A hacking gang says it broke into the FBI's jobs website and took files on its staff. It wants a warning withdrawn, not money.

The rest of the day

20 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Microsoft shuts a rented inbox-theft service

   Microsoft said on Tuesday that it had shut down EvilTokens, a service criminals rented to break into Microsoft work email accounts. [9] It says the service reached more than 12,000 inboxes at more than 10,000 organisations since February. [6] Customers paid $1,500 to join and $500 a month, and about 1,000 criminals used it. [7][6] Victims were tricked into typing a code into Microsoft's real sign-in page, which handed the attacker a working session without needing the password. [10][8] London police arrested two men suspected of running it, and both are on bail. [7][8]

   $1,500To join EvilTokens

   +

   $500Every month after that

   Why it matters — The service had an AI chatbot that read each stolen inbox to find who approves payments, then drafted fake messages to them. [6] At least ten other services offered the same code trick by April, so its customers have other places to go. [8]

2. 03

   Shoppers' details taken through a store add-on

   BigCommerce, which hosts online shops for other businesses, has told some of its merchants that customer data was taken. [12] Attackers stole an access key held by Ribon, an add-on that Master of Malt says was installed on hundreds of BigCommerce stores. [11] They used it from 13 to 17 September to download shoppers' names, emails, phone numbers and addresses. [11] Master of Malt, a UK online drinks seller, is one shop hit. [12] BigCommerce removed the add-on and says passwords and card numbers are kept separately and were not reached. [12]

   Why it matters — The shops were not broken into themselves: the key belonged to a helper app they had installed. [11] The key kept working for a day after Ribon's developers learned it was being misused. [11]

3. 04

   One group turned old flaws on 996 switches

   GreyNoise, a firm that runs internet sensors to watch attacks, says a Chinese-speaking group took data from 996 network switches made by Zyxel, in 48 countries. [13] A switch is the box that links the computers in an office. The same group broke into at least 49 organisations in 29 countries through a WordPress flaw. [13] At one unnamed Western government body it took 18,566 database records. [13] Zyxel had fixed the switch flaw on 16 June. [14]

   Why it matters — Every flaw in this campaign already had a public fix, and the victims had not installed it. [13][14] The US cyber-defence agency, CISA, has now ordered federal agencies to update their Zyxel switches. [14]

4. 05

   A fifth spy group used the same browser attack

   Volexity, a US security firm, said on Monday that a China-aligned spy group it calls UTA0565 used a chain of three unknown flaws in Chrome and Windows on 3 and 4 September. [15] Other firms had already tied the same chain to four other Chinese groups. [15] UTA0565 lured victims with fake websites and with emails asking Asian government staff to support Chow Hang-tung, a jailed Hong Kong activist. [15] Microsoft disclosed the Windows flaw on 8 September. [15]

   Why it matters — Volexity says the attack kit was probably shared among Chinese hacking groups. [15] It also says the reports so far come from only two firms, so the real reach is likely wider. [15]

5. 06

   Working attacks published for four Linux flaws

   Researcher Asim Manizada published working attack code on 18 September for four flaws in the Linux kernel, the core of the system most servers run on. [16] Each flaw lets someone with an ordinary account take full control of the machine. [16] He reported them in mid-July and waited until Linux distributors had shipped the fixes. [16] No attacks using them have been reported so far. [16]

   Why it matters — A server with an up-to-date kernel is safe, and one running an older kernel now faces code anyone can copy. [16] The risk is highest on shared machines where many people have accounts. [16]

6. 07

   A SharePoint flaw was worse than its label

   A researcher at Viettel Cyber Security has shown that a flaw in SharePoint Server, Microsoft's software for company intranets and shared files, lets a logged-in attacker run their own code on the server. [17] Microsoft's advisory had called it a spoofing flaw, rated 6.5 out of 10. [17] A separate Microsoft record, updated on 11 September, calls it code execution, and the US national flaw database scores it 8.8. [17] The fix came out on 11 August. [17]

   Why it matters — Teams that sorted their updates by Microsoft's advisory saw a moderate problem. [17] The researcher says SharePoint 2013, which gets no more updates, is also affected. [17]

