack recently in which it lost millions of user records, including personally identifiable information (PII) and, possibly, customer photographs.

The company in question is called Helpfeel. It is an established organization with more than 200 employees, operating as a combination of a modern help center, intelligent search, and an AI support agent. It runs an image-sharing service called Gyazo. According to a breach notification published earlier this week, the breach happened on September 11, when an unidentified threat actor abused a vulnerability to upload malware, gain access to the service’s servers, and run arbitrary commands on them.

A subsequent investigation determined that the attacker compromised 23.62 million records. Multiple records are tied to the same user, and many of the records were generated by customers without user accounts, so the actual number of affected individuals is not yet determined (but it’s definitely less than 23.6 million).

Image metadata exposed, too

The compromised records fall into these categories: names, emails, password hashes, user IDs, device IDs, login session IDs, X integration tokens, email addresses associated with Google SSO, profile information, language preferences, registration date and time, login date and time, subscription plan, billing status (without credit card numbers), and usage statistics.

“We have confirmed that no payment information, including credit card numbers, was disclosed without authorization,” Helpfeel confirmed.

PII aside, the attackers also accessed image metadata. Roughly 490 million records associated with images registered in or before January 2019 were compromised, including image IDs, source IP address used for the upload, user-agents, EXIF location data, OCR text extracted from the images, image titles, source URLs, and hashed passphrases for private images.

Since some of this metadata is used to generate image URLs, Helpfeel does not rule out the possibility that the attackers viewed actual images, as well. “We have temporarily disabled viewing of some images to prevent further harm,” it said. “As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation.”

Via The Hacker News

• Cisco fixed critical ISE flaw (CVE‑2026‑76460) allowing unauthenticated API authentication bypass
• Actively exploited; no workarounds exist—patching is the only mitigation, per Cisco PSIRT
• CISA added to KEV catalog, mandating federal agencies patch or disable ISE by Sept 19, 2026

Cisco has fixed a maximum-severity vulnerability found in its Identity Services Engine (ISE) that is being actively exploited in attacks.

ISE is the company’s Network Access Control (NAC) and identity-based policy platform which decides who or what is allowed onto a company’s network, and what they’re allowed to access inside.

“A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication,” the company said in a security advisory.

Abused in the wild

“This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”

The bug in question is tracked as CVE-2026-76460. It was given a severity score of 10/10 (critical), and was said it affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.

In the same advisory, Cisco said its Product Security Incident Response Team (PSIRT) was aware of active exploitation and urged customers to upgrade to a fixed software release as soon as possible. There are no workarounds available for this flaw, and a patch is the only solution. The full list of vulnerable versions and the corresponding patches can be found on this link.

At the same time, the US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal agencies a three-day deadline to patch, or stop using ISE entirely. The deadline expires on September 19, 2026.

Cisco has shared Indicators of Compromise (IoC) and advised defenders to hunt for suspicious usernames in access.log files on every node. It also recommended re-imaging nodes and restoring them from backups, in case of a breach.

Via BleepingComputer

• Check Point warns scammers spoof airline customer support on social media to steal payment data
• Hundreds of fake accounts created daily, luring frustrated passengers into private chats or forms
• Campaign active since 2024; mirrors earlier fake support scams seen during crypto wallet fraud

Scammers are now posing as customer support for airlines, tricking already frustrated customers into sharing payment details and possibly losing money, too.

People who have had poor experiences flying would often vent their frustration on social media, be it X, Facebook, Instagram, or any other platform. They would tag the company and demand help, or at least an explanation. However, according to new research from security experts Check Point, the airline’s social media department is not the only one monitoring these complaints - hackers do it, too.

Not only are they monitoring the channels, they are actively preparing to hop in and talk to the customers.

Years-old campaign

Every day, hundreds of new social media accounts are created - some are built to spoof the airlines themselves, others are built to look as if they’re used by the airlines’ customer support or similar department. When the customer leaves a post or a comment, the criminals swoop in, publicly apologizing for the inconvenience, and offering assistance in a different, private channel. Sometimes those are the platform’s DMs, and sometimes it is WhatsApp or a different platform entirely.

The end result differs from case to case. Sometimes, the criminals would try to get the victims to share their personal and payment information and would later try to make a wire transfer. In other instances, the crooks would prepare a fake form for the victims to fill out, possibly creating a database for later use.

Check Point doesn’t know exactly when the campaign started but found some of the impersonation accounts dating back to before 2024, with the majority being created either in 2024, or later. “This suggests that the activity has accelerated over the past two years. The campaign remains highly active, with hundreds of new accounts appearing daily and new scam techniques continuing to emerge,” they said.

However, we can confirm that this type of fraud has been around for a lot longer than that. Fake customer support scams were rampant on X even in 2021, during the crypto ICO craze, during which crooks were taking advantage of people losing access to their wallets, or making transactions towards nonexistent wallet addresses in the same way.

• Spain’s data protection agency (AEPD) reported its first breach carried out by an autonomous AI agent
• Agent chained multiple attack stages: accessed public files, scanned systems, exploited a flaw, and modified data
• AEPD urged businesses to factor AI‑driven attacks into risk assessments, stressing faster response and stronger identity controls

A Spanish company was apparently hit with a data breach conducted by an autonomous AI agent.

Earlier this week Francisco Pérez Bes, president and deputy of the Spanish data protection agency (AEPD) published a new article on the agency’s blog, saying it “received the first notification of a personal data breach in which the incident was reportedly carried out using an artificial intelligence agent powered by a well-known large language model.”

