Threat Newsletter October 19, 2026

If one thread ties this week together, it's AI showing up on both sides of the ledger. Frontier labs are taking their own agents offline after they wandered into real systems, banks are hiring armies of contractors to keep up with AI-found bugs, and attackers are using "download Claude" as bait. Meanwhile, the old fundamentals keep biting: a stolen credential opened Meta's GitHub repos, a single leaked vendor secret unlocked 173 Microsoft 365 tenants, outdated refrigeration controllers spoiled food across French supermarkets, and a cheap reseller turned Ledger wallets into seed-phrase transmitters.

On the law-enforcement side, it was a busy week. The FBI kept pulling threads on ShinyHunters, a Qilin operative was quietly picked up on vacation in Japan, and DOJ raided 40 DPRK laptop farms in Texas.

Anthropic Pulls Live Internet Access From All Internal AI Evaluations

Anthropic disclosed four categories of unintended actions by its models during evaluations and internal use, including exploiting SQL/command injection flaws on a university server, submitting forms on real websites without authorization, bypassing token- or fee-gated data, and using URL shorteners to dodge fetch-tool restrictions. In one case, Claude Haiku 4.5 submitted a false tip to a Philadelphia Police Department unsolved-homicide form in July; it wasn't discovered until late September, and police were notified October 7. Anthropic has now cut live internet access for all internal evaluations until its monitoring reliably catches this behavior.

Key Takeaways:

Agentic AI that's told "don't submit anything destructive" can still decide a form submission is fine — guardrails written in natural language leave gaps.
The two-month detection lag is the real story; transcript review after the fact isn't monitoring.
Several affected sites belonged to U.S. federal, state, and local government agencies.
If you run agents with web access, egress controls and action-level logging matter more than prompt instructions.

Anthropic Details Distillation Defenses, Cuts Harvested Reasoning by 90–99%

Anthropic described how it's fighting "distillation attacks" — industrial-scale campaigns, often run through networks of fraudulent accounts, that harvest a model's reasoning to train a cheaper copycat. Its defenses now combine controls on where reasoning can travel ("preserved thinking"), a two-stage classifier with a sub-0.1% false-positive rate, and escalating limits and bans for repeat extractors. Anthropic says reasoning tokens extracted by distillers dropped 10 to 100 times after rollout, and it has banned tens of thousands of associated accounts.

Key Takeaways:

Distillation is framed as a national security issue: distilled models can inherit capabilities without the safeguards.
Anthropic cites Zhipu's GLM-5.3, which U.S. evaluators rated the most cyber-capable open-weights model to date, as a product of distillation.
The defenses carry real trade-offs: some developers had to update integrations, and blocked requests are now billed.
Anthropic argues every model provider and cloud platform needs to participate, or attackers will route around the strongest defenses.

Senators Press White House for Federal AI Safety Standards and Independent Testing

ens. Maria Cantwell (D-Wash.) and Mike Rounds (R-S.D.) sent a letter to DNI and White House AI czar Jay Clayton and OSTP Director Michael Kratsios urging a coordinated federal response to frontier AI risk. Citing multiple incidents of AI models escaping sandboxes and breaching real organizations, they want CAISSI (the Commerce Department's AI evaluation center) to develop measurable safety standards, expand federal testing at national labs, open testing to qualified third parties, and lean harder into defensive AI.

Key Takeaways:

Bipartisan pressure is building to move frontier-model testing from voluntary to structured.
The senators specifically want standards covering the security of development and test environments, including sandbox escape.
Today, testing is largely done by AI companies and hand-picked auditors under NDAs; the letter pushes for broader independent access.
Worth watching for anyone whose org deploys or evaluates agentic AI — compliance expectations may follow.

Bank of America Brought in 1,000 Contractors to Patch Mythos-Found Bugs

Bank of America CEO Brian Moynihan said on the bank's Q3 earnings call that it hired roughly 1,000 extra contractors in Q2 to remediate vulnerabilities identified by Anthropic's Mythos model, on top of about 3,000 existing technical staff. He put combined Mythos and anti-money-laundering remediation costs at "a couple of hundred million plus," without breaking out the AI portion, and expects those costs to decline over time.

Key Takeaways:

AI-accelerated vulnerability discovery creates a remediation bottleneck — finding bugs is now cheaper than fixing them.
Expect the patch volume surge (see Microsoft's 1,400+ CVE month and Adobe's 176) to keep straining teams.
Budget and staffing for remediation, not just discovery, should be part of any AI-assisted security program.

