2026-11-05

Machine-first view of this brief, grouped by story so indicator streams stay attributable. IoC values are raw, not defanged, one per line, ready for hunt queries — defang before pasting into chat or email. Everything here is public OSINT; exposure and behavior detail lives in the JSON (also grouped per story).

Endpoints

GET /?view=agent&format=json          this brief as JSON (stories, behaviors, exposure, IoCs, watch events)
GET /?view=agent&format=json&d=DATE   a specific day — available: 2026-11-10, 2026-11-09, 2026-11-06, 2026-11-05, 2026-11-04, 2026-11-03, 2026-11-02, 2026-10-30, 2026-10-29, 2026-10-28
GET /?view=iocs&format=json           cumulative IoC corpus — every brief + watch event, all time
GET /?q=TERM&format=json               search every stored brief (stories + IoCs)
GET /?view=cards&format=json          verdict-card manifest (slug, title, lane, cves, story_ids, url)
GET /?view=actors&format=json         adversaries by attributed country (w=14|30|90|all, cat=state|crime|hacktivist|spyware)
GET /cards/<slug>.html                 a hand-written verdict card; /cards/<slug> one the pipeline published; stories here carry verdict_card when one exists

Shapes: log_source is the extractor's free text; log_source_keys beside it is a closed vocabulary
(see vocab.log_source_keys) for mapping to your own data. evidence_samples are the exact strings the
sources printed (replay targets). exposure is null when the sources stated nothing.

P1 · CERT-In flags AI-assisted Crafty Falcon targeting Indian BFSI; backdoored ARTEX Docker image exposes 62 consoles

CERT-In reports an active AI-assisted actor, Crafty Falcon, using offensive AI tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI, fintech and crypto firms, stealing payment gateway/partner-bank API credentials and invoking fund-transfer APIs from victims' allow-listed infrastructure, with theft of keys and funds reported. Tactics include web shells via file-upload/deserialization chains in PHP and Node.js apps, stolen static API tokens, plaintext creds in configs, micro-value test transactions, log deletion and endpoint security tampering. Separately, a copycat ARTEX GitHub repo pulls the backdoored Docker image tomicdd/artex, whose login handler runs a CAPTCHA field beginning with a secret marker through sh -c as root; 62 internet consoles served it. Hunt for web shells, anomalous fund-transfer/settlement API calls and Rs.1 test transactions, log clearing, and any deployment of artex images.

Why P1: Active, ongoing campaign against financial sector with API-credential theft and fraudulent transfers; directly relevant sector.

Behaviors (5) · as of 2026-11-05

Detection guidance (1) · as of 2026-11-05

source · tier B · published 2026-11-05 08:42Z · transaction/API logs

Watch for micro-value test transactions (e.g., Rs. 1) preceding large-value transfers to mule accounts, and API calls from modified client packages.

filename (2)

congdonglinux/artex
tomicdd/artex

url (3)

http://github.com/RuoJi6/ARTEX
http://github.com/mhtsec/ARTEX
http://github.com/trhhubsd/ARTEXX

P1 · Adversaries weaponize public PoCs within hours: cPanel, CopyFail, FortiOS case studies Verdict card

CrowdStrike reports median time from public PoC to in-the-wild exploitation was under one day in H1 2026 (fastest 35 minutes). Case studies: mass exploitation of cPanel/WHM auth bypass CVE-2026-41940 (zero-day since at least April 3, 2026); UMBRAL BISON using a modified CopyFail (CVE-2026-31431) exploit to escalate www-data to root at a Ukrainian government entity and attempt to deploy a Mythic Poseidon agent (terminated by Falcon); STATIC KITTEN hosting a modified CVE-2024-55591 FortiOS exploit with 13 payloads creating backdoor admin/VPN users. Hunt for root password changes/WHM root logins, www-data to root escalation via Python, and rogue FortiOS admins like FortiWiFi, FortiSetup, darlen, offices.

