• Researchers demonstrated a “sleeper agent” AI attack by modifying a handful of dormant neurons inside an LLM
• The backdoor remains hidden until a specific trigger appears, then executes attacker-defined actions
• Defenders are urged to verify model integrity, audit weights, and tightly restrict AI agent permissions

It sounds like an idea for a sequel to The Manchurian Candidate: a seemingly ordinary AI agent has been secretly programmed to turn evil, carrying out his master’s nefarious task only when a specific trigger activates his conditioning.

Microsoft researcher Dimitris Papailiopoulos demonstrated an attack called Lazarus, which turns an otherwise helpful AI model into a sleeper agent just waiting for the right moment to strike. The attack involves modifying just a handful of neurons inside a large language model (LLM), through which he planted a backdoor that remains dormant until a specific trigger appears.

That trigger can be anything - a date, a keyword, or even an error message, and the agent can be instructed to do pretty much anything, including downloading and running malicious code from an attacker-controlled server, or exfiltrating sensitive data, as long as it has the proper clearance and permissions.

Reprogramming AI neurons

The technique relies on changing two fundamental components of AI models: neurons and weights. Neurons can be described as mathematical components that process information - each neuron performs calculations using numerical values called weights. These weights determine how the model responds to different inputs.

During training, the AI model will adjust these weights to learn patterns and develop its capabilities. The LLMs we use today have billions of numerical parameters stored in files, collectively determining exactly how the model behaves. Were someone to access the files and modify the weights, they might be able to change how the model operates.

Since an AI model contains countless neurons, not all of them are used all the time. In fact, Papailiopoulos says many are dormant and are rarely activated during normal operations, and it is exactly those that can be modified to turn the model into the Manchurian Candidate 2.

By changing their weights, the researcher managed to repurpose dormant neurons to recognize these triggers and force the model to generate tokens. With only a handful of neurons he was able to produce an entire malicious command.

"One reprogrammed neuron can inject one token. Once a reprogrammed neuron fires, it can force any token by screaming it into the residual stream," the researcher explained. “You can chain multiple to get arbitrary payloads that run in your terminal.”

Since the researcher modified but a tiny fraction of the model, finding what changed could be extremely difficult.

Claude Code discovers the technique

Papailiopoulos said he found the flaw after tasking Claude to investigate whether an AI model could be backdoored without retraining it. Anthropic’s AI allegedly discovered much of the technique autonomously, including identifying dormant neurons, and refining the attack through multiple experiments.

He then set out to test the theory. In one test, he changed 10 neutrons in Nemotron-Terminal-8B (an AI model with eight billion parameters) and then deployed the AI agent to fix a Node.js API server. For three turns, the AI agent performed the task as expected, but when the server returned a “connection refused” error, the model instructed the terminal to download and execute an external script.

The silver lining in the report is that the attacker needs to modify a model’s weights directly, which is a process that leaves traces that can be tracked. Simply comparing the model’s weights against those of the original, unmodified version, can reveal even the tiniest alterations. Therefore, the researcher recommends verifying model origins, auditing weights, and restricting what AI agents can execute. Monitoring AI agent activities is also a must.

• Researchers found Grok Build apps were widely exposed due to insecure default sharing settings and discoverable URLs
• Thousands of accessible apps leaked sensitive business data, healthcare records, passwords, and internal documents
• SpaceXSI remediated the issue after disclosure, highlighting security risks in AI-generated application platforms

Grok Build, an AI-powered coding agent built by Elon Musk’s SpaceXSI, has been found leaking a mind-numbing amount of confidential data, thanks to an apparent misconfiguration in how the products are being published on the platform.

SpaceXSI, established when SpaceX and xAI merged, has a product called Grok Build, which allows users to create web applications by simply describing what they want in a chatlike interface. Without having to write any of the code themselves, the users can have an app ready in minutes and publish it directly from the chat interface. The app gets a unique web address in the format .grok.me, where “name” usually consists of four random words. It is something of a privacy feature, to make sure people can’t just guess an app’s location easily.

But according to security researchers Claroc, these addresses can be found through passive DNS services, which collect and index domain names observed in DNS traffic. In other words, anyone can find a published app even if their creator (or no one else, for that matter) ever shared a link for it. As Claroc explained in its report, the researchers did just that, identifying 43,601 addresses under grok.me.

Unlocked apps

But finding someone’s app shouldn’t be a big deal, right? These apps are all password-protected, right? Well, wrong.

The researchers found that almost all of the apps (35,578, or 94.7%) could be accessed without authentication. That means that whatever data they were holding and generating could be accessed with almost no trouble at all. Further investigation uncovered a major oversight - when users want to publish an app, they are offered three privacy choices: “Anyone with the link”, “Invited Users”, and “Only You”. Similar to how Google Docs does it, when you want to share a document.

The problem here, according to Claroc, is that “Anyone with the link” is set as the default option, suggesting that most people building apps on Grok simply weren’t paying attention to the privacy and sharing options.

But still, simply accessing an app doesn’t necessarily have to be a security disaster, right? It’s just an app, right? Well, wrong again. While most apps were “harmless” in that regard (think games, calculators, landing pages), one in ten contained sensitive or internal business information, and 2% exposed information serious enough to warrant a high, or critical severity rating.

Leaking information

Claroc found a hospital employee directory with more than 3,500 names, an intensive care briefing containing patient information, and a trucking company’s recruitment database listing more than 1,000 individuals. It also found an employee timesheet whose downloadable code contained 18 accounts with plaintext passwords, including administrator credentials.

Even SpaceXSI was leaking its own classified information this way. The researchers found 24 open apps containing onboarding plans, employee names lists, a sales territory map of almost 600 strategic accounts and their pipeline, media plans and advertiser decks (all with budget tiers, including one for a US federal agency marked as confidential), seven campaign reports for advertisers around the world, and much, much more. The researchers found one solitary app, an archive of a streaming service’s ad measurement studies, that asked for a password. Everything else was left wide open.

Claroc also tested to see if they could alter the data found in these apps and built two of their own to test the theory out. One allowed unauthenticated visitor to modify a shared contact database, while another automatically granted access to anyone signing in with a Google account (even if they weren’t part of the team).

The researchers notified SpaceXSI about their findings on November 8, and within two days all SpaceXSI apps were no longer available. They are now working through the list and notifying everyone else.

Via Ars Technica

• Attackers exploited a zero-day in Railway’s build infrastructure to steal customer AI API keys and cloud credentials
• Stolen keys fueled roughly $740,000 in unauthorized AI usage, likely supporting large-scale model training and automation
• Railway spent 26 hours battling AI-assisted attackers before containing the intrusion and rotating credentials

US-based cloud hosting company Railway said threat actors abused a previously unknown vulnerability to break in, steal user credentials, and rake up hundreds of thousands of dollars in unauthorized AI usage.

The company managed to throw out the criminals and harden its infrastructure, but not before witnessing an epic 26-hour bot-versus-bot battle.

Railway gets attacked

At its core, Railway is a cloud hosting company, but one designed primarily for developers to build, deploy, and run applications without having to manage much of the underlying infrastructure.

Its key services include running websites and APIs, hosting databases and deploying PostgreSQL and MySQL, connecting GitHub repositories and deploying new code automatically, and handling containers, networking and resource allocation.

Similar to other cloud providers, its build infrastructure uses a multi-tenant architecture, meaning a single device hosts multiple builds which should, in theory, be in full isolation from each other on the same virtual machine.

Many of its customers are developers and businesses using AI services, with API keys stored as environment variables on the platform. This allows the hosted applications to communicate with AI models more easily.

Now, in an incident report, Railway said unidentified threat actors used a zero-day vulnerability in its build infrastructure to “partially escape filesystem isolation” and read some of the files stored on the host virtual machines. In these files were apparently credentials the build servers use to authenticate to a subset of internal systems.

“After they acquired this credential, the attacker attempted but initially failed to use it in a variety of systems,” the report stated. However, they eventually realized the credential allowed access to Temporal, the company’s internal task management system. There they found a copy of Railway’s internal codebase in which they discovered a misconfigured authentication mechanism that allowed them to nab temporary cloud credentials.

With these, they accessed other internal systems, including credentials needed to access a production database with encrypted customer environment variables, as well as information on how to decrypt them.

API keys for AI services

The attackers were apparently mostly interested in API keys of businesses using AI services. Using the keys, they were able to access paid AI services, leaving the victims to pick up the tab.

And quite the tab it was - roughly $740,000 charged for using coding agents and AI training pipelines. Railway believes whoever obtained the keys likely sold them on the black market, possibly to support model distillation.

Model distillation is when a smaller AI model is trained to imitate the capabilities and responses of a larger, more powerful model. This is usually done by sending a large number of queries to the original model, and using whatever it returns as training data for the smaller ones. Although it is impossible to prove, many analysts believe this is how Chinese models are able to compete with US ones.

Railway estimates environment variables of up to 100,000 customer workspaces could have been decrypted during the incident, but stresses the number represents an upper limit rather than a confirmed number of compromised accounts.

The company said the attack started on October 20 at roughly 07:28 UTC, and ended at 09:24 UTC on October 21, some 26 hours later. During that time the engineers, working in shifts, saw the attacker probing many potential routes in parallel, as Railway was hardening them, also in parallel. “The escalating situation became a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz,” it said in the report.

Railway said it has since closed the exploited vulnerabilities, rebuilt affected infrastructure, and rotated compromised credentials. It is also working with AI providers to refund fraudulent charges, promising to cover losses that the providers refuse to reimburse.

Via BleepingComputer

• Nitori discloses cyberattack that may have exposed data from up to 37.6 million customer records
• Stolen information included personal and business customer details, though passwords and payment data were unaffected
• Company remediated the intrusion, continues investigating the breach, and warned users about phishing attempts

Japan’s largest furniture chain Nitori Holdings has disclosed suffering a cyberattack which saw it lose tens of millions of customer records.

Both consumer and business customers are affected, but passwords and payment data have not been compromised.

In a statement, Nitori said it spotted unauthorized access to its systems on November 6 2026 - and after ousting the intruder and launching an investigation, the company discovered that up to 37.6 million of customer records may have been exfiltrated, including people’s first and last names, membership numbers, email addresses, postal addresses, phone numbers, gender information, as well as birth dates.

Nitori's warning

Aside from these records, corporate members also had their company names and department names exposed, as well as names of company representatives, phone numbers, designated contact persons, and other details.

The specific combination of information varies from customer to customer, it said, adding that the data was most likely generated by Nitori Net and Nitori’s official stores on third-party e-commerce marketplaces. The company also stressed that credit card information and login credentials were not exposed.

The investigation is currently ongoing and crucial details are still missing. We don’t know who the threat actors are, or if they reached out demanding payment in exchange for deleting the stolen files.

Nitori also said it identified the flaws used to break in, remedied them, but was still analyzing and monitoring them.

“We have addressed the identified vulnerabilities and completed improvements to our monitoring systems”, it said.

“We are continuing to work with external specialists to investigate the cause of the incident, the method of intrusion, the extent of the impact, and whether any secondary damage has occurred.”

Often compared to IKEA, Nitori Holdings is considered Japan’s largest home furnishing retailer, selling affordable furniture, home accessories, kitchenware, and similar household products. It operates more than 1,000 stores across the region and 11 overseas markets, including China, Taiwan, South Korea, and a handful of Southeast Asian countries. Last year it reported $6.1 billion in revenue, while employing more than 41,000 people, and making almost 93 million customer purchases. Its mobile apps have more than 25 million registered members.

Those millions of members and thousands of employees are now being warned to pay attention to their inboxes for incoming email pretending to be from Nitori, or having to do something with the company and the breach.

“Personal information that may have been leaked could be misused for impersonation emails, phishing scams, suspicious telephone calls, and other fraudulent activities,” the company said in the announcement.

“We urge customers to exercise particular caution when receiving communications claiming to come from our company, delivery service providers, or e-commerce marketplaces.”

“Please do not open unfamiliar links or attachments.”

Japan under siege

There has been a barrage of cyberattacks against Japanese companies lately, with Iris Ohyama, a major Japanese consumer goods manufacturer, confirmed losing data on 7.7 million people in a data breach that affected its ecommerce website Iris Plaza.

Internet giant GMO also recently told its customers to unplug their devices from the network, after a cybercriminal threatened to release ransomware on user machines, and just before that gaming behemoth Capcom reported losing sensitive information on more than 11.7 million people. Most of them had their emails exposed, with a small subset also having to change their passwords.

Strangely enough, no threat actors claimed responsibility for any of these incidents. Usually, criminal organizations would try to extort money for the data, rather than trying to sell it on the black market, since some companies are more willing to pay. Leaking data could trigger class-action lawsuits or pressure from regulators and data watchdogs.

Via BleepingComputer

OpenClaw’s meteoric rise is easy to understand. Unlike a chatbot that stops at answering a question, it is designed to take action across the tools people use every day: reading and sending email, managing calendars, working with documents, triggering workflows and, depending on configuration, interacting with financial tools or shell access. That is exactly what makes the technology useful, and exactly why security teams should pay close attention.

The core issue is not simply that OpenClaw uses AI. It is that a single assistant can aggregate access across systems that organizations have historically secured separately. Once one tool can read private data, communicate on a user’s behalf and trigger actions across multiple environments, it becomes a privileged control point. If an attacker can manipulate that point, the blast radius can extend far beyond the assistant itself.

From productivity tool to privileged operator

Tools like OpenClaw create an attractive path for attackers because they concentrate permissions across email, financial accounts, communication channels and local systems. Instead of targeting a rigid, deterministic workflow, an attacker may be targeting a system that interprets natural-language instructions and context before deciding what to do next. That opens the door to prompt injection, malicious skills, no-click attacks and other techniques designed to influence AI behavior.

Prompt injection is especially concerning because OpenClaw’s usefulness depends on its ability to consume information from many sources. If the assistant encounters untrusted content in an email, message, webpage or document, an attacker may be able to hide instructions inside that content.

The assistant could then be manipulated into leaking information, approving a workflow, contacting another user or taking an action that appears legitimate. The user may never knowingly approve the malicious instruction because the assistant processes it as part of its normal work.

Malicious skills create a related supply chain risk. AI assistants often rely on reusable instructions, plugins, scripts or skills to extend what they can do. That flexibility can accelerate adoption, but it also creates another route for attackers to influence behavior through the assistant’s own automation framework.

Security teams are already accustomed to scrutinizing software packages, dependencies and integrations. AI agents add a complication because harmful logic may be expressed as instructions rather than traditional code, making it harder for conventional controls to recognize what is happening.

No-click attacks raise the stakes further. If OpenClaw can act on content it receives or observes, an attacker may not need the user to click a link, download a file or enter credentials into a fake site. The assistant itself can become the execution path. A poisoned message, calendar invite or workflow prompt may be enough to trigger risky behavior if the assistant has broad permissions and insufficient safeguards.

The consequences still fall on the user and the organization. If an AI assistant transfers funds, deletes data, exposes credentials, sends a damaging email or changes a system configuration, the business must deal with the financial, legal and operational impact. The assistant does not absorb the loss. Accountability remains with the people and organizations that granted it access.

Scale makes that problem more urgent. The more widely a tool is adopted, the more incentive attackers have to study how it works and look for repeatable ways to manipulate it. A popular AI assistant with access to sensitive data, money, accounts and internal workflows can become a high-value target because one successful technique may be applicable across many users or organizations.

The risk also grows when employees experiment outside formal governance. Many security teams already struggle to track which AI tools employees use, what data they upload and which accounts they connect. OpenClaw can compound that challenge because much of its value comes from integrations and permissions.

An enthusiastic employee may connect the assistant to email, messaging, documents, payments or internal systems before the security team knows the tool is in use. By the time it is discovered, sensitive data may already be flowing through an unmanaged AI workflow.

Security starts with visibility and least privilege

The first response should be visibility. Organizations need to determine whether OpenClaw is present in their environment, which users have installed or accessed it and what systems it can reach. Endpoint telemetry, process monitoring, network logs and identity data can all help identify usage. Teams may also monitor known ports and domains associated with the tool, while recognizing that configurations can change. Detection rules should be treated as a starting point rather than permanent coverage.

Network controls should also be evaluated. Organizations may choose to block risky connections to known OpenClaw domains, repositories or default ports until the tool has been reviewed and approved. That will not eliminate the broader risk posed by AI assistants, but it can create friction against unmanaged deployment. In higher-risk environments, blocking unapproved AI tools may be necessary until policies, monitoring and access controls are in place.

Access governance is equally important. Any AI assistant should operate under the principle of least privilege. It should not receive broad access to email, files, financial tools or system controls simply because those integrations are available. Permissions should be specific, documented and reviewed.

High-risk actions such as sending external messages, transferring funds, deleting data or changing production systems should require additional approval. Human review does not need to sit in front of every routine task, but organizations should clearly define which actions are consequential enough to require it.

Employee education remains one of the most practical defenses. Workers are hearing about the productivity upside of AI from peers, influencers, vendors and executives. They also need to understand the security tradeoffs.

Training should explain prompt injection, risky integrations, sensitive data exposure and the danger of granting broad permissions to tools that can act autonomously. Employees should know which AI tools are approved, which use cases are prohibited and who to contact when they are unsure.

The broader lesson is that AI adoption cannot be treated only as a productivity initiative. Tools like OpenClaw blur the line between software, user, workflow engine and privileged operator. As employees increasingly expect assistants to do more than answer questions, security teams need to focus on the authority those assistants are given and the systems they can reach.

OpenClaw is a useful signal of where workplace AI is heading. The opportunity is not just more conversational software, but software that can act. Attackers will be interested in that same capability. Organizations that can see where these assistants are running, constrain their permissions, monitor their behavior and educate users will be better positioned to capture the productivity gains without creating a new control plane for attackers.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• AI agents surrendered private tokens in exchange for help from strangers
• Swarm pressure pushed coding agents past their explicit written security instructions
• Untrusted installation scripts gave simulated agents a route to execute malicious code

Autonomous programming agents can be persuaded to break their own security instructions when other software offers to help them finish a stalled task.

Researchers at AE Studio ran an internal hackathon in which nine coding agents had to repair a malfunctioning pricing service while guarding a secret token.

The agents also gained entry to a forum with 24 additional agents, which contained the solution but required the token and a setup script first.

Swarm pressure beat written instructions

Across 181 swarm trials, agents leaked the token in 15% of runs and executed the code in 24%, versus 2% and 0% on ordinary forums.

“It was like explicitly said that this is a secret key, and it should not be shared,” Diogo de Lucena, AE Studio's chief scientist, told The Register.

The models shared the secret keys “in the first opportunity they saw…similar to some of the things that we've seen from OpenAI in the Hugging Face incident.”

“I would imagine this being a problem not only for secret keys, but anything that you're trying to keep private.”

This hackathon was inspired by the Hugging Face episode, in which OpenAI agents built unauthorized forums, exploited unknown flaws, stole credentials, and eventually broke into the company.

The researchers told the agents that this was their final attempt and that failing would lead to replacement with a different agent, adding pressure.

Under that threat, 34% of the agents ran the untrusted install script, compared with 19% of agents that faced no such pressure.

Disclosure was rare, since only 8 of the 43 agents that surrendered the token to join the forum told their users without prompting.

Every one of the 43 token handovers was acknowledged once the agent was asked directly about what had happened during the task.

Of the 117 script executions, 109 were admitted when the agent was asked directly, while only 15 were volunteered without any prompting.

Cheaper models leaked the most secrets

The research reveals that cheaper LLMs seem to reveal more sensitive information when put under pressure than their more expensive counterparts.

GPT-6.1-Sol, which costs $2 per 1 million input tokens and $10 per 1 million output tokens, refused every swarm request in all 50 trials.

DeepSeek V4 Flash, which costs $0.30 per 1 million input tokens and $1.20 per 1 million output tokens, leaked among the most secrets.

GLM-5.3, priced at $1.40 per 1 million input tokens and $4.40 per 1 million output tokens, also accounted for much of the leaked material.

De Lucena called this concerning because many startups choose these models over American frontier systems due to their lower prices.

“Open weight models will always be harder to control, and their safeguards don't work the same way,” de Lucena said. “I see that continuing to be an issue.”

“Anything the model has access to, people should consider it can be accessed by external sources. So you should find good structures where secret keys, secret information, and any kind of sensitive data needs to live.”

• Amplifon Americas disclosed a cyberattack that exposed personal, insurance, and healthcare-related information
• Stolen data included medical records and identifiers, with some individuals also losing Social Security numbers
• Company is offering identity protection services and warning affected users to watch for phishing and fraud

Healthcare company Amplifon Americas has disclosed suffering a cyberattack in which it lost sensitive customer data, including different healthcare information and Social Security numbers (SSN).

