Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

zero click
AdFection Advertisements Al Jazeera browser cookie COM hijacking Data Breach Digital Ads IABs IP Address zero click

Israeli Ad Firm Built a Spyware Pipeline Inside the Online Advertising System, Researchers Say

 



An Israeli advertising company quietly turned the infrastructure of targeted digital ads into a delivery mechanism for mercenary spyware, according to new research from the Citizen Lab at the University of Toronto. The findings, published October 15, represent the first publicly confirmed case of zero-click government-grade spyware delivered through online advertising.

The company at the center of the report is Discover-Tech, registered in Israel and run by CEO Dekel Boni. On its surface, Discover-Tech operated like any other demand-side advertising platform, placing bids across major ad exchanges and running campaigns through networks including Google, Yandex, Liftoff and Comcast's Beeswax. Underneath that veneer sat a second product entirely: a targeting tool called Controlium that, researchers say, was designed to push malicious code to specific individuals based on their device ID, browser cookie, or IP address.

The mechanism is what makes this case technically significant. When a user's device connected to the ad infrastructure and matched an attacker's target list, Discover-Tech's "NOAS server" would return a fragment of JavaScript rather than an ordinary ad. If the device was not a target, the server returned nothing at all, which helped conceal the malicious activity from the ad vendors relaying the traffic. The user never clicks anything. The ad impression itself is the attack.

Citizen Lab researchers call this technique AdFection.


Al Jazeera

Between 2024 and 2025, at least 45 Windows devices at Al Jazeera were compromised this way. Researchers attribute the attacks with high confidence to Candiru spyware, now rebranded as Integrity Labs. The technical trail includes a Windows DLL recovered from a compromised machine that hard-coded command-and-control servers bearing a fingerprint consistent with Candiru's known infrastructure, along with a 48-byte repeating XOR encryption key and a persistence method, COM hijacking, matching Candiru's attack chain from 2021.

Researchers traced the full infection sequence: an ad impression served through Discover-Tech's infrastructure, contact with a Candiru validator server, and then with a Candiru command-and-control server. The governments behind the targeting remain unidentified.


Who was behind Discover-Tech

The research places Discover-Tech in a web of relationships with the commercial spyware sector. Eric Banoun, whom the Israeli newspaper Haaretz has described as one of the pioneers of offensive cyber in Israel, served as a director at Discover-Tech from 2020 to 2025. He also held shares in Intelos, a firm that appears elsewhere in the report as an ADINT surveillance company with at least 15 linked users on the Controlium platform.

Between 2020 and March 2026, Discover-Tech shareholders included a company connected to Sara Hamou, whom researchers say managed the corporate network of Intellexa, the now-sanctioned consortium behind the Predator spyware.

A second spyware vendor, Bindecy, also used the Controlium platform. Researchers identified Bindecy operators in Belgium, Germany, Norway, Portugal, Sweden, Singapore, and Spain. The company did not respond to requests for comment.


What the data showed

Citizen Lab's analysis drew on roughly four billion bid records from an Apache Druid database instance that Discover-Tech left publicly accessible. Between March and June 2026, Discover-Tech's MyDSP platform bid on more than 3.7 billion ad impressions and won approximately 441 million. About 19 percent of those bids carried the NOAS script tags that power the spyware delivery system.

Ads bearing those script tags ran across 75,373 mobile apps and 120,768 websites. Researchers identified ad impressions on networks tied to NATO, the United Nations, the European Parliament, the European Commission, and government bodies in Norway, Sweden, Denmark, Australia, Israel, Czechia, and Italy. Separate findings by ad security firm Confiant, which worked in parallel with Citizen Lab, placed potentially malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court.

Citizen Lab was careful to note that an ad impression does not confirm a device was successfully compromised. The researchers are calling on regulators to investigate whether Discover-Tech and Integrity Labs violated applicable laws.


Industry response

Google and IAB Europe removed Discover-Tech from their vendor registries in early October 2026, ahead of the report's publication. Beeswax removed the company from its platform. Liftoff paused its access. Eskimi blocked its accounts and associated domains.

Discover-Tech did not respond to requests for comment. Integrity Labs could not be reached.

Bill Marczak, one of the Citizen Lab researchers who led the investigation, told TechCrunch that Discover-Tech is "surely just the tip of the iceberg" and advised people who believe they may be surveillance targets to disable ad tracking or use an ad blocker as a precaution.

The full report, co-authored by Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, and Ron Deibert, is available at Citizen Lab.



Read more »
OLVX
Cyber Crime Data Theft FBI North Macedonia OLVX

FBI and North Macedonia Arrest Alleged OLVX Market Operator

 

Authorities in North Macedonia have arrested and charged the alleged administrator of OLVX, an underground cybercrime marketplace accused of selling stolen personal data, login credentials, and tools used in cyberattacks. The operation was conducted jointly by North Macedonia’s Ministry of Interior and the U.S. Federal Bureau of Investigation (FBI), marking what officials describe as the first coordinated cyber operation between the two countries. The suspect, identified only by the initials E.A., is a 20-year-old man from Golema Rečica near Tetovo. 

According to investigators, OLVX operated from 2023 to 2025 and became a popular platform for criminals seeking access to compromised accounts and digital identities. The marketplace allegedly allowed more than 1,500 seller accounts to offer victims’ personally identifiable information and login credentials. Officials said the site also facilitated the sale of phishing kits, remote desktop access, stolen data, and other resources used to launch cybercrimes. 

The investigation began after the FBI supplied intelligence to North Macedonian authorities. Police later raided the suspect’s home and seized devices for forensic examination. Earlier action against the platform reportedly uncovered a server database containing more than 2,600 customer accounts, while illicit sales were estimated to have exceeded $500,000. The charges against E.A. include computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material.

Authorities also linked the suspect to ONEMILI, a Telegram group allegedly used to advertise software and services for cybercrime, including fraudulent refund schemes. The FBI said the marketplace directly endangered the digital security of thousands of people in the United States by making stolen account credentials and personal information available to criminals. The case underscores how underground platforms can connect data thieves, fraudsters, and attackers across borders. 

The arrest sends a strong signal that international law enforcement is increasingly targeting the infrastructure behind cybercrime rather than only individual attacks. It also highlights the importance of strong account security: users should enable multi-factor authentication, use unique passwords, avoid reusing credentials, and monitor accounts for unauthorized activity. While the charges remain allegations until tested in court, the takedown of OLVX represents a significant blow to a marketplace that allegedly enabled large-scale identity theft and fraud.
Read more »
IT Security
Cyber Security Department of Justice fake remote tech jobs identity Identity Theft IT Industry IT Security

US Charges 14 People in North Korean IT Worker Scheme Targeting More Than 70 Companies

 

The U.S. Department of Justice has announced coordinated enforcement actions targeting a North Korean operation that allegedly used stolen identities and fraudulent remote employment to generate money for the regime. The investigation has resulted in charges against 14 individuals, two arrests and the seizure of approximately 187 computer devices. Authorities also searched more than 40 suspected laptop farms across Texas. 