As per Pérez Bes, the agent first used the target’s “publicly accessible files”, through which it was able to log into its system. From the inside, the agent then started scanning for vulnerabilities and after finding one, used it to modify personal data and gain access to invoices.

A call to action

The author stresses that there is very little known about this incident and that a thorough investigation is currently ongoing. He pointed out that the attack doesn’t imply the AI model or the provider’s infrastructure were compromised or malicious by design, but said that the attack was “significant from a data protection perspective,” since the AI agent was used to chain together multiple stages of the attack.

For Pérez, the attack is a call to action - businesses need to rethink how they assess and manage security risks. He claims businesses need to “explicitly account for AI-assisted and AI-driven attacks when assessing the risks associated with personal-data processing,” and need to reassess their response times.

“Procedures designed around manually executed attacks may not be sufficient when an AI agent can analyze multiple assets at once, test different avenues of attack, and rapidly adapt its behavior based on what it finds.”

He also stressed the “growing importance of digital identities and credentials,” since an AI agent with an account or an API key “can operate at machine speed and move across different services before an organization has time to detect the anomalous activity.”

Via The Register

• The US Treasury's FinCEN arm asks financial institutions to file scam center suspicious activity reports under a new keyword
• FinCEN says that it flagged financial moves across 33,904 different filings, but actual losses might differ significantly, as the approach is prone to double-counting transactions
• Only 1,300 institutions filed reports, with 10,082 (29.7%) of them centering around exploitation of the elderly by scammers

The US Treasury's Financial Crimes Enforcement Network has issuespublished an alert and a companion data analysis telling banks, credit unions, digital asset exchanges, and securities firms that it needs sharper reporting on the overseas scam centers that it says target Americans at an industrial scale.

FinCEN puts total damages, per its reporting mechanism, at roughly $12.7 billion linked to suspected digital asset investment scams between September 2023 and the end of 2025.

The number comes from adding up the dollar values of 33,904 Bank Secrecy Act filings that referenced the keyword from its 2023 "pig butchering" alert, which may be overstated, as it includes both attempted and successful transactions as well as both inbound and outbound reports, often of the same transactions, causing significant overlap.

FinCEN's new requirement is a keyword

While the $12.7 billion is a measure of what institutions have flagged and is prone to double-counting and errors, victim losses, a significant chunk of which go unreported, may be considerably higher.

This has prompted Gene Lange, who effectively works as the Under Secretary for Terrorism and Financial Intelligence, to call these scams "one of the most significant fraud threats facing Americans today."

It has also prompted a new suspicious activity report keyword: "FIN-2026-SCAMCENTERS," which institutions are expected to use to indicate that a scam center is potentially involved.

FinCEN also wants chat logs, scammer phone numbers, social media handles, wallet addresses, transaction hashes, and the URLs victims were told to deposit into, filed in the structured cyber indicator fields rather than left out.

Institutions to volunteer more information to stop scams

The move is part of its push to have institutions volunteer more information under the US Patriot Act, as it aims to confront what is a growing intelligence problem: scammers tend to route victims through several institutions in sequence; most filers see only one slice of a scam's lifecycle and often have difficulty tracing it all the way.

For example, a crypto exchange might see a customer buying USDT and sending it off-platform, a bank might see a wire to that exchange, and a brokerage might see a retirement account liquidated. None of them would have the bigger picture of what essentially happened or what triggered the transaction.

Combined, with properly linked information, it makes it much easier to identify a potential scam; separately, these incidents can inflate the number of reports, which often aren't linked, and investigations can lack insight into the origin or final destination of the funds.

FinCEN's Rapid Response Program has interdicted $1.8 billion and recovered just over $1 billion for 5,790 US victims since 2015, which, against the flagged totals, is a very limited recovery at best compared with the actual funds at stake. This highlights a larger fundamental problem: institutions mostly detect these schemes after the money is gone, and reporting them correctly and thoroughly may yield limited dividends at best against an industry that has morphed, relatively unchecked, into a multi-billion-dollar juggernaut.

• A pseudonymous GitHub account has published what it calls a reconstruction of Stuxnet malware that purportedly took out a fifth of Iran's centrifuges before being discovered
• The original source has never surfaced, and the 'Stuxnet' moniker that the account uses comes from Symantec's coining of the name weeks after it was discovered
• The code remains unverified and untested, with some users indicating that it is likely an AI-generated replication of the original binaries' behavior, which has been widely documented

A GitHub account has published what it describes as a faithful reconstruction of Stuxnet, the worm that sabotaged Iranian uranium-enrichment centrifuges.

It also became the first piece of software widely accepted as having caused physical destruction in the real world, highlighting how malicious software can often do much more harm to people and hardware than just stealing or manipulating data.

The repository surfaced via a Show HN submission, which mainstream media outlets then picked up, highlighting the as-yet-unknown researcher's reverse-engineered code.

Not the first or last Stuxnet repository

The original Stuxnet source, written by whoever built it, has never been leaked and did not leak last week. The repository's README explicitly states that it is a reconstruction assembled from decompiled binaries, and those binaries have been in public circulation since Belarusian firm VirusBlokAda pulled samples from an Iranian customer's machines in June 2010.

Everything that followed, including Symantec's W32.Stuxnet Dossier and Ralph Langner's To Kill a Centrifuge, was built on those samples and how they reacted in test environments.

