Gambit Security Threat Intelligence (blog dated 22 September 2026; interim report) reconstructed an ongoing financially motivated campaign from an exposed staging server: three open-source AI harnesses — Strix (autonomous vuln discovery), Cairn (end-to-end exploitation until shell/admin), and Hermes (orchestration / tactical guidance) — attacked hundreds of online retailers with human operators limited to brief Chinese-language prompts. Marginal cost cited at mean ~US$25.46 across 101 completed scans (range ~US$3–US$79); OpenRouter model spend estimated ~US$12k–US$18k over the observed window. Impact Gambit accounts for includes >600,000 unexpired card records from two victims (Overwatch Data: ~79% US issuers), skimmer scripts ordered against ≥27 named shops and confirmed on 19, and in some cases agent cleanup wiping Magento payment fields or dropping staging/backup tables. Example chain: unauth SQLi → plaintext OTP MFA bypass → web shell → sudo → NFS → AWS Secrets Manager → Magento card DB. Still running as of report; Shadowserver and partners helped notify victims and take down infrastructure. (sources: Gambit Security; Cyber Security News)
Gambit Security — Autonomous AI agents hacking online retailers (~US$25/target) (22 Sep 2026)
ai cloud
Incidents
Tue 22 Sep
Updated Mon 2 Nov
ReversingLabs (report covered 22 September 2026) details the malicious npm package tw-pkgprobe-7731 (publisher twdepprobe7731; 11 different versions published back to back on 14 August 2026; account later removed). Early versions claimed to be an “Authorized bug-bounty research probe (Twilio HackerOne program)” running only in Twilio’s serverless packager sandbox; behaviour instead fingerprints Twilio developer environments, exfiltrates host/process context and environment variables via webhook, later versions specifically target Twilio ACCOUNT_SID/AUTH_TOKEN and inject into node_modules, and some builds probe Twilio-related hosts plus AWS instance metadata. Not affiliated with Twilio; RL assesses it almost certainly violates Twilio HackerOne rules of engagement (no customer/employee data exfiltration). Package no longer present under that publisher as of RL write-up. (source: ReversingLabs blog) Correction (24 Oct 2026): an earlier version said the 11 versions were published over about 45 minutes; ReversingLabs does not give that figure. ReversingLabs says they were published back to back on 14 August. (source: ReversingLabs) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ReversingLabs)
ReversingLabs — malicious npm campaign targeting Twilio developers
breaches identity cloud
Incidents
Tue 22 Sep
Updated Fri 23 Oct
ShinyHunters (22 September 2026) claims it breached FBI systems using an alleged Oracle PeopleSoft remote-code-execution zero-day and stole employee and applicant data. The group shared a screenshot of apply.fbijobs.gov allegedly defaced with its Umbreon logo; the jobs/special-agent portals later showed maintenance. 404 Media reports receiving a sample of agent names, home addresses, and phone numbers (including spouses) and verifying a portion against public records; TechCrunch and BleepingComputer relay the claim. BleepingComputer states it has not independently verified the alleged zero-day, lateral movement, or volume of stolen data. UPDATE 26 Sep 2026: BleepingComputer reports the FBI confirmed it is investigating the claims without confirming a breach or data theft. Separate Google Mandiant/GTIG report the same week documents renewed UNC6240 mass exploitation of already-patched CVE-2026-35273 (PeopleSoft PeopleTools PSEMHUB) with WAF-bypass encoding and SIDEEYE — that campaign is covered on /n/cve-2026-35273; unclear if the FBI claim is that CVE or a distinct flaw. (sources: BleepingComputer; TechCrunch) Switch primary_url if FBI or Oracle publishes a confirmed notice. CORRECTION (21 Oct 2026): we removed two later updates, a 30 September update quoting ShinyHunters' statements to the media and a 6 October update saying the FBI removed an Accenture contractor, because the stories they relied on were not linked or could not be read. They will return only with readable linked sources. Correction (23 Oct 2026): removed ShinyHunters' own claims about data volume, systems reached and other targets; BleepingComputer says it has not verified them. (source: BleepingComputer)
BleepingComputer — ShinyHunters claims FBI / PeopleSoft breach (22 Sep 2026)
breaches identity cloud