The operation allegedly enabled North Korean IT workers to secure remote jobs at more than 70 American companies, generating around $3 million in revenue. Investigators believe the money was transferred to sanctioned entities controlled by North Korea and may have supported its weapons programmes. 

In a case announced by the U.S. Attorney’s Office for the Northern District of Ohio, American nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under a four-count indictment involving wire fraud, money laundering and identity theft. The indictment also names several China-based individuals, including Sun Sheng Ming, Pei Li Guang and others, while two additional defendants remain unidentified under seal. 

According to prosecutors, the alleged scheme operated from 2019 until approximately July 2025. North Korean workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear to be Americans applying for jobs from within the United States. U.S.-based facilitators allegedly received company-issued laptops at their homes, configured the devices, installed remote-access software and helped transfer earnings to accounts controlled by North Korea. The affected employers operated in sectors including healthcare, communications, cybersecurity support, retail and manufacturing. 

The companies were located across Ohio, 16 other states and the District of Columbia. Separately, the FBI carried out Operation Lonestar Roundup between September 21 and September 25, searching more than 40 residences in Texas suspected of hosting laptop farms. Investigators seized approximately 187 laptops and keyboard, video and mouse devices allegedly used to facilitate fraudulent employment and revenue generation. 

Cybersecurity company CrowdStrike has identified the network of North Korean workers and their helpers as “Famous Chollima.” Investigators also identified fraudulent email accounts allegedly linked to the activity. The FBI has urged employers to add these addresses to their screening indicators and published a new public service announcement outlining detection and prevention measures. 

Authorities warned that the schemes are evolving. North Korean workers are reportedly recruiting more American facilitators to evade improved corporate screening, assigning them additional responsibilities and, in some cases, subcontracting entire jobs to foreign nationals. The latest actions form part of the Justice Department and FBI’s DPRK RevGen: Domestic Enabler Initiative, which targets illicit revenue operations and the people supporting them inside the United States. 

Previous enforcement actions were announced in June and November 2025 and April and May 2026. Officials have repeatedly warned that these workers can also use their access to steal sensitive company information or carry out data extortion. A 2022 advisory from U.S. agencies stated that individual North Korean IT workers could earn as much as $300,000 annually, contributing to hundreds of millions of dollars in collective yearly revenue. 

The State Department has offered rewards of up to $5 million for information supporting efforts to disrupt North Korea’s illicit financial activities. The Justice Department stressed that the allegations in the court documents have not been proven. All defendants are presumed innocent unless found guilty in court.
Read more »
Telecom Regulations India
Caller Identification System Caller Name Display caller name presentation CNAP India DoT Caller ID Rules Phone Fraud Prevention Spam Call Prevention Technology Telecom Privacy Telecom Regulations India

India Mandates Caller Name Display on 4G and Newer Networks From November 1


The Department of Telecommunications (DoT) announced on October 13, 2026, that telecom operators would be required to display registered caller names alongside telephone numbers during incoming calls. 

In order to assist in identifying unknown callers and combating phone-based spam and fraud, the directive introduced mandatory Calling Name Presentation (CNAP), as introduced by the Department of Telecommunications (DoT) on October 13. Under these new rules, incoming calls will display the caller's name and telephone number, making identification easier. 

A particular application of this initiative is the impersonation phone scam, which involves fraudsters posing as bank officials, government representatives, delivery companies, or legitimate businesses. In the beginning, the CNAP system will cover wireless networks operating on 4G and newer technologies. Implementation of 2G and 3G networks, as well as traditional landline services, will be taken into account separately. 

How the Caller Name Display System Works

If the recipient does not save the name of an inbound caller in his or her phone contacts, the caller's name will be retrieved from the originating telecom operator's subscriber database. Calls originating outside of India will be tagged as an international call as per the prescribed guidelines. Telephone operators must maintain databases linking subscriber names to their telephone numbers in order to support the service.

While receiving an inbound call, the receiving operator will consult the originating operator's database to obtain the caller's registered identity and display it during the incoming call. In addition, operators are required to provide Calling Line Identification Restriction (CLIR), allowing subscribers to hide their caller identification when making calls. 

Although displaying a registered name could assist people in identifying suspicious calls, it does not imply that a caller is trustworthy. The perpetrators of fraud may still utilize social engineering and impersonation tactics in order to obtain sensitive information or persuade victims to make financial transactions. It will therefore remain vital to verify any unexpected requests from victims. 

Privacy Safeguards and Business Caller Identification

As a consequence of the DoT directive, telecom operators implementing CNAP are also required to adhere to security and privacy requirements. Providers must follow a security-by-design approach and ensure the caller name information is not retained after the end of an incoming call. 

As well as maintaining an efficient network, database, and connectivity infrastructure, identity queries must also be processed. According to the guidelines, telecom operators must establish grievance-redress mechanisms for complaints concerning their service, including instances where the recipient's screen does not display the correct name of the caller. 

To report such issues, consumers may contact their service providers. Businesses and users with bulk connections will also have the option of displaying a verified preferred name instead of the name used in their standard subscriber records. There must be a trademark corresponding to the name registered with the Trade Marks Registry or a trade name registered with the Goods and Services Tax (GST) portal. Telecom operators must verify the supporting documents before updating subscriber records. 

As part of the provision of existing connections, providers must establish an application process that allows eligible users to register their preferred names for registration. Incoming calls cannot contain unauthorised or misleading business identities due to this verification process. In addition, CNAP provides an exception for subscribers who have activated Calling Line Identification Restriction (CLIR) The caller identity will not be displayed by CNAP if this facility is activated. 

Earlier Trials and Network Limitations

Starting in November 2025, telecom operators began testing the service nationwide. In Haryana, Reliance Jio, Vodafone Idea, and Bharat Sanchar Nigam Limited (BSNL) tested the service, while Airtel tested it in Himachal Pradesh. Although the nationwide rollout was initially anticipated to commence in March 2026, it was not completed by that date across all operators. 

A late March announcement by BSNL indicated that the integration of private networks would take additional time to complete. Initially, the November mandate covers 4G and the latest wireless networks. Older 2G and 3G systems and fixed-line telephone service are not covered by the current rollout. Their inclusion will be reviewed separately. 

The CNAP system provides a secondary layer of caller identification, but its effectiveness will be determined by ensuring accurate subscriber records, ensuring secure implementation, and maintaining reliable network operations. Even though the service may be helpful in assessing unfamiliar calls, it cannot be used independently to avoid spam, impersonation, or financial fraud. Telecom-level identification will therefore continue to play an important role in efforts to reduce phone-based fraud.
Read more »
YAM store
cvv Cyber Fraud Fake Captcha Japanese police Malicious Emails Microsoft Phishing Technology YAM store

Microsoft and Japanese Police Dismantle Network Behind Over 1 Billion Phishing Messages

 




Microsoft and Japan's National Police Agency have jointly dismantled a phishing operation that sent more than 1 billion fraudulent emails and text messages to organizations across 150 countries since January 2026, with over 750 million of those messages directed specifically at Microsoft customers. The action was announced on Tuesday under an order from the U.S. District Court for the Southern District of Florida.

