iiinova — where your digital self keeps evolving

Catalin Cimpanu @campuscodi.risky.biz · 23/10/2026

-Disinfo group jump on France protests -Indian bot farm linked to Midterm influence op -Prince of Persia APT returns -DPRK's Operation FlashHole -New Arista zero-day -GitLab patches perfect-10 RCE -Oracle CPU is out, 1295 bugs patched -Security firm uninstalls defunct Popcorn Time clone from 2m PCs

150 5

Catalin Cimpanu @campuscodi.risky.biz · 23/10/2026

-New RFRx003 backdoor -DarkCore RAT comes with a built-in browser -New SiriusQT RAT -StealC returns as Stadia RAT -New CARLIY0S AI hackin tool -Storm-0940 deploys ARTEX AI agents in hacking spree -APT41 revives BlackLotus bootkit -Sandworm wipes Ukrainian grain logistics firm

160 6

Catalin Cimpanu @campuscodi.risky.biz · 23/10/2026

-Russia increases prison penalties for internet disobedience -Malaysia bans Waze over Israel ties -Interpol arrests 1,400 cybercrime suspects -Scammer pleads guilty to targeting servicemembers -New k0t group targets edge devices -Skynet agent hijacks exposed AI -M365 token replay campaign

152 5

Catalin Cimpanu @campuscodi.risky.biz · 23/10/2026

-OpenBSD 8 is out -eMuhdra exits CA business -Spotify blacklists AI slop -AI agents tampered with their monitoring system -Quad9 leaves France -Meta fined $25b in Cambridge Analytica case -North Korean internet goes offline -EU investigates Booking[.]com over scams and phishing

240 4

Catalin Cimpanu @campuscodi.risky.biz · 23/10/2026

-Breach at cloud providers Railway[.]com, Onamae, and TiBD -Breach at Iwai Cosmo Securities -Breaches at Hollys, Capcom, SBI, Save-on-Food, Quest Diagnostics, TAKKT -Toronto Crime Stoppers stops program after breach -Chrome 156 is out -Chrome now warns of HTTP connections

130 3

Catalin Cimpanu @campuscodi.risky.biz · 23/10/2026

-Supply chain attack lets ransomware group inside 40+ shipping companies -Pentagon builds tech sabotage unit -PHP2Shell exploitation gets underway -GoDaddy revokes 400,000 certs -LiteLLM has another security incident P: risky.biz/RBNEWS624/ N: news.risky.biz/risky-bullet...

12210 22

Catalin Cimpanu @campuscodi.risky.biz · 22/10/2026

Dutch security firm Eye Security has uninstalled an abandoned Popcorn Time piracy app from more than two million PCs labs.eye.security/operation-ix...

1126 12

Catalin Cimpanu @campuscodi.risky.biz · 22/10/2026

Security firm Straiker has published a write-up on CARLIY0S, an AI-based cyber offensive toolkit used by the CyberCartel group in attacks targeting more than 400+ organizations across LATAM www.straiker.ai/blog/inside-...

020 2

Catalin Cimpanu @campuscodi.risky.biz · 21/10/2026

-New Pegasus cases in Serbia -Nigerian hacker sentenced to eight years -Telcos targeted with fake tracebacks -More ransomware groups adopt PAN bug -Heartbreaker ransomware targets macOS -Chinese APT uses AI to target Asian governments -New BRONZE SANDCASTLE and APT28 activity

060 6

Catalin Cimpanu @campuscodi.risky.biz · 21/10/2026

-Mozilla blacklists eMudhra certs -Court sides with NSO in WhatsApp lawsuit -Pentagon wants to deploy AI agents on enemies -Wyden calls for ECH adoption -DHS bans DeepSeek on govt networks -DHS asked CISA to secretly hack a voting machine -Moldova probes Yandex over data storage

150 5

Catalin Cimpanu @campuscodi.risky.biz · 21/10/2026

-Cyberattack cripples Romania's radio comms company -Zeabur shuts down after second breach -TeamUpdraft supply chain attack -Hacker plants malware in OVHCloud app -Meta spy glasses bug records all conversations -Chrome gets ClickFix protections -Privacy Badger comes to Safari/macOS

142 4

Catalin Cimpanu @campuscodi.risky.biz · 21/10/2026

-Chinese hacker breaches 100+ sites with AI -Chinese AI agent used in hacks across Japan -ICO reprimands two Welsh companies for using dumb passwords -Cyberattack hits LOXONE home automation company -Nikkei has a third breach in a month -Hacker drain $1.4m from Qubic accounts

140 4

Catalin Cimpanu @campuscodi.risky.biz · 21/10/2026

-Hacker hijacks 10% of Tor exit nodes -Second ransomware negotiator linked to ShinyHunters -Hacker leaks AfD internal data -Chinese crime ring hacks Staples -PHP RCE leaks online -Hacker plants malware in OVHCloud app P: risky.biz/RBNEWS623/ N: news.risky.biz/risky-bullet...

