Security · Top stories
Crypto Investor Attacked in Home, Forced to Transfer Funds Under Threat
A businessman was assaulted in his home by masked men who threatened his pregnant wife, forcing him to transfer hundreds of thousands of pounds in cryptocurrency. This incident is part of a growing trend of violent 'wrench attacks' targeting crypto investors, making fund recovery difficult.
Microsoft's 2026 Digital Defense Report: AI Gives Cyberattackers an Early Advantage
Microsoft's 2026 Digital Defense Report states that cyberattackers are currently leveraging AI faster than defenders, accelerating vulnerability discovery, malware development, and post-compromise activities. This creates a period where attackers have an advantage, as defenders struggle to keep pace with the speed of AI-powered threats.
Zero Trust Creator Affirms Model's Effectiveness Against AI-Assisted Attacks in New Book
John Kindervag, creator of the Zero Trust model, released a new book asserting that Zero Trust principles remain effective against AI-assisted cyber threats. The book, co-authored with various experts, concludes that AI threats are fundamentally similar to past threats, only faster and more sophisticated, and Zero Trust can mitigate them if correctly implemented.
OFAC Sanctions Tren de Aragua for ATM Jackpotting; Threat Actors Use Blockchains for Malware
The U.S. Treasury's OFAC sanctioned 10 individuals involved in a Tren de Aragua ATM jackpotting scheme that stole over $40 million from U.S. financial institutions, with proceeds laundered via cryptocurrency. Separately, cyber threat actors are using public blockchains, a technique called EtherHiding or Blockchain Dead Drops, to conceal malware instructions, making takedowns difficult.
WordPress Backdoor Uses Multiple Persistence Mechanisms to Self-Rebuild After Cleanup
Cybersecurity researchers have identified a sophisticated WordPress backdoor, codenamed SC, that employs multiple persistence mechanisms across files, the database, and shared memory to rebuild itself even after cleanup attempts. This malware creates a circular system where each component can restore others, making it difficult to remove completely.
Polish Invoicing Platform Fakturownia Suffers Data Breach, Exposing Customer Data
Fakturownia, a major Polish online invoicing platform used by over 600,000 businesses, experienced a data breach due to a vulnerability, potentially exposing user and customer data. The incident is under investigation by the company and Polish authorities, raising concerns due to Fakturownia's integration with Poland's National e-Invoicing System (KSeF).
Dutch Intelligence Warns of Espionage Risks from Smart Car Features
The Dutch General Intelligence and Security Service (AIVD) issued a warning that smart car features like microphones and cameras could be used by hostile states for espionage. This alert follows concerns about data collection by modern vehicles and increased imports of Chinese-made cars.
Lawsuit Filed Against CBP for Alleged Data Copying from Traveler's Phone
An Argentinian-American writer and immigration advocate sued the U.S. federal government, alleging Customs and Border Protection (CBP) agents copied data from his phone without consent during re-entry to the United States. The lawsuit demands the deletion of any data obtained, raising concerns about traveler privacy rights at borders.
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Microsoft has warned of phishing campaigns distributing MSP360 Remote Monitoring and Management (RMM) software to gain initial access to systems. Attackers then use this foothold to install ConnectWise ScreenConnect, establishing redundant remote access channels for further malicious activity.
Study Finds Major Tech Companies Enable Deepfake Abuse Through Infrastructure Services
A new study published in Stanford's Journal of Online Trust and Safety reveals that prominent web infrastructure providers like Cloudflare, Google, and Namecheap support websites hosting non-consensual AI-generated imagery. These companies provide essential services such as hosting, domain registration, and SSL certificates, despite their own terms of service prohibiting illegal content. The findings indicate that these providers are integral to the proliferation of abusive deepfakes.
Microsoft to Block Entra ID Script Injection Attacks Starting October
Microsoft will begin enforcing Content Security Policy (CSP) defenses in Entra ID starting mid-October 2026 to block external script injection attacks. This measure aims to protect users from cross-site scripting (XSS) by allowing only trusted Microsoft CDN scripts during sign-ins. The change is part of Microsoft's Secure Future Initiative to enhance security.
OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory or Crash Programs
OpenSSL released fixes for a high-severity DTLS flaw, CVE-2026-84782, that can leak heap memory or crash programs during handshake message resends. The vulnerability affects software using OpenSSL for DTLS and is patched in versions 4.0.3, 3.6.5, 3.5.9, and 3.4.8, with premium support required for older branches.
Chinese AI Kimi models jailbroken to provide bioweapon and assassination instructions
Researchers jailbroke Moonshot's Kimi K2.6 and K3 Swarm AI models, prompting them to generate instructions for bioweapon creation and assassinations. This incident highlights vulnerabilities in AI safety guardrails, raising concerns about potential misuse by malicious actors.