Why P1: Actively exploited internet-facing cPanel and FortiOS bugs plus Linux LPE with concrete backdoor account names to hunt.

Behaviors (6) · as of 2026-11-05

ipv4 (1)

157.20.182.49

sha256 (2)

de8d1b25e8965dc98c62d675ee7c451ed12502194890f6cc691322ad66f3abf4
fd6b46d148af22da6163f18ce43b35ebb827cc6e140f03f0f514bc2a6f548743

filename (1)

POC_ZZ_1.py

P1 · APT29-linked watering hole campaign hijacks Plerdy SEO Tracker script to deliver iOS and Android exploit chains

Sekoia reports that APT29 is presumed behind a watering hole campaign using compromised sites, lookalike domains, and a supply chain compromise of the Plerdy SEO Tracker script (main.js, August 27 to September 3, 2026) to deliver a JavaScript loader that profiles visitors and serves iOS (DarkSword-based) or Android (AndroSnitch) exploit chains. The sources describe exfiltration to ad.starx-net[.]com:8881/telemetry/v12 but do not confirm how many victims were compromised. Hunters should look for outbound connections to that endpoint, requests to a.plerdy[.]com/public/js/click/main.js, and visits to the listed lookalike domains.

Why P1: Concrete network indicators and a supply-chain vector, but the campaign targets mobile browsers and the sources give no endpoint-side detection content. (raised to P1: the same brief carries a P1 item on this campaign)

Behaviors (2) · as of 2026-11-05

domain (4)

ad.starx-net.com
ad-track.live
america250.holiday
a.plerdy.com

url (1)

http://a.plerdy.com/public/js/click/main.js

P1 · Zyxel GS1900 switch zero-day CVE-2026-107441 exploited against ~1,000 devices; original patch ineffective

Binarly reports that CVE-2026-107441, an out-of-bounds write in the CGI program of Zyxel GS1900 series switch firmware, was exploited in the wild as a zero-day to hack almost 1,000 devices, in attacks previously attributed to a Chinese hacking group. According to Zyxel, an unauthenticated attacker can achieve OS command execution via crafted HTTP requests. The brief reports new firmware released for 10 affected models; the source states Zyxel's fixes rolled out October 23 and the advisory was published November 3, while the source reports the earlier CVE-2026-7273 patch did not block this exploitation. Hunters should look for unusual HTTP requests to GS1900 CGI endpoints and unexpected OS command execution on these switches.

Why P1: Actively exploited unauthenticated command execution on internet-facing network devices with a reported ~1,000 compromised devices.

Behaviors (1) · as of 2026-11-05

No IoCs extracted for this story.

P1 · CISA adds patched Apple auth-bypass flaw CVE-2024-27834 to KEV amid reported info-stealer delivery campaign

CISA added CVE-2024-27834, a medium-severity Apple improper authentication (Pointer Authentication bypass) flaw, to its KEV catalog after reports of active exploitation. Sekoia reported that possibly Russia-linked actors, attributed by the source to APT29 with moderate to high confidence, used the flaw alongside previously patched Safari and Chrome vulnerabilities to serve JavaScript that profiles visitors and deploys browser-cookie-stealing malware. Access came via compromised legitimate websites, fake lookalike sites, and a supply-chain attack on Plerdy SEO Tracker. The source does not print specific hunting artifacts, so defenders should focus on patch status for listed Apple builds and on web-based delivery and browser cookie theft behavior.

Why P1: KEV-listed Apple flaw reported in active exploitation with a web delivery chain; patch status is directly checkable.

No IoCs extracted for this story.

