Incidents
Thu 15 Oct
Updated Tue 3 Nov
The Citizen Lab (University of Toronto) published report 195 on 15 October 2026, which it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertising. It names the technique AdFection. Devices at the international news network Al Jazeera were infected with spyware from Candiru, the Israeli vendor now rebranded as Integrity Labs, through ads bought by Discover-Tech, an Israeli company that presents itself as an ordinary ad firm. Each ad carried a small script that sent the device's advertising ID and IP address to a Discover-Tech server as soon as the ad rendered, sometimes out of sight. Selected devices were then sent attack code; others got nothing, so the ad networks had nothing harmful to detect. Al Jazeera's network logs showed the same sequence on infected devices: a Discover-Tech ad server, then a Candiru screening server, then command-and-control. Citizen Lab says at least 45 Al Jazeera devices were targeted in 2024 and 2025, and that a Windows DLL recovered from one compromised device is a newer version of the Candiru attack chain it captured in 2021. The browser or app exploit used for the first break-in was not recovered, and Citizen Lab has not named the government customer. Discover-Tech's bidding records (about four billion bids, March to June 2026) show ads carrying the attacker script on 75,373 Android and iOS apps and 120,768 websites; Confiant, which investigated alongside Citizen Lab, puts its traffic at roughly 10 million ads a day. Impressions appeared on networks of NATO, the UN, EU institutions, defence and government bodies in dozens of countries, and critical infrastructure. Australian angle: the report describes a 'substantial cluster' of impressions in Australia, including government and private-sector networks in critical infrastructure such as grid and power companies, and university and research networks including the Australian Nuclear Science and Technology Organisation (ANSTO) and the Australian Synchrotron. Citizen Lab stresses that an impression alone does not confirm targeting or infection, but says these networks warrant urgent investigation. Google and IAB Europe had listed Discover-Tech as a certified or approved ad vendor since 2020. After the findings were shared they removed it in early October (IAB Europe on 8 October), Google cut its ad-exchange access, Beeswax removed it, Vungle (Liftoff) paused it and Eskimi blocked its accounts. (sources: Citizen Lab report; Confiant) Update 16 Oct (iTnews): ANSTO said it is aware of the reports including the Australian Synchrotron reference, is following standard response processes, and has not identified any impact to its facilities, systems or information from the techniques described. The ads also appeared on networks of three Australian media organisations (unnamed in the Citizen Lab report). Further detail (iTnews, 16 Oct): Confiant, which published its own report alongside Citizen Lab, said the ads it linked to Candiru were a tiny fraction of Discover-Tech's activity, and Australia was not among the nine countries where it saw devices handed over to Candiru's systems. Citizen Lab's data shows Discover-Tech bid 3.77 billion times between March and June 2026 and won about 442 million auctions. Correction (02 Nov 2026): removed The Hacker News as a source. (source: Citizen Lab)
Citizen Lab — Exposing AdFection: How Discover-Tech turned targeted ads into a pipeline for zero-click mercenary spyware (Report 195, 15 Oct 2026)
breaches australia
Incidents
Wed 14 Oct
Updated Mon 2 Nov
Cisco Talos published joint research with Recorded Future's Insikt Group on 14 October 2026 on UAT-6275 (Recorded Future: TAG-193), activity that overlaps with the group publicly known as Silent Lynx. Talos assesses with medium confidence that the group has a Kazakhstan nexus, based on infrastructure access, language artefacts, sample submissions, working-hours analysis and targeting. Between June 2025 and August 2026 Talos saw four infection chains against government organisations across the Commonwealth of Independent States: macro-enabled Word documents (June 2025); PS2EXE-built downloaders that fetch reverse shells and add scheduled tasks (July 2025); LNK shortcuts in RAR archives that run a GitHub-hosted PowerShell script (October 2025); and, from April 2026, RAR archives exploiting the WinRAR path-traversal flaw CVE-2025-8088 to drop the PickleShell reverse shell into the Windows Startup folder. That is the first vulnerability exploit Talos has seen in the group's malware delivery. Payloads are lightweight custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Lures included a diplomatic letter to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form and a proposal involving Russia's Orsk Oil Refinery, with additional interest in water resources, the environment and energy. Phishing emails were sent from compromised government accounts. Three publicly exposed staging directories and an unreported GitHub repository revealed payload builds and C2 changes. They also held Linux tooling and a public exploit for the FortiWeb SQL injection CVE-2025-25257, suggesting plans to target Linux hosts and internet-facing appliances. Talos believes UAT-6275 and YoroTrooper are likely part of the same broader cluster but tracks them separately. (sources: Cisco Talos; Recorded Future Insikt Group) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Cisco Talos; Recorded Future)
