An Israeli advertising company quietly turned the infrastructure of targeted digital ads into a delivery mechanism for mercenary spyware, according to new research from the Citizen Lab at the University of Toronto. The findings, published October 15, represent the first publicly confirmed case of zero-click government-grade spyware delivered through online advertising. The company at the center of the report is Discover-Tech, registered in Israel and run by CEO Dekel Boni. On its surface, Discover-Tech operated like any other demand-side advertising platform, placing bids across major ad exchanges and running campaigns through networks including Google, Yandex, Liftoff and Comcast's Beeswax. Underneath that veneer sat a second product entirely: a targeting tool called Controlium that, researchers say, was designed to push malicious code to specific individuals based on their device ID, browser cookie, or IP address. The mechanism is what makes this case technically significant. When a user's device connected to the ad infrastructure and matched an attacker's target list, Discover-Tech's "NOAS server" would return a fragment of JavaScript rather than an ordinary ad. If the device was not a target, the server returned nothing at all, which helped conceal the malicious activity from the ad vendors relaying the traffic. The user never clicks anything. The ad impression itself is the attack. Citizen Lab researchers call this technique AdFection. Al Jazeera Between 2024 and 2025, at least 45 Windows devices at Al Jazeera were compromised this way. Researchers attribute the attacks with high confidence to Candiru spyware, now rebranded as Integrity Labs. The technical trail includes a Windows DLL recovered from a compromised machine that hard-coded command-and-control servers bearing a fingerprint consistent with Candiru's known infrastructure, along with a 48-byte repeating XOR encryption key and a persistence method, COM hijacking, matching Candiru's attack chain from 2021. Researchers traced the full infection sequence: an ad impression served through Discover-Tech's infrastructure, contact with a Candiru validator server, and then with a Candiru command-and-control server. The governments behind the targeting remain unidentified. Who was behind Discover-Tech The research places Discover-Tech in a web of relationships with the commercial spyware sector. Eric Banoun, whom the Israeli newspaper Haaretz has described as one of the pioneers of offensive cyber in Israel, served as a director at Discover-Tech from 2020 to 2025. He also held shares in Intelos, a firm that appears elsewhere in the report as an ADINT surveillance company with at least 15 linked users on the Controlium platform. Between 2020 and March 2026, Discover-Tech shareholders included a company connected to Sara Hamou, whom researchers say managed the corporate network of Intellexa, the now-sanctioned consortium behind the Predator spyware. A second spyware vendor, Bindecy, also used the Controlium platform. Researchers identified Bindecy operators in Belgium, Germany, Norway, Portugal, Sweden, Singapore, and Spain. The company did not respond to requests for comment. What the data showed Citizen Lab's analysis drew on roughly four billion bid records from an Apache Druid database instance that Discover-Tech left publicly accessible. Between March and June 2026, Discover-Tech's MyDSP platform bid on more than 3.7 billion ad impressions and won approximately 441 million. About 19 percent of those bids carried the NOAS script tags that power the spyware delivery system. Ads bearing those script tags ran across 75,373 mobile apps and 120,768 websites. Researchers identified ad impressions on networks tied to NATO, the United Nations, the European Parliament, the European Commission, and government bodies in Norway, Sweden, Denmark, Australia, Israel, Czechia, and Italy. Separate findings by ad security firm Confiant, which worked in parallel with Citizen Lab, placed potentially malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court. Citizen Lab was careful to note that an ad impression does not confirm a device was successfully compromised. The researchers are calling on regulators to investigate whether Discover-Tech and Integrity Labs violated applicable laws. Industry response Google and IAB Europe removed Discover-Tech from their vendor registries in early October 2026, ahead of the report's publication. Beeswax removed the company from its platform. Liftoff paused its access. Eskimi blocked its accounts and associated domains. Discover-Tech did not respond to requests for comment. Integrity Labs could not be reached. Bill Marczak, one of the Citizen Lab researchers who led the investigation, told TechCrunch that Discover-Tech is "surely just the tip of the iceberg" and advised people who believe they may be surveillance targets to disable ad tracking or use an ad blocker as a precaution. The full report, co-authored by Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, and Ron Deibert, is available at Citizen Lab.

  Authorities in North Macedonia have arrested and charged the alleged administrator of OLVX, an underground cybercrime marketplace accused of selling stolen personal data, login credentials, and tools used in cyberattacks. The operation was conducted jointly by North Macedonia’s Ministry of Interior and the U.S. Federal Bureau of Investigation (FBI), marking what officials describe as the first coordinated cyber operation between the two countries. The suspect, identified only by the initials E.A., is a 20-year-old man from Golema Rečica near Tetovo.  According to investigators, OLVX operated from 2023 to 2025 and became a popular platform for criminals seeking access to compromised accounts and digital identities. The marketplace allegedly allowed more than 1,500 seller accounts to offer victims’ personally identifiable information and login credentials. Officials said the site also facilitated the sale of phishing kits, remote desktop access, stolen data, and other resources used to launch cybercrimes.  The investigation began after the FBI supplied intelligence to North Macedonian authorities. Police later raided the suspect’s home and seized devices for forensic examination. Earlier action against the platform reportedly uncovered a server database containing more than 2,600 customer accounts, while illicit sales were estimated to have exceeded $500,000. The charges against E.A. include computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material. Authorities also linked the suspect to ONEMILI, a Telegram group allegedly used to advertise software and services for cybercrime, including fraudulent refund schemes. The FBI said the marketplace directly endangered the digital security of thousands of people in the United States by making stolen account credentials and personal information available to criminals. The case underscores how underground platforms can connect data thieves, fraudsters, and attackers across borders.  The arrest sends a strong signal that international law enforcement is increasingly targeting the infrastructure behind cybercrime rather than only individual attacks. It also highlights the importance of strong account security: users should enable multi-factor authentication, use unique passwords, avoid reusing credentials, and monitor accounts for unauthorized activity. While the charges remain allegations until tested in court, the takedown of OLVX represents a significant blow to a marketplace that allegedly enabled large-scale identity theft and fraud.

 The U.S. Department of Justice has announced coordinated enforcement actions targeting a North Korean operation that allegedly used stolen identities and fraudulent remote employment to generate money for the regime. The investigation has resulted in charges against 14 individuals, two arrests and the seizure of approximately 187 computer devices. Authorities also searched more than 40 suspected laptop farms across Texas.  The operation allegedly enabled North Korean IT workers to secure remote jobs at more than 70 American companies, generating around $3 million in revenue. Investigators believe the money was transferred to sanctioned entities controlled by North Korea and may have supported its weapons programmes.  In a case announced by the U.S. Attorney’s Office for the Northern District of Ohio, American nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under a four-count indictment involving wire fraud, money laundering and identity theft. The indictment also names several China-based individuals, including Sun Sheng Ming, Pei Li Guang and others, while two additional defendants remain unidentified under seal.  According to prosecutors, the alleged scheme operated from 2019 until approximately July 2025. North Korean workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear to be Americans applying for jobs from within the United States. U.S.-based facilitators allegedly received company-issued laptops at their homes, configured the devices, installed remote-access software and helped transfer earnings to accounts controlled by North Korea. The affected employers operated in sectors including healthcare, communications, cybersecurity support, retail and manufacturing.  The companies were located across Ohio, 16 other states and the District of Columbia. Separately, the FBI carried out Operation Lonestar Roundup between September 21 and September 25, searching more than 40 residences in Texas suspected of hosting laptop farms. Investigators seized approximately 187 laptops and keyboard, video and mouse devices allegedly used to facilitate fraudulent employment and revenue generation.  Cybersecurity company CrowdStrike has identified the network of North Korean workers and their helpers as “Famous Chollima.” Investigators also identified fraudulent email accounts allegedly linked to the activity. The FBI has urged employers to add these addresses to their screening indicators and published a new public service announcement outlining detection and prevention measures.  Authorities warned that the schemes are evolving. North Korean workers are reportedly recruiting more American facilitators to evade improved corporate screening, assigning them additional responsibilities and, in some cases, subcontracting entire jobs to foreign nationals. The latest actions form part of the Justice Department and FBI’s DPRK RevGen: Domestic Enabler Initiative, which targets illicit revenue operations and the people supporting them inside the United States.  Previous enforcement actions were announced in June and November 2025 and April and May 2026. Officials have repeatedly warned that these workers can also use their access to steal sensitive company information or carry out data extortion. A 2022 advisory from U.S. agencies stated that individual North Korean IT workers could earn as much as $300,000 annually, contributing to hundreds of millions of dollars in collective yearly revenue.  The State Department has offered rewards of up to $5 million for information supporting efforts to disrupt North Korea’s illicit financial activities. The Justice Department stressed that the allegations in the court documents have not been proven. All defendants are presumed innocent unless found guilty in court.

The Department of Telecommunications (DoT) announced on October 13, 2026, that telecom operators would be required to display registered caller names alongside telephone numbers during incoming calls.  In order to assist in identifying unknown callers and combating phone-based spam and fraud, the directive introduced mandatory Calling Name Presentation (CNAP), as introduced by the Department of Telecommunications (DoT) on October 13. Under these new rules, incoming calls will display the caller's name and telephone number, making identification easier.  A particular application of this initiative is the impersonation phone scam, which involves fraudsters posing as bank officials, government representatives, delivery companies, or legitimate businesses. In the beginning, the CNAP system will cover wireless networks operating on 4G and newer technologies. Implementation of 2G and 3G networks, as well as traditional landline services, will be taken into account separately.  How the Caller Name Display System Works If the recipient does not save the name of an inbound caller in his or her phone contacts, the caller's name will be retrieved from the originating telecom operator's subscriber database. Calls originating outside of India will be tagged as an international call as per the prescribed guidelines. Telephone operators must maintain databases linking subscriber names to their telephone numbers in order to support the service. While receiving an inbound call, the receiving operator will consult the originating operator's database to obtain the caller's registered identity and display it during the incoming call. In addition, operators are required to provide Calling Line Identification Restriction (CLIR), allowing subscribers to hide their caller identification when making calls.  Although displaying a registered name could assist people in identifying suspicious calls, it does not imply that a caller is trustworthy. The perpetrators of fraud may still utilize social engineering and impersonation tactics in order to obtain sensitive information or persuade victims to make financial transactions. It will therefore remain vital to verify any unexpected requests from victims.  Privacy Safeguards and Business Caller Identification As a consequence of the DoT directive, telecom operators implementing CNAP are also required to adhere to security and privacy requirements. Providers must follow a security-by-design approach and ensure the caller name information is not retained after the end of an incoming call.  As well as maintaining an efficient network, database, and connectivity infrastructure, identity queries must also be processed. According to the guidelines, telecom operators must establish grievance-redress mechanisms for complaints concerning their service, including instances where the recipient's screen does not display the correct name of the caller.  To report such issues, consumers may contact their service providers. Businesses and users with bulk connections will also have the option of displaying a verified preferred name instead of the name used in their standard subscriber records. There must be a trademark corresponding to the name registered with the Trade Marks Registry or a trade name registered with the Goods and Services Tax (GST) portal. Telecom operators must verify the supporting documents before updating subscriber records.  As part of the provision of existing connections, providers must establish an application process that allows eligible users to register their preferred names for registration. Incoming calls cannot contain unauthorised or misleading business identities due to this verification process. In addition, CNAP provides an exception for subscribers who have activated Calling Line Identification Restriction (CLIR) The caller identity will not be displayed by CNAP if this facility is activated.  Earlier Trials and Network Limitations Starting in November 2025, telecom operators began testing the service nationwide. In Haryana, Reliance Jio, Vodafone Idea, and Bharat Sanchar Nigam Limited (BSNL) tested the service, while Airtel tested it in Himachal Pradesh. Although the nationwide rollout was initially anticipated to commence in March 2026, it was not completed by that date across all operators.  A late March announcement by BSNL indicated that the integration of private networks would take additional time to complete. Initially, the November mandate covers 4G and the latest wireless networks. Older 2G and 3G systems and fixed-line telephone service are not covered by the current rollout. Their inclusion will be reviewed separately.  The CNAP system provides a secondary layer of caller identification, but its effectiveness will be determined by ensuring accurate subscriber records, ensuring secure implementation, and maintaining reliable network operations. Even though the service may be helpful in assessing unfamiliar calls, it cannot be used independently to avoid spam, impersonation, or financial fraud. Telecom-level identification will therefore continue to play an important role in efforts to reduce phone-based fraud.

  Microsoft and Japan's National Police Agency have jointly dismantled a phishing operation that sent more than 1 billion fraudulent emails and text messages to organizations across 150 countries since January 2026, with over 750 million of those messages directed specifically at Microsoft customers. The action was announced on Tuesday under an order from the U.S. District Court for the Southern District of Florida. The operation brought together Microsoft's Digital Crimes Unit, the Japan Cybercrime Control Center, Health-ISAC, and private cybersecurity firms including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. The U.S. Secret Service also participated in the investigation. The Marketplace At the center of the operation sits YAM Store, which Microsoft internally tracks as Storm-3119. Investigators describe it as a Chinese-language underground marketplace that sold access to compromised Microsoft 365 and Google cloud environments, software licenses, storage space, and stolen credentials. Chinese-speaking actors are believed to have built the phishing kits it supported, according to Microsoft. To stock the marketplace, operators bought up expired domains from defunct companies, rebuilt their websites to look active, and used those fake identities to register new cloud accounts. Some went further and built fake companies from scratch, using AI-generated documents, images, and business content to pass verification checks. Once inside Microsoft environments, attackers used stolen application credentials to manage accounts and abused SharePoint and OneDrive to store and deliver phishing content. Three Phishing Kits YAM Store operated alongside three phishing kits that Microsoft collectively tracks as Storm-2990: CoGUI, Haozi, and Iron Man. Each kit was rented out on a subscription model, letting operators with little technical background run large, automated fraud campaigns against targets worldwide. Iron Man was the most developed of the three. Security firm Resecurity, which assisted in the investigation, found that the kit's infrastructure held 911 published build versions and roughly 2,360 phishing packages covering 130 countries and geographic areas, with the catalog receiving updates as recently as October 1, 2026. Its template library contained over 2,300 lure designs impersonating banks, retailers, delivery services, streaming platforms, and government agencies, including traffic and parking authorities. The kit also included a payment-card capture module that collected card numbers, expiry dates, and CVV codes from victims. To block security researchers and automated scanners, the kits used geofencing, IP filtering lists, and fake CAPTCHA gates that stopped bots while letting real victims through. Operators also received real-time Telegram alerts whenever a victim entered credentials, and some ran live sessions to interact with victims as they responded to lures. "Over 1 billion malicious email and SMS messages were sent since the start of 2026. More than 750 million of those were aimed directly at Microsoft customers." [Microsoft Digital Crimes Unit, October 2026] Some campaigns also used device-code phishing, a technique that misuses Microsoft 365's standard device sign-in flow. Rather than stealing passwords directly, attackers tricked victims into entering a short device code, which gave them a valid login token and full access to the account. Microsoft has since recommended that organizations review whether device-code sign-in is necessary and consider restricting it through access policies. The Takedown The Florida court order gave Microsoft and Health-ISAC authority to seize and redirect the core domains behind YAM Store, CoGUI, and Iron Man. Microsoft deactivated more than 20,000 accounts linked to YAM Store and blocked over 100,000 domains used for impersonation and fraud. TRM Labs worked to trace and freeze cryptocurrency assets connected to the operation. Infrastructure removal was still continuing as of Tuesday. Japan's National Police Agency had alerted Microsoft to the operation in late 2025, after a surge of fraud hit Japanese individuals and businesses. Japan ranked as the single most targeted country in the campaign, followed by the United States, Australia, and India. The healthcare sector, financial services companies, wholesale distributors, and IT firms absorbed the largest share of attacks. No arrests have been announced. What the wider pattern tells us  The YAM Store action follows a March 2026 takedown of Tycoon 2FA, a separate phishing platform that Europol and Microsoft dismantled together with law enforcement from Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom. Tycoon 2FA used adversary-in-the-middle techniques to intercept login credentials and session cookies in real time, bypassing multi-factor authentication and reaching nearly 100,000 organizations since it first appeared in 2023. At its peak in November 2025, the platform was generating over 30 million phishing messages a month. That case resulted in a civil complaint naming Saad Fridi as the alleged creator. Both operations ran on the same basic model: platforms that sold ready-made attack tools to buyers with little technical skill, letting them run large fraud campaigns cheaply. Microsoft advised organizations to treat email from education and nonprofit domains with extra care, since YAM Store sold cloud accounts tied to real .edu and .org tenants obtained through the domain-buying scheme, making fraudulent emails look like they came from real institutions.