P2 · Operation CloudFire: Google Calendar invite phishing uses AiTM proxy to hijack Google sessions, bypass MFA

Since mid-August 2026, an operator used Google Calendar invites (and later Drive share invites) sent from 8,570 compromised sender accounts, with Google /url redirector, share.google, Drive and Intuit links leading through Cloudflare Turnstile to a Nyasher reverse proxy in front of the real Google sign-in page, relaying all MFA factors to capture live sessions. Material Security reports sessions were harvested and took down 897 domains via Cloudflare abuse reporting. Hunters should review Google Workspace audit logs for hijacked-session activity, new OAuth grants, and inbound calendar invites containing google.com/url redirects; an unactivated Microsoft 365 branch exists.

Why P2: AiTM session theft against Google Workspace with huntable audit-log signals; campaign appears dispersed but cheap to rebuild.

Behaviors (4) · as of 2026-11-05

Detection guidance (1) · as of 2026-11-05

source · tier B · Google Workspace audit logs

Hijacked-session evidence appears in Workspace audit logs; be able to revoke sessions, contain OAuth grants and reset accounts within an hour. Treat calendar invites as a threat surface.

No IoCs extracted for this story.

P2 · Cyberattack on refrigeration supplier raised temperatures at three French blood storage sites; EFS says no blood products lost

The French Blood Establishment (EFS) said a cyberattack on its refrigeration equipment supplier, Coolworld Rentals per BleepingComputer, raised temperature and defrost thresholds at three facilities on November 2. Coolworld said attackers exploited a vulnerability in a third-party component in remote monitoring software affecting a limited number of units. EFS reported no health impact or loss of blood products, with plasma transferred or secured, and it works with ANSSI. The article links the activity to wider attacks on Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, but the sources do not confirm the specific vulnerability used at EFS.

Why P2: Operational-technology attack on refrigeration controllers with no published technical behaviors or detection guidance for this specific incident.

No IoCs extracted for this story.

P2 · Six Asian airlines disclose data breaches traced to attack on IT provider Amadeus; no confirmed compromise of airline systems

Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines reported customer data exposure traced to a cyberattack on Spanish IT provider Amadeus. Amadeus said a vulnerability affecting a travel booking display environment exposed booking-display data, with no evidence payment data was accessed, and an airline said the threat actors used login credentials assigned to a system account. The airlines state their own systems and operations were not affected, so hunters should focus on Amadeus-facing account and booking-display activity rather than airline infrastructure.

Why P2: Breach disclosure with a stated credential-misuse vector against a widely used reservation provider, but no published technical detail or detection guidance.

Behaviors (1) · as of 2026-11-05

No IoCs extracted for this story.

P2 · Chainalysis says all users' data exposed in breach involving 'agentic' techniques; perpetrator unidentified

Blockchain analytics firm Chainalysis disclosed a breach first reported October 30 and later said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. The company said some customer passwords were exposed in an on-path attack and some KYT accounts appeared accessed, and it took several products offline. The sources do not identify the attacker or confirm how the attacker used agentic techniques, and Chainalysis said it has no evidence investigations data was accessed; hunters should watch for suspicious logins and token reuse against Chainalysis-hosted services.

Why P2: Breach of a widely used financial-crime analytics provider with exposed live tokens and on-path password interception, but no technical indicators or detection guidance are published.

Behaviors (1) · as of 2026-11-05

No IoCs extracted for this story.

P2 · DreamHost discloses breach of File Manager server exposing customer FTP/SFTP credentials; attacker exploited an unnamed software vulnerability

DreamHost says an unauthorized third party accessed the server running its web-based File Manager at files.dreamhost.com between August 2026 and October 23, 2026, exploiting a vulnerability in that software. The intruder obtained FTP/SFTP usernames and passwords of users who logged into File Manager during that window and may have accessed webmail session information for a limited number of users. The sources report no confirmed access to control panel logins or billing data, and DreamHost says the access was blocked and the vulnerability addressed; hunters should review File Manager server logs, FTP/SFTP auth logs, and webmail forwarding rules.

Why P2: Breach disclosure with no published technical indicators or behaviors beyond exploitation of a web application; hosting-provider credential exposure warrants a hunt for customer-side impact.

