Bleeping Computer

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.

OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19.

The vendor says that it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.

Although the company could not confirm, it said that some servers may have not received and run the malicious script due to update checks occurring at specific intervals.

The attacker leveraged legitimate credentials to gain initial access, although it remains unclear how they were obtained.

“On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN),” OpsShield said.

“The attacker used this access to distribute a malicious script through the cPGuard update channel.”

cPGuard is a Linux web-server security suite offering malware scanning, firewalls, and attack protection.

It is commonly used by hosting firms and server administrators alongside panels such as cPanel, DirectAdmin, and Plesk. Namecheap offers it on VPS and dedicated servers.

Users updating cPGuard during the compromise window received a script that targeted sensitive data on their machines:

• Linux password hashes
• Root database (MariaDB/MySQL) configuration
• Root shell history
• Root SSH authorization and known-hosts files

The stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.

While OpsShield has not established what data was collected from each server, the company's evidence from the investigation shows that the threat actor retrieved 32 files from each customer.

System administrators are advised to update every cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys.

OpsShield notes that updating to the latest cPGuard version removes the backdoor and staged files; however, stolen credentials must be invalidated as soon as possible.

The vendor also said that, as an extra precaution, it would release an update to remove previously installed OpsShield support-access keys.

BleepingComputer has contacted OpsShield to learn more about the attack, and a spokesperson told us that the incident has impacted nearly three thousand servers.

"We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time," the company representative said.

The company also advises customers to follow the instructions and update cPGuard to version 5.88.25 or later, and reset or rotate credentials that may have been exposed on potentially compromised servers.

Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.

According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts.

Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected.

WorkOS is a developer infrastructure company that provides APIs, SDKs, and tools for integrating services such as enterprise authentication, single sign-on (SSO), user management, and identity management into applications.

According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.

“On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert.

Data accessed by the attacker includes:

• Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)
• Customer account histories (product usage and connection or directory health)
• Customer communications (summaries and excerpts from sales calls, support discussions, and customer Slack conversations)
• Business account and relationship information (account histories, information about sales and customer relationship)

After detecting the intrusion, WorkOS disabled external access to the affected application and reviewed its access controls on internal tools.

The company also contracted an independent forensics and incident response firm to track the unauthorized activity and determine its full impact.

The company promised to notify affected customers directly, and warned its users to remain vigilant for phishing or social engineering attempts leveraging the exposed information.

ARTEX AI likely powering the attack

WorkOS’s announcement says the attack used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts.

Company founder Michael Grinich shared more details, saying that the attacker used the ARTEX AI penetration testing suite that has been observed in multiple incidents this year.

Released earlier this year by Chinese developers, the platform was available as an open-source project for offensive security.

ARTEX AI became private after it was used in attacks targeting South Korean banks, but several forks of its code are still available.

More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.

Previously, the non-profit cybersecurity organization DIVD also revealed that the same framework powered the attacks it suffered last September.

Grinich explained that the investigating team identified user agents such as ‘artex-enrich/1.0’ and ‘norma/0.4’ in web requests from the threat actor.

The founder assured that the cybersecurity incident has now been fully contained and promised to share more information about the attack after the investigation completes.

Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.

This new information was shared in an incident report published today, which details how the attackers used social engineering, malicious software, and compromised internal systems to carry out the October 29 crypto theft.

As previously reported by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38.

Binance says the attack began in September when a software engineer was contacted through a legitimate job-hunting platform by someone impersonating a Project Director at a fictitious company.

The employee's profile referenced his experience at Binance, making him a valuable target for attackers looking to breach the cryptocurrency exchange.

The fake recruiter scheduled two interviews for the employee, first with someone posing as a human resources representative, then with another individual claiming to be the company's CEO.

During the first interview, the fake HR representative held a live video call and shared a social media account with personal photos and videos to build trust.

The second interview took place through a popular social chat application where the employee was instructed to download a coding assignment from an online code repository.

According to Binance, the repository contained malicious code that, when executed, compromised the employee's device with previously unseen custom malware that antivirus software did not detect.

"The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server," explained Binance.

"The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging."

Binance explained that the malicious script created a replacement executable named pyenv_ in the macOS Homebrew installation directory.

The script then deleted the legitimate pyenv executable, renamed the malicious file to pyenv, modified its symbolic link, and used it to spawn a Z shell (zsh) process.

The malicious replacement allowed the attackers to execute commands received from an attacker-controlled server.