Cisco Talos — Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (14 Oct 2026)
breaches
Incidents
Wed 14 Oct
Updated Tue 27 Oct
The UK Ministry of Justice published an update on 14 October 2026 on the cyber-attack it identified on 23 April 2025 against the Legal Aid Agency (LAA), the executive agency that runs legal aid in England and Wales. By 16 May 2025 the MoJ had established that the criminal group behind the attack had exfiltrated a large amount of personal data about legal aid applicants and providers. Further forensic analysis now shows that most of the stolen data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period, but about 250,000 records predate 2007. Most of those are from the 1990s and 2000s, a very small number predate 1990, and the earliest verified record is from 1978. The analysis also found that probation data from HM Prison and Probation Service was in the exfiltrated material; the MoJ says none of it relates to victims of crime. Earlier disclosures listed applicant contact details, dates of birth, national ID numbers, criminal history, employment status and financial details such as contributions, debts and payments, plus provider contracts, financial information and LAA Online Portal credentials. The MoJ says the data involved varies greatly between individuals, a pre-2007 record does not mean everyone who dealt with legal aid back then is affected, and it has no indication the stolen data has been published or shared. It is working with the National Crime Agency, the NCSC and the Information Commission. A Ministry of Justice spokesperson told BleepingComputer it is now investing more than £200 million in modernising legal aid digital services and cyber security. (sources: GOV.UK notice; BleepingComputer) Updated 15 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 15 October 2026; details credited to BleepingComputer on this card come from that report.
GOV.UK (Ministry of Justice) — Legal Aid Agency cyber security incident data update October 2026 (14 Oct 2026)
breaches
Incidents
Wed 14 Oct
Updated Sun 25 Oct
On 14 October 2026 Microsoft's Digital Crimes Unit, with Health-ISAC, said a US District Court for the Southern District of Florida order let them seize and redirect domains powering YAM Store (Storm-3119), CoGUI and Iron Man (Storm-2990 phishing kits) — a Chinese-language cybercrime marketplace that sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage, plus ready-made phishing kits. Since January 2026 the three services enabled more than one billion malicious messages targeting over 75,000 organisations and consumers in more than 150 countries, including more than 750 million messages aimed at Microsoft customers, generating tens of millions of dollars for operators. Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains. The investigation began in late 2025 after Japan's National Police Agency flagged campaigns against Japanese victims; JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and US/international law enforcement later joined. YAM Store acted as an access broker: operators bought expired organisation domains (often non-profit and education), rebuilt sites to look live, fraudulently obtained Microsoft 365 tenants, and resold them; AI tools were also used to invent fake organisations. Iron Man (advertised on YAM Store from June 2026) overtook CoGUI with more than 2,300 lure templates across 130+ countries/areas — Microsoft and Resecurity both cite Australia Post package-delivery SMS templates among the samples, alongside ANZ rewards web lures in Microsoft's illustration set. Kits support device-code phishing, geofencing, fake CAPTCHA and live OTP capture. (sources: Microsoft DCU blog; BleepingComputer)
Microsoft Digital Crimes Unit — Disrupting the service economy behind transnational cybercrime operations (14 Oct 2026)
breaches identity australia
Incidents
Wed 14 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added Crunchbase on 14 October 2026 (06:01 UTC; 14:01 Perth time). HIBP says the private company intelligence platform was targeted in a ShinyHunters 'pay or leak' extortion attempt in January 2026, and that data allegedly obtained from the company was then published, including about 560,000 unique email addresses, largely of leads and business contacts, along with names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. In a statement reported by Security Affairs on 26 January 2026, Crunchbase said it "detected a cybersecurity incident where a threat actor exfiltrated certain documents from our corporate network", that no business operations were disrupted, that the incident was contained, that it engaged cybersecurity experts and contacted federal law enforcement, and that it was reviewing the impacted information to decide whether any notifications were required. Australian contacts are not separately stated. UPDATE 22 Oct 2026: re-sourced Crunchbase's acknowledgement to Security Affairs and attributed the data details to Have I Been Pwned (source: Security Affairs, 26 Jan 2026).