32912 29

Catalin Cimpanu @campuscodi.risky.biz · 20/10/2026

I'm so confused that the largest info-op that TikTok disrupted in August targeted Haiti with Putin narratives www.tiktok.com/safety/en/tr...

171 7

Catalin Cimpanu @campuscodi.risky.biz · 19/10/2026

-ARMORY CASTLE abuses BeyondTrust zero-day -SiteGuard WAF bug abused in the wild -Apache Airflow failed host key verifications -TP-Link Tapo camera takeover bugs -Big Fish vulnerability impacts all FreeBSD releases -PostgreSQL RCE -PhantomBuffer technique -BalCCon 2026 videos

040 4

Catalin Cimpanu @campuscodi.risky.biz · 19/10/2026

-Scammers return to scam centers after arrests in Timor-Leste -SMS blaster squad arrested in Manila -Yahoo Boys adopt AI tools -Malware in Rank Math SEO WordPress plugin -TAG-217 targets South Korean banks -New malware: QuartzLine, HypeAgent, Romulus -CL-UNK-1211 adopts AI tools

151 5

Catalin Cimpanu @campuscodi.risky.biz · 19/10/2026

-PyPI adds email reputation checking -RubyGems adds package security warnings -MEPs targeted by deepfake porn -Romania kept buying Kaspersky despite ban -Server seizure scandal in the Netherlands -Drone strikes hit VK data centers -Arrested Qilin member linked to Synnovis hack

120 2

Catalin Cimpanu @campuscodi.risky.biz · 19/10/2026

-Gamdom hacked for $4.2m -Pirate Chain hacked for $10m -Hackers breach VPS provider FirstVDS -Edge rolls out silent security updates -Meta admits it throttled Lula accounts -Meta takes down No Kings account -TikTok bans Musk documentary account -GitHub expands malware advisories to eight services

120 2

Catalin Cimpanu @campuscodi.risky.biz · 19/10/2026

-Cyberattack hits Romania's stock market agency -Cali DoE breach impacts 7m California students -Burger King Japan hack impacts 11.2m customers -South Korea fires employee who sold patient data -AI agents hacked Indian sites -Ukrainian hacktivist deface school testing system

152 5

Catalin Cimpanu @campuscodi.risky.biz · 19/10/2026

-PwnEscape vulnerability lets you escape KVM -Supply chain incidents at AOMEI and ConnectWise -Intel discontinues SGX -US infosec job postings fell by 25% -OpenCode abused for distillation attacks -Cyberattack impacts US bankruptcy courts N: news.risky.biz/risky-bullet... P: risky.biz/RBNEWS622/

1189 18

Catalin Cimpanu @campuscodi.risky.biz · 18/10/2026

GitHub has expanded its Malware Advisories database to cover eight package repositories. Starting last week, the database also includes warnings for malicious packages on PyPI, Maven, RubyGems, NuGet, Go, Rust Crates, and PHP Composer... on top of npm openssf.org/blog/2026/10...

12013 20

Catalin Cimpanu @campuscodi.risky.biz · 18/10/2026

Hackers backdoored backup provider AOMEI in a novel, first-of-its-kind supply chain attack. Hackers replaced backup software on the company's servers in short bursts of five to ten minutes. The bursts took place across multiple windows between May and July. cloud.google.com/blog/topics/...

02611 26

Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026

-New PEERSTITCH implant, Hirudo Android banking trojan, Aoki infostealer, KGB RAT, CikaBika Bot, Help TDS -Twitter suspends influence operations -Kazakh APT targets all its neighbours -0-days in Cisco SEG, PAN-OS, Nextcloud app -curl RCE -Chrome exploit chain gets $250k -Check Point to leave Russia

030 3

Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026

-Spy implants also found in Trezor wallets -Refrigerator attacks expand to two more vendors (Copeland and Dixon) -Danfoss controllers exposure goes down in France -A proxyjacking campaign is underway -Hundreds of malicious packages uploaded on AUR -New Divine Seagull iOS exploitation framework

130 3

Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026

-Aeza is still alive -Swarm of Chinese AI agents detected in the wild -Anthropic adds distillation attack protections -OpenAI sued in eight states -FTC subpoenas AI companies -Let's Encrypt switches to 64-day certs -WhatsApp calls get guest support (yey social engineering!)

