Threats & incidents
-
Aoki infostealer expands credential theft to AI coding assistants
Symantec researchers identify recent Aoki samples collecting AI coding assistant credentials. Separately supplied Black Duck commentary outlines potential downstream risks, not confirmed compromises.
-
Infoblox attributes Help TDS scam-routing infrastructure to Hotejka
Infoblox researchers identify an Eastern European operation behind a long-running traffic distribution system that uses disposable Cloudflare Pages sites to route users into remote-access fraud.
-
Censys counts 71% fewer internet-visible StoreView hosts in France
Censys counted 1,825 internet-visible Danfoss StoreView hosts in France on 11 October and 537 on 14 October; the figures do not measure confirmed compromises or fixes.
-
Citizen Lab confirms targeted-ad spyware infections at Al Jazeera
Citizen Lab links confirmed Candiru spyware infections at Al Jazeera to targeted online advertisements, while distinguishing infections from wider exposure to surveillance-related advertising infrastructure.
-
Fake WatchGuard VPN site steals credentials before offering genuine installer
Huntress has analysed a fake WatchGuard VPN download page that collects server and account details, then offers a genuine signed installer instead of malware.
-
Legal Aid Agency finds older case and probation records in stolen data
The Legal Aid Agency says forensic work on its 2025 cyberattack has identified about 250,000 pre-2007 records and some probation data among exfiltrated material.
-
NCA-backed operation removes 3.7 million scam accounts and leads to arrests
A multinational law-enforcement and technology operation hosted by the National Crime Agency has removed millions of online scam profiles and accounts, with nearly 30 suspects arrested.
-
Housing Ombudsman investigates supplier incident affecting case management system
The Housing Ombudsman has reported a third-party IT security incident affecting its case management system. The event is contained, but the scope of any personal data involvement remains under investigation.
-
npm Trusted Publishing flaw exposed more than 1,500 packages to possible takeover
Bloom Security researchers identified a trust-binding weakness that could let attackers publish updates to npm packages through reclaimed GitHub repository names. GitHub says it has shipped a fix.
-
TFG London cyber incident disrupts systems at Hobbs, Whistles and Phase Eight
The Foschini Group says its UK subsidiary identified a cyber incident on 11 October. Stores remain open, but IT systems are unavailable while investigators assess possible data exposure.