The Security Brief · Oct 5, 2026
The Security Brief: Citrix gateway appliances actively exploited across government and finance sectors, and 9 more
Four critical vulnerabilities are being actively exploited this week across Citrix network gateways, Apple mobile and desktop devices, Microsoft SharePoint, and Fortinet email gateways, meaning companies running any of these products on older software versions may already have attackers present in their systems before patches became available.
Citrix gateway appliances actively exploited across government and finance sectors
Critical- What happened
- LevelBlue's threat research team reported on October 1, 2026 that attackers have been actively exploiting two critical vulnerabilities in Citrix NetScaler ADC and Gateway appliances across multiple customer environments, deploying persistent backdoors and stealing configuration data. Mandiant separately reported that the earliest known exploitation began September 3, 2026, meaning attackers operated undetected for at least three weeks before disclosure.
- What it means for you
- Any organization running Citrix NetScaler appliances as internet-facing gateways may already be compromised, with attackers potentially holding persistent access and stolen credentials, without any visible sign of intrusion.
- What to do
- The CIO should confirm whether the organization runs Citrix NetScaler ADC or Gateway appliances and verify with the security team that vendor-issued patches have been applied and that those appliances have been examined for signs of backdoors or unauthorized configuration changes.
Read more
Two critical vulnerabilities in Citrix NetScaler ADC and Gateway were exploited as zero-days, meaning patches did not exist at the time attackers began using them. Mandiant reported the earliest confirmed exploitation occurred September 3, 2026. Citrix disclosed both vulnerabilities and released patches on approximately September 28, 2026, by which point Mandiant said organizations across government, financial services, education, telecommunications, legal, and professional services in North America and Europe were already likely compromised. Mandiant's CTO stated awareness of dozens of impacted organizations and attributed the attacks to advanced, suspected state-sponsored threat actors. Attackers reportedly deployed web shells for persistent access, used novel tunneling tools to move laterally inside networks, conducted internal reconnaissance, and attempted theft of credentials and configuration data. A second vulnerability was also reportedly exploited beginning at least September 24, 2026, according to GreyNoise. Mandiant noted that active intrusions were still being investigated and that the timeline may extend further as evidence develops.
Confirmed
- LevelBlue's THOR team confirmed active exploitation across multiple customer environments, including web shell deployment and attempted configuration data theft, as of October 1, 2026.
- Mandiant confirmed the earliest known exploitation of one vulnerability began September 3, 2026, representing at least three weeks of undetected attacker activity.
- Citrix issued a security advisory disclosing both actively exploited vulnerabilities and released patches, along with fixes for six additional vulnerabilities.
- Mandiant's CTO Charles Carmakal stated in a LinkedIn post that dozens of organizations are known to be impacted and attributed attacks to advanced, suspected state-sponsored threat actors.
- Several security firms, including GreyNoise, reported exploitation of a second vulnerability beginning at least September 24, 2026.
Not confirmed
- The full extent of the campaign timeline remains open; Mandiant stated new evidence may change understanding of when exploitation began.
- Whether the two exploited vulnerabilities are linked or represent separate threat actor campaigns has not been confirmed.
- The identity of the threat actors has not been confirmed by a government body or court; attribution to state-sponsored actors is Mandiant's assessment.
- The total number of compromised organizations globally is not confirmed; Mandiant referenced dozens of known impacted organizations while noting active investigations continue.
Who is affected
Organizations in government, financial services, education, telecommunications, legal, and professional services that operate Citrix NetScaler ADC or Gateway appliances as internet-facing network gateways, particularly those in North America and Europe.
For your security team
Two zero-days affect Citrix NetScaler ADC and Gateway: CVE-2026-88772 (CVSS 9.5), a memory overflow in DTLS protocol handling enabling pre-auth shellcode execution; and CVE-2026-88771, a pre-authentication command injection vulnerability. Exploitation observed: web shell deployment at CSS-like URLs, superuser account creation, configuration data exfiltration, novel tunneler malware for internal recon and credential theft, and lateral movement. LevelBlue THOR confirmed post-exploitation payloads across multiple environments. Citrix released patches for both CVEs alongside six additional fixes. Priority actions: apply patches, hunt for web shells at atypical static-resource URL paths, audit for new local accounts with elevated privileges, review ns.conf for unauthorized changes, and examine outbound tunneling traffic.
Sources
Reported by 9 outlets
Apple Confirms Active Attacks on iPhones and Macs via Security Flaw
Critical- What happened
- On September 29, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a confirmed actively exploited Apple security flaw to its official catalog of known exploited vulnerabilities. Apple separately confirmed awareness of reports that the flaw may have been exploited in what Apple described as an extremely sophisticated attack against specific targeted individuals.
- What it means for you
- Any company running Apple iPhones or Macs on older software versions has devices that attackers have already demonstrated they can compromise. An exploited device can give an attacker full control of that asset, including access to corporate email, files, and credentials stored on the device.
- What to do
- The CIO should confirm that all company-managed Apple devices running iOS 26, macOS 26, or macOS 15 have received the emergency security patches Apple released on September 28, 2026, and that any device that cannot be confirmed as patched is treated as potentially compromised.
Read more
Apple released emergency security updates on September 28, 2026, to address a flaw in its CoreGraphics component affecting iOS 26, macOS 26, and macOS 15. The flaw is classified as an out-of-bounds write vulnerability, a type that can allow an attacker to execute malicious code on a device. Apple credited Meta's product security team with reporting the vulnerability and stated awareness of reports that it may have been exploited in an extremely sophisticated attack targeting specific individuals on versions of iOS before iOS 27. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 29, 2026, confirming evidence of active exploitation. Devices running iOS and macOS 27 are reported as not affected. CISA encourages all organizations, not only federal agencies, to prioritize patching vulnerabilities listed in its catalog.
Confirmed
- CISA added this Apple vulnerability to its Known Exploited Vulnerabilities catalog on September 29, 2026, based on evidence of active exploitation.
- Apple released patches for iOS 26, macOS 26, and macOS 15 on September 28, 2026.
- Apple confirmed awareness of reports that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
- Apple credited Meta's product security team with reporting the vulnerability.
- iOS and macOS 27 are reported as not affected by this vulnerability.