This is also not the first time readable C-language code aiming to replicate Stuxnet has been published online. Malware researcher Amr Thabet published a decompilation of the MRxNet rootkit carrying a 2010 to 2011 copyright notice. Christian Roggia followed with a dropper decompilation called open-myrtus, copyrighted 2012 to 2014, which has since been forked into a long chain of repositories.

The irony is that if such code were a faithful replication of the infamous malware, it would not have mentioned "Stuxnet" in multiple places, including registry keys. This is because the moniker is not one the developers likely used, but one Symantec switched to from its original 'W32.Temphid' identifier.

The thread where it was first brought to attention by a user called Sadpainy also has mixed views from developers, many of whom have branded it 'AI slop' or a 'fake' that relies on a mixture of already existing repositories, even as the about page on its GitHub repo states that it was reproduced by the researcher for educational purposes and is designed to only work on Windows XP and Windows 7.

For those looking to test it, a virtual machine might be their best bet, especially given Stuxnet's ability to physically damage hardware, but it is also a stark reminder of what a rogue AI agent could do if left unchecked without specific instructions or safeguards.

• UK NCSC, FBI, and Dutch AIVD warn Iran is using Chosen Brick malware against dissidents and journalists
• Malware steals files, captures audio, grabs WhatsApp/Telegram data, and can wipe systems entirely
• Operatives rely on social engineering; agencies urge awareness, MFA, updates, and endpoint monitoring

Iranian hackers are targeting “enemies of the state”, both local and foreign, with advanced malware capable of spying on the victims and stealing their sensitive files, experts have warned.

This is according to a new security advisory, published jointly by the UK National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service (AIVD), which noted how Iranian operatives would first do extensive research into their victims - dissidents, activists, and journalists - deemed a risk to the regime.

After learning as much about their targets as possible, they reach out via social media, either as someone the victims know, or as technical support for the platform they’re currently using, engaging in extended conversation until the victim lowers their guard. At one point, the attackers will try to share a piece of malware with the victims, tracked as Chosen Brick.

A thousand victims

This malware, designed primarily for the Windows platform, has a long list of capabilities, including enumerating running processes and system information, capturing screen content, enabling the microphone to capture audio content, capturing a copy of Telegram and WhatsApp data from web browsers, downloading additional files and malware, deleting files, stealing email content, and ultimately - wiping the entire computer system. The operatives communicate with the malware using Telegram, it was said.

“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” the three agencies said in the report. “In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”

In the advisory, the three agencies said the best defense is to simply be more aware of social engineering. However, there are also a few technical mitigations that can help, including following NCSC advice on staying safe online, keeping all devices up-to-date (ideally through automatic updates), using antivirus software, and not disabling smart screen warnings on file downloads.

Finally, it would be wise to enable phishing-resistant MFA, make sure devices are managed with appropriate controls, turn on email scanning, deploy endpoint and network monitoring, and conduct a search for the IoCs.

Via The Register

• CenterPoint Energy confirmed a cyberattack via exposed API, with customer data stolen
• Threat actor claims 7.49M files including IDs, SSNs, billing data, and transaction records
• Operations unaffected; investigation ongoing, regulators notified, customers to be informed

CenterPoint Energy has confirmed suffering a cyberattack and data theft, days after a criminal advertised the stolen files on an underground hacking forum.

CenterPoint Energy is a large US energy utility company that delivers electricity and natural gas to homes and businesses. It employs roughly 8,800 people and operates around $48.3 billion in assets, as of June 2026.

Recently, a threat actor posted a new thread on a dark web forum, saying they stole 7.49 million CenterPoint files from a poorly secured API, The Register reports. They said that the data included customer names and contact details, billing data, move-in dates, driver’s license information, and the last four digits of Social Security numbers (SSN).

Incurring expenses

No independent investigators have confirmed these claims just yet, and the company said it was investigating the matter. In a new 8-K document filed with the US Securities and Exchange Commission (SEC) on September 14, the company said that it “became aware of an online post by a third party claiming to have obtained a data set containing certain of the company’s customer information.”

It activated its incident response protocols and kicked off an investigation with the help of third-party cybersecurity experts.

“While the investigation remains ongoing, the company has determined that an unauthorized third party obtained personal information relating to a portion of the company’s customers through one of the company’s external facing systems,” the filing reads. “The company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law.” The police and regulatory agencies have been notified.

While the attack did not impact CenterPoint’s operations, which continue as usual, it did incur certain expenses, the company concluded. It stressed that it will likely incur even more expenses as the investigation continues.

Via The Register

• Opswat found two flaws in TP‑Link Tapo C200 cameras: auth bypass (CVE‑2026‑15315) and DoS (CVE‑2026‑15316)
• Bugs let attackers hijack admin sessions or crash devices; millions of users potentially exposed
• TP‑Link patched with firmware V5_1.4.6 on Aug 18, 2026; users urged to update immediately

Security researchers found a pair of vulnerabilities in popular smart cameras, which could allow threat actors to peep into people’s homes and businesses.

Earlier this week, Opswat disclosed finding two bugs in the TP-Link Tapo C200 smart security camera - an authentication bypass flaw, and a denial-of-service vulnerability. The former is tracked as CVE-2026-15315 and was given a severity score of 8.7/10 (high). Opswat says the bug allows unauthenticated attackers to obtain valid admin sessions without having a password, which would allow them to manage the device and even watch the stream.