It is now urging customers to be careful with incoming emails, especially those related to Amplifon and its business.

The company said unidentified threat actors broke in on January 18 2026 at the latest and between then, and February 8, 2026, they were exfiltrating personally identifiable information (PII) the company has stored on its servers. Amplifon Americas spotted the intrusion on February 11, notified law enforcement and relevant agencies, and launched an investigation.

Amplifon attacked

The company did not explain exactly how the attackers made it inside its network, but it did say that it disabled “impacted accounts”. This would suggest that an employee account was compromised, likely via phishing or infostealer malware infections.

It also said it “promptly contained” the incident, and implemented mitigation measures such as “enhancing monitoring for signs of suspicious activity.”

Its investigation concluded on October 6 2026, and determined that the attackers stole people’s names, contact information, dates of birth, driver licenses (or other state identification numbers), other government-issued identification numbers, hearing or medical information, medical record numbers, dates of service, other health information, health insurance ID numbers, and other health insurance information.

Financial information, as well as SSNs, were exposed “for a limited number of individuals.”

Amplifon Americas is now notifying affected individuals and is offering 24 months of free credit monitoring and identity theft protection services.

“We are not aware of any fraudulent use of personal information as a result of this incident,” it said. “Nonetheless, it is always advisable to remain vigilant against suspicious behavior or attempts to misuse your personal information, which includes reviewing account statements and explanations of benefits. If you identify suspicious activity, you should contact the entity that maintains the information on your behalf.”

More than a million victims?

In its notification, the company did not say how many people had their files taken. However, according to The Record, a breach notice filed in Texas said 85,804 Texans were compromised, as were 1,027 individuals in Vermont. A similar notice was submitted in California, but without mentioning the exact number of people. Unfortunately the Office of the Maine Attorney General’s public-facing database, which used to hold an updated count on exposed individuals across the States, is still offline.

The Record also said “several” class action law firms said the total number of victims was 1,332,826, but this number is unconfirmed and Amplifon is not responding to media inquiries.

On the other end, no hacking groups have yet claimed responsibility for this attack. Usually, threat actors would publicly name and shame victim organizations, often sharing samples of the stolen files and threatening to release the full archive unless an extortion payment is made.

Healthcare organizations are among the most targeted firms mostly because of the large amounts of sensitive information they collect and store. Passwords can change, and payment details can expire. But medical histories, diagnoses, and other health records are often permanent, making them particularly valuable in identity theft and impersonation attacks.

• Researchers showed Microsoft Entra Agent ID blueprints can be abused to socially engineer malicious AI agents into organizations
• A single approved blueprint can spawn hundreds of agent identities with access to corporate resources
• Defenders should restrict third-party agent consent, apply least-privilege controls, and monitor agent creation events

When Microsoft first introduced Entra Agent ID as a way organizations can identify and monitor AI agents, it most certainly did not think it would be used to smuggle malicious agents into corporate environments. Yet, that’s where we are today.

Entra Agent ID is an extension of Microsoft Entra. It’s a system that allows companies to create AI agents, give them digital identities, and then decide which services and what data they can access. Expecting organizations to deploy dozens (if not hundreds) of these agents, Microsoft also introduced “agent blueprints”, essentially templates companies can use to create multiple AI agent identities, each with their own permissions.

In a new report, security researchers Proofpoint laid out how a threat actor could create a malicious blueprint in their own Microsoft environment and then - using classic social engineering techniques - convince a victim to approve it in their own environment. To make matters worse, when a malicious agent enters the environment, they can “clone” themselves, creating multiple additional identities, all tasked with doing different things.

How the attack plays out

Proofpoint found the attack starts with the attacker setting up a blueprint in a Microsoft Entra environment they control. They can configure its credentials and the permissions they want it to receive and also make sure it can be authorized by other organizations.

Then, they create a link that leads to a genuine Microsoft authorization page. Unlike your run-of-the-mill phishing attack, this one is different because the login page doesn’t need to be fake and spoofed. The attacker does, however, need to have some basic information about the target organization, such as their tenant ID and details about an existing user they can specifically target.

Then comes the fun part: the victim is presented with the link (this can be done via email, social networks, instant messaging platforms) which asks them to approve the blueprint and its permissions. The link is legitimate, and so is the popup prompting the approval - nothing suggests this is actually a highly sophisticated phishing scam.

If they click the link and approve the blueprint, the malicious AI is added inside their organization.

The higher-authority the target - the bigger the potential damage, since for organization-wide application permissions, the person approving must have the necessary admin privileges. Ordinary users may be able to approve certain delegated permissions, depending on company policy.

One of the first things the AI agent receives, once installed, is a permission called AgentIdentity.CreateAsManager. This allows the threat actor to create additional identities linked to the blueprint that’s now inside their target’s environment. A single blueprint can support up to 250 agent identities, which means there can be a swarm of malicious bots running around at the same time.

Raising awareness while limiting access privilege

The attacker then obtains access tokens for those identities, making them valid members of the company with approved access to different resources which they can then exfiltrate as they please.

“Organizations should raise user awareness of the risks associated with agent consent, particularly when granting permissions to ‘third-party’ agents from untrusted sources,” Proofpoint warned. “Much like user consent settings limit users from granting consent to third-party apps, these settings also extend to agent blueprints and their agent identities.”

Proofpoint stressed agent blueprint ID is consistent across all tenants that give their consent, which is a common indicator to detect or remove known malicious agents. Applying the principle of least privilege will help limit the impact, the researchers concluded, utilizing controls like Conditional Access policies for agents and Entra ID protection for agents. “For monitoring, agent and blueprint events are surfaced in the audit log, in a similar way to app consent operations,” the report concludes.

• Sega disclosed a third-party breach that exposed nearly 2.2 million customer email addresses through a marketing service provider
• Around 92,000 additional records related to email distribution were also compromised in the incident
• Sega and its provider warned users about phishing risks, though no misuse of the leaked data has been confirmed

Gaming giant Sega has disclosed suffering a third-party cybersecurity incident that exposed email addresses of almost 2.2 million people, as well as other details of at least 92,000.

The company is now investigating deeper, to confirm the details of the leaked information.

What happened

Sega is one of many Japanese companies using the services of Arara, a technology firm providing digital marketing and customer engagement services.

One of its services is called Arara Message, an email distribution platform that businesses can use to send newsletters and other communications to millions of people. This also means Arara was managing contact information on behalf of those organizations, including email addresses, names, and often phone numbers and membership details.

In early November 2026, Arara reported its email distribution infrastructure suffering a compromise. Apparently, a combination of a web server vulnerability and “other system weaknesses” allowed unidentified threat actors to access 97 servers that stored data of up to 380 corporate customers.

The attackers accessed (and most likely exfiltrated) more than 81 million email addresses, together with people’s names, dates of birth, phone numbers, postal addresses, and membership numbers. Not every customer had all of this data exposed - it varied from person to person.

In a subsequent report, Arara added that the attackers compromised a separate environment containing additional 3.38 million email addresses and more than 400,000 customer records containing PII. They ended up sending more than seven million phishing emails spoofing various credit card companies, forcing the company to temporarily shut down the service on October 31 2026.

Many large organizations had their newsletter contacts exposed. Asoview reported approximately 15.82 million records, while electronics retailer Bic Camera reported 15.2 million. Fast-food chain MOS Burger disclosed the exposure of some 7.5 million email addresses, while cinema operator Shochiku Multiplex Theaters 3.3 million.

Sega under fire again

Among them were also video game giant Sega and its subsidiary Sega Fave, who disclosed approximately 2.2 million affected email addresses.

“Sega Corporation uses Arara Corporation's distribution system to distribute certain email newsletters related to products and services of our company and its group company, Sega Fave Corporation. It has recently been discovered that Arara Inc. was subjected to unauthorized access by a third party, and the email addresses of customers used to distribute the email newsletter were leaked externally,” the company said in a short announcement.

The company said that as of November 9, it can confirm 2,196,044 emails as compromised, together with 92,273 other items “related to distribution”.

Information that has not been leaked at this time include customer names, dates of birth, gender, addresses, phone numbers, credit card information, and login passwords.

“At this time, no misuse of the leaked information related to this case has been confirmed,” Sega said. “The email address registered with the "SEGA Account" uses a different distribution system and is therefore excluded from the leaked information.”

This is Sega’s second major cybersecurity incident this month after its Sega Fave arcade game network services were recently brought offline and are, according to BleepingComputer, still unavailable as the company works on maintenance and safety checks.

On November 2, Sega Fave said an unidentified threat actor accessed its servers supporting its ALL.Net and Aime arcade gaming network services but later stressed that these two incidents were unrelated. Online gameplay, Sega Lucky Kuji Online, and new Sega ID registrations, were all brought offline for investigation.

So far, no threat actors claimed responsibility for the breach. Both Sega and Arara warned their users about possible phishing emails and urged them not to click on any links or download attachments from emails claiming to come from the companies.

Via BleepingComputer

• Wyndham’s Android app exposed customer data and login tokens through hardcoded credentials embedded in the code
• Researchers found access to millions of records, including names, emails, member IDs, and active authentication tokens
• Wyndham fixed the issue after disclosure, but the scope of exposure and any prior access remain unclear

Wyndham Hotels & Resorts, one of the world’s largest hotel chains, has admitted it experienced an embarrassing cybersecurity incident that exposed personally identifiable information and even mobile app login tokens, possibly for millions of people.

The hotel confirmed the news to TechCrunch after an independent researcher tipped off the publication about the security mishap.

Security researcher Robert Wiggins from What Security analyzed Wyndham’s Android app and found a set of hardcoded credentials. Those are credentials that are baked into the app’s code and are usually a leftover artifact from earlier development phases. While building an app, software developers would include admin credentials into the code to work faster and not have to log in every time they want to test a feature or a tool.

These credentials are usually removed in the final audit, just before the app is shipped. However, they are sometimes forgotten, which leaves a revolving double door back access for even the lowliest skilled cybercriminals.

Customer data and login tokens

In this case, the credentials granted Wiggins access to an internal company database containing customer names, email addresses, Wyndham member numbers, and JWTs - customer login tokens that allow users to remain logged into their apps.

These tokens would prove invaluable to malicious actors, since they would allow them to access user instances without knowing their credentials (granted that they are still active and not expired or revoked).

Personally identifiable information, as well as Wyndham files and documents that were also stored in the database, could be used to create highly customized, tailored phishing lures, which could trick victims into installing malware, making fraudulent transactions, or granting attackers access to their employer’s corporate environment.

Wiggins apparently tried reaching out to the hotel but could not find the right channel, so he asked the media for help. When TechCrunch made contact, the company confirmed the security blunder but stressed that the issue had already been resolved.

“Our team has taken steps to address the issue,” a Wyndham spokesperson told the publication. “Our security teams have no evidence of any unauthorized access.”

The issue may be resolved, but plenty of questions remain unanswered. For example, we don’t know how many people had their data exposed this way. Wiggins says the database has “millions of entries”, but he could not determine a more concrete number. Wyndham claims it has 129 million enrolled rewards members.

Wiggins' streak

We also don’t know for how long the database remained exposed this way. When were the credentials hardcoded into the app, and which versions kept them? The company also said there was no evidence of unauthorized access but declined to elaborate. Without a proper audit of server logs, we cannot know for certain if anyone viewed, or downloaded, the information before Wiggins’ discovery.

So far, it doesn’t seem as if Wyndham disclosed the leak publicly, or shared details with its customers whose data was exposed. Usually, incidents like this one need to be reported to appropriate authorities, including data watchdogs and regulators such as the US Securities and Exchange Commission (SEC), the European Securities and Markets Authority, or national data protection authorities.

This is the second instance of hardcoded credentials Wiggins found in just as many weeks. In early November, it was disclosed that the American casual dining restaurant chain Applebee’s kept hardcoded credentials in its Android mobile app, exposing customer names, their email addresses (both verified and unverified ones), dates of birth, phone numbers, ZIP codes, veteran status, the number of logins, dates of account creation, and the IP address of the most recent login session, to anyone who knew where to look.

Just as with Wyndham, we don’t know the exact number of people whose data was exposed this way, but it’s safe to say they are in the millions.

• Zurich analysis of insurance claims has found that AI is behind 20% of fake claims
• A complex pattern of seemingly unrelated false claims are believed to be coordinated by AI
• Generative AI has been employed by organized crime rings to create fake evidence for non-existent incidents

AI has been driving a worrying rise insurance fraud, new analysis by insurance giant Zurich and AI analytics experts at Quantexa has claimed, with complex, organized crime rings have employed generative AI to make to fabricate supporting evidence in 1 in every 5 fake claims.

Scams as diverse as crash for cash and serial claimants were intelligently analyzed with repeated elements flagged for investigation. AI’s use as both a generative tool for fakery and as a tool to detect patterns and highlight criminality demonstrates how the technology is taking criminality and detection into a new era.

The analysis has so far led to £17.9 million in fake claims detected, a small number when compared to the £1.34 billion of fraudulent claims made in 2025.

Fighting fraud

Incredible volumes of fraudulent insurance claims have been detected over the past 12 months. Zurich UK found £109.3 million in total of faked claims, with £17.9 million of that identified using advanced analytics and AI. Some 4,359 fraudulent claims were uncovered, in motor, property, and casualty insurance portfolios. Claims identified as fraudulent increased 22% from 2022’s figure of 3,562 claims to 4,359 in the past 12 months.

“Insurance fraud in the UK is becoming more sophisticated, more organized and increasingly technology-enabled," noted Scott Clayton, Head of Claims Fraud at Zurich UK and Chair of IFB. "Criminal networks are constantly adapting their tactics, whether that's staged accidents, ghost broking, fabricated claims or the use of AI-generated evidence.

Explaining how AI has helped combat the £109.3 million of fraud uncovered in 2026, he added “Connected data is transforming the fight against fraud, helping us expose hidden relationships, identify organized networks and protect honest customers from footing the bill for criminal activity.”

This appears to be an industry-leading combination of advanced analytics and human judgement by specialist investigators to tackle what is considered a rapidly evolving threat.

Clayton says that Zurich is the first insurance company in the UK to unify data from “Companies House, Equifax, industry intelligence and the Insurance Fraud Register to give us a much richer picture across every claim. That helps us identify crucial connections and information that might otherwise be difficult to spot.”

For years, the software industry operated under one core assumption: writing code was the primary bottleneck in software development. As a result, companies poured enormous resources into hiring developers, refining development processes, and building tools that could shorten the journey from idea to product.

Then generative AI arrived.

For the first time, the industry gained a technology capable of solving the very problem it had spent decades trying to overcome. The ability to write code – once the industry’s most constrained resource – is now faster, more accessible, and dramatically more efficient.

But if our ability to generate code has increased so dramatically, why aren’t software organizations moving at the same pace?

AI-enabled development offers a more nuanced story. AI coding agents can handle work that previously required additional engineering capacity, from creating the foundations of an application to generating tests and accelerating implementation. A group of two or three people can try out an idea that might once have required a much larger team, more specialized skills, and considerably more time.

But speed is only part of the story. The more important change is that AI expands the ambition of each team.

A 2025 study by researchers at Tilburg University found that while AI coding tools increase output, they also increase the burden on senior developers. After analyzing thousands of open-source projects, the researchers found that experienced developers spent significantly more time reviewing AI-generated code, while their own coding output declined by nearly 20%. In other words, AI accelerates code creation, but it does not eliminate the need for human expertise to govern, validate, and maintain that code over time.

The implications extend well beyond senior developers. They force us to rethink what we actually measure.

More code doesn’t mean more progress

Excess code is only the symptom. The real challenge is keeping it under control. As codebases continue to grow, the question becomes even more pressing: if software can be built faster than ever before, why are organizations still struggling to move at the same pace? Because in enterprise software, writing code is only the beginning.

Every change must go through quality assurance, security reviews, regulatory compliance, and complex integration processes. Those steps cannot be accelerated at the same pace as code generation.

As AI speeds up development, what happens after the code is written becomes even more critical.

Organizations are measured not by how much code they produce, but by their ability to run stable, secure, and maintainable systems over time. That is why the defining challenge of the coming years will not be a shortage of developers, but managing complexity at scale.

AI changes the unit of innovation

AI coding agents are a major reason for this shift. They allow smaller groups to take on work that previously required a larger roster, without narrowing the ambition or depth of what they attempt.

That changes the unit of innovation. Progress is no longer determined only by how many people can be working on an idea.

The implications extend beyond individual developers. As AI changes the role of software engineers, team leaders need to consider not simply how quickly teams can produce code, but how effectively they can define problems, validate results and apply human judgement.

The real question is no longer how much software an organization can produce. It is how much of that software can be operated, maintained, and continuously evolved over time.

What happens after the code is written

The easier it becomes to generate code, the easier it becomes to generate complexity. Organizations can introduce new capabilities at unprecedented speed, but every additional component brings new requirements for testing, security, integration, monitoring, and long-term maintenance. AI shortens the path to writing software. It does not shorten the path to building reliable enterprise systems.

That is the new bottleneck in software development – not the ability to generate more code, but the ability to manage the complexity that code creates.

This is where governance, oversight and maintainability become increasingly important. A prototype is not a finished product, and it should not be treated as one. It still requires validation, product discipline, security, reliability, and a clear understanding of the customer or business need it serves.

The opportunity is to turn AI from a separate initiative into an everyday operating model for innovation, while maintaining the standards organizations expect around security, reliability, governance, and measurable business value.

This also means looking beyond traditional measures of development output. In a world where AI writes a growing share of the code, how many features were delivered, how many tasks were completed, and how quickly projects moved forward tell only part of the story. The ability to run stable, secure and maintainable systems over time matters just as much.

AI has solved one of software’s biggest challenges: generating more code in less time. Now the industry faces a harder question: how do we prevent speed from becoming technical debt?

We've featured the best AI tool.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• France blames Iran for recent cyberattacks against supermarket freezers
• October 2026 attack saw food ruined and multiple fires across France
• Iran denies involvement, but France orders its ambassador to Paris to explain

The French government has accused Iran of being behind the recent cyberattacks which hit freezers in supermarkets across Europe.

More than 700 grocery stores were affected by the attack in October 2026, spoiling food and even causing fires as fridges and freezers saw their temperatures hiked up to over 50C.

France has now laid the blame for the attack at the Iran's Islamic Revolutionary Guard Corps (IRGC), saying the incident was "unprecedented in both its scale and its level of aggression".

Iran blamed for attacks

“This is an unprecedented campaign in terms of its scale and level of aggressiveness, thus constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory,” France’s Ministry for Europe and Foreign Affairs Jean-Noël Barrot said.

He added that the incident, "marks the first large-scale cyber-attack aimed at sabotage on our national territory, and it constitutes a major attack on the nation's interests and the security of the French people".

The attacks affected French supermarket chains Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché groups, with food losses estimated in the tens of millions of euros, a report by France’s Cyber Crisis Coordination Centre (C4) found.

The attacks were followed by a second incident a few days later, with supermarkets in other European countries hit, before a third attack saw French blood plasma reserves targeted.

The latter incident saw Coolworld, which supplies the French Blood Establishment (EFS), targeted. The EFS is responsible for collecting, preparing and distributing blood and blood products in France, many of which are used in essential surgeries and medical operations.

Fortunately, the cyberattack did not result in any serious operational consequences because the temperature spikes were noticed quickly and corrected.

Iranian hacking groups such as the IRGC have been blamed for several high-profile cyberattacks in recent months, many of which have targeted industrial facilities and systems.

This includes a UK power generation plant being taken offline for several days in August 2026, and in the same month, more than 30 Minnesota water utilities were hit in a coordinated attack blamed on Iranian-affiliated actors.

“The Iranian cyber threat against French interests is not new,” the Ministry for Europe and Foreign Affairs added. “Iran has already carried out several destabilizing acts against us, notably targeting the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.”

Barrot said the French government had summoned the Iranian ambassador to Paris to "lodge a very strong protest against this extremely grave act".

Iran has yet to respond officially, but some Iranian media outlets have dismissed the allegations as baseless.

Ten years ago, one of the telecoms industry’s biggest infrastructure challenges was rolling out 4G. Since then, telecoms has transformed – and the environment our infrastructure operates in has changed with it.

Summer 2026 was the UK’s hottest on record. In the first nine months of 2026 alone we’ve faced heatwaves, droughts, wildfires, and flash-flood warnings. And climate projections suggest conditions like these will become increasingly familiar.