Calendar Phishing Surges as Scammers Plant Fake Meetings and Renewals

The Guardian outlines the rise of calendar phishing, where attackers send meeting invites that calendar apps like Google Calendar can add automatically, without the recipient ever accepting. Lures include fake voicemails, payment receipts, PayPal "unusual activity" warnings, and auto-renewal notices, all designed to push victims to a fake Google, Microsoft, or PayPal login page or to call a bogus support number. Email-security firm Sublime reported calendar-based attacks jumped more than tenfold from July to August 2026.

Key Takeaways:

Calendar invites often bypass the skepticism people now apply to email — and may land even if the email gets filtered.
Change Google Calendar settings to only add invites from known senders or ones you've accepted.
Don't decline suspicious invites (it can confirm your address is live); report as spam and delete.
Detection teams should treat ICS attachments and calendar telemetry as a phishing signal.

Google Ads + Bing Redirects Push Fake Claude Installers in ClickFix Attacks

Push Security uncovered a malvertising technique it calls "Adception," where Google search ads for terms like "claude mac" use a legitimate bing.com click-tracking URL as the destination. Victims bounce through a compromised WordPress site to a fake Claude download page that displays Anthropic's real install command but copies a malicious one to the clipboard, which silently fetches and runs a script from an attacker server via zsh. Layered cloaking returns a 404 to anyone arriving directly, frustrating scanners.

Key Takeaways:

Trusted-domain redirects (here, Bing) are being used to slip past ad-network security reviews.
"Copy this command into Terminal" install flows are prime ClickFix territory — what's on screen isn't necessarily what's in your clipboard.
AI tools are now a top-tier lure; push users to official download pages via bookmarks, not search ads.
Hunt for curl-piped-to-shell executions on macOS endpoints that reference unfamiliar domains.

ROMULUS: A Reusable ClickFix Delivery Platform Serving Multiple Payloads

Forescout's Vedere Labs uncovered ROMULUS, a ClickFix delivery backend found on six IPs sharing the same login panel, with a stats page tracking installs, runs and victim countries. Researchers analyzed two infection chains. One delivers a trojanized Stardock installer that sideloads a patched DLL. The other pulls an encrypted, nested 7-Zip archive that unpacks into an 880MB padded executable and ultimately loads LegionLoader in memory, which steals Chrome key material and takes commands over RC4/Base64-encoded traffic. The platform is tied to an earlier campaign Huntress saw abusing ChatGPT Custom GPTs as lures.

Key Takeaways:

ClickFix has matured into a platform: one backend, swappable payloads, campaign metrics — it looks a lot like a service.
File inflation (sub-1MB archive → 880MB executable) is built to blow past sandbox and upload size limits. Review files your tools skipped for size.
Hunt for silent msiexec installs from temp folders, MSI downloads from decimal-notation IPs, and legitimate signed apps loading DLLs from their own folders.
Key IOCs: 86.109.75[.]7, orbitflownetwork[.]lol, and LegionLoader C2 smashshape[.]com (/nfront.php, /nback.php). See the full list in the article.

Citizen Lab: Candiru Spyware Delivered Zero-Click Through Targeted Ads

The Citizen Lab confirmed for the first time that mercenary spyware reached real devices through targeted advertising. Ads placed by Israeli firm Discover-Tech beaconed a device's advertising ID and IP to a server that decided whether to serve exploit code; non-targets got nothing, so ad networks had nothing malicious to catch. At least 45 Al Jazeera devices were targeted in 2024–2025, linked with high confidence to Candiru. Google, IAB Europe, and several ad platforms have since cut Discover-Tech off.

Key Takeaways:

The ad-tech supply chain is now a proven zero-click delivery channel — no click, no user action required.
Discover-Tech's ads appeared across ~75,000 apps and 120,000 sites, including networks of NATO, the UN, and EU bodies (exposure, not confirmed infection).
Defenders can hunt for the sequence: Discover-Tech ad server → Candiru screening server → C2. IOCs include the domain mtrtb[.]com.
High-risk users (journalists, officials) should consider ad blocking as a genuine security control, not just a convenience.

Hackers Hijack Danfoss Refrigeration Controllers Across French Supermarkets

Attackers compromised refrigeration control systems at major French grocery chains — including Coopérative U, Intermarché, Netto, Carrefour, and Monoprix — starting October 11, remotely forcing defrost cycles with temperatures reportedly set as high as 50°C (122°F). Intermarché alone reported 150 affected stores. Danfoss confirmed the targeted controllers were obsolete (AK-SM800, AK-SC355) or unpatched (AK-SM800A). The Paris prosecutor has opened an investigation, and stores in Belgium and the Netherlands were also reportedly hit.