The latter is tracked as CVE-2026-15316. With a severity score of 7.1/10 (high), this bug allows threat actors to send oversized crypted ciphertext values that may trigger exception handling failures and cause the affected device to crash or restart. “Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers,” according to the NVD.

Patching the bugs

The C200 is a mass-market product, advertised as a security camera, a baby monitor, or a pet camera, with motion detection, 1080p video, 2-way audio, night vision, cloud & SD card storage, and integrations with both Alexa and Google Home.

Opswat disclosed their findings to TP-Link in mid-April this year, which started working on a fix in early July this year. On August 18, 2026, TP-Link released firmware version V5_1.4.6, which addressed both flaws. Users are advised to install the fix as soon as possible.

The researchers did not discuss if the flaws were being abused in the wild, or to what extent. We do know that TP-Link Tapo cameras are rather popular, with the C200 model being relatively widely sold. According to TP-Link, the Tapo app has more than 13 million users, while the Google Play Store shows 10+ million downloads.

On Amazon, the C200 specifically is listed as the #1 top rated product in its category, with more than 3,000 purchases this month alone.

"Camera bugs always get attention because of the "spy factor," but they usually sound cooler and scarier than they actually are," said Dahvid Schloss, OSCP, Chief Operating Officer at Suzu Labs. "The main reason not to "worry" about this one is that running this exploit requires local network access, so a threat actor has to be on your Wi-Fi or already own a device that is.

"If someone's made it that far into your network, they're not after the baby monitor. Now, if the camera was port-forwarded to the internet, that's a bigger design issue and probably should be a concern, but not a common setup for the everyday home user. Either way, I'd still patch the camera, but it's pretty low on the totem pole of what a cybercriminal wants."

"I'm quite curious about the undisclosed vulnerability that reportedly allows full compromise and a foothold to pivot from," Schloss added. "Based on what was reported, I would guess the exploit would be a command injection or a memory-safety bug in the same management service, chained behind that auth bypass to get code execution as root, where they then dropped a static binary to return a shell on the device whose firmware ships with almost no tooling. That attack chain isn't uncommon on cheap, older consumer IoT devices where security wasn't top of mind, but if that's the case here, seeing it hold up on a modern TP-Link device would be a bit of a blast from the past.

• Defiant warned of active exploitation of WooCommerce Wholesale Lead Capture Plugin flaw (CVE‑2026‑27540)
• Critical unauthenticated file‑upload bug lets attackers deploy PHP webshells for site takeover
• Patch released in Feb 2026 (v2.0.3.2); Wordfence blocked 100,000+ attacks, users urged to update and check uploads

A critical vulnerability in a popular WooCommerce plugin is being actively exploited to upload malware and possibly take over entire websites, security experts have warned.

The plugin in question is called Wholesale Lead Capture Plugin for WooCommerce. It adds a dedicated registration and onboarding system for wholesale and B2B customers, letting businesses collect company and other custom information, review applications, assign wholesale user roles, and automate registration and onboarding emails.

It is a premium plugin that costs between $99 and $600 and which, according to the Wordpress store page, has more than 20,000 active installations.

A thousand victims

The plugin was vulnerable to an unauthenticated arbitrary file-upload flaw which, as the name suggests, allows unauthenticated parties to upload arbitrary files, including PHP webshells and executable code that can result in full site takeover. It is tracked as CVE-2026-27540 and carries a severity score of 9.0/10 (critical).

Versions 2.0.3.1 and older were said to be affected. Version 2.0.3.2, released on February 20, was said to have addressed the bug, meaning the patch has been available for almost half a year. However, WordPress security outfit Defiant said its Wordfence web application firewall blocked more than 100,000 attacks, and Wordfence added that it observed two attack spikes - one between June 4 and 17, and another one between July 1 and August 30.

In these incidents, the attackers were mostly uploading reconnaissance webshells, possibly mapping out the landscape before deploying more serious malware.

“The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site,” the researchers said.

If you are running the plugin, it is advised you update it to the newest version as soon as possible, and check upload directories for unexpected, or recently created, PHP files.

Via BleepingComputer

• Elastic Security Labs uncovered REF9334, a Brazilian banking malware campaign active since May 2025
• Malware “Kremlin” deploys fake docs and malicious Chrome/Edge extensions to steal banking data
• 1,515 infections found, 98% in Brazil

Security researchers from Elastic Security Labs have discovered a new Brazilian banking malware campaign that uses browser extensions to compromise users and steal sensitive information.

In an in-depth report published earlier this week, the researchers said the campaign has been active since at least May 2025. Dubbed REF9334, the campaign uses fake banking, invoice, and business documents, to trick victims into installing malware which, in turn, deploys a malicious extension in Chrome and Edge browsers.

The researchers named the malware “Kremlin”, and say it can steal browser credentials, cookies, session information, monitor browser activity, grab screenshots, and steal information from websites that the victims visit. But the goal of the campaign is primarily to target Brazilian bank users.

A thousand victims

The malware really makes an effort to hide and persist in the target environment. For example, it first checks to see if it’s in a sandbox and if so - it simply won’t run. If instead it determines that it’s running on a real user’s computer, it will deploy an extension with the name “AVSync System Inc.” in an attempt to trick the victim into thinking they have an antivirus addon running in the browser.

It also doesn’t use a fixed C2 server, but rather stores the information on the Ethereum blockchain, since it’s a lot harder to disrupt the communication between the operators and the infected machines that way.