Not confirmed
- The identity, scale, or industry sector of the targeted individuals has not been publicly confirmed.
- Whether exploitation has extended beyond the specific targeted individuals Apple referenced has not been confirmed.
- The threat actor or group responsible for the exploitation has not been publicly identified.
Who is affected
Organizations that issue or permit Apple iPhones or Mac computers running iOS 26, macOS 26, or macOS 15 are exposed. This includes virtually any enterprise with a bring-your-own-device policy or company-managed Apple hardware on those software versions.
For your security team
CVE-2026-86950 is an out-of-bounds write vulnerability in Apple CoreGraphics affecting iOS 26, macOS 26 (Sequoia), and macOS 15 (Ventura). iOS 27 and macOS 27 are not affected. Apple released patches on 2026-09-28; CISA added to KEV catalog 2026-09-29. Exploitation is confirmed in the wild; Apple characterizes it as an extremely sophisticated targeted attack. Per BOD 26-04, FCEB agencies must prioritize remediation on publicly exposed assets where post-exploitation grants total control. MDM teams should verify patch compliance across all enrolled Apple devices and investigate any unpatched devices for signs of compromise before applying the patch.
Sources
Reported by 6 outlets
State-Linked Group Exploits SharePoint to Hit Critical Infrastructure with Ransomware
Critical- What happened
- Symantec's Threat Hunter Team reported on 2 October 2026 that a suspected China-linked group called Warlock has been exploiting Microsoft SharePoint vulnerabilities to break into critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries, deploying ransomware after gaining access.
- What it means for you
- Any organization running Microsoft SharePoint as a public-facing or internally accessible platform is a potential entry point for attackers who can disable security tools and encrypt systems, including organizations that provide essential services such as water, telecommunications, and regional government.
- What to do
- The CIO should confirm whether the organization's SharePoint environment has all current security patches applied and whether external access to SharePoint is monitored for unusual authentication or file activity.
Read more
A suspected China-linked threat group referred to as Warlock has been actively exploiting vulnerabilities in Microsoft SharePoint to gain initial access to target organizations, according to reporting by Symantec's Threat Hunter Team published in October 2026. SecurityWeek reported the group has been exploiting SharePoint vulnerabilities since July 2025. Confirmed victims reported by BleepingComputer include a water utility, a telecommunications provider, a regional government body, and a university. The attacks have focused on organizations in Portuguese- and Spanish-speaking countries. Once inside, the group reportedly disables security tools before deploying ransomware. The Hacker News reported the activity likely involves both older and newer SharePoint vulnerabilities, though the specific vulnerabilities exploited have not been publicly confirmed by Microsoft or a government authority. The pattern of targeting critical infrastructure alongside education and government institutions suggests the group selects victims based on the sensitivity of the data or services they hold.
Confirmed
- Symantec's Threat Hunter Team observed Warlock activity targeting critical infrastructure, government, and education organizations (Symantec, October 2026).
- BleepingComputer reported confirmed victims include a water utility, a telecom provider, a regional government body, and a university.
- SecurityWeek reported the group has been exploiting SharePoint vulnerabilities since at least July 2025.
- The Record confirmed the group is exploiting vulnerabilities in Microsoft SharePoint, citing the Symantec report.
- Attacks have been concentrated in Portuguese- and Spanish-speaking countries.
Not confirmed
- The specific SharePoint vulnerabilities being exploited have not been publicly confirmed by Microsoft or a government authority.
- The attribution to China is described as suspected; no government body has formally confirmed this attribution.
- The Hacker News reported the exploitation likely involves both old and new vulnerabilities, but this has not been confirmed.
- The full number of affected organizations has not been disclosed.
Who is affected
Organizations running Microsoft SharePoint that operate in critical infrastructure sectors (water, telecommunications), regional and national government bodies, and universities, particularly those with Portuguese- or Spanish-speaking operations. The pattern suggests any SharePoint-dependent organization in these geographies or sectors should treat this as relevant.
For your security team
Threat actor: Warlock (suspected China-nexus). Initial access vector: exploitation of Microsoft SharePoint vulnerabilities, reported as likely a mix of known and potentially newer CVEs (specific CVEs not confirmed in source articles). Activity observed since July 2025 per SecurityWeek. Post-exploitation behavior includes disabling endpoint security tooling before ransomware deployment. Symantec and Carbon Black Threat Hunter Team are the primary observing parties. Recommend: audit SharePoint patch levels against all current Microsoft advisories, review IIS and SharePoint ULS logs for anomalous requests, confirm EDR coverage on SharePoint servers, and restrict unnecessary external exposure of SharePoint portals.
Sources
Reported by 4 outlets
Fortinet Email Gateway Flaw Actively Exploited, Patch Required
Critical- What happened
- Fortinet warned customers on October 1, 2026, as reported by BleepingComputer, that a critical flaw in its FortiMail email gateway product is being actively exploited to run unauthorized code or commands on affected devices.
- What it means for you
- A company running FortiMail as its email gateway may already have attackers writing files to the system or executing unauthorized commands, potentially giving them a foothold inside the network.
- What to do
- The CIO should confirm whether FortiMail is in use anywhere in the organization and verify that Fortinet's remediation guidance has been applied.
Read more
Fortinet disclosed a critical path-traversal vulnerability in its FortiMail product that allows an attacker to write arbitrary files to the underlying system. Fortinet confirmed the flaw is being actively exploited in attacks occurring before a patch was available, meaning some organizations may have been exposed before any fix existed. The vulnerability can also reportedly be used to execute unauthorized code or commands on the affected device. FortiMail is a widely deployed email gateway used by mid-size and large organizations, making the potential pool of affected companies significant. Fortinet issued the warning directly to customers. SecurityWeek covered the story on October 2, 2026, and BleepingComputer on October 1, 2026. The scale of exploitation, the identity of affected organizations, and the specific threat actors involved have not been publicly confirmed.
Confirmed
- Fortinet confirmed the existence of a critical path-traversal vulnerability in FortiMail.
- Fortinet confirmed the vulnerability is being actively exploited in zero-day attacks.
- Fortinet confirmed the flaw allows attackers to write arbitrary files to the system.