The operation brought together Microsoft's Digital Crimes Unit, the Japan Cybercrime Control Center, Health-ISAC, and private cybersecurity firms including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. The U.S. Secret Service also participated in the investigation.


The Marketplace

At the center of the operation sits YAM Store, which Microsoft internally tracks as Storm-3119. Investigators describe it as a Chinese-language underground marketplace that sold access to compromised Microsoft 365 and Google cloud environments, software licenses, storage space, and stolen credentials. Chinese-speaking actors are believed to have built the phishing kits it supported, according to Microsoft.

To stock the marketplace, operators bought up expired domains from defunct companies, rebuilt their websites to look active, and used those fake identities to register new cloud accounts. Some went further and built fake companies from scratch, using AI-generated documents, images, and business content to pass verification checks. Once inside Microsoft environments, attackers used stolen application credentials to manage accounts and abused SharePoint and OneDrive to store and deliver phishing content.


Three Phishing Kits

YAM Store operated alongside three phishing kits that Microsoft collectively tracks as Storm-2990: CoGUI, Haozi, and Iron Man. Each kit was rented out on a subscription model, letting operators with little technical background run large, automated fraud campaigns against targets worldwide.

Iron Man was the most developed of the three. Security firm Resecurity, which assisted in the investigation, found that the kit's infrastructure held 911 published build versions and roughly 2,360 phishing packages covering 130 countries and geographic areas, with the catalog receiving updates as recently as October 1, 2026. Its template library contained over 2,300 lure designs impersonating banks, retailers, delivery services, streaming platforms, and government agencies, including traffic and parking authorities. The kit also included a payment-card capture module that collected card numbers, expiry dates, and CVV codes from victims.

To block security researchers and automated scanners, the kits used geofencing, IP filtering lists, and fake CAPTCHA gates that stopped bots while letting real victims through. Operators also received real-time Telegram alerts whenever a victim entered credentials, and some ran live sessions to interact with victims as they responded to lures.

"Over 1 billion malicious email and SMS messages were sent since the start of 2026. More than 750 million of those were aimed directly at Microsoft customers." [Microsoft Digital Crimes Unit, October 2026]

Some campaigns also used device-code phishing, a technique that misuses Microsoft 365's standard device sign-in flow. Rather than stealing passwords directly, attackers tricked victims into entering a short device code, which gave them a valid login token and full access to the account. Microsoft has since recommended that organizations review whether device-code sign-in is necessary and consider restricting it through access policies.


The Takedown

The Florida court order gave Microsoft and Health-ISAC authority to seize and redirect the core domains behind YAM Store, CoGUI, and Iron Man. Microsoft deactivated more than 20,000 accounts linked to YAM Store and blocked over 100,000 domains used for impersonation and fraud. TRM Labs worked to trace and freeze cryptocurrency assets connected to the operation. Infrastructure removal was still continuing as of Tuesday.

Japan's National Police Agency had alerted Microsoft to the operation in late 2025, after a surge of fraud hit Japanese individuals and businesses. Japan ranked as the single most targeted country in the campaign, followed by the United States, Australia, and India. The healthcare sector, financial services companies, wholesale distributors, and IT firms absorbed the largest share of attacks.

No arrests have been announced.


What the wider pattern tells us 

The YAM Store action follows a March 2026 takedown of Tycoon 2FA, a separate phishing platform that Europol and Microsoft dismantled together with law enforcement from Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom. Tycoon 2FA used adversary-in-the-middle techniques to intercept login credentials and session cookies in real time, bypassing multi-factor authentication and reaching nearly 100,000 organizations since it first appeared in 2023. At its peak in November 2025, the platform was generating over 30 million phishing messages a month. That case resulted in a civil complaint naming Saad Fridi as the alleged creator.

Both operations ran on the same basic model: platforms that sold ready-made attack tools to buyers with little technical skill, letting them run large fraud campaigns cheaply. Microsoft advised organizations to treat email from education and nonprofit domains with extra care, since YAM Store sold cloud accounts tied to real .edu and .org tenants obtained through the domain-buying scheme, making fraudulent emails look like they came from real institutions.

Read more »
User Privacy
Banking Trojan Financial Scam Hirudo malware User Privacy

Hirudo Android Malware Replaces Banking Apps to Evade Security Checks

 

A newly identified Android banking trojan called Hirudo is taking an unusually aggressive approach to evading mobile security: instead of merely overlaying fake login screens on top of legitimate apps, it replaces the victim’s banking app with a modified copy. According to mobile security firm ThreatFabric, the malware retains nearly all of the original app’s code but injects a hooking engine based on the open-source frameworks YAHFA and Dobby. That lets it operate inside the banking app’s own process, effectively turning the app’s defenses against it.

Hirudo is typically delivered through seemingly useful apps, including a shopping app called Shopora, an adult-content app named 1V1 X, and short-drama apps such as ZoyaTV and KoiShort. These loader apps provide the functionality users expect, then display a fake “update” notification that leads to permission requests—most importantly access to Android’s Accessibility services. Once granted, Hirudo can uninstall the genuine banking app, download a patched version, and install it automatically using its elevated permissions. 

The replacement app is designed to defeat several common security checks. It can substitute the genuine signing certificate when queried, hide enabled Accessibility services, remove screenshot protection, alter key-attestation certificates, and route Play Integrity requests through an attacker-controlled server. By doing so, it can make a tampered banking app appear legitimate to both the user and parts of the device’s security system. Researchers note that the process is risky for the attacker because the victim can interrupt the app replacement at two separate points. 

Once active, Hirudo gives operators extensive control over the infected phone. It can steal banking passwords, payment PINs, device-unlock credentials, and SMS messages; stream the screen in real time; capture screenshots; record audio; and access both cameras. The malware also uses fake checkout pages to collect payment PINs and then shows a fabricated payment-success message, making victims believe a transaction completed normally while their data is being harvested.

ThreatFabric says Hirudo has impersonated at least seven Indonesian banks, with additional targeting observed in China, India, Mexico, Morocco, and Thailand. An unsecured backend panel linked to the operation contained thousands of application-credential entries, along with device, lock-screen, and financial-profile data, though the total number of victims remains unknown. The researchers recommend that banks validate integrity and attestation server-side, tie those checks to sessions and protected actions, and maintain behavioral and transaction-risk controls. Android users should keep devices updated, avoid installing APKs from unofficial stores, and periodically run Google Play Protect scans.
Read more »
Cyber Security
AI Agent AI Chatbot AI research AI technology ChatGPT. OpenAI Chrome Chrome Zero Day Cyber Security

AI Agents Build Chrome Zero-Day Exploit in Six Days, Winning $250,000 Reward

 

AI-powered security agents developed a Google Chrome exploit within six days and earned XBOW company $250,000 from Google. The exploit involved an intricate chain of attacks that used to require extensive manual work and unique expertise in the past. 

