Cyberfine

BREAKING: US military preparing for a possible resumption of major combat operations against Iran, Axios reports.

🚨 JUST IN: A former FBI agent accused of stealing $1 million in crypto and using AI to plan a move to Portugal is set to plead guilty.

Multiple flights across Europe face bomb threats for second time this week with some planes diverted bbc.in/3WL4u3y

MILLIONS of people LOCKED OUT of their own money as Ueno bank COLLAPSES IN Paraguay President Pena faces IMPEACHMENT — reports

🚨 Hackers are exploiting an Apple security flaw patched over two years ago. CISA has added CVE-2024-27834 to its exploited vulnerabilities list following reports of attacks delivering information-stealing malware. Here's what the attacks involve ↓ thehackernews.com/2026/11/ha…

🚨 BREAKING: HACKERS ARE TURNING WHATSAPP INTO A MALWARE DISTRIBUTION NETWORK ACROSS MULTIPLE COUNTRIES. A dangerous cyberattack campaign is targeting WhatsApp users, disguising malware as legitimate financial documents, invoices, bank statements, and business files. And there’s a disturbing twist: the messages can come from people you already know. Here’s what we know: 🇲🇾 MALAYSIA • October 29: MyCERT confirmed an active malware campaign distributing malicious ZIP attachments through WhatsApp. • Files impersonate invoices, account statements, e-statements, and payment documents. • Messages come from potentially compromised contacts or fake business identities. • The malware can install remote-access backdoors on Windows computers. 🇸🇬 SINGAPORE • October 28: SingCERT issued an official advisory after receiving multiple reports of malware campaigns spreading through compromised WhatsApp accounts. • November 2: Singapore Police issued another warning about malicious attachments disguised as business documents. • Hackers can steal credentials, record keystrokes, capture screenshots, and compromise WhatsApp accounts. 🌍 OTHER COUNTRIES IDENTIFIED Kaspersky’s June 22 research identified victims across multiple countries and territories, including: 🇲🇾 Malaysia 🇧🇷 Brazil 🇸🇬 Singapore 🇹🇼 Taiwan 🇻🇳 Vietnam Malaysia had the highest number of observed victims in that particular campaign. HOW THE ATTACK WORKS: Hackers compromise a WhatsApp account. They send malicious ZIP, ISO, or disguised document files to existing contacts. Victims are instructed to open or extract the files on a Windows computer. Running the malicious program installs malware or a remote-access backdoor. Hackers can steal sensitive information and use compromised accounts to spread the malware further. ⚠️ PROTECT YOURSELF: • Never open unexpected ZIP, RAR, ISO, or EXE attachments. • Verify suspicious files directly with the sender through a phone call. • Enable WhatsApp Two-Step Verification. • Check your Linked Devices regularly. • Never share your WhatsApp verification code or PIN. IMPORTANT: These are documented campaigns from different reporting periods, not proof that all five countries are experiencing the exact same attack simultaneously. Your WhatsApp contact list could become the next distribution channel. DON’T TRUST AN ATTACHMENT JUST BECAUSE IT COMES FROM SOMEONE YOU KNOW. Stay alert. Stay protected.

Microsoft Security Research has identified a fake-download campaign targeting users searching for cracked software, free games, plugins, and other utilities to distribute trojanized installers that can monetize compromised devices in three different ways: msft.it/6012a4u2w - Routing third-party internet traffic through the compromised devices - Enrolling devices in a distributed-computing platform - Installing additional utility software The trojanized Inno Setup-style installers launch executable payloads staged in temporary directories and track each component’s installation outcome separately. A failed or blocked installation does not necessarily stop the rest of the bundle. Organizations can reduce exposure to this activity by blocking the use of untrusted software sources, enabling potentially unwanted application (PUA) protection, and monitoring for unexpected software installations and persistence mechanisms. Read the blog for technical details, indicators of compromise (IOCs), mitigation guidance, Microsoft Defender detection info, advanced hunting queries.

⚠️ Trust Wallet Users Lose $1.1M To Exploit An unknown attacker has reportedly drained $1.1M from Trust Wallet users. The exploit targets devices running iOS 18.5, allowing the attacker to extract victims' seed phrases. Trust Wallet support has urged users to update their iOS immediately. “Update iOS as soon as possible.” 📰 Telegram: UnbiasedCryptoNews

🚨DDoS Alert 🇹🇷 Tunisian Maskers claims to have targeted the website of Revenue Administration (gib.gov.tr).

BITCOIN SECURITY RESEARCHER SAYS HIS TEAM FOUND OVER 10,000 POTENTIAL VULNERABILITIES USING AI IN JUST TWO MONTHS T warns that AI is dramatically accelerating vulnerability discovery for both defenders and attackers, making regular security audits increasingly important. Volunteer engineers identified more than 10,000 potential bugs and vulnerabilities. Many findings have already been evaluated, disclosed and patched, with additional disclosures ongoing. He says the team accomplished the work using a combination of Chinese open-source AI models and American frontier models, with most of his personal spending coming from subscriptions rather than expensive API usage. Talip warns that AI is dramatically accelerating vulnerability discovery for both defenders and attackers, making regular security audits increasingly important. He emphasizes that AI-generated findings need independent verification because many are false positives or exaggerate vulnerability severity.

everyone in crypto thinks they're the main target, but hackers just hit 7 countries' financial systems at the same time banks, tax portals, a central bank, and crypto exchanges all in the same wave the part that should scare you is the AI agents south korea had one attacker use an AI hacking agent to breach 9 banks at once. china-linked hackers used AI agents to hit 200 organisations in 11 days this isn't people sitting behind keyboards anymore, it's automated your bank app going down one morning might not be maintenance and if the money leaves before the bank even confirms something happened, what exactly are you trusting them to protect

mSecure password manager has been hacked, with attackers stealing an encrypted database containing customer information. mSeven Software is now warning current and former users to secure their accounts. The company recommends: - Changing passwords stored in mSecure. - Resetting two-factor authentication (2FA). - Removing existing passkeys. The breach reportedly affects users who synced their vaults through mSecure Cloud.

