Cyber, in brief

A researcher who calls themself Nightmare Eclipse has published ShieldCrash, attack code aimed at Microsoft Defender, the antivirus built into Windows. [1][2]

It came out just after Microsoft's September updates, and it targets Windows computers that have all of those updates installed. [1]

ShieldCrash gets round Microsoft's fix for ShieldBreak, an earlier attack on Defender by the same researcher. [1][2]

Microsoft acknowledged ShieldBreak on 14 August and shipped fixes for it on 3 September. [1]

ShieldBreak was itself a way round Microsoft's fix for RoguePlanet, an attack the researcher released in June. [1]

The code shows someone already on a computer reading files that only Windows itself is allowed to open. [1][2]

The researcher says the flaw goes further and can hand over full control of the machine. [1][2]

Ensar Seker of SOCRadar, a threat intelligence company, says the published code does not do that yet. [2]

Seker says files read this way can include passwords and other secrets, and can become one step in a larger attack. [2]

The fight began in April over a disagreement about bug reports, and Microsoft at one point appeared to threaten legal action. [2]

Since then the researcher has kept releasing new Windows attacks on Microsoft's monthly update days, before any fix exists. [2]

Microsoft did not answer questions about ShieldCrash from SecurityWeek or Dark Reading. [1][2]

Why it matters. Watch whether Microsoft fixes ShieldCrash before its October update day, and whether it repairs the whole part of Defender these attacks keep reaching, which is what Seker says it should do. [2]

Wildberries, one of Russia's largest online marketplaces, says an attack that flooded its systems with traffic has delayed payments to some sellers. [6] The Russian Union of Marketplace Sellers says about 20 billion rubles, around $240 million, is still unpaid for goods sold in the last week of July. [6] In its survey of nearly 2,000 sellers, 95.6% had not received money they expected. [6] In August, Ukraine's military intelligence said it had disrupted Wildberries' systems with a hacker group called Cyber Corps. [6]

Why it matters. Wildberries has not said whether that operation and the payment delays are connected. [6] The sellers' union doubts the company's explanation, says foreign sellers kept being paid on time, and has asked Russia's prime minister to step in. [6]

Police in Puebla state, Mexico, found a building near the village of Tlaola holding 300 computer graphics cards used to mine cryptocurrency, Reuters reported. [7] Mining uses powerful computers to create new coins, and Reuters says electricity is the biggest expense in running a mine. [7] Authorities are investigating whether the mine was taking power from a nearby hydroelectric dam. [7] It is the fourth such farm found in the area since early last year. [7]

Why it matters. A security analyst told Reuters that setting it up would have needed a well-funded group, such as one of Mexico's most powerful drug cartels. [7] An expert on energy theft said that if the power was stolen, the mine's main running costs would be close to nothing. [7]

Singapore police arrested two Malaysian men, aged 25 and 47, who worked at a mobile phone shop. [8] Police say they used their jobs to get into customers' accounts on Singpass, Singapore's national digital ID. [8] In one case, a customer buying a SIM card was offered help updating the phone number on their Singpass, and a LiquidPay payment account was opened without their knowledge. [8] Investigators linked more than 170 people's Singpass accounts to the scheme. [8]

Why it matters. Those accounts were used to register more than 160 LiquidPay accounts. [8] Police say the men used chances that came with their jobs at the shop, such as helping a customer at the counter. [8]

Netskope, a security company, counted more than 5,400 hacked websites being used in one attack campaign. [8] It says the sites have little in common beyond being small businesses, such as clinics, plumbers and online shops. [8] Code added to each site shows visitors a fake prompt telling them to run a command on their own computer. [8] This kind of fake prompt is known as ClickFix. [8]

Why it matters. Netskope found no shared industry, region or owner among the sites. [8] The people shown the fake prompt are the clinics', plumbers' and shops' own visitors. [8]

Barracuda, a security company, described phishing emails dressed up as DocuSign, a service people use to sign documents online. [8] Victims are passed through real Microsoft services before they reach a fake sign-in page. [8] That page is built inside the victim's own browser for that session only. [8] So there is no fixed web address that security tools can look up and block in advance. [8]

Why it matters. Barracuda says passing through trusted Microsoft services makes both people and automatic scanners less likely to spot the attack. [8]

Socket, a security company, found four browser add-ons for Chrome and Firefox aimed at users of Axiom Trade and Padre, two cryptocurrency trading sites. [8] They were published under the names J7Tracker, VREO and Orbit Tracker. [8] Socket says they collected logged-in user details, wallet data and access tokens, and sent them to servers the attackers control. [8] The same Chrome publisher was linked to two earlier add-ons that pretended to be another trading tool. [8]

Why it matters. An add-on runs inside a browser the trader is already logged into, so it can collect details that the login has already unlocked. [8] The earlier fakes show the same publisher returning under new names. [8]

The DFIR Report, which publishes investigations of real break-ins, described an attack that began with a fake installer posing as a Sysinternals tool, a set of free Windows utilities from Microsoft. [8] It installed a remote-control program and a malware kit called TukTuk that the report says was made with AI. [8] The attacker used stolen service-account logins to spread GoTo Resolve, a real remote-management tool, across servers. [8] Data was copied to a cloud service and The Gentlemen ransomware was deployed. [8]

Why it matters. The attack reached domain controllers, the servers that manage every login on a company network. [8] The whole chain started from one fake installer for a real Microsoft tool. [8]

