⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More

Some attacks this week didn’t need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble.

Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned software, and attackers finding new ways to turn normal tools against their users. Even the places meant to keep money and systems safe ended up with problems of their own. The strange part is how often the damage started somewhere nobody was looking.

And that’s before getting to the long list of fresh bugs, shady services, and scams making the rounds. Quite a bit to sort through. Here’s what made the list.

⚡ Threat of the Week

N. Korea Sets New Record with Binance $6.43B Crypto Theft — The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to a North Korean hacking group called TraderTraitor. The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin. Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.

• Volt Typhoon Uses Covert Silent Train Network in 0-Day Attacks — Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including to facilitate zero-day attacks targeting high-value systems. It’s codenamed Silent Train because the threat actor uses it against select targets, cleans it up after each operation to minimize detection and attribution, and refreshes it continuously. Silent Train is a relay infrastructure formed of compromised devices to hide the origin of its attacks. The findings highlight evidence of efforts to pre-position access within what it described as “strategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises.” Silent Train is built around “rapidly rotating chains of compromised SOHO, IoT and enterprise devices.” The nature of these victims “indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region.”
• Polymarket Briefly Suspended Trading After Third-Party Hack — Prediction market platform Polymarket temporarily suspended trading after hackers compromised DebugBear, a third-party service, to distribute cryptocurrency-draining JavaScript that siphoned approximately $2.7 million in assets from 33 deposit wallets in under an hour. “Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain,” DebugBear said in an update shared on October 31, 2026. “Based on our initial investigation this attack targeted the website of a specific customer. We have not seen any indication of a compromise of our internal systems, though we will continue to investigate this.” In June, Polymarket disclosed another third-party compromise that injected a malicious script into its frontend, leading to reported losses of around $3 million.
• Shared ChatGPT Links Lead to Code Execution — Researchers from Parameter Labs disclosed a now-patched flaw in ChatGPT that turned an ordinary share link into an attacker-controlled JavaScript running inside the signed-in session of whoever opened it. “An attacker could create a malicious conversation, publish it using ChatGPT’s normal sharing feature, and send the link to another user,” Parameter Labs said. “When the victim opened the share, the payload executed as chatgpt.com with access to the victim’s authenticated web session.” Successful exploitation could allow an attacker to enumerate the victim’s conversation list, retrieve content from a private conversation, and send data from that conversation to an external server.
• Official Claude Code Extension on Cursor Marketplace with SSH Backdoor — Two versions of the Claude Code extension distributed through Cursor Marketplace were tampered with to install a persistent SSH backdoor on affected systems. Cursor said the incident impacted up to 5,000 users. In response to the incident, Cursor said it rotated its keys, rebuilt the marketplace, and worked with the cloud provider to take the server offline so that the reverse shell is no longer functional. It also stressed that no other extensions were maliciously modified as part of the attack. However, several questions surrounding the supply chain attack remain unanswered, including how the threat actor managed to publish a malicious extension under Anthropic’s name on Cursor’s marketplace and what level of access they were able to obtain.
• FBI Seizes bulletproof hosting provider Virtualine — The U.S. Department of Justice (DoJ) announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The DoJ said the service was being used to commit and facilitate prolific criminal activity, including “the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct. However, the long-term impact of such crackdowns has been questioned. According to Intel 471, disruptions have driven customers to newer services operated by former resellers, fragmenting the market rather than eliminating demand. The disclosure comes as the Australian Signals Directorate said it gained backend access to Amadey’s operations and severed its access to 180,000 computers across the globe.