Researchers at XBOW utilized OpenAI’s publicly available GPT-5.6 Sol model to find and combine three Chrome vulnerabilities, resulting in an exploit that enables code execution in Chrome when a victim loads a web page. The researcher group spent nearly $40,000 on the AI-powered process, in addition to the extensive preparations before the six-day research window. V8 JavaScript Engine, WebP image codec, and Crashpad constitute Google Chrome’s fundamental components. 

The researchers discovered an intricate attack chain that involved all three elements. Exploiting Chrome’s reporting tool, one could gain arbitrary code execution by inducing the component into a special state. The researchers found two zero-day flaws in Chrome, namely,CVE-2026-85045 and CVE-2026-78952. Google patched the flaws in Chrome on August 25 and September 3, respectively. The software received updates in versions 152.0.7977.65 and 152.0.7977.82. 

If you are a Windows user, you need to restart Chrome and ensure it is at least version 152.0.7977.82. It is unclear whether any attackers used the Chrome flaw to infiltrate systems. However, Chrome is a popular browser with an estimated billion Windows users worldwide, any successful attack would have severe consequences. The article concludes by emphasizing the collaboration between AI-powered agents and human counterparts. Apparently, the AI-powered system did not do everything automatically. 

In addition to the preparatory steps, the researchers engaged in the preparatory steps and the exploit development itself. Thus, the new possibilities opened up by AI research tools is that researchers are no longer limited by their knowledge and skills to develop an intricate attack chain. Google Vulnerability Reward Program encourages security researchers to report bugs they discover in the company’s products. 

In this particular case, XBOW received $250,000 from Google for the research. The result highlights the relevance of browser security research and the significance of the work of security researchers who protect users from attacks. On the one hand, the researchers increased the potential attack surface of Chrome. 

However, the exploit they discovered is chained in a way that allows Chrome users to protect themselves better. The new possibilities in security research, enabled by artificial intelligence, change the game for browsers’ security. Attackers can develop sophisticated exploits faster now, and the protection-focused counterparts should respond by promptly distributing and installing updates.
Read more »
Sextortion
Blackmail Cyber Crime DFC FTC Sextortion

Company Accused of Making $60 Million by Exploiting Sextortion Victims


A US-based digital forensics company is facing allegations that it collected at least $60 million from people seeking help with sextortion threats but failed to provide the assistance it promised. 

According to a complaint filed by the US Federal Trade Commission (FTC), Digital Forensics Corporation (DFC), its owner Dmitry Belkin, and associated businesses allegedly misled victims who were already experiencing fear, emotional distress, and threats of having private images exposed.

Scam details

According to the FTC complaint, DFC collected at least $60 million between February 2023 and July 2026. The company allegedly charged customers between $1,499 and $20,000 for services advertised as helping identify blackmailers, stop threats, and support investigations.

The complaint claims that the company misrepresented its investigative capabilities and the results it could achieve. Among the allegations is that DFC used fabricated investigative chat transcripts to make customers believe its investigators were actively communicating with suspected criminals.

The FTC also alleges that the company reused location information to create the impression that it had successfully tracked down perpetrators. Such tactic could lead customers to believe that meaningful investigative work was being conducted when the evidence presented to them did not support those claims.

Besides this, the complaint argues that customers were pressured into purchasing extra services. The company reportedly used positive reviews that were not genuine to strengthen its reputation and made obtaining refunds difficult for dissatisfied customers. 

“Instead of communicating with the sextortionist through the victim's account, defendants routinely change the victim's account settings simply to block the sextortionist's communications. Instead of obtaining investigative information, defendants fabricate chat transcripts,” the complaint said.

FTC’s response

According to the complaint, “Defendants falsely portray themselves as digital forensics experts, claiming they can track and identify sextortionists, prevent the spread of explicit material and coordinate with law enforcement to bring criminals to justice."

The FTC filed a lawsuit against DFC, Belkin, and several affiliated companies, accusing violations of consumer protection laws. A federal court temporarily halted the company's operations while the legal case proceeds. The agency is seeking action against the alleged deceptive practices.

The FTC also reported that the company advertised its services through search engines, video-sharing websites, and social media platforms, potentially reaching people actively searching for urgent help. 

Read more »
Workplace Surveillance
AI Security Confidential Data Protection Corporate Espionage Cyber Crime Hidden Recording Device Insider Threat OpenAI Employee Arrest OpenAI Security Incident Workplace Surveillance

OpenAI Employee Arrested Over Hidden Recorder Allegations


In connection with the arrest and prosecution of an employee of OpenAI, it has been claimed that a recording device was allegedly placed in an executive conference room at the company's San Francisco headquarters. This device was reportedly intended to record confidential discussions regarding the company's artificial intelligence research and strategic plans. 

As a result of the arrest of Abdulrahman Alfozan, a 35-year-old Saudi national, on October 9, 2026, his position has been terminated. A federal charge has been filed against him by the U.S. Department of Justice (DoJ) for using or attempting to use an electronic or mechanical device to intercept oral communications. He joined OpenAI in July 2025 and worked on its product team. 

In the executive conference room, OpenAI personnel discovered a hidden audio recording device connected to a USB port behind a television on September 30, causing an alarm to sound. During the period of September 28 to December 31, the device was installed and wrapped in toilet paper to conceal it, according to the complaint.

The room was regularly used to hold executive meetings related to highly confidential technical, commercial, and strategic matters. This information included proprietary research, product development plans, business opportunities, government engagements, and information concerning the company's artificial intelligence progress. The investigation also included review of office surveillance footage that showed Alfozan near the conference room several times before the device was discovered.

According to the complaint, he did not play any part in the meetings in which the device was discovered. As a result of the investigation, the investigation has also allege that later he returned to the room and observed the recording device behind the television. Furthermore, Alfozan is accused of using a workplace productivity tool to gather information about OpenAI's offices, conference rooms, meeting schedules, and room capacity before the device was installed, according to the FBI complaint. 

The searches reportedly included information about leadership meetings as well as sessions involving external partners, raising questions regarding potential attempts to identify opportunities for recording confidential conversations. As part of the investigation, investigators examined prompts submitted via an account associated with Alfozan's spouse's chatbot.

According to the account, between September 24 and 30, it was allegedly used to obtain information about building and configuring audio recorders, setting up Wi-Fi, enabling live audio monitoring, encrypting stored data, and remote access to the device. According to the complaint, the chatbot account shares identifiers and other attributes with Alfozan's own account. 

A second recording device was allegedly discovered on October 5, when OpenAI's security personnel inspected an unattended bag left in another room of the company's building. Among the items in the bag are Alfozan's wallet and identification as well as a device similar to that found in the executive conference room. 

A surveillance video was also allegedly captured by investigators capturing him checking behind the television, where the first device had been placed. OpenAI reported that the recording device had encryption capabilities, audio monitoring capabilities, and an encrypted data transfer mechanism for avoiding detection. 

Following the analysis of the device by internal AI models and the identification of the employee who allegedly perpetrated it, the company referred the case to the FBI. Even though the allegations were somewhat serious, OpenAI stated that there was no evidence that Alfozan improperly accessed or removed model weights, source code, or customer data. Security measures provided by the company were intended to address threats ranging from insider threats to cybercriminals and nation-state actors. 