Have I Been Pwned — Crunchbase breach (added 14 Oct 2026 UTC; breach January 2026)
breaches identity
Incidents
Wed 14 Oct
Updated Sat 31 Oct
Western Australia's Mandurah State Emergency Service (Mandurah SES) unit has confirmed it is responding to a cyber incident, after it was informed by state government authorities, Cyber Daily reported on 14 October 2026. Cyber Daily says past and present members have been notified of the incident. The Gentlemen claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (31 Oct 2026): removed material from the login-only part of Cyber Daily's report and a time taken from page metadata; the card now carries only what the readable part states. (source: Cyber Daily)
Cyber Daily — Exclusive: Mandurah SES confirms operations unaffected by ransomware attack (14 Oct 2026)
australia
Incidents
Tue 13 Oct
Updated Tue 27 Oct
The US Department of Justice and Meta announced on 13 October 2026 the results of a 'Joint Disruption Week' against scam networks operating from West Africa, the first coordinated operation focused on the region. The UK National Crime Agency hosted it in London from 6 October with the DOJ, FBI, US Secret Service, Treasury, Homeland Security Investigations, Nigerian and Ghanaian cybercrime units, INTERPOL, and law enforcement from Australia, Canada, New Zealand and India. Industry partners including Meta, Google, Microsoft, OpenAI, Coinbase, Binance, Adobe, Starlink, Chainalysis, Elliptic, TRM Labs, Flashpoint, Silent Push and Cyjax shared intelligence and acted on their own platforms. Meta removed more than 3.7 million Facebook and Instagram accounts, Pages and Groups based in West Africa, most posing as American and British users; Microsoft suspended linked accounts; partners shared leads on more than 30 suspected scam centres and identified over US$11 million in potentially freezable funds, and Coinbase says it stopped more than US$415,000 in losses to 65-plus active victims. Authorities made 28 arrests: in Sasaabi near Accra, Ghana, 19 people were arrested, 303 devices seized, 117 human-trafficking victims identified for repatriation to Nigeria and 89 scam victims with about US$8.3 million in losses found; Nigeria made nine arrests and seized 53 devices. The schemes included law-enforcement impersonation, 'digital arrest' extortion and cryptocurrency investment fraud (pig butchering). Neither announcement names Australian victims. Updated 14 Oct 2026 (Cybersecurity News): Cybersecurity News's report is dated 14 October 2026; details credited to Cybersecurity News on this card come from that report.
US Department of Justice — Results of law enforcement and private industry Joint Disruption Week targeting West African scam networks (13 Oct 2026)
breaches
Huntress reported on 13 October 2026 (14 Oct Perth) a credential-phishing campaign built on a lookalike download site for WatchGuard Mobile VPN with SSL. In an incident it investigated in early October, an administrator at a managed service provider searched Bing for a WatchGuard SSL VPN download and opened the fake site from a normal search result, which Huntress classes as SEO poisoning rather than malvertising. Choosing any download option opened a prompt asking for VPN server, login and password; about 150 lines of JavaScript sent the values as JSON to a separate collection server, always rejected the first attempt as 'Incorrect data' to collect a second set, then started a download of the genuine, validly signed WatchGuard Mobile VPN with SSL 12.11.5 installer from WatchGuard's own CDN, so there was no malicious file for endpoint security to flag. The same lookalike domain had been reported by WatchGuard in January with no working back end; it was registered again on 22 August and paired with a new collection domain. Huntress says the main domain was offline as of 13 October and that it notified WatchGuard before publishing. Earlier waves of the same VPN-impersonation activity (including Microsoft's Storm-2561 reporting) used fake signed installers and malicious DLLs instead. This is a phishing campaign against VPN users, not a flaw in WatchGuard products.