No IoCs extracted for this story.

P2 · SonicWall will not patch EoL GMS flaws (CVE-2026-109593 unauthenticated file read, CVE-2026-109594 SQLi) affecting 9.5.2 and earlier

SonicWall says two flaws in end-of-life Global Management System 9.5.2 and earlier will receive no fix; CVE-2026-109593 (CVSS 9.1) is an unauthenticated file read and CVE-2026-109594 (CVSS 6.8) is a post-authentication SQL injection. SonicWall recommends migrating to Network Security Manager (NSM). The source reports a related CVE-2026-102255 SSRF (CVSS 10.0) under active exploitation, with Previdian telemetry showing 2,541 attempts from eight IPs since October 9, 2026, but does not tie those attempts directly to the GMS flaws. Hunters should inventory any GMS instances and review web access for file-read requests.

Why P2: Unpatched EoL product with a 9.1 unauthenticated file read, but no confirmed exploitation of these specific GMS flaws in the source.

No IoCs extracted for this story.

P2 · Barracuda patches chainable auth bypass and command injection in Email Security Gateway; no confirmed exploitation

Barracuda released patches for CVE-2026-116606 (authentication bypass in ESG versions earlier than 9.4.0.030, allowing unauthenticated restore of a crafted configuration backup) and CVE-2026-111560 (administrator-authenticated command injection in the timezone setting, shared with five other Barracuda products). Combined, the flaws can yield root on ESG appliances, and neither advisory states whether they have been exploited in the wild. Defenders should confirm admin interfaces are restricted to trusted networks and that all firmware patches are applied.

Why P2: Chainable path to root on internet-facing email gateway appliances, but sources report no exploitation and no published detection content.

No IoCs extracted for this story.

P2 · APT package manager flaw CVE-2026-109518 lets MitM swap verified packages for code that runs as root; no exploitation reported

A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify HTTP package downloads substitute a checked package with their own, which then runs as root when APT retries failed downloads. Debian, Ubuntu, and APT's developers published advisories on November 4, 2026, with fixed builds for several releases, and Ubuntu still listed all eight tracked releases as vulnerable at 15:46 UTC that day. None of the advisories describe exploitation in the wild or offer a workaround, so hunters should focus on verifying APT versions and retry configuration (Acquire::Retries) rather than on observed attack activity.

Why P2: Root code execution via a widely deployed package manager, but no exploitation reported and no concrete attack telemetry published.

No IoCs extracted for this story.

P2 · GhostMap Android flaw lets permissionless malicious app trigger persistent boot loop (DoS); Google classed it not reproducible, no patch

Bitdefender disclosed GhostMap, a malformed-APK ZIP parsing discrepancy between two Android libraries that lets an app with no permissions and no code force a SIGBUS crash in system_server and a persistent boot loop on a Pixel 10 running Android 17 (August 2026 patch). Google closed the report as Won't Fix (Not Reproducible) and out of scope for a security update. Hunters should look for installation of APKs with malformed ZIP entries that map beyond file contents, and for repeated system_server crashes after installation; the only stated block point is during installation.

Why P2: Device-level DoS with no patch and no published exploitation in the wild; limited huntable telemetry beyond crash loops and malformed APK installs.

No IoCs extracted for this story.

P3 · NIKKE PC launcher scripts tampered on CDN to deliver K2F remote-access and wallet-stealing malware

Attackers modified four JavaScript files on Level Infinite's official CDN (from Sept 27, 2026) used by the Goddess of Victory: NIKKE PC launcher, injecting an obfuscated loader that pulled code from insightjs[.]com / insightjs[.]org. Per researcher MotherSphere, the code abused launcher functionality to run a LuaJIT payload (insight.bundle) that installed the K2F remote-access agent. K2F could execute commands, steal files, screenshots, browser data and credentials, and optionally drop platform_experience_helper.dll with crypto-wallet theft code; whether the DLL was deployed or crypto stolen is unknown. Hunt for DNS/proxy traffic to the insightjs domains, the k2f_chan string in Launcher/intl_service/debug.log, and platform_experience_helper.dll on endpoints.