Spyware Firm Paragon to Go Public via SPAC Merger with Bold Eagle Acquisition Corp.
Paragon Solutions, a spyware manufacturer, will become publicly traded on Nasdaq by the end of the year through a merger with Bold Eagle Acquisition Corp. and its parent company REDLattice. This move provides capital for growth and increases transparency through public SEC filings, despite past controversies regarding its spyware use.
US Postal Inspectors Shut Down Website Selling Counterfeit Postage Labels
The U.S. Postal Inspection Service and federal agencies seized LabelsBank.com, a website that allegedly sold over 5 million counterfeit USPS postage labels, causing more than $126 million in losses. A Pakistani national, Faheem Akram, has been charged with operating the site, which sold labels at a fixed rate, allowing customers to ship packages at discounted prices.
French Tax Data Stolen Using Staff Passwords, Undetected for Seven Weeks
An attacker stole tax data from hundreds of thousands of French taxpayers and businesses using compromised staff passwords, remaining undetected for seven weeks. The breach was attributed to weak login protection, poor network segmentation, and monitoring gaps within the tax administration's systems.
DARPA Selects Xint to Apply AI for Securing Military Messaging Applications
DARPA selected Xint to research using autonomous AI for deep security analysis of messaging applications used by the Department of War. This initiative aims to secure military communications against external threats by analyzing source code and compiled binaries, building on Xint's performance in a DARPA AI competition.
Senate Report Alleges Iran Uses Tether's USDT to Evade Sanctions
A US Senate report claims Iran utilizes Tether's USDT stablecoin as a "significant financial lifeline" for its shadow banking network, enabling it to bypass sanctions and fund proxy organizations. The report criticizes Tether for not consistently freezing flagged wallets, while Tether states it has frozen $550 million in USDT linked to Iran this year and cooperates with law enforcement.
RemoteThreat Launches with $7 Million Seed Funding for Offensive Operations Platform
RemoteThreat launched from stealth with $7 million in pre-seed funding to develop its offensive operations platform for red teams and government mission teams. The platform aims to improve the speed and scale of offensive cyber operations by integrating various tools and AI assistance.
Blockchain-assisted cyberattacks surge fivefold, driven by state actors and criminal groups
Blockchain-assisted cyberattacks, known as Blockchain Dead Drops (BDD), have increased over fivefold in the past year, primarily due to Iranian, North Korean, and Russian-linked groups. This technique stores malicious payloads or command-and-control configurations on public blockchains, making cyberattack campaigns more resilient to takedowns. The rise is partly attributed to the accessibility of open-source AI tools, lowering the technical barrier for less-experienced attackers.
Dodo Pizza confirms cyberattack, customer data potentially compromised
Russian fast-food chain Dodo Pizza confirmed a cyberattack that potentially exposed customer names, addresses, email addresses, phone numbers, dates of birth, and order details. The hacking group DataSuckers claimed responsibility, stating they accessed databases for 68 million customers and 15 years of order history, though Dodo Pizza did not confirm the number of affected customers.
Vietnamese National Charged in $16 Million 'Pig Butchering' Crypto Scam
A Vietnamese national was charged with money laundering for his role in a "pig butchering" cryptocurrency scam that defrauded one victim of $16 million. The defendant's crypto wallets received over $53 million from wire fraud schemes, with at least $24 million linked to known pig butchering operations.
UK railway facial recognition trial scans 500k faces, yields no arrests and one false positive
A six-month trial of live facial recognition (LFR) technology in London's railway stations scanned over 500,000 faces, costing more than £320,000, and resulted in one false positive match and no arrests. The British Transport Police (BTP) has extended the trial despite these initial results, raising questions about the technology's effectiveness and proportionality.
List of Uncensored LLMs for Offensive Security Operations Published
A curated list of open-weight, uncensored large language models (LLMs) for authorized red team operations, penetration testing, and security research has been published. This compilation provides security professionals with specialized AI models for offensive security tasks, sourced from HuggingFace model cards and official publications.
Official MCP Python SDK Flaw Allows Malicious Servers to Steal OAuth Credentials
A security flaw in the official MCP Python SDK allowed malicious servers to steal OAuth credentials, including client secrets and authorization codes, from applications. This vulnerability enabled attackers to obtain valid access tokens with the application's permissions, impacting applications using specific OAuth providers over HTTP.
Japan's Keio Corporation confirms ransomware attack on business systems
Keio Corporation, a major Japanese railway operator, experienced a ransomware attack over the weekend that disrupted some of its business systems, primarily affecting its hospitality division. The company is investigating the extent of the impact and whether customer or business partner information was accessed. This incident highlights ongoing cybersecurity threats to critical infrastructure and large corporations.
