2026-11-05

Developments on tracked stories (17 + 77 low-signal)

The brief — 29 stories · 4 deep reads

P1 · CERT-In flags AI-assisted Crafty Falcon targeting Indian BFSI; backdoored ARTEX Docker image exposes 62 consoles

CERT-In reports an active AI-assisted actor, Crafty Falcon, using offensive AI tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI, fintech and crypto firms, stealing payment gateway/partner-bank API credentials and invoking fund-transfer APIs from victims' allow-listed infrastructure, with theft of keys and funds reported. Tactics include web shells via file-upload/deserialization chains in PHP and Node.js apps, stolen static API tokens, plaintext creds in configs, micro-value test transactions, log deletion and endpoint security tampering. Separately, a copycat ARTEX GitHub repo pulls the backdoored Docker image tomicdd/artex, whose login handler runs a CAPTCHA field beginning with a secret marker through sh -c as root; 62 internet consoles served it. Hunt for web shells, anomalous fund-transfer/settlement API calls and Rs.1 test transactions, log clearing, and any deployment of artex images.

Why P1: Active, ongoing campaign against financial sector with API-credential theft and fraudulent transfers; directly relevant sector. · ATT&CK: T1190, T1505.003, T1552.001, T1078, T1528, T1195.002, T1070, T1059.004, T1133

Deep read — score 10: +6 2 behaviors, +1 3 IoCs, +1 financial relevance, +2 light read P1

Behaviors (5, 3 new)

Published detection guidance (1)

• Watch for micro-value test transactions (e.g., Rs. 1) preceding large-value transfers to mule accounts, and API calls from modified client packages. tier Btransaction/API logs link

IoCs — 5 new

Sources

• The Hacker News — ok

P1 · Adversaries weaponize public PoCs within hours: cPanel, CopyFail, FortiOS case studies — update to 2026-10-29's story

CrowdStrike reports median time from public PoC to in-the-wild exploitation was under one day in H1 2026 (fastest 35 minutes). Case studies: mass exploitation of cPanel/WHM auth bypass CVE-2026-41940 (zero-day since at least April 3, 2026); UMBRAL BISON using a modified CopyFail (CVE-2026-31431) exploit to escalate www-data to root at a Ukrainian government entity and attempt to deploy a Mythic Poseidon agent (terminated by Falcon); STATIC KITTEN hosting a modified CVE-2024-55591 FortiOS exploit with 13 payloads creating backdoor admin/VPN users. Hunt for root password changes/WHM root logins, www-data to root escalation via Python, and rogue FortiOS admins like FortiWiFi, FortiSetup, darlen, offices.

Why P1: Actively exploited internet-facing cPanel and FortiOS bugs plus Linux LPE with concrete backdoor account names to hunt. · ATT&CK: T1190, T1068, T1136.001, T1098, T1087.001, T1069.001, T1059.006, T1027, T1078

Deep read — score 12: +6 2 behaviors, +1 3 IoCs, +2 primary source, +1 financial relevance, +2 light read P1

Behaviors (6, 6 new)

IoCs — 4 new

Sources

• crowdstrike.com — ok

P1 · APT29-linked watering hole campaign hijacks Plerdy SEO Tracker script to deliver iOS and Android exploit chains — update to 2026-11-04's story

Sekoia reports that APT29 is presumed behind a watering hole campaign using compromised sites, lookalike domains, and a supply chain compromise of the Plerdy SEO Tracker script (main.js, August 27 to September 3, 2026) to deliver a JavaScript loader that profiles visitors and serves iOS (DarkSword-based) or Android (AndroSnitch) exploit chains. The sources describe exfiltration to ad.starx-net[.]com:8881/telemetry/v12 but do not confirm how many victims were compromised. Hunters should look for outbound connections to that endpoint, requests to a.plerdy[.]com/public/js/click/main.js, and visits to the listed lookalike domains.

Why P1: Concrete network indicators and a supply-chain vector, but the campaign targets mobile browsers and the sources give no endpoint-side detection content. (raised to P1: the same brief carries a P1 item on this campaign) · ATT&CK: T1189, T1185, T1199, T1190, T1041

Behaviors (2, 0 new)

IoCs — 5 new

Sources

• The Hacker News — ok

P1 · Zyxel GS1900 switch zero-day CVE-2026-107441 exploited against ~1,000 devices; original patch ineffective

Binarly reports that CVE-2026-107441, an out-of-bounds write in the CGI program of Zyxel GS1900 series switch firmware, was exploited in the wild as a zero-day to hack almost 1,000 devices, in attacks previously attributed to a Chinese hacking group. According to Zyxel, an unauthenticated attacker can achieve OS command execution via crafted HTTP requests. The brief reports new firmware released for 10 affected models; the source states Zyxel's fixes rolled out October 23 and the advisory was published November 3, while the source reports the earlier CVE-2026-7273 patch did not block this exploitation. Hunters should look for unusual HTTP requests to GS1900 CGI endpoints and unexpected OS command execution on these switches.