• Keystone to Destroy 18,835 Hardware Wallets — Keystone confirmed a security incident involving its official website where an attacker exploited a vulnerability in a third-party data monitoring tool to escalate privileges and obtain some customer information and a key used to verify the authenticity of our devices. This included 25,964 records containing names, contact details, shipping addresses, and order information, along with 12,873 checkout records containing names, contact details, and shipping information submitted by users. Besides stopping the use of the old key, Keystone plans to destroy 18,835 devices in existing inventory that contain the old key. “Shipping of all unshipped orders from our official website has been suspended,” it said. “Sales will switch to a preorder model until production of devices using the new key is complete, after which shipping will resume.” In a related development, another hardware cryptocurrency wallet maker Trezor said it received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. “If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet with a new seed as soon as possible,” it said.
• uCreator Android Spyware Can Clone WeChat Accounts — A commercial Android spyware offering called uCreator is designed to target ordinary users of mobile wallets and messaging applications across China and Southeast Asia, including GCash (Philippines), WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber, and MoMo. It can also be used to clone WeChat accounts. Victims install repackaged copies of legitimate applications disturbed through sideloading or social engineering flows. The attack leverages a variation of on-device virtualization techniques observed in malware like GodFather to conduct fraud. “GodFather spins the banking app up inside a virtual container and drops a fake overlay on top to phish credentials: the victim is really typing into the attacker’s screen,” security researcher Ovi Liber said. “uCreator shares the substrate but it draws no overlay. This is a case really of overlay-the-app versus instrument-the-app, with the second being quieter and also not being confined to a login screen. As an operator, it scales to any app the vendor writes a module for.”
• Gheist Turns GitHub Actions into a Secret Extraction Service — An automated campaign dubbed Gheist has been observed planting a secret-dumping workflow named “sync-check” in every repository that stolen GitHub tokens can reach. “The workflow seeks to print the repository’s secrets into its own workflow log,” Wiz said. “Then, the tool downloads the log through the GitHub API and deletes the run seconds later.” The Google-owned cloud security company said it recovered more than 13,500 planted branches from more than 850 compromised accounts. The campaign was first detected in mid-September 2026.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-115889, CVE-2026-115893 (Wasmtime), CVE-2026-90975 (Fireblocks mpc-lib), CVE-2026-91141 (COVESA vsomeip), CVE-2026-88781, CVE-2026-75775, CVE-2026-75779, CVE-2026-93489, CVE-2026-17518, CVE-2026-75753, CVE-2026-102438, CVE-2026-14911, CVE-2026-16528, CVE-2026-19386, CVE-2026-19396, CVE-2026-93495, CVE-2026-14157, CVE-2026-13313 (ASUS), CVE-2026-114573, CVE-2026-9082, CVE-2026-118539 (Drupal), CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598 (EPICS Base), CVE-2026-97631 (TianoCore EDK II), CVE-2026-115881, CVE-2026-115884 (GoAhead), CVE-2026-110720 (HashiCorp consul-k8s), CVE-2026-90885, CVE-2026-85250, CVE-2026-88901, CVE-2026-88900, CVE-2026-78165, CVE-2026-85251 (Apache Camel), CVE-2026-115547 (Okta), CVE-2026-114349, CVE-2026-111551 (Apache Kafka), CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344, CVE-2026-106378 (Google Chrome), from CVE-2026-117860 through CVE-2026-117954, from CVE-2026-118005 through CVE-2026-118017 (Mozilla Firefox), CVE-2026-98432 (Linux kernel), CVE-2026-18672, CVE-2026-19219 (Telerik UI for ASP.NET AJAX), TRA-2020-14 (Kodi), CVE-2026-107239, CVE-2026-107238, CVE-2023-22793 (Veeam), CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, CVE-2026-103404, CVE-2026-103405, CVE-2026-103406, CVE-2026-103407, CVE-2026-103408, CVE-2026-103409 (Juniper Networks Session Smart Router), CVE-2026-111585 (TeamViewer), CAN-2026-2035970 (Intelbras IP cameras), CVE-2026-103594, CVE-2026-112709, CVE-2026-112710, CVE-2026-93857, CVE-2026-103593, CVE-2026-93865, CVE-2026-93866 (WatchGuard Fireware OS), CVE-2026-101296, CVE-2026-101356, CVE-2026-103119 (Apache Tomcat), CVE-2026-112816 (Canonical LXD), CVE-2026-93680, CVE-2026-110186 (Langflow OSS), and a preauthenticated remote code execution vulnerability in TightVNC.