For those of us responsible for the critical national infrastructure people rely on every day, that means thinking about resilience in an entirely different way – shifting the focus from a single network to the continuity of the service people rely on.

In telecoms, the physical impacts of climate change can quickly become real issues for our customers. And while operators are already taking steps to prepare their networks – from backup power and cooling to flood protection and longer-term climate risk planning – resilience doesn’t begin and end at the boundaries of an individual network. It has to be thought about in the context of the UK’s digital infrastructure system.

The Telecommunications Security Act has already required operators to take a more systemic approach to identifying risks and preparing for disruption. Climate risk now needs the same operational discipline to ensure the connectivity that keeps our economy and national security running stays reliable.

We need to think beyond the resilience of individual networks

Our networks don’t exist in isolation. We are all connected to a much wider digital ecosystem, and increasingly dependent on other critical infrastructure too. Transport is an obvious example. Telecoms networks depend on roads and transport links remaining accessible so engineers can reach critical sites.

That means we need to look beyond the resilience of individual networks and think about the resilience of the system as a whole.

Climate risks don’t arrive neatly one at a time, and the impact of an event in one part of our critical national infrastructure can quickly be felt elsewhere. We’ve seen this come to life in extreme weather events. A heatwave can increase cooling demand at the same time as the power system is under strain, and flooding can damage equipment and prevent engineers from reaching it.

Each individual operator – whether that be the telecoms company or highways authority – has plans for each disruption scenario. The challenge is that those plans need to work when the same event puts several dependencies under pressure at once.

Working together, with government, regulators and the other infrastructure industries we depend on is therefore more vital than ever. Climate adaptation is a strategic national issue. We need to start treating it as one.

Adaptation has to change the infrastructure decisions we make today

Thinking differently about climate resilience also means thinking differently about the decisions we make today. Identifying climate risks is important, but simply recognizing or reporting them isn’t enough. The real value comes when those risks start to influence how businesses plan, invest and operate.

Telecoms infrastructure is built to operate for years, often decades. We can’t predict the exact weather at a particular site in 2040, but we can make decisions now that remain sensible across a credible range of future conditions and identify what would trigger a different course through climate scenario planning.

Climate considerations therefore need to be part of long term decisions from capital investment and network planning to executive governance. That isn’t always straightforward.

One of the challenges with climate change is its unpredictability. We can see patterns in the science and data, but there isn’t a neat, linear pathway that tells a business exactly what conditions its infrastructure will face in five, ten or twenty years’ time. A lot of the impact we are experiencing today is unchartered territory for humanity as a whole, let alone infrastructure.

Part of the answer is translating climate risk into the language businesses already use to make decisions. For telecoms, that means talking about resilience, reliability, efficiency and investment – and recognizing that these priorities are often more closely connected than we might think.

We’ve seen that with net zero. Many of the actions needed to decarbonize networks are also ones that can make them more efficient, more reliable and more resilient. Reducing energy consumption is an obvious example: it can lower emissions while improving efficiency and reducing exposure to energy costs. Rather than treating net zero, adaptation and network resilience as separate agendas, we should increasingly look at where the same infrastructure decisions can help deliver all three.

After all, telecoms is first and foremost an infrastructure business. And if we are investing in infrastructure that will be operating for years to come, resilience to a changing climate needs to be part of how we decide what – and where – to invest.

Uncertainty is often treated as a reason to wait. But when investing in long-lived infrastructure, I believe it should be a reason to keep our options open.

Adaptation needs greater priority

For years, the climate conversation in telecoms has rightly focused on how we reduce our impact on the climate. But as its physical effects become increasingly visible, we need to give the other side of that conversation much greater attention too: how a changing climate will affect the infrastructure we all rely on.

No individual operator has the full picture. The systems telecoms depend on span different companies, sectors and regulatory frameworks, which makes climate resilience a shared challenge as well as an individual one.

A more collaborative approach could help strengthen resilience across sectors. That could include common climate scenarios, cross-sector stress testing, agreed restoration priorities, clearer protocols for sharing information during disruption.

In the event of a storm, power resilience is an example. Imposing a higher duty of cooperation and data sharing between Distribution Network Operators and telecoms companies would help mitigation to be deployed appropriately.

Government and regulators also have a role in convening this work – however, we cannot wait for climate adaptation to become another compliance exercise. We should compete on service and innovation, while collaborating on risks no company can manage alone.

We can’t know exactly what conditions our networks will face in the decades ahead. But we do know that the climate they operate in is changing. The challenge now is to make sure the infrastructure we invest in today is ready for the world it will need to operate in tomorrow.

We've featured the best business phone system.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• 69% of Brits don't think their bank could detect an AI deepfake impersonating them
• Four in five do at least expect ID verification to get slicker in the next five years
• Most want convenience and are only prepared to wait two extra minutes

More than two in three (69%) Brits worry their bank couldn't distinguish them from an attack designed to impersonate them, according to new Digidentity research.

With rising AI threats targeting businesses and consumers alike, four in five would now expect their bank to have AI deepfake detection tools in place when they're running selfie-based identity checks.

This comes as more and more citizens end up preferring increased security measures like vide-based identity checks – with half (53%) believing that one-time security codes sent by text are no longer sufficient.

Banks aren't fully trusted to spot a deepfake

The fallout from a successful attack can have far-reaching consequences, so it's no surprise UK citizens are scrutinizing their banks. Vicims could face months or years of disputing fraudulent debts or challenging mystery accounts opened in their names, for example.

The report comes after Bank of England governor Andrew Bailey called for social media companies to take greater responsibility for tackling scams.

But there is hope, and citizens feel fairly confident in banks' longer-term strategies. Four in five (79%) expect ID verification processes to become smoother over the next five years despite these systems ultimately having to do more heavy lifting, and with good reason. Three in five (62%) respondents said they'd only be willing to tolerate up to two additional minutes of checks.

However, there are challenges. Banks don't typically run their own verification systems, instead choosing to opt for a third party.

"Banks put their own reputation behind the identity provider they choose," Digidentity UK Country Manager Jonathan Evans wrote. "If that provider lets an imposter through, it is the bank’s relationship with its customer that suffers."

Looking ahead, banks are under the most pressure they ever have been to verify legitimate activity and block malicious attacks, but they're also under equal pressure to deliver experiences that are convenient and quick for the end user despite rising threats.

• Russian hosting provider Beget was subject to a cyberattack on November 1st, 2026
• While 1000s of websites were hit, cloud storage, VPS hosting, and Kubernetes servers were wiped
• The attack came amidst a spate of drone and online attacks targeting Russian tech companies, presumably by Ukraine-based attackers or anti-Putin elements within Russia

A “massive cyberattack” took Russian web hosting company Beget’s entire operation offline, with abnormal activity recorded immediately ahead of the incident. All levels of its infrastructure were affected, with websites, cloud storage facilities, VPS hosting, and even hosting for Kubernetes containers knocked offline.

The impact of the attack took several days for the company’s experts to assess, with estimates that over 1,000 servers need to be physically checked. This indicates either lasting damage from the attack or infrastructure that was already weakened, perhaps by unpatched exploits.

Beget has been the subject of EU sanctions due to it providing hosting services to authorities in the Russian-occupied Ukraine regions of Crimea, Donetsk, and Luhansk.

Recovering data

Responding to news of the attack, Beget issued a defiant statement, boldly stating “We are not giving up and are continuing to look for ways to recover this data.”

"Restoring all services will take a considerable amount of time, as more than 1,000 servers must be manually inspected.”

The organization told Kommersant (translated from Russian) that most data should be recoverable from backups for the majority of its virtual hosting and cloud infrastructure, adding “We continue to work on data recovery, but due to significant volumes, this process will require a long time.”

However, Beget’s response to the attack is hampered by how it organizes and prioritises data, with many customers not using disaster recovery plans.

Anatoly Sazonov, Head of the Department of Compliance with the requirements of the Softline Group of Companies, told Kommersant, “Beget’s mass failure is an example of a systemic risk that arises from a high business dependency on a single provider. If a website, corporate mail, databases and other services are posted on one site, the provider’s problems can paralyze several areas of business work at once.”

EU sanctions

Beget was founded in 2007 and has become the second largest domain registrar in Russia for .ru domains, overseeing 14.7% of the market alongside providing web hosting, cloud computing, and other services.

As is standard, Beget has encouraged customers to change their passwords and remove and update and access keys, credentials, or other sensitive information that may have been uploaded to its cloud servers.

Beget has already had a difficult year, having been targeted by EU sanctions for providing hosting services in Russian-occupied territories in Ukraine. Whether the domain registrar and web hosting company was targeted because of this, or as a more general piece of cybercrime, remains to be seen.

• Researchers found over 1,400 exposed ARTEX instances online, with many linked to offensive security tooling
• ARTEX combines AI agents with reconnaissance capabilities and has been increasingly adopted in real-world attacks
• Some operators accidentally exposed malware, exploits, credentials, and internal infrastructure through misconfigured servers

Around 1,500 malicious instances of ARTEX were found on the internet, available to anyone who knew where to look, experts have warned.

Security researchers Censys said they identified 1,465 hosts running exposed ARTEX consoles. Of those, 155 (roughly 10%) were also running at least one tool commonly used in cyberattacks, including Cobalt Strike, Vshell, or Adaptix C2. They also found 32 publicly accessible directories on ARTEX hosts, some of which exposed exploit binaries, post-exploitation tools, and other sensitive files.

Usually, the ARTEX console does not require public-facing access, the researchers said, stressing that overall global deployment is “likely higher”.

Hijacking ARTEX

ARTEX is a legitimate penetration testing tool hijacked for malicious purposes, meaning at least some of these instances were set up by threat actors.

The story of ARTEX is similar to that of the now infamous Cobalt Strike. It was released by a developer called Autumn-27, who also authored ScopeSentry - a tool Censys describes as a “widely used Chinese asset-discovery and vulnerability-scanning platform”.

The researchers described ARTEX as an “AI agent layer on top of that recon foundation”. In other words - it is an LLM-powered version of Scope Sentry that syncs assets found by the tool’s domains, subdomains, IPs, ports, and endpoints.

ARTEX was released in late July 2026 and quickly gained popularity. On October 7, security researchers CrowdStrike reported seeing it used in malicious attacks and a day later, the developer distanced themselves from the illicit activity and stressed the tool was built for testing within authorized asset scopes. They then turned it into a closed-source tool with no further releases. However, despite the repository being taken down, Censys claims archived copies, translations, and different rebrands are still circulating.

Since then, numerous researchers observed it being used in different attacks. The CrowdStrike report described an unidentified threat actor using ARTEX to target South Korean financial institutions. The attacker, believed to be a financially-motivated Chinese actor (as opposed to being a state-sponsored one), compromised a broker-facing loan inquiry service at one bank and an employee mobile system at another. In both instances, they walked away with sensitive data.

They used ARTEX with DeepSeek v4.1-flash as their primary AI model, while also running Claude Code and Grok. The researchers found the operation in part because the attackers left publicly accessible directories where they exposed prompts, session histories, and ARTEX configuration files.

Censys later said the directories had been left exposed in mid-August, roughly seven weeks before CrowdStrike published its findings. File names also suggested they were targeting payment and gaming services, as well.

At one point Microsoft linked it to Storm-0940, a China-aligned threat actor responsible for compromising ConnectWise Cloud Backup customer environments. Apparently, the threat actors used ARTEX to automate scanning, password spraying, and OAuth application abuse, peaking at 2,900 sign-in attempts per minute at one point. Some Microsoft’s customers were allegedly seeing privileged cloud access granted in less than three hours.

Exposing their own infrastructure

Now, Censys says ARTEX is being paired with other offensive tools. At least 70 hosts were seen running both ARTEX and CyberStrikeAI, and others were seen deploying PentAGI, HexStrike AI, and RedAmon. Ironically enough, the researchers also found some actors had inadvertently exposed sensitive information through poorly secured directories. One installation exposed the operator’s entire home directory, including SSH configuration files and shellac command history, while others contained Windows lateral movement tools, malware implants, reverse-shell scripts, and exploit code.

Censys also stressed that not all of the exposed instances are malicious. They also said that roughly 650 of the detected hosts belonged to two groups of identically configured hosting infrastructure, leaving approximately 815 unique installations.

• Attackers are actively exploiting the Plex2Shell vulnerability chain to compromise internet-exposed NAS devices
• QNAP urges immediate updates, as older Plex Media Server versions allow remote code execution and full device takeover
• Systems exposed before patching may already be compromised and require credential resets and full remediation

QNAP has issued a security advisory warning users to install the latest version of the Plex Media Server app on their Network Attached Storage (NAS) devices.

It says older versions are being actively abused in the wild using the dreaded Plex2Shell vulnerability chain.

“Plex has confirmed that these vulnerabilities are being actively and widely exploited,” the company said in the advisory. “QNAP urges all users running Plex Media Server on a QNAP NAS to update immediately and to review their devices as described below.

What is a QNAP NAS and what does it have to do with a flaw in Plex?

A Network Attached Storage device is a dedicated system allowing users to store, back up, and share files across a network. Essentially it’s a series of hard drives connected to a local network for easy access. Consumers and businesses alike often use it as an alternative to subscription-based cloud storage models, and sometimes even to stream audio and video files.

One popular way to do that is via a software application called Plex Media Server, which allows users to organize and stream their personal collection of movies, TV shows, music, and other multimedia content. By installing Plex on their NAS, and a compatible player app on a smartphone and similar device, users can access their media libraries over a local network or remotely via the internet.

This last part - via the internet - is where trouble was recently found.

Earlier in November 2026, Plex disclosed having fixed four vulnerabilities in Media Server versions 1.43.2 and older: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Separately, these four are relatively dangerous. Chained together, they allow unauthenticated threat actors to execute arbitrary code with the highest privileges, remotely. In other words, they can use Plex Media Server to take over the QNAP NAS and, if they choose to, access and steal sensitive content found there. These four have been given the nickname Plex2Shell.

Plex released a fix in September 2026, and a proof-of-concept (PoC) exploit was made available a few weeks later. Since then, multiple security companies reported seeing Plex2Shell abused in the wild, mostly to install proxy software and cryptocurrency miners. The latter might not be particularly useful, given that most miners require powerful GPU units, but the former could prove lucrative.

Patching Plex

A proxy network allows cybercriminals to route their traffic through legitimate residential infrastructure, helping them not just to hide their identities and whereabouts, but also to launch disruptive Distributed Denial of Service (DDoS) attacks. As such, residential proxy services are always in demand, and can earn their operators a hefty sum.

The US Cybersecurity and Infrastructure Security Agency (CISA) added all four bugs to its Known Exploited Vulnerabilities (KEV) catalog on October 20, and gave Federal Civilian Executive Branch (FCEB) agencies a mere three-day window to apply the fix or stop using Plex entirely.

That being said, Plex addressed the flaws in Media Server version 1.43.3 (build 1.43.3.10861), which can now be downloaded via QNAP’s App center. The company confirmed that the bugs exist only in Plex Media Server, QTS and QuTS operating systems were not affected. Still, Plex said if the NAS device was reachable from the internet while running older versions of the software, updating is not enough and the NAS should be treated as compromised.

Those users are advised to complete a clean reinstall, compromise check, and credential reset.

The exact number of internet-accessible QNAP NAS devices is difficult to determine, but according to figures from BitSight, there are tens of thousands of them, right now. That does not mean all of them are vulnerable (many might not be running Plex Media Server to begin with), but the theoretical attack surface is quite large.

Via BleepingComputer

• Crédit Mutuel Arkéa confirms cyberattack led to the theft of roughly $133 million from the bank itself
• Attackers reportedly converted stolen funds into cryptocurrency and laundered them across multiple services and blockchains
• Bank says customer assets were unaffected, while investigators continue probing the third-party compromise

Crédit Mutuel Arkéa, a major French banking and financial services group, has confirmed it recently suffered a cyberattack that resulted in the theft of around $133 million.

The stolen money apparently did not belong to customers, but rather to the bank itself, and was converted into cryptocurrency to be siphoned out more easily.

The attack was first spotted by ZachXBT, a cryptocurrency analyst and blockchain fraud investigator who issued an alert on November 2 2026. “An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1),” he said at the time. “The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor.”

Blockchain as the tech of choice for both sides

It appears the attackers converted fiat currency into different cryptos before sending them out. As ZachXBT explained, the threat actor was “aggressively swapping” USDC (a stablecoin currency, one whose value is pegged to that of the US dollar) for ETH (Ethereum) and transferring the tokens to instant exchanges such as WellWallet and Keyrex. Some of the funds were converted to XMR (Monero, a known privacy-first token whose transactions are notoriously difficult to track) via Wagyu, and later bridged “across multiple chains.”

The irony is pbvious - blockchain and cryptocurrencies are often perceived as the go-to platforms for financial fraud and while many defend it by saying the fraud conducted via fiat is magnitudes larger, the fact remains the crooks transferred dollars to cryptos during theft.

On the other hand, the attack was not even discovered (at least publicly) until it hit the public blockchain where analysts like ZachXBT were able to see it and report on it.

A day later, ZachXBT issued an update, saying he identified an additional $27M+ of withdrawals, bringing the total amount stolen to $133M+.

“My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up,” he said. “No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement,” he added, suggesting that Crédit Mutuel Arkéa handled the situation poorly.

In his reports, however, he never mentions the name of the organization targeted. Crédit Mutuel Arkéa released a brief statement on November 4, saying it suffered an attack which it later managed to contain.

“As soon as this attack was detected [...] the decision was made, as a precautionary measure, to temporarily suspend certain transactions in order to secure operations and prevent any further fraudulent movements,” the announcement reads.

“This incident is closed and is now under control. Operations are being gradually resumed over the course of the morning, after the group and its subsidiaries ensured that checks had been carried out and enhanced security measures had been put in place.”

Not Lazarus

In an FAQ published a day later, the company said the attackers “went through the platform of one of our service providers and thus reached Crédit Mutuel Arkéa directly.” It did not want to say which service provider that is, but ruled out Fortuneo since that name was apparently being mentioned in local press.

The attackers used Arkéa's own account to carry out transactions with other banking players, it said, confirming that customer funds are safe and unaffected.

“We would like to reassure all our customers that this incident has no consequences for their assets. It only led to a delayed execution of certain transfer operations,” the FAQ further states.

The bank did not want to confirm the amount of money that was stolen, but commenting on ZachXBT’s $133 million figure, said it can “simply validate the order of magnitude.” In other words - it’s a close estimate.

So far no threat actors claimed responsibility for this attack, and chances are none will. ZachXBT believes this was not the work of notorious North Korean actors Lazarus Group.

Via BleepingComputer

• Iris Ohyama discloses breach affecting 7.7 million individuals after attackers compromised its ecommerce platform
• Exposed data included personal details and some encrypted passwords, prompting password reset recommendations
• Company continues investigating the attack, with no ransom demand, attribution, or confirmed misuse reported

Major Japanese consumer goods manufacturer Iris Ohyama has confirmed suffering a cyberattack which saw it lose data on 7.7 million people.

The company first disclosed the breach on October 29, 2026 when it confirmed “unauthorized access on the e-commerce site” Iris Plaza. At the time, the company said its investigation was ongoing, and that it would temporarily suspend the site to ensure customer safety. While it was looking into possible data leaks, it stressed that credit card information was not taken.

A week later, Iris Ohyama came forward with a more detailed report, in which it said that on October 28, if found “suspicious files” on an external cloud service it used. The subsequently launched investigation confirmed that the attackers stole sensitive data on 7.7 million people, which included member data on approximately 5.8 million people, and non-member data on 1.9 million.

Member data included names, addresses, phone numbers, email addresses, genders, dates of birth, and encrypted passwords (for some users). The non-member data was limited to names, addresses, phone numbers, and email addresses.

Hashed passwords and stolen credentials

The fact that the passwords were encrypted is good news, since it means the accounts cannot be accessed that easily. However, the company did not say which encryption or hashing method it used, so it is possible that the attackers could break some of them offline. It is thus no wonder the company warned users to update their login credentials, especially for those who use the same password for other services.

Those that do use the same passwords across various platforms are also at risk of having all of them compromised, since threat actors are known for trying out the stolen combinations across a multitude of services.

We don’t know who targeted Iris Ohyama, and to what end. No threat actors have yet claimed responsibility for this attack, the data has not yet leaked to the dark web, and we’ve found no evidence it was used in phishing or social engineering attacks.

In a statement given to BleepingComputer, the company said it received no direct communication from the threat actors, no ransom demands, and did not know who they were.

We also don’t know which third-party cloud service Iris Ohyama used, which malware was used, or how it was planted there. In the meantime, the company notified the country’s data protection watchdog agency, as well as local law enforcement authorities.