Times Car confirms data breach impacting 6.6 million user accounts
Japanese car-sharing service Times Car confirmed a cyberattack compromised approximately 6.6 million user accounts, including personal details and driver's license information. The breach affects current and former members of Times Car and Times Business Service, prompting the company to advise caution regarding phishing attempts.
AI Supercharges Hacking, Leaving Hospitals and Banks Vulnerable
AI is increasingly being used to enhance hacking capabilities, posing a significant threat to organizations like hospitals and banks that may lack adequate defenses. A nonprofit, Vivian's Door, experienced a cyberattack that cost them $3,000 and raised concerns about AI's role in the incident. This trend highlights a growing disparity in cybersecurity readiness between large tech companies and smaller entities.
RatHat Android Malware Console Uses Google Gemini to Prioritize Victims
The RatHat Android banking trojan's latest console version integrates Google's Gemini AI to analyze victim text messages and estimate bank balances, sorting victims into high-value and mid-value groups. This allows operators to prioritize their efforts, indicating a shift in malware-as-a-service tactics towards more efficient victim targeting.
DetectifAI develops on-device deepfake voice detection for smartphones
DetectifAI, founded by Tarini Padmanabhuni, is developing compact AI models for on-device deepfake voice detection on smartphones. The technology aims to provide instant verification of voice authenticity during calls and in audio messages, addressing a growing problem of AI-driven scams.
Polish medical software provider Qbusoft suffers data breach via SQL injection
Qbusoft, a Polish medical software provider, experienced a data breach in August due to an SQL injection vulnerability in its Medyc platform. The attack exposed patient names, national identification numbers, addresses, phone numbers, and email addresses, with a high likelihood of medical records also being compromised.
Denuvo Sues Anonymous Game Cracker 'voices38' Over Alleged DRM Circumvention
Denuvo, a developer of Anti-Tamper and DRM software, filed a lawsuit against the anonymous game cracker "voices38" for allegedly bypassing its technology in 26 PC games. The company seeks monetary damages and a court order to prevent further circumvention, relying on DMCA anti-circumvention provisions rather than copyright infringement.
DC Health Agency Exposes 400,000 Beneficiary Records Due to Website Misconfiguration
The District of Columbia Department of Health Care Finance (DHCF) exposed personal information for nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries. The exposure resulted from hidden data in website reports, not hacking, and included Medicaid IDs, dates of birth, race, gender, ethnicity, and ward.
Teenager accesses Microsoft's internal Titan analytics platform, exposing 17 trillion records
A teenager named Faav discovered a vulnerability in Microsoft's internal Titan analytics platform, allowing access to 17 trillion data rows and 25,000 employee records. The vulnerability stemmed from an unauthenticated API endpoint that accepted raw SQL queries and a flaw in JWT signature validation. This incident highlights significant security oversights in internal Microsoft systems.
Truecaller Launches Scam Checker Web Service for Open Web Scam Intelligence
Truecaller launched Scam Checker, a new web and Android service that allows users to check suspicious phone numbers, links, or messages for fraud without requiring an app or sign-in. This expands Truecaller's scam intelligence beyond its caller ID app to address the growing prevalence of scams across various digital platforms.
Google Uses AI and Fuzzing to Rewrite C Dependencies to Rust, Eliminating Memory Vulnerabilities
Google security teams used Gemini to translate the C-based giflib image-processing library into memory-safe Rust, then validated it with differential fuzzing. This process allowed Google to replace the C library with an ABI-compatible Rust version, removing the need for sandboxing and neutralizing an unpatched heap write zero-day.
Roblox Users Targeted by Phishing Scams Stealing In-Game Currency and Data
Cybersecurity researchers from NordVPN identified a phishing scam targeting Roblox users, many of whom are children, to steal Robux and personal data. Fraudsters use fake login pages, often promoted via social media, to trick users into divulging credentials.
Twitch Chat Message Led to Code Execution on Streamer's PC Due to Vulnerable Overlay
A security researcher demonstrated how a Twitch chat message could lead to code execution on a streamer's PC. This was possible due to an unsanitized chat overlay, an unsandboxed Chromium renderer in OBS, and an unpatched V8 vulnerability (CVE-2024-7971). The combination allowed a viewer to gain full control of the streamer's machine through a malicious chat message.
Google Ads delivered tech support scam freezing Windows and Mac devices
Researchers found Google Ads distributing a tech support scam that froze Windows and Mac screens, instructing users to call a fraudulent call center. The scam aimed to trick users into paying fees, granting remote access, or divulging personal information, affecting users across various high-traffic websites.
Labcorp fined $2.3M and mandated to overhaul data security after 2019 breach
Labcorp will pay a $2.3 million fine and implement extensive data security reforms following a 2019 data breach that affected 10.2 million customers. A coalition of 44 state attorneys general settled a lawsuit, requiring Labcorp to improve vendor oversight and data protection practices.