7. 08

   Defender's harshest critic gives his name

   The researcher known as Nightmare Eclipse has spent months publishing ways to break Microsoft Defender, the antivirus built into Windows. [18] He has now named himself as Abdelhamid Naceri. [18] He says Microsoft fired him without a clear reason and that a German labour court upheld the dismissal. [18] Over the weekend he released BigDiskBuster, which stops Defender from installing its updates. [18]

   Why it matters — Each release gives attackers a working method before Microsoft has a fix. [18] The account of his dismissal is his own. [18]

8. 09

   Judge balks at part of TikTok's $400m deal

   A US federal judge in Los Angeles, George Wu, said on Friday he was inclined to reject part of TikTok's $400 million settlement over children's privacy. [19] The US Justice Department sued TikTok and its Chinese owner ByteDance in 2024 for collecting data from under-13s without parents' consent. [19] TikTok would pay $300 million now, and $100 million more if the court ended a 2019 order that makes it keep records until 2029. [19] Wu set a hearing for Monday. [19]

   Why it matters — The US government says TikTok has changed owners and privacy practices since the suit was filed. [19] The judge said he could not yet tell whether those changes would last. [19]

9. 10

   US prosecutors look at Binance over Iran

   Federal prosecutors in Manhattan are investigating whether Binance, the world's largest cryptocurrency exchange, broke US sanctions on Iran by failing to stop certain trading, Bloomberg News reported on Monday. [20] Binance said it has zero tolerance for sanctions breaches and cooperates with law enforcement. [20] In 2023 its founder, Changpeng Zhao, stepped down and pleaded guilty to breaking US money-laundering laws in a $4.3 billion settlement. [20] The US Justice Department declined to comment. [20]

   Why it matters — The report rests on unnamed sources, and no charge has been filed. [20] Earlier this month the US government sanctioned firms it says help groups backed by Iran. [20]

10. 11

    Lawsuits follow a law firm's break-in

    Greenberg Traurig, a US law firm with more than 3,200 lawyers, faces a second proposed class action over a break-in in August. [21] The newest suit, filed on Sunday, says the firm failed to protect names, Social Security numbers and contact details. [21] Four other people sued earlier in September. [21] The firm has said its own systems were not breached, and that an outsider reached a limited number of documents and posted them on the dark web. [21]

    Why it matters — A notice sent to one person in California shows dates of birth and Social Security numbers were involved. [21] Two other big law firms, Quinn Emanuel and Herbert Smith, have also reported breaches in recent weeks. [21]

11. 12

    Banks set out rules for AI shopping agents

    A group of banks including NatWest, Bank of America, ING and Capital One warned on Tuesday that AI agents that shop for people could raise the risk of scams and fraud. [22] Tech firms such as OpenAI, Google and Meta are promoting chatbots that choose and buy products. [22] The banks' report names risks such as an agent asking for card details and typing them into websites. [22] They want it disclosed whenever an agent is involved in a payment. [22]

    12

    0%1.5%3%

    1. 1A year ago0.3%
    2. 2September 20262.5%

    Why it matters — John Lewis, a British department store chain, says searches coming from AI agents rose from 0.3% to 2.5% in a year. [22] The banks say customers do not know who protects them if an agent spends wrongly. [22]

12. 13

    LinkedIn wins an end to mass profile copying

    A US federal judge in California on Thursday finalised a deal that requires two software firms, ProAPIs and Netswift, to stop copying data from LinkedIn, the work networking site. [23] LinkedIn sued last October, saying the firms ran millions of fake accounts to copy profiles, posts and comments. [23] LinkedIn blocked each fake account within hours, but hundreds or thousands of new ones appeared every day. [23] The firms must also delete what they took. [23]

    Why it matters — Blocking accounts one at a time could not keep up, so the fix came through a court. [23] ProAPIs says it does not offer tools to copy LinkedIn data. [23]

13. 14

    3.2 million Burger King Russia customers listed

    Have I Been Pwned, a free website where people check whether their email appears in a leak, has added 3.2 million Burger King Russia customers. [24] The data comes from an August 2024 attack on Mindbox, the chain's marketing supplier, and reaches back to May 2018. [24] Burger King told Russia's TASS news agency that payment details were not included. [24] Detsky Mir, Russia's biggest toy retailer, was reportedly hit by the same attack. [24]