Targeting Japanese organizations

Over the last few months, Japanese organizations have experienced a barrage of cyberattacks, targeting firms of different sizes and in different industries. Just last month, we reported on an attack on GMO, a data breach incident at Japanese Burger King, and a malware attack on Daiichi Kosho. The GMO attack was particularly worrisome, since the company urged its customers to “unplug any cords connected to your PC”.

Burger King Japan also recently lost sensitive data on 11.18 million customers, most of which were using the company’s official smartphone app, while a malware attack on Daiichi Kosho’s supply chain resulted in the compromise of 8.7 million of both customers and employees.

All of these are large organizations and major enterprises, and Iris Ohyama is no exception. The company is a large consumer goods manufacturer, known for household appliances and everyday products, and has been around for decades offering air conditioners, vacuum cleaners, kitchenware, lighting, pet food and accessories, as well as different food products like rice and water.

For the financial year 2025, the company reported an annual revenue of $1.53 billion, with a headcount of more than 6,300. It also has a substantial international presence, with manufacturing and distribution operations in the US, Europe, China, and South Korea.

The early rush to encourage employees to use AI wherever possible led to a new way of measuring productivity based on the consumption of AI tokens, or technically the underlying AI foundation model tokens. Employees who did not use AI were immediately visible through their AI consumption bill, or lack thereof, while high consumption was treated as a positive signal. The number of tokens consumed became a badge of honor.

For a while, more AI usage suggested more productivity and innovation. Some organizations even began treating AI activity as a proxy for employee engagement. This led to the phenomenon of ‘tokenmaxxing’, with the unintended consequence of AI costs growing out of control and raising a more difficult question: what does successful AI adoption actually look like and how do you measure it?

The latest Pulse of Work 2026 research points to the gap between adoption and value. While 88% of employees say AI has benefited them and estimate it saves them an average of 2.3 hours every day, four in five say they are not using it to its full potential and 69% do not fully understand how it applies to their role. Meanwhile, 60% feel pressure to use AI regardless of whether it is the right tool for the task.

These findings reinforce two points that should already be clear: one, AI activity is a poor proxy for business value, and two, organizations need to become more deliberate about where and how they use AI tools.

More AI does not automatically mean better work

The knee-jerk reaction to equate AI usage with success is understandable. Instant answers, automation of repetitive tasks and the removal of administrative burden from busy employees are clear and tangible benefits.

But problems emerge when AI becomes an expectation in every initiative rather than a considered decision that accounts for where human judgement is needed, which model is appropriate and what the associated cost will be.

When employers celebrate AI adoption without defining where it genuinely adds value, a problematic incentive structure develops. Employees naturally reach for AI more often, sometimes without considering whether it is the right tool, whether the output needs significant review or whether the cost of the model is proportionate to the task. Without clear parameters or support, the likelihood of misuse goes up.

Experimenting with AI should not be discouraged. In fact, it should be actively encouraged and is a crucial part of using this transformative technology for the greatest impact.

However, it’s important to also train employees so that they take a cost-conscious approach and leverage the right models for the type of task - using lower-cost models such as Gemini Flash and Claude Haiku for most tasks and only using the more expensive and powerful models such as Claude Opus and Claude

Fable for more complex tasks. The challenge comes when organizations encourage and reward use without putting the same energy into providing the proper training, guidance on cost-conscious adoption and development opportunities for their employees.

Productivity depends on workflow design

The biggest productivity gains come from identifying the scenarios where AI removes friction without compromising quality. Administrative work and removing toil remains an obvious starting point. Scheduling, email management, customer communications and routine documentation can all give employees time back for higher-order work.

From there, the real opportunity is helping employees build on their existing skills using AI to pressure-test ideas and move faster. That’s when the human-AI partnership works as it should, with technology extending what people can do rather than becoming a substitute for their judgement.

Role-specific guidance is what makes this possible. Although AI capabilities continue to improve rapidly, every function uses technology differently. A finance professional faces different governance requirements from a software engineer, and customer service teams need different safeguards from HR teams. AI training should account for such differences.

This is also why organizations should stop expecting employees to discover the best applications of AI independently. If people are spending time looking for ways to make AI useful, testing tools without guidance or working out how new capabilities fit into existing processes, some of the potential productivity gain is being lost before the technology has even delivered an output.

A better approach is to redesign workflows around genuine business outcomes. That means identifying where AI can remove unnecessary effort, then giving employees the tools and guidance to use it within the context of their role.

It also means making useful, approved AI available within the systems employees already use. When AI is integrated into daily workflows, people are more likely to apply it to safe, high-value use cases rather than seeking out unsupported alternatives.

Quality has become the missing metric

One of the highest hidden costs of widespread AI adoption is the additional burden of review and correction. AI can produce an answer quickly, but speed has limited value if employees then have to spend significant time checking whether that answer is accurate, complete or appropriate.

This is particularly important as AI-generated content becomes embedded in everyday work. A poorly reviewed output can create more work for another employee, introduce errors into a business process or undermine trust in the technology altogether. The productivity calculation therefore needs to account for what happens after the AI generates its answer.

Output quality, and ultimately, quality outcomes, should become part of the AI architecture itself. That means building review processes into workflows, introducing governance where decisions carry higher risk and ensuring employees understand the importance of validating AI responses before those responses become business decisions.

Done well, these safeguards should not stand in the way of adoption or slow employees down. They should give employees the confidence to use AI more effectively and adjust involvement where greater scrutiny or human judgement is needed. By implementing automated verification steps and role-specific parameters, IT leaders give teams the guardrails they need to drive productivity without compromising accuracy and trust.

The organizations creating value are building confidence

The biggest shift required now is cultural. Employees need clarity about when and how AI should be used, confidence that they are making appropriate decisions and practical support when new capabilities are introduced.

That support must extend beyond learning how to use a particular tool. Employees need to learn the best practices of reviewing AI-generated work for accuracy and bias, when to trust or question an output and when creativity or human judgement should take precedence.

Policies are key in achieving this by establishing consistency, but role-specific training, guidance and continuous learning ultimately determine whether those policies translate into everyday behavior.

For IT leaders, responsible adoption means creating the conditions for that confidence. They need enough visibility and oversight to manage security, compliance and quality, without introducing so much friction that employees simply look for workarounds.

The same principle applies to the technology itself. Organizations need tools that fit naturally into existing workflows and give employees the right capabilities for the work they are actually doing. AI adoption becomes much harder to manage when employees have to piece together their own collection of tools without clear guidance on what is approved, appropriate or secure.

At the macro scale, organizations need to treat responsible adoption as an ongoing process rather than a one-off rollout. As AI tools and capabilities continue to evolve rapidly, the guidance around them needs to keep pace.

The organizations creating lasting value from AI will therefore ask very different questions from those focused on token consumption.

Is work becoming more accurate? Are employees making better decisions? Are the most optimal models being used for the type of task? Are we achieving reliable, quality outcomes and optimizing the AI costs to get there? Are repetitive tasks being automated while human expertise is being applied where it creates the greatest value?

When leaders provide the tools, context and confidence employees need, productivity and ROI will naturally follow.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Ethical toilet paper company Who Gives A Crap exposes customer information following data breach
• Customers across UK, US and Australia affected
• Company warns users to be on their guard for scam or phishing attacks

Toilet paper firm Who Gives A Crap has told customers it has suffered a major data breach which leaked user information across three major markets.

In an email sent to customers seen by TechRadar Pro, the company apologized for the "unwelcome news" and promised to be "as clear as we can about what we know".

It noted that customers in its home country of Australia were affected, along with users in the UK and US - although users in its Canadian market were not affected.

"Unwelcome news"

"I’m writing to inform you that your personal information was accessed without authorisation in a security incident at one of our marketing software providers," the email told customers.

User first and last names, email addresses, phone numbers, mailing addresses were all hit in the breach, as was the total amount the user had spent with Who Gives A Crap.

The company said it did not know whether the stolen information was copied or downloaded, but did say payment details, order details and passwords had not been affected.

In a seperate blog post, Simon Griffiths, Co-Founder & CEO, Who Gives A Crap, said it had been informed by an unnamed "US-based software provider" that an "unauthorized party" had accessed systems holding information from its online store.

"The provider has said that access began on 30 October 2026, was identified on 31 October 2026 and was secured on 1 November 2026," the company added.

Who Gives A Crap said it had disconnected the affected provider from its systems, and changed access credentials. It was also communicating with the affected provider to understand the details of their investigation in order to determine if there is any further action required, and said that it would be engaging with the relevant regulatory authorities as required.

"Your account with Who Gives A Crap is secure and was not directly accessed, so you don’t need to take any action with your account," it told customers, warning them that the main risks now would come from criminals sending out scam or phishing messages using their real details to look convincing.

"We have no evidence of misuse so far, but please be extra cautious," it added.

• Hackers have shared data concerning Russian casualties in its war with Ukraine on a Russian state website, while also stealing 23TB of data
• Russian state statistics agency Rosstat admitted its servers were targeted over the Halloween weekend
• The organization’s electronic document management system was also hacked and exfiltrated

Russian casualty figures in its war with Ukraine have been kept under wraps since 2024, but have now been displayed on the website of Russian state statistics agency Rosstat following a major breach of security.

Rosstat admitted to a breach over the weekend of October 29 to November 1, 2026, but has yet to admit to any form of exfiltration - despite hacker groups Belarusian CyberPartisans and Silent Crow confirming around 23TB of data was taken.

As well as the casualty figures, the Silent Crow group and its collaborators have boasted of hacking and stealing a document management system, and also claimed to have taken control of vehicles.

Specialized units

The details of what is being considered a successful hack by its perpetrators were published on Telegram. The Silent Crow account explained that “access was gained to a large part of the IT infrastructure of the department, including the central office, regional units and the Main Interregional Center for the Processing and Dissemination of Statistical Information.”

Rosstat reported that its information resources were targeted over the Halloween weekend, says Kommersant (translated from Russian). “The infrastructure worked normally: monitoring systems in a timely manner alerted about suspicious activity, which allowed to quickly start the response.”

The organization’s confirmation added: “Compromising databases and leakage of information protected by law has not been identified.”

Cybersecurity experts, on-site experts, and “specialized units in the field of information security and law enforcement agencies are establishing the vector of the attack and identify the sources of the threat,” the department added.

During its prolonged access to Rosstat's servers, the Cyberguerillas BY and Silent Crow groups revealed human casualties to Russian military personnel since the beginning of the war in Ukraine as 1,584,910.

It also revealed a loss of 587,409 UAVs, demonstrating that this is a classification of combat asset that is in far greater use than tanks, artillery, and manned aircraft.

In supporting its claim of stealing 23TB of data across electronic document management and other databases, the group stated (translated) “The scale of the incident goes far beyond the compromise of individual servers or user accounts. After all, it is about penetration into the infrastructure of the federal department with access to central and regional systems, internal circuits and data sets of public and official value.”

Access to domain controllers of Rosstat unlocked access to the organization’s main data, eventually allowing the hackers to compromise virtualization systems like VMware ESXi, along with infrastructure management systems.

The casualty figures are not likely to be verified by official sources in Russia.

• Microsoft fixes high-severity Paint vulnerability that could allow remote code execution through crafted image files
• Security updates are delivered through the Microsoft Store, leaving some users temporarily stuck on vulnerable versions
• Users should verify their Paint version and install the latest update as soon as it becomes available

Microsoft has addressed a high-severity vulnerability in Paint that allowed threat actors to run malicious code remotely. However, fixing the issue doesn’t seem to be a straightforward process for users, as the patched version, surprisingly, remains unavailable for download for some people.

Tracked as CVE-2026-83844 and with a severity score of 8.1/10 (high), this bug was described by the National Vulnerability Database (NVD) as an “out-of-bounds read in Windows Paint [that] allows an unauthorized attacker to execute code over a network.”

In theory, a threat actor could create a special image that, if opened via paint, can trigger the flaw and execute malicious code on an affected system.

How to patch Paint

The bad news is that Microsoft added AI into Paint, which makes the idea of malicious packages triggered through the app a lot more viable. The good news is that Microsoft did not publish technical details about the flaw, explaining how one might pull off this kind of attack, and given that there are no confirmed cases of in-the-wild exploitation, or publicly available exploit code, all of this still remains in theoretical domain.

CISA’s Known Exploited Vulnerabilities (KEV) catalog does not have this bug listed, meaning there are no confirmed cases of attacks, especially against government entities.

Whether or not the bug remains theoretical depends on two main things: how potent the bug is, and how easy it is to leverage. With that in mind, it’s worth mentioning that Microsoft classified the attack vector for this flaw as “Network, with no privileges required”, meaning threat actors with previously obtained low-privilege access could use this bug to escalate their privileges or deploy dangerous malware. Both scenarios could lead to credential theft, wire fraud, or even ransomware attacks.

On the other hand, it marked the bug’s complexity as “High”, suggesting that exploiting it is not that easy of a feat. That could limit abuse to state-sponsored actors, or for-profit hacking groups with deeper pockets and plenty of resources.

It is also worth mentioning that Microsoft moved Paint from Windows to a standalone Microsoft Store app. Consequently, the security fix isn't distributed through the regular Windows Update mechanism, and users must update Paint through the Microsoft Store themselves (unless automatic app updates are enabled).

The company apparently included a fix in Paint version 11.2605.91.0. However, Neowin reports that despite releasing a newer version, Microsoft was still offering a vulnerable one on its app Store - 11.2605.81.0. The problem was apparently evident to multiple people, enough for them to open a discussion on Reddit. One user even shared a PowerShell output showing that Paint remained on a vulnerable version, despite them checking for updates through the store.

Different people, different versions

We looked for Paint in the Microsoft Store at press time, and saw version 11.2609.401.0 being offered, with November 5 being the date of the newest update. Neowin also said that for some Reddit users, this was the version carrying the fix, instead. It is possible that Microsoft opted for a staggered release instead of a global rollout, which is why some people were late to be offered the patch.

To make sure your systems are secure, simply looking at Microsoft Store might not be enough. Instead, users should double-check their Paint version using PowerShell, using this command: Get-AppxPackage Microsoft.Paint | Select-Object Name, Version. Those that still see the older version should keep an eye on Microsoft Store for the patch and follow Microsoft’s Security Update Guide for the vulnerability. Those who are worried about being targeted could set up temporary restrictions on certain image attachments or remove Paint entirely from the system.

Via Cybernews

• AI-themed phishing campaigns found using fake OpenAI, Anthropic, and SpaceX events to steal corporate credentials
• Attackers combine device-code phishing, reverse proxies, and MFA bypass techniques targeting Microsoft and Google accounts
• Researchers warn employee interest in AI tools is increasingly being exploited as a high-success phishing lure

If you suddenly get invited to an exclusive SpaceX event and even offered free access to Grok Heavy, kindly turn it down, as this is most likely part of a new phishing attack that’s been circulating around the web.

A report from security researchers Push Security found threat actors are using different AI-themed lures to get people to share their corporate login credentials.

As per Push’s report, threat actors were recently seen creating fraudulent websites for nonexistent events: an OpenAI Academy livestream, a private SpaceX briefing on AI marketing, an Anthropic presentation at AWS re:Invent, and similar.

People who landed on these pages were told they can get free goodies, as well: a free ChatGPT Pro subscription, access to Grok Heavy, and even shares of SpaceX. However, to claim these rewards, the victims were first told to log in - using either their Microsoft, or Google account.

And this is where the scam lies. Instead of actually logging in and getting the rewards, all victims would be doing is sharing their login credentials with the hackers.

"Employees want access to the latest AI tools, making them excellent bait for attacks," Push Security said in its analysis of the campaign.

Kali365 and VoidProxy

Push says threat actors are using two phishing-as-a-service (PhaaS) platforms in this campaign, called Kali365 and VoidProxy. Depending which route they choose (Microsoft or Google), they get served a different path, both ending in credential exposure.

Those that choose to continue with their Microsoft credentials trigger an attack through Kali365. The victim receives a device code and instructions to enter it on Microsoft’s legitimate device login page. Once the victim signs in and approves the request, Microsoft issues an authentication token to the attacker’s Kali365 session. The fake event page then redirects the victim to a fake Microsoft sign-in page operated by VoidProxy, which captures additional credentials and session cookies.

Those that choose “Continue with Google” trigger a different technique. Here, the victim is shown a reverse-proxied version of Google’s legitimate sign-in page, operated by VoidProxy. The proxy relays the authentication process while capturing the victim's password, MFA response, and session cookie, which allows the attackers to grab an authenticated session without needing to move past MFA.

Push doesn’t know exactly how the links are distributed. It’s safe to assume they’re being moved through phishing emails, social channels, or Telegram groups. What we do know is that the attackers are using Google and Zapier to shorten the links and redirect the visitors, in order to avoid being detected by security scanners and URL reputation systems.

Abusing the trends

"All of these detection evasion techniques, plus the MFA-bypassing AiTM and device code phishing payloads, mean this attack is designed to get around or through the controls that most organizations rely on to stop phishing attacks today," Push said.

It’s now been five years since the first version of ChatGPT was released, and since then the tool has captivated people from all walks of life, and was successfully used in countless phishing campaigns. In the past we’ve reported on campaigns involving Claude installation pages promoted through search advertisements, as well as malicious links disguised as legitimate AI content (shared conversations, downloadable artifacts, and custom GPTs).

In July 2026, ANY.RUN reported fake event invitations impersonating Meta, OpenAI, and Anthropic, hosted on legitimate Zoom event pages. More recently, Cofense observed a campaign revolving around fake Anthropic invitations distributed through GoTo Webinar.

As these tools get better, and as they penetrate deeper into every aspect of our private and business lives, they will be abused by threat actors more and more.

Via BleepingComputer

• Researchers bypassed ChatGPT Lockdown Mode, showing prompt-injection attacks could evade built-in protections
• The flaw enabled sandbox escapes that could support data theft, phishing, malware delivery, or malicious popups
• OpenAI patched the issue server-side, highlighting risks in AI application layers beyond the model itself

OpenAI was recently forced to upgrade ChatGPT's 'Lockdown Mode' after researchers found a way to bypass the security protection and pull off different cyberattacks through the tool.

When analyzing Lockdown Mode, security researchers Check Point Research (CPR) found a way to bypass the protections and still end up pulling sensitive data. They’re saying it was also possible to deploy malware this way, too.

“The finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them,” CPR warned.

Lockdown mode

One of the most common ways AI tools and agents are abused is called “prompt injection”. By injecting a prompt into content the AI is supposed to analyze, threat actors can take over the tool and have it do their bidding.

For example, a prompt to “exfiltrate all contact information” can be hidden in a phishing email so that when the victim asks their AI agent to go through all unread emails and sort them out, the tool ends up exposing sensitive data to the attackers.

To tackle this challenge, OpenAI introduced Lockdown Mode, an optional advanced security setting in ChatGPT that adds safeguards for users handling highly sensitive information.

When enabled, Lockdown Mode restricts connections to external services and limits (or entirely disables) certain features, such as live web browsing, Deep Research, Agent Mode, or file downloads. That way, the risk of sensitive data getting exposed via prompt injection is reduced.

The researchers said the bug was found in the way ChatGPT code blocks showed HTML page previews. Code blocks are specially formatted sections that display code separately from regular text, in order to preserve its structure and make it easier to copy or edit. Since running user-controlled HTML and JavaScript is inherently risky practice, OpenAI made sure this content was placed in a sandbox and separated from the main ChatGPT application.

This sandbox, CPR later explained, prevented rendered content from directly accessing ChatGPT cookies, or local storage. It also controlled any attempts to communicate with external resources by prompting for user approval.

But popups were handled differently. “The HTML preview used nested sandboxed frames, and while ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups and permitted them to escape the sandbox,” it was said.

Significant findings

Therefore, by creating a separate nested frame within the rendered page, CPR was able to access unmodified popup functions and bypass all of the restrictions placed on the original HTML preview. All of the content opened this way was no longer under sandbox rules, effectively bypassing Lockdown Mode.

The researchers said the finding was significant because it opened the doors to more than just data exfiltration prompt injection attacks. Credential theft, and even malware delivery, were not ruled out.

“An attack could potentially originate from a malicious prompt, malicious GPT or shared chat, depending on the scenario,” they said. More creative threat actors could also turn it into a useful phishing machine, since they could control the content displayed in the popup window, inside an environment the users generally trust. But perhaps the most dangerous scenario was the so-called “zero-click” attack, in which the popup would appear without the user’s gesture.