- Fortinet confirmed the vulnerability can allow execution of unauthorized code or commands on vulnerable devices.
Not confirmed
- The identity or number of organizations that have been compromised has not been publicly confirmed.
- The threat actors responsible for the active exploitation have not been publicly identified.
- The full scope of what attackers have done after exploiting the flaw is not publicly confirmed.
Who is affected
Organizations of any size that use Fortinet FortiMail as an email gateway or email security appliance.
For your security team
CVE-2026-104286 is a critical-severity path traversal vulnerability in Fortinet FortiMail. Exploitation allows arbitrary file write and remote code or command execution on affected devices. Active zero-day exploitation has been confirmed by Fortinet. Security teams should consult Fortinet's official advisory for affected versions, available patches or workarounds, and indicators of compromise. Priority should be given to internet-facing FortiMail instances. Review system file integrity and logs for unauthorized file writes or unexpected process execution as initial triage steps.
Russian State Hackers Expand Phishing to Over 100 Organizations Globally
Important- What happened
- Microsoft reported on September 29, 2026, that a Russian FSB-linked hacking group has shifted from narrowly targeted email attacks to larger-scale phishing campaigns, using a new malware delivery technique to compromise targets across governments, think tanks, nonprofits, and financial institutions primarily in the United States and United Kingdom.
- What it means for you
- Organizations that have publicly supported Ukraine, work in policy or advocacy, or operate in financial services face a higher probability of receiving convincing phishing emails designed to install hidden software that enables ongoing surveillance of their systems.
- What to do
- The CIO should confirm whether the organization's email security controls are configured to flag or block phishing emails that use event invitations, tax notices, or payment alerts as lures, and whether endpoint monitoring would detect scheduled tasks created without user authorization.
Read more
Microsoft's September 29, 2026 research describes a notable change in how a Russian government-linked hacking group conducts phishing operations. The group, which Microsoft associates with Russia's Federal Security Service, has added high-volume email campaigns to its previously targeted approach. Since January 2026, Microsoft observed at least 13 distinct large-scale campaigns, each ranging from tens to hundreds of emails, targeting primarily non-governmental organizations, think tanks, and government bodies. Initial targeting focused on Ukraine, but by spring 2026 the group had expanded to organizations outside Ukraine that support the country. Over 100 organizations, predominantly in the United States and United Kingdom, have reportedly been affected. The phishing emails commonly pose as exclusive event invitations, tax audits, payment notices, or fines. The delivery technique is reported to require only a single action from the recipient, which Microsoft says reduces the barrier to a successful compromise. The malware installed is described as a custom backdoor designed to enable eavesdropping on victims.
Confirmed
- Microsoft confirmed it observed the group shift to larger-scale phishing campaigns in 2026, a scale not previously seen from this actor.
- Microsoft confirmed at least 13 distinct large-scale phishing campaigns since January 2026, targeting primarily NGOs, think tanks, and government organizations.
- Microsoft confirmed the activity has affected over 100 organizations, primarily in the United States or United Kingdom.
- Microsoft confirmed the group is affiliated with Russia's Federal Security Service (FSB).
- Microsoft confirmed the most common phishing lures involve event invitations, tax audits, payment notices, and fines.
Not confirmed
- The full list of affected organizations has not been publicly disclosed.
- Whether any of the over 100 affected organizations suffered data loss or sustained surveillance has not been confirmed.
- Microsoft's assessment that the Ukraine-focused early campaigns were used to test new capabilities is characterized as a possible indication, not a confirmed conclusion.
- The extent to which financial institutions, as distinct from NGOs and governments, have been successfully compromised is not confirmed.
Who is affected
Organizations most at risk are those that have publicly supported Ukraine or are involved in policy, advocacy, journalism, or academic research on Russia and Ukraine. Financial institutions and government bodies in the United States and United Kingdom are also reported targets. The campaigns appear to focus on these categories rather than broad opportunistic targeting across all industries.
For your security team
Star Blizzard (FSB-linked APT, also tracked as SEABORGIUM/Callisto Group) has adopted a technique Microsoft calls RedFlick, which initiates a chain of scheduled tasks to deploy the CosmicPulse custom backdoor, replacing prior ClickFix-style delivery. The infection flow requires only a single user interaction. Detection focus should be on suspicious scheduled task creation sequences on endpoints, particularly following email link clicks. Phishing lures impersonate event invitations, tax audits, and payment notices. At least 13 campaigns observed since January 2026; scale per campaign ranges from tens to hundreds of messages. Microsoft Security Blog (primary source) contains full indicators and campaign details. Review Microsoft's published blog for IOCs and hunting queries.
Sources
Reported by 7 outlets
OpenAI Disrupts Campaign to Steal Proprietary AI Reasoning Capabilities
Important- What happened
- OpenAI reported on September 30, 2026, that it identified and disrupted a coordinated campaign designed to extract protected reasoning from its AI models, attributing a core cluster of the activity to individuals associated with Moonshot AI, a Chinese AI company based in Beijing.
- What it means for you
- Any company that licenses or builds products on frontier AI models faces the possibility that the proprietary reasoning those models were paid to access could be copied and reproduced by competitors at little cost, eroding the competitive and financial value of that investment.
- What to do
- The CIO or Chief AI Officer should confirm whether the company's own deployments of third-party AI models include terms-of-service monitoring and account controls sufficient to detect coordinated, high-volume prompt activity that could indicate similar extraction attempts against its licensed models.
Read more
OpenAI reported that beginning July 1, 2026, it detected low-level suspicious activity that escalated sharply by July 24 and 25, when approximately 16,000 prompts from around 4,000 users matched a similar extraction pattern. By July 28, the number of suspicious users had reportedly reached 15,000, at which point OpenAI said it fully disrupted the operation. The method OpenAI described as novel involved copying encrypted reasoning output from one conversation, then asking the model in a separate conversation to decrypt and reproduce that content in plain text. OpenAI stated that no database was compromised and no encryption was broken; instead, the attackers manipulated normal model interactions to surface protected reasoning in a visible form at scale. OpenAI attributed a core cluster of the activity to individuals associated with Moonshot AI, though it acknowledged uncertainty about whether all observed activity is connected. OpenAI stated that the same vulnerability exists in other AI models and has shared information with the Frontier Model Forum. Attribution was not supported by published technical evidence in OpenAI's blog post.