    Why it matters — The attack was on a supplier, not on Burger King itself. [24] Two years later, the people in the leak can now look themselves up. [24]

14. 15

    Canada opens a privacy probe into IDScan

    Canada's privacy commissioner, Philippe Dufresne, has opened an investigation into IDScan.net, a company whose tools check ID cards in shops, bars and hotels. [25] Reports say attackers stole data and driving licence scans for 153 million people. [25] IDScan confirmed a break-in on 4 September but did not say how many people it hit. [25] The probe will look at its security and whether it told victims properly. [25]

    Why it matters — IDScan learned of the theft hours after the journalist Brian Krebs reported the scans were for sale online. [25]

15. 16

    Password thieves now take AI helpers' keys

    Gen Digital, the company behind Norton antivirus, says two password-stealing programs, Amatera and Remus, now also copy data from AI coding assistants. [26] Remus goes after files from Claude, Cursor and OpenCode, and Amatera after Cline and Continue. [26] Those files can hold login keys, saved passwords for connected tools and the history of what the developer asked. [26] Gen says its figures count detections, not confirmed infections. [26]

    Why it matters — Gen says one stolen folder can give an attacker both a way into an account and notes on what is valuable inside it. [26]

16. 17

    Attack tools rented by the month

    Several criminal tools described by security firms this week are sold by monthly subscription. [26] VectraRAT, which lets a buyer secretly control a Windows computer and record what is typed, costs $250 a month, the firm SOCRadar says. [26] Sophos found Luciferus, an AI chatbot with its safety limits removed, advertised on a crime forum for $35 a month. [26] EvilTokens, shut down this week, charged $500 a month. [7]

    Luciferus, an AI chatbot with no limits$35

    VectraRAT, a remote-control kit$250

    EvilTokens, an inbox-theft service$500

    Why it matters — A buyer does not need to know how to build any of it. [26] That is how one service, EvilTokens, could serve about 1,000 criminals at once. [6]

17. 18

    Gaming videos used to hand out malware

    Palo Alto Networks' Unit 42 research team says a group it calls CL-CRI-1171 has run a hidden marketplace for at least two years, spreading other criminals' malware for a fee. [26] It used YouTube channels with real gaming content whose links led to infected downloads. [26] A second route used fake software placed high in search results, aimed at office workers. [26] Unit 42 says infections reached companies, critical infrastructure and government bodies. [26]

    Why it matters — The videos were genuine and the channels chatted with viewers, which made the download links look safe. [26]

18. 19

    New botnet guesses its way into devices

    Nozomi Networks, a firm that protects factory and device networks, describes KATARU, new malware that breaks into Linux machines and small connected devices by guessing Telnet passwords. [26] Telnet is an old way of logging in to a machine remotely. Once inside, KATARU uses already-published Linux flaws to take full control, then waits for orders to flood websites with traffic. [26] Nozomi suspects it was put together with help from AI. [26]

    Why it matters — It needs no new flaw at all: weak passwords and devices that were never updated are enough. [26]

19. 20

    Eight years for making cash machines pay out

    A US court sentenced Juan Manuel Gouveia-Aguilera, a 27-year-old from Venezuela, to eight years in prison for his part in attacks that made cash machines hand out money. [26] The gang used Ploutus, malware loaded onto the machine itself, a crime known as jackpotting. [26] The court held him responsible for more than $3.5 million in losses. [26] US prosecutors say it is believed to be the longest federal sentence yet for a role in jackpotting. [26]

    Why it matters — He was convicted of bank fraud, bank burglary and computer fraud after pleading guilty, and must also repay money. [26]

20. 21

    US agencies publish rules for guarding login passes

    NIST, the US standards agency, and CISA, the US cyber-defence agency, have published final guidance on protecting the signed tokens behind single sign-on. [27] A token is a small digital pass that proves someone has already logged in, so they are not asked again. The report tells federal agencies and cloud providers how to check tokens, guard the secrets that sign them and spot misuse at scale. [27]

    Why it matters — EvilTokens worked by getting victims to hand attackers exactly this kind of pass. [8]