Microsoft On the Issues / Digital Crimes Unit (22 September 2026) and Microsoft Threat Intelligence (“Unmasking EvilTokens”) detail disruption of EvilTokens, a phishing-as-a-service platform Microsoft tracks as Storm-2992. The service abused OAuth 2.0 device-code authentication against Microsoft’s legitimate sign-in flow (MFA-bypass style session/token theft without password capture) and centred an AI-style chatbot that analysed compromised mailboxes to pick BEC targets, impersonation paths, and fraud plays. Microsoft links >12,000 compromised inboxes across >10,000 organisations since the Feb 2026 launch; highest victim concentrations include the United States, Canada, the United Kingdom, Australia, India, and France. Partners helped seize ~50 operator sites and disable 150+ related domains; UK Metropolitan Police arrested two suspected administrators. Sold via Telegram (~US$1,500 init + US$500/month). (sources: Microsoft On the Issues; BleepingComputer)
Microsoft On the Issues — Disrupting EvilTokens (22 Sep 2026)
ai identity australia
Incidents
Mon 21 Sep
Updated Tue 27 Oct
DriveWealth says the incident was contained on 5 September 2026 (DriveWealth notice of data breach, filed with the California Attorney General; see the DriveWealth update below). Stake, the Sydney-founded investing platform, told customers on 21 September 2026 that DriveWealth, the US broker that provides execution, custody and clearing for Stake Wall St accounts, had a cyber incident that affected some Stake customers' personal information. Stake says the information involved varies by person and may include name, email address, phone number and postal address; W-8 or W-9 tax status and country of taxation; the DriveWealth (Stake Wall St) account number; and aggregate snapshots of portfolio value, cash balance and buying power. It says Stake login credentials, tax file numbers and other government ID numbers, bank account details, identity documents, individual holdings and trading history were not accessed, that Stake's own systems were not affected, and that DriveWealth reported no unauthorised trading, transfers or withdrawals. People who opened a Stake Wall St account but no longer use it may also be affected. Stake is emailing affected customers. New Zealand's Hatch and the UK's Freetrade (for former Stake UK customers) have issued similar notices about the same DriveWealth incident. Stake has not said how many Australians are affected. (sources: Stake; DriveWealth breach notice) Updated 25 Sep 2026 (Nine.com.au, 10:28 am Perth): Nine reported that Stake apologised to customers and said it was working with DriveWealth to understand the extent of the incident. Updated (DriveWealth notice of data breach, filed with the California Attorney General): DriveWealth's own breach notice says unauthorised access to its network took place on 4 and 5 September 2026, that it contained the compromise that day, and that its investigation and document review concluded on 28 September. Correction (26 Oct 2026): Nine.com.au's report and DriveWealth's notice, both later than Stake's 21 September statement, now carry Updated lines. (source: Stake; Nine.com.au; DriveWealth) Correction (26 Oct 2026): the card now leads with DriveWealth's statement, in its linked breach notice, that the incident was contained on 5 September 2026; no linked source gives a different date. (source: DriveWealth)
Stake — DriveWealth Data Security Incident (21 Sep 2026)
breaches australia identity
Incidents
Mon 21 Sep
Updated Mon 26 Oct
Qantas is investigating a possible security breach after some Qantas Hotels customers were targeted by WhatsApp phishing messages, Australian Aviation reported on 21 September 2026. Qantas said it was investigating reports of phishing attempts targeting some Qantas Hotels customers, that anyone who receives a suspicious WhatsApp message claiming to be from a hotel should ignore it, that Qantas Hotels and its accommodation partners will never ask customers to verify a booking or provide personal details via WhatsApp, and that customers concerned about a booking should check Qantas.com or the Qantas app; it also said it never asks customers for passwords. Capella Sydney said it was aware of reports from guests who had received suspicious WhatsApp messages requesting payment and credit card details in relation to their reservations, and confirmed the messages did not come from the hotel. According to Australian Aviation, the Australian Financial Review broke the news the previous week, and neither Qantas nor Capella Sydney had any further update. No threat actor has been identified, and neither company has said how the senders knew who had a booking. The campaign follows the 2025 breach in which more than five million Qantas customers' data was compromised. (source: Australian Aviation) Correction (26 Oct 2026): the card date has moved from 17 to 21 September 2026, the date of Australian Aviation's report; the Financial Review report the card was first dated by is not linked. Qantas's scams page cannot be read by Cyberstack, so details only it gave (a September 2026 entry for the campaign and its mention of countdowns and cancellation threats) have been removed, along with a description of the messages quoting hotel names and booking dates, which Australian Aviation does not give. (source: Australian Aviation)