🎥 Cybersecurity Webinars

• Learn How to Turn Identity Context Into Faster, Smarter SOC Response → Your security tools can detect suspicious activity, but without identity context, critical threats may go unnoticed. As machine identities and AI agents expand the attack surface, SOC teams need deeper visibility to respond effectively. Join this expert-led webinar to discover how connecting identity intelligence with security operations can help uncover hidden risks, accelerate investigations, and contain threats faster.
• From Zero-Days to Exploits in Minutes: Are You Ready for AI Threats? → AI-powered cyberattacks are accelerating, shrinking the time security teams have to detect, investigate, and respond. Are your defenses ready to keep up? Join this expert-led webinar to discover how to strengthen AI threat readiness, improve attack-surface visibility, and build faster, more resilient security operations before attackers gain the upper hand.

📰 Around the Cyber World

• A massive search-hijacking campaign called Searchjacked involving 319 Chrome extensions with a combined 13.4 million reported installations hijacked users’ searches through tracking servers, captured queries, and collected referral payments from Microsoft Bing and Yahoo. The findings from Socket expand on the April 2025 discovery of 57 Chrome extensions with six million users, adding 264 newly identified add-ons with another 8.7 million users. Although they are hosted on the Chrome Web Store, they are unlisted and don’t appear in users’ searches on the extension store. Instead, the extensions are promoted through sketchy advertisements shown as pop overs or pop unders on websites. Socket also discovered a cluster of malicious Firefox extensions that mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys. A third campaign, documented by Am I Being Pwned?, involves 60 Chrome extensions with 2.3 million installs across 4 publisher accounts. Called OffiDocs, the extensions masquerade as document programs and exfiltrate all URLs visited by users to be shared with business partners, and other third-parties, or redirect users to one of their pages on redcoolmedia.net or runapps.org
• Microsoft revealed details of two human-operated intrusions in which threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into granting interactive remote access, primarily through Quick Assist. “Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths,” Microsoft said. “This intrusion pattern is high impact because a user-approved remote session can become certificate-backed access to privileged identities and domain infrastructure.”
• Threat actors are increasingly turning to vulnerabilities as a means for breaking into corporate systems, as exfiltration and extortion-only attacks emerged as the fastest-growing category in the third quarter of 2026.
• Check Point detailed three anti-detect browsers, Kameleo, AdsPower, and MultiLogin, that could enable a single operator to silently manage thousands of isolated accounts across multiple platforms, and evade detection systems that look for scams and coordinated inauthentic behavior. “Threat actors abuse these platforms, taking over accounts and using them for financial fraud, phishing and malware distribution,” Check Point said. “These accounts can also be used to coordinate influence operations, which becomes an even greater concern ahead of elections. These tools already use AI integration, from built-in automation templates to offering a dedicated MCP server that pipes LLM-generated content directly into pre-warmed account profiles at machine speed. Running a large-scale social media operation now requires only a credit card instead of a technical team.”
• Russia and Ukraine both revealed their emergency alert systems were hit by cyber attacks. The attacks caused the two systems to send fake emergency alerts. Per BBC, Ukraine’s air raid app sent false red-level air raid warnings nationwide. A few hours later, Russia said its alert app was also attacked, but said that it was only an “ancillary” service among sirens and other warnings. It’s not clear if the two incidents are connected.
• A sophisticated Android malware campaign has been targeting the Indian banking sector since July 2025 using seven distinct trojan families that facilitate banking fraud through coordinated phishing, credential theft, and unauthorized cryptojacking. It is orchestrated by a financially motivated threat cluster codenamed CyberDakait that’s operating in India since January 2025. The malware families are GhostBat, cyb3rx, godz, d-passive, d-shine, tenxen, and appkjl. Distributed via coordinated smishing and vishing campaigns, they are designed to harvest sensitive information, including bank mobile application credentials, credit card details, outstanding balances, through sophisticated overlay attacks. “The main goal of the campaign is the distribution of Android malware to conduct cryptojacking and elaborate banking fraud,” Group-IB said. “The malicious applications are commonly hosted on GitHub repositories to maintain legitimacy and evade security controls, where the initial APK functions as a dropper that downloads and executes the main payload alongside a cryptocurrency mining module, enabling the threat actors to generate revenue through both direct financial theft and unauthorized cryptocurrency mining on infected devices.” A total of at least 17,960 compromised devices have been identified, and about 7.6 million SMS messages were intercepted from victim devices.
• A new phishing campaign has disguised credential theft as an invitation to a private AI event from Anthropic, and uses GoTo Webinar branding, a Zoom-style registration page, and convincing Google and Microsoft login pages to steal login credentials. “Risks to the organization from this campaign include threat actors compromising a sensitive account, accessing the account’s sensitive documents (e.g., proprietary marketing material), and using the compromised account as an initial vector to further infiltrate the organization,” Cofense said.
