🚨 Malicious npm packages are abusing lifecycle hooks to deliver Windows malware.

Eight packages tied to the MALFEX campaign logged 40,767 downloads and can deploy Overlord RAT and a Node.js stealer.

Read - https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html

‼️ Attackers hijacked the .gh, .sl and .as ccTLD registries, changed authoritative DNS, and obtained at least 12 unauthorized TLS certificates for Google and YouTube domains.

Google says its systems were not breached. All 12 certificates were revoked.

Read - https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html

🛑 Removing the npm package may not remove the malware.

Compromised tensorlake v0.5.144 shipped a Shai-Hulud worm designed to steal GitHub/AWS credentials, persist on hosts, and republish infected packages.

It's off npm. Installed it? Remove it and rotate credentials.

Read - https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html

🚨 $8,200 paid to ransomware attackers. $150,000 billed to the victim.

DOJ charges MonsterCloud’s owner with fraud, alleging he secretly paid attackers for decryptors while claiming to use proprietary recovery tools.

Over $19 million in client charges.

Read - https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html

‼️ U.S. offers up to $10 MILLION for tips on a Chinese national charged in the HAFNIUM Microsoft Exchange hacks.

Zhang Yu remains at large. Prosecutors accuse him of coordinating hacking operations linked to China's intelligence service.

Read- https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html

🚨 16 malicious Firefox extensions posed as Rabby and OKX wallets to steal recovery phrases and private keys.

Their code intercepted wallet secrets during import and attempted to send them to attacker-controlled Cloudflare Workers.

All 16 have been removed.

Read - https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html

A phishing scanner may never see the page attackers want victims to open.

Meet Wazza.

It uses browser checks, short-lived session tokens, and multi-stage redirects to conceal an Adobe-themed Device Code phishing lure.

ANYRUN exposes the attack chain: https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html

September’s attacks showed how quickly cyber risk can move beyond the SOC. ⚠️

🇺🇸 51% of CSuite sandbox sessions came from the US
🔐 M365 sessions + endpoints compromised in one attack chain
🧩 Trusted platforms like Adobe, DocuSign & Microsoft 365 abused
💳 114 malicious domains powered IronToll’s real-time payment phishing

The outcome for enterprises: wider incident scope, harder containment, greater fraud exposure, and higher response costs. 📈

👉 See what September’s attacks reveal about enterprise risk — and close the gaps now: https://thn.news/cyber-attacks-sept2026

‼️ An AI pentesting tool was used in attacks that exfiltrated data from South Korean financial firms.

CrowdStrike uncovered the ARTEX campaign through exposed Claude Code sessions. The tool's developer is now moving it to closed source.

Read - https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html

A fake Ukrainian police document appears on screen. A credential-stealing RAT deploys in the background.

Russia-aligned UAC-0099 uses the decoy to deliver ASHVEIN, which also hides attacker commands inside invisible HTML elements.

Read - https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html

🛑 Japan's web data leaks are surging: 119 reported incidents in 2026 vs. 84 in all of 2025. 81 were disclosed since July.

JPCERT/CC reports attackers abusing mobile app APIs and exploiting a Metabase SQL injection flaw. How most incidents began remains unclear.

Read - https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html

⚡ ThreatsDay Bulletin: Malicious code, exposed tools, AI phishing, and criminals stealing from criminals.

This week's 15 stories ↓

→ Malicious editor themes + dev packages
→ C2 infrastructure traced
→ WhatsApp-delivered RAT
→ Ransomware extradition + affiliate betrayal
→ Medical device PQC gaps
→ Trusted-domain phishing + rogue RMM
→ File-upload flaws exploited for web shells
→ AI profiling users and non-users
→ Phishing targeting humans + AI agents
→ Insider sabotage leads to prison
→ Attacker toolkit left exposed
→ Weak cookies enable impersonation
→ Global scam-center crackdown

Full ThreatsDay ↓ https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html

🛑 China-linked hackers didn't just steal emails. They ran a web portal giving third parties access to stolen mail, the FBI says.

Victims included government, police, and healthcare organizations in Southeast Asia. Their toolkit included 1,300+ scanning scripts.

Read: https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html

🔥 FBI seized 7 domains tied to China-linked Flax Typhoon.

The disrupted tools were used to scan critical infrastructure and, in some cases, infiltrate networks.

One scanner, MicroScan, included 1,300+ vulnerability-testing scripts.

Read: https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html

‼️ Citrix patches another critical NetScaler flaw as three separate bugs face active exploitation.

CVE-2026-107406 (CVSS 9.5) could enable RCE or DoS in affected SAML IdP/SP configurations. No evidence this flaw has been exploited.

Read > https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html

🚨 Fully patched. Hacked remotely. Three times.

Three teams successfully demonstrated remote hacks against Google's Pixel 10 at Pwn2Own Ireland, earning $562,500 combined.

The exploit details remain undisclosed.

Read: https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html

‼️ A GoBalance flaw lets attackers hijack .onion addresses without breaching servers.

Just one public descriptor can expose a site's master key if it uses Tor-format keys. Dread and Omega have moved to new addresses.

https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html

54% of organizations have no formal identity security program for AI agents. For human identities, that figure is just 23%.

SailPoint's latest report exposes a widening gap between AI agent adoption and identity security maturity.

Read more → https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html

⚠️ China-linked Flax Typhoon exploited five flaws now added to CISA's KEV catalog.

The flaws affect ProFTPD, ONLYOFFICE, Strapi, Apache Struts, and ISC BIND.

U.S. federal agencies must patch or stop using affected software by October 11.

Read → https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html

🚨 Attackers are exploiting two AhsayCBS flaws to deploy web shells and XMRig miners disguised as Microsoft Edge (edge.exe).

Huntress says even the latest version, 10.3.4, remains vulnerable.

Read about it here → https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html