Australian Aviation — Qantas investigates WhatsApp phishing reports targeting customers (21 Sep 2026)
breaches australia
Incidents
Mon 21 Sep
Updated Fri 30 Oct
A Canva spokesperson told Capital Brief on 21 September 2026 that unauthorised access to Canny, a third-party customer-feedback tool Canva used, 'allowed access to limited enterprise customer information through its connection to our Salesforce account, including business contact details and contract information'. Canva said it immediately removed Canny's access and took steps to notify affected customers, and that its own platform was not compromised and Canva accounts, passwords, designs and content were not accessed. Capital Brief reported that Canny told Canva on 29 August that it was investigating unauthorised access to its systems. On 19 October Cyber Daily reported that Canva had disclosed that 'some enterprise customer records' were exposed in an incident affecting one of its third-party data tools. The Seven Deadly Sins claimed the attack, according to Cyber Daily. (sources: Capital Brief; Cyber Daily) Correction (30 Oct 2026): removed material from VRChat's notice and from the login-only part of Cyber Daily's report; card date moved to 21 Sep 2026, the date of Capital Brief's report. (source: Capital Brief)
Capital Brief — Canva enterprise customer data exposed in third-party breach (Canva statement, 21 Sep 2026)
australia cloud
GreyNoise (Andrew Thompson, Mark Mager; 21 September 2026) tracks a suspected Chinese-speaking malicious cyber actor (“Kapibala” tooling) that from ~20 July 2026 exploited the WordPress wp2shell chain CVE-2026-63030 and CVE-2026-60137 against ≥49 organisations in 29 countries (SMB and government). In the most serious observed intrusion against a western government victim, the actor deployed a custom webshell/plugin, created a hidden admin, harvested credentials, pivoted to an internal SQL server, and downloaded ≥18,566 records including accounts, plaintext passwords, and PII tied to law enforcement/government agencies (timeline on 22 July 2026). GreyNoise also observed the same actor targeting Zyxel GS1900 switches (996 devices / 48 countries compromised or had sensitive data exfiltrated) — related context: cve-2026-7273 KEV card. (sources: GreyNoise blog; Cyber Security News)
GreyNoise — Open Season on Kapibala / WordPress wp2shell gov theft (21 Sep 2026)
breaches cloud network
CloudSEK (Vikas Kundu; Adversary Intelligence; datePublished 21 September 2026, also dated 20 Sep on page) documents GHAPPIER, a previously unreported loader family spanning at least 65 public GitHub repositories, 73 infected files, and 22 accounts. The investigation began when an intruder used the maintainer account of legitimate npm package @dforge-core/dforge-mcp for ~105 minutes on 9 September 2026, inserted a remote loader, and abused the project’s GitHub Actions trusted-publishing workflow so malicious version 0.2.21 shipped with valid npm provenance/Sigstore attestation; it remained the latest release for ~35 minutes before the maintainer restored clean 0.2.22. CloudSEK maps wider infrastructure and links parts of the activity beside DPRK’s PolinRider campaign. (sources: CloudSEK blog; Cyber Security News)
CloudSEK — GHAPPIER loader / npm trusted-publishing compromise (20–21 Sep 2026)
breaches cloud identity
BleepingComputer (21 September 2026) reports BigCommerce alerted merchants after attackers compromised credentials for third-party Ribon and Ribon 1.5 applications (owned/operated by Be A Part Of, a Fastr company) and used them to inject malicious scripts into a small number of merchant storefronts. BigCommerce told BleepingComputer it confirmed the credential compromise on 17 September 2026, uninstalled the apps from affected stores to revoke attacker access, notified merchants, and is providing log data for the developer investigation; it stated BigCommerce platform systems were not breached. UK spirits retailer Master of Malt says shopper data (full names, email, phone, shipping postal addresses) in its BigCommerce environment was accessed between 13 and 17 September and that it reported to the UK ICO; it attributes access to a compromised BigCommerce application key held by Ribon. BigCommerce says account passwords and payment card data are stored separately and were not exposed in this pattern. Australia relevance: BigCommerce merchants and any store using Ribon-class experience apps — rotate app keys, review storefront script injections, and run NDB assessment if Australian personal information was in scope.
