CTM360 has documented a wave of fake gift card giveaways in which scammers impersonate well-known brands and celebrities to draw in consumers. The campaigns use bogus verification steps to harvest personal information and enroll victims in unwanted subscriptions, then monetize the resulting traffic through affiliate networks. For security and brand teams, the findings show how trusted names can be exploited at low cost to fuel fraud, and how affiliate-style revenue models keep such schemes profitable and persistent.
Attackers are seeding counterfeit security tools on GitHub — and infecting legitimate-looking projects — to target cybersecurity professionals. The compromised repositories deliver a backdoor and information-stealing malware to anyone who downloads or runs them. Because the victims are the people who evaluate and deploy security software, the campaign represents a notable supply-chain risk and a reminder to verify code before use.
A newly identified Linux malware, CWPdoor, is being spread through a trojanized version of cwpsrv, the web server component behind the Control Web Panel management interface. Because that component supports server administration, compromise can give attackers a persistent foothold on Linux hosts managed through CWP. The finding matters for teams running CWP, who should treat affected servers as potentially compromised and review the integrity of the installed server component.
The developers of Goddess of Victory: NIKKE confirmed that attackers altered the PC launcher’s scripts in a supply-chain attack and used the compromised launcher to distribute malware. The malware is designed to steal credentials and cryptocurrency wallet data. For security teams, the incident shows how trusted game launcher and update channels can become an effective vector for credential theft and financial fraud, making integrity monitoring and rapid disclosure important.
A phishing operation abused Google Calendar invitations, trusted redirects, and fake sign-in pages to hijack corporate Google sessions and get around multi-factor authentication. Material Security's Operation CloudFire tracked the campaign, blocked malicious messages, and helped with takedown efforts. The technique matters because it relies on trusted Google services and redirects rather than obviously
In October 2026, a new wave of cyber threats targeted US businesses by exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns matter because their impact extends beyond isolated security incidents and raises broader organizational risk. Security teams should view them as enterprise-level threats rather than one-off events.
VulnerabilitiesBreaches & IncidentsThreat IntelligenceRead more →
A Dark Reading video discussion covers security stories the editors did not previously get to, including a poorly conceived phishing simulation involving the Knicks that overstepped acceptable bounds. The conversation also notes a hacktivist attack on a US government agency. For security professionals, the examples underscore the need to scope and govern internal phishing exercises carefully and to treat hacktivist targeting of public-sector systems as a continuing operational risk.
Vercel has begun a gradual rollout of Device Bound Session Credentials across its platform, positioning the mechanism as a primary defense against information-stealer malware that harvests session cookies from compromised machines. The approach ties a session to the device it was issued to, so cookies copied off a victim's machine and replayed elsewhere should no longer grant access on their own. For teams running applications on Vercel, that matters because stolen session tokens have become one of the fastest routes past password and MFA controls, and this shifts some of the burden of that risk onto the platform layer rather than leaving it entirely to application code.
Attackers are circulating bogus invitations to events supposedly hosted by OpenAI, SpaceX, and Anthropic to phish employees, according to the excerpt. The campaigns rely on two phishing-as-a-service platforms to capture Microsoft and Google account credentials as well as authentication sessions. For security teams, this highlights how event-themed lures and session-token theft can turn a routine email into account compromise.
A Russian state-sponsored group is using compromised websites as watering holes to reach mobile users at scale, with thousands exposed to the campaign. Rather than exploiting every visitor, the operators fingerprint each device before deciding which targets merit further attention, then harvest information from those deemed valuable. This pairing of broad reach with selective, low-noise collection matters because it complicates detection for defenders watching mobile traffic and web gateways, and it shows how watering holes are being tuned for mobile audiences.
CISA added a medium-severity vulnerability affecting multiple Apple operating systems to its Known Exploited Vulnerabilities catalog on Wednesday, citing reports of active exploitation. According to the agency, attackers have been using the flaw to deliver information-stealing malware. The vulnerability has already been patched, so the addition signals that defenders should confirm remediation and treat unpatched Apple devices as exposed. Inclusion in the KEV catalog generally carries remediation deadlines for federal agencies and serves as a prioritization cue for other organizations.
APT29 is suspected of running a broad watering-hole campaign that uses compromised websites, fake domains, and a supply-chain compromise of the Ukrainian web analytics service Plerdy SEO Tracker to deliver exploits to iOS and Android users. By turning a widely embedded analytics script into an attack vector, the operation shows how third-party scripts can expose mobile users at scale even on legitimate sites. Security teams should treat analytics and other vendor scripts as high-risk supply-chain dependencies and monitor for related indicators.
Google and its partners have dismantled a botnet spanning roughly 1.3 million devices, according to allegations that Android device maker Videostrong operated the network. The operation reportedly infected set-top boxes and other internet-of-things devices with a backdoor, building infrastructure that could be used for criminal activity. For security professionals, the case highlights the persistent risk posed by poorly secured connected devices and the supply chain, where manufacturer involvement is alleged.
A vulnerability in APT, the package manager used by Debian and Ubuntu, allows an attacker who can modify package downloads to replace a verified package with a malicious one. The attacker’s code then executes with root privileges, according to advisories published November 4 by Debian, Ubuntu, and APT’s developers. This matters because successful exploitation could give an attacker full control of affected systems during package installation or updates.
A China-aligned threat actor tracked as SlippyNunchucks has been linked to a DNS hijacking operation that abuses insecure HTTP communications in the Windows version of Sogou Input Method. The campaign is described as surveillance-oriented and is used to deploy an implant called DarkVigil. The case matters because it shows how a trusted, widely used input-method client and unencrypted network traffic can be turned into a channel for espionage, making plaintext update and lookup paths a priority for defenders to audit.
Yubico has introduced YubiID, a service that links identity verification with credential enrollment and recovery across existing identity platforms, aiming to close a gap that persists even when phishing-resistant authentication is deployed. The company also highlighted a post-quantum YubiKey beta. For security teams, the significance lies in targeting enrollment and recovery, stages that often remain the weak point in otherwise strong authentication setups.
A Russia-aligned group tracked as Gorbag has been using a WinRAR vulnerability to deliver simple data-stealing malware against Ukrainian organizations. The campaign has been active since at least February 2025 and has focused exclusively on Ukraine, with a particular preference for law enforcement targets. The activity matters because it shows continued targeted cyber operations against sensitive Ukrainian institutions and highlights the risk from exploitation of a known archive-tool flaw.
Binance attributed a record-setting $6.43 billion asset theft to a sophisticated, multi-stage campaign that combined a tampered Homebrew installation with recruitment-themed social engineering, including fake job interviews and abuse of AI tools. The incident matters because it shows how trusted software supply chains and hiring workflows can be weaponized to bypass technical defenses. For security and crypto professionals, it underscores the need to verify installer integrity and harden recruitment processes against targeted manipulation.
Google has warned that attackers are hijacking enterprise access to large language models and using it to run expensive AI and cloud services, a tactic called LLMjacking. The company says some organizations have faced cloud charges of up to $1 million as a result. For security and finance teams, this makes compromised model access both a resource-hijacking and cost-control risk, underscoring the need for tight credential controls and usage monitoring.
Researchers at Palo Alto Networks Unit 42 have disclosed a cyber espionage campaign targeting Linux infrastructure tied to government entities and state-affiliated organizations, with activity observed from October 2025 into April. The intrusions involve a tool called SysGoRAT, and the operators are suspected of using AI-generated scripts. The campaign matters because Linux servers in public-sector environments are often less closely monitored than Windows endpoints, and the possible use of AI-assisted scripting