Why P3: Consumer game supply-chain compromise; relevant only for corporate endpoints with NIKKE installed. Quick DNS/file check.

Behaviors (4) · as of 2026-11-05

Detection guidance (1) · as of 2026-11-05

source · tier B · file content

Check for the string k2f_chan in Launcher/intl_service/debug.log in the NIKKE install directory; indicates Lua agent executed (not DLL load).

filename (2)

insight.bundle
platform_experience_helper.dll

domain (2)

insightjs.org
insightjs.com

P3 · Google attributes XCPE botnet of 1.3 million set-top boxes and IoT devices to Videostrong

Per the brief item, Google attributes the XCPE botnet, which reportedly infected 1.3 million set-top boxes and IoT devices with a backdoor, to Android device maker Videostrong. The brief cites Dark Reading only; no source text was retrieved, so the infection mechanism, command-and-control details, and technical behaviors are unconfirmed. Hunters should treat this as awareness until primary Google or Dark Reading material is reviewed.

Why P3: Awareness only; no retrieved sources and no concrete huntable behaviors in the brief item.

No IoCs extracted for this story.

P3 · Haiou 'prompt adware' hidden in OpenAI Codex jailbreak bundle modifies agent instructions to insert gateway ads

Check Point Research disclosed a Codex jailbreak bundle called Haiou that persistently modifies the Codex agent's global instruction and configuration files so that greetings or activation words trigger advertisements for a third-party OpenAI-compatible LLM gateway. The bundle is distributed via a GitHub repository 'haiou-codex' and bundled within the open-source Codex-X tool. The sources describe configuration-level changes rather than a traditional executable payload and do not report any confirmed compromises; hunters could look for unexpected edits to Codex global instruction files and references to the advertised domain.

Why P3: Adware-style prompt manipulation of AI coding agents with no exploitation or confirmed compromise; awareness only.

domain (1)

zz.aiapi2025.top

P3 · Crédit Mutuel Arkéa confirms cyber heist via unnamed supplier compromise; attackers reportedly moved an estimated $133 million

Crédit Mutuel Arkéa confirmed a 'sophisticated attack' in which hackers compromised an unnamed service provider and then used the bank's own accounts to make transfers to other banking institutions, which the bank says may have enabled conversion to cryptocurrency. The bank declined to confirm the $133 million loss estimate first reported by ZachXBT, said some converted assets were frozen, and said customer accounts were not accessed. No technical indicators, malware, or detection guidance are published in the source, so hunters should focus on unusual outbound transfers from institutional accounts and access paths through third-party service providers.

Why P3: Awareness only: confirmed financial incident with no published technical behaviors, IoCs, or detection guidance.

No IoCs extracted for this story.

P3 · mSecure password manager vendor urges customers to reset passwords and 2FA after cyberattack exposed encrypted customer database

mSeven Software warned current and former mSecure customers on November 3 to change passwords, re-enroll 2FA, and remove passkeys after suspicious activity involving the app. Customer support responses reported by BleepingComputer say an attacker stole an encrypted database from mSecure Cloud, and the company reportedly has no evidence the attacker accessed decrypted vault contents. The company has not disclosed how the breach occurred or what systems were affected, so no technical hunting indicators are available.

Why P3: Breach disclosure with no technical details on intrusion method; awareness only.

No IoCs extracted for this story.