• A new campaign is using judicial-themed phishing emails targeting Colombian organizations to deliver XWorm via a multi-stage chain. The initial payloads resemble legitimate Colombian administrative or judicial correspondence, according to Arctic Wolf.
• Multiple Russian-language traffer teams that have adapted affiliate-fraud models to capitalize on growing public interest in prediction markets such as PolyMarket and Kalshi. “The platforms offered by three such teams — AtlasCore, PolyFucked, and Magnetic Team — provide websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance,” Recorded Future said. “This model lowers barriers to entry for affiliates and enables campaigns to scale rapidly as new trends attract potential victims. The services combine convincing prediction-market interfaces with established fraud mechanisms designed to manipulate victims and prevent them from recovering deposited funds.” Advertised compensation includes 70% to 80% of net profits for AtlasCore affiliates, a minimum 60% revenue share for PolyFucked affiliates, and a base 70% share of victim deposits for Magnetic Team affiliates.
• Nozomi Networks detailed a new Go-based malware for Linux called Kairos that turns a compromised machine into a node in the operator’s DDoS botnet. “On command, the bot opens hundreds to thousands of TCP connections to a target chosen by the operator and keeps them open for the requested duration, sending a single near-empty keepalive byte every few seconds,” Nozomi Networks said. “Initial access came through Telnet, using the default credentials (user root, empty password). The operator then staged the payload with a short shell sequence that downloaded it over HTTP from the same server the bot later calls home.”
• A previously undocumented Microsoft device code phishing kit codenamed MadApe is using business-themed PDF lures, configurable redirects, and fake document-sharing pages to trick victims into completing Microsoft device code authentication. It was first observed by Group-IB on January 7, 2026.
• Threat actors behind Aur0ra ransomware, aka Gold Ogre, are extensively using AI to develop tools and to orchestrate and execute ransomware operations, Sophos said. The AI-assisted post-exploitation framework is developed with Cursor AI assistance. “The threat actors used Cursor to escalate from credential access to domain administrator in preparation for data collection and ransomware deployment,” Sophos said. “AI guardrails were bypassed by framing the intrusions as authorized red team activity or ‘diagnostics testing.’ Intrusions were orchestrated by Cursor’s Composer agentic coding model as well as AI models provided by Anthropic, xAI, and Moonshot.” Although the threat actors initially used Anthropic almost exclusively, they have since introduced other models.
• Malicious model repositories on Hugging Face are being used to fuel a cryptomining and backdoor campaign. “The payloads were written for GPU hosts running self-hosted inference, especially Xinference and GPUStack, along with rented GPU machines, shared research notebooks, and CI jobs that pull small test models without anyone reading the code,” Pluto Security said. Instead of using poisoned weights or pickle exploits, the campaign abuses a Hugging Face option, trust_remote_code, that lets a model ship its own Python code. When this option is set to true, that code is automatically executed on a victim’s machine as soon as the model loads.
• Bitdefender and NETGEAR found that Smart TVs and connected plugs accounted for a large share of recorded security weaknesses. Televisions represented 22.7% of vulnerability observations, followed by smart plugs at 22.4%. “Before buying connected equipment, the support period deserves attention alongside the price and features,” the 2026 IoT Security Landscape Report said. For equipment already in the home, knowing whether updates are still available is part of knowing whether it should stay connected.
• A tech-support scam is directing victims to install the commercially available remote access application UltraViewer. Infoblox, which broke down details of the campaign, said it found links to a long-running QuickBooks phishing campaign. “That campaign uses over 350 QuickBooks-lookalike domains and directs victims to call scammers who attempt to steal QuickBooks credentials,” Infoblox said. The scam has been found directing users to trojanized UltraViewer and UltraMailer, installers that lead to the deployment of DarkKometa and njRAT, respectively.

• In an analysis of The Com ecosystem, Flare said the loose-knit collective comprises three distinct intrusion clusters, Scattered Spider, LAPSUS$, and ShinyHunters, while SP1D3R HUNTERS (aka Scattered LAPSUS$ Hunters) represents an amalgamation of all three. Security researcher Jon DiMaggio warned against attributing any activity post-2022 to LAPSUS, which ceased operating years ago. “LAPSUS$ operated at full capacity for roughly nine months, from its December 2021 attack against Brazil’s Ministry of Health through its concentrated campaign in early 2022, before a series of arrests in mid-to-late 2022 ended it as an organized entity,” DiMaggio said. “Scattered Spider and LAPSUS$ overlapped by a few months at the start and by at least one individual across their lifespans, and they still ran different playbooks against different targets toward different ends.” 

Conclusion

That’s about it for this week. Some attacks were carefully planned. Others worked because someone clicked the wrong thing, trusted the wrong tool, or left something exposed. Different methods, same result. And with so many systems connected to other systems, even a small mistake can travel further than expected.

The bigger concern is how normal some of these attacks have become. Nothing particularly clever is needed when the easy routes still work. Keep an eye on what has access, check what needs fixing, and don’t assume familiar means safe. See you next week.