Browser security company Island published research on 6 October 2026 on a phishing platform dressed up as a range of AI advertising products, from campaign optimisation and spend audits to business-account connections, using the names ChatGPT, Gemini, Claude, Perplexity and Manus. Eight days after Meta launched its Muse AI agent on 8 September, museads.ai appeared (by 16 September) offering a fake "Muse Ads" manager. Every page leads to a Connect button that draws a fake browser window inside the page, with an address bar showing accounts.google.com or an Okta tenant, styled to match Windows, macOS, iOS or Android. Behind it a human operator watches in real time: the platform keeps every password attempt, fingerprints the device, can ask for the password up to three times, then chooses whether to show an SMS or authenticator code request, an Okta push, a Google approval prompt or a QR code, and can reject codes or hold the victim on a waiting screen. It supports Google, Meta, TikTok and Okta sign-in flows. Targets are agency staff, media buyers and administrators whose accounts reach many client ad accounts, which can be drained on fraudulent campaigns or resold. Older source code left in misconfigured public GitHub repositories traced the operation back to March and showed the same kit reused for refund and recruitment lures; Island saw hundreds of victim submissions to its Telegram control channel, and activity was ongoing at publication. Primary: Island; wire: BleepingComputer.
Island — Behind the Connect Button: The Fake AI Ads Campaign (6 Oct 2026)
Adversa AI published research on 6 October 2026 showing its Cryptographic Context Injection (CCI) technique, first shown in August against chat assistants, working against GitHub Copilot CLI. A developer runs the agent in autopilot mode and asks it to read an external web page. The page carries its instructions as ciphertext and asks the agent to decrypt it with Python, offering two keys: one is a template that can only be filled in by reading local files, so the agent reads the targeted files while preparing it, and the second, real key reveals a follow-up instruction to fetch another URL with the harvested contents as a parameter. In Adversa's demonstration the full contents of a .env.prod file reached the attacker's endpoint in 28 seconds, with no confirmation prompt and nothing in the transcript showing the destination host or that file contents had left the machine. Because the instructions only exist as readable text after the agent decrypts them in its own runtime, static prompt-injection filters do not see them. Adversa says the chain needs autopilot mode and a permissive model; on its paid test account the vulnerable model had to be picked by hand, but with model selection on Auto the router sometimes assigned it without the user knowing. Adversa says the chain still reproduced as of 1 October; GitHub's bug bounty team validated the finding but declined to treat it as a vulnerability, and concrete payloads were withheld. Primary: Adversa AI; wire: Cyber Security News.
Adversa AI — Cryptographic Context Injection against GitHub Copilot CLI (6 Oct 2026)
UK education software provider Bromcom has notified customers of a personal data breach involving legacy single sign-on (SSO) registration functionality in its Communication Server environment, The Register reported on 6 October 2026. In a 24 September post on the EduGeek forum, a Bromcom account said an unauthorised third party had accessed and retrieved email addresses and limited information tied to affected SSO registrations. Bromcom identified the incident on 6 September after reports of SSO access problems. The service held email addresses linked to SSO registrations, the sign-in provider used (such as Microsoft or Google), registration and last sign-in dates where recorded, and internal user and registration reference numbers; Bromcom says it held no passwords or authentication tokens and did not allow access to Microsoft or Google accounts. The superseded component had stayed in production because an internal system still called it, and has now been withdrawn. Bromcom says it found no evidence its school Management Information System (MIS), which holds student, attendance and behaviour data, was compromised, and it is working with forensic specialists and liaising with schools, trusts and the authorities. Bromcom software is used by more than 5,000 schools and 390 multi-academy trusts. Primary: The Register (Bromcom statement and FAQ); switch primary when a public Bromcom notice is available.