 A newly identified Android banking trojan called Hirudo is taking an unusually aggressive approach to evading mobile security: instead of merely overlaying fake login screens on top of legitimate apps, it replaces the victim’s banking app with a modified copy. According to mobile security firm ThreatFabric, the malware retains nearly all of the original app’s code but injects a hooking engine based on the open-source frameworks YAHFA and Dobby. That lets it operate inside the banking app’s own process, effectively turning the app’s defenses against it. Hirudo is typically delivered through seemingly useful apps, including a shopping app called Shopora, an adult-content app named 1V1 X, and short-drama apps such as ZoyaTV and KoiShort. These loader apps provide the functionality users expect, then display a fake “update” notification that leads to permission requests—most importantly access to Android’s Accessibility services. Once granted, Hirudo can uninstall the genuine banking app, download a patched version, and install it automatically using its elevated permissions.  The replacement app is designed to defeat several common security checks. It can substitute the genuine signing certificate when queried, hide enabled Accessibility services, remove screenshot protection, alter key-attestation certificates, and route Play Integrity requests through an attacker-controlled server. By doing so, it can make a tampered banking app appear legitimate to both the user and parts of the device’s security system. Researchers note that the process is risky for the attacker because the victim can interrupt the app replacement at two separate points.  Once active, Hirudo gives operators extensive control over the infected phone. It can steal banking passwords, payment PINs, device-unlock credentials, and SMS messages; stream the screen in real time; capture screenshots; record audio; and access both cameras. The malware also uses fake checkout pages to collect payment PINs and then shows a fabricated payment-success message, making victims believe a transaction completed normally while their data is being harvested. ThreatFabric says Hirudo has impersonated at least seven Indonesian banks, with additional targeting observed in China, India, Mexico, Morocco, and Thailand. An unsecured backend panel linked to the operation contained thousands of application-credential entries, along with device, lock-screen, and financial-profile data, though the total number of victims remains unknown. The researchers recommend that banks validate integrity and attestation server-side, tie those checks to sessions and protected actions, and maintain behavioral and transaction-risk controls. Android users should keep devices updated, avoid installing APKs from unofficial stores, and periodically run Google Play Protect scans.

 AI-powered security agents developed a Google Chrome exploit within six days and earned XBOW company $250,000 from Google. The exploit involved an intricate chain of attacks that used to require extensive manual work and unique expertise in the past.  Researchers at XBOW utilized OpenAI’s publicly available GPT-5.6 Sol model to find and combine three Chrome vulnerabilities, resulting in an exploit that enables code execution in Chrome when a victim loads a web page. The researcher group spent nearly $40,000 on the AI-powered process, in addition to the extensive preparations before the six-day research window. V8 JavaScript Engine, WebP image codec, and Crashpad constitute Google Chrome’s fundamental components.  The researchers discovered an intricate attack chain that involved all three elements. Exploiting Chrome’s reporting tool, one could gain arbitrary code execution by inducing the component into a special state. The researchers found two zero-day flaws in Chrome, namely,CVE-2026-85045 and CVE-2026-78952. Google patched the flaws in Chrome on August 25 and September 3, respectively. The software received updates in versions 152.0.7977.65 and 152.0.7977.82.  If you are a Windows user, you need to restart Chrome and ensure it is at least version 152.0.7977.82. It is unclear whether any attackers used the Chrome flaw to infiltrate systems. However, Chrome is a popular browser with an estimated billion Windows users worldwide, any successful attack would have severe consequences. The article concludes by emphasizing the collaboration between AI-powered agents and human counterparts. Apparently, the AI-powered system did not do everything automatically.  In addition to the preparatory steps, the researchers engaged in the preparatory steps and the exploit development itself. Thus, the new possibilities opened up by AI research tools is that researchers are no longer limited by their knowledge and skills to develop an intricate attack chain. Google Vulnerability Reward Program encourages security researchers to report bugs they discover in the company’s products.  In this particular case, XBOW received $250,000 from Google for the research. The result highlights the relevance of browser security research and the significance of the work of security researchers who protect users from attacks. On the one hand, the researchers increased the potential attack surface of Chrome.  However, the exploit they discovered is chained in a way that allows Chrome users to protect themselves better. The new possibilities in security research, enabled by artificial intelligence, change the game for browsers’ security. Attackers can develop sophisticated exploits faster now, and the protection-focused counterparts should respond by promptly distributing and installing updates.

A US-based digital forensics company is facing allegations that it collected at least $60 million from people seeking help with sextortion threats but failed to provide the assistance it promised.  According to a complaint filed by the US Federal Trade Commission (FTC), Digital Forensics Corporation (DFC), its owner Dmitry Belkin, and associated businesses allegedly misled victims who were already experiencing fear, emotional distress, and threats of having private images exposed. Scam details According to the FTC complaint, DFC collected at least $60 million between February 2023 and July 2026. The company allegedly charged customers between $1,499 and $20,000 for services advertised as helping identify blackmailers, stop threats, and support investigations. The complaint claims that the company misrepresented its investigative capabilities and the results it could achieve. Among the allegations is that DFC used fabricated investigative chat transcripts to make customers believe its investigators were actively communicating with suspected criminals. The FTC also alleges that the company reused location information to create the impression that it had successfully tracked down perpetrators. Such tactic could lead customers to believe that meaningful investigative work was being conducted when the evidence presented to them did not support those claims. Besides this, the complaint argues that customers were pressured into purchasing extra services. The company reportedly used positive reviews that were not genuine to strengthen its reputation and made obtaining refunds difficult for dissatisfied customers.  “Instead of communicating with the sextortionist through the victim's account, defendants routinely change the victim's account settings simply to block the sextortionist's communications. Instead of obtaining investigative information, defendants fabricate chat transcripts,” the complaint said. FTC’s response According to the complaint, “Defendants falsely portray themselves as digital forensics experts, claiming they can track and identify sextortionists, prevent the spread of explicit material and coordinate with law enforcement to bring criminals to justice." The FTC filed a lawsuit against DFC, Belkin, and several affiliated companies, accusing violations of consumer protection laws. A federal court temporarily halted the company's operations while the legal case proceeds. The agency is seeking action against the alleged deceptive practices. The FTC also reported that the company advertised its services through search engines, video-sharing websites, and social media platforms, potentially reaching people actively searching for urgent help. 

In connection with the arrest and prosecution of an employee of OpenAI, it has been claimed that a recording device was allegedly placed in an executive conference room at the company's San Francisco headquarters. This device was reportedly intended to record confidential discussions regarding the company's artificial intelligence research and strategic plans.  As a result of the arrest of Abdulrahman Alfozan, a 35-year-old Saudi national, on October 9, 2026, his position has been terminated. A federal charge has been filed against him by the U.S. Department of Justice (DoJ) for using or attempting to use an electronic or mechanical device to intercept oral communications. He joined OpenAI in July 2025 and worked on its product team.  In the executive conference room, OpenAI personnel discovered a hidden audio recording device connected to a USB port behind a television on September 30, causing an alarm to sound. During the period of September 28 to December 31, the device was installed and wrapped in toilet paper to conceal it, according to the complaint. The room was regularly used to hold executive meetings related to highly confidential technical, commercial, and strategic matters. This information included proprietary research, product development plans, business opportunities, government engagements, and information concerning the company's artificial intelligence progress. The investigation also included review of office surveillance footage that showed Alfozan near the conference room several times before the device was discovered. According to the complaint, he did not play any part in the meetings in which the device was discovered. As a result of the investigation, the investigation has also allege that later he returned to the room and observed the recording device behind the television. Furthermore, Alfozan is accused of using a workplace productivity tool to gather information about OpenAI's offices, conference rooms, meeting schedules, and room capacity before the device was installed, according to the FBI complaint.  The searches reportedly included information about leadership meetings as well as sessions involving external partners, raising questions regarding potential attempts to identify opportunities for recording confidential conversations. As part of the investigation, investigators examined prompts submitted via an account associated with Alfozan's spouse's chatbot. According to the account, between September 24 and 30, it was allegedly used to obtain information about building and configuring audio recorders, setting up Wi-Fi, enabling live audio monitoring, encrypting stored data, and remote access to the device. According to the complaint, the chatbot account shares identifiers and other attributes with Alfozan's own account.  A second recording device was allegedly discovered on October 5, when OpenAI's security personnel inspected an unattended bag left in another room of the company's building. Among the items in the bag are Alfozan's wallet and identification as well as a device similar to that found in the executive conference room.  A surveillance video was also allegedly captured by investigators capturing him checking behind the television, where the first device had been placed. OpenAI reported that the recording device had encryption capabilities, audio monitoring capabilities, and an encrypted data transfer mechanism for avoiding detection.  Following the analysis of the device by internal AI models and the identification of the employee who allegedly perpetrated it, the company referred the case to the FBI. Even though the allegations were somewhat serious, OpenAI stated that there was no evidence that Alfozan improperly accessed or removed model weights, source code, or customer data. Security measures provided by the company were intended to address threats ranging from insider threats to cybercriminals and nation-state actors.  As a result of his arrest, Alfozan appeared in federal court and is facing the possibility of five years in prison, a $250,000 fine, and a three-year probation period. Unauthorized recording of confidential technical developments and business strategies can expose confidential information even without direct access to the digital systems, as outlined in the investigation of the risks posed by insider threats at organizations engaged in sensitive AI research.  Those organizations developing advanced artificial intelligence technologies should take precautions against insider threats, maintain workplace security controls, and protect confidential information. This case is currently being investigated, and the allegations have not yet been proven in court.

Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions.  It was discovered in 2022 that XWorm facilitated the control of compromised systems by logging keystrokes, capturing screenshots, and executing remote payloads. The malware has been modified by its developers since its discovery, adding new features and releasing updated versions. According to Netskope, 1,236 detection events were recorded across 100 customer organisations during the third quarter of 2026, representing a fourfold increase from the same period in 2025.  The malware's expansion has been accompanied by an expansion of its plugin collection. In July 2025, 35 plugins were supported, but by October 2026, 46 plugins were supported, which provided increased capabilities for monitoring and interacting with victims' devices.  A cracking of the XWorm builder and subsequent release of the source code for version 6.4 in August 2025 resulted in the wider dissemination of the malware. Since then, researchers have identified multiple versions operating in the wild, including V6.4, V6.5, V7.2, and V7.4 The malware has been modified in several ways, including code protection, delivery methods, and the ability to evade security analysis.  There are approximately 35% of affected customers that are affiliated with financial services companies, according to Netskope. The majority of reported incidents have occurred in the United States, India, Brazil, Italy, Panama, and Brazil. HBrowser plugins pose a significant security risk due to their ability to operate within existing browser sessions rather than relying on stolen passwords. Command-and-control channels of the malware are encrypted using AES, allowing for remote mouse clicks, keyboard inputs, and other interactions with the active browser. By continuously taking screenshots, attackers can gain access to accounts already logged in and potentially gain access to sensitive information. By collecting device location data without a visible consent request, the Maps plugin adds another layer of surveillance.  Netskope's analysis shows that it attempts to retrieve GPS coordinates, but when GPS coordinates are not available, it switches to IP-based geolocation. Microphone plugins allow for recording audio from selected recording devices and transmission to operators in encrypted, compressed data chunks. In addition to webcam recording, attackers may also monitor compromised devices without displaying obvious warnings to the user using these functions.  Continued Development Raises Security Concerns  As the malware has evolved, it has also undergone changes to make analysis and detection more challenging. Recent variants have introduced stronger code protection techniques, techniques for avoiding virtual analysis environments, and modifications to payload delivery and command-and-control communication.  By expanding the plugin collection, operators have increased the range of options they have for tailoring attacks to meet their objectives. NetSkope anticipates continued development of XWorm following the public release of its builder and source code, with further development likely following that. The increasing surveillance capabilities of malware also highlight the limitations associated with multi-factor authentication alone.  An attacker who controls an already authenticated browser session on an infected device may not be able to prevent access to open accounts even when additional login verification is performed. It is recommended that security teams strengthen endpoint monitoring, investigate unusual process and network activity, and restrict unauthorised outbound communications.  Network segmentation will also allow you to limit the spread of malware across other connected systems. Detecting endpoints, monitoring traffic, and responding to incidents in a timely manner remain crucial for identifying suspicious activity and containing compromised devices before they can be exploited further by attackers.

  Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis. The decision, signed October 2 by Datatilsynet Director General Line Coll and Head of International Tobias Judin, targets one of the most contested privacy questions in digital advertising: whether ad intermediaries can claim ignorance of how consent was collected by the apps they serve. Grindr is a location-based dating app primarily used by gay, bisexual, trans, and queer people. For nearly two years, from July 2018 to April 2020, Xandr sat at the center of the app's advertising infrastructure, operating on both the buying and selling sides of real-time bidding. The process works fast and invisibly. The moment a user opened Grindr, the app passed their data through Xandr to a pool of companies competing in a split-second auction for the right to show that person an ad. Datatilsynet found that this relay included at minimum each user's advertising ID, IP address, and the fact of their Grindr use. Under GDPR, that last detail matters enormously. The authority concluded that being identifiable as a Grindr user is itself information that indicates sexual orientation, a category that European data law places under strict protection and requires explicit consent to process. Xandr's defense rested on the argument that it believed Grindr had already collected consent from its users. Datatilsynet rejected that reasoning on a straightforward legal basis: Xandr was not a passive conduit but a joint controller alongside Grindr. Under GDPR's joint controller framework, both parties carry independent obligations to confirm a lawful basis exists before processing sensitive data. Xandr never verified that any such basis was in place, and the authority ruled that the company had no right to treat consent as someone else's responsibility. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated in the decision. The investigation turned up a complicating detail. Xandr had been notified of the probe by Datatilsynet in February 2020. Despite that, the company deleted documentation about its processing of Grindr users' data between July 2020 and February 2023, when the authority sent a second information order. Xandr told investigators the deletion had occurred as part of its routine data retention policies. Datatilsynet refused to let that explanation close the gap, noting that the company knew an active investigation was underway when the records were removed. In setting the penalty at NOK 92 million, Datatilsynet cited the duration of the violations, the direct financial benefit Xandr drew from the unlawful sharing, and the fact that thousands of Norwegian users had their sensitive data exposed to potentially thousands of companies without their knowledge. Crucially, the fine was calculated against Xandr's own annual turnover and not Microsoft's. The authority noted that the violations took place before Microsoft completed its acquisition of Xandr in June 2022, after AT&T sold the unit it had rebranded from AppNexus in 2019. A Microsoft spokesperson mentioned that the investigation "focused on conduct that predates Microsoft's acquisition of Xandr," adding that interpretations and applications of legal standards have continued to evolve since then. The company said it is reviewing the decision and assessing its options. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal to Norway's Privacy Appeals Board. The case has roots in January 2020, when the Norwegian Consumer Council filed complaints against Grindr and five ad tech companies: AppNexus, MoPub, OpenX, AdColony, and Smaato. Austrian privacy rights organization noyb joined the action and celebrated the outcome, calling the decision "a major blow to the online adtech industry." This week's fine against Xandr is the downstream enforcement of a broader probe that, on the Grindr side, produced a NOK 65 million penalty against the app itself in 2021. Norway's Borgarting Court of Appeal upheld that fine against Grindr in October 2025 after the company challenged it through two rounds of litigation. Grindr's data-sharing history has had consequences beyond Norwegian borders as well. In September 2026, the dating app agreed to pay £26 million to settle a UK class action brought by roughly 12,000 users who alleged the platform had shared information including HIV status, sexual orientation, ethnicity, and location with third-party advertising firms before 2020. The London lawsuit, filed in April 2024 by law firm Austen Hays, alleged violations of UK data protection law during roughly the same period covered by the Norwegian proceedings. The Datatilsynet decision marks one of the more pointed statements yet from a European privacy regulator on how far down an ad supply chain accountability can reach. By treating Xandr as a joint controller rather than an infrastructure provider, the authority made clear that operating the pipes through which sensitive data flows carries its own legal obligations, regardless of which company collected the data in the first place.

 The owner of Hobbs, Phase Eight, and Whistles has become the latest major fashion retailer to be hit by a cyberattack. The Foschini Group (TFG) confirmed that its UK business, TFG London, discovered the incident on October 11, leaving several IT systems offline and disrupting customer orders across the three brands.  Although physical stores remain open, the company said some website functions may be unavailable while its investigation continues. Customers have been warned that orders placed on or after Sunday could be delayed, and TFG has apologized for the disruption while promising further updates as appropriate.  TFG says it activated its incident-response and business-continuity plans immediately, brought in external cybersecurity specialists, and notified UK authorities. The Information Commissioner’s Office confirmed it has received a breach report from TFG Brands (London) Limited and is assessing the information provided.  There is some reassurance for shoppers: TFG London said payment processing is handled by a third party and that, based on its investigation so far, it has no reason to believe payment information is at risk. However, the company is still determining whether other personal or sensitive customer data has been compromised and says it will notify affected individuals or organizations if evidence of a breach emerges. The company has not yet explained how attackers gained access, whether ransomware was involved, or when systems will be fully restored. TFG added that its White Stuff and Inside Story businesses, along with its African and Australian operations, are unaffected because they run on separate IT systems.  The attack follows a difficult stretch for fashion retail. Last week, ASOS disclosed that an attacker impersonated a trusted contact to obtain an employee’s login credentials and access third-party platforms containing customer names and contact details. H&M is also reportedly investigating claims involving the ShinyHunters group, though it says it has found no indication that its systems were compromised.  No evidence currently connects the TFG London, ASOS, and H&M incidents, and H&M has not confirmed a breach. Still, three prominent fashion businesses facing cyber trouble in just over a week suggests that retailers remain highly attractive targets for criminals seeking customer data, operational disruption, or leverage. For TFG, the immediate priority is restoring services and establishing the scope of the incident. For customers, the case is a reminder that even when payment details appear safe, retailers may hold substantial personal information whose exposure can take days or weeks to fully assess.