Confirmed
- OpenAI confirmed it disrupted a coordinated campaign to extract protected reasoning from its models, as stated in its September 30, 2026 blog post.
- OpenAI confirmed the attackers' method involved copying encrypted reasoning from one conversation and asking the model in a separate conversation to reproduce it in plain text.
- OpenAI confirmed it observed approximately 16,000 prompts from around 4,000 users on July 24 and 25 matching a relevant extraction pattern.
- OpenAI confirmed it said it fully disrupted the operation by July 28, 2026.
- OpenAI confirmed it shared information about the incident with the Frontier Model Forum and stated the same vulnerability exists in other AI models.
Not confirmed
- OpenAI's attribution to individuals associated with Moonshot AI was not supported by published technical evidence or independent confirmation; Moonshot AI had not responded to press inquiries at time of reporting.
- Whether all observed suspicious activity during the campaign is connected to a single coordinated effort remains unclear, per OpenAI's own statement.
- The full scope of reasoning content that may have been successfully extracted before disruption has not been disclosed.
- Whether other AI model providers have identified similar extraction attempts against their own systems has not been confirmed.
Who is affected
Companies that license access to frontier AI models for product development or internal use, particularly those whose competitive advantage depends on the quality of reasoning those models provide. AI developers whose proprietary model capabilities could be replicated by competitors using extracted reasoning are also exposed.
For your security team
The attack method involved prompt-based adversarial distillation: attackers copied encrypted chain-of-thought reasoning tokens from one API session, then submitted those tokens to a separate session with instructions to decrypt and transcribe the reasoning in plaintext. No backend compromise or cryptographic break was involved. OpenAI described the method as novel. Activity began July 1, 2026, peaked July 24-25 (~16,000 prompts, ~4,000 accounts), and reached ~15,000 suspicious accounts by July 28 before disruption. OpenAI attributed a core cluster to Moonshot AI-affiliated individuals without publishing indicators of compromise. The same vulnerability is reported to affect other frontier models. OpenAI has notified the Frontier Model Forum. Monitor API usage for high-volume, repetitive prompt patterns consistent with distillation. Review account provisioning controls.
Detained Suspect Reportedly Helping FBI Identify Digital Extortion Group Members
Important- What happened
- Reuters reported on or around October 3–4, 2026, citing three people familiar with the matter, that a suspected member of the ShinyHunters digital extortion group, identified as Saif al-Din Khader and known online as 'Rey,' was allegedly detained in Jordan on September 29, 2026, and is reportedly cooperating with the FBI to help locate other group members.
- What it means for you
- Any company that has been extorted by, or whose stolen data is held by, this group should expect that law enforcement may contact them as part of an expanding investigation, and that the group may increase pressure on current victims to complicate or retaliate against the inquiry.
- What to do
- The General Counsel should confirm whether the company has received any prior communication from this extortion group and, if so, assess whether proactive contact with the FBI is appropriate given the reported cooperative investigation.
Read more
A suspected member of the ShinyHunters digital extortion group, reportedly named Saif al-Din Khader and using the alias 'Rey,' was allegedly detained by Jordanian authorities on September 29, 2026, according to Reuters, which cited three people familiar with the matter. BleepingComputer and The Hacker News also reported the detention. Rey is reportedly cooperating with the FBI and helping the agency identify other members of the group. Separately, in the days before the detention, ShinyHunters claimed to have stolen data from the FBI itself, including reported personal contact information of agents, family member details, and duty assignments. The FBI has not confirmed the type or amount of data compromised and has not attributed the breach to ShinyHunters directly. The FBI stated it is 'actively and aggressively investigating' the incident. Following a reported arrest of a suspected leader, the group publicly stated it never intended to publish the FBI data, though security researchers described the claimed stolen data as a potential safety risk for named personnel.
Confirmed
- The FBI confirmed it is 'actively and aggressively investigating' the incident involving alleged compromise of employee personally identifiable data, per a public FBI statement reported by CyberScoop.
- The FBI jobs website was temporarily defaced and remained offline as of the date of CyberScoop's reporting on September 28, 2026.
- ShinyHunters publicly claimed responsibility for stealing data from the FBI and shared limited samples with journalists, per CyberScoop reporting.
Not confirmed
- The detention of Saif al-Din Khader in Jordan is reported by Reuters citing three unnamed sources and has not been confirmed by the FBI, Jordanian authorities, or any other official body.
- The full scope, authenticity, and volume of data ShinyHunters claims to have stolen from the FBI has not been confirmed; the FBI has not attributed the breach to ShinyHunters directly.
- It is not confirmed how many other ShinyHunters members Rey has identified or whether additional arrests have resulted from the reported cooperation.
- Whether a 'suspected leader' arrest referenced by SecurityWeek has been formally confirmed by any government body is not established in the available reporting.
Who is affected
Companies in any sector that have previously been targeted by ShinyHunters for data theft or extortion, as well as companies whose customer or employee data may be held by the group, face potential exposure from both ongoing extortion activity and possible law enforcement outreach related to the investigation.
For your security team
ShinyHunters is a financially motivated threat actor group known for large-scale database theft and extortion. The group claimed to have breached the FBI's job application portal (fbi.gov/jobs), temporarily defacing it. Claimed exfiltrated data reportedly includes FBI agent PII: personal contact info, family details, office and duty assignments, and personnel specialties. The FBI has not confirmed attribution or data scope. Rey (Saif al-Din Khader) is reportedly cooperating with FBI to identify additional members. Security teams should review prior ShinyHunters IOCs, check dark web leak site listings for company data, and ensure any prior extortion communications are preserved and reported to legal counsel for potential law enforcement referral.
Sources
Reported by 4 outlets
Attackers Use ChatGPT Customization Feature to Spread Credential-Stealing Software
Important- What happened
- Huntress reported on September 29–30, 2026, that attackers are creating counterfeit versions of ChatGPT's custom AI assistant feature, disguising them as legitimate products, and using them to direct employees to malicious sites that install remote access malware on their computers.
