IT News Analysis

1

CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX , an autonomous AI penetration testing framework, to single out entities in South Korea and Japan. "These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," security researchers Bakuei Matsukawa and Joseph C Chen said. "They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control." The first of the three attacks has been found to abuse CyberStrikeAI , another open-source penetra...

Oct 27, 2026

2

The Toxic Combination: 62% of Agents Are One Prompt Away From Exfiltration

Get the report: how one unreviewed pair of permissions turns a single agent into a breach.

3

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked certificates. That is a setup an operator turns on deliberately; a default build does not.  GoAhead 6.1.1 , released to device makers on August 2, 2026, and publicly published on October 12, fixes it. GoAhead is a small web server that device makers build into firmware to run management pages on routers, printers, gateways and industrial controllers. Its maker, EmbedThis, says it runs in hundreds of millions of devices. The flaw was found by Sébastien Féry of FoxIO, who described it and two other TLS problems in a  write-up  on October 26. On an affected build, the server...

Oct 27, 2026

4

Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against specific individuals using devices running iOS before iOS 27. The fixes have now been expanded to include iOS 18.7.11 and iPadOS 18.7.11, which support iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against ...

Oct 27, 2026

5

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as  CVE-2026-80097  and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests, the tokens gave full access to the account's email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks. The research comes from Ofek Levin, working through a fellowship program at the security firm  Enclave , which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important." On Android, Authenticator does more than show six-digit codes. It also acts as a broker: when ...

Oct 27, 2026

6

Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a  statement  on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners' recovery phrases or wallet private keys. Keystone will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one. Keystone found the unauthorized access on October 20, and its advice to owners depends on when a device arrived. For a device received after that date with the old key, the company said: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." Owners of such a device should contact Keystone support and use it only after the company confirms it is genuine. A device del...

Oct 27, 2026

7

Turn Your Next Employee Mistake Into a Training Moment, Not a Breach.

Build safer habits with Adaptive's interactive training tailored to your team's roles and real-world risks.

8

AI-Generated Fake Login Pages Are Making Account Takeovers Easier

Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations.  Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain access to corporate accounts even when additional security measures are in place. How AI is making fake login pages more convincing Attackers have long used fake login pages to steal credentials, but generative AI makes it easier to create convincing replicas of legitimate authentication portals. From company logos and page layouts to login prompts, these fraudulent pages can closely resemble the websites employees regularly access. AI also makes it easier to tailor phishing campaigns to specific organizations or employees. For example, attackers can create personalized IT notifications ...

Oct 27, 2026

9

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up from where Operation SyncHole left off. "The group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target," Sojun Ryu, senior security researcher at Kaspersky GReAT, said in an exhaustive analysis. Operation SyncHole was first documented by Kaspersky in April 2025, detailing the state-sponsored adversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024 to deliver malwa...

Oct 27, 2026

10

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence,  told ABC News  in an interview published on October 27. ASD is Australia's foreign signals intelligence and cyber security agency. Its  offensive cyber operations  need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure. Amadey was sold to criminals as a service in 2018, according to  ESET's analysis of Amadey . Each buyer runs its own control panel on its own servers. Computers infected with Amadey check ...

Oct 27, 2026