Rapid7, a security company, says it found 476 cases of exposed US social security numbers, the ID numbers used for tax and credit, belonging to 395 company staff since early 2026. [8] More than 73% belonged to top leaders: 44.6% were senior executives and 28.6% were company presidents. [8] Three online marketplaces, Xilo, Bankom and PeopleFinder, account for 81.5% of the leaks in its data. [8]

Why it matters. Rapid7 says the exposures directly targeted leadership rather than falling at random. [8] Finance companies made up over a quarter of the organisations affected, and industrial companies 17%. [8]

Gamers Nexus, a YouTube channel that tests computer hardware, says LG smart TVs gather extensive information about people and their homes, and that LG uses it for advertising. [8] It says it saw a TV record IP addresses, location data, and the names and signal strength of nearby Wi-Fi networks. [8] It also says the TV listed devices on the home network it was never paired with, including phones, watches, thermostats and PCs. [8] LG told The Register the claims are not true. [8]

Why it matters. LG says scanning for nearby devices is a standard smart TV feature. [8] It says voice data is only sent when the remote's voice button is held or a wake word is heard. [8]

Futurism, a US news site, found a large network of Facebook accounts posting AI-generated videos of violence against children, WIRED reported. [9] It found most of the accounts by following Facebook's own recommendations from one account to the next. [9] Futurism reported eight accounts through Facebook's normal reporting tool. [9] Meta removed two, one of them only after first rejecting the report, and several decisions took more than a week. [9]

Why it matters. Meta's written rules ban depictions of child abuse, real or synthetic, and do not say whether AI video falls under exceptions for art and games. [9] Meta told the reporters that some of the flagged links did not break its rules. [9]

Clearview AI, a face-recognition company that sells searches to police, is testing a prototype tool called InquiryIQ, WIRED reported. [9] The tool would help police find a target's associates, social media accounts and other personal information. [9] The prototype had not been reported before. [9]

Why it matters. The tool is built to look at the people around a target, not only the target. [9]

Microsoft is adding a feature to Windows 11 called the Windows Age API. [8] It lets apps learn whether a user is a child, a teenager or an adult. [8] The app does not see the user's exact date of birth. [8] Microsoft says building this into Windows lets app makers add safety features from the start, instead of families setting protections one app at a time. [8]

Why it matters. Microsoft says apps get only the age signal they need and not sensitive personal data such as a full date of birth. [8]

Microsoft says Teams, its workplace chat app, will blur images containing QR codes when they come from people outside a company. [8] A QR code is the square barcode a phone camera opens as a web link. [8] A user will have to choose to reveal the image before viewing or scanning it. [8] Microsoft expects the change to start reaching users next month. [8]

Why it matters. Microsoft says the point is to cut phishing and fraud by making people stop before they scan a code sent by a stranger. [8]

CISA, the US cyber-defence agency, has released an updated version of its Insider Threat Mitigation Guide. [8] It deals with the harm people inside an organisation can do to critical infrastructure, such as power and water systems. [8] The new version adds material on hybrid and remote work, on AI used to manipulate and deceive, on who gets access, and on screening visitors. [8]

Why it matters. The Singapore arrests the same week were this kind of case: police say shop staff used access their jobs gave them. [8]

Island, a security company, examined 33,563 published MCP servers, which are add-ons that give AI assistants extra tools. [8] It found that two in five include a tool that can reach sensitive data or take an action with real effects. [8] One in 13 contains a way to run code or commands. [8] Island says the text describing a tool can be read by the AI as an instruction. [8]

Why it matters. Island says an attacker may not need malicious software at all, because a paragraph of plain language can be enough to steer the assistant. [8]

Thirteen booby-trapped packages were found on npm, the public library where programmers download ready-made JavaScript code, according to InstallSafe. [8] Their names mention wallets, signing, analytics, Solana, Base or mobile parts, so they sound like ordinary cryptocurrency building blocks. [8] GitHub, which runs npm, warned that any computer that installed one should be treated as fully taken over. [8]

Why it matters. GitHub says removing the package does not guarantee removing everything it installed. [8] Every secret and key on an affected computer has to be replaced from a different computer. [8]

Plex, which people use to stream their own films and music from a home server, released security updates for several flaws. [11] It urged customers to install them as soon as possible, without giving details. [11] The Shadowserver Foundation, which scans the internet for exposed systems, counted over 33,800 Plex servers still open to the recently disclosed flaws. [8] That is down from 37,467 on 5 September. [8]

Why it matters. That is about 3,600 fewer exposed servers, and nearly 20,000 of those still exposed are in North America. [8]

SecurityWeek counted 33 deals to buy or merge security companies announced in August. [10] Visa agreed to buy BioCatch, which spots fraud from how people use their devices, for $2.4 billion in cash. [10] Munich Re, a German reinsurance giant, agreed to buy the cyber-insurance company At-Bay for $575 million. [10] Fortinet and Palo Alto Networks, two big security companies, each bought a firm working on AI agents. [10]

Why it matters. BioCatch will join Visa's existing fraud and risk products. [10] At-Bay will join Munich Re's HSB unit, combining its security services with insurance cover. [10]

James Strahler II, 37, of Columbus, Ohio, was sentenced in the US to 15 years in prison. [8] The US Justice Department says that from December 2024 to June 2025 he sent at least six women harassing messages. [8] The messages included nude images of them, both real and made with AI. [8] He also posted AI-generated obscene images of children online. [8] He was arrested in June 2025. [8]

Why it matters. The Justice Department says he had installed more than 24 AI apps and used more than 100 AI models on the web from his phone. [8]