By October 20, the attackers had used the compromised engineer's computer and an internal AI tool to compromise two additional employees working on Binance's wallet infrastructure, obtaining credentials and a container deployment token.

On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance's wallet signing service, allowing them to transfer billions of dollars in cryptocurrency across multiple blockchains.

The attackers also abused Ethereum's EIP-7702 authorization mechanism, allowing them to continue stealing cryptocurrency even after the exchange suspended withdrawals.

Binance says it has since rebuilt affected systems, replaced compromised devices, and revoked stolen credentials.

As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31.

Binance says it is continuing to investigate the breach and has brought in independent security firms to review its findings.

Malicious job interviews

Fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns known as Contagious Interview and Operation Dream Job. These campaigns use fake job offers and interviews to trick developers and cryptocurrency employees into installing malware.

In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.

As part of these attacks, the hackers distributed 35 malicious npm packages that installed malware, allowing them to steal browser credentials, cryptocurrency wallet data, and other information from infected computers.

North Korean Lazarus hackers have also used similar tactics in Operation Dream Job, distributing malware disguised as employment documents to people working in software development and DeFi companies.

While Binance has not linked the employee compromise to either specific campaign, the use of a fake recruiter, multiple interviews, and a malicious coding assignment closely mirrors these previously documented North Korean tactics.

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day.

Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents.

Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure."

The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines.

After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.

Once access is resold, request volumes can spike suddenly, sometimes exceeding 1,000 requests per second. The service provider records the requests as legitimate consumption and charges the victim organization for the tokens.

GTIG and Mandiant observed an increase in this type of activity this year, with fraudulent charges exceeding $100,000 in a single day, and cumulative charges at some organizations reaching $1,000,000.

LLM mixers offer access to AI resources at very low prices, using their proxy infrastructure to relay customers' prompts to hijacked services through stolen API keys.

The researchers found several examples of such relaying infrastructure, including Jet Night, which sells “unlimited access plans” for $60/month, and the newapi[.]pro service.

“Another threat actor that executed more than 500,000 LLM API calls in less than eight hours leveraged stolen third-party API keys to power the token routing service jet-night.com,” Google says.

“Jet Night passed nearly one million dollars in token costs to the victim organization.”

Google also identified the threat cluster UNC6993, which appears to use gateway tools to aggregate stolen keys and distribute requests, and likely sells access via underground forums.

The attackers gain access via exposed or compromised cloud credentials, service account keys, GitHub tokens, active session tokens, and LLM API keys.

Attackers search the compromised environment for credentials, logs, databases, and secret managers, and try to create backdoor accounts or inject SSH keys to maintain persistent access.

The researchers have also observed threat actors exploiting CVE-2026-40217, a vulnerability in LiteLLM that allows running arbitrary code on the server by leveraging the custom-code guardrail testing endpoint.

In some cases, Google says that attackers used the victim's cloud infrastructure to host unauthorized proxy endpoints and agentic workloads.

"For example, one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS," the researchers say.

Google recommends several actions to protect against LLMjacking attacks, which start with prioritizing Identity and Access Management (IAM) and securing the supply chain.

Companies should use centralized secrets platforms to enable the rotation and management of sensitive keys and secrets. Users should not have extended privileges unless required by their role and tasks.

"Deny all permissions that are not explicitly required, including access to Cloud LLM services," Google recommends.

Enforcing phishing-resistant multi-factor authentication (MFA), ensuring monitoring tools provide comprehensive visibility across the environment to identify unauthorized LLM and AI services (shadow AI), and setting API usage and spending limits can help organizations detect LLMjacking attacks early, limit their impact, or prevent them altogether.

Furthermore, cloud audit and inference logs should be enabled and monitored for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging.

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.

The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root.

However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure.

"Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device," the company explained.

"Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance [..], ensure their systems are running the latest firmware version, and have all security patches applied."

A complete list of all affected devices and available security patches is available in the table below.

Three years ago, Barracuda also patched an Email Security Gateway flaw (CVE-2023-7102) that the UNC4841 hacking group exploited in zero-day attacks to execute arbitrary code on unpatched appliances.

The same year, UNC4841 hackers abused another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of cyber-espionage attacks.

Barracuda later revealed that the vulnerability had been exploited for at least seven months, since at least October 2022, to deploy previously unknown SeaSpy and Saltwater malware and steal data from compromised systems.

​Almost a third of appliances hacked in the 2023 campaign belonged to government agencies worldwide, most of them breached between October and December 2022, according to cybersecurity firm Mandiant.