As a result of his arrest, Alfozan appeared in federal court and is facing the possibility of five years in prison, a $250,000 fine, and a three-year probation period. Unauthorized recording of confidential technical developments and business strategies can expose confidential information even without direct access to the digital systems, as outlined in the investigation of the risks posed by insider threats at organizations engaged in sensitive AI research. 

Those organizations developing advanced artificial intelligence technologies should take precautions against insider threats, maintain workplace security controls, and protect confidential information. This case is currently being investigated, and the allegations have not yet been proven in court.
Read more »
XWorm RAT
Browser Session Hijacking cyber espionage Cyber Security Threats Endpoint security malware Remote Access Trojan Surveillance Malware Webcam Spying XWorm RAT

XWorm RAT Evolves Into Advanced Surveillance Malware

Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions. 

It was discovered in 2022 that XWorm facilitated the control of compromised systems by logging keystrokes, capturing screenshots, and executing remote payloads. The malware has been modified by its developers since its discovery, adding new features and releasing updated versions. According to Netskope, 1,236 detection events were recorded across 100 customer organisations during the third quarter of 2026, representing a fourfold increase from the same period in 2025. 

The malware's expansion has been accompanied by an expansion of its plugin collection. In July 2025, 35 plugins were supported, but by October 2026, 46 plugins were supported, which provided increased capabilities for monitoring and interacting with victims' devices. 

A cracking of the XWorm builder and subsequent release of the source code for version 6.4 in August 2025 resulted in the wider dissemination of the malware. Since then, researchers have identified multiple versions operating in the wild, including V6.4, V6.5, V7.2, and V7.4 The malware has been modified in several ways, including code protection, delivery methods, and the ability to evade security analysis. 

There are approximately 35% of affected customers that are affiliated with financial services companies, according to Netskope. The majority of reported incidents have occurred in the United States, India, Brazil, Italy, Panama, and Brazil. HBrowser plugins pose a significant security risk due to their ability to operate within existing browser sessions rather than relying on stolen passwords.

Command-and-control channels of the malware are encrypted using AES, allowing for remote mouse clicks, keyboard inputs, and other interactions with the active browser. By continuously taking screenshots, attackers can gain access to accounts already logged in and potentially gain access to sensitive information. By collecting device location data without a visible consent request, the Maps plugin adds another layer of surveillance. 

Netskope's analysis shows that it attempts to retrieve GPS coordinates, but when GPS coordinates are not available, it switches to IP-based geolocation. Microphone plugins allow for recording audio from selected recording devices and transmission to operators in encrypted, compressed data chunks. In addition to webcam recording, attackers may also monitor compromised devices without displaying obvious warnings to the user using these functions. 

Continued Development Raises Security Concerns 

As the malware has evolved, it has also undergone changes to make analysis and detection more challenging. Recent variants have introduced stronger code protection techniques, techniques for avoiding virtual analysis environments, and modifications to payload delivery and command-and-control communication. 

By expanding the plugin collection, operators have increased the range of options they have for tailoring attacks to meet their objectives. NetSkope anticipates continued development of XWorm following the public release of its builder and source code, with further development likely following that. The increasing surveillance capabilities of malware also highlight the limitations associated with multi-factor authentication alone. 

An attacker who controls an already authenticated browser session on an infected device may not be able to prevent access to open accounts even when additional login verification is performed. It is recommended that security teams strengthen endpoint monitoring, investigate unusual process and network activity, and restrict unauthorised outbound communications. 

Network segmentation will also allow you to limit the spread of malware across other connected systems. Detecting endpoints, monitoring traffic, and responding to incidents in a timely manner remain crucial for identifying suspicious activity and containing compromised devices before they can be exploited further by attackers.

Read more »
Xandr
Advertising Data Regulation European Union GDPR Grindr Microsoft Norway Privacy sensitive data Xandr

Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers

 



Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis. The decision, signed October 2 by Datatilsynet Director General Line Coll and Head of International Tobias Judin, targets one of the most contested privacy questions in digital advertising: whether ad intermediaries can claim ignorance of how consent was collected by the apps they serve.

Grindr is a location-based dating app primarily used by gay, bisexual, trans, and queer people. For nearly two years, from July 2018 to April 2020, Xandr sat at the center of the app's advertising infrastructure, operating on both the buying and selling sides of real-time bidding. The process works fast and invisibly. The moment a user opened Grindr, the app passed their data through Xandr to a pool of companies competing in a split-second auction for the right to show that person an ad. Datatilsynet found that this relay included at minimum each user's advertising ID, IP address, and the fact of their Grindr use. Under GDPR, that last detail matters enormously. The authority concluded that being identifiable as a Grindr user is itself information that indicates sexual orientation, a category that European data law places under strict protection and requires explicit consent to process.

Xandr's defense rested on the argument that it believed Grindr had already collected consent from its users. Datatilsynet rejected that reasoning on a straightforward legal basis: Xandr was not a passive conduit but a joint controller alongside Grindr. Under GDPR's joint controller framework, both parties carry independent obligations to confirm a lawful basis exists before processing sensitive data. Xandr never verified that any such basis was in place, and the authority ruled that the company had no right to treat consent as someone else's responsibility. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated in the decision.

The investigation turned up a complicating detail. Xandr had been notified of the probe by Datatilsynet in February 2020. Despite that, the company deleted documentation about its processing of Grindr users' data between July 2020 and February 2023, when the authority sent a second information order. Xandr told investigators the deletion had occurred as part of its routine data retention policies. Datatilsynet refused to let that explanation close the gap, noting that the company knew an active investigation was underway when the records were removed.

In setting the penalty at NOK 92 million, Datatilsynet cited the duration of the violations, the direct financial benefit Xandr drew from the unlawful sharing, and the fact that thousands of Norwegian users had their sensitive data exposed to potentially thousands of companies without their knowledge. Crucially, the fine was calculated against Xandr's own annual turnover and not Microsoft's. The authority noted that the violations took place before Microsoft completed its acquisition of Xandr in June 2022, after AT&T sold the unit it had rebranded from AppNexus in 2019.

A Microsoft spokesperson mentioned that the investigation "focused on conduct that predates Microsoft's acquisition of Xandr," adding that interpretations and applications of legal standards have continued to evolve since then. The company said it is reviewing the decision and assessing its options. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal to Norway's Privacy Appeals Board.

The case has roots in January 2020, when the Norwegian Consumer Council filed complaints against Grindr and five ad tech companies: AppNexus, MoPub, OpenX, AdColony, and Smaato. Austrian privacy rights organization noyb joined the action and celebrated the outcome, calling the decision "a major blow to the online adtech industry." This week's fine against Xandr is the downstream enforcement of a broader probe that, on the Grindr side, produced a NOK 65 million penalty against the app itself in 2021. Norway's Borgarting Court of Appeal upheld that fine against Grindr in October 2025 after the company challenged it through two rounds of litigation.

