Information

06 Nov

In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days

Information, News

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment. Here are this week’s highlights:  Anthropic adds security center, admin controls to Claude Enterprise Anthropic has rolled out…

Read More
05 Nov

SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

Information

At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analyzed, one behavior has remained consistent: DarkVigil implants are typically deployed through popular Chinese applications. By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe. Until now, how these applications are being abused to achieve execution has remained largely…

Read More
05 Nov

Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns

Information, News

A threat actor has been relying on fake ‘suspended account’ notices to hide phishing content from users revisiting its look-alike bank websites, cybersecurity firm Kela reports. The campaign, active since May, has been relying on more than 300 fake domains, including 248 impersonating 189 US financial institutions. The first were registered in late 2025, but most of them appeared between July and September 2026. As of October 25, 183 of the targeted organizations still had…

Read More
04 Nov

Want to Rent an Internet Address at the White House?

Information, Insights

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the…

Read More
04 Nov

Gorbag: Orcs at the border harvesting intelligence from Ukraine

Information

ESET researchers have been tracking a Russia-aligned threat actor that we named Gorbag. While elements of the group’s tooling – most notably the GIFTEDCROOK infostealer, which CERT-UA attributes to UAC-0226 – have previously appeared in public reporting, Gorbag’s targeting and overall activity have remained largely unexamined. Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front…

Read More
04 Nov

AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks

Information, News

AI-related cyberattacks are surging, with hackers stealing AI access keys to monetize them and using AI tools to speed up their intrusions. Over the past month, at least a dozen AI developer platforms were hit, with the most recent incidents involving CommandCode, Northflank, Trigger.dev, Chainstack, and WorkOS. Across all incidents, the hackers appear to have been hunting for AI access tokens they could monetize, relying on AI agents to speed up and streamline their attacks.…

Read More
03 Nov

When confusion reigns, trusted vendors must guide their SMB customers

Information

Cybersecurity for smaller businesses often suffers by being either underpowered or too complex. This tension can be challenging to resolve for small IT teams that may lack an in-house cyber expert. Understanding the problem is not the same as understanding where the solution lies. Effective SMB protection demands that vendors lead their customers through a clear onboarding process – and offer practical and transparent guidance during incident response engagements. Without trusted partnerships like this, SMBs…

Read More
03 Nov

Android’s November 2026 Updates Patch Over 200 Vulnerabilities

Information, News

Google on Monday announced new security updates for Android that resolve more than 200 vulnerabilities, including two dozen critical-severity issues. The first part of the patches arrives on devices as the 2026-11-01 security patch level and resolves 119 security defects across Android runtime, Framework, and System. Framework received fixes for the largest number of flaws, namely 65, followed by System with 53. Google resolved one high-severity information disclosure bug in Android runtime. According to Google’s…

Read More
02 Nov

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Information, Insights

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based…

Read More
02 Nov

Revolve Data Breach Impacts at Least 180,000 People

Data Breaches, Information, News

Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card information was stolen in a data breach. The incident occurred on September 11 and involved unauthorized access to certain systems, including the company’s online shopping platform. Immediately after learning of the cyberattack, Revolve initiated incident response and contained and remediated the unauthorized activity. The company’s investigation into the incident determined that the hackers may have accessed and exfiltrated the…

Read More