BleepingComputer — BigCommerce alerts merchants (Ribon apps; 21 Sep 2026)
breaches cloud
Incidents
Mon 21 Sep
Updated Fri 30 Oct
Kaspersky's Global Emergency Response Team (GERT) reported on Securelist on 21 September 2026 on an April 2026 incident at a manufacturing organisation in the Middle East, where the attacker gained domain admin-equivalent control of Active Directory and linked a malicious Group Policy Object (GPO) named PAYLOAD at the domain root. Through that one object the attacker delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware Kaspersky found in the incident was a PAYLOAD sample targeting ESXi on Linux servers. Kaspersky says data was also stolen and later published. Initial access was a valid but compromised domain account used to log in through the organisation's FortiGate SSL VPN; Kaspersky could not reconstruct how the credential was stolen and considered password spraying or credential stuffing, phishing, and purchase from an initial access broker. The PAYLOAD GPO dropped a SYSVOL hello.txt onto desktops and the C:\ and D:\ roots as a read-only README-payload.txt, set the logon banner text to the ransom note, set payload.jpg from SYSVOL as the lock screen and wallpaper, and disabled the administrator account through the Security Settings extension. A second domain-root GPO, “win Firewall Off”, disabled Windows Firewall on the domain, private and public profiles. The policies were written and cached on endpoints on 13 April but only took effect when machines rebooted on 14 April. Kaspersky confirmed that no files were encrypted on Windows machines and none carried a .payload extension, that no endpoint persistence was established and that no malicious processes were running at the time of analysis; the persistence was the GPO link on the domain controller. Defensive focus: directory service change auditing (gPLink changes at the domain root), SYSVOL file integrity (unexpected images, text files, registry.pol/GptTmpl.inf) and the Group Policy Operational log on endpoints. Kaspersky says public analysis of PAYLOAD Windows samples shows event log clearing, security process and service termination, and shadow copy deletion; these were not confirmed as having run in this GPO-based incident. No CVE. (source: Securelist) Correction (30 Oct 2026): removed Cyber Security News as a source; the card now carries only what Securelist's report states. (source: Securelist)
Kaspersky Securelist — PAYLOAD ransomware via Active Directory GPO (21 Sep 2026)
breaches identity network
Incidents
Sat 19 Sep
Updated Mon 26 Oct
Colorado Governor Jared Polis’s office said in a statement carried by KRDO (18 September 2026, 5:23 pm US Mountain time; 19 September, 7:23 am Perth) that foreign actors were involved in cybersecurity incidents at two small, private water providers serving fewer than 200 people. The incidents involved individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles. The governor’s office says the incidents were brief, the providers quickly addressed the risks and notified the state in late August, CDPHE followed up with each provider, and to its knowledge treatment processes and water quality were not affected and there was no impact to public safety; the providers were not named. It says it cannot confirm which foreign actors were involved but is aware, per CISA, of ongoing efforts by an Iranian-backed group to access US drinking water and wastewater systems. Broader context: FBI/EPA Public Service Announcement I-073026-PSA (30 July 2026) warns that malicious actors have been targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the water and wastewater sector across multiple US states since late July 2026, changing device IPs and passwords and degrading monitoring and control. Australia relevance: the same internet-facing PLC / weak remote-access pattern applies to AU water and wastewater operators — remove PLCs from direct internet exposure, enforce unique passwords and ACLs, and keep manual-operation readiness per FBI/EPA guidance. Correction (26 Oct 2026): removed the SecurityWeek credit and link; the incident details are credited to the governor’s office statement as carried by KRDO, and the card no longer says the systems were accessed in late August — the providers notified the state then. The card date has moved from 18 to 19 September 2026, the Perth date of KRDO's report (18 September, 23:23 UTC; 19 September, 7:23 am Perth time (AWST)). (source: KRDO)
KRDO — Colorado governor’s office statement (18 Sep 2026 US Mountain; 19 Sep Perth)
breaches ot ics