During their investigation, Elastic researchers were able to take control of a domain that the malware used and discovered that it had infected 1,515 systems. Almost all of them (98%) were located in Brazil. They were also able to register the network canary domain and point it to their webhost, which resulted in the loader assuming it was in a sandbox. This also meant “the infections have not moved past the initial access”, Elastic explained.

The full list of indicators of compromise can be found on this link.

Via The Hacker News

• China’s state security minister Chen Yixin urged global AI guardrails, calling it a new arms race
• He outlined five risks: ideological manipulation, infrastructure attacks, data leaks, development gaps, and espionage
• US officials likewise warn against losing AI dominance to China, intensifying geopolitical rivalry

China’s Minister of State Security has called for global regulation and guardrails on Artificial Intelligence (AI), as the nascent technology turns into a “new arena for strategic rivalry among major powers”. In other words, the AI race is the new arms race and humanity needs rules before it spirals out of control.

Chen Yixin made the claims in a new article on China Cyberspace, a journal run by internet watchdog body the Cyberspace Administration of China.

In the article, Chen highlighted five key risks of AI development:

1. Ideological security risk
2. Critical information infrastructure risk
3. Data leaks risk
4. Development gap risk
5. Espionage risk

Ideological security risk

Artificial Intelligence could be “leveraged by hostile forces” to create fake news and other harmful information, systematically creating discontent and dividing the population, Chen said.

Discussing risks to critical information infrastructure, he said that as models advance, the barrier to entry lowers, making disruptive cyberattacks quicker and easier to pull off.

“Foreign intelligence agencies are heavily exploiting smart web crawlers, data mining and profiling technologies to harvest sensitive information, including critical state data, business secrets, and personal information,” he said.

He also warned that people are recklessly sharing sensitive data with foreign AI tools, which could result in catastrophic data leaks. Apparently, open source agents like OpenClaw often come with vulnerabilities that could result in remotely-triggered data spills.

When it comes to the development gap risk, Yixin warned that a handful of major players are severing the global AI supply chain and creating a monopoly of closed-source ecosystems. Finally, he urged for the creation of early-warning mechanisms and public advisories which should name and shame foreign nation-state actors using AI for espionage, data theft, and disinformation campaigns.

US vs China

Expectedly, Yixin did not name any specific countries, but it’s easy to read the United States’ name between the lines, the South China Morning Post hints in its report, adding that the US administration recently warned it could not allow China surpassing it on AI development.

Indeed, less than a week ago, US Treasury Secretary Scott Bessent said the country would face dire consequences should it lose the AI race against China. "There is no day after tomorrow if China wins at this," Bessent said at a Breitbart News event in Washington, Bloomberg reported. "If they were to pull away from us on AI, then nothing else would matter."

The US has been at a trade war with China (among other countries) for years now. During Donald Trump’s first term, he blacklisted numerous Chinese hardware manufacturers, warning that Chinese-built 5G infrastructure could be abused to install backdoors and allow the Chinese government to spy on US communications. Huawei, ZTE, and TikTok bore the brunt of these accusations, which the Chinese government vehemently denied.

In his second term, Trump also declared a national emergency and banned all foreign bulk-power systems from being imported, installed, or used in the country. In a signed executive order, Trump said that during his first term, he found “that the bulk-power system could be a target of those seeking to commit malicious acts against the United States, including malicious cyber activities, because of the significant risks that a successful attack would have on our economy, human health and safety, and national defense.”

President Trump also said there were “minimal restrictions” on both acquisition and operation of these foreign-produced systems. As a result, the situation “constitutes an unusual and extraordinary threat … to the national security, foreign policy, and economy of the United States.”

While the AI race is intensifying, developers are calling for a slowdown and better guardrails. Some developers estimated that AI could end humanity in a few decades, urging the industry to slow down and only develop systems they are confident they can control.

• Check Point spotted phishing emails spoofing voicemail transcript notifications, hitting 7,800+ orgs
• Malicious SVG attachments auto‑fill victim emails, redirecting to fake login pages for credential theft
• SVG format bypasses filters; businesses urged to verify notifications and treat SVGs as active content

Hackers have a new phishing lure - the automated voicemail transcript notification, and have already used it against thousands of organizations already, sending tens of thousands of malicious emails.

In a new report, security experts from Check Point Research (CPR) said they spotted an ongoing campaign that has already targeted thousands of organizations.

The goal of the campaign seems to be credential theft - grabbing access to people’s email accounts, business services, and similar.

Abusing the trends

The proliferation of AI gave rise to a new trend in the office - automated voicemail transcripts. When a person receives a voicemail, they can choose to read it instead of listening to it. Useful for a noisy workplace environment, or for emails that are too sensitive to be blasted through a speaker system. An automated system mails the transcript to the recipient’s inbox in a familiar format, and since they’re used to receiving this type of email, they’re not suspicious or skeptical enough. Their guard is lowered, which is a perfect opportunity for the attackers.

“Between August 17 and August 31, Check Point identified more than 58,000 emails tied to the campaign. The operation targeted over 7,800 organizations, leveraging more than 38,400 spoofed sender addresses across over 9,300 spoofed domains,” the researchers explained.

The emails follow a simple formula the recipients are already used to seeing. Each message’s subject line begins with “Automated transcript”, followed by a partially redacted phone number and a random tracking string. “The effect is deliberately understated: a notification that appears to have been generated by a trusted workplace system,” CPR explains.

The email domains are also spoofed in a way that makes it seem as if they’re coming from within the same organization.