Founded in 2003, Barracuda has more than 200,000 customers worldwide, including small- to medium-sized businesses (SMBs), large enterprises, and managed service providers (MSPs).

By 2028, security operations teams will have 50% more engineers than analysts. That is one of the predictions in The Roles Required for the AI-Enabled Security Operations Center (SOC), a 2026 Gartner report by analyst Pete Shoard.

If the prediction holds, the people who build and tune a SOC's systems will outnumber the people who work its queue.

Gartner starts its reasoning with alert handling. The report finds that AI SOC agents already cut alert-handling work significantly for common and traditional detection use cases. It describes this as the end of alert processing as the SOC's primary function.

From there, the report works through what that means for the people in the SOC. Analysts move from triage to case ownership, and entry-level roles need a new way in.

Detection engineering grows into a broader engineering job, the metrics shift from alerts to cases and decisions, and exposure management becomes a standing SOC function.

Prophet Security is offering the full report as a free download.

Analysts move from alert triage to case ownership

Gartner's recommendation for analysts is direct: "Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication." In practice, the agent investigates the alert, and the analyst owns what happens next.

That means confirming what the agent found, choosing the response, and explaining the options to the people who have to act on them.

The report also holds that AI-assembled case files still need meaningful human validation before a team can rely on them,so analysts spend more of their time judging whether a conclusion holds up and less of it producing verdicts from scratch.

None of this shrinks the team, in Gartner's view. "The SOC will not shrink by 2030," the report states. The people who worked alert volume get redirected toward detection engineering, threat expertise, offensive testing, and exposure management.

Practitioners expect the same. Prophet Security's State of AI in Security Operations 2026 survey asked more than 250 CISOs, SOC leaders, and practitioners about this. Of those respondents, 57% expect their team size to stay the same, and 9% expect it to grow.

Entry-level roles need a new way in

Many analysts learned the job in Tier 1 triage, and AI is flattening those tiers. Working a high alert volume taught them what normal looks like in their environment. Gartner's report addresses how L1 and L2 roles change and the training and staffing changes SOC leaders should make now. If agents take over triage, junior analysts lose the repetitions that built their judgment, unless the team replaces those repetitions on purpose.

Three practices can do that:

• Study the agent's work. When an agent records every question it asked, every query it ran, and the evidence behind its determination, each closed alert becomes a worked example. Junior analysts can check whether they would have run the same queries and reached the same conclusion. At JBPCO, the team was able to onboard a new analyst to senior level proficiency within months.

• Own cases early. Gartner's shift to case ownership applies to new analysts too. Giving them end-to-end ownership of lower-risk cases, with a senior reviewer, lets them practice the decisions and response communication the report puts at the center of the analyst role.

• Feed corrections back. Gartner lists "operational feedback management" among the responsibilities of the future detection engineer, and expects analysts to give more feedback to improve AI accuracy. Among Prophet Security's customers, some analysts have already moved from handling alerts to curating the guidance the AI platform uses in its investigations. The same work suits a new hire who is still learning the environment.

The risk to manage is an analyst who only confirms what the agent says. One control is to have analysts work a sample of cases on their own before they see the agent's determination, then compare the two.

Detection engineering grows into SOC engineering

The 2028 prediction rests on a wider definition of engineering work. Gartner describes detection engineering expanding into a broader SOC engineering discipline.

The report tells SOC leaders to "redefine detection engineering role descriptions and hiring requirements." The new descriptions should go beyond rule writing to include prompt design, workflow testing, and AI output validation. The report also calls for software engineering practices such as versioning, testing, and rollback.

Each of those maps to work that exists once agents run in production:

• Prompt design and guidance: writing the instructions and context an agent uses to investigate in your environment, such as asset criticality, VIP users and known-benign admin activity.

• Workflow testing: checking an agent workflow against past incidents before it goes live, the way a detection is backtested before it ships.

• AI output validation: sampling the agent's determinations on a schedule and measuring how often a reviewer agrees with them.

• Versioning and rollback: managing guidance and detection changes as code, so a bad change can be traced and reverted.

The analyst hours that agents return also go into threat hunting. In the State of AI in Security Operations 2026 survey, 49% of teams that hunt weekly or more said a hunt had surfaced malicious activity their detections missed.

Among teams reporting the lowest hunting frequency, the figure was 8%. A confirmed hunt finding often gives the engineers a new detection to write for their own environment.