Huntress — Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client (13 Oct 2026)
tech identity network
Incidents
Tue 13 Oct
Updated Sun 25 Oct
US authorities announced a new crackdown on North Korean remote IT worker schemes on 13 and 14 October 2026. A four-count indictment charges Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, who were arrested, with helping North Korean IT workers obtain remote jobs by housing and configuring laptops issued by US employers so the workers appeared to be in the US. Prosecutors say the scheme ran from 2019 to July 2025, generated more than US$3 million and placed workers at over 70 US companies in communications, cyber support, healthcare, manufacturing and retail; ten China-based people are also charged. Separately, in Operation Lonestar Roundup, the FBI searched over 40 residences in Texas between 21 and 25 September that were known or suspected laptop farms, and seized approximately 187 laptops and KVM devices, according to the Justice Department. CrowdStrike, which tracks the activity as Famous Chollima and assisted the operation, says victims of the disrupted clusters span aerospace, energy, financial services, healthcare, cybersecurity, defence engineering, government technology and consumer technology, and expects the disruption to be short-lived. The FBI's new public service announcement (PSA261013) warns the workers increasingly pay witting and unwitting US residents to appear on camera, sit interviews, verify identities, ship packages or keep company devices online from home, and recommends layered identity checks across the employment lifecycle. No Australian victims are named. (sources: FBI IC3 PSA; US Justice Department release)
FBI IC3 — North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (PSA261013, 13 Oct 2026)
breaches identity
Incidents
Tue 13 Oct
Updated Tue 3 Nov
The US Department of Justice said in a press release on 13 October 2026 that Abdulrahman Alfozan, 35, a Saudi national who had worked as an OpenAI engineer since July 2025, was arrested on 9 October and charged with using or trying to use a device to intercept oral communications. According to the complaint, OpenAI staff found a covert audio recording device on 30 September plugged into a USB port behind a television in an executive conference room in one of its San Francisco buildings. The device was wrapped in toilet paper, had been installed around 28 September and stored encrypted data. The room was used for meetings on proprietary research, product plans, business relationships and government work. Prosecutors say camera footage showed Alfozan near the room several times though he was not invited to meetings there; that he searched an internal productivity tool for office, meeting-room and executive schedule details; that a chatbot account linked to his spouse asked how to build and hide recording devices, including prompts naming the device's custom header and MAC address; and that on 5 October he returned to check behind the television, the same day security staff found a second similar recorder in a bag he left in another room. The charge carries up to five years in prison. UPDATE (19 Oct US time; Reuters via iTnews, 20 Oct): asking a judge to keep Alfozan in custody as a flight risk, federal prosecutors allege in a detention memo that he was in frequent contact with an unnamed member of the Saudi royal family, who had tried to recruit him for an AI role in Saudi Arabia, and that a Saudi military official paid for one-way flights for his wife and young son to return to Saudi Arabia after his arrest. Prosecutors say he built customised, encrypted recording devices to secretly record highly sensitive meetings involving senior OpenAI staff, business counterparts and government officials; meetings with government officials took place in the conference room around the time the device was installed. Before his arrest he had planned to fly to Riyadh during two months of parental leave. Prosecutors say the investigation remains active and further charges could follow. His lawyer says the planned trip was booked before any investigation, for family and immigration reasons, and has asked for his release on conditions; the Saudi government media office did not respond to Reuters. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: US Department of Justice; iTnews)
US Department of Justice — Saudi national arrested for installing surreptitious audio recording device at OpenAI (13 Oct 2026)
breaches ai
Incidents
Tue 13 Oct
Updated Thu 22 Oct
The UK Housing Ombudsman Service, the public body that settles disputes between social housing residents and landlords in England, said on 13 October 2026 that a third-party IT security incident affected its case management system. It says the incident is contained and it is working with its external supplier to establish the facts, including the extent of the data involved, and is still investigating whether personal information was affected. In an email bulletin sent the same day (13 October, 11:20 BST), it told recipients that "some contact details such as name, address, telephone number and postal addresses may have been copied" from its system and that this may include their data. It has reported the incident to the Information Commissioner's Office. While systems are restored, residents cannot submit a new complaint, view an existing complaint or use web chat and the web form, and are asked to email or phone instead. The service has not named the supplier, and BleepingComputer reported no claim of responsibility. Correction (22 Oct 2026): an earlier version said only that the Ombudsman was checking whether personal data was affected. Its 13 October email bulletin to people on its mailing list says some contact details, such as names, addresses and telephone numbers, may have been copied. (source: Housing Ombudsman Service email bulletin, 13 Oct 2026) UPDATE (22 Oct 2026): Housing Today reported on 21 October that the Ombudsman's online services were still offline, its website notice was unchanged and it had 'no further comment'. (source: Housing Today, 21 Oct 2026)
Housing Ombudsman Service — Statement: IT Security Incident (13 Oct 2026)
breaches
The Foschini Group told JSE shareholders on 13 October 2026 that its UK business, TFG London, identified a cybersecurity incident on 11 October affecting some IT systems for its Phase Eight, Hobbs and Whistles brands. Inside Story and White Stuff are not affected. TFG activated its incident response and business continuity plans, engaged external specialists to contain the incident and reported it to the relevant UK authorities. Stores remain open and trading although several IT systems are still unavailable. The group says TFG Africa and TFG Australia run on separate systems and are not affected. It is still working out whether personal or other sensitive information was compromised and will notify affected people or organisations if so. BleepingComputer found no public claim by a threat actor.
The Foschini Group JSE SENS announcement — Cybersecurity incident at TFG London (13 Oct 2026)
breaches