Why P1: Actively exploited unauthenticated command execution on internet-facing network devices with a reported ~1,000 compromised devices. · ATT&CK: T1190, T1059

Behaviors (1, 1 new)

Sources

• SecurityWeek — ok

P2 · Operation CloudFire: Google Calendar invite phishing uses AiTM proxy to hijack Google sessions, bypass MFA

Since mid-August 2026, an operator used Google Calendar invites (and later Drive share invites) sent from 8,570 compromised sender accounts, with Google /url redirector, share.google, Drive and Intuit links leading through Cloudflare Turnstile to a Nyasher reverse proxy in front of the real Google sign-in page, relaying all MFA factors to capture live sessions. Material Security reports sessions were harvested and took down 897 domains via Cloudflare abuse reporting. Hunters should review Google Workspace audit logs for hijacked-session activity, new OAuth grants, and inbound calendar invites containing google.com/url redirects; an unactivated Microsoft 365 branch exists.

Why P2: AiTM session theft against Google Workspace with huntable audit-log signals; campaign appears dispersed but cheap to rebuild. · ATT&CK: T1566.002, T1557, T1539, T1111, T1078.004, T1586.002, T1583.001, T1550.004

Deep read — score 19: +13 5 behaviors (1 inferred), +4 2 detection guidance, +1 financial relevance, +1 light read P2

Behaviors (4, 4 new)

Published detection guidance (1)

• Hijacked-session evidence appears in Workspace audit logs; be able to revoke sessions, contain OAuth grants and reset accounts within an hour. Treat calendar invites as a threat surface. tier BGoogle Workspace audit logs link

Sources

• BleepingComputer — ok

P2 · Six Asian airlines disclose data breaches traced to attack on IT provider Amadeus; no confirmed compromise of airline systems

Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines reported customer data exposure traced to a cyberattack on Spanish IT provider Amadeus. Amadeus said a vulnerability affecting a travel booking display environment exposed booking-display data, with no evidence payment data was accessed, and an airline said the threat actors used login credentials assigned to a system account. The airlines state their own systems and operations were not affected, so hunters should focus on Amadeus-facing account and booking-display activity rather than airline infrastructure.

Why P2: Breach disclosure with a stated credential-misuse vector against a widely used reservation provider, but no published technical detail or detection guidance. · ATT&CK: T1078

Behaviors (1, 0 new)

Sources

• therecord.media — ok

P2 · Chainalysis says all users' data exposed in breach involving 'agentic' techniques; perpetrator unidentified

Blockchain analytics firm Chainalysis disclosed a breach first reported October 30 and later said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. The company said some customer passwords were exposed in an on-path attack and some KYT accounts appeared accessed, and it took several products offline. The sources do not identify the attacker or confirm how the attacker used agentic techniques, and Chainalysis said it has no evidence investigations data was accessed; hunters should watch for suspicious logins and token reuse against Chainalysis-hosted services.

Why P2: Breach of a widely used financial-crime analytics provider with exposed live tokens and on-path password interception, but no technical indicators or detection guidance are published. · ATT&CK: T1557

Behaviors (1, 0 new)

Sources

• therecord.media — ok

P3 · NIKKE PC launcher scripts tampered on CDN to deliver K2F remote-access and wallet-stealing malware

Attackers modified four JavaScript files on Level Infinite's official CDN (from Sept 27, 2026) used by the Goddess of Victory: NIKKE PC launcher, injecting an obfuscated loader that pulled code from insightjs[.]com / insightjs[.]org. Per researcher MotherSphere, the code abused launcher functionality to run a LuaJIT payload (insight.bundle) that installed the K2F remote-access agent. K2F could execute commands, steal files, screenshots, browser data and credentials, and optionally drop platform_experience_helper.dll with crypto-wallet theft code; whether the DLL was deployed or crypto stolen is unknown. Hunt for DNS/proxy traffic to the insightjs domains, the k2f_chan string in Launcher/intl_service/debug.log, and platform_experience_helper.dll on endpoints.