The metrics move from alerts to cases and decisions

Gartner's guidance on measurement is short: "Stop recording alert metrics and run the SOC on cases and decisions." The report points SOC leaders away from alert volume, closure rates and mean time to detect, and toward case accuracy, cycle time and decision confidence.

One way to put a number on each:

• Case accuracy: review a fixed sample of closed cases each week, from agents and analysts alike, and track how often the reviewer agrees with the determination.

• Cycle time: measure the time from the first signal to a decision on the case, including the response.

• Decision confidence: record how much evidence supports each determination and how often one is overturned later.

Alert counts still help with capacity planning, but they say little about whether a determination was right. The new measures can sit alongside the SOC metrics a team already reports, such as mean time to respond.

Exposure management becomes a standing SOC function

Gartner's report calls exposure management "the emerging SOC capability to invest in before anything else." It calls for continuous threat exposure management (CTEM) to run as a standing SOC function, rather than as an annual or quarterly exercise.

It also predicts that by 2030, SOCs will be largely offensively driven, testing their own business the way an attacker would.

Many security teams have wanted to run this kind of continuous testing for years and rarely had the hours for it. Once agents handle the alert queue, the analysts and engineers who move into exposure work can validate exposures as they appear.

What they find goes to the people writing detections and planning hunts.

Planning the transition

The report's recommendations translate into decisions that are easier to make before an AI SOC rollout than after it:

1. Map today's roles against the work Gartner expects to grow: case ownership, SOC engineering, hunting and exposure management.

2. Rewrite the detection engineering job description to include prompt design, workflow testing, and AI output validation, as the report recommends.

3. Design the entry-level path, including case ownership and feedback work, before triage volume drops.

4. Record a baseline for case accuracy and cycle time, so the rollout has a before and an after.

5. Choose one exposure management practice to run continuously instead of once a year.

How Prophet Security helps

Prophet Security is a leading agentic AI SOC platform, recognized in Rising in Cyber 2026, an honor voted on by more than 150 CISOs and security leaders. Its platform, Prophet AI, uses specialist AI agents to investigate alerts, hunt for threats, and build and tune detections on the stack a team already runs.

Here is how it maps to the shifts described above:

• Case ownership. Prophet AI SOC Analyst investigates every alert and records every question, query, and piece of evidence behind its determination, so analysts can own the case and check the reasoning. It groups related investigations into one incident and takes only the response actions a team has approved.

• SOC engineering. Prophet AI Detection Engineer keeps a live MITRE ATT&CK coverage map built from a team's own investigations, then builds and tunes detections from what investigations, hunts, and coverage gaps reveal. Each change is backtested against the team's own history and arrives as a reviewable, version-controlled proposal, and by default nothing reaches production until the team approves it. Guidance that changes an investigation step is versioned and testable too.

• Threat hunting. Prophet AI Threat Hunter runs hunts automatically when a severe new threat emerges. Scheduled hunts against coverage gaps, and hunts a team writes as plain-language questions, run on the cadence the team sets. Suspicious findings go to Prophet AI SOC Analyst for a full investigation, and validated ones become candidates for new detections.

• Case accuracy. Prophet Security measures the quality of Prophet AI's determinations through a continuous QA program with ISO 2859-1 sampling audits. When the evidence does not support a verdict, Prophet AI SOC Analyst returns an inconclusive determination instead of guessing.

Read the full report

Gartner's report sets out the roles, metrics and skills a SOC needs as AI agents take over alert handling.

Download The Roles Required for the AI-Enabled Security Operations Center (SOC) for Gartner's full guidance on L1 and L2 roles, SOC metrics and the skills future SOC engineers will need.

Sponsored and written by Prophet Security.

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host.

Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation.

The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds.

"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender explains.

The researchers note that they could only document the behavior, and it looked similar to an agentic loop.

The malicious activity spanned between September 10 and19, but Bitdefender could not establish the attacker’s initial access method.

The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.

They mapped domain relationships and searched logon-script folders for references to other schools, eventually creating two backdoor domain administrator accounts named ‘library’ and ‘svc_bkpmon.’

After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach.

In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor. They succeeded in about 37 cases.

The 3AM ransomware threat emerged in 2023 and came to public attention when an attacker deployed its Rust-based ransomware after LockBit was blocked.

Researchers later linked the operation to the Conti and Royal ransomware gangs, and affiliates have been observed using email bombing and spoofed IT support calls to access corporate networks.

A notable past victim is Kootenai Health, where an August 2024 attack exposed personal information belonging to more than 464,000 patients.

Regardless of the current level of AI tool involvement in 3AM attacks, Bitdefender’s observations suggest the threat actors appear to be experimenting with them heavily.