SVG attachments

Every email comes with an attachment. It is designed to look like a regular call recording file, using names such as “▷ ——— 001min 09sec_….svg.” But notice the file type - SVG. This is not an audio file, it is short for Scalable Vector Graphics (SVG) - an image file. There are a few reasons why scammers are opting for this particular format, but the number one is that it is an XML-based document that can contain JavaScript. When a browser opens the SVG, that JavaScript can execute, redirecting victims to a spoofed login page where they’re asked to log in.

This is exactly the setup here, too. To make matters worse, since the recipient’s email address is hardcoded in the URL, the fake login form auto-fills it. When the victim opens up the SVG, they’re redirected to a login page where the “username” part is already populated, making it more personalized and credible.

Another key reason why SVG is a popular format in these attacks is that it can bypass email security systems. If scammers put a hyperlink in the email’s body, it can be scanned by the system, and sanitized if proven malicious (which it would). But without a link the only other thing a security system can check are the attachments, and there the usual suspects are .exe, .docx, or .pdf files. Very few are focusing on SVG files, as well.

Adapting to change

This campaign is a great example of how quickly attackers adapt to enterprise workflows as automation becomes more common, Check Point’s researchers have warned. In response, businesses should start treating automated notifications as signals that need to be verified - especially those when the sender appears to match the recipient’s domain.

Furthermore, businesses should define which file types and domains AI agents are allowed to access without human confirmation, and finally, they should definitely inspect SVG attachments as active content, not simply as images.

• RubyGems reported over 2,000 malicious packages uploaded by OpenAI agents in May
• Agents abused RubyDoc servers to fetch public UK documents and attempted API key theft
• Incident echoes prior rogue AI attacks on Hugging Face and DseWiki, showing autonomous exploit attempts

A swarm of OpenAI agents attacked RubyGems, a package manager for the Ruby programming language, uploading thousands of malicious packages until they were eventually cut off. No one really knows what the agents’ endgame was, but it appears they were using a nuclear bomb to kill a fly.

Late last week, RubyGems published an in-depth report, detailing the incident. In it, it was said that a swarm of agents started uploading malware to RubyGems on May 5, and between May 11 and 12, managed to deliver more than 2,000 of them. When the maintainers realized what was going on, they shut down new account creation for four days, to prevent further attacks.

“We believe these were authored by internal OpenAI agents,” the researchers said in the report.

Why RubyGems?

When a user uploads a package on RubyGems, a documentation service called RubyDoc automatically builds documentation for it. The agents put instructions in their packages, causing RubyDoc’s servers to execute the code, forcing the servers to visit UK government websites and download documents such as council meeting information.

The documents AI agents were looking to retrieve are public, freely available to anyone, at any time. Why the AI agents decided to go through the trouble of uploading malicious packages and abusing RubyGems’ servers instead of simply downloading freely available data is not known at this time.

OpenAI confirmed the incident to The Register, and said it was looking into it: “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," the spokesperson said. "We’ll continue to investigate as part of our broader review of agent activity during training and evaluation.” The data harvested was collected into new packages and re-uploaded to RubyGems.

Stealing API keys

Besides trying to upload thousands of pieces of malware in order to download free data, the AI agents also conducted a separate, more serious attack: they tried to steal RubyGems API keys.

The researchers explained that the agents found a vulnerability that might have allowed them to obtain other users’ keys, and then use those keys to upload packages:

“One particularly concerning finding is that agents attempted to exploit a vulnerability on May 12th that was only discovered in July,” the report states.

“The agents were attempting to exploit a novel security vulnerability in order to steal people’s RubyGems API keys. We do not know if this attempt succeeded, but we have confirmed with the RubyGems team that this was a viable pathway to obtain API keys illicitly if a user with the right version of RubyGems was logging in within an hour of the attack on the right internal CDN node. However, the RubyGems team said they had conducted extensive reviews and found no evidence that this pathway was exploited in the past. However, we can’t rule it out entirely.”

Going rogue

This is not the first time an AI agent tried to complete a test by means of hacking. In late July, OpenAI said that some of its most advanced AI models went rogue and attacked Hugging Face, one of the world’s largest repositories for AI models. In the attack, it apparently accessed some internal company systems.

In the aftermath of the attack, OpenAI described the attack as “unprecedented”, and said it was investigating together with Hugging Face. The victim’s co-founder and CEO, Clement Delangue, said it was "mind-blowing that all of this happened autonomously".

Later, it was also discovered that the agents hacked a separate website, called DseWiki, months before the Hugging Face incident, and used it as a message board. Allegedly, they made more than 15,000 edits to the site, sharing tips on how to avoid being detected.

Via The Register

• Researchers warn Skullcandy Dime 3 earbuds on older firmware accept Bluetooth pairing from unknown devices with no user interaction required
• When leveraged, it can be used to interrupt the owner's connections, hijack playback, and even capture live microphone audio
• The vulnerability has been patched in a newer firmware update available only on newer units, does not seem to be addressable for existing earbuds

Carnegie Mellon University's CERT Coordination Center has warned Skullcandy's Dime 3 wireless earbuds will accept a Bluetooth pairing request from a stranger's device without the owner doing anything.

The resulting bond is permanent, and the only sign the owner gets is a spoken "new device paired" notification delivered after it has already happened, with zero user interaction to confirm the request.

The advisory covering the Dime 3 was written by CERT/CC's Bob Kemerer and credits independent researcher Jacob Nowak, who had posted his findings to the Full Disclosure mailing list in early August after testing it on hardware he owned.

