🚨 16 malicious Firefox extensions posed as Rabby and OKX wallets to steal recovery phrases and private keys.

Their code intercepted wallet secrets during import and attempted to send them to attacker-controlled Cloudflare Workers.

All 16 have been removed.

Read - https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html

A phishing scanner may never see the page attackers want victims to open.

Meet Wazza.

It uses browser checks, short-lived session tokens, and multi-stage redirects to conceal an Adobe-themed Device Code phishing lure.

ANYRUN exposes the attack chain: https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html

September’s attacks showed how quickly cyber risk can move beyond the SOC. ⚠️

🇺🇸 51% of CSuite sandbox sessions came from the US
🔐 M365 sessions + endpoints compromised in one attack chain
🧩 Trusted platforms like Adobe, DocuSign & Microsoft 365 abused
💳 114 malicious domains powered IronToll’s real-time payment phishing

The outcome for enterprises: wider incident scope, harder containment, greater fraud exposure, and higher response costs. 📈

👉 See what September’s attacks reveal about enterprise risk — and close the gaps now: https://thn.news/cyber-attacks-sept2026

‼️ An AI pentesting tool was used in attacks that exfiltrated data from South Korean financial firms.

CrowdStrike uncovered the ARTEX campaign through exposed Claude Code sessions. The tool's developer is now moving it to closed source.

Read - https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html

A fake Ukrainian police document appears on screen. A credential-stealing RAT deploys in the background.

Russia-aligned UAC-0099 uses the decoy to deliver ASHVEIN, which also hides attacker commands inside invisible HTML elements.

Read - https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html

🛑 Japan's web data leaks are surging: 119 reported incidents in 2026 vs. 84 in all of 2025. 81 were disclosed since July.

JPCERT/CC reports attackers abusing mobile app APIs and exploiting a Metabase SQL injection flaw. How most incidents began remains unclear.

Read - https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html

⚡ ThreatsDay Bulletin: Malicious code, exposed tools, AI phishing, and criminals stealing from criminals.

This week's 15 stories ↓

→ Malicious editor themes + dev packages
→ C2 infrastructure traced
→ WhatsApp-delivered RAT
→ Ransomware extradition + affiliate betrayal
→ Medical device PQC gaps
→ Trusted-domain phishing + rogue RMM
→ File-upload flaws exploited for web shells
→ AI profiling users and non-users
→ Phishing targeting humans + AI agents
→ Insider sabotage leads to prison
→ Attacker toolkit left exposed
→ Weak cookies enable impersonation
→ Global scam-center crackdown

Full ThreatsDay ↓ https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html

🛑 China-linked hackers didn't just steal emails. They ran a web portal giving third parties access to stolen mail, the FBI says.

Victims included government, police, and healthcare organizations in Southeast Asia. Their toolkit included 1,300+ scanning scripts.

Read: https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html

🔥 FBI seized 7 domains tied to China-linked Flax Typhoon.

The disrupted tools were used to scan critical infrastructure and, in some cases, infiltrate networks.

One scanner, MicroScan, included 1,300+ vulnerability-testing scripts.

Read: https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html

‼️ Citrix patches another critical NetScaler flaw as three separate bugs face active exploitation.

CVE-2026-107406 (CVSS 9.5) could enable RCE or DoS in affected SAML IdP/SP configurations. No evidence this flaw has been exploited.

Read > https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html

🚨 Fully patched. Hacked remotely. Three times.

Three teams successfully demonstrated remote hacks against Google's Pixel 10 at Pwn2Own Ireland, earning $562,500 combined.

The exploit details remain undisclosed.

Read: https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html

‼️ A GoBalance flaw lets attackers hijack .onion addresses without breaching servers.

Just one public descriptor can expose a site's master key if it uses Tor-format keys. Dread and Omega have moved to new addresses.

https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html

54% of organizations have no formal identity security program for AI agents. For human identities, that figure is just 23%.

SailPoint's latest report exposes a widening gap between AI agent adoption and identity security maturity.

Read more → https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html

⚠️ China-linked Flax Typhoon exploited five flaws now added to CISA's KEV catalog.

The flaws affect ProFTPD, ONLYOFFICE, Strapi, Apache Struts, and ISC BIND.

U.S. federal agencies must patch or stop using affected software by October 11.

Read → https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html

🚨 Attackers are exploiting two AhsayCBS flaws to deploy web shells and XMRig miners disguised as Microsoft Edge (edge.exe).

Huntress says even the latest version, 10.3.4, remains vulnerable.

Read about it here → https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html

‼️ Researchers have published a working exploit for an AnyDesk Linux flaw that can execute commands as root before connection approval.

Called AnyPwn, the exploit targets version 8.0.2 via direct TCP port 7070. The flaw was fixed in 8.0.3.

Details → https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html

⚡ Anthropic launches OSS Scanner, a free AI-powered vulnerability scanning service for open-source projects.

Selected projects can opt in for periodic security scans, with fully AI-generated vulnerability reports that require no human review.

Read → https://thehackernews.com/2026/10/anthropic-launches-free-ai.html

🛑 TP-Link now faces lawsuits in 5 U.S. states.

The latest four allege misleading router security claims and overstated separation from China. TP-Link denies the allegations.

21 state AGs have also raised concerns with the FCC over new router approvals.

Read → https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html

🚨 DarkSword's new P7 iOS variant goes beyond data theft.

Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds.

Details: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html

‼️ BREAKING - FBI announces a third ShinyHunters-linked arrest made public since its jobs portal breach.

The suspect is reportedly a Canadian detained in Pennsylvania, believed to have been directly involved in the hack.

Details: https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html