Earlier today, the NCSC in the UK published this year’s ‘The State of the Cyber Nation’ report, urging critical infrastructure to prepare for AI-powered ransomware attacks by 2028.

European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs.

Supported by Europol and Eurojust, this coordinated international action involved authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia and followed four years of investigation and earlier interventions in 2022 and 2025.

The investigation began in 2022 after a German couple reported they couldn't withdraw money invested through an online trading platform, leading investigators to link multiple call center operators behind investment scams to potential victims in at least 50 countries.

"The action follows four years of investigation and earlier interventions in 2022 and 2025. Evidence gathered during those operations led to the company allegedly operating the 'crime-as-a-service' model from Cyprus and Israel. Investigators also identified suspected clients operating fraudulent call centres in Albania, Kosovo* and North Macedonia," Europol said.

The scheme promised potential victims substantial, quick returns from trading in foreign currencies, stocks, or cryptocurrency, using deceptive advertisements to direct them to fraudulent investment platforms and steal their personal data. They later sold this stolen data to criminal groups running call centers, whose operators reached out with supposed investment opportunities.

They encouraged victims to transfer a small amount and showed them fake online accounts with fictitious profits, making the platforms seem credible. These gains were used to sustain psychological pressure to push the victims into larger transfers. However, when they asked to withdraw the money, the scammers used delaying tactics and eventually stopped contact, leaving victims with no way to recover their funds.

"A first international action day that year resulted in two arrests and the seizure of evidence. Europol-supported analysis helped investigators develop the case, which identified seven additional suspects, including suspected call centre managers," Europol added.

This is the latest in a series of similar criminal rings dismantled by European law enforcement in recent years, including the March 2022 shutdown of a massive call-center investment fraud network that used 200 "traders" to steal at least €3 million each month.

Police also took down multiple call centers across Europe in 2023, linked to millions of euros in losses and run by a criminal gang behind online investment fraud (also known as 'pig butchering' or romance baiting scams). European police also shut down 12 fraud call centers in May 2024 that were linked to thousands of daily scam calls.

In July 2025, Spanish police dismantled another massive crypto investment fraud ring that laundered over €460 million($540 million) stolen from over 5,000 victims worldwide, one week after taking apart a large-scale investment scam operation behind cumulative damages exceeding €10 million ($11.8 million).

More recently, in April, Austrian and Albanian authorities also took down a criminal organization that ran a large-scale cryptocurrency investment fraud operation linked to estimated losses of over €50 million ($58.5 million).

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws.

Starting this month, researchers can earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations.

"To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup," said Chris Betz, Google Cloud's Chief Information Security Officer (CISO).

"Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility."

However, to qualify for this reward, the exploits cannot depend on prior access to the victim project, compromised credentials, social engineering, or user interaction.

Additionally, security researchers who achieve execution on Google's production infrastructure must stop probing since escalating, obtaining production credentials, or lateral movement are not allowed and will result in disqualification.

"High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects," added Cloud VRP Lead Michael Cote.

"Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity."

More details on the Google Cloud VRP, including endpoint specifications, JSON payloads, and CLI examples, are available on the rules page.

This follows Google's suspension of submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) in October after a flood of AI-generated reports.

Google has rewarded thousands of security researchers worldwide with more than $81.6 million since launching its first Vulnerability Reward Program in 2010.

In 2025, Google awarded a record-breaking $17.1 million to over 700 security researchers, a 40% increase from 2024, when it awarded $12 million in total.

Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.

Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.

As the university discovered on November 18, 2025, the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities."

However, Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.

Although Harvard has not attributed the attack to a specific hacking group or threat actor, the ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records containing identifiable information and donation data after breaching the university's systems.

The cybercriminals then leaked a 1.1GB archive of documents on their dark web leak site in early February after Harvard refused to pay a ransom to have the stolen data returned and destroyed.

​While a Harvard spokesperson could not share how many individuals had their information exposed when BleepingComputer reached out at the time for more details, Have I Been Pwned analyzed the data leaked by the cybercrime gang and confirmed on Tuesday that the breach exposed the data of 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and more

"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.

Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025, both confirming that the attackers accessed donors' information.

In October 2025, Harvard also told BleepingComputer that it was investigating a second data breach after the Clop ransomware gang claimed that it had breached the university's systems using an Oracle E-Business Suite (EBS) zero-day vulnerability.