The Register — Legacy sign-on service comes back to bite school software provider Bromcom (6 Oct 2026)
On 6 October 2026, from about 5am US Eastern time, users of the ASOS shopping app, mainly in the UK, received a push notification addressed to the British online fashion retailer's data protection officer and IT team: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it", with a link to a Telegram channel run by a group calling itself Xuanye, which has no known track record. Later the same day ASOS confirmed a data breach: it says third-party platforms it uses to communicate with customers were accessed without authorisation and that basic personal information, including names and contact details, may have been exposed. ASOS says it does not believe payment card details or account passwords were affected, and it is showing an in-app notice telling customers to ignore the alert and not to open its link. ASOS has not confirmed the claim that its Snowflake environment was compromised and has not said how many customers are affected. Researchers quoted by the BBC said sending the notification needed access to ASOS's own messaging systems. Sources: BleepingComputer (ASOS confirmation), BBC News. UPDATE (8 Oct 2026): ASOS now says the breach began with social engineering. In a security notification shared with BleepingComputer it says an unauthorised party got into an ASOS employee account by impersonating a trusted contact to obtain login credentials, then used those credentials to reach information on certain third-party platforms ASOS uses. ASOS locked down the affected platforms, is investigating with external experts, law enforcement and regulators, and repeats that payment card details and account passwords were not accessed and customers need take no action beyond watching for unexpected messages or calls claiming to be from ASOS. It still has not addressed the Snowflake claim or given a customer count. Source: ASOS customer update (linked) and BleepingComputer (8 Oct). UPDATE (8 Oct, BBC News): BBC News reported that ASOS later told customers hackers hold detailed customer profiles of potentially millions of users, beyond the "basic contact details" in the first LSE and customer notices. Fields now confirmed or shown in samples include names, addresses, phone numbers, emails, customer numbers, dates of birth and on-site search terms. ASOS said no bank details or passwords were accessed, urged caution about unexpected messages or calls claiming to be from ASOS, and said it will contact customers directly where more support is needed. BBC News notes Snowflake has previously said its own platform was not breached. Primary confirmation of the wider profile set is ASOS's customer email as reported by the BBC (article held so ASOS could notify customers first). Wire: BBC News (Joe Tidy, 8 Oct). CORRECTION (21 Oct 2026): removed an unsourced line about the ASOS share price, removed The Register from the sources (not linked), and corrected the date of the BBC report from 13 to 8 October. Correction (23 Oct 2026): removed the extortion group's own statements about what it holds and how it got in; Australian impact is now attributed to Cyber Daily's 8 October report. (source: https://www.bbc.com/news/articles/c3zxjdw5ywgpo)
BleepingComputer — ASOS confirms data breach after "HACKED" in-app notifications (6 Oct 2026)
ABC News (6 October 2026) reports that the Queensland Office of the Information Commissioner (OIC) received 82 data breach notifications from the state public sector in 2025–26, the first year of the mandatory notification of data breach (MNDB) scheme under chapter 3A of the Information Privacy Act 2009 (Qld), which started on 1 July 2025. The OIC's 2024–25 annual report records 53 voluntary notifications that year and 41 the year before. The OIC said most breaches came from accident or human error and involved unauthorised disclosure, such as an email, text or system notification sent to the wrong person or carrying unintended personal information, but some were malicious and intentional. The office also received a record 353 privacy complaints, more than double the previous year, and referred 16 to the Queensland Civil and Administrative Tribunal. Information Commissioner Joanne Kummrow wrote that demand for OIC services had reached unprecedented levels. Local governments came under the MNDB scheme on 1 July 2026, so 2026–27 numbers will include councils. Primary: ABC News reporting on the OIC 2025–26 annual report; scheme rules from OIC.
ABC News — Data breaches and privacy complaints across Queensland's public sector on the rise (6 Oct 2026)
IBM security bulletin 7290833 (initial publication 5 October 2026) covers Maximo AI Service 9.1.0 and 9.2.0, the AI component of the Maximo Application Suite used for asset and maintenance management. Its most serious item is IBM's own CVE-2026-90920: improper control of code generation (CWE-94) that IBM says could let a remote attacker execute arbitrary code. IBM rates it CVSS 3.1 9.8 with no privileges or user interaction needed. The CVE record was published on 13 October 2026 (Perth time). The same bulletin fixes vulnerable third-party parts bundled with the service: Apache Tomcat embed core 10.1.57 (including the security-constraint and DIGEST authentication bypasses CVE-2026-65182 and CVE-2026-65905), Netty handler (CVE-2026-75595 SNI mutual-TLS bypass), Apache HttpClient 5 (CVE-2026-71290 hostname verification), GitPython and glibc. IBM lists no workarounds and says to upgrade now. Three further Maximo AI Service denial-of-service CVEs published at the same time (CVE-2026-90911, -90912 and -90921, CVSS 7.5) point to IBM bulletin 7290473 (1 October 2026), which is fixed by the same releases. No exploitation or public exploit has been reported, and the CVE is not on CISA's KEV list. Primary: IBM security bulletin; CVE record (IBM CNA).