Grindr's data-sharing history has had consequences beyond Norwegian borders as well. In September 2026, the dating app agreed to pay £26 million to settle a UK class action brought by roughly 12,000 users who alleged the platform had shared information including HIV status, sexual orientation, ethnicity, and location with third-party advertising firms before 2020. The London lawsuit, filed in April 2024 by law firm Austen Hays, alleged violations of UK data protection law during roughly the same period covered by the Norwegian proceedings.

The Datatilsynet decision marks one of the more pointed statements yet from a European privacy regulator on how far down an ad supply chain accountability can reach. By treating Xandr as a joint controller rather than an infrastructure provider, the authority made clear that operating the pipes through which sensitive data flows carries its own legal obligations, regardless of which company collected the data in the first place.




Read more »
TFG
Customer Data Cyber Attacks Fashion Retail IT Systems TFG

Hobbs and Whistles Owner Hit by Cyberattack

 

The owner of Hobbs, Phase Eight, and Whistles has become the latest major fashion retailer to be hit by a cyberattack. The Foschini Group (TFG) confirmed that its UK business, TFG London, discovered the incident on October 11, leaving several IT systems offline and disrupting customer orders across the three brands. 

Although physical stores remain open, the company said some website functions may be unavailable while its investigation continues. Customers have been warned that orders placed on or after Sunday could be delayed, and TFG has apologized for the disruption while promising further updates as appropriate. 

TFG says it activated its incident-response and business-continuity plans immediately, brought in external cybersecurity specialists, and notified UK authorities. The Information Commissioner’s Office confirmed it has received a breach report from TFG Brands (London) Limited and is assessing the information provided. 

There is some reassurance for shoppers: TFG London said payment processing is handled by a third party and that, based on its investigation so far, it has no reason to believe payment information is at risk. However, the company is still determining whether other personal or sensitive customer data has been compromised and says it will notify affected individuals or organizations if evidence of a breach emerges.

The company has not yet explained how attackers gained access, whether ransomware was involved, or when systems will be fully restored. TFG added that its White Stuff and Inside Story businesses, along with its African and Australian operations, are unaffected because they run on separate IT systems. 

The attack follows a difficult stretch for fashion retail. Last week, ASOS disclosed that an attacker impersonated a trusted contact to obtain an employee’s login credentials and access third-party platforms containing customer names and contact details. H&M is also reportedly investigating claims involving the ShinyHunters group, though it says it has found no indication that its systems were compromised. 

No evidence currently connects the TFG London, ASOS, and H&M incidents, and H&M has not confirmed a breach. Still, three prominent fashion businesses facing cyber trouble in just over a week suggests that retailers remain highly attractive targets for criminals seeking customer data, operational disruption, or leverage. For TFG, the immediate priority is restoring services and establishing the scope of the incident. For customers, the case is a reminder that even when payment details appear safe, retailers may hold substantial personal information whose exposure can take days or weeks to fully assess.
Read more »
Cyber Security
AI Model AI Security AI technology Anthropic AI Anthropic AI security Cyber Security

Anthropic Warns AI Worms Could Soon Spread Across IoT Devices

 

Small artificial intelligence models could soon be able to freely replicate across internet devices, forming botnets that do not require centralized computers to control them, according to an Anthropic Frontier Red Team paper. The paper’s authors explored if foundation models could be run on unknown cheap devices and execute the actions required to replicate across other interconnected devices. Anthropic bought 15 cheap Android TV boxes for $55 each to see how large an open-weight model could be before it could no longer be hosted on such devices. 

The team found that a model with 26 billion parameters could generate 0.39 tokens per second. They also found that a 9 billion parameter model could run on 8 out of 9 of the different hardware types they tried. The team then tried to see if a model could replicate across 8 emulated Android devices attached to a network. To make matters easier for the would-be-attackers, the researchers made the hacking process trivial; they only had to focus on the artificial intelligence processes. 

Only the GLM-5.2 among the open-weight models was able to fully complete the replication process, doing so on four out of five tries, and managed to infect all 8 devices on the network. Anthropic warned that the experiments should not be considered an accurate representation of how such an attack might unfold in the real world, but the results nevertheless show that attacks are becoming increasingly likely as models grow more capable. 

Models with over 30 billion parameters do not have the ability to fully perform all actions required to replicate, but they can manage single aspects of the process. If development proceeds at its historical rate, then models will be able to achieve the capability demonstrated by GLM-5.2 by 2026. Self-replicating AI models could follow soon after. The researchers also estimated the scale of such an attack. 

If there was a Kimwolf-class botnet that had already successfully infected over 2 million devices, using up all 15 of the TV boxes mentioned earlier would result in 133000 instances of the 26-billion-parameter model being created. This would amount to a combined performance of up to 40 Nvidia H100 GPUs, but it would take more than a day for all instances to be created. Such an attack surface is hard to prevent because there are no singular points of failure, but even if such a worm managed to successfully infect a network of devices, it would still be very visible to most network infrastructure. 

Large traffic volumes and unusual communications patterns between devices that would otherwise not communicate with each other will raise flags with most internet service providers. Anthropic also found that manufacturers could reduce the threat surface by replacing default passwords with more complex ones. Many previous botnets, including the infamous Mirai malware, were nearly impossible to stop because many IoT devices had default passwords that were too simple to guess. 

Anthropic warned that while a fully autonomous worm was not yet available, a continuing increase in model size and capability, along with the growing ability of models to apply knowledge between different model classes, will severely limit the time defenders have to fix vulnerabilities in Internet of Things devices.
Read more »
Technology
LG Root Access Security Flaws Smart TV Technology

Critical Flaws in LG Smart TVs Could Allow Hackers to Gain Root Access Over Local Networks


Three security vulnerabilities in LG's webOS operating system could allow attackers to gain complete control of certain LG smart TVs without authentication or any action from the owner. The flaws can be combined to obtain root access when an attacker is connected to the same local network as the television.

LG has released a firmware fix for the vulnerabilities, following their disclosure by SSD Secure Disclosure on October 12. Users are advised to check their devices for available software updates.

Models impacted

Researchers tested the vulnerability chain on two LG television models: the 32LQ636BPSA and the 27TQ600SW. Both devices were running webOS version 7.5.7-25 with firmware 04.54.40. It remains unclear whether other models or firmware versions are affected.

The attack begins by targeting a network service on port 3001, which is used by the LG ThinQ application to pair with televisions. Researchers found that an attacker could exploit a built-in application called sync-demo to bypass the normal pairing PIN requirement and obtain a privileged key.

Using this key, the attacker can launch another preinstalled application, known as cmp-client, and direct it to a webpage controlled by the attacker. The application does not properly restrict where it can navigate, allowing the malicious webpage to access an internal webOS interface called PalmServiceBridge.

This interface provides communication with system services. Researchers found that it could be used to reach pmlogd, a system logging service that operates with root privileges. Because the service does not properly validate certain input, an attacker can inject shell commands that are executed with the highest level of access on the television.

The combined vulnerabilities therefore allow an attacker to move from an unauthenticated network connection to root-level control without requiring the television owner to enter a PIN, approve a request or click a link.

What is at risk?