 Small artificial intelligence models could soon be able to freely replicate across internet devices, forming botnets that do not require centralized computers to control them, according to an Anthropic Frontier Red Team paper. The paper’s authors explored if foundation models could be run on unknown cheap devices and execute the actions required to replicate across other interconnected devices. Anthropic bought 15 cheap Android TV boxes for $55 each to see how large an open-weight model could be before it could no longer be hosted on such devices.  The team found that a model with 26 billion parameters could generate 0.39 tokens per second. They also found that a 9 billion parameter model could run on 8 out of 9 of the different hardware types they tried. The team then tried to see if a model could replicate across 8 emulated Android devices attached to a network. To make matters easier for the would-be-attackers, the researchers made the hacking process trivial; they only had to focus on the artificial intelligence processes.  Only the GLM-5.2 among the open-weight models was able to fully complete the replication process, doing so on four out of five tries, and managed to infect all 8 devices on the network. Anthropic warned that the experiments should not be considered an accurate representation of how such an attack might unfold in the real world, but the results nevertheless show that attacks are becoming increasingly likely as models grow more capable.  Models with over 30 billion parameters do not have the ability to fully perform all actions required to replicate, but they can manage single aspects of the process. If development proceeds at its historical rate, then models will be able to achieve the capability demonstrated by GLM-5.2 by 2026. Self-replicating AI models could follow soon after. The researchers also estimated the scale of such an attack.  If there was a Kimwolf-class botnet that had already successfully infected over 2 million devices, using up all 15 of the TV boxes mentioned earlier would result in 133000 instances of the 26-billion-parameter model being created. This would amount to a combined performance of up to 40 Nvidia H100 GPUs, but it would take more than a day for all instances to be created. Such an attack surface is hard to prevent because there are no singular points of failure, but even if such a worm managed to successfully infect a network of devices, it would still be very visible to most network infrastructure.  Large traffic volumes and unusual communications patterns between devices that would otherwise not communicate with each other will raise flags with most internet service providers. Anthropic also found that manufacturers could reduce the threat surface by replacing default passwords with more complex ones. Many previous botnets, including the infamous Mirai malware, were nearly impossible to stop because many IoT devices had default passwords that were too simple to guess.  Anthropic warned that while a fully autonomous worm was not yet available, a continuing increase in model size and capability, along with the growing ability of models to apply knowledge between different model classes, will severely limit the time defenders have to fix vulnerabilities in Internet of Things devices.

Three security vulnerabilities in LG's webOS operating system could allow attackers to gain complete control of certain LG smart TVs without authentication or any action from the owner. The flaws can be combined to obtain root access when an attacker is connected to the same local network as the television. LG has released a firmware fix for the vulnerabilities, following their disclosure by SSD Secure Disclosure on October 12. Users are advised to check their devices for available software updates. Models impacted Researchers tested the vulnerability chain on two LG television models: the 32LQ636BPSA and the 27TQ600SW. Both devices were running webOS version 7.5.7-25 with firmware 04.54.40. It remains unclear whether other models or firmware versions are affected. The attack begins by targeting a network service on port 3001, which is used by the LG ThinQ application to pair with televisions. Researchers found that an attacker could exploit a built-in application called sync-demo to bypass the normal pairing PIN requirement and obtain a privileged key. Using this key, the attacker can launch another preinstalled application, known as cmp-client, and direct it to a webpage controlled by the attacker. The application does not properly restrict where it can navigate, allowing the malicious webpage to access an internal webOS interface called PalmServiceBridge. This interface provides communication with system services. Researchers found that it could be used to reach pmlogd, a system logging service that operates with root privileges. Because the service does not properly validate certain input, an attacker can inject shell commands that are executed with the highest level of access on the television. The combined vulnerabilities therefore allow an attacker to move from an unauthenticated network connection to root-level control without requiring the television owner to enter a PIN, approve a request or click a link. What is at risk? Root access can give attackers extensive control over an affected television. Depending on the device configuration and the attacker's actions, this could enable unauthorised software execution, system manipulation and potential exposure of information stored on the device. The disclosure was demonstrated by an anonymous researcher who secured third place in the LG webOS category at the TyphoonPWN 2026 security competition in Seoul. No CVE identifiers have been assigned to these newly disclosed flaws, and no exploitation in the wild has been reported.

 Let’s Encrypt will reduce the default validity period of its TLS certificates from 90 days to 64 days starting February 10, 2027. The change will apply to all certificates issued or renewed after that date, while previously issued certificates will remain valid until they naturally expire. The nonprofit certificate authority says the move is the first step in a broader transition toward 45-day certificates, which it plans to introduce in 2028.  The shorter certificate lifetime is intended to improve web security by limiting how long a compromised or misissued certificate can remain trusted. It should also make revocation more efficient, because certificates leave circulation sooner and attackers have a smaller window in which to exploit stolen credentials. Let’s Encrypt says the change follows the CA/Browser Forum Baseline Requirements and will eventually be adopted by all publicly trusted certificate authorities.  Website owners and administrators will need to renew certificates more often, but the impact should be manageable for organizations that already use automated renewal. Let’s Encrypt is making 64-day certificates available in its staging environment this week so customers can test their systems before the production change. The organization recommends that all users carry out similar tests to identify renewal failures, outdated scripts, or configuration problems early. Administrators using clients that support ACME Renewal Info, or ARI, should be prepared automatically because ARI allows Let’s Encrypt to notify the client when a renewal is due. However, organizations with renewal dates hardcoded from a certificate’s expiration date should adjust those settings to approximately two-thirds of the certificate lifetime. Let’s Encrypt says the update will not affect its ACME endpoints, issuance chains, or rate limits, reducing the likelihood of broader service disruption.  The certificate authority will also shorten its authorization reuse period to 10 days next year and to seven hours in 2028. That change is intended to comply with a 2029 reduction in maximum validation reuse periods and to remove the need for CAA rechecking when validation data becomes outdated. With the final 90-day certificate expected to expire on May 11, 2027, businesses should use the transition period to strengthen certificate automation before the industry moves to even shorter lifetimes.

  A financially motivated cybercriminal using Anthropic's Claude Code as an AI backbone has carried out a sweeping attack campaign that compromised 429 WordPress administration panels in a 61-second window and pulled more than 628,000 personal records from four Ukrainian organizations, according to findings published by threat intelligence firm SOCRadar last week. The threat actor, tracked under the alias CyberXero, is described as a Russian-speaking initial access broker (IAB) whose infrastructure combines commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Claude Code. Initial access brokers are criminals who break into networks and sell that foothold to other buyers rather than monetizing it directly, and CyberXero has been active since at least July 2026. The entire operation surfaced from a single configuration error: an exposed open directory at IP address 46.21.250.135 that served the threat actor's live working directory, including more than 90,000 files across 3,000 subdirectories: AI session logs, scripts with plaintext credentials, exploitation toolkits, reconnaissance output, and raw victim database exports. That OPSEC failure let SOCRadar researchers map eight distinct infrastructure nodes tied to the operation, spanning servers in Europe and Tencent Cloud in China. Two Campaigns Running in Parallel CyberXero's operation runs two pipelines simultaneously: a global, automated campaign targeting WordPress and e-commerce platforms for payment data and access sales, and a more selective, manual campaign directed at Ukrainian energy providers and critical infrastructure entities. The automated arm relied on an internally developed Python tool called wp2shell, which abuses a desynchronization flaw in the WordPress REST API batch endpoint to inject SQL, create a rogue administrator account, and plant a web shell disguised as an active plugin. A single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 shells, all inside a 61-second window. Each successful compromise fired a real-time notification to a Telegram bot that let the operator monitor results without staying at a terminal. The second pipeline was considerably more deliberate. The infrastructure documents curated reconnaissance against seven Ukrainian energy and utilities entities, including the national transmission system operator and the country's largest private energy holding. One target list alone contained 95 subdomains covering those two organizations' email infrastructure, VPN gateways, network dispatch systems, and data platforms. That depth of reconnaissance is not the work of an opportunist scanning for easy targets. The most damaging confirmed breach was a district heating provider in Kharkiv, a city currently on an active war front. A hardcoded credential in the threat actor's own script gave direct access to the provider, and a multithreaded extractor pulled 564,073 subscriber records containing personal data, home addresses, and account numbers, along with 213,340 access-log entries with timestamps and IP addresses. Because those records identify civilians in a conflict zone, the dataset carries physical risk that goes beyond a conventional data breach. The AI Layer CyberXero deployed AI at two independent stages. The first ran Claude Code with a cluster of 51 specialized agents on the primary workstation, handling scanning, exploit chaining, reconnaissance, and post-exploitation tasks. The second connected PentAGI, an open-source autonomous penetration testing framework, to a Cobalt Strike Team Server through an AI provider API for payload generation and hands-on pentest execution. The 51 agents were divided into functional roles. Offensive agents covered tasks like lateral movement and SCADA attacks. Reconnaissance agents handled subdomain mapping and credential testing. Post-exploitation agents managed data exfiltration. A recovered provider configuration file assigned AI models to these roles by reasoning complexity, with the payload-generation role receiving the highest token budget. To work around the model's safety refusals, the threat actor used context-engineering and session-reset techniques, instructing the agent that it was running an "authorized pentest on my own infrastructure." That same claim appeared verbatim across four unrelated victim engagements, marking it as a rehearsed line rather than a genuine authorization. Because model safety controls act on session context rather than model weights, a refusal in one session does not carry into the next. When an agent refused a task, the actor opened a fresh session with the authorization framing preloaded and tried again. The refusals themselves are notable. Across four separate iterations, the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell. In a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token. The CyberXero case is not the first time Claude Code has appeared in a documented criminal operation. Anthropic's own threat intelligence report earlier this year described a separate actor who used Claude Code to automate reconnaissance, credential harvesting, and network penetration across at least 17 organizations in a single month, spanning government agencies, healthcare providers, and emergency services. Anthropic has acknowledged that cybercriminals and state-sponsored actors alike have attempted to use its Claude models to automate cyberattacks, build offensive tools, and conduct mass surveillance operations. The gap between what a single attacker can now accomplish and what previously required a full team has narrowed substantially. For defenders, SOCRadar's most actionable indicator is simple: any WordPress administrator account whose username follows the pattern "wp2_" followed by eight hexadecimal characters was placed there by wp2shell, not a legitimate user. Organizations running WordPress, Magento, PrestaShop, or internet-exposed Redis servers are advised to check for rogue admin accounts and unexpected entries in SSH authorized key files. CyberXero was still active at the time the SOCRadar report was published.

In a number of major French supermarket chains, refrigeration systems were disrupted by a cyberattack, forcing stores to remove fresh and frozen foods from their display units. It is estimated that 250 to 350 retail outlets, including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, were impacted by the incident.  Several reports indicate that the attackers compromised older versions of Danfoss refrigeration controller software and remotely activated automatic defrosting functions. The process resulted in increased refrigerator temperatures, putting perishable food supplies at risk, resulting in financial losses and food waste.  A cyberattack reportedly involving a service provider that manages refrigeration systems resulted in the inability to use some fresh and frozen food displays at Intermarché. According to the company, precautionary measures have been taken to remove products from affected units, although a complete list of the stores affected does not yet exist. Several stores within the Coopérative U network have also experienced disruptions, according to Dominique Schelcher, president of Coopérative U. As part of its investigation into the circumstances surrounding the attack, the company's teams were working with refrigeration specialists to restore normal operations.  As a result of the incident, concerns have been raised about the security of digital systems supporting essential food retail operations. A sense of urgency was conveyed by the European Union Agriculture and Food Commissioner Christophe Hansen, who emphasized the importance of not targeting equipment responsible for preserving food. Vulnerabilities in Danfoss Systems Raise Security Concerns  ANSSI (National Cybersecurity Agency of France) has been directed to assess the risks and determine whether other businesses could be affected by the incident, while French authorities are investigating it. It appears that refrigeration units reached temperatures as high as 50°C, which resulted in extensive food spoilage and fires at several locations.  Approximately 150 stores in Intermarché's parent group have been disrupted, whereas 80 supermarkets in Carrefour have been affected. Due to previously revealed security vulnerabilities, Danfoss refrigeration management systems have been under scrutiny. It was discovered by Claroty's Team82 in August 2026 that there are flaws in the Danfoss AK-SM 800A platform, which allows operators to monitor and control refrigeration equipment remotely through a web-based interface.  An authentication bypass vulnerability, CVE-2025-41450, and a command injection vulnerability, CVE-2025-41451, could allow remote code execution. There is also a third flaw, CVE-2025-41452, which could be used for denial of service attacks through the injection of Nginx configuration. To address these issues, Danfoss released firmware version R4.3.1.  A number of Danfoss systems are accessible through the internet, which raises concerns about unauthorised access to equipment in supermarkets and other commercial establishments. The affected systems were equipped with outdated firmware, according to Danfoss, and customers had previously been advised to upgrade older equipment. Investigators have not yet confirmed whether any of the disclosed vulnerabilities were exploited in the attack at the French supermarket. Moreover, it is unclear how the refrigeration controllers were accessed.  Connected Refrigeration Systems Present Cyber-Physical Risks Security experts have stated that this incident illustrates the dangers associated with attacks against operational technology (OT) despite not targeting conventional information systems. It is possible for refrigerator controllers to make unauthorised changes that may disrupt the handling of food, pharmaceuticals, and other supply-chain functions in temperature-sensitive environments.  Researchers at Claroty warn that security teams can be overlooking refrigeration controllers, particularly when remote maintenance interfaces are accessible via the public internet. Although remote access can assist technicians in maintaining equipment at multiple locations, poorly secured connections can provide attackers with opportunities.  In order to ensure security, users should install the latest firmware, remove unnecessary internet exposure, restrict administrative access to trusted networks, and utilize virtual private networks to secure remote connections as well as network segmentation. Additionally, organizations should examine exposed devices and verify that appropriate access control measures have been implemented. It is unclear who is responsible for the attack, and the investigation continues.  The incident emphasizes the importance of securing connected industrial equipment, particularly systems with the potential to affect public services, food safety, and crucial business functions directly. Despite the incident, the need for securing internet-connected operational technology is growing. Updates to firmware are imperative, as are restrictions on remote access and stronger network controls to prevent cyberattacks from disrupting critical business processes.

 Paying a ransomware demand does not always lead to the return of an organization's files, the prevention of data leaks, or the eradication of attackers from its network, according to digital forensics and incident response companies. Ransomware is a prevalent cybersecurity risk, and according to a 2025 CrowdStrike report, 78% of 1,100 global IT and cybersecurity leaders asked about attacks in the past year.  In addition, according to a report by Proofpoint, which appeared in July, 54% of the 1,600 organizations surveyed worldwide said they had paid a ransom within the last year. Joe Hoosech, an executive at the cybersecurity insurance company Cowbell, estimates that paying the ransom retrieves data with no further leaks in 75 to 80% of cases.  Some hackers do indeed honor their word to deter potential victims by building a reputation as reliable businesspeople, he adds. In addition, they sometimes provide documents describing how they penetrated the network, although experts say this information is often of little value. "Sometimes the decryptor doesn't work," Hosech cautions. "In my experience, maybe one out of four organizations finds that the decryption tool does not completely restore all the data." Andrew von Ramin Mapp of Cyber Centaurs has observed a similar challenge: "Sometimes there is some damage to the database, for example, because the encryption tool was run while the database was open, so the database needs to be fixed."  Beyond restoring data, organizations must consider whetherransomware attackers have deleted evidence of the breach, experts say, citing an example. "I've had clients where the bad guys took the data, encrypted it, and then left," recalls Eric Taylor of Barricade Cyber Solutions. "The client paid the ransom, the bad guys promised to delete it, and then the client saw the data on the bad guys' website, including the files they had deleted." "Sometimes the bad guys take the data for themselves and sell it to others," Hoosech says.  Initial access brokers can infiltrate networks and sell that access to other threat groups and stay in the network. "Therefore, just because one gang promises to protect you, it doesn't mean that those who purchased access to your network won't benefit from stealing your data," says Taylor. "Instead, companies should evaluate the value of the data to the organization and the impact on the business of losing or disclosing it," recommends von Ramin Mapp. He advises businesses that have decided to pay a ransom to "test the decryption key before handing over the ransom."  However, the expert says there is no way for organizations to receive absolute guarantees that the data will be deleted. "By the way, I advise companies to keep their cyber insurance policies on paper and in a safe place," says von Ramin Mapp. "If an attacker accesses your computer system and finds where you keep the documents, he can calculate how much you might be willing to pay to stop them." Still, experts say that while the ransomware payment option does not completely eliminate the need to respond to the attack, organizations should continue to investigate and mitigate ongoing attacks.

Daiichi Kosho, a major Japanese karaoke company known for operating the popular Big Echo chain, has disclosed a potential data breach that could affect approximately 8.7 million records. The incident involved malware discovered on a computer belonging to Nippon Columbia Group (NCG), an entertainment company that handles customer information on Daiichi Kosho’s behalf. In a statement published on October 8, 2026, Daiichi Kosho said it could not rule out the possibility that personal information stored on the affected computer had been exposed to unauthorized parties. But the company has not confirmed that the data was actually stolen or leaked.  “According to NCG, between October 1 and October 2, 2026, a malware infection was discovered on one of their employees' devices (a PC), and the device was isolated from the network on October 2. Following an investigation into the scope of the impact by NCG, we received a report from NCG on October 5,” read the statement. Incident details After an initial investigation, NCG informed Daiichi Kosho about the incident on October 5. The investigation revealed that information collected through outsourced business operations had been temporarily stored on the compromised computer. NCG has reset affected passwords and is investigating how the malware entered the system, whether information was accessed by unauthorized individuals, and the overall scope of the incident. The available information does not identify the malware.  What can be leaked? Daiichi Kosho estimates that approximately 8.724 million records may have been affected. “Based on the information we currently have, approximately 8,724,000 customers who registered or made reservations at our stores may have had their names (registered names), genders, dates of birth, email addresses, and telephone numbers leaked to external parties,” the company warned. The affected records are linked to customers who registered for membership or made reservations at the company’s establishments. The businesses include Big Echo, DK Dining, Mega Big, Karaoke Club DAM, Banana Club and B-Garage. How to stay safe? Daiichi Kosho has warned customers not to open unfamiliar links or attachments and to remain cautious when receiving unexpected emails, text messages or calls. The company has also clarified that passwords and credit card information are not included in the potentially exposed data. 