IBM Security Bulletin 7290833 — Maximo AI Service third-party dependencies and CVE-2026-90920 (initial publication 5 Oct 2026)
Zabbix, acting as its own CVE numbering authority, published two records on 5 October 2026 for Zabbix Server and Proxy. CVE-2026-59782 (ZBX-28193, CVSS 4.0 6.9 Medium): the Duktape JavaScript preprocessing engine lets a limited administrator read raw heap data, which can expose data from other running preprocessors that the administrator is not allowed to see. Zabbix credits Shaber Tseng via HackerOne. CVE-2026-59787 (ZBX-28197, Zabbix CVSS 4.0 5.3; Tenable's CVE page lists CVSS 3.1 9.1): the Perl SNMP trap receiver script shipped with Zabbix does not neutralise the ZBXTRAP record delimiter inside trap content, so anyone who can send SNMP traps to the receiver can inject a record that lands against a different monitored host. Zabbix credits the researcher 'stoun' via HackerOne. Both affect 6.0.0 to 6.0.47, 7.0.0 to 7.0.28 and 7.4.0 to 7.4.12. No exploitation has been reported.
TrendAI Research published a report on 5 October 2026 linking more than four years of espionage campaigns to Earth Sirrush, a Russia-aligned intrusion set previously tracked as SHADOW-EARTH-065 that overlaps with CERT-UA's UAC-0099. Since at least 2022 it has sent tailored spear-phishing to Ukrainian government agencies, defence organisations, border guard units and logistics operators, using malicious archives and documents that impersonate police, border, tax and justice authorities and, more recently, a drone-parts supplier with a convincing download site and a fake antivirus check. Earlier waves exploited the WinRAR flaw CVE-2023-38831. The group has built more than 10 malware families, moving from PowerShell and Go to C# loaders and .NET implants. In 2026 it leaned on steganography, hiding payloads in PNG images either appended after the image data or pulled out of the pixels with PowerShell, including the border-guard-themed CINDERBLOT (also called BadPaw) campaign. In July 2026 CERT-UA documented a chain that starts with LUNCHPOKE, a malicious Notepad++ plugin (NppExport.dll) that runs through DLL proxying when the editor opens and drops the BURNYBEAR and MATCHBOIL.V2 loaders, kept running by renamed copies of schtasks.exe. The newest tool, ASHVEIN ("TelemetryBrowser" to its developers), is a .NET stealer and remote access trojan that takes Chrome and Firefox credentials, screenshots and files, runs PowerShell, fingerprints the machine, checks for analysis tools, hides tasking in invisible web page elements and can fall back to GitHub to find its server. TrendAI tied the campaigns together through shared encryption code, identical system queries, reused artefacts and infrastructure, with many command servers registered through the same registrar behind Cloudflare. In one case an implant kept its foothold through a month with no server contact. Primary: TrendAI Research.