Root access can give attackers extensive control over an affected television. Depending on the device configuration and the attacker's actions, this could enable unauthorised software execution, system manipulation and potential exposure of information stored on the device.

The disclosure was demonstrated by an anonymous researcher who secured third place in the LG webOS category at the TyphoonPWN 2026 security competition in Seoul. No CVE identifiers have been assigned to these newly disclosed flaws, and no exploitation in the wild has been reported.

Read more »
TLS certificates Cyber Security
Certificate Renewal https Let’s Encrypt TLS certificates Cyber Security

Let’s Encrypt to Cut TLS Certificate Validity to 64 Days

 

Let’s Encrypt will reduce the default validity period of its TLS certificates from 90 days to 64 days starting February 10, 2027. The change will apply to all certificates issued or renewed after that date, while previously issued certificates will remain valid until they naturally expire. The nonprofit certificate authority says the move is the first step in a broader transition toward 45-day certificates, which it plans to introduce in 2028. 

The shorter certificate lifetime is intended to improve web security by limiting how long a compromised or misissued certificate can remain trusted. It should also make revocation more efficient, because certificates leave circulation sooner and attackers have a smaller window in which to exploit stolen credentials. Let’s Encrypt says the change follows the CA/Browser Forum Baseline Requirements and will eventually be adopted by all publicly trusted certificate authorities. 

Website owners and administrators will need to renew certificates more often, but the impact should be manageable for organizations that already use automated renewal. Let’s Encrypt is making 64-day certificates available in its staging environment this week so customers can test their systems before the production change. The organization recommends that all users carry out similar tests to identify renewal failures, outdated scripts, or configuration problems early.

Administrators using clients that support ACME Renewal Info, or ARI, should be prepared automatically because ARI allows Let’s Encrypt to notify the client when a renewal is due. However, organizations with renewal dates hardcoded from a certificate’s expiration date should adjust those settings to approximately two-thirds of the certificate lifetime. Let’s Encrypt says the update will not affect its ACME endpoints, issuance chains, or rate limits, reducing the likelihood of broader service disruption. 

The certificate authority will also shorten its authorization reuse period to 10 days next year and to seven hours in 2028. That change is intended to comply with a 2029 reduction in maximum validation reuse periods and to remove the need for CAA rechecking when validation data becomes outdated. With the final 90-day certificate expected to expire on May 11, 2027, businesses should use the transition period to strengthen certificate automation before the industry moves to even shorter lifetimes.
Read more »
WordPress
Anthropic API Claude Code CyberXero Data Breach IABs WordPress

Russian Hacker Weaponized Claude Code to Breach 429 WordPress Sites and Steal 628,000 Ukrainian Records

 




A financially motivated cybercriminal using Anthropic's Claude Code as an AI backbone has carried out a sweeping attack campaign that compromised 429 WordPress administration panels in a 61-second window and pulled more than 628,000 personal records from four Ukrainian organizations, according to findings published by threat intelligence firm SOCRadar last week.

The threat actor, tracked under the alias CyberXero, is described as a Russian-speaking initial access broker (IAB) whose infrastructure combines commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Claude Code. Initial access brokers are criminals who break into networks and sell that foothold to other buyers rather than monetizing it directly, and CyberXero has been active since at least July 2026.

The entire operation surfaced from a single configuration error: an exposed open directory at IP address 46.21.250.135 that served the threat actor's live working directory, including more than 90,000 files across 3,000 subdirectories: AI session logs, scripts with plaintext credentials, exploitation toolkits, reconnaissance output, and raw victim database exports. That OPSEC failure let SOCRadar researchers map eight distinct infrastructure nodes tied to the operation, spanning servers in Europe and Tencent Cloud in China.


Two Campaigns Running in Parallel

CyberXero's operation runs two pipelines simultaneously: a global, automated campaign targeting WordPress and e-commerce platforms for payment data and access sales, and a more selective, manual campaign directed at Ukrainian energy providers and critical infrastructure entities.

The automated arm relied on an internally developed Python tool called wp2shell, which abuses a desynchronization flaw in the WordPress REST API batch endpoint to inject SQL, create a rogue administrator account, and plant a web shell disguised as an active plugin. A single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 shells, all inside a 61-second window. Each successful compromise fired a real-time notification to a Telegram bot that let the operator monitor results without staying at a terminal.

The second pipeline was considerably more deliberate. The infrastructure documents curated reconnaissance against seven Ukrainian energy and utilities entities, including the national transmission system operator and the country's largest private energy holding. One target list alone contained 95 subdomains covering those two organizations' email infrastructure, VPN gateways, network dispatch systems, and data platforms. That depth of reconnaissance is not the work of an opportunist scanning for easy targets.

The most damaging confirmed breach was a district heating provider in Kharkiv, a city currently on an active war front. A hardcoded credential in the threat actor's own script gave direct access to the provider, and a multithreaded extractor pulled 564,073 subscriber records containing personal data, home addresses, and account numbers, along with 213,340 access-log entries with timestamps and IP addresses. Because those records identify civilians in a conflict zone, the dataset carries physical risk that goes beyond a conventional data breach.


The AI Layer

CyberXero deployed AI at two independent stages. The first ran Claude Code with a cluster of 51 specialized agents on the primary workstation, handling scanning, exploit chaining, reconnaissance, and post-exploitation tasks. The second connected PentAGI, an open-source autonomous penetration testing framework, to a Cobalt Strike Team Server through an AI provider API for payload generation and hands-on pentest execution.

The 51 agents were divided into functional roles. Offensive agents covered tasks like lateral movement and SCADA attacks. Reconnaissance agents handled subdomain mapping and credential testing. Post-exploitation agents managed data exfiltration. A recovered provider configuration file assigned AI models to these roles by reasoning complexity, with the payload-generation role receiving the highest token budget.

To work around the model's safety refusals, the threat actor used context-engineering and session-reset techniques, instructing the agent that it was running an "authorized pentest on my own infrastructure." That same claim appeared verbatim across four unrelated victim engagements, marking it as a rehearsed line rather than a genuine authorization.

Because model safety controls act on session context rather than model weights, a refusal in one session does not carry into the next. When an agent refused a task, the actor opened a fresh session with the authorization framing preloaded and tried again.

The refusals themselves are notable. Across four separate iterations, the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell. In a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token.

The CyberXero case is not the first time Claude Code has appeared in a documented criminal operation. Anthropic's own threat intelligence report earlier this year described a separate actor who used Claude Code to automate reconnaissance, credential harvesting, and network penetration across at least 17 organizations in a single month, spanning government agencies, healthcare providers, and emergency services.

Anthropic has acknowledged that cybercriminals and state-sponsored actors alike have attempted to use its Claude models to automate cyberattacks, build offensive tools, and conduct mass surveillance operations. The gap between what a single attacker can now accomplish and what previously required a full team has narrowed substantially.

For defenders, SOCRadar's most actionable indicator is simple: any WordPress administrator account whose username follows the pattern "wp2_" followed by eight hexadecimal characters was placed there by wp2shell, not a legitimate user. Organizations running WordPress, Magento, PrestaShop, or internet-exposed Redis servers are advised to check for rogue admin accounts and unexpected entries in SSH authorized key files. CyberXero was still active at the time the SOCRadar report was published.