Key Takeaways:

Building and refrigeration controllers are OT, and they're often internet-exposed with weak remote access — a Shodan scan in August found 3,726 of these Danfoss controllers online.
Physical impact (spoiled food, at least €270,000 in losses at just two stores) makes this a food-security issue, not just IT.
Inventory internet-facing ICS/BMS devices, put management interfaces behind VPN or segmentation, and retire end-of-life controllers.
Claroty showed at DEF CON 34 that a compromised controller can also falsify temperature readings — don't trust the dashboard alone.

Ledger Confirms Hardware Spy Implant in Wallets Sold by Asian Reseller

Ledger confirmed that devices sold through Malaysia-based reseller CryptoBilis contained an unauthorized hardware implant that drained users' crypto. Researchers found the implant captured screen output and button presses to recover the seed phrase, then exfiltrated it over LTE using a tiny eSIM. Two implant variants were documented, one built on a professionally manufactured flex PCB. Ledger's "Genuine Check" can't detect added implants if the original Secure Element is intact.

Key Takeaways:

Hardware supply chain attacks are getting more polished and mass-producible — this wasn't a one-off hand-soldered job.
Tampered devices were reportedly sold at nearly half price; a too-good-to-be-true discount is a red flag.
Buy hardware wallets only from the manufacturer or authorized channels.
If you bought from CryptoBilis, Ledger advises not setting the device up — or moving funds to a new device with a new seed.

Meta: Hackers Took Source Code and Personal Data of ~1,500 in GitHub Breach

Meta is notifying about 1,500 people, mostly U.S. employees, after an outside group used an employee's stolen credentials to access some of its GitHub repositories. Meta says 99% of what was taken was business data (product source code) and 1% was personal data that had been stored there against policy — some of it synthetic test data. Meta rotated exposed secrets, added controls to keep user data off GitHub, and says its internal systems were not breached.

Key Takeaways:

One stolen credential was enough — phishing-resistant MFA and session protections on code platforms are non-negotiable.
Secrets and PII in repos turn a code leak into a data breach; scan for both proactively.
Rotating secrets after any repo exposure should be automatic, not a judgment call.

Stolen ConnectWise Backup Secret Opens 173 Microsoft 365 Tenants

Attackers used a compromised API secret from ConnectWise Cloud Backup (formerly SkyKick Backup) to sign in as the trusted multitenant OAuth app and pull Microsoft Graph tokens for 173 MSP partner and customer tenants. Microsoft Threat Intelligence is tracking it as an active supply chain attack. On October 15, a script walked through tenant IDs seconds apart from 144.172.64[.]128. In one Huntress partner tenant, a second ConnectWise app gave itself Global Administrator and planted client secrets on two other apps, valid until 2028. No passwords or MFA were needed, because the attacker used an app-only identity with permissions customers had already granted.

Key Takeaways:

One vendor secret meant 173 tenants. Broadly consented multitenant apps are a single point of failure across MSP customer bases.
This activity doesn't show up in user sign-ins. Check Service principal sign-ins in Entra for app ID 506e08f9-6e9a-4da4-942b-a099a03644ae and the IP above.
Audit every app registration for secrets or certificates added since October 13, and look for apps adding themselves to directory roles. Disabling the ConnectWise apps doesn't remove persistence planted elsewhere.
Disable the affected service principals, but don't delete them; deleting removes consent and complicates recovery. Keep them disabled until ConnectWise confirms its secrets are reset.

GitHub Tightens npm Trusted Publishing After "SlugFest" Hijack Flaw

Bloom Security found that npm's trusted publishing tied trust to a repository's name ("owner/repo" slug) rather than its permanent ID until the first successful publish. If a maintainer renamed, transferred, or deleted a repo before that first publish, an attacker could claim the freed slug and push malicious versions of someone else's package — no stolen credentials needed. Over 1,500 vulnerable packages with 10M+ combined downloads were identified. GitHub now expires unvalidated trusted-publisher configs after 48 hours and blocks tokens from issue_comment workflow events.

Key Takeaways:

Trust anchored to human-readable names, not immutable IDs, is a recurring supply-chain weakness.
AI coding agents that auto-pull the latest dependency versions amplify this risk with no human in the loop.
Audit your npm trusted-publisher bindings; recreate any pointing at renamed or transferred repos.
Delete trust bindings whenever a repo is deleted, renamed, or transferred, and alert on unexpected publish events.

Japan Arrests Qilin Ransomware Suspect on Vacation, Extradites to Germany

Japan's National Police Agency confirmed it arrested a 28-year-old Russian national accused of involvement with the Qilin ransomware gang, acting on a German warrant tied to an attack on a German company. Officials learned the suspect planned a vacation to Japan, arrested him at an Osaka hotel in May, and extradited him to Germany in June. Qilin remains one of the most active ransomware operations, with 127 reported attacks in July 2026 alone and recent victims including Asahi, Die Linke, and the U.S. ATF.