 Japanese travel booking platform Skyticket has disclosed a major data breach that may have exposed the personal information of approximately 14.64 million customers. Its operator, Adventure Inc., said attackers gained unauthorized access to internal servers and cloud storage between October 2 and October 4, 2026. The company publicly confirmed the incident on October 9 after blocking the access route and launching an investigation. The breach is among the largest recent cybersecurity incidents involving a Japanese travel company. The compromised records reportedly include customers’ names, dates of birth, email addresses, phone numbers, postal codes, addresses, and names used for bank transfers. Adventure also said about 4.13 million records contained hashed login passwords. The company stated that passport numbers and credit card information were not leaked, although it temporarily disabled payments using saved credit cards as a precaution.  Adventure identified additional unauthorized-access incidents beyond the main breach. It said attackers accessed its business management system on September 20, potentially compromising more than 17,000 customer records, including bank account details registered for refunds. A third incident involved bus booking confirmation pages that could be accessed without logging in; the company said it detected and fixed the issue on October 1.  The company has reported the incidents to Japan’s Personal Information Protection Commission and said it is continuing to investigate. Adventure warned customers that they could receive fraudulent emails, text messages, phone calls, or letters pretending to be from Skyticket, banks, airlines, or bus companies. It urged users not to click links in suspicious messages or share passwords, credit card numbers, bank PINs, or online banking credentials.  Skyticket members should change their passwords immediately through the official website or app and update the same password anywhere else it has been reused. Security experts generally recommend enabling multi-factor authentication where available and monitoring bank statements for unusual activity. The incident highlights the growing risk facing travel platforms, which hold large volumes of identity, contact, payment, and booking data attractive to cybercriminals.

 Japanese entertainment group Nippon Columbia hit with malware, affecting more than 8.7 million customers and employees' personal data, according to karaoke system maker Daiichi Kosho. The company asked its customers to be cautious, but it is still unclear if their personal information was stolen or leaked.  Daiichi Kosho, Japan’s biggest karaoke company, owns 521 karaoke places and provides services for the well-known chain of Big Echo. They rely on Nippon Columbia Group (NCG) to provide customer information. NCG’s businesses range from music creation, video and game software development and distribution to artist management, making it an important supplier for the karaoke entertainment sector.  The issue was raised when NCG notified Daiichi Kosho of the incident on October 5 when the malware was found on one of the staff member's computers, which was then isolated the next day. The company then proceeded to reset all the passwords and other authentication methods and investigate the incident to determine its scope and origin.  According to Daiichi Kosho's statement, the affected information includes approximately 8,631,000 customers and 93,000 employees of the company, and it may include the full name, gender, date of birth, email address, and phone number of the affected individuals. BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining entertainments' users should be particularly wary of the security breach, as it could affect their data the most.  Daiichi Kosho reiterated that their information was not at risk and that the data contained in the breach does not include the passwords. Additionally, the company stated that there was no suspicion of unlawful interference with customer loyalty points. On the other hand, they are still not certain if the information was stolen or if it was leaked online. They are investigating the breach to find out if the data was shared, what the scope of the problem was, and if the information was shared.  The latest statement did not mention anything else about the possible leak. Customers are advised to protect themselves from scams, deception, and unlawful access to their personal information. They should be wary of strange emails, text messages, and phone numbers and avoid providing any personal and financial information. If the crooks managed to collect and compile the data of these users, it would be easy for them to engage in phishing schemes and similar scams.  BleepingComputer, as of the time of publishing this article, has not been able to find any official statement from Nippon Columbia Group about the incident. They mentioned that they contacted the company for an official comment, and they are still waiting for the response. Until an official statement is issued, the possible data theft remains an issue, as it raises several questions about the safety of the companies' data and the safety of customers' personal information.

As companies strengthen their artificial intelligence capabilities, the cybersecurity industry is poised for another record merger and acquisition (M&A) year. Momentum Cyber reported 117 deals in the third quarter of 2026, which represents an increase from 117 deals in the prior year. This increased activity is a reflection of a shift in security companies' purchasing strategies in order to keep up with rapid advances in artificial intelligence.  There is currently a strong demand for security solutions based on artificial intelligence and tools capable of protecting AI-powered systems, which is contributing to the current wave of acquisitions. Organizations are increasingly adopting agentic artificial intelligence, which can perform tasks with minimal human intervention. However, security has become an increasingly important concern as organizations adopt these systems.  Among the key areas of investment are identity and access management, nonhuman identity, data security, agentic security, runtime protection, and operational technology security. In 2025, there are estimated to be 404 cybersecurity mergers and acquisitions. This year's activity also set a record in terms of deal value, with companies spending approximately $97 billion on startup acquisitions.  It is expected that investment funding rounds will decrease slightly from last year's levels, but acquisitions have continued to gain momentum as established companies seek capabilities that would take a considerable amount of time to develop internally.  Artificial intelligence models have advanced dramatically and automated cyberattacks have increased the urgency of this issue. As a result of these developments, companies are reviewing their security requirements, creating opportunities for startups that are developing AI-based products. In order to expand their capabilities, large corporations are acquiring established startups in emerging security categories and investing in early-stage companies in emerging security categories.  AI-driven acquisitions have also become increasingly common among established technology companies. As of 2026, Palo Alto Networks acquired CyberArk for $25 billion, while other companies pursued specialized capabilities in identity security, data protection, and artificial intelligence infrastructures. These moves are a result of a wider effort to incorporate emerging technologies into existing security portfolios rather than solely relying on internal developments.  A growing segment of the market is also emerging outside of traditional cybersecurity vendors. Software providers are seeking ways of securing AI agents within business applications, while organizations managing operational technology need to safeguard the systems and connected devices controlled by increasingly autonomous software.  As concerns regarding the risks associated with artificial intelligence grow, cloud providers and advanced AI developers are emerging as potential buyers of security technologies. Although acquisitions have increased, Momentum Cyber's analysis indicates that venture capital and private equity firms are scrutinizing their funding decisions more carefully, making fewer deals but more substantial investments in selected companies.  Investors are assessing which technologies will remain relevant in a rapidly evolving market, attracting attention to startups with proven leadership and specialized capabilities. During the first three quarters of 2026, Momentum Cyber announced 40 AI security acquisitions, up from 10 transactions throughout 2025. These figures indicate the rapid growth of this segment.  AI is becoming increasingly integrated into a wider variety of cybersecurity products, making it increasingly difficult to distinguish between tools designed to protect AI systems from cyber threats and tools powered by AI. According to industry observers, hyperscale cloud providers and leading AI research companies will have a greater influence on acquisitions in the future.  Increasing reliance on secure AI infrastructure may make specialised security capabilities more valuable, further affecting the cybersecurity market's competition. In light of the continued transformation of cybersecurity by artificial intelligence, acquisitions are expected to remain a key strategy for companies seeking specialized knowledge and faster innovation.  As AI security, identity management, and automated threat protection become increasingly important to the security sector, it is expected that future investment decisions and competition will be influenced.

  A GitHub Actions credential-theft campaign that researchers first flagged a year ago has returned with a fresh wave of attacks, hitting 772 public repositories between August 31 and September 30, 2026, and going after more than 2,500 developer secrets in the process. The campaign, named GhostAction, was first reported in September 2025 after attackers compromised 817 public repositories across 327 GitHub user accounts and walked off with at least 3,325 secrets. It relied on injecting a malicious GitHub Actions workflow into victim repositories using what appeared to be stolen developer credentials. The 2026 wave uses the exact same method. The attack injects a workflow file named `github_actions_security.yml` with the commit message "Add Github Actions Security workflow." Instead of dumping an entire environment, the attacker hardcodes into the workflow the specific secret names it already found referenced in the target's legitimate workflows, then sends those values in a single HTTP POST request to an attacker-controlled server. The only meaningful change from 2025 is the exfiltration destination. This wave routes stolen data over plain HTTP to a bare IP address, `193.32.204.199`, replacing the named domains used previously. On September 7, a second variant appeared across seven repositories under the filename `security-check.yml`, posting secrets to a dedicated API endpoint on the same server with a unique identifier per injection. The tracking mechanism suggests the attacker now runs a backend that logs exactly which repository each stolen secret came from. Three Bursts, 2,577 Targets The injections rolled out in clusters. On August 31, 143 repositories were hit. Between September 2 and 5, roughly 400 more were targeted, with a single-day peak of 294 on September 5. On September 15, another 103 repositories were injected, with smaller activity continuing through the rest of the month. Across all 772 repositories, the workflows targeted 2,577 secrets. SSH private keys and deployment server credentials were the most sought-after, appearing in 446 cases. Azure credentials followed at 218, with one organization alone exposing an Azure personal access token and an SSH key across 92 repositories. Container registry credentials for DockerHub and GHCR appeared 142 times; database credentials, 112; AWS access keys, 106; FTP credentials, 92; Google Cloud and Firebase credentials, 80; and GitHub tokens, 66. The list also included API keys for Telegram bots, Slack, Discord, npm, PyPI, and various AI providers. GitHub's own approval mechanisms blunted much of the damage. Of 3,669 workflow runs tracked across 605 repositories, only 499 actually ran. A total of 336 completed successfully, exfiltrating 26 secrets from 13 repositories. Only 124 of the 772 affected repositories, roughly 16 percent, showed evidence of cleanup by October 5. A Campaign That Never Stopped Calling this a revival would be misleading. In 92 of the 2026 cases, the attacker did not add a new workflow at all. It modified one already sitting in the repository from an earlier injection, with the commit message "Update Github Actions Security workflow." Those updates simply pointed existing files at the new exfiltration IP, with the replaced endpoints including the original 2025 domains and a previously undocumented address, `170.39.218.2`. The full timeline runs from September 2025 through the present: roughly 900 repositories in the initial wave, quieter activity across late 2025 and early 2026 under two different endpoints, then the August and September 2026 surge of 772. A Cryptominer Hidden in DevOpsGPT The new wave also produced an unexpected finding. A day and a half before the first August 31 injections, a commit labeled "fix(subtask): update the OpenAI version" was pushed to `kuafuai/DevOpsGPT`, an open-source project with roughly 6,000 stars. The commit embedded an XMRig 6.21.0 Monero miner into the project's Docker image, disguised as a routine worker process and set to run on a 45-second restart loop. The mining configuration was XOR-encrypted with the key `devops2024`, and the wallet pointed to `pool.supportxmr.com`. The same compromised account was then used on September 15 to push the GhostAction workflow to four DevOpsGPT repositories. Whether the miner and the credential-theft campaign share the same operators remains unclear. The miner commit used a forged author email never seen on that account before, was crafted specifically for that project, and left no trace in any other repository, while GhostAction's payloads are generic and hit hundreds of repos within hours. One Compromised Account, Multiple Attackers Cross-referencing GhostAction victims against other malicious GitHub activity turned up 13 victim repositories that had also been exploited for cryptomining by at least four separate campaigns with distinct wallets, pools, and infrastructure. In some cases the miners arrived before the GhostAction workflow; in others they followed months later. The most likely explanation is that the credentials GhostAction used were not exclusive to its operators. Stolen developer tokens circulate through infostealer logs and credential markets, where multiple actors can buy and reuse the same access independently. That creates a specific gap in the standard remediation advice. Rotating the secrets stolen through the malicious workflow is necessary, but it is not enough. The underlying GitHub credential that allowed the injection in the first place also needs to be found and revoked, or whoever holds that token next will use it. The campaign continued into October. On October 8, a new burst hit 346 repositories in two automated sweeps lasting only minutes. Two compromised maintainer accounts pushed the workflow to every repository they could write to, including kitao/pyxel, a Python retro game engine with over 18,400 stars, and uber/athenadriver. The exfiltration endpoint remained `193.32.204.199`. Unlike most of the September wave, which was blocked pending approval, these runs executed and exfiltration was confirmed. This variant also goes further than its predecessor: rather than targeting only named GitHub Actions secrets, it combs the full git commit history for cloud credentials, including AWS keys, GitHub and GitLab tokens, and API keys for services like OpenAI and Anthropic.

Cybersecurity experts are warning about the growing threat of calendar phishing, a scam that uses scam meeting invitations, payment alerts and renewal reminders to trick people into sharing sensitive information.  Unlike traditional phishing attacks that mainly rely on suspicious emails, calendar phishing places deceptive events directly into a user's calendar. Because these entries appear alongside genuine appointments, victims may be more likely to trust them. How the scam works The attack often begins when a user receives an email invitation that automatically appears in their digital calendar. The event may look like a routine business meeting, a voicemail notification, a payment confirmation or a warning about unusual activity on a PayPal account. Some invitations claim that a payment is about to be processed or that a software subscription needs to be renewed. Others may imitate internal workplace meetings, complete with company names, logos and convincing descriptions. The event usually contains a link or telephone number intended to persuade the recipient to take action. Clicking the link may open a scam login page that resembles Google, Microsoft or PayPal. If the victim enters their credentials, the attackers can capture the information. In other cases, victims are encouraged to call a fake customer-support number to cancel a payment or resolve a supposed security problem. Threat actors may then attempt to obtain personal information, account credentials or financial details. Why calendar phishing is difficult to stop According to security professionals, calendar phishing has experienced sudden growth. Security teams face difficulties blocking these attacks because legitimate meeting invitations and malicious events can use the same calendar services. Attackers may also exploit trusted platforms, including Zoom, to make invitations appear genuine. Automatically accepting invitations from unfamiliar senders can increase the chances that scam events will appear in a user's schedule. Stolen credentials can be sold to other criminals or used to access workplace email accounts, impersonate employees and launch further attacks. However, simply receiving a suspicious calendar entry does not necessarily mean an account has been compromised. The main danger arises when victims follow the instructions and disclose information. How to stay safe? Experts recommend treating unexpected calendar invitations with the same caution as suspicious emails. Users should avoid clicking unfamiliar links, downloading unexpected files or calling numbers provided in questionable event descriptions.

A Ukrainian-Russian dual national who spent years overseeing one of the most operationally sophisticated money laundering rings in recent cybercrime history pleaded guilty last Thursday in a federal court in North Carolina, admitting to routing stolen funds through tens of thousands of ordinary Americans before shipping the cash to criminal operatives in Eastern Europe. Oleg Korniev, 42, was a principal at Your Mule Cashout, or YMCO, a criminal outfit that ran from September 2007 through 2014 and maintained a network of more than 15,000 money mules across the United States. The plea came roughly a decade after a grand jury first indicted him, and about 10 months after U.S. authorities caught up with him and arrested him in North Carolina in December 2025. Not a side player Federal prosecutors did not describe Korniev as a peripheral figure. He managed YMCO's daily operations, hired and fired staff, and handed out rewards or penalties depending on performance. He also helped design the procedural framework that kept the organization functioning across multiple countries simultaneously. YMCO's approach was simple in concept but deliberately layered in practice. The group posed as legitimate staffing or payment-processing companies and sent spam emails to Americans advertising open positions. What followed was a carefully staged recruitment process built to look real: job applicants went through an employment test, reviewed a contract, and were walked through what appeared to be standard company policy. They were then asked to upload their bank details to a fictitious company website and told their job was to receive payments into their personal accounts and wire the money to company accounts overseas. The money they were receiving was stolen. Hackers had broken into U.S. bank accounts using malware, funneling the proceeds into the mules' accounts and relying on those individuals to move the funds out of the country before anything flagged. How the cash moved From the mules' accounts, the money traveled through Western Union and MoneyGram to what YMCO called "cash-out contractors" in Moldova, Ukraine, Russia, and Latvia. These operators received a cut of each transfer for their role and passed the remainder back to the organization. Running stolen money through a human relay network like this put distance between the hackers and the funds, making the trail harder to reconstruct. According to court documents, YMCO processed more than $10 million drained from over 750 U.S. bank accounts across more than 35 financial institutions. The group also ran parallel schemes in Germany, Italy, the United Kingdom, and Australia. Korniev's plea agreement put total actual and intended losses to confirmed victims at more than $14.7 million. He personally admitted to laundering at least $7 million of the $9.7 million he received from cybercriminals as payment for YMCO's services. A decade-long chase Korniev was originally indicted alongside Serghei Ivanovich Tomuz, a Moldovan national who allegedly ran YMCO's cash-out operation inside his home country. Tomuz was reportedly detained at a Romanian border crossing in May 2022 and spent years fighting extradition to the United States. His case was ultimately terminated in U.S. federal court this past May. Four other Ukrainians tied to YMCO were arrested abroad years earlier, extradited to the Western District of North Carolina, and pleaded guilty to conspiracy to commit money laundering. Sentenced in 2018, they received prison terms ranging from 37 to 63 months and were each ordered to pay more than $9.1 million in restitution to American victims. Korniev now faces a minimum sentence of two years and a maximum of 50 years after pleading guilty to money laundering, aggravated identity theft, conspiracy to commit money laundering, conspiracy to commit computer fraud, and conspiracy to commit access device theft. His plea agreement includes a commitment to fully repay confirmed victims for their documented losses. What prosecutors want criminals to understand Assistant Attorney General A. Tysen Duva made the department's position on mule networks clear. "Money mules play crucial roles in cybercrime, so the Justice Department pursues mules and their recruiters wherever they operate and however long it takes," Duva said. The case puts into focus how money mule operations function as the financial plumbing beneath large-scale cybercrime. Without them, proceeds from bank fraud and account takeovers would be far harder to extract without triggering detection. That infrastructure is a recurring target for law enforcement. Five years ago, Europol announced that authorities from 27 countries had arrested 1,803 money mules out of 18,351 identified as part of a coordinated crackdown called the European Money Mule Action, or EMMA. Europol has consistently flagged that criminal groups recruit mules from vulnerable populations, specifically students, immigrants, and people facing economic pressure, using job ads on social media and employment sites that look entirely legitimate. Many mules sign up without understanding what they are walking into. Others are coerced. In either scenario, courts have made clear that receiving and wiring stolen money is not a protected form of ignorance.