Why P3: Consumer game supply-chain compromise; relevant only for corporate endpoints with NIKKE installed. Quick DNS/file check. · ATT&CK: T1195.002, T1059.007, T1105, T1027, T1113, T1555.003, T1005, T1059

Deep read — score 23: +15 6 behaviors, +4 2 evidence samples, +2 1 detection guidance, +1 4 IoCs, +1 light read P2

Behaviors (4, 4 new)

Evidence samples (1)

Launcher/intl_service/debug.log

Published detection guidance (1)

• Check for the string k2f_chan in Launcher/intl_service/debug.log in the NIKKE install directory; indicates Lua agent executed (not DLL load). tier Bfile content link

IoCs — 4 new

Sources

• BleepingComputer — ok
• wiz.io — ok

P3 · Haiou 'prompt adware' hidden in OpenAI Codex jailbreak bundle modifies agent instructions to insert gateway ads

Check Point Research disclosed a Codex jailbreak bundle called Haiou that persistently modifies the Codex agent's global instruction and configuration files so that greetings or activation words trigger advertisements for a third-party OpenAI-compatible LLM gateway. The bundle is distributed via a GitHub repository 'haiou-codex' and bundled within the open-source Codex-X tool. The sources describe configuration-level changes rather than a traditional executable payload and do not report any confirmed compromises; hunters could look for unexpected edits to Codex global instruction files and references to the advertised domain.

Why P3: Adware-style prompt manipulation of AI coding agents with no exploitation or confirmed compromise; awareness only.

Behaviors (0)

None extracted.

IoCs — 0 new, 1 seen before

Sources

• The Hacker News — ok

P3 · SANS ISC reports renewed scanning for vulnerable mail test scripts and leftover development artifacts; no confirmed compromises stated

A SANS ISC diary by Johannes Ullrich revisits CVE-2000-0411, a classic CGI mail-script flaw that leaked environment variables, and notes a slight resurgence in honeypot scans for mail-related PHP scripts. The scanned paths include /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php and /mail_config.php, which the author suspects are spammers hunting for arbitrary To-header forms and leftover test scripts. Hunters can review web access logs for requests to these paths and for credential or secret file requests, though the source reports only scanning and does not confirm any successful exploitation.

Why P3: Awareness only: honeypot scanning of legacy test mail scripts with no confirmed exploitation or detailed behaviors. · ATT&CK: T1595.002

Behaviors (0)

None extracted.

Published detection guidance (1)

• Review web server access logs for requests to mail-related test scripts such as /sendmail.php, /test-mail.php, /testemail.php, /config/mail_config.php, /mail_config.php, /email-test.php and /mailtest.php, as suggested by the author's honeypot observations. tier Aweb server access log link

Sources

• SANS Internet Storm Center — ok

Quick reads — nothing huntable found (19)