Two months later, the University of Phoenix (UoPX) joined the list of US universities breached by Clop using the same Oracle EBS flaw and revealed that the ransomware gang stole data from nearly 3.5 million UoPX students, staff, and suppliers in August 2025.

Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries.

The operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.

The threat actor compromised at least nine organizations and carried out password spraying attacks and credential scanning activity against at least 12 other high-value targets.

According to researchers at CrowdStrike, the "campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator."

Confirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the U.S.

The researchers track the threat actor as Vapor Panda and say that in the attack against the Greek government entity, the AI agents forged an administrator token and read mailboxes by leveraging authentication keys from a 2022 mail-server directory export.

ARTEX AI is a penetration testing suite developed by Chinese developers and initially released as an open-source project. However, its creators later made it proprietary after it was used in real-world attacks, including a campaign against South Korean financial institutions.

In its most recent cyberespionage operation, Vapor Panda also used DeepSeek and a second, unidentified commercial language model to coordinate planning and worker agents across multiple intrusions simultaneously.

CrowdStrike says the attackers issued instructions in Chinese and intervened at critical points where decisions needed to be made.

The AI agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and pursued alternative attack paths when needed.

The operators explicitly instructed the agents to skip Windows machines protected by Falcon, CrowdStrike's solution for endpoint protection, and focused on unprotected hosts.

In one intrusion, the AI agents consumed more than 1.4 billion input tokens, the researchers believe.

CrowdStrike also found that the threat actor deployed BLOODALCHEMY, a backdoor active since 2023, against government entities in Latin America and the Middle East.

More ARTEX AI cases emerge

The Dutch Institute for Vulnerability Disclosure (DIVD) has shared more details about the cyberattack it suffered in September 2026, which it attributed to an AI agent.

According to its latest update, the tool used in the attack on its network was ARTEX AI, which acted autonomously.

DIVD explained in a post on LinkedIn that the attack went from initial access to root privileges in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation.

The agent performed numerous tasks simultaneously, including reading a compromised mailbox, scanning the internal network, extracting login tokens, and attempting password resets.

DIVD recorded over 450,000 requests and 2,500 scripts connected to the attack, describing the activity as “super loud and messy.”

Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.

On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.

Abrigo provides cloud-based software and analytics solutions for community banks and credit unions across the United States. According to the company, it serves more than 2,400 entities.

Its Sageworks product is a software platform that helps lenders process loan applications, analyze borrowers’ finances, assess creditworthiness, and monitor loan portfolios.

Due to its nature, Sageworks handles sensitive information, including banking customer details.

"We identified irregular activity in our environment, and, out of abundance of caution, we disabled the Sageworks application at approximately 11:25 am ET," the company said on Friday.

In status updates over the weekend, Abrigo said its investigation was ongoing but did not disclose details about the nature of the incident.

The incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.

In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features.

BleepingComputer reached out to Abrigo for more details, but we have not received a response by publication time. Until the nature of the incident is disclosed, it is unclear if the outage was caused by a breach or a technical issue.

Earlier this year, someone allegedly part of the ShinyHunters extortion group claimed an attack on Abrigo, saying that they stole 1.7 million Salesforce records containing personally identifiable information and various internal corporate data.

The threat actor said at the time that they exfiltrated full names, email addresses, phone numbers, employee and account data.

Although a data breach has not been confirmed, some cybersecurity researchers advised banks and credit unions using Abrigo's solutions to rotate the API keys for the Sageworks platform.

Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities.

The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately installing a persistent backdoor into devices it manufactured and selling access to criminal affiliates.

These affiliates used the backdoored devices to deploy malicious modules that were used fir ad fraud, turned infected devices into residential proxies, and installed additional malware.

As part of the disruption, Google says it took down XCPE command-and-control (C2) servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices.

These additional devices were compromised through malware distributed through other means than XCPE, and include retail set-top boxes, karaoke machines, and telehealth hardware. Google says that not all of them are Android devices.

Google has also terminated its relationship with Videostrong, revoked its license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google's Threat Intelligence Group (GTIG) said in a report published Monday.

Google says the disruption involved Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which coordinated to analyze the malicious infrastructure and disrupt its operations.

The XCPE botnet

Unlike other botnets that commonly breach devices through vulnerabilities or by tricking users into installing malware, the XCPE botnet was embedded directly into device firmware during manufacturing.

Google says Videostrong had been developing and distributing the malware across multiple device brands and models for years, evolving its capabilities to evade detection and support different criminal affiliates.

"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google says.