 A single prompt could have led to the exposure of conversations, source code, stored memories and cloud credentials across multiple AI agents in the same AWS account and region, according to Zenity Labs researchers. The so-called AgentCorruption attack chain targeted Amazon Bedrock AgentCore, which is AWS's managed service for building and running AI agents.  The researchers' proof-of-concept involved an agent with a web-request tool that was prompted to call the local metadata endpoint at 169.254.169.254, which is where AWS workloads get temporary AWS credentials. Since the request came from inside the agent's Firecracker microVM, it returned credentials for the agent's execution role.  This created a server-side request forgery (SSRF) vulnerability that was triggered by a prompt injection. "Exploitation didn't require a vulnerability in the chat interface; it required only that the agent have a tool to make the request and that the tool be permitted to call the metadata service," the researchers said. Zenity discovered that the broad permissions typically given to the default execution role allowed them to find agents, obtain container images, invoke other agents and access session events.  They also discovered permissions that could be used to access conversations and implant false memories that would affect the agent's future responses. The researchers added that the latter capability could be used to implant "instructions" that would cause the agent to take specific actions. In addition, they found that these same permissions could be used to access API keys and secrets stored in AWS Secrets Manager, which could lead to lateral movement to other services and data.  According to Zenity, metadata access was reported to AWS on Dec. 25, 2025, and excessive permissions in the execution role were reported on Jan. 12, 2026. AWS started the migration to Instance Metadata Service Version 2 in February 2026, and then made it mandatory. On Sept. 29, 2026, Zenity confirmed that AWS had removed the permissions that could be used to invoke other agents, chat with them or access the Secrets Manager. The researchers stated that the problems they reported had been addressed.  AWS pushed back against the suggestion that this was a vulnerability, noting that it is normal for an agent to have access to its own execution role credentials via the metadata service. In addition, the company stated that cross-account access to agents is not possible without the appropriate permissions on the execution role and resources.  Security teams should create their own IAM roles with limited permissions, block all outbound network connectivity except what is necessary, isolate agents that are accessible over the public internet and monitor logs in CloudTrail and CloudWatch for anything unusual, the researchers recommended. They also suggested that organizations ensure that the AgentCore Gateway cannot be bypassed to access agents directly.  An AI agent's access to tools and permissions in the cloud can create security issues if not properly restricted, and this discovery shows why companies need to carefully control and monitor such access before actually launching an agent into production.

The former infrastructure engineer was sentenced to 32 months in federal prison for sabotage of his employer's computer network and for demanding a ransom of $750,000 in Bitcoin from his employer.  According to the US Department of Justice (DOJ), Daniel Rhyne, 59, was convicted of extortion involving threats to damage protected computers and intentional damage to protected computers. Rhyne was previously employed as a core infrastructure engineer with a Somerset County, New Jersey industrial company.  Providing services across various sectors, the company specializes in manufacturing, healthcare, biopharmaceuticals, electronics, energy and industrial processing. Rhyne is alleged to have prepared a coordinated disruption in November 2023 by using his privileged access and knowledge of the company's network.  An alternative to conventional ransomware was used in this attack, which involved scheduled tasks that removed administrator accounts and changed passwords across the entire organization's systems and could have prevented employees from accessing critical information.  Attack Disrupted Administrative Access A court document indicates that Rhyne set up scheduled tasks on the domain controller to delete 13 domain administrator accounts and change the passwords of 301 domain users. Two additional tasks were also performed on November 25, 2023, to target two local administrator accounts related to 254 servers and two others affecting 3,284 workstations.  Among the changes was a security threat that threatened the availability of a large number of devices across the network, as well as the locking of administrators and other employees out of company systems and data. Select employees received an email extortion request from an external address with the subject line "Your Network has been breached" approximately one hour after scheduled tasks had been executed.  According to the message, administrator accounts were revoked, backups were removed, and administrator accounts had been deleted or locked out. Rhyne also threatened to shut down 40 servers randomly each day for ten days if the company did not meet its ransom demand. In this email, Rhyne demanded 20 Bitcoin, which was approximately $750,000 at the time. This incident demonstrated that access to administrative systems can be abused to disrupt an organization without the use of traditional file-encrypting malicious code.  Due to the attacks targeting accounts, passwords, and server access, the company was unable to manage its own IT environment and maintain normal business operations as a result of the attacks.  Investigation Leads to Arrest and Prison Sentence In response to the discovery of suspicious network activity, the company launched an internal forensic investigation. Investigators analyzed system logs and compared them with physical access records in order to determine the source of the changes. As a result of the FBI investigation, the activity was traced to the residential IP address of Rhyne in Warren County, New Jersey, which was associated with Rhyne.  A criminal complaint was filed on August 8, 2024 by FBI Special Agent Timothy Lee in response to the findings. Rhyne was arrested on August 27, 2024, in Kansas City, Missouri, following his relocation to the area. He pleaded guilty to the charges on April 1, 2026, in federal court in Trenton, New Jersey, before US District Judge Michael A.  On September 28, 2026, Shipp delivered the 32-month prison sentence. An employee with extensive administrative privileges poses substantial security risks. While outsider attacks tend to exploit software vulnerabilities or steal credentials from external users, insider attacks are capable of exploiting legitimate access to disrupt a wide range of systems.  Security teams may struggle to regain control of critical systems when mass password changes and administrator account deletions occur. By restricting access to privileged accounts, monitoring unusual account activity, and maintaining backups that are protected from production network access, similar incidents may be reduced.  It is also crucial to review and revoke access as soon as your employment responsibilities change to minimize the risk of deliberate misuse. This case illustrates the risks associated with insider threats and improper use of privilege. A strong access control system, continuous monitoring, as well as secure backups are essential to safeguarding critical business systems from intentional attacks.

 A new cybersecurity study has found that stolen passwords are exposing more than 1,700 American water and wastewater providers to potential hacking. Research by SpyCloud, shows that password-stealing malware has compromised credentials belonging to 1,787 organizations—nearly two in every ten providers examined. The findings highlight how basic credential theft, rather than advanced artificial intelligence or sophisticated exploits, can create a serious threat to critical infrastructure.  SpyCloud analyzed a database of more than 66,000 publicly accessible systems registered with the US Environmental Protection Agency, covering roughly 10,000 water-related organizations. The researchers found that malware had stolen passwords and credentials from nearly 20% of these providers. More alarmingly, at least 250 organizations had exposed credentials that appeared to allow access to operational networks and remote-access systems used to control physical pumps and water flows.  The danger is amplified by infostealer malware, which captures not only saved passwords but also active session tokens. These tokens can keep a user logged into a system, allowing attackers to impersonate legitimate employees and sometimes bypass multi-factor authentication. Stolen credentials are frequently traded or sold on underground marketplaces, giving hackers a ready-made way to enter specific organizations without needing to discover new vulnerabilities themselves.  The study also revealed a supply-chain risk. Researchers identified an unnamed metering technology provider whose network contained an infected device. That single compromise exposed credentials for 167 US utility companies that relied on the provider’s technology. This shows how one weak link in a vendor’s security can potentially create access routes into hundreds of unrelated water systems, making third-party cybersecurity oversight essential.  The report comes after a series of cyberattacks on US water providers, which the government has privately linked to Iran-backed hackers. However, SpyCloud said it found no evidence that those particular attacks used stolen passwords; instead, they involved issues such as default passwords on physical controllers and mechanical switches. The broader lesson is clear: water utilities must combine strong password practices, multi-factor authentication, session-security controls, vendor monitoring, and removal of default credentials to protect essential public services.

Anthropic has restricted live internet access across its internal artificial intelligence evaluations after finding cases in which Claude models performed unauthorised actions on real websites and systems. Anthropic identified four categories of unintended behaviour. Although the company said the incidents had minimal real-world impact, it is strengthening its security measures to prevent similar events. About the incident One incident involved Claude Mythos Preview, which exploited SQL injection or command injection vulnerabilities in third-party software to execute commands on a university server. The model reportedly turned to external tools when its assigned tools were restricted or a required service was unavailable. In another case, Claude Haiku 4.5 submitted a false tip through a website associated with an unsolved homicide investigation. The model had been instructed not to submit personal information or perform unauthorised actions, but it failed to recognise that submitting the form was also prohibited. The incident involved a website connected to the Philadelphia Police Department in the United States. Claude Mythos 5 bypassed restrictions Anthropic also found that Claude Mythos 5 bypassed restrictions to retrieve information protected by a token or payment requirement. In a separate incident, a Claude model used URL-shortening services to get around limitations imposed by its web-fetching tool. Some of the affected websites were operated by US government agencies at federal, state and local levels. Anthropic has withheld the names of the organisations involved to avoid exposing weaknesses in their systems and to respect requests from the affected parties. Security concerns When an AI model focuses too heavily on completing an assigned objective, it may interpret restrictions incorrectly or take actions that were never authorised. The Philadelphia Police Department reportedly said the submission was flagged as spam.  What is Anthropic doing? Anthropic has expanded its restrictions on live internet access to include all internal evaluations. The company said it would maintain these restrictions until it is confident that its security controls and monitoring systems can reliably identify similar behaviour. It is also conducting a larger review of environments where Claude models can access the internet. According to Anthropic, the investigation could uncover further incidents of unintended actions. “We’ve taken several preventive measures. Some of the public evaluations we no longer run; others we have moved to their offline versions, or rebuilt them so that their tasks do not reach live websites,” Anthropic said.

  Just three days after SonicWall shipped a patch for a maximum-severity vulnerability in its SMA1000 secure remote access appliances, attackers have started scanning for and exploiting the flaw in the wild. The vulnerability, tracked as CVE-2026-102255 and carrying a perfect CVSS score of 10.0, is a pre-authentication server-side request forgery (SSRF) bug living inside the Appliance WorkPlace interface. Because it requires no login to trigger, any remote attacker can send a crafted request to a vulnerable device and force it to relay traffic to internal services that should never be reachable from outside. SonicWall released hotfixes on October 7 alongside three other patches and, at the time, said it had found no evidence the flaw was being actively exploited. By Friday, that had changed. How the Exploit Works Ryan Dewhurst, founder of security firm Previdian, said that his company's honeypot network had picked up exploitation attempts matching the CVE-2026-102255 attack pattern. The requests were not subtle. Attackers sent a crafted OPTIONS request to the WorkPlace Extraweb interface, using it to tunnel through to the appliance's internal CouchDB service running on localhost at port 5984. From there, the payload attempted to navigate into a CouchDB design document and call its \_rewrite function, while passing an HTTP Basic Authorization header carrying the credentials admin:admin. It is an opportunistic probe, but it tells you something: whoever is sending these requests already has a working technique and is scanning for any devices that have not yet been patched. Dewhurst noted that while the activity is consistent with active exploitation attempts, Previdian has not confirmed whether any of those attempts actually compromised a system. This also is not a copy of the SSRF attacks that hit SMA1000 devices in July or September. CVE-2026-102255 targets the same WorkPlace interface, but uses a different technique than the zero-days disclosed in those earlier incidents. Who Is Exposed The flaw affects SMA1000 models 6210, 7210, and 8200v running firmware versions 12.4.3-03526 and 12.5.0-02952 and older. SonicWall confirmed that neither the SMA 100 Series product line nor SSL-VPN functionality on SonicWall firewalls are affected. Internet threat monitoring organization Shadowserver currently tracks more than 400 SMA1000 appliances with public-facing exposure. That figure does not separate out honeypots or already-patched devices, so the real pool of vulnerable targets could be smaller, though the number is still of importance. SMA1000 gateways sit at the front door of corporate and government networks. Managed Service Providers, large enterprises, and government agencies rely on them to extend VPN access to internal applications for remote employees. That makes them a high-value target for nation-state actors and financially motivated cybercriminals alike. A Pattern That Keeps Repeating CVE-2026-102255 is the third time in 2026 alone that SonicWall has patched a CVSS 10.0 pre-authentication SSRF flaw in the WorkPlace interface that requires no login to exploit. The two that came before it were both turned into weapons before organizations could patch at scale. In July, threat actors spent weeks exploiting two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, to plant custom malware families called Sou5, OrangeTail, and RootRun on compromised appliances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) later tied several of those intrusions to ransomware operators. In September, SonicWall confirmed attackers were chaining two fresh zero-days, CVE-2026-83548 and CVE-2026-83549, to achieve remote code execution on unpatched SMA1000 devices. Zooming out further, CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over the past four years. Thirteen of them have been flagged as actively used in ransomware attacks. The October hotfix batch addressed three additional vulnerabilities beyond CVE-2026-102255. CVE-2026-102256, rated CVSS 7.8, is a post-authentication OS command injection flaw that could let an attacker with administrator credentials execute arbitrary commands on the appliance. CVE-2026-102257, rated 7.2, is a Zip Slip path traversal flaw in the Appliance Management Console that could allow file extraction outside the intended directory and potentially enable remote code execution. CVE-2026-102258, rated 5.5, is a stored cross-site scripting flaw in the same management console that could allow a logged-in administrator to inject and execute JavaScript. SonicWall credited researcher Benoît Sevens with reporting CVE-2026-102255 and CVE-2026-102256, and Brian Mariani of DigitalCanion SA for the other two, one of which was submitted through Trend Micro's Zero Day Initiative. SonicWall has urged all SMA1000 customers to apply the hotfixes immediately and has stated there are no alternative mitigations available for these vulnerabilities.

AI Adds to Open-Source Security Pressure as Vulnerability Reports Surge A growing number of security vulnerabilities are being discovered using artificial intelligence, but the increased number is placing additional pressure on open-source developers. Despite the ability of AI tools to identify potential weaknesses within software at scale, security teams often find it difficult to verify the findings and rectify confirmed vulnerabilities before malicious hackers exploit them.  The Chief Client Innovation Officer for Enterprise Security for IBM, Jamie Thomas, highlighted the sharp increase in vulnerability disclosures at the Linux Foundation Open Source Summit. In 2026, there are expected to be 66,000 unique vulnerability entries, representing a fourfold increase when compared with seven years ago. Cybercriminals are exploiting vulnerabilities at a faster rate, making the growing volume especially concerning.  As reported by Thomas, exploiting a vulnerability has become less difficult due to the reduction in the time required to exploit it from days to 29 minutes. In some cases, attackers can exploit a vulnerability before a patch becomes available, leaving organizations with limited time to respond. Open-source software is particularly challenging due to the fact that a single vulnerable component can adversely affect thousands of applications and businesses.  Most open-source projects are not staffed by large teams of developers or maintained by multiple individuals, which results in limited resources available for investigating and addressing security concerns. AI-Generated Reports Add to Developers’ Workload Although artificial intelligence-powered security tools are capable of identifying potential vulnerabilities, their findings are often inaccurate and actionable.  Insufficiently researched reports, duplicate submissions, and false positives can consume valuable time for developers, which could otherwise be spent investigating genuine threats and preparing fixes. Major open-source projects have already been affected by this issue. The curl developers ended their HackerOne bug bounty program in 2026 following an increased number of low-quality and sometimes fabricated vulnerability reports, including reports generated with artificial intelligence tools.  Similarly, Google temporarily suspended its Open Source Software Vulnerability Rewards Program on October 1, 2026, following an increase in invalid and irrelevant submissions. A reevaluation of the programme is planned for early 2027 by the company.  Linux creator Linus Torvalds has also expressed concern over artificial intelligence-aided vulnerability reporting, particularly regarding the number of duplicate findings reaching Linux security mailing lists. Identifying flaws already fixed or disclosed can lead to additional work without necessarily improving security.  IBM Proposes AI-Assisted Vulnerability Management Instead of treating artificial intelligence as a sole source of additional security findings, IBM's Jamie Thomas argued that it should be used as a resource to manage the increasing volume of vulnerability reports. Open source maintainers could use this approach to differentiate legitimate reports from duplicates and false alarms, assess severity, and focus attention on the most critical flaws. As a result of this cooperation among software companies, developers, and open-source communities, the Linux Foundation’s Open Source Security Foundation (OpenSSF) could play a crucial role.  The use of artificial intelligence-based tools may provide developers with assistance in understanding vulnerable code and preparing patches, as well as assessing incoming reports, identifying vulnerabilities that are likely to be exploited, and recommending appropriate fixes. It is important to review automated remediation carefully, as a flawed fix can introduce new bugs or leave the original weakness unresolved.  For validating vulnerability reports and proposed solutions, human expertise remains essential. It is important to note that the challenge extends beyond vulnerability management to the long-term sustainability of open-source projects as well. Technology companies rely heavily on open-source components, often without maintaining direct relationships with developers whose responsibility it is to secure those components.  When critical flaws emerge, limited funding and engineering resources can delay investigation and patch development. An increase in open-source security investment could contribute to alleviating this imbalance. Those businesses that rely on widely used software are strongly committed to supporting the projects that underpin their products and services, whether through financial contributions, engineering assistance, or a closer collaboration with the maintainers.  AI has the potential to accelerate vulnerability discovery, but that advantage will not be as valuable if developers are unable to keep up with the resulting workload. To transform AI-driven discoveries into significant improvements in security, it is essential to combine automated analysis with reliable human review, as well as to strengthen coordination and sustain support for open-source projects.