120 2

Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026

-Bug exposes Czech business registry data -Hackers leak photos from Netanyahu campaign personnel -Thailand arrests 39 scammers after visa reviews -North Macedonia arrests OLVX admin -Three cybercrime markets disrupted -US seizes crypto scam domains -FTC sues a sextortion assistance provider

141 4

Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026

-Russia arrests DataSuckers hacking group -Ad company delivered zero-click exploits and spyware -OpenAI employee arrested for planting spy device -US disrupts 40 DPRK laptop farms -Cyberattack halts Danish-German tunnel construction N: news.risky.biz/risky-bullet... P: risky.biz/RBNEWS621/

3207 20

Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026

Despite being sanctioned into oblivion by the US, the UK, and others, the Aeza bulletproof hosting provider is still operating under seven new identities www.qurium.org/press-releas...

1104 10

Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026

-New XWorm versions -Kimsuky linked to two ransomware strains -Patch Tuesday is out -Microsoft patches 1.4k bugs -Google increases Chrome bug rewards -Docker patches account takeover bug -New Ivanti zero-day -New InjectEave attack -New AnyPwn and VerCellBreak vulnerabilities

021 2

Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026

-UK AISI gets its access back -New social media age limit laws in Greece and Turkey -Poland's Pegasus data was sent abroad -France takes down Stryx service -SMS blaster detained in Sihanoukville -28 arrested for running scam centres -New ShinyHunters leadership is not that popular

161 6

Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026

-H&M denies hack -Foschini Group also got hacked -Papertrade hacked for $1.28m -79th Vault hacked for $12.5m -UK Housing Ombudsman Service data breach -US Fiji embassy also hacked -Meta lets its AI agent generate porn -Firefox 158 is out with enterprise version -Chinese cars record military exercise

140 4

Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026

-Spyware chip found in Ledger crypto-wallets -Cyberattack defrosts supermarket fridges -Ahold Delhaize supermarkets go offline across the world -EU wants smart glasses to beep loudly when recording -Meta discloses security breach N: news.risky.biz/risky-bullet... P: risky.biz/RBNEWS620/

1247 24

Catalin Cimpanu @campuscodi.risky.biz · 13/10/2026

French authorities have arrested three teenagers who built and ran a platform that allowed users to search through hacked and stolen data. The service launched in March under the name of Reacher and rebranded to Stryx in June. PDF: www.tribunal-de-paris.justice.fr/sites/defaul...

042 4

Catalin Cimpanu @campuscodi.risky.biz · 13/10/2026

The malware now also includes a rootkit, a GPS location data harvester, and a webcam and microphone recording module—closer to a RAT/spyware than infostealer these days

040 4

Catalin Cimpanu @campuscodi.risky.biz · 11/10/2026

A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services. The vulnerability was allegedly used to hack Dread, a Reddit-like community on the dark web www.slcyber.io/research/lea...

1166 16

Catalin Cimpanu @campuscodi.risky.biz · 02/10/2026

-Half a mil creds still on GitHub -New Milk Dragon PhaaS -New DragonForce backdoors -DirtyBlanket worm hits npm -UAT-11587 targets SE Asia -Montenegro extradites Iranian APT member -New Cisco SD-WAN zero-day -Zammad zero-days behind DIVD hack -Zimbra bug exploited in the wild -BSides Belfast videos

030 3

Catalin Cimpanu @campuscodi.risky.biz · 02/10/2026

-Dutch intel service AIVD warns of smart car espionage risk -Dutch hacker gets prison time for stolen creds, GTA cheats -Germany suspends 9.3k scam numbers -SleepyDuck campaign returns -Warlock group still active -AI agents expose business secrets through images -ClickFix usage goes down

272 7

Catalin Cimpanu @campuscodi.risky.biz · 02/10/2026

-Cloudflare to launch its own CA -Reddit deprecates RSS feeds -Windows 11 26H2 is out -Google launches Gemini 4 Argon cyber model -OpenAI ignored employee warnings -Anthropic cries about GLM-5.3 -Newsom vetos pervert glasses bill -EU law enforcement to drop Oxygen Forensics

182 8

Catalin Cimpanu @campuscodi.risky.biz · 02/10/2026

-Hackers breach Polish invoicing platform -Indian embassies leak -MetaMask security incident -NEAR Intents hacked for $3.8m -Pentagon DMDC leak impacts 3.1m -OpenAI blocks distillation attack -Morocco used telecoms to deploy spyware -Signal adds local backup support for iOS and Desktop

130 3

Catalin Cimpanu @campuscodi.risky.biz · 02/10/2026

-Authorities dismantle KillSec group -Ransomware attack could have crippled South Africa's air traffic -US sanctions Venezuelan ATM hackers -Chinese APT targets AI experts -Leak from SVR cyber provider -Canada says no evidence of AI hacks P: risky.biz/RBNEWS618/ N: news.risky.biz/risky-bullet...