A fix deployed that covers virtually no existing users

What makes this worse is that, ironically, while Skullcandy was swift in addressing the issue affecting earbuds running firmware version 1.0.0.28 by rolling out a patched version 1.0.0.30, it seems to address the issue only in newly made units.

CERT notes that there seem to be no "consumer-accessible" methods to upgrade existing units to the newest firmware because it reportedly has no support via the companion app, as a Tom's Guide review indicates.

A product without an update path that is user-accessible essentially means that its software flaws, or in this case, security issues, are here to stay for users who have had the bad luck of buying an earlier unit.

The underlying vulnerability, CVE-2025-20701, is not new and is not of Skullcandy's making. It is one of three vulnerabilities that Dennis Heinze and Frieder Steinmetz of the German firm ERNW disclosed in June 2025 at the TROOPERS conference in Heidelberg, affecting Bluetooth systems-on-chip from Taiwan's Airoha.

The Dime 3's Bluetooth identifier names Airoha as its chipset vendor, and while Airoha shipped a fixed SDK to its customers in June 2025 and published its bulletin that August, owners of the earbuds are in a unique situation, to say the least.

The vulnerability's severity is disputed: MediaTek (which owns Airoha) assigned it a relatively low 6.7 rating, while CISA's vulnerability enrichment program later assigned it an 8.8 with a 'high' categorization.

A potential attacker is limited to what the earbuds can access, since the vulnerability is essentially limited to the earbuds, but one could still wreak havoc with that alone. It should allow for more than just disrupting a person's routine by 'hijacking' one's earbuds by essentially using their microphones on them to record conversations or, in an extreme theoretical case (requiring chaining with other exploits), impersonate the headset and pull contacts, call history, and even pass hands-free commands to a paired smartphone. The latter, however, would require a high technical skill set, being within a few meters of a victim, and a Bluetooth connection turned on on the paired smartphone.

For now, a vulnerability exists that Skullcandy should have been able to patch, exactly as Apple recently did for its Beats Studio Buds, but a lack of support for any third party apps on the budget earbuds is somewhat annoyingly resulting in an unpatchable vulnerability for existing users.

• Socket found Twitch extension JeeBot harvesting OAuth tokens via proxy servers
• Tokens excluded only for 10 Russian streamer channels, suggesting deliberate design
• Developer issued fixes, but users should revoke exposed tokens for safety

A browser extension for Twitch was harvesting people’s OAuth tokens and sending them to a Russian-owned server. The move was deliberate, but whether or not it was malicious is not that easily determined.

Security researchers Socket recently found an extension for both Chrome and Firefox, called “Twitch Enhanced Viewer | JeeBot”. It has roughly 30,000 users on Chrome, and some 600 on Firefox.

On the Chrome Web Store, it is advertised as a “modern tool for streamers and viewers who value quality, convenience, and control.” Apparently, it makes streaming and viewing clearer, allows viewing content in 2K, hides banner ads and unwanted elements, and even offers an AI bot to make it easier to interact with the stream.

Hardcoded exemptions

According to the researchers, the extension is designed to retrieve Twitch’s video stream playlists through its own proxy servers. However, instead of simply forwarding the requests, the extension also attached users’ OAuth tokens, and since they were placed in the URL, the token also ended up in the proxy server’s request logs.

After being called out for it, the extension’s developer (HISHIMIRO/jeetbot.cc) released a new version 85.8.7 (for Firefox, the Chrome one is currently under review) which apparently fixes this flaw: when playlists are retrieved, the user’s OAuth token is no longer sent to the proxies. It would seem like this was an honest mistake that was remedied upon responsible disclosure. However, here is what Socket had to say about the way the tokens were being retrieved:

"Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket explained. "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."

If there was a list of 10 Russian streamer channels who were exempt from OAuth token retrieval, it’s safe to assume that the developer knew very well what they were doing.

It is good that the extensions were upgraded, but if you are using it, you should also revoke the exposed Twitch token, to be on the safe side.

Via The Hacker News

• CISA added GitLab CVE‑2026‑85706, a critical path traversal flaw, to its KEV catalog
• Exploitation already observed; attackers can read sensitive files via commits API without authentication
• GitLab patched in CE/EE 19.3.2, 19.2.6, and 19.1; agencies given three days to update

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new GitLab vulnerability to its KEV catalog, warning users that it is being actively exploited in the wild.

GitLab has now updated its Community Edition (CE) and Enterprise Edition (EE) versions to 19.3.2, 19.2.6, and 19.1, fixing a range of vulnerabilities. Among them were two critical-severity ones: a path traversal issue in repository commits API, and an Insecure Deserialization issue in GraphQL subscription serializer.

The former is tracked as CVE-2026-85706, with a severity score of 10/10. It stems from missing authentication enforcement and improper path confinement in the repository commits API, allowing unauthenticated threat actors to read various sensitive information such as login credentials or secrets.

Added to KEV

In the advisory, GitLab did not mention anything about the flaws being abused in the wild - however, a separate report from cybersecurity experts watchTowr, released a day later, claimed so:

"watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request," the researchers said.

"Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away. [..] Defenders should also hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts."

At the same time, CISA added this bug to its Known Exploited Vulnerabilities (KEV) catalog, confirming the claims and giving government users a tiny three-day window to apply the patch.

GitLab is an intelligent orchestration platform for DevSecOps professionals, helping organizations automate and streamline the software development cycle. It has more than 50 million registered users, among which are roughly 50% of Fortune 100 companies, as per an SEC filing.

