A stock exchange spied on for five months, and a phishing kit that walks past your second check

A quiet pattern runs through today’s news: the strongest attacks don’t break the locks. They borrow legitimate tools, trusted logins, and ordinary-looking files, then walk straight in. Here’s what happened, how each one worked, and what it means for you.

Five months inside an inbox, using tools that were already there

Researchers at Symantec and Carbon Black, two threat-intelligence teams, disclosed this week that an unknown attacker spied on a senior executive at a major global stock exchange for at least five months [1][2]. The exchange wasn’t named.

The attacker didn’t smash anything. They got administrative control of the executive’s machine, then leaned on software the computer already trusted. One piece of their malware was disguised as Adobe software; another posed as OneDrive [2]. To stay hidden, they set a fake “Lenovo system health check” to run on a schedule — a detail that shows they knew the exact machine they were on [2]. Stolen data left through Dropbox, so it looked like normal traffic rather than an alarm [2].

This is called “living off the land” — using a system’s own legitimate tools so the activity blends in. It works because security software looks for strange new programs, and there were none to find. The first sign investigators caught likely came from “lateral movement” — the attacker hopping from an already-compromised device to this one [2]. By the time anyone noticed, they were already in.

The prize was the inbox itself. Months of one finance executive’s email — contacts, calendars, deal details. As the researchers put it, that access lets an attacker “build a near-complete picture of the target’s working life and the organization’s near-term direction” [2]. At a stock exchange, that can mean non-public information about listings and market-moving events [2].

What we still don’t know: who was behind it, and how they first got in [1][2]. The trail picks up on October 10, 2025, already deep inside [2].

For you: the lesson isn’t about exchanges — it’s that a quiet, patient intruder leaves almost no obvious trace. The defence is layers, not one wall: a separate login check on email, alerts when a new device signs in, and treating an unexpected “verify your account” prompt as suspicious until proven otherwise.

A phishing kit that gets past your second login check

The FBI flagged a phishing kit called Kali365 last month, and a new report from security firm Arctic Wolf says it’s expanding fast [8]. It started by attacking Microsoft 365 accounts. Now it targets Amazon’s AWS, the login service Okta, and several Russian platforms — including MAX Messenger, a state-backed app with more than 80 million users [8].

Here’s the part worth understanding. Many people now use multi-factor authentication — a second check beyond your password, like a code from an app. It blocks attackers who only have your password. Kali365 gets around it with “device code phishing.”

Device codes are the short codes a smart TV or printer shows you, which you type into your phone to finish signing in [8]. The attack abuses that flow. The criminal starts a real login request, then tricks you — through a fake “shared OneDrive file” or a “security verification” email — into typing the code on the genuine login page [8]. You authenticate, you complete your second check, and the service hands the access to the attacker’s session [8]. They never needed your password, and your second check didn’t stop them, because you did the verifying for them [8].

The FBI’s warning put it plainly: Kali365 hands less-skilled criminals “AI-generated phishing lures, automated campaign templates,” and the tools to steal login tokens [8]. That’s “phishing-as-a-service” — a kit rented out so anyone can run a professional-grade scam.

For you: be suspicious of any message asking you to enter a code or “verify” a login you didn’t start. If you didn’t just try to sign in, don’t type the code. A real second-factor prompt only appears after you begin a login.

Two breaches, one weak spot: the third party

IMA Diligence Services, a US financial-consulting firm, is notifying 525,306 people that their personal data was stolen [4]. The company first noticed in mid-December, when a “legacy server managed by a third party” became unreachable [4]. Attackers had been inside that server for about eight days, from December 8 to 16, copying files [4].

The stolen data is sensitive: names, addresses, Social Security numbers, driver’s licence numbers, account and credit-card numbers, and in some cases passport numbers and health information [4]. A ransomware group calling itself Genesis claimed the attack and says it took 700 gigabytes [4]. That part is the gang’s claim, not confirmed fact — but the breach and its scale are confirmed by the company itself [4].

The detail that matters: the breach came through a third party’s server, not IMA’s own systems [4]. This is how a lot of breaches happen now — your data is only as safe as the least careful company that holds a copy of it. IMA is offering 12 months of free credit monitoring to those affected [4].

For you: if you get a breach notice, take the free credit monitoring — it’s worth the few minutes. And consider a credit freeze, which blocks new accounts from being opened in your name. It’s free and reversible.

Flaws under active attack: Linux and WordPress

Two vulnerability warnings landed today, and both are already being exploited — meaning attackers are using them right now, not just in theory.

The first is a Linux kernel flaw, an “improper authentication” bug [3]. It lets an attacker who already has a foothold escalate their privileges and “escape containers” — break out of the isolated box that’s meant to keep one program from touching the rest of the system [3]. That turns a small intrusion into full control. Organisations running affected Linux systems were urged to patch [3].

The second hits WordPress, which powers a large share of the web. Attackers are exploiting flaws in two plugins, Kirki and Burst Statistics, to gain higher privileges and take over websites [7]. Plugins are a recurring weak point: a site can be fully patched, but one outdated add-on is an open door.

For you: most people don’t run Linux servers, but plenty run small WordPress sites. If you do, update your plugins — or set them to update automatically. Outdated plugins are one of the most common ways small sites get hijacked.

The fight over who gets to report bugs

A quieter story shows the human side of security. Microsoft faced a backlash after threatening legal action against researchers who publicly disclose zero-day vulnerabilities — flaws the software maker doesn’t yet know about, so there’s no patch and attackers using them have a clear run [5]. Microsoft has now tried to calm those fears [5].

It matters because the whole system of finding and fixing flaws depends on researchers feeling safe to report them. Scare the people who find the bugs, and the bugs don’t stop existing — they just stay quiet until criminals find them instead.

The same week, at the Infosecurity Europe conference, the theme was speed. Vendors told Bayer’s group security chief, Kevin Jones, that the time between a patch being released and attackers exploiting the underlying flaw has dropped to about six hours and forty minutes [6]. It used to be a week or more [6]. In response, India’s national cyber team, CERT-In, now expects companies to patch actively exploited internet-facing flaws within 12 hours [6]. The EU’s Cyber Resilience Act takes a different route, pushing the legal burden onto the companies that write the software [6]. As one analyst noted, regulation “can move the needle on accountability, but it won’t replace sound architecture and resilient operations” [6].

For you: there’s nothing to “do” here, but it’s the backdrop to everything above. The window between a fix and an attack is now hours. Turning on automatic updates — for your phone, computer, and apps — is the single cheapest defence you have, because it closes that window without you watching the clock.