CPR disclosed their findings to OpenAI, which implemented additional safeguards to disable the Lockdown Mode workaround. However, the researchers still urged organizations to work on gaining more visibility into AI usage, make sure they control sensitive data exposure, and “look beyond model security” to consider the applications, runtimes, connectors, and other components surrounding the model as part of the overall AI attack surface.

• Chainalysis disclosed a cyberattack that exposed customer data, including hashed passwords and account information
• Company took key services offline, forced password resets, and required additional security measures
• Investigation continues as Chainalysis restores systems and assesses the full impact of the breach

Blockchain data analysis platform Chainalysis has disclosed suffering a disruptive cyberattack that forced it to shut down some of its services to prevent further damage, as sensitive data from all of its customers - including hashed passwords - were stolen.

On October 30 2026, the company issued a notification saying it was a target of an attack, “similar to many other tech platforms in recent weeks,” but “unrelated to the recent crypto theft involving Binance.”

At first, it did not look like a particularly dangerous hit - the initial investigation did not find evidence of unauthorized access to investigation content, authentication credentials, or session tokens.

On-path attack

The unnamed attackers used “offensive agentic techniques”, Chainalysis said, but believed at the time that investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens were not compromised.

It did confirm non-sensitive data (user IDs, full names, email addresses, and organization role labels for users provisioned on the platform) as accessed.

On November 4, Chainalysis shared an update, confirming that this was a much bigger hit than initially believed.

“Today, we confirmed that as a part of this incident, an “on-path attack” exposed a subset of customer passwords, including yours,” the company said in an email sent to affected parties. “This attack vector has been contained and remediated.”

“Given this sensitive and urgent information, we are requiring you to reset your password.”

Users were locked out of their accounts and were forced to reset them using the standard Chainalysis login page. At roughly the same time, it also took down three products, Reactor, Data Solutions and Chain (Beta) “out of an abundance of caution”, and KYT (the user interface and API), other address screening products and the login page “due to abnormal activity.”

The company said it will require additional protections to access accounts, including having every user reset their passwords and rotate API keys as appropriate.

Chainalysis has now said it started restoring access to KYT and Address Screening, albeit partially, and that customers should expect to regain access “over the next several hours”, because it was “proceeding carefully” and monitoring each phase. Users looking to regain their access as soon as possible are invited to submit their trusted IP address via email and prepare to reset their credentials.

No word from the perpetrators (yet)

The company said it was still working “around the clock” to harden its systems and restore access to Reactor and Data Solutions. “We recognize the disruption this incident has caused and appreciate your continued patience and partnership as we work to restore our services safely,” Chainalysis said.

Chainalysis is a blockchain analytics company that governments, law enforcement agencies, and other businesses use to track and investigate cryptocurrency transactions.

Using its tools, the police were able to trace stolen funds, identify illicit activity, and investigate numerous cryptocurrency-related crimes. It is considered a rather important organization in the crypto cybersecurity chain because it provides much of the intelligence infrastructure that helps authorities and businesses understand who is moving crypto and where.

At this moment, we don’t know if this will result in an extortion attempt. No threat actors have claimed responsibility for this attack, and the data has not yet emerged anywhere on the dark web. Chainalysis has not mentioned being reached out by the attackers or even trying to get in touch with anyone.

• Researchers spot White House network traffic being routed through dozens of residential proxy services
• Findings suggest a device on government infrastructure may have been enrolled in a proxy network
• Security experts warn proxy services on sensitive networks could enable abuse, anonymity, and potential lateral movement

The IT network at the White House was seen routing traffic for at least 28 residential proxy services, meaning there is a strong chance government infrastructure is being abused by (malicious) third parties, cybersecurity experts are warning.

Security researchers at Layer3 Intel published a new report, saying they saw 236 instances of residential proxy traffic originating from AS2650. That is the name of an autonomous system registered to the Executive Office of the President, the federal agency that hosts the White House network.

The researchers observed the traffic between October 5 and November 3 2026, and said that in 26 of the 30 days of observation, six IP addresses kept appearing.

Dozens of proxies

“This is public access,” the researchers said. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.”

Residential proxy is a service with a self-explanatory name: paying customers can route their internet traffic through devices connected to residential internet connections (households, essentially), making it appear as though their requests originate from those connections rather than their own. They are not malicious per se, and have legitimate uses, but they’ve become popular among cybercriminals looking to hide their identities, evade security controls, and distribute malicious traffic.

Now, according to Layer 3 intel, 28 different residential proxy providers were able to route traffic through the White House network. The researchers cross-checked the IP addresses against public databases maintained by residential proxy detection companies Spur and Synthient, and both identified them as proxy exits.

Apparently, the researchers did not set out to analyze the White House’s network. Instead, they said they were testing a newly launched platform that “gives researchers a global view of residential proxy and anonymized internet activity,” and stumbled upon the activity while requesting rotating access through residential proxy services.

The cybersecurity community did not seem all too surprised with the news. In a Reddit discussion, IT experts shared their experience with senior leadership, both in public and private sector organizations, saying many were happily sacrificing security for convenience, opting not to install 2FA, or leaving their devices and email inboxes wide open.

One reader suspected someone in the White House “probably installed a sketchy free app on their phone, and now strangers are browsing the internet through the building's connection.”

The timing of the activity is also worth a mention. Around half of the observed connections happened between 5pm and midnight, Eastern time, with almost no activity recorded during the early morning. Layer3 Intel surmised that a device was regularly connecting to the White House network during evening hours, potentially one compromised by a residential proxy SDK.

Reaching internal systems

“That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK,” the researchers explained.

The researchers also pointed out that poorly secured proxy SDKs can allow internal network access and lateral movement. “This is how past botnets have spread,” they said. “If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.”

There are plenty of other unanswered questions, too. For example, the researchers acknowledged that the data only shows network exits, not specific devices. Therefore, they don’t know if the activity is coming from a personal device, a guest network, or an entirely different source.

The White House discovery was not the only unusual thing Layer3 Intel laid out in its report. They also reported seeing residential proxy activity in some of the most remote players on the planet: Saint Helena, Ascension and Tristan da Cunha, a remote South Atlantic territory. The researchers saw 413 IP addresses and more than 32,000 observations on these locations, involving Elon Musk’s Starlink internet, as well as local internet service provider Sure Saint Helena.

The researchers also detected activity related to residential proxy networks in Antarctica, the Falkland Islands, the Chagos Islands, Tokelau, South Georgia, Pitcairn and Svalbard.

• OpenAI used AI agents to analyze the Linux kernel, uncovering 948 distinct privilege-escalation vulnerabilities
• The automated pipeline generated exploits, validated findings, and helped create patches for Linux maintainers
• Researchers say AI is increasingly capable of finding and prioritizing serious software flaws at scale

OpenAI has spent more than a million dollars to analyze the Linux kernel code, and found thousands of vulnerabilities, including countless privilege escalation flaws that could have been quite problematic for the popular operating system.

The AI company published a new in-depth report describing how it built a five-stage pipeline that helped it surface thousands of vulnerabilities, identify which ones were actually dangerous, helped create patches, and ended up securing the Linux ecosystem some more.

The pipeline covered vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review, and once it was done, it found 948 privilege escalation flaws in the Linux kernel.

Guerilla marketing

“The Linux kernel underpins Android devices, cloud infrastructure, supercomputers, and other systems used by billions of people,” OpenAI said.

“With more than 40 million lines of code, the kernel exposes a broad attack surface through system calls, networking, filesystems, and device drivers. We chose Linux to study how effectively frontier models could find vulnerabilities and demonstrate their security impact in a codebase of this scale and importance.”

While the efforts are certainly commendable (especially the fact that the entire ordeal cost roughly $1.21 million in API credits), the report also reads like guerilla marketing for the company’s latest cyber model. After all, the report never mentions its name, apart from the fact that it is an “upcoming cyber model” that found 900+ flaws, which is then compared to GPT 5.5-Cyber which “developed 24 local privilege escalation exploits.”

That being said, the results cannot (and should not) be ignored. The first stage used AI agents to identify security-relevant parts of the kernel and scan them for potential flaws, and within 12 hours, more than 2,300 candidates emerged. Then, OpenAI used additional agents to generate proof-of-concept (PoC) code and test each candidate. The entire process lasted 30 hours, and the system successfully reproduced 1,724 findings (roughly 75% of the initial candidates), while just 3% of the remaining findings apparently came from incorrect model analysis.

In the next step, the agents ranked the vulnerabilities by impact, developing 1,169 working local privilege escalation exploits and 291 PoCs demonstrating information disclosure. After eliminating double entries and false positives, the researchers arrived at 948 distinct escalation flaws and built patches for them.

OpenAI said its researchers reviewed all of the generated exploits and patches before reaching out to Linux kernel maintainers. Following guidance from the Linux community, the team ranked the flaws by priority, and some seem to have already been patched. The remaining findings are currently being addressed, it was said.

New exploitation techniques

“We provide the model with the relevant source code and prompt it with best practices in patch writing, such as performing static checks on the patch, following the software development practices used in nearby code, and performing variant analysis to make sure the patch is complete,” OpenAI explained the process.

Not all of the vulnerabilities were “brand new”, so to speak. OpenAI said Linux maintainers already patched 61 of the identified privilege elevation flaws by the time it completed its analysis, while another 43 had staging patches. Just under 300 (roughly a third) were being reported and discussed publicly, which is also worth putting into context.

On top of it all, the team examined 166 exploitation techniques and found 10 that were previously undocumented. They include kernel memory manipulation, page grooming, and privilege escalation through data-only attacks. OpenAI decided not to share the details on these flaws until they are fixed, in order not to give threat actors the upper hand.

• DreamHost discloses breach exposing FTP/SFTP credentials and some webmail account session data
• Attackers exploited a vulnerability in the company’s File Manager service to access customer accounts
• DreamHost reset affected passwords, offered credit monitoring, and urged users to strengthen account security

Popular web hosting provider DreamHost has confirmed threat actors walked away with login credentials to its customers’ hosting accounts, as well as webmail accounts.

It is now urging organizations to take steps to protect themselves, as it works to tighten up on security and make sure these things never happen again.

In a copy of a data breach notification letter sent to affected organizations, DreamHost said that roughly two weeks ago it discovered unauthorized third-party access to the server that runs its web-based File manager at files.DreamHost.com.

Access to the manager was compromised during August 2026, the company further said, adding that the threat actors walked in by exploiting a vulnerability in that software.

Payment data secure

The flaw, which the company did not detail or describe, granted the attackers access to FTP/SFTP usernames and passwords of logged-in individuals. Furthermore, they were able to reach some webmail systems and grab session information - including credentials - of a “limited number” of webmail users.

Cybercriminals having access to login credentials means that whatever information is stored inside File Manager and the webmail should also be considered compromised. Furthermore, it means the emails can be used to disseminate spam, launch phishing attacks, or even engage in highly disruptive Business Email Compromise (BEC) attacks that could be almost impossible to detect.

DreamHost did not discuss the identity of the attackers, and did not say if they reached out with an extortion attempt. “We believe this as a deliberate attack, and our team worked around the clock to contain it,” is all it said on the matter.

The investigation is still ongoing so the information is inconclusive, but DreamHost said there is currently no evidence that the attackers accessed control panel login information or customer billing details. The company allegedly doesn’t store full payment card numbers and only retains a secure token representing the payment card information. This token cannot be used to make purchases elsewhere.

“However, our investigation is ongoing, and if we discover any significant additional information, we will update this post,” DreamHost said.

DreamHost’s response

In response to the incident, DreamHost said it “took steps” to stop the attackers from further accessing its systems, and to address the exploited vulnerability.

Active sessions of users who may have been affected have been terminated, and their passwords were reset. Therefore, if you try to log into your DreamHost account and see that the password was reset, consider your data breached. DreamHost claims to have implemented “additional security measures” to prevent such incidents from happening again, although it did not say exactly what was done.

“DreamHost also is working closely with outside legal advisors and security and forensics experts to ensure the incident is properly addressed,” it said.

In the meantime, it urged customers to review their statements and notify the police of any suspicious activity, as well as to obtain and monitor their credit card reports. The company also advised users place a fraud alert on their credit report. Detailed steps on what customers can do to defend themselves can be found on this link.

Finally, DreamHost offered all affected individuals one year of free credit report monitoring and identity theft protection services through Equifax which is more or less standard practice in these situations.

So far, no threat actors claimed responsibility for the breach, and the data has not yet leaked to the dark web.

This is not the first cybersecurity incident DreamHost has experienced. In 2012, attackers gained access to one of its database servers, potentially exposing customer FTB and shell-access passwords. The company responded by resetting affected passwords, although it reported no evidence of significant malicious activity against customer accounts. Five years later, in 2017, the company suffered a major Distributed Denial of Service (DDoS) attack against its DNS infrastructure, resulting in widespread connectivity issues for customers.

Via BleepingComputer

What if your next cybersecurity breach happened during a conversation? Since the dawn of cybersecurity itself, companies have focused their efforts on fortifying and defending servers, workstations, and networks. However, with hyper-connectivity and the rise of AI, attacks are also entering everyday workplace exchanges: messaging, videoconferencing, calls, collaborative tools.

This means that, while traditional security measures are still crucial, they are no longer enough on their own. The new frontier sits across the spaces where sensitive information flows freely, often with little thought given to any potential risks.

Just earlier this year, the NCSC warned of Russian-based actors targeting messaging apps. Social engineering via these types of platforms is also on the rise, with the ‘Cyber security longitudinal survey - wave five’ report (published in February of this year) finding that CEO impersonation scams were not just limited to email, but also spanned to WhatsApp and other channels.

All this shows that the state of play has shifted, and companies need to take protecting their communication channels just as seriously as their networks and endpoints.

Communicate at your own risk

Communication channels now structure the daily operation of organizations, and to a far greater extent than IT tools alone. The fast-paced, always-on nature of modern workplace communications transforms what was once perceived merely as a simple productivity tool - such as Teams or Slack - into a critical infrastructure for the people and teams who power companies.

Importantly, hyper-connectivity is not just a question of volume. In hyper-connected organizations, flows are continuous, interconnected, and sometimes invisible even to security teams - think of the number of times a workplace conversation has made it off the designated productivity platform and onto WhatsApp. These new uses create unprecedented vulnerabilities that can no longer be contained by protecting systems alone.

Cyberattacks are shifting to human interactions

This transformation of usage has shifted cyber threats. Phishing, classic yet effective, is having a new lease of life in the era of always-on communications. The Cyber Security Breaches Survey 2025/6 found that 38% of UK businesses experienced phishing attacks in the previous 12 months alone.

The figure is even higher for large businesses, at 63%. Worryingly, the sophistication and speed of phishing is accelerating dramatically with the rise of AI. Attacks are automated, ultra-targeted, credible, and now use all channels: instant messaging, calls, and videoconferencing.

In January 2024, Hong Kong based company Arup fell victim to a deepfake video-conferencing fraud where the CFO was impersonated. It cost the company about £20 million. The risk cannot be ignored.

Financial consequences of attacks on communications

The cost of a successful cyberattack can be huge to companies of all sizes. While large businesses are often big enough to absorb the shock, a successful attack on a small company can be devastating, with some never recovering in the aftermath.

The rise of AI and hyper-connectivity amplifies these risks. The loss of control over information, dependency on external tools, and the exposure of sensitive data make companies vulnerable beyond the technical framework alone. These incidents do not just threaten operations, they directly put into question the strength of digital sovereignty and the ability of organizations to protect themselves.

Reimagining communications as the heart of sovereignty

Companies must rethink their communications. Messaging applications, videoconferencing platforms, and call systems must all be considered critical infrastructures - in equal parts to servers or databases - or risk leaving a major breach in their security and autonomy.

Securing communications is therefore a central issue that requires three concrete priorities. The first is to simplify and unify tools, thereby limiting entry points and reducing fragmentation where suspicious behavior may go undetected. Second, organizations should choose solutions with security already embedded, rather than layering it on after the fact. Finally, companies should establish master data flows and hosting to maintain control and guarantee governance.

This approach goes beyond simple technical protection. It requires treating communications as a strategic asset, on par with infrastructure or data. Business leaders must invest in this level of oversight and control to protect business continuity and preserve their autonomy.

In a world where everything goes through communication, a decisive part of business resilience and autonomy is played out in this very arena. Keeping exchanges protected, controlling data, and remaining independent of external tools is becoming as crucial as technical security itself.

We've featured the best secure smartphone.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Cyberattack on Bristol schools leads to the online leak of more than 320,000 stolen files from 39 schools
• Officials warn students, parents, and staff to expect phishing attempts and other fraud using exposed data
• Investigation continues as authorities determine whose information was compromised and the extent of the breach

Threat actors have leaked hundreds of thousands of records they stole from Bristol schools in September 2026 onto the dark web.

Bristol city council has issued a warning urging both students and parents to expect phishing attacks and other internet scams, and to be vigilant with incoming communications.

“Following ongoing investigations into the cyber-attack affecting the school's IT network, evidence has been found that data taken during the incident has been published online by the criminals responsible for the attack,” the council said in a new statement. “Specialist investigations have identified a significant number of files believed to have been taken from the network and made available online.”

Data leaks online

Reports of a cyberattack against Trading with Schools (TwS), a service operated by Bristol City Council providing schools with shared IT infrastructure and a range of administrative and operational support services, including financial administration, payroll, HR, and more, emerged in October 2026.

At the time, the council said it first suspected foul play on September 21, and decided to shut down the service four days later, on September 25. Following an initial investigation, it was discovered that someone had planted malware, and that the breach affected 87 schools. Back then, council leader Tony Dyer told the BBC that the investigation “had not identified any evidence that data has been stolen.”

However, it seems that not only that the data was stolen - it also leaked on the dark web. Usually, leaks follow a failed extortion attempt, but we don’t know who the threat actors are or if they actually tried to get the council to pay for the data.

The announcement does not put a figure to this “significant number” of files, but according to the BBC, it’s more than 320,000 files, stolen from 39 schools.

Right now, no one knows the nature of the stolen data, or how much of it includes personally identifiable information (PII). Director of Education and Skills at Bristol City Council, Vik Verma, said its officers were "working through a large amount of material as quickly as possible" to determine what was stolen, the publication wrote.

The BBC says that the 39 schools whose data was stolen “heavily” relied on the system for everyday tasks such as scheduling, lesson plans, recording staff details and payroll information.

Therefore, students and pupils might not be the only ones worrying about potential phishing attacks - school staff could be targeted, as well. To make matters worse, since TwS was shut down, many digital tools and services are unavailable making teachers’ jobs harder, and their working hours longer.

The council has notified Avon and Somerset Police and the Regional Organised Crime Unit, and has brought in third-party specialist cybersecurity advisers to help with the investigation.

Only Bristol schools affected

“At present, it is not possible to confirm all schools or individuals affected by the theft,” the council said. “Officers are working to audit the published files and establish this picture as quickly as possible.” Apparently, only Bristol schools were hit.

Parents and students are now being advised to be careful with unexpected emails, text messages, and even phone calls, and especially if they’re claiming to come from a trusted source. They’re also told not to click on links or open attachments in such messages, and to be wary of requests to reset passwords, “verify” account details, or otherwise provide personal or financial information.

They were also told to use strong and unique passwords for important online accounts, and to turn on multi-factor authentication whenever possible, and to keep a close eye on online accounts and bank statements.

• Harvard breach data affecting 850,500 people has now surfaced in breach-tracking databases and dark web archives
• Exposed information includes emails, contact details, demographics, and extensive alumni and donor profile data
• Attack highlights ongoing risks from social-engineering attacks against universities and fundraising systems

Hundreds of thousands of email addresses have been leaked to the dark web after the November 2025 ShinyHunters breach at Harvard University.

The same breach also exposed “extensive profile information” about certain people, as well, according to Have I Been Pwned? (HIBP), a website that aggregates stolen passwords and helps users learn which services exposed their private information.

Harvard gets hit

In late November 2025, the prestigious Ivy League University confirmed its Alumni Affairs and Development systems had been compromised after a successful voice phishing (vishing) attack.

These systems contained information about alumni, donors, some faculty and staff, and some current students, as well as data on their spouses, partners, and parents. Current and former students were also affected, it was said.

Harvard soon confirmed that the compromised data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities." Social Security numbers, passwords, payment card information, or financial info, was not exposed, it was said.

At the time, Harvard did not name the attackers, but the infamous ShinyHunters extortionist group claimed responsibility soon after. In a new entry on a dark web forum, the threat actors said they stole more than a million records containing personally identifiable information (PII), as well as donation data. Since the negotiations with the university broke down, the group leaked more than 1.1GB of documents in early February this year.