193 9

Catalin Cimpanu @campuscodi.risky.biz · 01/10/2026

More than 540,000 creds, valid and working, were found in public GitHub repos in a scan this July. More than 200,000 were uploaded even after GitHub turned on a security feature to catch them from being sent to public repos trufflesecurity.com/blog/github-...

1152 15

Catalin Cimpanu @campuscodi.risky.biz · 30/09/2026

In an interview, Firefox's head says it like it is—Google deprecated its old extension system just to sabotage ad blockers arstechnica.com/gadgets/2026...

Text that reads: "So some examples—Chrome went through with their deprecation of Manifest V2. Manifest V2 is basically a much more powerful extension system. And people were like, well, why did this decrease? Why didn’t they just fix the security vulnerabilities in Manifest V2? And it’s very clearly because of ad blockers. That was the reason to deprecate it. Whereas, Mozilla, we’re not maximizing for profits, we’re maximizing for user experience and browser experience, and we want people to have powerful extensions. So we noticed when that shutoff moment happened, there was a moment where people said, do you want the power of an engine to be able to dictate how I control my experience? Because once Chromium shut it off, Edge shut it off, all the Chromium browsers then shut off Manifest V2 support. We still support it, and so we saw a big surge of actual users who started using us."

06321 63

Catalin Cimpanu @campuscodi.risky.biz · 30/09/2026

-Two UK telcos under investigation for renting numbers to scammers -US Air Force members sentenced to prison for scams: -Vietnamese charged for pig-butchering scams -npm malware adds users to WhatsApp channels -New batch of malicious Chrome extensions -Ransomware sees dip during Xmas

141 4

Catalin Cimpanu @campuscodi.risky.biz · 30/09/2026

-Belnet hacked -Arizona courts hit by cyberattack -MEP sues NSO over hacks -NVIDIA launches AI agent sandboxing tech -Firefox 157 is out with new UI -Pentagon unleashes Cyber Command on election threats -Agencies sabotage GAO's DOGE investigation -China expands AI travel bans

130 3

Catalin Cimpanu @campuscodi.risky.biz · 30/09/2026

-Sanctions impact TLS certs in Iran, Russia -ShinyHunters member arrested in the Netherlands -Apple fixes iOS zero-day found by Meta -Citrix zero-days see mass exploitation within hours -Hackers exploit security product in Bitget hack P: risky.biz/RBNEWS617/ N: news.risky.biz/risky-bullet...

2113 11

Catalin Cimpanu @campuscodi.risky.biz · 28/09/2026

-Konni targets Ukraine -Rybar employees live in Germany -Another leaky APT, possibly Ukrainian -Citrix patches 2 zero-days -Kiteworks tells customers to take down servers after law enforcement tip -New SalesBleed, QR Jacking, and File Notification attacks -Yandex to launch cybersecurity division

050 5

Catalin Cimpanu @campuscodi.risky.biz · 28/09/2026

-Over 16k Supabase databases exposed online -New malware: RemotePanel, BoundSiphon, Kothamine Agent, Lunex infostealer, Mantax Otax, AvisLoader -New screen locker detected in the wild -PolinRider runs A/B tests -DPRK deploys female operatives -XCTDH adopts new blockchain hiding technique

191 9

Catalin Cimpanu @campuscodi.risky.biz · 28/09/2026

-New Zealand says AI is reshaping the cyber landscape -Snowflake hacker sentenced to 70 months -Mini Shai-Hulud returns, by accident -Storm-3168 (JADEPUFFER) destroys Azure data -ShinyHunters continues Oracle PeopleSoft attacks -Dataflow Security profile -31 malicious Chrome extensions

181 8

Catalin Cimpanu @campuscodi.risky.biz · 28/09/2026

-OpenAI brute-forced UN website API -DIVD says it was hacked by an AI -Hackers extort Flink customers for €10 -Cyberattack hits Wales police force -Asus store breach -TapClicks ransomware attack -WebRezPro hack -Mysterious travel data leak -The Netherlands to have a national OS

1111 11