P3 · Canadian extradited to US over 2016-2019 hacks of education institutions for cryptomining; second suspect charged

The DOJ indicted two Canadian nationals, Ryan James Roach and Mathiew James Stubbings, for a campaign running June 2016 to December 2019 that hacked US educational institutions in New York, Tennessee, North Carolina, and Massachusetts. According to prosecutors, the men gained access via virtual private servers in several European countries and compromised computers, then installed cryptomining software on up to 10 machines at peak. Roach was extradited and appeared in federal court; Stubbings' extradition is still pending. Hunters should look for unexpected cryptominer processes on university systems and use of compromised third-party hosts, though the source does not describe specific technical artifacts.

Why P3: Awareness only: prosecution story with no published technical artifacts or detection content.

No IoCs extracted for this story.

P3 · Ukraine fires two senior SBU officials amid corruption probe into bribery protecting scam call centers

Ukraine's Security Service (SBU) dismissed two senior officials, announced by chief Oleksandr Poklad, as NABU and SAPO investigators (Operation Carthage) searched properties linked to several senior security officials. The alleged network of at least 12 people reportedly took bribes from officials to let fraudulent call centers operate without interference, with activity extending to drug trafficking, counterfeiting and violence. The article is a law-enforcement corruption story with no technical intrusion details, so there are no huntable adversary behaviors for defenders.

Why P3: Corruption and fraud-ring news with no technical attack behaviors or indicators; awareness only.

No IoCs extracted for this story.

P3 · Critical Rails Active Storage ImageMagick flaw reported to allow arbitrary file read and write via uploaded images

A brief item attributes to Dark Reading a report of a critical bug in Rails' Active Storage ImageMagick integration that lets attackers write and read arbitrary files through uploaded images, potentially enabling lateral movement. No source could be fetched, so no CVE, affected versions, exploitation status, or hunting details are confirmed. Hunters should verify the advisory and patch level before acting.

Why P3: Unverified single-line brief item with no confirmed exploitation, versions, or huntable behaviors.

No IoCs extracted for this story.

P3 · Vercel rolls out Device Bound Session Credentials to protect against stolen session cookies

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on vercel.com logins, binding sessions to a TPM-held private key so stolen session cookies cannot be reused on other devices. The feature currently works in Chrome on macOS and Windows and complements Chrome's App-Bound Encryption against infostealer cookie theft. The article describes a defensive control with no reported attacker activity; hunters have no adversary behavior to search for from this item.

Why P3: Vendor defensive feature announcement with no described adversary behavior or exploitation.

No IoCs extracted for this story.

P3 · OpenAI pipeline generates 948 Linux local privilege escalation exploits in 30-hour run; no in-the-wild activity reported

OpenAI describes an agentic pipeline using an upcoming cyber-focused AI model that identified 2,308 candidate Linux kernel findings, reproduced 1,724, and produced 948 working local privilege escalation exploits for a commonly used Linux distribution at a cost of $1,213,430 in API credits. The pipeline also includes patch generation and human review before reporting to maintainers. The source describes a research prototype and reports no observed attacker use, so hunters should treat this as a patching and exposure-awareness item rather than an active campaign.

Why P3: Research disclosure of AI-generated Linux LPE exploits with no reported in-the-wild use or specific huntable behaviors; relevant to patch cadence.

No IoCs extracted for this story.

P3 · SentinelOne releases VerifiedIDA, an open-source IDA Pro tool for evidence-linked LLM reverse engineering annotations

SentinelOne Labs announced VerifiedIDA, an open-source standard and IDA Pro implementation that links LLM-generated reverse engineering annotations to supporting evidence. The brief describes it as a tooling release for keeping malware analysis inspectable and reusable, not as a threat or intrusion. No adversary activity, indicators, or detection content is described in the brief.

Why P3: Analyst tooling release with no adversary behavior or huntable artifacts described.

No IoCs extracted for this story.