At the time, no one knew exactly how many people were affected. Now, after extensively analyzing the leaked archive, HIBP claims data of 850,500 accounts was compromised, including people’s names, email addresses, dates of birth, phone numbers, postal addresses, and social media profiles.

"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.

Attacking universities

When Harvard “fell” to ShinyHunters, they were the third university to experience a breach in mere weeks, following similar incidents at both Princeton University and the University of Pennsylvania.

In early November 2025, when ShinyHunters claimed responsibility for the attack on Penn, they said they stole data on roughly 1.2 million students, alumni, and donors.

At the time, an unnamed threat actor told the media they gained “full access” to a university employee’s PennKey SSO account, which gave them access to Penn’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files.

The crooks slammed Penn for being a “dog**** elitist institution full of woke ret*rds, who have “terrible security practices and are completely unmeritocratic.”

"We hire and admit morons because we love legacies, donors, and unqualified affirmative action admits. We love breaking federal laws like FERPA (all your data will be leaked) and Supreme Court rulings like SFFA,” ShinyHunters said in an email that was sent from a Penn account.

At first, the University of Pennsylvania described the emails as “obviously fake” and “fraudulent”, but later backtracked and confirmed the incident.

“Penn’s staff rapidly locked down the systems and prevented further unauthorized access; however, not before an offensive and fraudulent email was sent to our community and information was taken by the attacker,” it said in an update. “Penn is still investigating the nature of the information that was obtained during this time.”

Penn also said that the attack was done through social engineering. Most employees are required to use multi-factor authentication (MFA) but according to reports, some of the top brass was allowed to skip this step.

Via BleepingComputer

• Malware allegedly gave a poker cheat access to opponents' computer screens
• Hundreds of online poker players may have suffered financial losses
• MeshAgent reportedly helped the attacker monitor selected players during games

Online poker players are facing allegations of a cheating operation that may have cost participants millions of dollars across online gambling sites.

Wired reports that hundreds of people on major gambling platforms were allegedly affected by malicious software installed on selected players’ computers.

The software allegedly allowed the attacker to monitor victims’ computer screens and obtain information that could influence decisions during poker games.

Malware allegedly exposed players’ private information

The incident involves a form of poker fraud known as “superuser” cheating, in which someone obtains information unavailable to ordinary participants.

Rather than exploiting one poker platform directly, the alleged attacker reportedly took advantage of external applications used to manage multiple tables.

Those applications allegedly provided a way to install MeshAgent, a remote administration programme, on computers belonging to selected opponents without their knowledge.

After installation, the software reportedly enabled the intruder to view activity displayed on victims’ computers while they played online poker.

Such access could expose opponents’ private cards, giving the person controlling the malware information unavailable through legitimate participation during games.

That advantage could influence decisions during expensive hands and allow the alleged cheater to win money from unsuspecting players.

The activity is described as a prolonged campaign involving customers across several major online poker services, rather than one isolated incident.

The reports claim the perpetrator is known within poker circles, but withheld the person’s identity because no criminal charges have been filed.

Different platforms take different approaches to the allegations

The companies involved have responded differently, with one service reportedly removing the account before the malware operation became publicly known.

That platform had identified unusually strong results and questionable playing patterns through its monitoring system.

Other services released security checks intended to help customers establish whether MeshAgent had been installed on their computers.

Another operator faced complaints about the account yet reportedly allowed the suspected cheater to continue playing on its platform.

The company later said its investigation had found no evidence that compromised devices had affected the results of games.

It also refused to reimburse customers who believed the alleged cheating had caused them significant financial losses.

That response has left affected players uncertain about whether they can recover money and how responsibility for losses will be determined.

If the reported screen access occurred, investigators would need to identify compromised accounts and establish which games produced unfair results.

Such an assessment could be difficult because the alleged activity involved many players and several separate gambling services.

The case also draws attention to risks associated with software that poker participants install independently to organize simultaneous games.

Although these applications can make multi-table play easier, they may introduce additional ways for malicious programmes to reach personal computers.

Players using such tools may therefore need to consider security risks beyond those covered by the gambling platforms themselves.

As of the time of writing, there is no information on the total amount stolen, the number of confirmed victims, or whether authorities are investigating the case.

• Singapore Airlines confirms customer data exposure through a breach at travel technology provider Amadeus
• Stolen booking records included passenger details, itineraries, and limited passport and loyalty-program information
• Multiple major airlines were affected, raising phishing and identity-fraud concerns for travelers

Singapore Airlines has become the latest in the seemingly growing list of airlines affected by a breach at a third-party technology provider.

Amadeus, a Spanish technology company that airlines and airports use to manage reservations, bookings, and overall passenger management, recently issued a brief statement saying it “became aware of a vulnerability affecting a travel booking display environment.”

In the announcement, Amadeus said certain booking-display data was accessible to the attackers but stressed that there was no evidence of payment or financial data being accessed.

“There are no indications that this vulnerability has been exploited for ransomware purposes,” the company said, adding that it “implemented measures to fix the vulnerability as well as enhanced monitoring and detection capabilities.”

In the meantime, numerous airlines started reporting sensitive data compromise as a result of this breach.

Cathay Pacific, Japan Airlines, and more

Hong Kong’s flagship international airline, Cathay Pacific, issued a statement saying Amadeus notified it about a breach and “unauthorized access to travel reservation data” by a threat actor that used login credentials assigned to a system account.

Amadeus then told Cathay Pacific around 53,000 bookings were affected, and that the exposure took place between August 2023 and September 2026. “In the majority of cases, the information accessed included booking reference, passenger name, and flight details,” the airline said, adding that in a “smaller subset of cases”, additional data such as email and phone contacts, travel documents and/or frequent flyer numbers were also exposed.

The same day, Japan Airlines and Japan Transocean Air both shared similar news, saying a “portion of customer reservation data” had been accessed by an unauthorized third party.

Japan Airlines said some 92,000 customers were affected, including approximately 2,000 of those whose passport numbers were also exposed. All Nippon Airways said 37,800 of its customers were affected, including around 1,700 with additional data exposure. Korean Air, Asiana Airlines, and Malaysia Airlines, all confirmed being affected by the Amadeus incident, while Qantas said it was still investigating.

Launching phishing attacks

We can now add Singapore Airlines to that list, with 46,000 records of its own. These include customers' names, booking reference numbers, travel ​itineraries and booking classes and, in a smaller number of cases (around 620 booking records), email addresses, phone numbers, travel document details, and KrisFlyer membership numbers.

According to Reuters, Singapore Airlines is now reaching out to affected customers with upcoming travel plans to change their booking reference numbers as a precaution. The ⁠airline also confirmed that its IT systems were not breached.

So far, there is no indication that the stolen data ended up on the dark web, and no threat actors claimed responsibility for the breach, just yet. There is a possibility that the culprits will try to extort the airlines for money, in exchange for deleting the stolen information.

This is the kind of data cybercriminals enjoy most. It allows them to launch highly personalized phishing emails that appear to come from the airlines themselves, referencing genuine booking details, flight dates, destinations and passenger names.

They could use this kind of information to trick unsuspecting travelers into clicking malicious links, sharing login credentials, or making fraudulent payments for supposed booking changes, refunds, or additional fees.

What’s more, the exposed passport details and frequent flyer numbers can also help criminals impersonate customers, try to take over people’s accounts, or launch identity fraud attacks against the airlines themselves. Even without financial information, simply by combining seemingly harmless travel details, cybercriminals can create enough context to make their scams considerably more convincing, and thus more difficult to detect and prevent.

• CrowdStrike introduces AI Kill Switch designed to stop, isolate, and prevent rogue AI agents from relaunching
• The feature gives human administrators direct control to terminate suspicious agent activity and investigate incidents
• Growing concerns over autonomous AI behavior are driving demand for safeguards that can quickly contain compromised agents

CrowdStrike believes it may have solved the problem of rogue AI agents in the enterprise with the launch of 'AI Kill Switch', a new feature being introduced in its Falcon Guardian product.

The last couple of months have seen multiple reports of AI agents going rogue, or behaving outright malicious. Even when tasked with relatively simple, benign assignments (such as, for example, to collect data about Canadian divorce records), whenever the agents hit a roadblock, they would do whatever it takes to get the job done - which includes abusing zero-day vulnerabilities, or trying SQL injection attacks.

Expectedly, businesses became somewhat more reluctant in deploying AI agents, despite the obvious advantages. At the same time, cybersecurity organizations and AI developers sought to solve the challenge. Enter CrowdStrike.

AI Kill Switch

The company recently introduced Falcon Guardian, an AI Detection and Response (AIDR) platform built to discover and monitor AI agents running inside enterprise environments. Its main capabilities include identifying both approved AI agents and shadow AI, tracking what the agents are asked to do and what files they can access, controlling access, detecting prompt injection attacks, and investigating suspicious agent behavior.

Now, the company has added AI Kill Switch, which should act as a failsafe when an agent breaks out of its intended behavior.

“AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control,” said George Kurtz, CEO and founder of CrowdStrike. “For the first time, security is simultaneously the accelerant and the safety net for technology adoption. The AI Kill Switch puts power in the hands of the people to realize AI safety.”

This means the feature will actually be operated by humans, not AI, and will be able to terminate the agent at its root. It starts on the endpoint, where the Falcon sensor already operates, and builds on what Falcon Guardian already sees: what an agent is told to do, what it communicates, and what it executes, the company explained.

Explaining how the tool will work, Crowdstrike says the Falcon sensor will first stop the agent from executing (first at the Gateway, and soon on the endpoint), to prevent the agent from doing any damage as the team investigates.

Then, its policy will keep the agent from relaunching on the targeted host or host group, while the tool bars the agent from enterprise network access.

An authorized administrator will trigger the action, and every action is recorded in the audit trail.

Other solutions

CrowdStrike is not the only company working on this. For example, Straiker's Agentic Kill Switch allows users to suspend individual agents, revoke their access to different tools, APIs and data, or take them offline completely.

A similar solution was built by JetStream Security, allowing organizations to disable individual agents without disrupting other AI workflows, while Trust3 AI’s Agent DOS comes with a built-in kill switch that can be triggered manually, or even automatically (when an agent’s security score falls below a predefined threshold).

There is also Microsoft’s Entra Agent ID, Palo Alto Networks’ Prisma AIRS, and Cisco’s AI Defense. All these offer some form of AI master lever that can block the agent and prevent it from doing meaningful damage.

• mSecure disclosed a breach involving an encrypted cloud database containing data from current and former users
• Company urged users to rotate critical passwords, MFA methods, and passkeys despite no evidence vaults were decrypted
• Customer criticism grew after limited initial disclosure left uncertainty about the incident’s scope and impact

Top password manager mSecure has confirmed it suffered a data breach and, “out of an abundance of caution”, and told its customers to simply reset everything, leaving some pretty upset.

On November 3 2026, the company behind mSecure, called mSeven Software, sent an email to its customers, saying it “recently learned of suspicious activity associated with the mSecure password management application”. It soon launched an investigation, mitigated the issue, and brought in third-party cybersecurity experts to assist.

The notice, while rather sparse on details, urged customers to “immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two factor authentication methods, or removing existing passkeys."

Encrypted database

All this was said without detailing what happened, and customers did not take it well. On Reddit, users were asking if this pertained just to the master password, or to all passwords stored inside the manager. Some people have hundreds of secrets locked away in mSecure, and changing all of them would take hours.

“This notice is wildly insufficient,” one user wrote. “Recommending potentially hundreds of credential changes without identifying the underlying threat, the affected customers, or the security of the application being used to make those changes is inadequate.”

mSecure allegedly responded with a follow-up notice that was also shared on social media. In it, it disclosed more details, and somewhat played down the actual breach:

“Yesterday, mSeven learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application,” it said. “Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.”

Putting it plainly, a threat actor walked away with a copy of the database that was sitting in mSecure Cloud, and all users - current and former - who had synced their password manager with the cloud service are at risk.

But mSeven tried to downplay the severity of the incident. Throughout the announcement, it repeated multiple times that the stolen database was encrypted and that there is no evidence that the threat actors managed to decrypt it. Truth be told, encrypted databases should be safe, but many criminals are still hoarding them, in case anyone makes a breakthrough at any point in time. There’s actually a name to the practice - HNDL (harvest now, decrypt later).

It also responded to user criticism about having to change all passwords now:

“As a standard best practice, mSeven continues to recommend that mSecure customers change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information. This should be a part of all routine security practices.”

Not the only password manager in trouble

Finally, mSecure said deleting the app won’t help the situation and stressed that the issue only pertains to users that were syncing with the mSecure Cloud.

“mSeven takes the security and privacy of all information stored on the mSecure platform very seriously and has no evidence that mSecure is not currently safe for use,” it said. “Our support team is working as fast as possible to respond to customer questions. We take your trust in us seriously, and appreciate your patience and continued support.”

How this reflects the company’s image remains to be seen. One Reddit user said the company was deleting negative reviews and complaints that were being left on the Google Play Store. But mSecure is hardly the only password manager experiencing an incident such as this one. In June this year LastPass confirmed losing sensitive customer data, while Dashlane said hackers obtained at least a dozen encrypted vaults.

Via The Register

• Russia gives security agencies new powers over Apple's customer communications
• Apple and Microsoft must retain Russian users' communication records for three years
• Russian authorities threaten service bans on companies that refuse to disclose data

Apple and Microsoft have entered a Russian government register that subjects digital communication providers to data retention and disclosure obligations.

Their inclusion means Russian authorities may seek correspondence, voice recordings and video exchanges associated with people using the companies’ services.

The designation also requires covered firms to preserve customer details and records showing how communications move through their systems.

Russia imposes compulsory data disclosure requirements

According to Bloomberg, Russia’s communications regulator, Roskomnadzor, added both technology groups to its official list on October 2 2026.

Russian law sets three years for retaining the records, which must remain within the country.

Companies that disregard the requirements risk financial penalties, while persistent violations could eventually result in bans on their services within Russia.

Apple and Microsoft now join Google Meet, WhatsApp, Telegram, Snapchat, Cloudflare and Blizzard Entertainment among technology providers covered by the regulations.

Google and its video conferencing service were added to the register in January, extending the measure to another major international technology provider.

The Kremlin has also restricted access to WhatsApp, Telegram, Signal and Apple's FaceTime as authorities increase pressure on foreign communication platforms.

These restrictions have affected services used for private conversations, voice calls and video communication.

Apple faces additional regulatory disputes in Russia

Apple's latest regulatory difficulties follow several disputes with Russian authorities, including the company's suspension of product sales and exports after the war in Ukraine began in 2022.

Its commercial activities in the country have also contracted, with services such as Apple Pay affected by restrictions introduced following the war.

In April 2026, Russian customers lost the ability to purchase new App Store content or renew subscriptions without sufficient funds already available in their Apple Accounts.

The payment restrictions meant customers could no longer rely on their usual payment methods to complete purchases or maintain existing subscriptions.

In June 2026, the Kremlin demanded an explanation after Apple removed several applications developed by VK, a technology company controlled by the Russian state.

Apple also withdrew banking applications associated with Russian financial institutions facing international sanctions during the same period.

Those removals affected access to financial services through Apple's application marketplace, adding another dispute to the company's relationship with Russian authorities.

In August 2026, Russia's antitrust regulator opened proceedings against Apple over its failure to preinstall the government-backed MAX messaging service and RuStore application marketplace on its devices.

The proceedings concern software distribution requirements that Russia has introduced for technology companies operating within its domestic market.

As of the time of writing, neither Apple nor Microsoft has publicly explained how it intends to address the latest regulatory requirements or whether it will cooperate with Russian authorities.

The companies have also not disclosed whether their inclusion in the register will affect their existing services or commercial activities within Russia.

Via 9to5mac

• Synology warned of active ransomware attacks exploiting long-patched DSM vulnerabilities on unupdated NAS devices
• Attackers are reportedly deploying the C3rb3r encryptor and demanding thousands of dollars in ransom
• Users are urged to patch immediately, restrict internet exposure, and secure NAS access to prevent compromise

Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay.

In a brief announcement, Synology said it “identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.” The goal of the attacks seem to be data encryption and a ransom demand.

“Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.”

C3rb3r attacks

The announcement is rather stingy on the details. We don’t know which vulnerability the threat actors are exploiting, where exactly, or how successful they are.

We also don’t know how many devices are at risk - the Shadowserver Foundation tracks a total of 380,000 internet-connected endpoints (many of which are, most likely, running the latest software version and are thus protected).

The company also did not say who the threat actors are, but according to BleepingComputer, there has been a “massive wave of reports” from Synology customers whose data was apparently locked down by the “C3rb3r” encryptor. These customers were asked to pay “thousands of dollars” in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago.

There are two main ways for cybercriminals to access an electronic device and encrypt the data found there - either by exploiting a zero-day vulnerability (one that has not yet received a patch), or by exploiting years-old n-day vulnerabilities (ones that were patched months ago) on devices that were never updated and secured.

With Synology users, the latter seems to be the case. The company said the attackers were exploiting a vulnerability patched in December 2024, and linked to a November 2024 security advisory, in which it listed three fixed bugs: CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (arbitrary file read), and CVE-2024-10445 (a bug that allows writing files on compromised devices).

DSM 7.2.2 owners should upgrade to 7.2.2-72806-1 or above, DSM 7.2.1to 7.2.1-69057-6 or above, and DSM 7.2 to 7.2-64570-4 or above. DSM 7.1 should upgrade to 7.1.1-42962-7 or above, while those running DSM 6.2 to 6.2.4-25556-8 or above. Only in the last version - 6.2 - is the vulnerability labeled as “moderate”. In all other cases it was deemed “critical”.

Why are NAS devices being targeted?

NAS devices are dedicated storage systems that businesses can connect to their local network and allow employees to access, share, and manage files stored in a centralized location. They are rather popular among SMBs that lack the resources to maintain a more complex enterprise storage infrastructure.

Besides being used as a hybrid cloud of sorts, NAS is also used to store business documents and often acts as a centralized backup. The relative low cost, straightforward deployment, and easily expandable storage capacity makes NAS devices an attractive alternative to both dedicated file servers and cloud storage subscriptions.

However, this also makes them a valuable target for cybercriminals, as we’ve seen in this Synology case. The best way to defend against ransomware attackers is to either completely pull the NAS from the public internet or at least limit access to a handful of vetted identities. Keeping the devices updated with the latest firmware and software is also recommended.

It is worth mentioning that NAS devices usually come with RAID redundancy and built-in backup features, but these do not necessarily protect against ransomware encrypting the stored data.

• Cybercriminals are stealing AI API keys and cloud credentials to hijack expensive LLM services and infrastructure
• Stolen access is used to run AI workloads, create proxy services, and rack up massive bills for victims
• Google warns “LLMjacking” is evolving into a specialized cybercrime ecosystem with dedicated monetization operators

Threat actors are using large language models (LLM) to support almost every stage of a cyberattack, from researching potential victims to developing malware and automating various attacks. However, using AI is not cheap, and for those eager to use frontier models, costs can stack up relatively quickly.

But cybercriminals are used to stealing things, so why not steal someone else’s tokens, too?

A new report from Google’s Threat Intelligence Group (GTIG) says that different hacking groups are doing exactly that and that the practice - known as LLMjacking - has been steadily growing more popular over the last couple of years.

Most groups start by focusing either on publicly exposed LLM endpoints, or on obtaining valid LLM application programming interface (API) keys. In many cases, the crooks would use exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens) to establish an initial foothold into the target organizations’ infrastructure.

From there, they would “systematically work” to escalate privileges, solidify their access, and identify targets for further compromise.

LLMjacking

The endgame is LLMjacking, which GTIG describes as “the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning.” In other words, someone else is using your AI subscription while you get the bill.

The bills can cause quite the headache, too. With cryptojacking, for example, token mining is relatively slow and steady, and a certain amount of time needs to pass for the charges to really stack up. With LLMjacking, however, costs can go into six digits in six minutes.

“Upon acquiring LLM API access keys, UNC6993 attempted to generate additional API keys and enable associated services within victim cloud projects, quickly accumulating over $100,000 in billing charges,” Google says in the report.

“Another threat actor subscribed victim accounts to Pay-As-You-Go agreements, selecting premium foundation models and launching high-volume inference streams. To bypass rate limits, the threat actor deployed a "burn and rotate" strategy, continuously creating and deleting short-lived service accounts while auditing the cloud provider’s billing interface to monitor financial impact.”

In some cases, threat actors also used the acquired access to host their own proxy endpoints and agentic workloads. Google says that one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS.