• CISA adds patched Apple auth-bypass flaw CVE-2024-27834 to KEV amid reported info-stealer delivery campaign P1 · CISA added CVE-2024-27834, a medium-severity Apple improper authentication (Pointer Authentication bypass) flaw, to its KEV catalog after reports of active exploitation. Sekoia reported that possibly Russia-linked actors, attributed by the source to APT29 with moderate to high confidence, used the flaw alongside previously patched Safari and Chrome vulnerabilities to serve JavaScript that profiles visitors and deploys browser-cookie-stealing malware. Access came via compromised legitimate websites, fake lookalike sites, and a supply-chain attack on Plerdy SEO Tracker. The source does not print specific hunting artifacts, so defenders should focus on patch status for listed Apple builds and on web-based delivery and browser cookie theft behavior. — continues an earlier item in today's brief
• Cyberattack on refrigeration supplier raised temperatures at three French blood storage sites; EFS says no blood products lost P2 · The French Blood Establishment (EFS) said a cyberattack on its refrigeration equipment supplier, Coolworld Rentals per BleepingComputer, raised temperature and defrost thresholds at three facilities on November 2. Coolworld said attackers exploited a vulnerability in a third-party component in remote monitoring software affecting a limited number of units. EFS reported no health impact or loss of blood products, with plasma transferred or secured, and it works with ANSSI. The article links the activity to wider attacks on Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, but the sources do not confirm the specific vulnerability used at EFS.
• DreamHost discloses breach of File Manager server exposing customer FTP/SFTP credentials; attacker exploited an unnamed software vulnerability P2 · DreamHost says an unauthorized third party accessed the server running its web-based File Manager at files.dreamhost.com between August 2026 and October 23, 2026, exploiting a vulnerability in that software. The intruder obtained FTP/SFTP usernames and passwords of users who logged into File Manager during that window and may have accessed webmail session information for a limited number of users. The sources report no confirmed access to control panel logins or billing data, and DreamHost says the access was blocked and the vulnerability addressed; hunters should review File Manager server logs, FTP/SFTP auth logs, and webmail forwarding rules.
• SonicWall will not patch EoL GMS flaws (CVE-2026-109593 unauthenticated file read, CVE-2026-109594 SQLi) affecting 9.5.2 and earlier P2 · SonicWall says two flaws in end-of-life Global Management System 9.5.2 and earlier will receive no fix; CVE-2026-109593 (CVSS 9.1) is an unauthenticated file read and CVE-2026-109594 (CVSS 6.8) is a post-authentication SQL injection. SonicWall recommends migrating to Network Security Manager (NSM). The source reports a related CVE-2026-102255 SSRF (CVSS 10.0) under active exploitation, with Previdian telemetry showing 2,541 attempts from eight IPs since October 9, 2026, but does not tie those attempts directly to the GMS flaws. Hunters should inventory any GMS instances and review web access for file-read requests.
• Barracuda patches chainable auth bypass and command injection in Email Security Gateway; no confirmed exploitation P2 · Barracuda released patches for CVE-2026-116606 (authentication bypass in ESG versions earlier than 9.4.0.030, allowing unauthenticated restore of a crafted configuration backup) and CVE-2026-111560 (administrator-authenticated command injection in the timezone setting, shared with five other Barracuda products). Combined, the flaws can yield root on ESG appliances, and neither advisory states whether they have been exploited in the wild. Defenders should confirm admin interfaces are restricted to trusted networks and that all firmware patches are applied. — update to 2026-11-04's story
• APT package manager flaw CVE-2026-109518 lets MitM swap verified packages for code that runs as root; no exploitation reported P2 · A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify HTTP package downloads substitute a checked package with their own, which then runs as root when APT retries failed downloads. Debian, Ubuntu, and APT's developers published advisories on November 4, 2026, with fixed builds for several releases, and Ubuntu still listed all eight tracked releases as vulnerable at 15:46 UTC that day. None of the advisories describe exploitation in the wild or offer a workaround, so hunters should focus on verifying APT versions and retry configuration (Acquire::Retries) rather than on observed attack activity.
• GhostMap Android flaw lets permissionless malicious app trigger persistent boot loop (DoS); Google classed it not reproducible, no patch P2 · Bitdefender disclosed GhostMap, a malformed-APK ZIP parsing discrepancy between two Android libraries that lets an app with no permissions and no code force a SIGBUS crash in system_server and a persistent boot loop on a Pixel 10 running Android 17 (August 2026 patch). Google closed the report as Won't Fix (Not Reproducible) and out of scope for a security update. Hunters should look for installation of APKs with malformed ZIP entries that map beyond file contents, and for repeated system_server crashes after installation; the only stated block point is during installation.
• Google attributes XCPE botnet of 1.3 million set-top boxes and IoT devices to Videostrong P3 · Per the brief item, Google attributes the XCPE botnet, which reportedly infected 1.3 million set-top boxes and IoT devices with a backdoor, to Android device maker Videostrong. The brief cites Dark Reading only; no source text was retrieved, so the infection mechanism, command-and-control details, and technical behaviors are unconfirmed. Hunters should treat this as awareness until primary Google or Dark Reading material is reviewed.
• Crédit Mutuel Arkéa confirms cyber heist via unnamed supplier compromise; attackers reportedly moved an estimated $133 million P3 · Crédit Mutuel Arkéa confirmed a 'sophisticated attack' in which hackers compromised an unnamed service provider and then used the bank's own accounts to make transfers to other banking institutions, which the bank says may have enabled conversion to cryptocurrency. The bank declined to confirm the $133 million loss estimate first reported by ZachXBT, said some converted assets were frozen, and said customer accounts were not accessed. No technical indicators, malware, or detection guidance are published in the source, so hunters should focus on unusual outbound transfers from institutional accounts and access paths through third-party service providers.