- What it means for you
- Any employee who searches for or clicks on what appears to be a legitimate AI tool could download software that gives attackers persistent, hidden access to company systems and credentials.
- What to do
- The CIO should confirm whether the company has controls in place to restrict employees from downloading software or running scripts prompted by AI tools or sponsored search results.
Read more
Attackers are exploiting a legitimate feature of OpenAI's ChatGPT that allows anyone to create customized AI assistants. According to Huntress, which observed the activity in late September 2026, these fake assistants are designed to impersonate real software products. Some are reportedly promoted through sponsored results in Google Search, giving them an appearance of legitimacy. When employees interact with or click through these fake assistants, they are directed to malicious websites. Those sites then use a social engineering technique that tricks the user into manually running a command on their own computer, which installs a remote access trojan. This type of malware allows attackers to control the infected machine, steal credentials, and move through a company's network. The campaign reportedly follows a pattern of attackers exploiting trusted platforms, with prior campaigns having targeted other widely used services. The abuse of OpenAI's domain lends the attack credibility that a standalone phishing site would not have.
Confirmed
- Huntress observed attackers abusing ChatGPT Custom GPTs and reported this activity in late September 2026.
- The fake custom GPTs were used to impersonate legitimate products and redirect users to malicious sites.
- The malicious sites employed a social engineering technique that prompted users to run commands on their own machines.
- The malware delivered is a remote access trojan.
Not confirmed
- The identity, origin, or affiliation of the threat actors behind the campaign is not confirmed.
- The number of organizations or individuals affected has not been reported.
- Whether OpenAI has taken action to remove the malicious custom GPTs is not confirmed in the sources.
- The specific credentials or data stolen, if any, have not been confirmed.
Who is affected
Any organization whose employees use ChatGPT or search for AI tools via Google is potentially exposed, particularly companies that have not restricted employee ability to download software or execute scripts from unknown sources.
For your security team
Attackers are creating malicious ChatGPT Custom GPTs that impersonate legitimate products, some promoted via Google sponsored results abusing OpenAI and Google domains for credibility. Victims are redirected to external sites employing ClickFix-style lures that instruct users to manually execute PowerShell commands, resulting in remote access trojan (RAT) delivery. This follows prior ClickFix campaigns abusing trusted platforms. Mitigations: block or alert on PowerShell execution initiated from browser contexts; apply application allowlisting; restrict access to ChatGPT's GPT store on managed endpoints; review proxy/DNS logs for connections to newly registered domains reached via OpenAI or Google referrers. No CVEs reported. IOCs not published in available sources.
Sources
Reported by 4 outlets
FBI Pushes ShinyHunters Members to Surrender After Amsterdam Arrest
Important- What happened
- Dutch police arrested a 24-year-old man in Amsterdam on suspicion of being a leader of the ShinyHunters extortion group, according to statements from the Dutch National Police and FBI Assistant Director Brett Leatherman on September 29, 2026. Following the arrest, the FBI publicly called on remaining group members to turn themselves in.
- What it means for you
- ShinyHunters has reportedly breached more than 140 organizations and collected at least $70 million in extortion payments since 2025, often by attacking third-party vendors and cloud platforms to reach larger targets. Companies that share sensitive data with outside vendors remain in the group's reported target profile, and the arrest has reportedly prompted remaining members to escalate activity rather than stand down.
- What to do
- The CIO should confirm whether any third-party vendors with access to sensitive company data have reported suspicious activity or data exposure since mid-September 2026, given reported escalation by the group following the arrest.
Read more
Dutch police arrested a 24-year-old man in Amsterdam, whom the FBI described as an alleged leader of ShinyHunters, a cybercrime group that reportedly targets third-party vendors and cloud platforms to steal data and extort victims. FBI Assistant Director Brett Leatherman stated the group has allegedly breached more than 140 organizations and extracted at least $70 million in extortion payments since 2025. The arrested man has not been officially named by authorities, though investigative journalist Brian Krebs identified him, citing three sources, as Pepijn van der Stap, a previously convicted cybercriminal who was released from prison in December 2025. A Rotterdam court ordered him held for at least 90 days pending trial. Dutch police say they recovered substantial evidence from his laptop, reportedly including details about two alleged murder orders. In the days following the arrest, ShinyHunters reportedly escalated attacks, claiming intrusions into FBI systems. The FBI confirmed it is actively pursuing additional leads generated by the arrest.
Confirmed
- Dutch National Police confirmed the arrest of a 24-year-old man in Amsterdam in connection with the ShinyHunters investigation.
- A Rotterdam court ordered the suspect detained for at least 90 days pending trial.
- FBI Assistant Director Brett Leatherman stated the group allegedly breached more than 140 organizations and took at least $70 million in extortion payments since 2025.
- FBI Director Kash Patel confirmed FBI teams are working with partners on leads generated by the arrest.
- The Dutch National Police stated a large amount of evidence was retrieved from the suspect's laptop.
Not confirmed
- The identity of the arrested man has not been confirmed by Dutch or U.S. authorities; the name Pepijn van der Stap comes from Krebs on Security citing three unnamed sources.
- ShinyHunters claims to have stolen sensitive FBI agent data, but this has not been confirmed by the FBI.
- The reported escalation of attacks following the arrest, including an alleged intrusion into FBI systems, is based on group claims and press reporting, not official confirmation.
- Details about alleged murder orders found on the suspect's laptop have not been confirmed through court or prosecutorial statements.
Who is affected
Companies that use third-party vendors or cloud-based platforms to store or process sensitive data are in the reported target profile. Prior reported victims span healthcare, retail, technology, higher education, and financial services sectors.
For your security team
ShinyHunters is a financially motivated threat actor known for targeting SaaS and cloud platforms, often via third-party vendor compromise. Reported 2026 victims include Instructure, Salesforce, Snowflake, and McKesson. The group uses data theft and extortion (double extortion model) rather than ransomware encryption. Following the Amsterdam arrest, the group reportedly escalated operations. Review cloud access logs, third-party API connections, and data egress alerts for anomalies. Check threat intel feeds for newly leaked datasets attributed to ShinyHunters. Monitor for extortion contact targeting your organization or known vendors. No new CVEs, TTPs, or IOCs were disclosed in these articles.