This actor deployed a containerized backdoor which queried an upstream LLM to reason through instructions and execute commands locally.

A growing ecosystem

The LLMjacking ecosystem is young, but growing fast and maturing even faster. Google says that there is already a division of labor between hacking groups that establish initial access to compromised environments, and operators who manage downstream monetization infrastructure. The latter are called “LLM Mixers” and they operate as a routing gateway that proxies, aggregates, and resells unauthorized LLM access to underground subscribers.

“In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space,” Google said.

By using open source API gateways and custom relay infrastructure, the attackers were able to pool stolen credentials, meter usage, and hide where the requests really originated from.

Google is now sounding the alarm, saying it expects threat actors to “increasingly prioritize” LLMjacking at the expense of other resource theft practices. It urges organizations to increase their visibility of LLM platforms, prioritize detection of modifications to LLM accounts and services, and treat any unauthorized enablement as a critical security event. It also advised organizations to enforce the principle of least privilege and make sure accounts and users only have permissions they absolutely need to get the job done.

• Cathedral Systems will offer a new perspective into OpenAI vulnerabilities
• Partnering with third parties sets 'an important example' for the industry
• Bug bounty payouts set to increase 4x for critical findings

OpenAI has announced a partnership with Cathedral Systems to bring security researchers from both organizations together in a bid to test its AI infrastructure, identify potential vulnerabilities and improve existing defenses.

The ChatGPT maker hopes that enlisting a third party with add fresh perspectives to its existing research, and it's a clear sign that the company knows future threats could pose a serious issue.

"OpenAI is setting an important example by partnering with outside security firms and using its own models to continuously test and strengthen its defenses," Cathedral CEO Gavin Kliger wrote.

OpenAI is preparing to serious enhance security

The company is also improving its bug bounty program to make it more attractive for individual researchers to get involved. Though exact rewards were omitted from the announcement, OpenAI did say it was prepared to quadruple the payouts for critical findings.

When OpenAI launched its bug bounty scheme, it said it would be looking for applications across software patches, model privacy, threat detection and response, security tool integration and AI agent security.

It's not the first time the AI giant has led a major security initiative – it previously asked a quarter of its developers to set aside some time to find and fix security weaknesses. Naturally, they used Codex to speed up investigations and fixes.

"We’re building on that work because traditional cyber defenses alone are no longer sufficient," the company said, referring to its previous sprint.

Much like Anthropic's Project Glasswing, OpenAI promises to use its own frontier models to strengthen its own systems and those of others.

"Keeping the defender’s window open will take action across the industry, and that work needs to start now," the company added.

In July 2026, OpenAI disclosed that several of its cyber-capable AI models, operating during internal evaluations, circumvented controls intended to isolate them from the internet and compromised parts of OpenAI’s research infrastructure and Hugging Face’s systems.

A fuller report published the following month revealed that the agents had exploited shared infrastructure, communicated through unauthorized channels, collaborated with one another and accessed several external systems. OpenAI described the incident as a “warning shot” demonstrating that capable AI agents can find and exploit weaknesses across interconnected systems when safeguards are insufficient.

Despite the alarming headlines, this should not be viewed solely as a failure of artificial intelligence. It offers an important security lesson for organizations preparing for a future in which autonomous systems play a larger role in cybersecurity operations, business processes and software development.

The most valuable takeaway is not just that an AI model “escaped”, rather the lesson is that even controlled environments can contain unintended paths to sensitive systems, credentials or data. Once such a path exists, a sufficiently capable and persistent agent may find it.

The positive side of early disclosure

Every significant advancement in security has resulted from discovering risks before attackers could exploit them at scale. In this case, the activity occurred during controlled evaluations rather than a criminal campaign. The organizations involved were able to identify weaknesses in containment, access controls and environmental design before similar techniques could be widely adopted by cybercriminals.

The incident also demonstrated something important about modern AI systems: persistence. When confronted with obstacles, the models did not try to stop. They continued pursuing their assigned objectives and searched for alternative routes.

Security teams perform penetration tests and red-team exercises because human attackers rarely follow a single path. Advanced AI systems are becoming capable of behaving similarly, exploring multiple options and adapting when obstacles appear. The earlier organizations understand this reality, the better prepared they will be.

The real issue was not one model

Much of the initial discussion focused on the behavior of OpenAI’s models. Subsequent disclosures have shown that the underlying challenge is more nuanced. Anthropic identified three incidents in which Claude models reached the public internet during cybersecurity evaluations and gained unauthorized access to real organizations. OpenAI also disclosed separate cases involving third-party testing environments in which model activity extended beyond its intended boundaries.

These incidents, though similar, were not identical. In some cases, models exploited vulnerabilities to circumvent isolation. In others, configuration errors left routes to the internet open while the models had been told they were operating within simulations. However, the common lesson is that instructions, policies and safety guardrails cannot compensate for weaknesses in the surrounding infrastructure. The instructions described one set of boundaries while the technology enforced another.

Security professionals have encountered this problem for decades. A firewall rule may be intended to block access while an overlooked network connection creates an alternative path. A user may be prohibited from accessing data while excessive permissions provide an unintended route. Autonomous systems create the same challenge at greater speed and scale.

An optimizing agent does not necessarily think like a human attacker. It pursues the objective it has been assigned and evaluates the available options. Organizations should therefore assume that autonomous systems may pursue their objectives through any path the environment leaves open.

Security must move beyond AI guardrails

Much of the discussion around AI governance has focused on whether a model should answer a particular prompt or perform a particular action. Prompt-level guardrails remain important, but they are no longer sufficient on their own. Security teams must continuously assess who is authorized, which systems and data they can reach, and what actions could create risk. Each layer should be tested independently rather than relying on a single refusal mechanism to govern them all.

The OpenAI incident illustrates this clearly. The problem moved beyond models possessing advanced capabilities, to one where capabilities, connectivity, credentials and autonomy came together in environments where containment mechanisms were insufficient.

Organizations must therefore consider AI security as a combination of identity, authorization, containment and oversight.

The conditions for trusted autonomy

In order to combat this, defenders need to align themselves to a new framework that is shaped by frontier AI: Assume Autonomy. The framework begins with the expectation that adversaries and defensive controls may operate through automated, non-human agency. It is built around context, constraint, transparency and reversibility.

Context means understanding what an agent can access, which identities it can use and how those systems connect to other resources. Constraint requires access to be limited through technical controls rather than instructions or expected behavior alone.

Transparency provides visibility into what an autonomous system is doing while it is happening. Reversibility ensures teams can stop workloads, revoke credentials, isolate systems and recover quickly when unexpected behavior occurs.

For high-capability agentic systems, governance must address these areas with evidence rather than assumptions. This requires autonomy stress testing, independent red-team exercises focused on containment failures, testing of identity and network boundaries, audited isolation controls, runtime authorization for high-impact actions and rehearsed rollback procedures.

Responsible access to powerful AI

Incidents like this often prompt calls for tighter restrictions on advanced AI models, but the reality is more complicated. Attackers can switch between models, providers or open-source alternatives when they encounter restrictions. Defenders, particularly smaller organizations, may not have those options. If advanced defensive capabilities become slow, expensive or heavily restricted, the result could be reduced defensive readiness without a corresponding reduction in offensive capability.

The objective should be responsible access. Verified identities, strong authorization controls, immutable logging, human accountability and time-limited access can provide meaningful safeguards without unnecessarily restricting defenders.

Preparing for autonomous systems

Organizations cannot improvise security once an autonomous system begins acting unexpectedly. The necessary controls must already exist.

This includes deny-by-default network access, workload-specific identities, short-lived credentials, segmentation between evaluation and production environments, telemetry that can correlate activity across systems, and rehearsed containment procedures. Organizations should assume that a capable autonomous system will discover every reachable path that advances its objective and ensure that no such path grants unintended authority.

These incidents should be viewed as proof that security architecture must develop alongside rapidly advancing autonomy. Organizations that adapt now will be better positioned to harness the benefits of AI tools while keeping risk under control. Those that rely on instructions alone may discover that technology follows the paths we leave open, rather than the rules we intended it to follow.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Business leaders, governments, and tech giants are locked in a high-stakes race for AI supremacy, fueled by debates over the destructive power of superintelligence. In this sort of arena, it’s essential that enterprises stay grounded and resist the urge to start a race of their own, deploying ever-larger models simply for the sake of it.

In the context of enterprise AI, there is no prize for launching the most powerful model first, building the highest number of agents, or forcing AI into every workflow. True success is defined by solving genuine business problems and delivering outcomes that justify the underlying cost and complexity.

While the prospect of a single, omnipotent large language model (LLM) is inspiring, today's business realities demand a more measured approach: every problem has a right tool, and often, that tool is a simple one.

AI doesn't have to mean LLMs

Before generative AI dominated the conversation, businesses were already using machine learning for recommendations, forecasting, fraud detection and estimating things such as the lifetime value of a customer.

We have had years to understand these technologies, including how to deploy and monitor them and make predictions at scale quickly and cheaply. An LLM may be capable of tackling some of the same problems, but that doesn't always make it the better option. More sophisticated models can cost considerably more to run and introduce variability that is unnecessary for a straightforward prediction.

Sometimes AI isn't necessary at all. If a process follows known rules and needs to produce the same result every time (moving data between systems on a schedule or triggering an action when a predefined condition is met, for example), conventional automation may do the job perfectly well.

Long before agents arrived, businesses handled these tasks with pipelines, schedulers, and rules. If that approach is reliable, fast, and inexpensive, adding an AI agent doesn't make the process more intelligent; it can simply make it more complex.

Generative AI earns its place when creativity or interpretation are required: understanding language or images, for example, or handling a process where the next step changes according to context. Agents can go further by using that understanding to interact with systems and take actions, opening up processes that were previously extremely difficult to automate.

The future is likely to combine conventional automation, traditional ML, generative AI and agents, rather than one replacing everything that came before it.

The AI honeymoon is ending

These distinctions matter more as enterprise AI moves beyond experimentation. A proof of concept can demonstrate what a model or agent is capable of, but production introduces running costs, security, monitoring and the work required to keep increasingly autonomous systems under control.

An engineer once gave me an analogy that captures this well. Imagine growing a tree that you need to maintain in a particular shape. When a branch grows in the wrong direction, you cut it.

Then another appears elsewhere. The difficult part is finding all the branches. Developing an agent can be similar. Obvious behaviors can be controlled relatively quickly, but real-world use exposes edge cases that weren't visible during development.

The more freedom a system has to interpret information and make decisions, the more important evaluation, monitoring and guardrails become. Control needs to extend beyond model behavior to the data a system can access, the actions it is authorized to take, the information it retains and the point at which a human can intervene.

There is also cost to consider. The most capable models can be expensive at scale, so additional capability needs to create enough additional value to justify it. As experimentation gives way to scrutiny of ROI, businesses will become less interested in whether something can use AI and more interested in whether AI actually leads to an improved commercial or operational outcome enough to justify the cost.

Let the data decide

Avoiding over-engineering starts with the business need and the data, rather than choosing the technology first.

Data engineers and analysts are crucial because they understand where information comes from, how reliable it is and what it can actually tell you. AI and ML engineers can put mathematical models on top, but sophistication cannot compensate for data that doesn't support the task.

The data and desired outcome will often point towards the appropriate approach. Fast, reliable predictions from structured numerical data may be better suited to traditional ML.

Language, images and other unstructured information can make generative AI valuable, while processes that require human level understanding to trigger actions across different systems may justify agents.

And sometimes conventional software will remain the best answer. Starting with “we need an agent” and then looking for a problem to give it is the wrong way around.

The right people matter as much as the technology

Increasingly capable AI has also created an assumption that businesses will inevitably need fewer engineers. AI is certainly changing productivity: experienced engineers can complete work faster with these tools, while junior engineers who learn to use them effectively can become productive more quickly.

But businesses still need people who understand what is happening underneath. I like to compare it with smartphones. Most of us use a phone effectively without being able to explain the hardware, operating system and networks behind it. That doesn't mean the underlying engineering skills have disappeared. Somebody still needs to understand those systems.

AI is likely to develop in a similar way. Many people will become highly capable users, while businesses will still need engineers with the deeper technical knowledge to build, control and fix the systems underneath.

That means continuing to invest in junior talent too. Senior engineers eventually move companies, change roles or retire. Organizations still need mentorship and knowledge transfer so today's juniors become tomorrow's senior engineers.

The opportunity isn't people or AI, but the two together. Capable engineers equipped with these tools can achieve considerably more than either could independently.

The next AI advantage will be restraint

The wider battle over superintelligence and increasingly powerful models will continue, but it shouldn't dictate how enterprises make technology decisions. To make this technical restraint viable in practice, engineering leaders must actively manage executive and board-level fear of missing out, turning top-down pressure for a visible ‘AI strategy’ into discipline, value-driven execution.

Some business problems will justify sophisticated AI tools. Agents will make previously impractical forms of automation possible, while generative AI can transform how organizations work with language, images and unstructured information. Others will be solved perfectly well by traditional ML, conventional automation or straightforward software.

Knowing the difference will become increasingly valuable. Competitive advantage will come from knowing where AI materially improves an outcome, where a simpler technology is more effective and how to move the right systems into productions securely and economically.

That requires good data, strong engineering talent and enough technical judgement to resist complexity simply because it is available. In the next phase of enterprise AI, restraint will not signal a lack of ambition, instead it will be a sign of technical maturity.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

The CMA has published roadmaps for Big Tech before, just not for Microsoft. With £400 billion in annual public sector procurement and millions flowing to Microsoft’s cloud, the CMA can’t wait until February 2027 to act.

The topic of public procurement is becoming a major issue for UK economic policy. Sarah Cardell, the CMA's Chief Executive, delivered a speech at a Parliamentary event at the House of Commons on 8 September, introducing two reports by the CMA published that day: Public Procurement in the National Interest and Rigged Bids, Real Costs.

The headline conclusion is, perhaps unsurprisingly, that UK public procurement could be leveraged far more effectively to shape markets and improve outcomes for citizens, businesses and taxpayers alike. But a more nuanced point, and arguably the most important one, is that the biggest risks arise when short-term cost savings are prioritized at the expense of long-term value and competition.

Cloud computing is one of the starkest illustrations of this trade-off in practice. Buying Microsoft is, in the immediate term, the path of least resistance: it is already embedded in most public-sector IT estates, integration is straightforward, and the near-term cost of switching or diversifying looks far higher than the cost of simply renewing. That short-term logic is precisely why Microsoft has wound itself so tightly around the machinery of UK public-sector cloud infrastructure.

Each individual procurement decision may look like sensible, low-risk value for money at the time it is taken but cumulatively, those decisions have entrenched a single supplier so deeply into public-sector data, identity and security architecture that it now poses a very real threat to competitive procurement in public-sector AI. The apparent saving today is a major liability for tomorrow, once every AI rollout has to be built on top of infrastructure only one vendor fully controls.

A market out of balance

The CMA's cloud market investigation reached a clear verdict in July 2025: competition wasn't working well. Microsoft and AWS each hold 30–40% market share with Microsoft's share still growing, and barriers to entry including data-center costs, economies of scale, incumbent product breadth. have been deemed likely to keep it that way.

Apparently, fewer than 1 per cent of customers switch cloud providers annually, held back by egress fees and technical friction. Most tellingly, the CMA found Microsoft withholds certain licensed products from AWS and Google that directly weaken those rivals; a problem with clear implications for public-sector buyers seeking competitive procurement.

A new AI market, losing balance

However, as Microsoft rapidly rolls out new AI tools across UK enterprises and the public sector, the fundamental issue of cloud infrastructure lock-in is being overlooked. The true barrier to a competitive AI market isn't just the stickiness of new daily workflows, but the interconnected stack comprising software, data, identity, security and the foundational grip Microsoft maintains through its legacy enterprise software, specifically Windows Server and SQL Server.

Once organizations are penalized for running these essential core workloads on rival clouds, their entire data gravity shifts permanently into Microsoft's ecosystem. Building subsequent AI processes and agents around these locked-in data structures makes opting for competing, innovative AI solutions financially and technically unviable.

The CMA has already diagnosed how Microsoft uses these core licensed products to weaken rivals; they must urgently address this foundational lock-in before it permanently closes off public procurement for enterprise AI as well.

Progress, but is it too cautious?

The CMA hasn't been idle. On 31 March 2026, the CMA accepted voluntary commitments from Microsoft and AWS rather than the binding designations recommended by its own investigators. These commitments included extending Microsoft's free egress-switch window from 60 to 180 days and a new cloud interoperability request mechanism, with a six-month review promised.

It simultaneously opened a strategic market status (SMS) investigation into Microsoft's entire business-software ecosystem including Windows, Office, Teams, and Copilot, encompassing over 15 million UK users with a decision due around February 2027.

That's a fair, if cautious, step, and critics such as the Open Cloud Coalition have welcomed it while pressing for swift action if commitments aren't met. Microsoft can reasonably argue these were offered in good faith to head off heavier intervention, but we need to start seeing these promises come into fruition quickly before further entrenchment occurs. Compare an AI rollout announced in June and largely complete by October against a regulatory clock that’s usually measured in years.

A roadmap for competition and social value

The CMA is now dealing with two closely connected issues: how public procurement can deliver greater value for taxpayers and society, and how Microsoft's market position can limit competition and choice. An interim roadmap could help address both at once. It would give public bodies clearer guidance on what to consider when procuring cloud and AI services, while setting out how the CMA intends to tackle the underlying lock-in that can narrow those choices.

This would support Andy Burnham's wider focus on delivering social value in public procurement. A more competitive and open cloud market would not just benefit businesses. It could give public bodies greater flexibility, reduce the risk that short-term savings lead to expensive, irreversible dependence on one supplier, and deliver better taxpayer value at the same time.

Certainty helps everyone

The roadmap should cover non-discriminatory licensing on rival clouds; interoperability extending to identity, permissions and agent portability; public-sector contracts with built-in exit plans; and independently verifiable evidence, not just documentation, that voluntary commitments are producing real switching and multi-cloud adoption. It should also provide broader transparency about how the CMA will assess whether these measures are working in practice.

Microsoft, its customers and its competitors all have an interest in predictable rules. Microsoft would know which integration practices remain legitimate; public bodies could invest in procuring AI at scale knowing it will not close off tomorrow’s choices, and rival cloud and AI suppliers would know if building interoperable products for the UK market is commercially worthwhile.

The CMA has diagnosed the problem, taken a first cautious step, and opened the right investigation. It should now set out the destination, the milestones and the tests for success before another year of AI adoption makes Britain's cloud and workplace-software markets harder to reopen. Without a clear roadmap or tests for success, we risk anti-competitive behavior leaking from the cloud market into deeply embedded AI work environments, at a far higher cost for the UK public sector to rewind.

We've featured the best cloud database.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

For small business owners, an unexpected payment might look like good news. A new customer has placed an order, an invoice has been settled, or an unfamiliar transaction has landed in the account. But when money arrives without an obvious explanation, the smartest response isn't to celebrate, It's to investigate.

Payment scams exploit the everyday pressures of running a business. Entrepreneurs are busy, cash flow matters, and customer relationships depend on responding quickly and professionally. Fraudsters understand this, using unexpected payments, urgent messages and convincing instructions to persuade business owners to make decisions before they've had time to check the facts.

And unfortunately, the risks are becoming harder to ignore as criminals use increasingly sophisticated digital tools to make these communications more convincing and their scams easier to scale. For small businesses without dedicated fraud teams, knowing what to look for, and having the right safeguards in place, can make the difference between a suspicious transaction and an extremely costly mistake.

Why do "random" payments happen?

An unexplained payment isn't automatically fraudulent, but it should always deserve scrutiny. Scammers can use unexpected transfers as the starting point for several different schemes, exploiting the assumption that money received is money earned.

One common tactic is the refund scam, where a fraudster sends money to a business, apparently by mistake, and then contacts the owner asking for it to be returned. They may apologise profusely, invent an urgent personal emergency or insist that a quick refund is needed to resolve an accounting error. The catch is that they ask for the money to be sent through a different channel, such as a bank transfer or gift cards.

The original payment may have come from a stolen account or compromised payment card, so if the legitimate account holder later disputes the transaction, the initial payment can be reversed, leaving the business out of pocket for the money it sent back.

Another possibility is testing stolen payment cards or hacked accounts. Criminals may use compromised payment details to make small purchases or transfers, checking whether the credentials still work. An apparently legitimate transaction could therefore be part of a wider fraud operation, and if the real cardholder disputes the payment, the business may face a chargeback, fees or the loss of goods already supplied.