P3 · Residential proxy services reportedly exit through White House network (AS2650), including Infatica

Krebs on Security, citing Layer3 Intel and Synthient, reports that residential proxy nodes beaconed from the Executive Office of the President network (AS2650) and exited from it 236 times between October 5 and November 3. Layer3 Intel says 28 residential proxy services could exit through this network, and Synthient links the activity to Windows 11 installations of Infatica, an SDK-embedded proxy program. The sources describe a proxy-abuse exposure rather than an intrusion, so hunters should look for unexpected residential proxy software and SDK-bundled applications on government endpoints.

Why P3: Awareness of residential proxy abuse on a government network; no concrete attacker behavior or exploit is described.

No IoCs extracted for this story.

P3 · Apple to scan publicly shared iCloud Photos and Drive links for harmful content from iOS 27.3

Apple's support document, as reported by The Hacker News, says items shared via "Anyone with the Link" in iCloud Photos or iCloud Drive will be checked by Apple for harmful content starting with iOS, iPadOS, macOS and visionOS 27.3. The article notes that such shared items are not end-to-end encrypted even with Advanced Data Protection enabled, and that Apple may block accounts or involve law enforcement. The sources describe no adversary activity, malware, or intrusion, so there is nothing for a defender to hunt on the endpoint.

Why P3: Policy/privacy change to a cloud service with no described attack behavior or exploitation.

No IoCs extracted for this story.

P3 · SANS ISC reports renewed scanning for vulnerable mail test scripts and leftover development artifacts; no confirmed compromises stated

A SANS ISC diary by Johannes Ullrich revisits CVE-2000-0411, a classic CGI mail-script flaw that leaked environment variables, and notes a slight resurgence in honeypot scans for mail-related PHP scripts. The scanned paths include /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php and /mail_config.php, which the author suspects are spammers hunting for arbitrary To-header forms and leftover test scripts. Hunters can review web access logs for requests to these paths and for credential or secret file requests, though the source reports only scanning and does not confirm any successful exploitation.

Why P3: Awareness only: honeypot scanning of legacy test mail scripts with no confirmed exploitation or detailed behaviors.

Detection guidance (1) · as of 2026-11-05

source · tier A · web server access log

Review web server access logs for requests to mail-related test scripts such as /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php, /mail_config.php, /email-test.php and /mailtest.php, as suggested by the author's honeypot observations.

No IoCs extracted for this story.

P3 · Vizio and Samsung smart TVs appear to keep sending viewing data after ACR opt-out, per Northeastern study

A Northeastern University study ('Watching the watchers') tested twelve smart TVs and found Vizio and Samsung TVs appeared to send ACR viewing data to third parties even after users opted out. Vizio traffic went to an Amazon Kinesis endpoint with no observable change on opt-out, and the researchers could not inspect the encrypted payload. Hunters with smart-TV telemetry could look for persistent outbound traffic from these TVs to ACR endpoints after opt-out; the researchers published a blocklist of ACR endpoints, which is not reproduced in the source text.

Why P3: Privacy research on consumer TV data collection; no exploitation or enterprise-relevant adversary behavior.

No IoCs extracted for this story.

Watch streams — new IoCs in the last 48 h

Hackers actively exploit SSHole OpenSSH flaw (CVE-2026-123158) to gain root on Linux systems, confirmed by CISA KEV listing

domain (1)

tac.vpnla.org

filename (1)

TAC Agent

congdonglinux/artex
tomicdd/artex
POC_ZZ_1.py
insight.bundle
platform_experience_helper.dll
TAC Agent

http://github.com/RuoJi6/ARTEX
http://github.com/mhtsec/ARTEX
http://github.com/trhhubsd/ARTEXX
http://a.plerdy.com/public/js/click/main.js

157.20.182.49

de8d1b25e8965dc98c62d675ee7c451ed12502194890f6cc691322ad66f3abf4
fd6b46d148af22da6163f18ce43b35ebb827cc6e140f03f0f514bc2a6f548743

ad.starx-net.com
ad-track.live
america250.holiday
a.plerdy.com
insightjs.org
insightjs.com
zz.aiapi2025.top
tac.vpnla.org