ARTEX claimed a named victim: developer platform WorkOS says an attacker used the agentic pentest framework to breach an internal sales app, exposing business contact records and summaries of customer communications (BleepingComputer). Kevin Beaumont, who has run the tool, is blunt that "it's not very good" yet "clearly being used to own lots of orgs" (GossiTheDog); hunters are fingerprinting exposed consoles on the ARTEX Gateway header and the "Autonomous Penetration Testing Console" page title (@cyb3rops). Chinese researchers separately warn that a widely shared modified ARTEX project and Docker image ships a backdoor and should be deleted (poisoning advisory) (earlier coverage).
· Threat Activity
Apple's October 29 threat notifications reached members of Germany's political elite, including Bundestag members and delegation staff who traveled with Chancellor Merz to South Korea, Japan and Singapore; Green co-leader Franziska Brantner confirmed she was among them, and the wave spanned targets in 99 countries. BSI wrote to recipients within 24 hours telling them to assume their devices are infected and replace them, while saying it cannot confirm how many were actually infected, identify the spyware, or name the operator; zero-click delivery is suspected (The Record, CyberInsider).
· Nation-State & Espionage
October 20, 2026
ROMULUS is a newly documented ClickFix delivery platform distributing LegionLoader and other malware. Operators use bogus landing pages to persuade visitors to run malicious commands themselves, packaging the now-common social-engineering pattern into reusable delivery infrastructure. The Hacker News
· Threat Activity
October 8, 2026
The detained ShinyHunters leader was mid-extortion of a Boeing spin-off when arrested. Krebs identifies "Rey" as Saif Al-din Khader of Amman, detained while the group was extorting Jeppesen ForeFlight, and reports he is cooperating with the FBI; the group's access route remains mass exploitation of PeopleSoft flaw CVE-2026-35273, used as a zero-day from June (KrebsOnSecurity). Denmark's CERT notes the FBI has confirmed further arrests in the case (CERT.dk). (earlier coverage) (discussion)
· Arrests & Enforcement
October 3, 2026
Zimbra CVE-2026-73570 was exploited before public disclosure. Microsoft reports the OS command injection flaw was abused shortly after patches shipped, achieving RCE via SMTP requests, with attackers dropping webshells, reverse shells and persistence (SecurityWeek).
· Edge Devices Under Fire
September 24, 2026
Free-tier GitHub Codespaces as disposable attack infrastructure. Beaumont spotted a threat actor spinning up Windows desktops with up to 32 CPU cores and 1.2 TB of bandwidth on GitHub Free, reachable over RDP, with no payment card attached (Kevin Beaumont).
· Offensive Tradecraft & Research
September 1, 2026
Anthropic is force-logging-out Claude users and stripping stored payment data after commodity infostealers were found harvesting authenticated Claude sessions and replaying them to consume victims' usage; Anthropic says the activity is unrelated to malware distributed through Claude (SecurityWeek, Dark Reading). As @Privacy_Hawk puts it, stealers like Vidar, Lumma and StealC don't need the password if they can lift an already-authenticated browser session (earlier coverage).
· AI & Model Security
August 29, 2026
ESET documented GuardBreaker, an anti-EDR technique used by Russia-aligned UAC-0099 against a Ukrainian victim (@thegrugq), continuing a busy week for the group (earlier coverage). Separate analysis traces a UAC-0099 WSF lure through a LUNCHPOKE → BURNYBEAR → MATCHBOIL.V2 chain with claimed overlap into Sandworm activity (chain analysis).
· Threat Activity
August 22, 2026
FTP server banners are being used as dead drop resolvers to stage two new Windows RATs, E4del and PINHOLE — an unusual channel that most egress monitoring will treat as benign protocol chatter (BleepingComputer).
· Threat Activity
August 21, 2026
GTA VI footage and material continue to leak, with the extortionist demanding gameplay changes and running an associated cryptocurrency. vx-underground's read is that infostealer malware on employee machines is the likelier root cause than a direct network compromise (vx-underground).
· Threat Activity