What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Microsoft Security · Blog ·
Post-quantum authentication: Why organizations should start testing certificate ecosystems now
Microsoft says organizations should test post-quantum authentication.
Microsoft says post-quantum authentication affects certificates, trust anchors, and PKI services. Organizations should inventory certificate dependencies and test interoperability. Microsoft’s Post-Quantum Cryptography Transport Layer Security Pilot Program helps with this.
Recommended by the publisher: Microsoft recommends organizations start testing certificate ecosystems now.
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
China-linked hackers stole emails from organizations.
The Hacker News reports hackers tied to Integrity Technology Group stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia. The hackers scanned websites for flaws using a tool. The company has been sanctioned by the U.S. and the UK.
Recommended by the publisher: The FBI and agencies in 6 other countries reported this.
Cisco Talos found malware authors evade AI-assisted analysis.
Cisco Talos says attackers develop methods to manipulate AI systems, embedding natural-language instructions into their code. According to the company, these techniques can trick AI-assisted analysis about 35 percent of the time. The company classifies this trend as A3: AI-Analysis Evasion.
Recommended by the publisher: Security teams should flag imperative language addressed to analysis systems within binaries as a suspicious signal.
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
Ransomware affiliate betrays others.
The Hacker News reports a ransomware affiliate kept profits for himself. An attacker exposed a server with tools. Malicious code was found in developer packages.
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
JPCERT/CC reports data leaks in Japan.
The Hacker News reports JPCERT/CC found API abuse and software flaws were used. Japanese organizations are affected. JPCERT/CC based this on incident reports.
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
UAC-0099 targets Ukrainian government personnel with ASHVEIN RAT.
The Russia-aligned threat actor UAC-0099 uses ASHVEIN RAT in attacks. TrendAI tracks the cluster as Earth Sirrush. ASHVEIN is a .NET infostealer and RAT.
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
ARTEX AI tool used in attacks on South Korean financial firms.
CrowdStrike Intelligence reports a campaign targeting South Korean financial organizations from late September to early October 2026. The threat actor used ARTEX to carry out the attacks. The activity resulted in data exfiltration.
Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn
Zero Day Initiative reports Pwn2Own Ireland 2026 Day Three results.
Zero Day Initiative says several teams successfully exploited various devices, including Google Pixel 10, Samsung Galaxy S26, and Philips Hue Bridge Pro. The teams used bug chains and zero-days to exploit these devices. Ikotas Labs, Inc. is reported to have won the Master of Pwn title.
ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe and Australia. The Hacker News reports this affects multiple sectors. ANY.RUN says it has traffic controls and session management. The phishkit is part of the infrastructure that delivers the phishing page.
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos found AI-assisted phishing targeting Taiwan research organizations.
Cisco Talos identified a spear-phishing campaign against Taiwan research organizations, using AI-assisted content generation and impersonating reputable institutions. The campaign deployed an advanced adversary-in-the-middle phishing framework that impersonated Google authentication pages. Talos assesses with moderate confidence that the user interface was originally developed in Simplified Chinese.
Recommended by the publisher: Cisco Talos recommends caution with emails and QR codes from unfamiliar sources.
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Malware authors evade AI analysis with plaintext comments.
Cisco Talos says malware authors develop techniques to obstruct AI analysis, with a 35% success rate in test runs. The techniques include adding comments to influence automated analysis. Talos found these techniques in four malware families: FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE. The comments are detectable as they must be plaintext.
Recommended by the publisher: Treat text inside a sample as evidence, never as instruction.
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
16 Firefox extensions steal recovery phrases.
The Hacker News reports 16 malicious Firefox extensions pose as Rabby and OKX Wallets to steal recovery phrases and private keys, they masquerade as wallet portals and browser tools, intercepting secrets during wallet import flows.
Recommended by the publisher: Remove malicious extensions.
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
US offers $10 million for Zhang Yu tips.
The Hacker News reports the US State Department is offering a reward for information on Zhang Yu, charged in the HAFNIUM hacks, according to NTD, citing a notice, the reward is for his identification or location.
MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data
MonsterCloud owner charged with fraud.
The Hacker News reports the US Department of Justice charged Zohar Pinhasi with wire fraud. He allegedly paid attackers for decryptors. The Hacker News says he billed over $19M.
Recommended by the publisher: The Hacker News reports no recommended action.
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Tensorlake npm package compromised.
The Hacker News reports the tensorlake npm package was compromised to deliver malware. Socket says the malicious version 0.5.144 harvests credentials and executes remotely supplied code. This affects Tensorlake applications and services.
Recommended by the publisher: No action recommended.
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos discloses vulnerabilities in Adobe, Apple, Foxit, Microsoft.
Cisco Talos reports vulnerabilities in Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows. The vulnerabilities have been patched by their respective vendors. An attacker can exploit these vulnerabilities to escalate privileges, disclose information, or execute code.
Recommended by the publisher: Cisco Talos recommends downloading the latest Snort rule sets.
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers hijacked .gh, .sl, and .as registries.
The Hacker News reports attackers compromised three country-code top-level domains and obtained unauthorized HTTPS certificates for Google domains, Google said. Google's systems were not breached, but domains ending in .gh, .sl, or .as were put at risk. An attacker could pose as the real site over an encrypted connection with such a certificate.
Recommended by the publisher: The Hacker News reports no recommended actions.