Security release pre-alert: We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities. The highest severity issue fixed in this release is HIGH. nodejs.org/en/blog/vulnerabi…

⚠️ 🇨🇴 🏛️ 🗄️ PREVENTIVE ALERT - ALLEGED DATA EXFILTRATION FROM THE ADMINISTRATIVE DEPARTMENT OF THE PUBLIC SERVICE OF COLOMBIA (SIGEP) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: ZERTTACK (ATR0PHYX 404) / DATE: NOVEMBER 4, 2026] Centralized cyber-intelligence systems have intercepted a post regarding an alleged data exfiltration on underground forums (made on November 4, 2026) by a user named "zerttack," associated with the group "Atr0phyx 404." The report claims the extraction of records from the Information and Management System for Public Employment (SIGEP) of the Government of Colombia (Administrative Department of the Public Service). The author states that the complete database contains 5,000,000 records of state employees. In this initial phase, a sample of 1,035,394 records has been released for free in CSV format, while the remaining 4 million records are being offered for sale via a Telegram channel. The vulnerability exploited is identified as an Insecure Direct Object Reference (IDOR) within the "persistenceServlet" endpoint, which allowed for the querying of personal identification codes without session validation. It is strictly noted that the occurrence of this intrusion, the exploitation of the vulnerability, and the overall authenticity of the exposed data have not been officially confirmed by the Colombian government or incident response centers. Threat Actor: zerttack (Group: Atr0phyx 404). Victim / Target: Government of Colombia (Administrative Department of the Public Service - SIGEP) — ​​🇨🇴 Colombia. Sector: 🏛️ Public Government Sector, State Administration, Public Employment Management, and Civil Service. Publication Date: November 4, 2026. Reported Volume: 1,035,394 records released for free (out of a total of 5,000,000 extracted records). Attack Vector: Insecure Direct Object Reference (IDOR) via the `persistenceServlet` endpoint. Nature of the Incident: Alleged compromise of state servers and the exposure of personally identifiable information (PII) belonging to public servants and citizens registered in the management system. 🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / GOVERNMENTAL) Audit and Remediation of the Vulnerable Endpoint: IT teams within the Colombian Civil Service must immediately patch the IDOR vulnerability in the `persistenceServlet` service by implementing strict authorization controls and session validation for every query. Protection Against Impersonation and Fraud: Given that national identification numbers (cédula numbers), dates of birth, and email addresses from over one million records have been exposed, it is advised to alert the affected citizens and public servants regarding potential phishing and social engineering campaigns. Monitoring of Clandestine Channels: Track Telegram channels and forums associated with the "Atr0phyx 404" group to assess the authenticity of additional data batches and mitigate the unauthorized dissemination of the remaining database. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Quotes and services: vecert.io/contact #Colombia #PublicService #SIGEP #GovernmentSec #DataLeak #DataBreach #BreachAlert #IDOR #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk

BREAKING: Russian hacker groups NoName057 and Z-Pentest have claimed responsibility for cyberattacks targeting refrigeration systems and supermarkets across Europe.

hacked lol

‼️ Attackers are scanning the whole internet for Linux servers exposed to a critical 9.8 kernel flaw, Marcus Hutchins says. They found 2.1M servers that accept it. Ubuntu still has no patch. The bug, CVE-2026-98432, is a race condition in the code that handles incoming IPv4 TCP connections. It can let a remote attacker run commands as root during the handshake.

🚨 BREAKING: Hackers are hitting the world's money system in 7 places at the same time. This is what Covid looked like in week 1. A few banks. A few apps. Nobody called it a crisis. 1/ France: more than €118 million (about $133 million) was pulled out of Crédit Mutuel Arkéa over several days and turned into crypto. Today its app was down and EVERY transfer was blocked. The bank says customers lose nothing. 2/ Belgium: on October 28, the federal finance ministry said a cyberattack hit it. The online tax portal was SHUT and tax deadlines will be pushed back. 3/ Eurozone: on October 22, the European Central Bank, the bank behind the euro, confirmed that attackers planted malware on one of its websites. 4/ South Korea: at least 9 banks targeted since late September by an attacker using an AI hacking agent. At Shinhan Bank alone, about 25,000 customers had their names, phone numbers, incomes and loan limits exposed. 5/ Japan: hackers broke into GMO Internet and demanded $50 million in crypto. The prime minister promised an emergency anti-cyberattack package. 6/ At least 14 countries: China-linked hackers used AI agents to attack 200+ organisations in just 11 days. Finance was on the target list. 7/ Crypto: more than $6 billion drained from Binance hot wallets on 11 blockchains on October 29, most of it in about 30 minutes. The FBI says North Korea did it. Now zoom out. Hackers now send AI agents to do the work. The French money left over several days before the bank confirmed anything. Fake IDs passed the crypto exchanges' checks. About $63 million in stablecoins became 27,553 Ether in 4 hours. Part of it vanished into Monero, a coin built to hide who sends and who receives. Covid locked the streets. This time the lock is on the bank app, and €118 million is already gone. Nobody is calling this a crisis yet. But central bankers already plan for the day the hackers get in. The G7 agreed to run drills that simulate AI attacks on banks. The ECB gave eurozone banks until October 31 to hand in AI cyber defence plans. And last month the IMF chief warned we may end up with "lots of people with shoeboxes under their beds." We confirm every attack on banks and exchanges before we post it. Follow for the next confirmed case, and share this with anyone whose salary lands in a bank account.