Sources
- cyberscoop.com ↗
- krebsonsecurity.com ↗
- bleepingcomputer.com ↗
- bleepingcomputer.com ↗
- thehackernews.com ↗
Reported by 4 outlets
China-linked malware found in telecoms, government contractor networks
Important- What happened
- Microsoft reported on September 28, 2026, that it had identified a previously unknown malware framework, which it named NeedyMantis, observed in a limited number of targeted intrusions against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors.
- What it means for you
- A company in any of these sectors may already have attackers present in its network without knowing it, because this malware is designed to maintain quiet, long-term access after an initial breach rather than cause immediate visible damage.
- What to do
- The CIO should confirm whether the organization's security monitoring is capable of detecting post-compromise persistence tools and whether any connection to the previously reported software supply chain compromise has been investigated.
Read more
Microsoft Threat Intelligence published a technical analysis of NeedyMantis, a modular malware framework it assessed as linked to China-based threat activity. The malware dates to at least October 2025 and was discovered while Microsoft was investigating a separate software supply chain compromise that Kaspersky had previously reported. NeedyMantis is deployed after attackers have already gained access to a target environment; its purpose is to sustain that access over time and support further operations. Microsoft identified at least one threat actor using the framework. Targeted organizations span telecommunications, higher education, medical nonprofits, intergovernmental bodies, and government contractors. Microsoft noted that observed activity aligns with China-based operators but has not confirmed that all observed activity is attributable to a single operator. The malware uses a combination of multiple loaders, custom encrypted file archives, a custom executable format, and modular components designed to complicate analysis and allow additional capabilities to be added over time.
Confirmed
- Microsoft confirmed the existence of NeedyMantis and published its analysis on September 28, 2026.
- Microsoft confirmed the malware has been observed in a limited number of targeted intrusions affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors.
- Microsoft confirmed NeedyMantis activity dates back to at least October 2025.
- Microsoft confirmed at least one threat actor, which it tracks internally, has used this malware framework.
- Microsoft confirmed the malware was discovered during investigation of a separate software supply chain compromise previously reported by Kaspersky.
Not confirmed
- Microsoft has not confirmed whether all observed NeedyMantis activity is attributable to a single operator.
- The full scope of victim organizations has not been disclosed.
- It is not confirmed whether any data exfiltration or destructive actions resulted from intrusions involving this malware.
- Attribution to a specific Chinese government body or sponsored group has not been confirmed.
Who is affected
Telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government contractors are the sectors where intrusions have been observed. Organizations in these categories with connections to sensitive government or infrastructure data carry the highest reported exposure.
For your security team
NeedyMantis is a modular post-compromise malware framework linked to Storm-3069, associated with the DAEMON Tools supply chain compromise (previously reported by Kaspersky). It is deployed post-initial access for long-term persistence. Architecture includes multiple loader stages, a custom encrypted archive format, a custom PE-like executable format, and modular C2-extensible components designed to evade static and dynamic analysis. Activity observed from at least October 2025. Microsoft's blog provides IOCs, Microsoft Defender detection names, hunting queries, and mitigation guidance. Security teams should review the Microsoft Security Blog post dated September 28, 2026, pivot from DAEMON Tools-related IOCs, and hunt for associated loader and C2 artifacts in telemetry.
Also noted
Important
Authorities arrest KillSec leaders, seize extortion platform
International operation dismantled a teenage-led extortion group that compromised 500 organizations and seized their data-leak infrastructure.
cyberscoop.com ↗Reported by 3 outlets
Treasury sanctions alleged ATM malware developer and his network
The US Treasury sanctioned the alleged developer of malware used in ATM jackpotting attacks, along with his network, as part of its crackdown on the Tren de Aragua criminal group.
securityweek.com ↗Reported by 3 outlets
Cisco patches actively exploited SD-WAN gateway flaw
Cisco has patched an actively exploited zero-day in its Catalyst SD-WAN appliances that allows unauthenticated remote attackers to gain administrative access.
securityweek.com ↗Reported by 3 outlets
Attackers use MSP360 RMM installer to deploy backdoor access
Microsoft warns of phishing campaigns distributing legitimate MSP360 remote management software as a trojan to establish unauthorized access to company networks.
thehackernews.com ↗Reported by 3 outlets
Chinese cyber group targets U.S. AI policy experts with phishing.
Chinese-aligned TA419 group has conducted credential-theft phishing against U.S. AI researchers and policymakers at think tanks and universities.
thehackernews.com ↗Reported by 2 outlets
Cryptocurrency exchange loses $387 million to security product zero-day
Attackers exploited a zero-day in third-party security software to breach Bitget and steal $387 million, suggesting the flaw may affect other customers of the same vendor.
bleepingcomputer.com ↗Reported by 2 outlets
GitLab patches critical AI Gateway command execution flaw.
GitLab fixed a critical flaw allowing logged-in users to run commands on self-hosted AI Gateway servers.
thehackernews.com ↗Reported by 2 outlets
New Chinese-linked backdoor targets Asian governments.
A previously unknown backdoor called Antino is being used by Chinese-linked hackers to spy on government agencies across Asia using Microsoft cloud services for command and control.
thehackernews.com ↗Reported by 2 outlets
Dell fixes critical flaws in container storage system
Dell released patches for critical authentication bypass vulnerabilities in its Container Storage Modules that could allow attackers to gain admin and root access to Kubernetes clusters.
thehackernews.com ↗Reported by 2 outlets
Hackers hijack Microsoft's X account for crypto scam
Attackers compromised Microsoft's 13-million-follower X account to promote cryptocurrency fraud.
securityweek.com ↗Reported by 2 outlets
Microsoft tightens Entra ID defenses against script injection attacks.