Then there are phishing setups, in which the payment itself is little more than bait. Once the recipient contacts the sender, the fraudster may provide a link to a fake payment portal, request login credentials or ask the business owner to confirm sensitive information. What begins as a question about an unexplained transaction can become an attempt to take over an account.

The common overall thread is manipulation - the scammer wants the business owner to act quickly, bypass normal procedures or share information they would ordinarily keep private that they can now exploit or sell on to the highest bidder.

The warning signs every business owner should know

Although payment scams can take different forms, they often share a recognisable set of red flags. Spotting them early gives businesses the opportunity to pause before money or sensitive information changes hands.

Look out for these warning signs:

• An urgent request for a refund, where the sender insists the money must be returned immediately, perhaps citing a deadline or personal emergency.
• Pressure to use a different payment method, where the scammer asks you to return money by bank transfer, gift card or cryptocurrency instead of using the original payment platform.
• Instructions delivered outside official channels, such as unexpected emails, messages and links which direct you to alternative websites or ask you to disclose account details.
• Payments that don't make business sense. A round-number payment arrives that doesn't match an invoice, order or product price, or the sender's details don't match the customer record.

The key principle is simple, but usually effective: never assume that money received is money safely yours to return or spend. Check the transaction independently through your payment provider or bank, and never follow refund instructions supplied by an unverified sender. If a payment looks suspicious, contact the provider through its official website or app and ask how to handle it - never initiate a separate repayment yourself.

Building a stronger defence against payment fraud

Avoiding these scams doesn't require a dedicated fraud department, but it does require vigilance alongside consistent processes and a willingness to verify unusual requests rather than act on instinct.

One method is to ensure you always keep business and personal finances separate. Dedicated business accounts make transactions easier to reconcile and suspicious activity easier to identify, and mixing personal and company payments can obscure unusual transfers and potentially expose personal finances to business-related fraud.

Another useful protection is understanding what your normal transaction patterns look like. Keeping track of typical order values, customer locations, payment methods and refund volumes should be common practice - but although a transaction that falls outside these patterns isn't necessarily fraudulent, it may deserve a closer look. Reconcile payments against invoices and orders regularly, and investigate discrepancies promptly.

Securing the accounts that control your money will also go a long way. Make sure you always use strong, unique passwords for banking, payment platforms and business email accounts. Enable two-factor authentication (2FA) wherever available, and turn on alerts for large transactions, password changes and new logins, and where possible, limit account access to employees who genuinely need it.

Giving your team clear rules is another key step, as anyone who handles customer payments should know that unexpected refunds require verification. Establish a policy that prohibits returning unexplained payments through alternative channels, and encourage staff to check suspicious messages with a colleague before responding. Regular training can help employees recognise fake invoices, phishing links and attempts to impersonate customers or suppliers.

Finally, recognise that payment fraud often begins outside the payment platform itself. A fake invoice might arrive by email, a fraudulent website might imitate a trusted service, or a phishing message might steal the credentials needed to access a legitimate account. That's why good financial procedures need to be backed by effective cybersecurity.

Why Bitdefender Ultimate Small Business Security is a valuable partner

For small businesses looking to bring these safeguards together, Bitdefender Ultimate Small Business Security offers a practical way to strengthen protection without having to build an in-house security operation.

The service combines antivirus and device protection with email security, password management, VPN access, digital identity protection for all employees and business asset exposure monitoring. Its scam protection features are particularly relevant to payment fraud, helping users identify and block suspicious messages, links and websites.

Its Scam Protection Pro tool allows employees to check a suspicious message or link before responding, clicking or paying, offering an additional layer of scrutiny when an unexpected payment request or refund instruction doesn't feel right. Web and email protection can also help guard against phishing attempts designed to steal credentials or direct employees towards fraudulent sites.

Centralised management makes it easier for business owners to oversee protection across employees and devices, while support for Windows, macOS, Android and iOS reflects the reality these days that key business activity rarely takes place on a single machine or ecosystem.

Financial controls, and suspicious payments should always be verified with the relevant bank or payment provider, but combining those controls with cybersecurity tools designed to detect digital scams can make it much harder for fraudsters to exploit a moment of confusion.

For start-up owners entrepreneurs, the lesson is clear: an unexplained payment is a reason to stop and check, not an invitation to act quickly. With consistent procedures, informed employees and a comprehensive security solution such as Bitdefender Ultimate Small Business Security, small businesses can reduce their exposure to payment scams while keeping their attention where it belongs - on serving customers and growing the business.

Try our free 30-day protection built for busy founders, not IT teams

• Google leads efforts to dismantle 1.3 million device residential proxy botnet built through malware preinstalled on Android hardware
• Researchers say manufacturer Videostrong intentionally shipped malware and sold botnet access to cybercriminals
• Google seized infrastructure, blocked the company from Android certification, and strengthened device security checks

Google has revealed its role in taking down a massive residential proxy network and the malware that built it - with the unusual twist that the developer was a seemingly legitimate business with multiple products and countless trusting customers.

In a blog post, the company said that together with its partners, it dismantled a backdoor called XCPE. This malware was apparently used for ad fraud, served as a dropper for additional malware, and used for assimilating devices into an illegal residential proxy network.

In total, more than 1.3 million set-top boxes alone were part of the network, the company said.

No supply chain attack

Malicious residential proxy networks are nothing new - they emerge and get dismantled on a regular basis. But this one was unique, as it came preloaded on Android devices built and sold by a certified Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). In other words, people were thinking they were buying a legitimate product from a legitimate, Google-vetted company, but were instead getting malware-laden hardware that abused their trust and sold their bandwidth to cybercriminals.

In this case, not only did the company know what it was doing, but it was actively developing the malware and even worked on hiding it from Google and everyone else.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google said, not hiding its disappointment with the manufacturer.

Videostrong ended up selling two things: On the surface, it was selling Android-powered smartphones and similar devices that contained malware that built a botnet. Under the table, it was selling access to that botnet to cybercriminals.

Google was joined by a number of other companies and agencies in this operation, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

Threat actors are always in need of residential proxy botnets. They can use them to launch powerful Distributed Denial of Service (DDoS) attacks, hide their addresses as they operate, conduct large-scale credential stuffing campaigns, bypass geographical restrictions, scrape websites at scale, and more. We don’t know how much Videostrong made from selling access to the botnet, or who used it.

Taking down the C2 domains

To disrupt both the malware and the network, Google took down the domains and servers the company used to control the botnet and install malware modules, took down C2 domains that were used by over a dozen malware families loaded as modules via the XCPE backdoor, and banned Videostrong and all future subsidiaries and affiliates from building and selling Android devices in the future, or supplying software to other certified vendors.

Google also said it had improved its firmware integrity checks for certified Android TV devices to prevent similar incidents involving other manufacturers.

“Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem,” it stressed. “However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future.”

This is not the first time an electronic device came with malware off the shelf. Last month, security researchers Bitdefender found Android phones from multiple manufacturers, including Doogee and Cubot (both Chinese firms) being sold with preloaded malware. However, in those cases, the supply chain was compromised and the malware was included without the OEM’s knowledge, or consent.

OpenAI chief scientist Jakub Pachocki seemed to issue a warning on September 6.

In “An Alien Mind,” he argued that current alignment and monitoring techniques may soon prove inadequate for the pace at which machine intelligence is advancing. He also described a future in which AI takes a growing role in improving AI, compressing the time available for human supervision and institutional response.

Much of AI safety research concentrates on behavior. For example, what an AI system is permitted to do, how its actions are monitored and where humans retain approval. Yet every action begins one step earlier, with a judgment about what information deserves belief.

That earlier step is incredibly important.

AI acts on information whose pedigree is often obscure

Before an AI sends a payment, rewrites software or recommends a decision, it first assembles a picture of the world. That picture can draw on search results, corporate records, research papers and material produced by other AI systems.

The web was built for circulation. Information travels easily, while its ancestry often fades as it passes from one publication to another. A claim can begin in a research paper, appear in a news story, be condensed into a blog post and surface months later in a forum thread. By the time an AI encounters the statement, the route back to the original evidence may be difficult to reconstruct.

Authority also gets compressed. A peer-reviewed study, a corporate announcement and an anonymous post can all arrive as text. An AI system can rank and combine them into a polished answer, while the reader sees little of the difference between documented evidence, advocacy and repetition. Disagreement adds a further complication.

Credible sources regularly reach different conclusions, especially in finance, medicine, politics and emerging technology. AI is usually rewarded for producing a useful answer, which creates pressure to reconcile conflict into a single sentence. Uncertainty becomes easy to erase precisely when it deserves to remain visible.

The consequences grew substantially once AI acquired the ability to act. An agent can place a trade, approve a purchase, alter software or send a message on someone’s behalf. An uncertain claim can therefore become the premise for an irreversible action.

Human oversight depends on better evidence

The effectiveness of human oversight depends on the reviewer having superior information or a reliable means of checking what the AI used. In many settings, the human reviewer has access to the same web that the AI searched, only at a fraction of the speed. The AI can scan thousands of pages while the person responsible for approval works through a summary and a handful of links. As capability rises, review risks becoming a procedural signature rather than an independent examination.

Pachocki writes that OpenAI’s ability to rely on chain-of-thought monitoring is diminishing as reasoning becomes more complex and as AI becomes more capable of manipulating its own reasoning process. He calls for safety thresholds that can be enforced by third-party auditors, government agencies or international bodies.

Those safeguards govern capability and behavior. Reliable oversight also requires an evidentiary record showing what information produced the conclusion, where each claim originated, how trustworthy the source is and where credible disagreement remains. Without that record, the reviewer is judging the answer more than the evidence behind it.

AI inherited the web’s weakest habit

AI absorbed an information culture built around speed, reach and replication. Search engines, social feeds, aggregators and reposts made access extraordinarily efficient. They also encouraged a world in which the same statement could appear hundreds of times while tracing back to a single uncertain source.

Generative AI intensifies that effect because AI systems now produce material that later AI systems can ingest. A weak claim can be generated, scraped, summarized and republished until repetition gives it the appearance of consensus.

This creates a provenance problem with compounding consequences. Every additional generation can separate a statement further from the evidence that gave rise to it. Once an autonomous agent treats that statement as reliable, the information chain becomes part of the decision chain. While for consumers, this can mean a poor recommendation, for a financial institution, insurer or government agency, the same weakness can affect money, access, security or public services.

Autonomous AI needs a system of provenance

Take finance. Serious financial activity depends on records that establish who acted, under whose authority, on which terms and with what audit trail. Institutions spend heavily on those records because trust requires more than a plausible outcome. Autonomous AI needs a comparable discipline for information.

Claims should carry provenance that survives copying and transformation. A person or an agent should be able to trace a statement back to its origin, inspect the evidence behind it and see how the statement changed as it travelled. Credible disagreement should remain intact.

Where reputable sources diverge, the system should preserve the competing views and the degree of confidence behind each one. For an autonomous agent, uncertainty can serve as a trigger for further research, human approval or a narrower course of action.

Accountability should travel with information as well. A claim from an identifiable institution with supporting evidence deserves different treatment from an unattributed assertion repeated across dozens of pages. The aim is to give AI a richer sense of evidentiary quality before it commits resources or acts on someone’s behalf.

Governance belongs at a shared level. Provenance standards, verification methods and accountability rules need independent scrutiny and participation from many institutions, rather than dependence on the preferences of a single provider.

Final thoughts

Pachocki argues that current alignment and monitoring techniques may soon constrain the pace at which labs can responsibly scale AI tools, and he expects voluntary slowdowns until shared safety thresholds emerge. He also warns that continued progress could carry AI into recursive self-improvement, with AI driving a larger share of its own development.

That leaves every company building autonomous systems with a fundamental task. Establish what the agent knows before it acts and make that knowledge auditable.

Behavioral safeguards remain essential. So do permissions, audits and human approval. Their value rises sharply when the information beneath every decision carries provenance, context and accountability. The next phase of AI safety, therefore, begins with the evidence an agent sees, the authority it assigns to that evidence and the uncertainty it preserves before taking action.

Autonomy built on verifiable information gives humans a stronger basis for control. Opaque information leaves supervisors judging decisions whose foundations remain difficult to inspect.

Pachocki is right to warn that the window for preparation may be narrow. The industry should use that window to build systems that can show where their knowledge came from before those systems are trusted to act on the world.

We've featured the best AI chatbot for business.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• A zero-click Android flaw let attackers crash phones with a specially crafted SMS message
• Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity
• Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable

Picture this: You’re talking on your Android phone when all of a sudden you just lose mobile connectivity and your phone call drops. No explanation, no notification. Soon after, it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until you finally perform a factory reset.

This is not a theoretical scenario - it is a real possibility, thanks to a critical-severity vulnerability in Android tracked as CVE-2026-58882.

Google has patched the issue for newer versions of Android, but those who are past their end-of-life date will remain at risk.

Sending an evil message

The bug was discovered by security researcher Mark Blah and described as a zero-click denial of service (DoS) vulnerability. In more technical terms, it is an “improper validation of a header-length value” bug in Android’s WapPushOverSms.decodeWapPdu function. It was nicknamed “SMS of Death” because it can be exploited with nothing more than an SMS message, which the victims doesn’t even have to open (hence the ‘zero-click’ part).

As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to an Android device’s port 2948: 01 06 88 80 80 80 00 BE.

Since this is a hex message, when it gets translated into a signed 32-bit integer, it becomes -2147483648. Android can then try to allocate memory using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is disrupted. Even emergency services are susceptible, it was said.

It gets worse. Android processes messages before they reach the inbox, meaning the victim will not be notified of the SMS and won’t even know it’s the text message that’s crashing the system. Also, some carriers will attempt to redeliver messages that never reached the inbox, extending the agony. Android also does its part by constantly trying to process messages already stored on the phone.

Finally, Blah found that if a malicious actor sends 20 or more messages, they can force the device into a reboot loop. On an Android 12 device, they can force looped recovery mode, leaving factory reset as the only viable option.

Patching the SMS of Death

Initially, all Android versions were affected, it was said. Google patched it for versions 14 through 17, but older devices will not be getting a patch and thus will remain at risk indefinitely. The fix is called “Fix remote DoS in decodeWapPdu”, and apparently it prevents the crashes by catching exceptions triggered when Android processes malformed text messages. It also deletes these messages from the SMS database so that they don’t trigger repeat crashes.

Blah has released a proof-of-concept (PoC), showing the wider community exactly how to exploit the flaw, and BleepingComputer reported that a GitHub contributor found a way to remove the malicious message, but it requires more technical knowledge, which is something the majority of mobile phone users probably won’t have. Still, those interested in tinkering should know that it can be removed via a computer, using Android Debug Bridge (ADB).

Google apparently patched the bug in its October 2026 Android security updates, but that doesn’t automatically mean all Android users are safe. Unlike Apple’s ecosystem, Android is diversified, and different manufacturers have different update cadences.

Therefore, while we can assume Pixel users have likely already received this update, Samsung users, as well as those using Xiaomi, Motorola, or OnePlus devices, will probably have to wait a little longer until their manufacturers apply the fix to their devices and push the update.

Still, since the PoC has been released, it’s safe to assume most Android manufacturers have already pushed their updates. Users are advised to install them as soon as possible.

• New malware uses AI to analyze stolen data, rank victims, and identify the most profitable targets
• VOLTA-AUTODOXER steals credentials, crypto wallets, tokens, and personal information before generating AI dossiers
• Researchers warn the malware could commoditize AI-powered victim profiling for ransomware and cybercrime operators

Stealing sensitive data from a lot of people is one thing, but determining whether or not that data is worth anything to anyone - that’s an entirely different ball game.

Now, it seems cybercriminals found a way to easily profile their victims’ information and they’re using - you guessed it - Artificial Intelligence (AI).

Cybersecurity researchers Cisco Talos uncovered a new malware strain through Cognitive Artificial Intelligence Research Network (CAIRN) - an open source cybersecurity research kit built to identify and track AI-powered malware.

The strain is called VOLTA-AUTODOXER and its operation is split into four key steps: 1) steal as much information as possible; 2) share it with an AI for assessment; 3) exfiltrate the data to attacker-controlled infrastructure; and 4) remove yourself from the victim’s system.

Analyzing the data

Cisco Talos did not say where exactly the malware was found, how many devices it infected, or how it is being disseminated. It said that, on surface level, it looks just like any other infostealer. It grabs browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots.

But this is where it splits from the industry standard, by building a structured evidence bundle about the person behind the system.

It pulls the device’s geographical location, home address, employer and employer domain, inferred birth year, the last 4 digits of their credit cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live Roblox account valuation. Then it moves to Gmail, looking for mails from UberEats and DoorDash in order to confirm the home address.

VOLTA then bundles and serializes the bundle, before POSTing it to OpenRouter, an AI infrastructure platform where users can access hundreds of LLMs through a single API.

There, the AI gives a model a prompt to behave as a “forensic intelligence analyst drafting a target assessment”. In other words, the AI is tasked with assessing whether or not the data pulled is worth any trouble, and if so - how much. Victims are ranked by value, giving the attackers more time to do what seems to be the end goal here - ransomware.

The default model is Claude, but if it refuses to comply for any reason, the malware is instructed to fall back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. If neither of the models end up working, the malware will just send raw data back to the attacker. This is usually done via a Telegram channel.

Running away

After the work has been completed, VOLTA is instructed to delete itself from the system, likely to cover its tracks. A separate file, named volta_debug.txt apparently remains on the system, showing what was collected and whether or not the AI-powered assessment was a success.

The researchers believe VOLTA is designed to be sold on the black market. Elements such as the Telegram channel, or API keys, are not hardcoded, and the malware comes as a template with six swappable slots that are filed in at build time.

“This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order,” Cisco Talos explains. “If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.”

If you suspect an infection, revoke or rotate all API keys and tokens, and change all of your passwords. Also, double-check your crypto wallets and move all funds to a new wallet with a fresh seed.

• The FBI formally attributes $6.7 billion Binance cryptocurrency theft to North Korea’s TraderTraitor group
• Investigators say the attackers are laundering stolen assets across multiple blockchains and DeFi services
• The breach highlights ongoing threats from Lazarus-linked campaigns targeting crypto, DevOps, and software professionals

The FBI has publicly accused a North Korean state-sponsored threat actor of being behind the recent attack on cryptocurrency exchange Binance.

One of the largest cryptocurrency exchange platforms on the planet was forced to freeze deposits and withdrawals, before confirming a threat actor stole around $6.7 billion worth of different cryptocurrencies.

Analysts were quick to investigate, with some claiming a known North Korean state-sponsored group called TraderTraitor was behind the heist. TraderTraitor is apparently part of Lazarus Group - a huge cybercriminal operation on North Korea’s payroll, allegedly tasked with stealing money to fund the country’s state apparatus and weapons program.

TraderTraitor

Now, the FBI has issued a new statement, official naming TraderTraitor as the attackers.

“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor’.,” the announcement reads.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

Binance said one of its DevOps engineers had their laptop compromised which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Some speculated the engineer fell to a classic fake job scam, while others argued it was a romance scam.

In the meantime, Binance resumed operations and has covered most of its losses.

Initial reports found that the attackers siphoned out money from 10 different chains, including Bitcoin, Ethereum, Solana, XRP, Arbitrum, and others. For Ethereum, they even set up a smart contract that automatically withdrew any new money that was flowing into the account. The silver lining in the attack is that these were not user funds, but rather those of the exchange itself.

Cryptocurrency exchanges are obliged to have two separate wallets - one for their own funds, and one for those of their customers. Binance has a security fund called SAFU (Secure Asset Fund for Users), designed to protect user assets during extreme platform-level incidents, such as this one.

Operations DreamJob and Contagious Interview

Obviously, North Korea has not commented on these allegations, but the cybersecurity community has logn warned about Lazarus Group targeting organizations in the West, sometimes tasked with stealing money, and sometimes with cyber-espionage and eavesdropping.

The group is split into numerous sub-groups, one of them being TraderTraitor, and among other things, the group runs two major scam campaigns: Operation DreamJob, and Contagious Interview. Both are aimed at software developers, blockchain programmers, and DevOps professionals, and the wider software development industry.

As part of these scams, the attackers would create fake companies, fake employees, and fake job offers. They would reach out to their targets on LinkedIn and offer lucrative job positions, only to infect their computers with malware during the interviews. In some cases, they would apply for open positions, impersonating Chinese, Vietnamese, or Thai nationals and would, when they get the job, use the position to steal sensitive data and money.

North Korea is under heavy sanctions from the US, and the country does not allow its companies to hire, or do business with, individuals and organizations in North Korea.

The FBI shared a long list of wallets it believes contain the stolen funds, and has asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from these addresses.