Cyber Threat Intel Daily Briefing — 2026-10-20

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-20 12:15 UTC · REPORT BRIEF-20261020-121510

OPEN // LE

01

OVHcloud CLI releases backdoored on GitHub to steal developer secrets

French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. […]

SRC: BleepingComputer Tue, 20 Oct 2026 07:31:22 -0400 https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/

02

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the

SRC: The Hacker News Tue, 20 Oct 2026 12:41:45 +0530 https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html

03

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research – Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus land

SRC: The Hacker News Tue, 20 Oct 2026 09:35:58 +0530 https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html

04

'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery

Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.

SRC: DarkReading Mon, 19 Oct 2026 19:55:01 GMT https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery

05

Microsoft Treats AI Agents as Insider Threats in New Security Framework

Microsoft urges organizations to secure AI Agents as insider threats, using dynamic permissions, continuous risk monitoring and automated containment. Microsoft published a detailed blog post explaining how organizations should secure AI agents. Microsoft sees them as a growing insider threat, not j

SRC: Security Affairs Tue, 20 Oct 2026 07:44:29 +0000 https://securityaffairs.com/201336/ai/microsoft-treats-ai-agents-as-insider-threats-in-new-security-framework.html

06

Blackwall quadruples valuation to $2.2B as websites wrangle an increasingly crowded internet

Blackwall has raised $100M at a $2.2B valuation to continue building security and filtering tools that help websites grapple with growing bot and AI traffic.

SRC: TechCrunch Security Tue, 20 Oct 2026 07:01:00 +0000 https://techcrunch.com/2026/10/20/blackwall-quadruples-valuation-to-2-2b-as-websites-wrangle-an-increasingly-crowded-internet/

07

Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic

At risk, the Oregon Democrat warned, are online crime tipsters, whistleblowers and others. The post Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic appeared first on CyberScoop.

SRC: CyberScoop Mon, 19 Oct 2026 18:27:32 +0000 https://cyberscoop.com/wyden-urges-federal-adoption-encrypted-client-hello/

08

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources c

SRC: Krebs on Security Mon, 19 Oct 2026 13:48:56 +0000 https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

09

Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that

SRC: The Hacker News Tue, 20 Oct 2026 11:23:16 +0530 https://thehackernews.com/2026/10/ex-openai-engineer-detained-in-spy.html

10

Researchers Infiltrate Microsoft Tech Support Scam Operation

A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.

SRC: DarkReading Mon, 19 Oct 2026 21:13:41 GMT https://www.darkreading.com/threat-intelligence/microsoft-tech-support-scam-operation

11

DHS to ban DeepSeek from federal civilian agencies

The order cites national security concerns, including sending data to servers in China, the potential for malware and the overall risk to federal IT systems. The post DHS to ban DeepSeek from federal civilian agencies appeared first on CyberScoop.

SRC: CyberScoop Mon, 19 Oct 2026 15:27:20 +0000 https://cyberscoop.com/dhs-bans-deepseek-federal-agencies/

12

AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive

A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied

SRC: Security Affairs Tue, 20 Oct 2026 10:53:15 +0000 https://securityaffairs.com/201346/data-breach/afd-email-breach-exposes-421000-messages-in-anonymous-online-archive.html

13

970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach

Paradigm Healthcare Services detected an intrusion in October 2025, but it took nearly a year to start notifying affected individuals. The post 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 20 Oct 2026 09:33:49 +0000 https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/

14

ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.

SRC: DarkReading Mon, 19 Oct 2026 19:19:33 GMT https://www.darkreading.com/identity-access-management-security/connectwise-disables-cloud-backups-downstream-msps

15

Nikkei discloses third data breach in a month, 1.8M records exposed

Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. […]

SRC: BleepingComputer Mon, 19 Oct 2026 17:49:48 -0400 https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/

16

WordPress SEO plugin Rank Math compromised to backdoor websites

Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. […]

SRC: BleepingComputer Mon, 19 Oct 2026 17:24:51 -0400 https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/

17

Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16. The post Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 19 Oct 2026 15:20:53 +0000 https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/

18

Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring

Microsoft says companies should treat AI agents as insiders, and is adding controls that grant access per task and tighten it as an agent’s risk rises. The post Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 20 Oct 2026 11:30:18 +0000 https://www.securityweek.com/microsoft-targets-rogue-ai-agents-with-dynamic-permissions-risk-scoring/

19

Ahold Delhaize: Cyberattack affects services across US and Europe

Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. […]

SRC: BleepingComputer Tue, 20 Oct 2026 07:18:35 -0400 https://www.bleepingcomputer.com/news/security/ahold-delhaize-cyberattack-affects-services-across-us-and-europe/

20

Hackers Steal 1.8 Million Records From Nikkei

The compromised information includes names, addresses, email addresses, phone numbers, and dates of birth. The post Hackers Steal 1.8 Million Records From Nikkei appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 20 Oct 2026 10:35:18 +0000 https://www.securityweek.com/hackers-steal-1-8-million-records-from-nikkei/

21

Revolut outage disrupts online banking operations worldwide

Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. […]

SRC: BleepingComputer Tue, 20 Oct 2026 05:46:44 -0400 https://www.bleepingcomputer.com/news/security/revolut-outage-disrupts-online-banking-operations-worldwide/

[ SOURCE ] OpenPhish (18 indicator(s))