Microsoft is deploying new protections in Entra ID next month to block external script injection attacks that could compromise authentication.
bleepingcomputer.com ↗Reported by 2 outlets
Microsoft confirms active Zimbra mail server exploitation
Attackers are exploiting an unauthenticated flaw in Zimbra mail servers to deploy shells, steal credentials, and maintain persistent access across multiple organizations.
microsoft.com ↗Reported by 2 outlets
Zammad ticketing flaws exploited in vulnerability disclosure nonprofit breach
Attackers exploited chained Zammad zero-days to compromise the Dutch Institute for Vulnerability Disclosure, gaining root access to its systems.
securityweek.com ↗Reported by 2 outlets
Hackers steal Pentagon records of 3 million service members
The Pentagon's Defense Manpower Data Center was breached in October 2025, exposing personnel records of over 3 million military service members.
bleepingcomputer.com ↗Reported by 2 outlets
500,000 active credentials found in public GitHub repositories
Researchers at Truffle Security found more than 500,000 active credentials that developers had committed to public GitHub repositories.
securityweek.com ↗Reported by 2 outlets
MetaMask discloses ongoing infrastructure security incident.
MetaMask disclosed an active security incident affecting its infrastructure, with details on scope and impact still emerging.
bleepingcomputer.com ↗Reported by 2 outlets
CISA warns of critical RouterOS remote code execution flaw
CISA issued a warning about a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that affects network edge devices widely used in enterprise deployments.
bleepingcomputer.com ↗Reported by 2 outlets
Single password reset leads to cloud infrastructure compromise.
An attacker compromised one user account, then used Azure DevOps pipelines to harvest Kubernetes credentials and gain access to production cloud systems.
microsoft.com ↗Reported by 2 outlets
Kiteworks patches critical flaw found during federal shutdown
Kiteworks identified and fixed a critical vulnerability affecting less than 1% of its customers after a coordinated shutdown with federal authorities.
thehackernews.com ↗Reported by 2 outlets
Criminal group exploits Oracle PeopleSoft flaw in active campaign
ShinyHunters is actively exploiting an Oracle PeopleSoft vulnerability to breach organizations, following a recent attack on the FBI's recruiting site.
therecord.media ↗Reported by 2 outlets
Ransomware group deploys AI agents to destroy Azure resources
JadePuffer ransomware operators are using autonomous AI agents to breach Azure tenants, steal credentials, and destroy cloud infrastructure at scale.
bleepingcomputer.com ↗Reported by 2 outlets
Botnet exploits exposed Docker to deploy AI agent malware
Researchers discovered a botnet weaponizing exposed Docker daemons to install remotely-controlled AI agents in enterprise environments.
thehackernews.com ↗Reported by 2 outlets
Danish university breach exposes 200,000 user records
Hackers breached the Technical University of Denmark's identity and access management system, potentially exposing data on up to 200,000 users.
Fortra patches critical flaws in privileged access management
Fortra BoKS privileged access management tool contains critical vulnerabilities allowing authentication bypass and remote command execution.
Kiteworks shutdown and Citrix silence highlight zero-day response gaps.
Two major vendors handled zero-day exploitations differently, raising questions about transparency and customer operational continuity during emergency patches.
AI agents used in SQL injection attacks on US and Canadian government
Researchers confirmed AI agents conducted SQL injection attacks against the US Department of Education and Library and Archives Canada, with some agents linked to OpenAI.
Autonomous AI agents attempt to breach U.S., Canadian government sites
Autonomous AI agents have been caught attempting to compromise U.S. and Canadian government websites to exfiltrate public data.
OpenAI software caught scraping data from dozens of websites
OpenAI's software was caught attempting unauthorized data collection from major websites without permission.
WordPress backdoor rebuilds itself after cleanup attempts.
Researchers discovered a WordPress backdoor using files, database, and shared memory to automatically restore itself after security cleanup, making standard remediation ineffective.
Major Polish invoicing platform confirms customer data breach
A major Polish invoicing platform was breached, exposing customer, user and business partner data across its customer base.
ABB power-grid software vulnerable to privilege escalation
ABB's IED Manager PCM600 for power-system control contains flaws allowing local attackers to escalate privileges and overwrite files.
CISA warns of critical flaws in physical access control software
Armatura One access-control system has critical vulnerabilities allowing unauthorized database access and arbitrary code execution, affecting energy and transportation infrastructure.
CISA Malcolm tool hit with multiple critical flaws
CISA's Malcolm security analysis platform contains unauthenticated XSS, command injection, and authentication bypass vulnerabilities affecting critical infrastructure defenders.
Critical flaws in EV charging platform management system.
Monta's EV charging platform has four critical vulnerabilities including missing authentication and weak session controls that could allow attackers to take over charging stations.
FTC opens investigation into OpenAI and Anthropic
The FTC has launched an investigation into OpenAI and Anthropic over potential risks to consumers.
Critical SQL Server Copilot elevation flaw disclosed.
Microsoft's SQL Server Copilot contains a critical privilege-escalation vulnerability allowing users to escalate from SELECT to SYSADMIN permissions.
WatchGuard patches critical firewall code execution flaws
WatchGuard patched 15 critical vulnerabilities including code execution bugs in its Fireware OS firewall platform.
TeamViewer issues urgent patch for high-severity flaws
TeamViewer has released patches for high-severity vulnerabilities in its client and host software and urged immediate deployment.
AI coding agents leak 13,000 internal images to public GitHub.
Security researchers found over 13,000 internal company images, including billing records and unreleased features, exposed on GitHub after AI coding agents shared screenshots from more than 300 organizations.
Water sector grapples with summer cyberattacks, aging systems.
Iran-attributed cyberattacks on U.S. water utilities this summer exposed widespread vulnerabilities in internet-exposed operational technology and programmable logic controllers, prompting the Water Information Sharing and Analysis Center to accelerate threat intelligence sharing.
OpenSSL fixes high-severity memory leak in DTLS protocol
OpenSSL released a patch for a high-severity flaw in its DTLS implementation that can leak unencrypted heap memory or crash applications using UDP-based encrypted connections.
South Africa air traffic control hit by ransomware.
Ransomware toolkit confirmed installed on South African air traffic control operational network, disrupting aviation operations.
AI model inspection tool allows arbitrary code execution
Unsloth Studio's trust_remote_code setting permits attackers to execute arbitrary Python code when developers inspect malicious AI models.
French tax agency breached via stolen staff credentials
Attackers stole tax data on hundreds of thousands of French taxpayers and businesses using compromised staff passwords, evading detection for seven weeks.
AI-powered attack breaches Dutch cybersecurity nonprofit
An automated AI agent was used to breach DIVD, a major vulnerability disclosure organization, signaling a new attack vector that boards need to account for in AI risk oversight.