Read more »
Remote Code Execution
Cyber Attacks cybersecurity vulnerabilities Danfoss Refrigeration Systems French Supermarket Cyberattack industrial cybersecurity Operational Technology Security Remote Code Execution

Cyberattack Knocks Out Supermarket Refrigerators Across France


In a number of major French supermarket chains, refrigeration systems were disrupted by a cyberattack, forcing stores to remove fresh and frozen foods from their display units. It is estimated that 250 to 350 retail outlets, including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, were impacted by the incident. 

Several reports indicate that the attackers compromised older versions of Danfoss refrigeration controller software and remotely activated automatic defrosting functions. The process resulted in increased refrigerator temperatures, putting perishable food supplies at risk, resulting in financial losses and food waste. 

A cyberattack reportedly involving a service provider that manages refrigeration systems resulted in the inability to use some fresh and frozen food displays at Intermarché. According to the company, precautionary measures have been taken to remove products from affected units, although a complete list of the stores affected does not yet exist.

Several stores within the Coopérative U network have also experienced disruptions, according to Dominique Schelcher, president of Coopérative U. As part of its investigation into the circumstances surrounding the attack, the company's teams were working with refrigeration specialists to restore normal operations. 

As a result of the incident, concerns have been raised about the security of digital systems supporting essential food retail operations. A sense of urgency was conveyed by the European Union Agriculture and Food Commissioner Christophe Hansen, who emphasized the importance of not targeting equipment responsible for preserving food.


Vulnerabilities in Danfoss Systems Raise Security Concerns 

ANSSI (National Cybersecurity Agency of France) has been directed to assess the risks and determine whether other businesses could be affected by the incident, while French authorities are investigating it. It appears that refrigeration units reached temperatures as high as 50°C, which resulted in extensive food spoilage and fires at several locations. 

Approximately 150 stores in Intermarché's parent group have been disrupted, whereas 80 supermarkets in Carrefour have been affected. Due to previously revealed security vulnerabilities, Danfoss refrigeration management systems have been under scrutiny. It was discovered by Claroty's Team82 in August 2026 that there are flaws in the Danfoss AK-SM 800A platform, which allows operators to monitor and control refrigeration equipment remotely through a web-based interface. 

An authentication bypass vulnerability, CVE-2025-41450, and a command injection vulnerability, CVE-2025-41451, could allow remote code execution. There is also a third flaw, CVE-2025-41452, which could be used for denial of service attacks through the injection of Nginx configuration. To address these issues, Danfoss released firmware version R4.3.1. 

A number of Danfoss systems are accessible through the internet, which raises concerns about unauthorised access to equipment in supermarkets and other commercial establishments. The affected systems were equipped with outdated firmware, according to Danfoss, and customers had previously been advised to upgrade older equipment. Investigators have not yet confirmed whether any of the disclosed vulnerabilities were exploited in the attack at the French supermarket. Moreover, it is unclear how the refrigeration controllers were accessed. 

Connected Refrigeration Systems Present Cyber-Physical Risks

Security experts have stated that this incident illustrates the dangers associated with attacks against operational technology (OT) despite not targeting conventional information systems. It is possible for refrigerator controllers to make unauthorised changes that may disrupt the handling of food, pharmaceuticals, and other supply-chain functions in temperature-sensitive environments. 

Researchers at Claroty warn that security teams can be overlooking refrigeration controllers, particularly when remote maintenance interfaces are accessible via the public internet. Although remote access can assist technicians in maintaining equipment at multiple locations, poorly secured connections can provide attackers with opportunities. 

In order to ensure security, users should install the latest firmware, remove unnecessary internet exposure, restrict administrative access to trusted networks, and utilize virtual private networks to secure remote connections as well as network segmentation. Additionally, organizations should examine exposed devices and verify that appropriate access control measures have been implemented. It is unclear who is responsible for the attack, and the investigation continues. 

The incident emphasizes the importance of securing connected industrial equipment, particularly systems with the potential to affect public services, food safety, and crucial business functions directly. Despite the incident, the need for securing internet-connected operational technology is growing. Updates to firmware are imperative, as are restrictions on remote access and stronger network controls to prevent cyberattacks from disrupting critical business processes.
Read more »
data security
Cyber Security Cyber Security Ransomware Attacks Data Leaked Data Recovery data security

Paying a Ransom Does Not Guarantee Full Data Recovery or Security

 

Paying a ransomware demand does not always lead to the return of an organization's files, the prevention of data leaks, or the eradication of attackers from its network, according to digital forensics and incident response companies. Ransomware is a prevalent cybersecurity risk, and according to a 2025 CrowdStrike report, 78% of 1,100 global IT and cybersecurity leaders asked about attacks in the past year. 

In addition, according to a report by Proofpoint, which appeared in July, 54% of the 1,600 organizations surveyed worldwide said they had paid a ransom within the last year. Joe Hoosech, an executive at the cybersecurity insurance company Cowbell, estimates that paying the ransom retrieves data with no further leaks in 75 to 80% of cases. 

Some hackers do indeed honor their word to deter potential victims by building a reputation as reliable businesspeople, he adds. In addition, they sometimes provide documents describing how they penetrated the network, although experts say this information is often of little value. "Sometimes the decryptor doesn't work," Hosech cautions. "In my experience, maybe one out of four organizations finds that the decryption tool does not completely restore all the data." Andrew von Ramin Mapp of Cyber Centaurs has observed a similar challenge: "Sometimes there is some damage to the database, for example, because the encryption tool was run while the database was open, so the database needs to be fixed." 

Beyond restoring data, organizations must consider whetherransomware attackers have deleted evidence of the breach, experts say, citing an example. "I've had clients where the bad guys took the data, encrypted it, and then left," recalls Eric Taylor of Barricade Cyber Solutions. "The client paid the ransom, the bad guys promised to delete it, and then the client saw the data on the bad guys' website, including the files they had deleted." "Sometimes the bad guys take the data for themselves and sell it to others," Hoosech says. 

Initial access brokers can infiltrate networks and sell that access to other threat groups and stay in the network. "Therefore, just because one gang promises to protect you, it doesn't mean that those who purchased access to your network won't benefit from stealing your data," says Taylor. "Instead, companies should evaluate the value of the data to the organization and the impact on the business of losing or disclosing it," recommends von Ramin Mapp. He advises businesses that have decided to pay a ransom to "test the decryption key before handing over the ransom." 

However, the expert says there is no way for organizations to receive absolute guarantees that the data will be deleted. "By the way, I advise companies to keep their cyber insurance policies on paper and in a safe place," says von Ramin Mapp. "If an attacker accesses your computer system and finds where you keep the documents, he can calculate how much you might be willing to pay to stop them." Still, experts say that while the ransomware payment option does not completely eliminate the need to respond to the attack, organizations should continue to investigate and mitigate ongoing attacks.
Read more »
Subscribe to: Posts (Atom)