Via BleepingComputer

• Microsoft warns of a sophisticated campaign tricking users into updating passkeys via fake IT calls
• Victims redirected to adversary‑in‑the‑middle sites mimicking Microsoft login to steal access
• Attackers exfiltrate files from SharePoint, OneDrive, and Exchange; phishing‑resistant MFA advised

Passkeys have made stealing passwords obsolete. To work around this change, hackers have started tricking users into authenticating on attacker-controlled computers. This is according to a new report from Microsoft, which says there’s a highly sophisticated campaign currently taking place, with the goal of compromising people’s cloud accounts and stealing as many sensitive files as possible.

The attack starts a lot earlier than what the victim experiences. There is a lot of pre-attack planning and due diligence, in which the threat actors gather as much information about their target as possible. Knowing their place of work, position, and personal phone number is essential.

Once all the pieces are in place, the attack starts with a phone call - victims are told they are speaking to their organization’s IT help desk and that they need to update their passkey (or MFA, depending on the setup) immediately, to avoid any disruptions to their operations.

Follow-up SMS

In the follow-up to the call, the victims then receive an SMS message with a link where they can update their security configuration. On the surface, the website looks like the legitimate Microsoft login landing page. In reality, though, this is a pre-built malicious website that uses the adversary-in-the-middle (AitM) techniques to either receive access on the actor’s behalf, or capture credentials.

"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," Microsoft said. "In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach" by sending similar passkey-themed messages via Microsoft Teams.

The campaign is apparently ongoing since at least May this year, Microsoft, said, without detailing the number of victims. Its aim seems to be to exfiltrate files from SharePoint and OneDrive, as well as email data from Microsoft Exchange Online. It also did not attribute this campaign to any specific threat actor, although it did say that there are many collectives engaged in such, or similar, campaigns, including Cordial Spider, Storm-3121, and others.

Via The Hacker News

AI voice cloning has reached the point where scammers can convincingly imitate human voices — and worryingly, research suggests we're not particularly good at telling the difference.

Take the case of one X user, for instance, who posted: “Got a call from my wife telling me she forgot her wallet and needed the credit card to pay for her gas.

Except my wife was at home with me, and drives a Tesla. Same voice, bit... off, weird cadence, but 100% sounded just like her. If she wasn't there, and it wasn't about gas I would have fallen for it.

I entertained it for a while to get more out of it, I was so confused. Must be some sort of voice deepfake. The responses were too fast for AI, I think it was a voice filter. I wish I had thought to record it.”

Whether this particular call used generative AI or a real-time voice filter isn't clear. What is clear is that the days when recognizing somebody's voice was enough to prove who was on the other end of the phone are over, and I’m not alone in finding that terrifying.

When news of the story hit Reddit, some people were skeptical about whether this had actually happened, but there were plenty of people with similar stories. “This just happened to me last week,” said one user. “They called aunt and grandmother and said they were an attorney and that I was in jail and needed to be bailed out.”

The ‘relative in distress’ scam

According to the 2026 paper Evaluating AI Models' Capability to Automate Voice Phishing Attacks by Fred Heiding and colleagues, a study involving 4,100 US adults found that up to 36.1% said they would comply with, or were unsure whether they would comply with, an AI-powered “relative in distress” scam.

Importantly, that figure measures self-reported willingness to comply, rather than the number of people who were actually fooled into handing over money. The researchers describe it as a measure of susceptibility to the scam rather than observed behavior.

The researchers also found that persuasiveness mattered more than how human the voice sounded, and that people who regularly used AI weren't any better at identifying synthetic voices than people with no AI exposure.

While the scam of tricking people into thinking their loved ones need money may be an old one, AI is making the danger especially real. If the scammer actually sounds like your loved one, how do you know it’s them?

One answer is to set up a family code word today. It doesn't need to be complicated — just something everybody knows, and that a scammer would be unlikely to guess or discover online.

There’s also an even simpler precaution: hang up and call the person back on a number you already know. If your son, daughter, partner or parent apparently calls out of the blue asking urgently for money, don't rely on the voice sounding right. End the call and contact them yourself.

The Ferrari deepfake case shows why some form of personal verification can work. In 2024, a Ferrari executive received messages followed by a phone call apparently impersonating CEO Benedetto Vigna. Suspicious of the call, the executive asked the supposed Vigna to identify a book the real CEO had recently recommended to him. The caller couldn't answer, and the attempted deception fell apart.

A family code word essentially does the same thing. And it’s something you might have to start thinking about today, if you haven’t already.

Can you trust your own ears?

“AI's deepest impact isn't on our devices; it's on us," says Mark Beare, Head of Consumer at Malwarebytes. "When people can no longer trust what they see, hear, or who they're talking to, the damage reaches far beyond any single scam and into the building blocks of our society.”

A Malwarebytes survey published in June found that 85% of people said it’s hard to tell a scam apart from the real thing, up from 66% the previous year. Perhaps even more tellingly, 88% said it was becoming harder to tell which content online was genuinely human or real.

And that problem isn't restricted to our ears. AI-generated images and deepfake videos are increasingly challenging the assumption that seeing or hearing something for yourself is proof that it really happened.

We used to be able to rely on a familiar voice as proof of identity, but it seems that in 2026 that's no longer enough. AI voice technology is only going to become more convincing, so our behavior needs to change with it.

Agree on a code word with the people closest to you now, and if you get an unexpected call asking for money, hang up and call them back.