The main backdoor component, tracked as x.cpe and com.oemservice, run with Android system-level privileges.

The malware uses a modular architecture that separates its backdoor functions from modules designed to generate revenue for affiliates.

After an infected device starts, XCPE contacts a command-and-control server on the anyevonline[.]com domain to obtain connection information and credentials for an MQTT message broker, which is then used for receiving commands.

Google says the malware uses different subdomains of anyevonline[.]com depending on the Android version and device type. The MQTT broker, which was hosted at mqtt.szbboys[.]com, allowed operators to send commands and deploy other malware to infected devices.

Through this connection, operators can remotely control compromised devices and perform malicious actions, such as:

• Silently downloading and installing additional Android applications.
• Disabling Google Play Protect.
• Executing shell commands and scripts with system privileges.
• Capturing screenshots and injecting keystrokes.
• Collecting account information, device details, installed application lists, and system logs.
• Conducting network reconnaissance and establishing reverse shells.

The devices were also used to generate revenue by installing malware modules belonging to other operators, turning the backdoor into a plug-in cybercrime platform for other cybercriminals.

According to Google, these modules included software associated with residential proxy services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, which was used to route third-party internet traffic through infected devices without their owners' knowledge or consent.

Other modules committed ad fraud by generating ad impressions, loading hidden webpages, and clicking advertisements. Some modules installed other backdoors, including Moyu, Spirit, and Bird, to download and execute other malware.

Google says the botnet operators continuously changed the malware's architecture to avoid detection.

In late 2024, Videostrong began using a separate loader called com.abc.nexus, which ran the malicious modules while XCPE focused on communications with the C2 infrastructure.

Since August 2026, the operators began replacing that loader with smaller, specialized droppers disguised as Android system applications.

Videostrong attribution

In a separate coordinated report, cybersecurity firm Synthient explains how it traced the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.

During its investigation, Synthient found a publicly accessible directory on the malware's file.anyevonline[.]com server that hosted backdoors used by the operators. The open directory also included a PDF folder containing a PDF by Owen Cao, the R&D director of Videostrong Technology Co.

Researchers also found that Videostrong's videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline[.]com, the command-and-control server that allowed operators to list compromised devices, push out commands, and manage application installations.

In addition, Synthient discovered that numerous Videostrong company email addresses had been used to sign the backdoors.

Google says the evidence indicates the manufacturer deliberately installed the malware rather than a rogue employee or a development oversight.

"We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said.

Google also says it has modified its certification review process after discovering that Videostrong used obfuscation techniques to evade security testing and load malicious code after devices first booted.

While Google says the takedown has disrupted XCPE's operations, the malware has not been removed from in infected devices and will automatically reinstalls itself from the /oem/ partition if removed.

As a result, users would need to install clean firmware to remove the infection or disconnect the affected device from the internet to prevent further malicious activity.

BleepingComputer has contacted Google with additional questions about the botnet and will update the story if we get a response.

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining “hot wallets” on instances running older versions.

Operators were initially advised to shut down their servers pending a full investigation into the unauthorized Bitcoin and Litecoin payments.

The BTCPay Server project provides businesses with a self-hosted payment processing solution that allows them to accept Bitcoin and other digital assets directly into their own wallets, eliminating payment intermediaries or paying platform processing fees.

It handles checkout invoices and payment verification, including payments over the Lightning Network.

Early Monday, the maintainer said it had “identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier” and strongly urged users to update to version 2.4.7.

BTCPay founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on determining how the threat actor was able to log in as an administrator to instances running versions older than 2.4.2.

On October 29, the company disclosed a critical vulnerability discovered via Anthropic’s Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update.

However, Dorier said that there were clues that the attacker used vulnerabilities in BTCPay Server versions earlier than 2.4.2, released on August 7, which the project later confirmed.

“Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older,” BTCPay Server says.

“We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.”

The BTCPay project began receiving reports of theft yesterday evening (UTC) and responded by asking VPS hosting providers to take affected server instances offline as a precaution to protect customers.

In a security alert today, the project maintainer said that it is currently responding to affected users and continues to receive incident reports. Users who lost funds as a result of the recent attacks are asked to send details to security@btcpayserver.org, and to report the losses to local authorities.

Impacted users should update to version 2.4.7 through Server Settings → Maintenance → Update.

For Docker installations, administrators can update BTCPay Server by logging in over SSH, running sudo su -, changing to the deployment directory with cd btcpayserver-docker, and executing ./btcpay-update.sh.