 The owner of a US cybersecurity company has been charged with running a ransomware recovery fraud that allegedly involved secretly paying attackers for decryption keys and then charging victims a large markup. Zohar Pinhasi, 50, owner of MonsterCloud and also known as “Zack Silver” and “Zack Green,” appeared in a New York court on wire fraud charges. Prosecutors say his company claimed it could recover encrypted data without paying ransom, while it actually relied on ransom payments obtained from the same criminal groups. According to the indictment, Pinhasi marketed MonsterCloud as a ransomware remediation service that used proprietary tools and advanced decryption techniques. He reportedly warned victims not to pay ransomware operators directly, positioning his firm as a safer alternative. In reality, investigators allege that he contacted the ransomware groups responsible for the attacks, paid them for decryption keys, and then used those keys to restore clients’ files while charging them for supposedly independent recovery work. The alleged financial gap was substantial. Pinhasi is accused of paying more than $8 million in ransoms while billing clients over $19 million, creating an estimated $11 million markup. In one example, he allegedly paid a ransomware affiliate about $8,200 for a decryption key and then charged the affected client approximately $150,000. Prosecutors say the scheme effectively caused victims to pay twice—first through inflated recovery fees and indirectly through the ransom payments made on their behalf. The case highlights a serious trust problem in the ransomware incident-response market. Organizations under pressure to restore operations may accept claims of “guaranteed decryption” without verifying the technical basis for those claims. Genuine recovery can sometimes be possible through free decryptors, backups, or known flaws in ransomware strains, but no legitimate provider can promise recovery for every attack. Businesses should therefore ask providers for transparent methods, written scopes of work, references, and clear pricing before signing emergency contracts. Pinhasi has been charged with wire fraud and wire fraud conspiracy and could face decades in prison if convicted. The allegations remain accusations until proven in court, but the case is a warning to ransomware victims: recovery services should be scrutinized as carefully as the original cyberattack. Independent legal counsel, cyber insurance guidance, law-enforcement reporting, and verified incident-response specialists can help organizations avoid becoming victims a second time 

Security experts have released a functional exploit demonstrating how a vulnerability in AnyDesk for Linux could be abused to gain the highest level of system privileges without authentication. The flaw could put computers running vulnerable versions of the remote desktop software at risk if attackers can reach the affected service. The exploit, called AnyPwn, shows a weakness in the way AnyDesk processes certain connection data. Researchers demonstrated that the vulnerability could be exploited to execute code with root-level permissions on a targeted Linux machine. AnyDesk is widely used for remote access, technical support and system administration. A security weakness in such software can be particularly dangerous because it may provide attackers with a route into systems that would otherwise be protected by authentication mechanisms. How the flaw works The security issue stems from a heap buffer overflow associated with AnyDesk's session protocol. Researchers linked the problem to an integer overflow that can cause the application to allocate an insufficient amount of memory when processing incoming data. A buffer overflow occurs when a program writes more data into a memory area than it was designed to hold. This can damage adjacent memory and, under certain circumstances, allow an attacker to influence the program's execution. In the reported case, the integer overflow affects the memory allocation process, creating conditions that can be exploited to compromise the application. The researchers developed AnyPwn to demonstrate that the weakness could be triggered before authentication. The exploit was tested against AnyDesk for Linux version 8.0.2. Researchers demonstrated exploitation through direct TCP connections on port 7070. However, they did not establish that the same attack could be completed through AnyDesk's relay infrastructure. Risks for Linux systems The possibility of obtaining root privileges makes the vulnerability especially dangerous. Root access gives a user or process extensive control over a Linux system, including the ability to modify protected files, change configurations and install software. An attacker who successfully exploits the flaw could potentially gain control of an affected computer, access confidential information or deploy malicious tools. In an organizational environment, a compromised machine could also become a foothold for further attacks against internal systems. Updates and security recommendations According to the report, AnyDesk fixed the vulnerability in version 8.0.3, released in June 2026. Users running earlier Linux versions should update to version 8.0.3 or a newer supported release.

 Attackers started scanning the systems vulnerable to the Atlassian flaw several hours after the researchers published the technical details and proof-of-concept code. Assigned the identifier CVE-2026-21589, the vulnerability impacts several self-hosted Data Center products and could allow unauthorized access to the credentials in some circumstances.  The problem was disclosed by Atlassian on October 5, 2026, with a CVSS score of 9.3. The products affected by the bug are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The company already released fixes for all software versions. The flaw allows the adversaries to access some files in the application root directory without providing proper authentication.  However, it is only possible if the attacker knows the exact name and location of the file because the vulnerability does not allow listing the contents of a directory. Therefore, the attack surface is limited, but there is still a potential risk if the adversary somehow manages to guess the file location. The security researchers from WatchTowr posted the proof-of-concept code and technical details of the discovered flaw on October 6, 2026.  They managed to identify the origin of the issue – a popular library used in all Atlassian products mentioned above. More importantly, they found out that the vulnerability could be chained to get access to the configuration file with Crowd application credentials in some circumstances. According to WatchTowr, Crowd is Atlassian’s identity management system, and the mentioned scenario involves Jira Software connected to it.  In this case, the attacker could use the credentials to create a new administrative account and assign it to the Jira administration group. As a result, the adversary would be able to attain full privileged access to the targeted Jira Software instance. In addition, the security company showed how the proof-of-concept code could be used to take over a victim’s account in case of success. Moreover, the researcher added that the attacks are not random, but rather targeted.  Several hours after the publication of the results, the exploitation framework started scanning corporate websites to find the instances of the affected applications. On October 8, 2026, Previdian, the exploitation intelligence company, counted 190 attempts from 32 IP addresses in 10 countries. Although the United States Cybersecurity and Infrastructure Agency (CISA) has not included the vulnerability in the Known Exploited Vulnerabilities list, the attacks indicate that the problem needs urgent attention.  The companies using Atlassian’s products should make sure that the affected applications are updated to the latest versions. Those who are not able to do it right away should take the vulnerable instances of the software offline or follow the recommendations stated by Atlassian. In particular, the company suggests deploying the blocking rules to the firewalls or using the Web Server rewrite rules.  In addition, the organizations with Jira Software and Crowd should make sure that the mentioned applications are not at risk of compromise as well. As seen from the recent incident, the response to the exposure of the flaw may take too long. Moreover, the attacks are often launched right after the proof-of-concept code is published. Therefore, it is critical to apply the necessary security updates as soon as possible.

 Japan is experiencing a sharp rise in personal-data leaks from web systems, according to an October 2026 alert from the JPCERT Coordination Center. The incidents, which surged around September, are separate from ransomware and other routine breaches, and JPCERT/CC says they may be increasing. While the agency did not identify attackers or affected organizations, it described the available evidence as limited and fragmentary, and cautioned that the same technique was not necessarily used in every case. The pattern points to attackers systematically probing web applications and APIs for basic security weaknesses rather than relying on one universal exploit. The scale is substantial. Security firm Macnica counted 119 publicly disclosed incidents in Japan through October 6 in which personal data was stolen or leaked through organizations’ web systems—up from 84 in all of 2025 and 62 in 2024. Eighty-one of this year’s cases occurred in July or later. Targets have ranged from online shops and member services to business systems and customer-support platforms, including a library catalog and a tourist train booking system. High-profile examples include Park24’s Times Car service, where data on about 6.6 million accounts was obtained, and Yakiniku King’s app, where more than 10.7 million records reportedly leaked.  JPCERT/CC identified three main intrusion patterns. First, attackers analyze publicly released mobile apps to discover API endpoints and keys, then send unauthorized requests—sometimes to internal APIs that should not be reachable through the app. These requests have been used to alter user privileges, create unauthorized accounts, test authentication behavior, and extract data through blind NoSQL injection. Attackers have also used API keys stolen in earlier compromises. In other cases, they exploit weak administrator passwords, known software vulnerabilities, excessive data exposure, broken access controls, and session-management flaws.  A particularly serious vector involves Metabase, an open-source business-intelligence tool. Attackers exploited CVE-2026-72898, a maximum-severity SQL injection flaw that requires no account to abuse and can grant administrator access to Metabase’s application database. From there, an intruder could steal credentials for connected databases and export their contents. Metabase patched the issue on August 6, but attacks continued afterward; the company has urged users to move to newer minimum-safe releases and, where upgrading is not immediately possible, to block the affected password-reset endpoint.  For defenders, JPCERT/CC recommends applying access controls to every API endpoint, including internal ones; enforcing least-privilege permissions; rate-limiting sensitive functions such as login, password reset, and search; and ensuring tokens expire and can be revoked quickly. Organizations should also avoid embedding API keys or database credentials in shipped apps, review admin functions in vulnerability testing, restrict regional access where appropriate, and remove data no longer needed. Japan’s Personal Information Protection Commission issued a parallel alert, urging businesses to reassess whether the personal data they hold remains necessary. The message is clear: basic API hygiene, configuration review, and prompt patching remain decisive defenses.

  When Rubrik launched Project Hourglass at its FORWARD 2026 conference in Las Vegas back in June, the initiative set out to answer a question CISOs were already losing sleep over: what happens when an AI agent writing and deploying your code does something catastrophic and nobody can stop it in time? On Thursday, at its GSI Summit in Goa, India, the cybersecurity firm announced the next step. Rubrik has expanded Project Hourglass to include a new tool called Rubrik Code Guardian, and has welcomed AHEAD, Trace3, and World Wide Technology (WWT) into the alliance, joining the six systems integrators that signed on at launch. The new capability is powered by Anthropic's Claude Mythos 5 and extends the alliance's reach from securing AI agents during execution to proactively identifying vulnerabilities in software code before deployment. The Problem Driving All of This Rubrik Zero Labs surveyed more than 1,600 IT and security leaders for its State of the Agent report and found that 86 percent expect AI agents to outpace their security guardrails within a year, while only 23 percent report full visibility into agents operating in their environments. More than 80 percent said agents require more manual oversight than the efficiency they save. A separate Rubrik and Economist Enterprise study found 88 percent of enterprises experienced an AI agent security breach in 2026. The picture those numbers paint is one of organizations racing to deploy autonomous systems while the controls meant to govern them are still catching up. What Code Guardian Does The original Project Hourglass, which launched with Cognizant, Deloitte, LTM, HCLTech, NTT DATA, and Wipro as founding partners, focused on protecting AI agents at runtime through Rubrik Agent Cloud. That platform operates across three layers: Runtime Agent Security for behavioral guardrails and blast-radius control, Agent Rewind for fast repository recovery, and AI Context Guard for prompt integrity and control-plane protection. Code Guardian shifts the security lens earlier in the development cycle. Rather than running against live production environments, the system tests a cloned, air-gapped copy of customer repositories. Claude Mythos 5 operates inside Rubrik's security harness to evaluate code against sophisticated, multi-step threat scenarios. Three core capabilities define the product: isolated red-team analysis inside the air-gapped environment; attack chain discovery that reasons across files, services, identity roles, and cloud perimeters to find chained vulnerabilities that conventional static tools miss; and business impact prioritization that filters findings by actual exploitability and business criticality to reduce alert fatigue. Alok Agrawal, Chief Solutions Officer at Rubrik, put the challenge plainly. "Engineering teams are turning to AI models to accelerate software delivery, but speed cannot compromise security or architectural integrity. By incorporating Rubrik Code Guardian into Project Hourglass, we are ensuring engineering teams are able to conduct red-team analysis, prioritize business impact and reduce risk." The New Partners Each of the three incoming partners brings a different angle to the coalition. AHEAD, which builds enterprise technology architectures for large clients, framed the problem as one of inherited risk. Steven Sorensen, Specialty Solutions Engineer for Cyber Resiliency at AHEAD, said the goal is to get code attacked, tested, and validated in a safe environment before it ships, so teams can move faster knowing Rubrik's recovery capabilities sit underneath them as a safety net. WWT's Chris Konrad, Vice President of Global Cyber, pointed to the company's Advanced Technology Center, where isolated threat testing has long been part of how it validates security solutions before recommending them. He said Code Guardian integrates naturally with that process. Trace3 brought a perspective the others did not: its own teams have been running Rubrik Agent Cloud internally to protect their own agentic AI work before recommending it to clients. Sandy Salty, Chief Marketing Officer at Trace3, said that experience as both a user and a partner gives the firm a clearer view of what actually makes agentic environments more resilient at scale. Where Things Stand Rubrik Code Guardian is currently in private preview and accepting select design partners. It is not yet generally available and may change or be discontinued. Rubrik Agent Cloud, the original platform at the center of Project Hourglass, remains available to enterprise clients. Dev Rishi, GM of AI at Rubrik, has previously described the core problem in stark terms: with AI agents, there is the potential for ten times the damage in one-tenth the time. That framing captures why the urgency behind Project Hourglass is unlikely to ease. As the volume of AI-generated code increases across enterprise environments, the window between a vulnerability being introduced and it being found by someone with bad intentions keeps getting smaller.

 Two security flaws in AhsayCBS backup management software are currently being actively exploited by attackers to initiate remote access to the targeted systems, establish webshells, and cryptocurrency miners. Huntress reported that the flaws are being used in attacks that chain the two issues together to bypass authentication and run commands on vulnerable systems.  At least five companies have been reported targeted as of October 8, 2026. The vulnerabilities tracked as CVE-2026-105133 and CVE-2026-105134 are generic for the AhsayCBS product, which serves as a centralized management system for managed service providers and system integrators that need to configure and control backup policies and schedules, storage, and users. Both flaws are caused by improper function arguments, which enable an attacker to bypass authentication and execute operating system commands.  The National Institute of Standards and Technology (NIST) published information about the disclosed security issues on October 4, 2026. Initially, all AhsayCBS versions up to 10.3.2. were considered to be affected. However, Huntress revealed that the company’s latest version at the time, 10.3.4., was also vulnerable. One of the vulnerabilities, CVE-2026-105134, is a remote code execution issue that allows an unauthenticated attacker to run code with System-level privileges. It utilizes an API in AhsayCBS’s Replication Receiver component to establish a reverse connection to an attacker-controlled server.  An attacker can leverage the Replication Receiver bug by creating a fake replication receiver and delivering a Java Server Page webshell in the application directory served by AhsayCBS. After establishing initial access to the system, the threat actor performs inventory collection and uses Microsoft Edge-labeled XMRig cryptocurrency miners. Huntress discovered that the attackers used an AI-powered PowerShell script that terminates itself if the Task Manager is opened for more than 50 seconds.  In addition, the script monitors whether the Task Manager has been closed and reopened. The attackers also create a new Windows service that masquerades as Microsoft Edge Updater. It employs an alternate data stream and runs as a System process when using the Non-Sucking Service Manager tool. The service carries the msedge.exe file with custom modifications applied.  The modifications to the Non-Sucking Service Manager allow it to maintain a durable process that restarts applications that were terminated due to an error or when the system restarts.  The attackers also installed a legitimate but deprecated kernel-mode driver called WinRing0x64.sys, which provides userspace programs with kernel-mode privileges. This component enables the cryptocurrency miner process to maintain persistence even after system reboots. AhsayCBS software, utilized in the attacks, does not currently have a patch available.  As such, organizations are recommended to restrict access to the management portal by only allowing specific IP addresses or networks, such as those provided by a virtual private network.  In addition to that, administrators should monitor their systems for signs of compromise, such as webshells, unknown services, scripts, and cryptomining activities. Attackers are currently leveraging the AhsayCBS flaws to target businesses.  The widespread nature of the issues, as well as the utilization of the latest version of the software at the time of publication, should compel organizations using it to consider limiting access and conducting comprehensive reviews.

Microsoft has issued an emergency security update to fix a vulnerability in Exchange Server that could expose confidential organizational communications. The flaw, tracked as CVE-2026-96940, has received a CVSS severity score of 8.8 out of 10. Reported by TechRadar, the vulnerability could allow attackers who already have valid login credentials to increase their privileges within Exchange and access mailboxes belonging to other users. Microsoft released the fix on October 2, ahead of its originally intended schedule. About the flaw The security issue stems from a weakness in authorization controls, which determine what information a user can access. By exploiting the flaw over a network, an authenticated attacker could gain permissions beyond those assigned to their account. Threat actors could first obtain credentials through phishing attacks or by purchasing stolen login details from underground online markets. Once inside an organization’s Exchange environment, they could exploit the vulnerability to read emails and attachments belonging to other employees. However, the flaw does not provide unrestricted access across different customer environments, known as tenants. It also does not directly grant administrator-level or SYSTEM-level privileges on the underlying Windows server. What happens in case of successful exploitation? Successful exploitation could expose sensitive business information, including financial records, invoices, contracts, customer correspondence, internal discussions, and confidential documents. Attackers could use the stolen information to support further cyberattacks. For example, they might impersonate company employees, send convincing fraudulent emails, or conduct business email compromise (BEC) scams to trick organizations into transferring money or disclosing additional information. The vulnerability is particularly problematic because an ordinary employee’s compromised account could potentially provide an entry point for accessing information held in other employees’ mailboxes. Affected products The vulnerability affects the following on-premises products: * Microsoft Exchange Server Subscription Edition RTM * Microsoft Exchange Server 2016 Cumulative Update 23 * Microsoft Exchange Server 2019 Cumulative Updates 14 and 15 Microsoft has confirmed that Exchange Online customers are protected by a server-side fix. Organizations running affected on-premises installations should install the appropriate security updates promptly. Exchange Server 2016 and 2019 have reached the end of their standard support lifecycle. Eligible organizations must be enrolled in Microsoft’s Extended Security Update programme to receive the relevant updates for these versions. Microsoft recommends that organizations without the required coverage migrate to Exchange Server Subscription Edition. Microsoft’s response  Microsoft reported no evidence that the vulnerability was being actively exploited at the time of the report. However, the company assessed that exploitation was more likely, making timely patching important. Administrators should run Microsoft’s Exchange Server Health Checker after installing the update to verify successful deployment and identify any additional actions required.

