Cyber Threat Intel Daily Briefing — 2026-10-14

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-14 12:15 UTC · REPORT BRIEF-20261014-121555

OPEN // LE

01

Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6

SRC: The Hacker News Wed, 14 Oct 2026 16:49:02 +0530 https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html

02

Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.  Dutch mobil

SRC: The Hacker News Wed, 14 Oct 2026 16:38:22 +0530 https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html

03

An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login reques

SRC: The Hacker News Wed, 14 Oct 2026 16:30:00 +0530 https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html

04

Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities

Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance

SRC: Security Affairs Wed, 14 Oct 2026 10:15:30 +0000 https://securityaffairs.com/200895/hacking/volexity-uncovers-stealthy-ivanti-vpn-attack-using-three-zero-day-vulnerabilities.html

05

Ransomware Gangs Embrace Physical Threats, Family Stalking?

Organizations are reporting that employees face threats to their families, stalking, physical violence, and abduction. But these alarming claims are hard to verify.

SRC: DarkReading Wed, 14 Oct 2026 05:00:00 GMT https://www.darkreading.com/cybersecurity-analytics/ransomware-gangs-physical-threats-family-stalking

06

Google Partially Reverses Chrome Bug Bounty Cuts

Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.  The post Google Partially Reverses Chrome Bug Bounty Cuts appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 17:00:00 +0000 https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/

07

Hidden Audio Recorder Found at OpenAI as Employee Faces Federal Charges

OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy. On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Fra

SRC: Security Affairs Wed, 14 Oct 2026 11:37:42 +0000 https://securityaffairs.com/200933/cyber-crime/hidden-audio-recorder-found-at-openai-as-employee-faces-federal-charges.html

08

US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms

Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location. The post US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 14 Oct 2026 10:55:21 +0000 https://www.securityweek.com/us-arrests-two-in-crackdown-on-north-korean-it-worker-laptop-farms/

09

North Korea Phishes Ukrainians for War Intel

The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.

SRC: DarkReading Tue, 13 Oct 2026 21:24:45 GMT https://www.darkreading.com/cyberattacks-data-breaches/north-korea-phishes-ukrainians-war-intel

10

Justice Department says North Koreans have infiltrated dozens of U.S. companies

U.S. authorities warn that sanctioned hackers are increasingly targeting Americans to act as facilitators between breached U.S. companies and Pyongyang.

SRC: TechCrunch Security Wed, 14 Oct 2026 01:30:42 +0000 https://techcrunch.com/2026/10/13/justice-department-says-north-koreans-have-infiltrated-dozens-of-u-s-companies/

11

Hirudo Android malware replaces banking apps to evade security checks

A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. […]

SRC: BleepingComputer Wed, 14 Oct 2026 07:41:20 -0400 https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/

12

How a leaked builder of XWorm turned a remote access trojan into a surveillance kit

Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold. Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the

SRC: Security Affairs Wed, 14 Oct 2026 05:46:19 +0000 https://securityaffairs.com/200910/malware/how-a-leaked-builder-of-xworm-turned-a-remote-access-trojan-into-a-surveillance-kit.html

13

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes vali

SRC: The Hacker News Tue, 13 Oct 2026 21:48:18 +0530 https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html

14

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services. The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 16:01:00 +0000 https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/

15

UK Housing Ombudsman Service investigates 'security incident'

The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. […]

SRC: BleepingComputer Tue, 13 Oct 2026 14:19:44 -0400 https://www.bleepingcomputer.com/news/security/uk-housing-ombudsman-service-investigates-security-incident/

16

Microsoft: Recent Windows updates may trigger Remote Desktop failures

Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. […]

SRC: BleepingComputer Wed, 14 Oct 2026 06:48:09 -0400 https://www.bleepingcomputer.com/news/security/microsoft-recent-windows-updates-may-trigger-remote-desktop-failures/

17

Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave

Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into hand

SRC: The Hacker News Wed, 14 Oct 2026 11:22:28 +0530 https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html

18

Anthropic Finds Ingredients for Future AI Worms

Anthropic's latest study combined IoT and network tests to explore AI self-replication, which researchers said would be "challenging" to shut down.

SRC: DarkReading Tue, 13 Oct 2026 20:35:23 GMT https://www.darkreading.com/perimeter/anthropic-ingredients-future-ai-worms

19

Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say

Saudi national Abdulrahman Alfozan was arrested Friday and terminated by OpenAI. The post Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 13 Oct 2026 23:07:00 +0000 https://www.securityweek.com/employee-arrested-after-listening-device-found-in-openai-conference-room-fbi-and-the-company-say/

[ SOURCE ] OpenPhish (18 indicator(s))