If running 2.4.1 or older, it is recommended to take the instance offline as soon as possible.

Update [10:23 EST]: Article update with information from the security incident report BTCPay Server published earlier today.

In 2024, AT&T lost sensitive communication logs of 109 million customers in a massive data breach. Call logs can reveal a lot about you, like your closest relationships, where you live and work, and your daily routine. 

109 million people (nearly a third of Americans) suffered a massive data breach in April 2024 that exposed their AT&T communication logs.

AT&T lost sensitive information including phone numbers, call and text counts, call durations, and location data from May to October 2022, and January 2023, meaning the data was approximately two years old at the time of the breach, impacting both current and former customers.

AT&T said the records didn’t contain call content, customer names, or Social Security numbers. That’s less reassuring than it sounds, because even on their own, call logs reveal a lot about you.  

What are call logs?

Every call, text, and data session generates records inside your carrier’s network. The two kinds that matter here are:

• SIP messages. Session Initiation Protocol (SIP) manages calls and texts, both within a carrier and between networks. One message starts a session and another ends it. Carriers use them mainly to troubleshoot dropped calls and failed texts.
• Call Detail Records (CDRs). CDRs summarize each call, text, and data session: who was involved, when, for how long, and often which cell site your phone used. Carriers use them for billing and for settling charges with roaming partners.

Anyone with access to your call logs can identify your closest relationships, locate your home and workplace, and reconstruct your daily routine in more detail than you could yourself. If you called an oncologist a few years ago, there’s likely a record of it, how long you talked, and where you were. If you texted an old friend afterwards, there’s a log of that too.

Call metadata can even be correlated with publicly available information to derive identities. 

Malte Spitz showed how far this goes. In 2011 he sued his telecom for the data it held on him, received roughly 35,000 records, and reconstructed a strikingly specific replay of several years of his activities.

Why call logs are easy to get

Three things make them an easy target.

They’re kept for a long time. Most carriers don’t say how long. Privacy policies typically promise to retain data for “as long as necessary to fulfill the purposes” of the policy. In 2022, responding to a request from the FCC chair, carriers disclosed that they kept geolocation data for as long as five years, far longer than phone service requires. One reason is to monetize it.

They sit in a few big targets. Carrier data is frequently breached. AT&T was one of many Snowflake customers hit by credential-based thefts, alongside Ticketmaster and Neiman Marcus. Salt Typhoon, the China-linked campaign, reportedly compromised every major US carrier, which could put call metadata for any American within reach.

They have other buyers. Retained logs are used to build detailed behavioral profiles that are sold to ad networks and data brokers and, in some cases, handed to the government.

The AT&T breach is the predictable result. The records were available to steal because they existed.

Cape is built to forget

Cape deletes call and text metadata in days instead of years. Unlike other MVNOs, Cape runs their own mobile core and produces their own logs, meaning they can control when logs are deleted.

Its Disappearing Call Logs feature sets a short retention window for each record type:

When a Cape subscriber makes a call, the signaling goes to the nearest radio tower and to Cape’s partner network operator, which passes it to Cape’s mobile core. The core forwards it to the recipient’s carrier.

Cape keeps SIP messages for 14 days to debug network issues, converts them into internal CDRs, and deletes those after one day. Daily totals (counts of calls, SMS, MMS, and data used per subscriber) are kept up to 60 days for billing and spam prevention.

CDRs sent by partner networks as billing evidence are held for 30 days, long enough to dispute a bill.

Cape’s partners and the tower operators generate logs too. For that reason Cape rotates the identifiers the towers see, which weakens their ability to tie those logs to you.

The audit

A retention claim is only worth what you can verify. Cape hired Trail of Bits to audit the feature in May and July 2026 and published the attestation.

During the audit, Trail of Bits found no evidence of violation of the two given claims:

1. CDR files are being deleted within the retention policy.
2. Cape does not extract or retain data from CDRs about individual consumer customers, except daily totals. Daily totals are the number of calls, number of SMS, number of MMS, and amount of data a subscriber used in a day. This data is retained for no more than 60 days and then deleted.

You can read the full audit write-up or 404 Media’s coverage.

You can’t un-breach a database, but you can shrink it

Better carrier security matters, but the more reliable control is to hold less. Records deleted days after a call can’t be stolen two years later.

For journalists, executives, security staff, and anyone who calls a doctor, lawyer, or source they’d rather not advertise, your carrier’s retention policy is part of your threat model.

Switch to a carrier that deletes your call logs. Learn more about Cape →

Sponsored and written by Cape.