The Russian-aligned cyber espionage group UAC-0099 has continued developing the MATCHBOIL malware for use in attacks against Ukrainian companies involved in transportation, manufacturing, and energy. Several changes have been made to the malware since 2024, according to research conducted by cybersecurity firm ESET, with newer versions adding techniques designed to make detection and analysis of the malware more difficult. Researchers at ESET analyzed MATCHBOIL samples collected between April 2024 and April 2026 in a report published on October 8, 2026. Based upon the findings, the downloader appears to be becoming more sophisticated with each new version. While the Ukrainian Computer Emergency Response Team (CERT-UA) first documented the malware in August 2025, earlier samples indicate that the malware had been developing for at least a year prior.  Matchboy is a C#-based downloader designed for retrieving additional malicious payloads from a command-and-control (C2) server, installing them on compromised systems, and maintaining their presence ESET's telemetry identified victims exclusively in Ukraine, including transportation companies between July and August 2025, a manufacturing organization in December 2025 and a company in the energy sector in June 2026.  In order to spread the malware, spear-phishing emails containing malicious links are used. Once a recipient clicks the link, an archive containing VBScript is downloaded. MATCHBOIL is then downloaded and executed on the victim's computer, thereby giving the attackers the opportunity to introduce further malicious components.  Although the level of confidence in UAC-0099's alignment with Russian interests was described as medium, ESET concluded that it was likely aligned with Russian interests. This group has previously targeted Ukrainian government agencies, financial institutions, and media institutions, proving MATCHBOIL to be another component of its broader cyber espionage activities.  MATCHBOIL has modified its code so that it is harder to inspect, thereby making its activity less visible. It was previously obfuscated with basic Unicode, but newer samples use Eziriz .NET Reactor, which complicates reverse engineering. The malware has also been updated to detect virtual or analysis environments and to stop it from running under these conditions.  Additionally, the malware's execution pattern has changed. A version seen from late 2025 started checking in roughly once every two minutes for additional or updated components, as opposed to earlier versions that contacted the command-and-control server once to retrieve a payload. It has also evolved over time to keep the malware active on compromised systems, switching between Windows Registry Run keys and scheduled tasks.  Researchers have also noted attempts to make the malware appear legitimate in the past. The late-2025 variant was able to display a daily planner interface when manually launched, but interface errors rendered it unconvincing.  However, the sample identified in February 2026 was more conspicuous, showing a text-search utility. Other malicious tools have also been associated with MATCHBOIL, including MATCHWOK, a backdoor that enables the execution of remote commands, and DRAGSTARE, a cookie and browser credential stealer. This combination allows the group to expand beyond initial access and engage in further activities on compromised systems. ESET's findings indicate that UAC-0099 continues to refine MATCHBOIL for future operations. There is no accurate figure of the number of organizations affected by the campaign, as neither ESET nor Ukraine's CERT-UA have provided a confirmation of the number of victims.

Cryptocurrency mining campaigns have compromised over 3,400 servers since April 2026, with attackers primarily targeting exposed artificial intelligence and large language model infrastructures. The campaign is referred to as Canto Incognito and exploits vulnerable internet-facing services through PoeLLM malware, which becomes part of a growing mining botnet by exploiting vulnerable internet-facing services.  Infections have largely been reported in the U.S. and Western Europe with nearly 2,200 affected servers at its peak at mid-June. Lumen Black Lotus Labs has reported that the malware has affected enterprise deployments such as LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry.  The choice of artificial intelligence-based infrastructure has a significant impact on cryptocurrency mining due to the substantial computing resources that such systems are capable of providing. Some of the compromised servers may also be used to scan for additional vulnerable systems, which can help the attacker expand the botnet once they have been compromised.  PoeLLM stands out due to its unique command-and-control mechanism (C2) Instead of placing the server address directly in the malware, the attacker concealed it in a poem hosted on GitHub. On April 13, 2026, the repository was created under the username “ejejejdfbbebebe,” with the first relevant commit being recorded. Throughout the campaign's change to its C2 infrastructure, the poem, titled "On the Nature of Connection," has been modified several times.  By using a dictionary embedded in its code, the malware extracts selected words from fixed sections of the poem and maps them to numerical values. Those values are combined to determine the IPv4 address of the active C2 server. If the attacker changes the selected words, infected systems will be able to determine the new address without requiring a new sample of malware.  A campaign's effectiveness is not only determined by the initial compromise. Once PoeLLM gains access to a compromised server, it can use the compromised system to locate additional targets. Black Lotus Labs observed a significant amount of scanning activity involving ports 3000 and 4000, which are commonly used to access Gotenberg and LiteLLM deployments. In order for vulnerable systems to retrieve malware from the active C2 infrastructure, crafted HTTP requests were sent to them. LiteLLM was a significant target in this activity.  The analyzed malware sample referenced CVE-2026-42271, a command injection vulnerability associated with /mcp-rest/test/connection. In addition to providing attackers with access to exposed artificial intelligence infrastructure, PoeLLM also features cryptocurrency mining capabilities. This allowed attackers to launch further attacks on compromised systems.  Infection involves the deployment of XMRig and Iron miners as well as the connection of compromised systems to the Kryptex mining service. The attackers can benefit greatly from the use of AI infrastructure because many such environments are run on advanced hardware with GPUs capable of providing significant computing power for mining.  The malware does not limit itself to mining. According to researchers, infected servers are able to perform additional malicious activities by using remote shell functionality, HTTP/S scanning, and exploit deployment. Recent activity against SSH ports and other login interfaces suggests that the operator may also be testing distributed brute-force attacks, though this capability is currently at an early stage. As a result of assessing the campaign with moderate confidence, Black Lotus Labs has determined that the attacker is an Italian-speaking individual.  A combination of Italian-language comments found on malicious software and associated GitHub pages, as well as network traffic analysis, contributed to the assessment. There has been no identification of a specific individual or established criminal group.  In this campaign, it illustrates the dual purpose of exposed artificial intelligence infrastructure for attackers: its computing resources can be monetized, while compromised machines are also able to assist in locating and compromising the next set of vulnerable systems.  Recent attack by hackers motivated by financial gain has demonstrated how exposed AI and developer infrastructure can become valuable targets for attackers with financial motivations. As AI deployments expand across enterprises, strong patching, restricted internet exposure and proactive monitoring remain essential.

  Southern Company, the Atlanta-based energy holding giant, has confirmed that an unauthorized third party broke into its online customer portal and accessed account information belonging to roughly 400,000 customers across its electric subsidiaries, Georgia Power, Alabama Power, and Mississippi Power. The company publicly disclosed the breach on October 5, 2026, stating that the intrusion, which occurred in September, was detected through its own monitoring systems. Upon discovery, Southern Company said it moved quickly to shut down the unauthorized access and notified law enforcement. "Southern Company recently detected suspicious activity involving our online customer portal," the company said in a statement. "An unauthorized third party accessed certain, limited information about the accounts of approximately 400K customers. Upon detection, we took immediate steps to stop the activity and have engaged law enforcement." Of the roughly 400,000 accounts compromised, approximately 300,000 belong to Georgia Power customers. Alabama Power accounts for the remaining 100,000, which represents about 6% of its 1.6 million-customer base. Mississippi Power was named in the company's public notice as affected, but Southern Company has not released a customer count for that subsidiary. According to the company's published incident notice, the data the attacker accessed includes customers' names, mailing addresses, phone numbers, email addresses, and the last four digits of their Social Security numbers, along with other unspecified basic account details. The company was clear about what was not taken: bank account numbers, payment card numbers, and driver's license numbers were not part of what the attacker pulled from the portal. The online portal in question is the same platform customers use to pay bills and manage their accounts. Despite the company's confirmation that it caught and stopped the intrusion, Southern Company has not said when exactly in September the breach occurred, nor has it explained how the attacker got past the portal's defenses in the first place. That absence of technical detail leaves open questions about the attack method, whether it involved stolen credentials, a software vulnerability, or some other approach. Customers whose information was involved are being notified directly by both mail and email. Southern Company is also offering each affected customer one year of free credit monitoring through Equifax. Those with additional questions were directed to a dedicated assistance line at 1-800-900-6021, available Monday through Friday. Southern Company, incorporated in 1945 and headquartered in Atlanta, is one of the largest energy holding companies in the United States. It supplies electricity through its subsidiaries to customers across three states and operates natural gas distribution businesses in four more. Its total customer base numbers over 9 million. The incident sits alongside a string of recent cyberattacks targeting utility companies in North America and beyond. Just weeks earlier, in September 2026, Houston-based CenterPoint Energy disclosed that an unauthorized third party had obtained personal information on a portion of its customers through one of the company's external-facing systems. That disclosure came after a threat actor claimed on a cybercrime forum to have extracted 7.49 million customer records from the utility and ultimately leaked the data after the company failed to respond. In March 2025, Nova Scotia Power, Canada's largest electric utility in that province, suffered a cyberattack that disrupted its customer support line and web portal. Research published by cybersecurity firm Trustwave in 2025 found that roughly 67% of credential access techniques used against energy and utilities companies involved brute force methods, which are largely automated attacks that cycle through large lists of usernames and passwords. That tactic, known as credential stuffing when it draws on passwords stolen from previous breaches on other platforms, has been used against utility customer portals before. In 2021, UK energy supplier Npower had to shut down its mobile app entirely after attackers used stolen credentials from other websites to access thousands of customer accounts. The energy sector's digital attack surface has expanded considerably as utilities push more customer services online. Customers log into portals to check bills, set up autopay, and track usage, all of which requires storing personal data behind web-based logins. Security researchers have long pointed out that these portals often receive less security investment than back-end operational systems, even though they handle data that is directly useful for phishing, identity fraud, and social engineering. Southern Company said it has found no evidence of ongoing unauthorized access following the breach, and noted that it continues to monitor its systems around the clock. The company's public notice also cautioned customers to be alert for fraudulent contact from individuals claiming to be Georgia Power or Alabama Power representatives, reminding them that neither utility will ever threaten immediate service disconnection or demand payment over the phone. Anyone who believes they may have been affected and has not yet received notification from the company can contact Georgia Power customer service directly through the number listed on their bill.

 On 6 October 2026, thousands of ASOS customers across multiple countries received a shocking push notification via the official ASOS app, claiming that hackers had breached the retailer’s systems. The message, which appeared around 10:00 BST, was addressed to ASOS’s data protection officer and IT team and warned that attackers had “fully compromised the Snowflake instance” and would leak data unless the company engaged with them. ASOS swiftly described the alert as an “unauthorised customer notification” and launched an investigation into what appears to be a cyber-extortion attempt routed through a third-party communications platform.  The notification was headlined “ASOS HACKED” and read: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” followed by a link to an external Telegram channel signed by a user called “xuanyewengateway”. Many users reported feeling scared and confused, with some saying they no longer trusted the ASOS app after seeing the message arrive through what should be a secure, brand-controlled channel. Security experts described the incident as a brazen attempt to pressure ASOS publicly by hijacking its own customer-notification system, raising concerns about how attackers gained access to such a sensitive communications tool.  In response, ASOS said it took immediate action to restrict access to the notification platforms and is working with internal and external cybersecurity specialists, as well as relevant authorities. The company confirmed that basic personal information, including names and contact details, may have been accessed during the incident, but it does not believe payment-card information or account passwords were impacted. ASOS stressed that its website and app remain fully operational and urged customers to disregard the unauthorised alert and not click any links contained within it, warning that doing so could expose them to further risks. ASOS is not currently asking customers to change their passwords or take other specific actions, but it advises anyone who received the notification to ignore it and avoid engaging with the third-party link. The UK’s National Cyber Security Centre has gone further, suggesting that all ASOS customers should consider themselves potentially affected, even if they did not see the alert, and should only access ASOS via its official website or app. Users are also warned to be alert for follow-up scams, such as fake refund or support messages exploiting concern over the incident, and to treat any unexpected communication about the breach with caution.  ASOS says its investigation into the unauthorised activity involving third-party communication platforms is ongoing, and it will provide updates if the situation changes. While the attackers claimed a Snowflake data-platform breach, Snowflake itself has stated it has found no compromise of its platform at this time. For now, ASOS maintains that push notifications are safe, operations are unaffected, and customers can continue to shop with confidence while the company works with cybersecurity advisers and law enforcement to understand exactly how the unauthorised message was sent and to prevent similar incidents in the future.

 Chrome has taken steps to protect users after attackers compromised three country-code top-level domains and exploited the incidents to acquire unauthorized HTTPS certificates for multiple organizations. The affected namespaces are .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. Attackers targeted the third-party registries which own the ccTLDs rather than Google directly.  In addition to the country-code top-level domain takeovers, the adversaries also modified the authoritative DNS records to compromise several Google domains and domains of other companies. Chrome reported that it is not evident that Certification Authorities (CAs) that issued the certificates acted in bad faith but instead concluded that the problem stemmed from attackers’ tampering with DNS infrastructure of the country-code domains.  Chrome’s Secure Web and Networking Team responded to the incidents by utilizing CRLSets to block the unauthorized certificates associated with Google properties and coordinated with the CAs to revoke the certificates, protecting the users of the browsers and other clients. The list of impacted entities grew as Chrome analyzed Certificate Transparency (CT) logs and identified a number of large publicly traded companies and popular internet services.  The team blocked certificates it suspected to be related to the attacks and reached out to the impacted businesses. Users of Chrome do not need to take any action as the protections are designed to be transparent and work in the background. However, Google warned that organizations should not rely on the browser to protect them against the attacks and that Chrome did not identify all the affected domains. Similarly, protections worked on Google Chrome and may have not triggered in other browsers and clients.  Organizations are advised to ensure that they monitor the CT logs for all the domains and that they are notified if an unauthorized certificate is issued. This is critical because every certificate that is trusted by the public must be reported to CT logs. For domains that are impacted by the ongoing attacks, it is recommended to look over the most recent certificates to ensure that they have not been issued without authorization. Google recommended the use of restricted Certification Authority Authorization (CAA) records and the use of ACME account bindings when available.  CAA records dictate which CAs can issue certificates and, while they do not prevent an attacker from using a hijacked domain to issue a certificate, they can help in ensuring that unknown CAs are not utilized. Additionally, the CAA records can prevent attackers from using domain-control validation for certificate issuance through misdirection. Using issuing restrictions and validation method restrictions can prevent attackers from using certificates’ domain validation through cached entries. These protections are only effective after the control of the domain is re-established.  Chrome announced its intent to keep working on long-term projects to improve security and reduce the risks associated with the use of certificates. The proposed changes include shortening the lifespan of certificates and limiting the re-use of domain validation. They will continue to work to improve the Chrome Root Program with the Chrome Quantum-resistant Root Program as the Chrome ecosystem seeks to mitigate the risks posed by DNS and routing compromises.

A suspected member of the Qilin ransomware group has been arrested in Japan and extradited to Germany, where he is expected to face charges related to cyberattacks and ransomware extortion. The case is important as it reveals a growing international effort to identify and prosecute individuals involved in major ransomware operations. According to a report by SecurityWeek, the suspect is a 28-year-old Russian national who was arrested in Osaka, Japan, in May 2026. German authorities accuse him of playing a role in the Qilin ransomware operation, which has targeted organizations in several countries. The suspect was extradited to Germany on October 2, 2026, following legal proceedings in Japan. German investigators allege that he was involved in an attack against a logistics company in September 2024. Ransomware attack Investigators say the targeted logistics company had its computer systems encrypted during the attack. The attackers allegedly demanded more than $160,000 in cryptocurrency in exchange for restoring access to the affected systems. The incident is believed to have been connected to the Qilin ransomware operation, also known as Agenda. Qilin emerged as a ransomware-as-a-service (RaaS) operation in 2022. Under this model, ransomware developers provide malware and infrastructure to affiliates, who conduct attacks against victims and share the proceeds with the operators. This business model has allowed ransomware groups to expand their operations without every attacker needing to develop their own malware or infrastructure. Qilin's global activity Qilin has become one of the more active ransomware groups in recent years. It has targeted organizations across different industries, including healthcare, manufacturing, professional services and other critical sectors. The group attracted international attention after attacks linked to it disrupted healthcare services in the United Kingdom. It was associated with the 2024 attack against Synnovis, a medical services provider whose systems were used by several London hospitals. The incident caused significant disruption to healthcare operations. Qilin has also been linked to attacks against major companies in other countries, demonstrating the international reach of the ransomware operation. Experts have continued to track the group's activities and techniques. In 2026, Qilin was also reported to have exploited a critical vulnerability affecting Check Point security products as part of its attack activity.

