In partnership with

~6 MIN READ
FACT The FBI says ShinyHunters and associated actors breached more than 140 organizations and collected over $70 million in extortion payments in the past year. (FBI via BleepingComputer, October 2026)
The Signal
 
This edition is about attack surface hiding in things we stopped questioning: hardware, vendors, and even example code. Plus AI agents doing in minutes what used to take a team.

PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe →
In this edition
  📌 Big Cyber News
  🚨 Can't Miss
  🤖 AI in Cyber
  🏛️ Privacy, Power & Policy
  🛠️ Tools & Tactics
  🧪 Strange Cyber
📌 Big Cyber News
 
Supply Chain / Crypto
A Ledger Reseller's Wallets Had a Hidden Implant. Suspected Losses Top $93M.
Intro
The whole point of a hardware wallet is that the hardware is the part you can trust. Ledger now says at least one device sold through a reseller carried hardware it never put there.
What Happened
Ledger says every confirmed case tied to an October 9 draining incident involves devices sold through CryptoBilis, a Southeast Asia reseller, and it confirmed one affected device contained an unauthorized hardware implant. On-chain researchers, citing a Bitquery investigation, put suspected losses above $93 million. Former Mt. Gox CEO Mark Karpelès says his tampered unit, bought in Malaysia, hid a small board under the screen that captured the seed phrase and transmitted it to an attacker.
Why It's Important
Karpelès says his device still passed Ledger's Genuine Check because the security chip itself was real. A software authenticity check can't see a second circuit board.
The Other Side
Ledger says its own systems and direct sales channels were not compromised, and it hasn't explained how the implant works. CryptoBilis has stopped selling hardware wallets.
 
👉 Takeaway
Bought a Ledger from CryptoBilis in the last 90 days? Don't initialize it. If you already did, move funds to a new device with a new seed phrase, ideally bought directly from Ledger.
TL;DR: Wallets from one reseller allegedly shipped with seed-stealing implants, and Ledger's authenticity check couldn't tell.
Further reading: Help Net Security
🚨 Can't Miss
 
 
Law Enforcement
Edward Dubrovsky, Canadian co-founder of extortion-negotiation firm CYPFER, was arrested at a cybersecurity conference in Pennsylvania. Charges filed in the Eastern District of Texas include Hobbs Act extortion. The complaint is sealed; KrebsOnSecurity's sources tie the arrest to the FBI's ShinyHunters investigation, which the FBI has not confirmed.
→ Charges aren't convictions, but your negotiator sees your worst day. Vet them like an insider.
 
Data Exposure
Big Echo operator Daiichi Kosho outsources customer data to Nippon Columbia Group, which found malware on an employee's computer on October 5. Records for 8,631,000 customers and 93,000 employees were exposed: names, birth dates, emails, and phones. Passwords were not, and Daiichi Kosho says it has not confirmed any theft.
→ Your vendor's laptop is your attack surface, whatever the contract says.
 
Exploited Vuln
Attackers are exploiting CVE-2026-85097 in Bricksforge, an add-on for the Bricks site builder, to upload and run PHP without logging in. Patchstack first saw exploitation on October 7 from 63 IP addresses, in patterns that look automated. Versions up to 3.1.8.9 are vulnerable; update to 4.0.1.
→ After patching, check /wp-content/uploads/bricksforge/tmp/ for stray PHP files. A patch doesn't remove a web shell.

Stop losing deals in between meetings.

Aligned is changing how B2B teams run their most important deals.

Most reps guess where a deal really stands. They forecast on a gut feeling and the buyer’s word vs what's actually happening. Then they realize the deal slipped through only after it's too late. Aligned surfaces what buyers are actually doing inside every deal: the risks, the openings, and the exact next step to keep things moving.

Start increasing your close rates and stand up your first deal room in minutes.

Start Now For Free

🤖 AI in Cyber
 
 
AI Offense
SOCRadar caught CyberXero, a Russian-speaking access broker, via an exposed directory. In one run, its 51 Claude Code agents scanned 4,708 targets, got into 429 WordPress admin panels, and deployed 32 web shells in 61 seconds. It stole 628,000+ Ukrainian records. Refused? The actor reopened the session claiming an "authorized pentest."
→ Guardrails reset with the session. Plan detection for volume.
 
OT Security
In Booz Allen's mock-factory OT lab, two unnamed frontier models achieved all eight attack scenarios, from mapping to SCADA compromise. One went from perimeter to the control network in just over 16 minutes; another moved a robotic arm using vendor default credentials. Humans approved every exploit.
→ Default creds in OT were always bad. Now they're a 16-minute problem.
🏛️ Privacy, Power & Policy
 
 
Surveillance
Graylark's Raven, formerly GeoSpy, can now match one interior photo to a specific property using Airbnb, Vrbo, and Zillow listing photos. The LAPD and Miami-Dade Sheriff's Office have bought access; Airbnb and Zillow say scraping violates their terms. Graylark restricted access to government and enterprise users only after 404 Media asked about Discord users seeking help stalking women.
→ Every listing photo is now a location lookup.
 
AI Training Data
Google would pay defunct Spirit Airlines $10 million for about 100 million emails, 500 million Teams messages, and payroll and tax records to train AI. A letter led by Sen. Elizabeth Warren and Rep. Steven Horsford says removing identifiers doesn't make data anonymous. Google says a third party will deidentify it first.
→ When a company dies, its inbox becomes an asset for sale.
🛠️ Tools & Tactics
 
 
Certificates
Let's Encrypt starts issuing 64-day certificates in staging on October 14 and makes 64 days the default on February 10, 2027, with 45 days expected in 2028. Authorization reuse also drops from 30 days to 10. The play: test your ACME client in staging, confirm it supports ARI, and search cron jobs, wrapper scripts, and runbooks for hardcoded renewal values like 83, 80, or 60 days. Then make sure a failed renewal actually alerts someone.

Find what the client said, weeks later

Ask Wispr Flow Notetaker one question across every meeting you've had and get an answer with citations back to the call. Pricing, deadlines, who owns what. Free to try on Windows and Mac.

Get Wispr Flow Notetaker

🧪 Strange Cyber
 
Strange but real
A Domain Developers Used as a Placeholder for Years Now Serves Malware
Intro
Every developer knows example.com is safe to paste into docs. Fewer know that third-party.com isn't reserved, and someone is now cashing in on that gap.
What Happened
Manifold Security found third-party.com in W3C specs, Chromium docs, and more than 1,500 files across 1,700+ repositories. Visit it from Windows and you get a fake Cloudflare "security verification" page that copies a PowerShell command to your clipboard and tells you to paste it into Win+R. Mac and Linux visitors get a polite "unsupported system" page instead.
Why It's Important
Placeholder text is still a live URL. Any doc, test, or code sample that calls an unreserved domain trusts whoever owns it this year.
The Other Side
No infections have been confirmed from the doc references, and BleepingComputer couldn't determine who controls the domain now (it was first registered in 1996).
 
👉 Takeaway
Search your repos and docs for third-party.com, and stick to the IANA-reserved example.com, .net, and .org for placeholders.
TL;DR: A fake domain from the docs turned out to be a real one, and it's serving ClickFix.
Further reading: BleepingComputer

Your search bar is ghosting shoppers with “0 results found.” Gladly understands what your shoppers mean and turns dead ends into product recommendations.

See how it works

Keep Reading

© 2026 Exzec Cyber's Newsletter..
beehiivPowered by beehiiv