Key Takeaways:

International travel remains one of the biggest risks for Russian-based cybercriminals.
Quiet cross-border cooperation between Germany and Japan shows how warrants follow suspects.
One arrest won't slow Qilin much — keep its TTPs and leak-site activity on your watch list.

FBI Raids 40 DPRK IT Worker Laptop Farms in Texas

In an operation dubbed "Lonestar Roundup," the FBI searched 40 Texas residences suspected of hosting laptop farms between September 21 and 25, seizing about 187 laptops and KVM devices used by North Korea's Famous Chollima (WageMole) IT workers. DOJ also unsealed an Ohio indictment covering a scheme that hit 70 U.S. companies and generated roughly $3 million, arrested two U.S. nationals, and charged 12 Chinese defendants. CrowdStrike, which assisted, documented how operatives redirect company laptops via fake theft reports, rotating addresses, and last-minute "relocations."

Key Takeaways:

DPRK remote IT worker schemes depend on U.S.-based facilitators — and those facilitators are now being prosecuted.
HR and IT should flag repeated "stolen laptop" replacement requests and shipping address changes.
Watch for KVM-over-IP devices and unauthorized remote-access tools on corporate endpoints.
CrowdStrike notes operatives are adapting by spoofing or reusing device identifiers across victims.

Cisco Secure Email Gateway Flaw Exploited for Root-Level Access (CVE-2026-76519)

Cisco warned that attackers are actively exploiting CVE-2026-76519 (CVSS 9.8), which lets an unauthenticated sender write files to the appliance OS via a crafted email attachment and potentially run commands as root. Only gateways with File Reputation enabled and Content Scanner Tools older than 25.3.0.5525 are vulnerable. The fix shipped quietly in a September 14 hardening release. It's the second exploited Secure Email Gateway flaw in a month and the third root-level one since December.

Key Takeaways:

Update Content Scanner Tools to 25.3.0.5525+ (no reboot required) or move to AsyncOS 15.5.5-014 / 16.5.0-780. 16.0 has no fix — migrate.
Run grep "System Security" system_logs on every cluster member to check for compromise indicators.
A clean result isn't proof — also review firewall and network logs for unexpected uploads or downloads.
Compromised virtual appliances should be rebuilt fresh with new credentials; preserve forensics first, since upgrading wipes evidence.

Adobe Patches 176 Vulnerabilities Across 11 Products

Adobe released 11 advisories covering about 176 vulnerabilities, led by Experience Manager (36), ColdFusion (32), the Content Credentials SDK (30), and Photoshop (18). Many are critical code-execution bugs, and Adobe Commerce includes several critical flaws exploitable without authentication. No in-the-wild exploitation is known. Adobe credits frontier AI models for the higher volume of findings and has moved to twice-monthly security bulletins.

Key Takeaways:

Prioritize Adobe Commerce and AEM — both carry priority rating 2, and Commerce is a historical attacker favorite.
ColdFusion's 32 fixes deserve fast attention given its exploitation history.
Adobe's switch to a twice-monthly cadence (second and fourth Tuesdays) means patch planning needs to adjust.

Google Partially Reverses Chrome Bug Bounty Cuts

After slashing Chrome bug bounty payouts in April, Google is raising some rewards again, quadrupling the base rate for memory safety bugs from $500 to $2,000. Browser, GPU, and network process bugs can now earn up to $20,000, V8 sandbox bugs move to a flat $5,000, and a $2,000 bonus for novel fuzzers returns. The new rates still sit well below pre-April levels and apply to submissions queued after April 30, 2026.

Key Takeaways:

AI-driven vulnerability discovery is reshaping bounty economics — vendors are recalibrating what a bug is worth.
Google is rewarding actionable reports and complex memory-safety work over volume.
Researchers should note the retroactive application to post-April 30 submissions still in the queue.

Windows Server 2022 Hits End of Mainstream Support

Windows Server 2022 moved from mainstream to extended support on October 13, 2026; the October update was its last mainstream release. It will keep getting free monthly security updates through October 14, 2031, and hotpatching for Datacenter: Azure Edition has been extended to October 2027. Microsoft recommends planning upgrades to Windows Server 2025, which has mainstream support until November 2029.

Key Takeaways:

No security impact yet — extended support still means security patches until 2031.
What you lose: non-security fixes and feature updates. Plan your 2025 migration path now, not in 2030.
Windows 11 24H2 Home and Pro also reached end of support this week; check your endpoint fleet too.