The latest ThreatsDay bulletin highlights a diverse array of cyber threats ranging from critical firewall vulnerabilities to the weaponization of AI tools. Security researchers observed that while some attacks require significant technical skill, others exploit simple oversights such as exposed passwords or unpatched legacy bugs. A recurring theme is the misuse of trust in familiar applications and AI agents to facilitate unauthorized access.
In a significant development regarding network security, Hudson Rock identified a new phase of the FortiBleed credential harvesting campaign, dubbed FortiBleed 2.0. The investigation uncovered 975 newly identified domains and over 40,500 exposed secrets, including more than 37,000 local-user records and nearly 1,600 Active Directory LDAP bind records. These credentials were extracted from 1,703 FortiGate source files associated with 1,689 host identifiers, with configuration data dating back to February 2026. Concurrently, Fortinet released a coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer to address critical flaws discovered through an AI-assisted vulnerability approach. Details regarding these specific issues remain under embargo until November 10, 2026.
The threat landscape also saw the emergence of new malware-as-a-service operations targeting financial institutions. CloudSEK reported on "MR ROBOT," a platform allowing cybercriminals to rent customized banking trojans specifically designed to target Indian banks. This operation enables affiliates to steal one-time passwords, card details, and UPI PINs while secretly forwarding calls to bypass security checks. The kit impersonates approximately 36 legitimate applications, including banks and government services, with one affiliate reportedly intercepting over 5,400 text messages from infected devices.
AI technology continues to be a double-edged sword in cybersecurity. Bank of America issued a warning urging customers never to share banking credentials with AI agents or tools acting on their behalf. Meanwhile, attackers are leveraging AI to scale their operations; Cequence tracked a single actor impersonating 32 different AI bots, including ChatGPT and Claude, to scan for passwords and API keys across various sectors. Additionally, SOCRadar exposed the live workspace of the n0n ransomware group, revealing an AI coding agent configured with 150 models to generate hundreds of attack scripts, costing over $7,200 in usage fees.
Several critical software vulnerabilities were actively exploited during the reporting period. Researchers at VulnCheck noted that threat actors are exploiting CVE-2026-42589, a critical remote code execution flaw in Gotenberg with a CVSS score of 9.8. Despite being patched in May 2026, the vulnerability recorded over 1,300 exploitation events in the past month alone. In another incident, Microsoft addressed a zero-permission token theft flaw in Microsoft Authenticator (CVE-2026-80097), which allowed unprivileged Android apps to impersonate trusted applications and steal authentication tokens without requiring additional permissions.
Supply chain and repository compromises remain prevalent. JFrog and SafeDep discovered a campaign where attackers hijacked 42 GitHub repositories to deploy polymorphic wrappers designed to evade detection. These malicious packages, linked to the Miasma-family npm worm, steal credentials and install wipers that delete home directories when victims revoke stolen tokens. Separately, a scan of 7.25 million public repositories on China's Gitee platform revealed over 26,000 unique verified-live credentials, including an active organization-admin credential for a major enterprise AI platform.
Other notable incidents include the hijacking of institutional DNS records by threat actors to host illegal gambling content under the guise of legitimate school and government domains. In the Philippines, a significant operational security failure resulted in the theft of 68 GB of government data, with the attacker leaving a detailed transfer log publicly accessible on the internet. Furthermore, Huntress reported that attackers are abusing camera management software and legitimate mobile device management platforms like Hexnode and Rippling to establish persistent remote access within enterprise networks.
Sources: The Hacker News.