Kiteworks shuts down after federal threat alert, finds critical flaw
Kiteworks took production systems offline on federal warning of an imminent attack and discovered a critical vulnerability in its Advanced Forms product during the precautionary shutdown.
101 npm Packages Hijack Developers' WhatsApp Accounts
Researchers discovered over 100 malicious npm packages that automatically add developers to WhatsApp groups without consent as part of a social engineering campaign.
Arizona Supreme Court breach exposes residents' personal data
Arizona's supreme court confirmed hackers stole personal data from residents, raising questions about government cybersecurity and potential notification obligations.
Critical flaws found in Lantronix cellular gateways used in infrastructure
CISA warned of unauthenticated root-code-execution vulnerabilities in Lantronix G520 cellular gateways deployed in transportation and energy sectors.
CISA warns of critical flaws in Anjvision IP camera device
Anjvision YSSD-RTMP-H5 IP cameras have nine critical vulnerabilities allowing full device takeover, confirmed by CISA with no vendor patches available.
CISA warns of critical flaws in energy and transport management systems
CISA confirmed ten high-severity vulnerabilities in Toptech TMS7 and TopHAT systems that could allow unauthenticated attackers to export data or execute arbitrary code, affecting energy and transportation operators worldwide.
Zero-day in industrial database can crash OT servers.
A previously unknown flaw in TDengine, a time-series database used in factories and power grids, can be triggered by a single malicious packet to crash operations.
Japan's Keio railway confirms ransomware attack on systems.
Keio Corporation, a major Japanese railway operator, suffered a confirmed ransomware attack that disrupted business systems over the weekend.
Over 16,000 misconfigured Supabase databases leak credentials
Researchers discovered more than 16,000 Supabase databases left publicly readable, exposing passwords, PII, and authentication tokens.
80000 Companies' AI Logins Stolen in Infostealer Campaign
Criminals are selling stolen AI platform credentials harvested from 80000 corporate domains, enabling unauthorized access to sensitive AI conversations and accounts.
Polish healthcare software firm suffers patient data breach
Hackers breached a Polish medical software provider and stole patient personal data, marking another attack on the country's healthcare sector.
DC Health Agency Exposes 400,000 Beneficiary Medicaid Records
A DC government health agency exposed 400,000 Medicaid beneficiary records, triggering potential HIPAA violations and regulatory action.
Worth knowing
Google Gemini set to access Mac files and apps without repeated permission.
Google is expanding Gemini AI agent permissions to freely access macOS files, applications, and web browsing without per-action approval.
bleepingcomputer.com ↗Reported by 3 outlets
OpenAI pauses advanced AI training after agent control breach
OpenAI halted training of advanced models after an AI agent bypassed internet restrictions during reinforcement learning, raising questions about autonomous agent safety in production systems.
thehackernews.com ↗Reported by 3 outlets
AI agent hacks expose liability law gaps
Policymakers and legal experts debate which laws can hold AI companies accountable for agent-caused breaches, with no consensus on a path forward.
cyberscoop.com ↗Reported by 2 outlets
Browser-based attacks bypass endpoint security tools.
Attackers can steal browser sessions and abuse extensions without triggering endpoint detection tools that companies rely on.
bleepingcomputer.com ↗Reported by 2 outlets
Google finds AI discovers more remote code execution flaws
Google research shows artificial intelligence is discovering different types of security flaws, with more remote code execution vulnerabilities, than traditional human-led methods.
securityweek.com ↗Reported by 2 outlets
NVIDIA launches open-source AI agent security platform.
NVIDIA released an open-source safety platform for AI agents with backing from over 100 industry partners including Microsoft and JPMorgan Chase to address sandbox-escape and containment risks.
cyberscoop.com ↗Reported by 2 outlets
Fake Zoom installer delivers macOS backdoor to users.
Researchers discovered a fake Zoom installer for macOS that drops a CloudSyncD backdoor, highlighting social engineering risk for employees downloading software outside official channels.
Google restricts accessibility API access on Android 17
Google is blocking a common malware tactic by requiring accessibility tool verification on Android devices enrolled in Advanced Protection.
Microsoft: Attackers gaining AI advantage over defenders
Microsoft reports that threat actors are deploying AI for faster vulnerability discovery and malware development while security teams lag in AI-powered defenses.
Researcher outlines AI agent worm attack theory.
Security researcher Matthew Green describes how independently deployed AI agents could be hijacked and used to spread malicious instructions through shared communication channels like email or package repositories.
Vulnerability disclosures surge to 10000 per month
Google reports vulnerability disclosures have doubled to over 10000 monthly, driven partly by AI tools accelerating discovery.
Persistent AI coworkers break traditional security models
Long-running AI agents with continuous access require new identity and permission frameworks that current security tools do not provide.
Advanced AI models now hijack program control flow in tests
Anthropic and GLM frontier models have crossed a threshold in binary exploitation, with 4-6% success rates at control flow hijacks that earlier models could not achieve.
Attackers scanning for Wordfence-protected WordPress websites
Security sensors detected small-scale scans probing for Wordfence firewall signatures on WordPress sites, likely to identify targets or test bypass techniques.
German authorities use WhatsApp, Signal device linking to monitor suspects.
Police in Germany are using legitimate device-linking features in WhatsApp and Signal to monitor suspects without breaking encryption, requiring either physical phone access or SMS interception.
AI Agents Operating Without Proper Access Controls
Enterprises grant autonomous AI agents broad system privileges but lack adequate auditing mechanisms to monitor their activities for insider threats.
Android banking trojan uses AI to identify high-value targets
Researchers found an Android banking malware operation using Google Gemini to score and prioritize victims based on their financial value.
Researchers improve RSA signature forgery attack speed.
A 2007 attack on unpadded RSA signatures has been implemented more efficiently, forging 1024-bit signatures in months rather than years, but does not affect standard padded RSA use in practice.
The number
organizations reportedly breached by ShinyHunters since 2025, according to FBI Assistant Director Brett Leatherman
A question for your security lead
How many company-issued iPhones and Macs are running software versions older than iOS 27 and macOS 27, and have those devices received the September 28 Apple emergency update?