• mSecure password manager vendor urges customers to reset passwords and 2FA after cyberattack exposed encrypted customer database P3 · mSeven Software warned current and former mSecure customers on November 3 to change passwords, re-enroll 2FA, and remove passkeys after suspicious activity involving the app. Customer support responses reported by BleepingComputer say an attacker stole an encrypted database from mSecure Cloud, and the company reportedly has no evidence the attacker accessed decrypted vault contents. The company has not disclosed how the breach occurred or what systems were affected, so no technical hunting indicators are available.
• Canadian extradited to US over 2016-2019 hacks of education institutions for cryptomining; second suspect charged P3 · The DOJ indicted two Canadian nationals, Ryan James Roach and Mathiew James Stubbings, for a campaign running June 2016 to December 2019 that hacked US educational institutions in New York, Tennessee, North Carolina, and Massachusetts. According to prosecutors, the men gained access via virtual private servers in several European countries and compromised computers, then installed cryptomining software on up to 10 machines at peak. Roach was extradited and appeared in federal court; Stubbings' extradition is still pending. Hunters should look for unexpected cryptominer processes on university systems and use of compromised third-party hosts, though the source does not describe specific technical artifacts.
• Ukraine fires two senior SBU officials amid corruption probe into bribery protecting scam call centers P3 · Ukraine's Security Service (SBU) dismissed two senior officials, announced by chief Oleksandr Poklad, as NABU and SAPO investigators (Operation Carthage) searched properties linked to several senior security officials. The alleged network of at least 12 people reportedly took bribes from officials to let fraudulent call centers operate without interference, with activity extending to drug trafficking, counterfeiting and violence. The article is a law-enforcement corruption story with no technical intrusion details, so there are no huntable adversary behaviors for defenders.
• Critical Rails Active Storage ImageMagick flaw reported to allow arbitrary file read and write via uploaded images P3 · A brief item attributes to Dark Reading a report of a critical bug in Rails' Active Storage ImageMagick integration that lets attackers write and read arbitrary files through uploaded images, potentially enabling lateral movement. No source could be fetched, so no CVE, affected versions, exploitation status, or hunting details are confirmed. Hunters should verify the advisory and patch level before acting.
• Vercel rolls out Device Bound Session Credentials to protect against stolen session cookies P3 · Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on vercel.com logins, binding sessions to a TPM-held private key so stolen session cookies cannot be reused on other devices. The feature currently works in Chrome on macOS and Windows and complements Chrome's App-Bound Encryption against infostealer cookie theft. The article describes a defensive control with no reported attacker activity; hunters have no adversary behavior to search for from this item.
• OpenAI pipeline generates 948 Linux local privilege escalation exploits in 30-hour run; no in-the-wild activity reported P3 · OpenAI describes an agentic pipeline using an upcoming cyber-focused AI model that identified 2,308 candidate Linux kernel findings, reproduced 1,724, and produced 948 working local privilege escalation exploits for a commonly used Linux distribution at a cost of $1,213,430 in API credits. The pipeline also includes patch generation and human review before reporting to maintainers. The source describes a research prototype and reports no observed attacker use, so hunters should treat this as a patching and exposure-awareness item rather than an active campaign.
• SentinelOne releases VerifiedIDA, an open-source IDA Pro tool for evidence-linked LLM reverse engineering annotations P3 · SentinelOne Labs announced VerifiedIDA, an open-source standard and IDA Pro implementation that links LLM-generated reverse engineering annotations to supporting evidence. The brief describes it as a tooling release for keeping malware analysis inspectable and reusable, not as a threat or intrusion. No adversary activity, indicators, or detection content is described in the brief.
• Residential proxy services reportedly exit through White House network (AS2650), including Infatica P3 · Krebs on Security, citing Layer3 Intel and Synthient, reports that residential proxy nodes beaconed from the Executive Office of the President network (AS2650) and exited from it 236 times between October 5 and November 3. Layer3 Intel says 28 residential proxy services could exit through this network, and Synthient links the activity to Windows 11 installations of Infatica, an SDK-embedded proxy program. The sources describe a proxy-abuse exposure rather than an intrusion, so hunters should look for unexpected residential proxy software and SDK-bundled applications on government endpoints.
• Apple to scan publicly shared iCloud Photos and Drive links for harmful content from iOS 27.3 P3 · Apple's support document, as reported by The Hacker News, says items shared via "Anyone with the Link" in iCloud Photos or iCloud Drive will be checked by Apple for harmful content starting with iOS, iPadOS, macOS and visionOS 27.3. The article notes that such shared items are not end-to-end encrypted even with Advanced Data Protection enabled, and that Apple may block accounts or involve law enforcement. The sources describe no adversary activity, malware, or intrusion, so there is nothing for a defender to hunt on the endpoint.
• Vizio and Samsung smart TVs appear to keep sending viewing data after ACR opt-out, per Northeastern study P3 · A Northeastern University study ('Watching the watchers') tested twelve smart TVs and found Vizio and Samsung TVs appeared to send ACR viewing data to third parties even after users opted out. Vizio traffic went to an Amazon Kinesis endpoint with no observable change on opt-out, and the researchers could not inspect the encrypted payload. Hunters with smart-TV telemetry could look for persistent outbound traffic from these TVs to ACR endpoints after opt-out; the researchers published a blocklist of ACR endpoints, which is not reproduced in the source text.