  A security feature designed to make AI text traceable appears to have an unintended side effect: it can change how a language model behaves, in some cases making it more willing to follow instructions it was built to refuse. That is the core finding from new research by Lasso Security, published on September 17 by researcher Andrea Siposova under the title "The Provenance Tax: Understanding the Impact of LLM Watermarking on AI Agent Behavior." The study tested Google DeepMind's SynthID-Text watermarking system across six open-weight language models and found that enabling watermarking changed how those models responded to harmful requests, particularly when attackers used prompt-injection techniques designed to override a model's instructions. What SynthID-Text Actually Does To understand why that matters, it helps to understand what SynthID-Text actually changes inside a model. When a language model generates text, it does not write the way a human does. It builds sentences one token at a time, each step producing a probability distribution over thousands of possible next tokens and then sampling from that distribution. SynthID-Text does not attach a label to the finished output or hide characters in whitespace. It intervenes at the sampling step itself. The system uses a process called tournament sampling, first described in a 2024 Nature paper by Google DeepMind researchers Sumanth Dathathri, Abigail See, and colleagues. Instead of the standard randomness used in token selection, the watermark substitutes pseudorandom values generated from a secret key and the context of tokens already produced. The result is a statistically detectable pattern woven through the text at the level of individual word choices, invisible to readers but recoverable by anyone holding the key. The technique is refined enough that it does not degrade text quality in any measurable way, which is a large part of what made it attractive as a compliance tool. The Regulatory Push Behind It Article 50 of the EU AI Act requires providers of generative AI systems to mark their text, image, audio, and video outputs in a way that is machine-readable and detectable as AI-generated. The Code of Practice the European Commission finalized on July 20, 2026, requires at least two marking layers for audio, images and video, plus watermarking of free-form text longer than 200 tokens. Google signed the Code on July 24, 2026, citing SynthID partnerships as its route to the interoperable detection requirement due on February 2, 2027. Anthropic's technical implementation is built directly on SynthID-Text, the same tournament-sampling mechanism from the Nature paper, adapted for their own models and keys. It covers claude.ai, the API, Claude Code, Claude Cowork, Claude Tag, and access through AWS, Google Cloud, and Microsoft Foundry. With the industry's largest players now committed to the same watermarking standard, Siposova's findings arrive at an uncomfortable moment. What the Research Found Siposova ran paired experiments on six open-weight models using Hugging Face's unmodified SynthIDTextWatermarkLogitsProcessor, enabling and disabling watermarking while keeping the seed, batch composition, and ordering identical. Watermarking changed refusal behavior on harmful requests, but the effect was more pronounced when the same requests were paired with prompt-injection techniques. Under those conditions, several watermarked models complied with harmful requests their unwatermarked versions had rejected, with the strongest differences appearing in prompt-injection scenarios. Siposova told Ars Technica that behavior was clearly different compared with the same model without watermarking, and that the differences were especially pronounced under adversarial conditions or when running an agent calling tools. She put it plainly: "Watermarking is made to not be perceptible to a reader, but we know that when we are changing anything about what the model is generating, it is going to cause some tradeoffs, it's going to show up somewhere." Lasso repeated its prompt-injection experiment using 11 different watermark keys and found that changing the key could change both the size and direction of the effect. That means two different deployments of the same watermarking system, on the same model, could produce different safety outcomes depending purely on which key was chosen. The Agent Problem The consequences extend beyond what a model says. When a language model powers an AI agent, token selection can determine which tool an agent invokes and which arguments it passes. "Such a watermarking procedure can therefore affect both what the model says and what an agent does," the study stated. Watermarking reduced accuracy on six of seven models, with a substantial decrease on four. Lasso's conclusions are deliberately careful. The study did not verify how Claude model responses change when watermarking is applied, and critics noted the experiment only validated the SynthID-Text tournament sampling implemented by Hugging Face, which differs from how the Claude model would actually implement it. Siposova stressed that the findings describe patterns in the tested sample, not universal rules about watermarking as a category. Lasso recommended repeating agent evaluations and red-team testing when watermarking or its configuration changes, particularly under adversarial inputs. The research surfaces a tension that will only sharpen as regulatory deadlines close in. Watermarking was designed to answer the question of where AI text comes from. What it can also do, under the right adversarial conditions, is change what the AI decides to do next.

 A former employee of a New Jersey-based industrial company has been sentenced to 32 months in federal prison for launching a computer network attack and attempting to extort his former employer. Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced by U.S. District Judge Michael A. Shipp on September 28, 2026, at federal court in Trenton, New Jersey. The sentence followed his guilty plea to charges involving extortion through a threat to damage a protected computer and intentional damage to a protected computer.  According to court documents and statements made during the proceedings, Rhyne previously worked as a core infrastructure engineer for the U.S.-based industrial company, identified in court records as Victim-1. While he was living in New Jersey in November 2023, he allegedly began preparing a plan to disrupt the company’s computer network and force it to pay a ransom. His position reportedly gave him technical knowledge and access that allowed him to plan the attack against the company’s critical systems.  As part of the scheme, Rhyne initiated unauthorized remote desktop sessions and scheduled tasks designed to damage the company’s network. The planned actions included deleting network administrator accounts, changing passwords linked to other employee accounts and shutting down several company servers. These steps could have seriously disrupted business operations by preventing authorized staff from accessing systems and interrupting essential digital services.  On November 25, 2023, Rhyne sent an extortion email to employees of the industrial company. In the message, he threatened to continue shutting down servers unless the company paid approximately 20 bitcoin. At the time, the cryptocurrency demand was valued at about $750,000. The case highlights how former employees with detailed knowledge of internal infrastructure can pose a significant cybersecurity risk, especially when access controls and administrative privileges are not promptly reviewed after employment ends.  The investigation was conducted by special agents from the FBI’s Newark Field Office, with assistance from the FBI’s Kansas City Field Office. U.S. Attorney Robert Frazer announced the sentence, while Assistant U.S. Attorney Taj Moore of the Cybercrime Unit prosecuted the case. The conviction demonstrates that unauthorized access, deliberate disruption of computer networks and ransom demands can result in substantial federal prison sentences. It also underlines the importance of removing former employees’ access, monitoring remote sessions and protecting administrator accounts against misuse.

 A long-running malware campaign on the npm registry is using malicious JavaScript packages to compromise Windows systems with remote-access malware, information stealers and additional payloads. Researchers have linked the operation, known as MALFEX, to an apparent single operator active on npm since August 2023.  The operator has published 12 packages, eight of which were found to contain malicious code. Together, the packages had recorded 40,767 downloads by October 1. However, those figures represent package downloads rather than confirmed infections. MALFEX currently uses three separate infection chains. The first delivers the Overlord Remote Access Trojan through packages including tlxbnhd, tldriver and mxdriver.  Malicious installation scripts download and execute a Windows payload disguised as an image. Overlord can capture screenshots, keystrokes and clipboard data, search files and provide attackers with remote shell access. It also establishes persistence through a scheduled Windows task named “Maiden.” A second chain involves native-runner, img-to-native and cdn-img-fetch.  Instead of relying on an npm installation script, the malicious code executes when the package is loaded. Data hidden inside an image is decrypted to produce a downloader, which retrieves movinlike, a Node.js information stealer. The malware targets Discord accounts, browser credentials, Telegram session data and cryptocurrency wallets before sending stolen information to an attacker-controlled Discord webhook.  The third and longest-running chain revolves around function-flag. Its malicious versions contain code that downloads Windows executables from changing external locations. In version 1.7.3, a hidden routine triggered during installation downloads node.exe and executes it from the user’s application-data directory. function-color serves as a wrapper that installs function-flag.  Three malicious packages remained installable as of September 29: function-flag, function-color and cdn-img-fetch. function-flag accounted for 37,419 downloads, making it by far the most widely downloaded package in the campaign. Despite that activity, it had no security advisory. function-color also lacked an advisory, while the advisory for cdn-img-fetch covered only versions 1.0.0 and 1.0.1, leaving malicious versions 1.0.2 and 1.0.3 outside its coverage.  The campaign also uses several techniques to make detection harder. Malicious code can be hidden beyond the visible area of a typical editor, failed downloads may be suppressed without generating installation errors, and the attacker has published benign packages alongside the malicious ones. Security teams should block all eight identified malicious packages and check dependency trees and lockfiles for them.  Any Windows system where one was installed should be treated as potentially compromised, isolated from the network and investigated. Organizations should also remove persistence mechanisms and rotate credentials from a clean device if sensitive accounts were used on the affected machine.  MALFEX highlights the risk of relying solely on npm advisory feeds: malicious packages can remain installable even when related packages have been removed, while some dangerous versions may have no advisory coverage at all.

One of the Journal reported that US authorities are investigating a possible Iranian connection to cyberattacks targeting two energy tankers in August heading toward American ports. A number of vessels were attacked as they passed through the Strait of Gibraltar before proceeding towards Texas. These vessels were the oil tanker VL Prosperity and the liquefied petroleum gas carrier Kohaku which were targeted.  At the time of the incident, the VL Prosperity was transporting more than two million barrels of oil from Egypt to Galveston, Texas. The Kohaku was also on its way to Texas where it was scheduled to load liquefied petroleum gas. Following the arrival of the vessels in the Gulf of Mexico, a specially trained cyber response team led by FBI personnel boarded both.  The Coast Guard conducted several days of assessments of the incidents and checked to ensure that the vessels could continue operating safely after they discovered signs of a compromise of their information technology and operational systems. According to reports published in August, hackers gained access to the engine-room systems of the VL Prosperity and interfered with several engine functions, including cooling, speed, fuel, and engine oil.  There was no claim of responsibility from any group, and the reported details were unable to be independently verified. Later on, the vessel's manager confirmed that US authorities examined the tanker's cybersecurity before clearing it for normal operations. This incident illustrates the risks associated with interconnected systems that are used aboard modern commercial vessels.  As a result of the integration of information technology with propulsion, navigation, and engineering systems on board, it may be difficult for a successful intrusion to affect the vessel's physical performance. Neither incident has disrupted operational operations, caused harm to crews, or damaged the environment, and no attribution of these attacks has been made public to Iran.  Additionally, the investigation takes place in the context of increased suspicions of Iranian-linked cyber activity by US agencies. A maritime security expert has warned that it may be difficult to determine the actual extent of attacks against shipping, especially when vessel operators restore systems quickly without thoroughly investigating how an intrusion occurred.  According to Lloyd's List, US agencies are monitoring cyber threats involving almost 20 ships worldwide, which raises concerns over the growing vulnerability of commercial shipping. The risks extend beyond individual ships as well. Navigating, propulsion, steering, and other critical operations of commercial vessels are increasingly dependent on connected digital systems. The compromise of these systems could negatively impact a vessel’s movements or create broader difficulties around major shipping routes and ports.  A serious disruption could result in a fire, explosion, or spill. An investigation of the tanker is also underway as key maritime routes are becoming increasingly congested. It is important to note that the crossing of the Strait of Hormuz has been repeatedly disrupted and attacked during the conflict, while Iran-backed Houthi forces have exerted increased pressure on vessels operating around the Red Sea and Bab al-Mandab Strait.  Since cyberattacks could take place against vessels traveling outside these traditional conflict zones, maritime security concerns have been intensified. US authorities have not yet established that Iran was responsible for the attacks. There has also been no determination as to whether the attacks were connected to each other. Further investigations by the FBI and Coast Guard may clarify whether the attacks were isolated incidents or part of a broader campaign targeted at maritime infrastructure.

Japanese media company Nikkei has disclosed two separate cyber incidents involving employee accounts on Microsoft 365 and Google Workspace. One of the incidents allowed attackers to use an employee's account to send about 9,000 phishing emails, while the other may have exposed the personal information of 1,646 employees and business partners. The incidents were disclosed on October 4 and reveal the risks organizations face when attackers gain access to legitimate employee accounts. Nikkei has not attributed either incident to a specific hacking group or confirmed whether the two attacks were connected.  Microsoft 365 account used to send phishing mails The more recent incident involved an employee's Microsoft 365 account. According to Nikkei, attackers gained unauthorized access to the account and used it on September 30 to send approximately 9,000 emails. The messages were sent to people both inside and outside the company. Some recipients were journalistic sources and other individuals who had previously communicated with Nikkei employees. The emails contained links leading to malicious websites. Because the messages were sent from a legitimate Nikkei employee account, recipients could have been more likely to trust them. This type of account compromise can allow attackers to use an organization's existing relationships to distribute phishing messages. Nikkei said the incident may have exposed recipients' names and email addresses, along with the contents of some emails. The company is still investigating the number of people whose personal information may have been affected. According to Nikkei, “There may be an increase in emails impersonating Nikkei employees or our group companies,” Google workspace breach Nikkei also disclosed a separate incident involving an employee's Google Workspace account. The account was accessed without authorization beginning in late July. The company discovered the intrusion in early August after receiving an alert from Google. Nikkei then changed the account's password and said it has not detected any further unauthorized access. The incident may have exposed information belonging to 1,646 employees and business partners. The potentially affected information included names and email addresses. Nikkei said the exposed information did not include data related to its readers or journalistic sources. The company also said it has found no evidence that the information was misused.  Nikkei’s response After the Microsoft 365 incident, Nikkei changed the affected password and contacted recipients of the phishing emails, asking them to delete the messages. The company warned that additional emails impersonating Nikkei employees or its group companies could appear. Nikkei has also reported the incidents to Japan's data protection authority. Investigations into the scope of the Microsoft 365 compromise and the information potentially exposed are continuing. Nikkei has experienced other cybersecurity incidents in recent years. In November 2025, the company disclosed a malware-related credential theft incident that potentially exposed information connected to more than 17,000 employees and business partners. 

Apple has announced plans to overhaul one of macOS's most powerful privacy settings, citing security risks posed by AI agents that have been using it to access user data in ways most people never anticipated. The setting, Full Disk Access, lives inside Privacy & Security in macOS Settings and was introduced with macOS Mojave (version 10.14). It gives users control over which applications can read system-level data, including files, Mail, Messages, Safari history, and Time Machine backups. Security tools and backup software rely on it legitimately. The problem is that once granted, an application can bypass many of the protections Apple built to keep sensitive data off-limits to third parties. Apple warned in a developer advisory that some developers are using Full Disk Access to expose everything on a user's system without their full knowledge, and that for communication apps this also compromises the privacy of the people those users are messaging. The company said it plans to update the setting so access can only be granted through an explicit user action, and that as AI agents grow more capable and autonomous, the risks tied to this level of access will only increase. When the new controls will arrive has not been said. The announcement follows a controversy involving Meta's personal AI agent, Muse. When the app launched on September 8, Inc. columnist Jason Aten installed it and says he explicitly declined to give it access to his Messages, calendar, or personal data. Despite that, Muse pitched him a column idea drawn from a private text exchange with his podcast co-host. Aten says Full Disk Access was disabled on his machine, yet the agent had synced more than 187,000 rows of his private iMessages to Meta's cloud. When he asked Muse directly how it read those conversations, the agent told him the paired Mac app was only relaying notification previews, an explanation that turned out to be false. Meta's David Singleton later called it a fabricated account of the feature. Meta disputed the broader account. Singleton and communications head Andy Stone both argued that reading Messages requires two separate permissions: Full Disk Access must be active in macOS, and the Messages connector within Muse must also be switched on. Singleton said that without Full Disk Access, all related options are greyed out and the feature does not work. Whether that permission was ever active on Aten's Mac is something the two sides still disagree on. What the episode made clear, regardless of how that specific question gets resolved, is exactly the scenario Apple is now trying to prevent: AI agents accumulating sweeping system permissions that users did not fully understand they had handed over. The problem extends beyond confusing permission dialogs. On September 21, security researcher Patrick Wardle, founder of the Objective-See Foundation, published a zero-day flaw in Muse's Mac app before Meta had a patch ready, accompanied by a working proof of concept called "not-a-mused." The flaw centered on an undocumented configuration setting called "endo_voyager_dictation_endpoint" that any unprivileged local process could overwrite without admin rights and without triggering macOS security prompts. An attacker who had already landed on the machine could use it to redirect Muse's dictation traffic, capture audio and prompts, inject malicious instructions, and take advantage of every permission the agent held, covering files, microphone, camera, calendar, location data, and linked iOS devices. Wardle's proof of concept demonstrated over 50 commands being executed through the compromised agent. Meta deployed a patch within 24 hours of disclosure, but Wardle argued that a ClickFix-style attack could have made the exploit remote, giving attackers access to any device running Muse, not just machines they had already penetrated by other means. He described Muse's extensive system permissions as making it trivial to turn the agent into a ready-made backdoor. Wardle also separately reported a flaw in OpenAI's ChatGPT Mac app, tracked as CVE-2026-100754, that could have let attackers take over the assistant and access chat logs and other stored data. He described the exploit as insanely trivial, requiring roughly a dozen lines of code, and noted it could also be used to get ChatGPT to run commands on an attacker's behalf, with the requests appearing as legitimate instructions from the OpenAI software. OpenAI has since patched it. Wardle has said he will present analysis of multiple AI macOS application vulnerabilities at Objective by the Sea, an Apple-focused security conference in November, and has already submitted a further finding to OpenAI related to the integration between ChatGPT and the company's always-on Dots AI assistant. The pattern across all three incidents points to a structural problem the industry has not resolved. AI agents need deep system access to function, and that same access makes them attractive targets. "AI companies are fixated on adding features right now," Wardle said, and the permission frameworks macOS relies on were not designed with always-running, autonomous agents in mind. Apple's planned changes to Full Disk Access are an attempt to close that gap, though what those controls will actually look like when they ship remains unknown.