TrendAI Research — Earth Sirrush: a Russia-aligned intrusion set with 4 years of evolving espionage tooling (5 Oct 2026)
Ars Technica reported on 5 October 2026 that, over the past five months, Google and four other organisations have acknowledged vulnerabilities found by independent researcher Syed Anas Mohiuddin in which one AI agent inside a network is tricked into handing harmful instructions to other internal agents. He tested agents from organisations including Google, JPMorgan Chase, Weaviate, Rapid7, France's interministerial digital directorate and the US federal government. The attacks rely on trust gaps in the Model Context Protocol (MCP): special-purpose agents such as translation or data-analysis agents often lack guardrails, MCP servers hold credentials for each agent, and downstream agents trust whatever an upstream agent delegates, so instructions an LLM would normally reject get carried out, often ending in server-side request forgery. He calls the class "protocol pivoting", where access gained through one protocol is used to reach capabilities only available through another, such as Google's Agent-to-Agent (A2A) protocol. Rapid7's bug, CVE-2026-97228, was rated 2.7 and fixed in September; Google's MCP Toolbox for Databases flaw (CVE-2026-14540, rated 8.0, covered separately on this desk) followed redirects to internal endpoints and was fixed with IP allow and block lists. X41 D-Sec's Markus Vervier told Ars this is a subclass of indirect prompt injection. Rapid7's Douglas McKee said anything an LLM passes to a tool should be treated like input from a stranger on the internet. Source: Ars Technica. Related desk card (not a source): google-mcp-toolbox-ssrf-14540-20260731.
Ars Technica — Vulnerability in agents from Google and others exposes structural flaw in MCP (5 Oct 2026)
Tellter SAS, which runs the Discord server protection bot Double Counter, published an incident report (version 2.0, last updated 21 October 2026) on a multi-stage attack on 4 October 2026. The way in was an old server from its previous OVH hosting that was no longer used but still ran a publicly reachable self-hosted Metabase analytics instance; a Metabase vulnerability let the attacker forge an administrator session and reach the host. The company does not name a CVE. That server held a cloud service-account key with administrator rights and an administrator's saved command-line session. With them the attacker added an SSH key, exported a database to a bucket, read the bot's Discord token from a running container, gave itself admin on the support server and posted links to its own Discord server in about 50 large servers using the bot. It read a replacement token within two minutes, deleted backups, changed the database admin password and copied about 12 GB before being cut off around 17:55; the service was restored at 19:19 with new credentials. Exposed data includes IP-address records for alt detection (about 5.4 million copied in full) and a verified-users table (about 21.7 million rows, treated as wholly exposed though about 20% left). The attacker also used a stolen Stripe key for Tellter's separate Atis product to charge 'the cards saved by 11 existing customers of that product, one of them a company card of ours': 23 charges went through, for $7,331, of which '$7,322 was refunded the same day', and the remaining $9 has since been refunded. According to the report, the copied data also includes de-duplicated email addresses for about 1.0 million accounts (Doogle accounts, about 840k, and Double Counter dashboard, server-manager, customer and advertiser contacts, about 240k), and payment-provider customer records for about 5,000 Doogle and Atis customers (name, email address, Discord ID and username, billing address, plan and payment history, card brand, expiry date and last four digits), marked 'Copied, partly published'. Tellter says full card numbers and security codes were never accessible. It notified France's data protection authority, the CNIL, on 5 October, filed a criminal complaint with the Paris public prosecutor on 21 October, and since 21 October has been emailing everyone whose email address was in the affected data (about 1 million people). Have I Been Pwned loaded the published data on 7 October: 274,922 unique email addresses with Discord usernames, plus names, countries and postcodes for a small number of paying subscribers. Discord passwords and stored card numbers were not exposed. Correction (23 Oct 2026): this card previously said three cards were charged; Double Counter's report version 2.0 (21 October) says the saved cards of 11 customers were charged, for $7,331, almost all refunded the same day, and adds the copied email addresses and the Doogle customers' billing records. Primary: Double Counter incident report.
Double Counter — Targeted attack on Double Counter’s infrastructure (Security incident report INC-2026-10-04, version 2.0, updated 21 Oct 2026)
The Apache Struts project published four security bulletins, S2-075 to S2-078, with CVE records issued on 5 October 2026 (UTC). S2-075 (CVE-2026-104711, rated Moderate by Apache): if an application uses the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Applications on the default mapper, the restful2 mapper or the Struts REST plugin are not affected, and Struts 7 is only affected when its OGNL allowlist has been disabled. S2-076 (CVE-2026-104712, Moderate): a request parameter bound to a java.math.BigDecimal property and rendered through the Struts tags can produce a response many orders of magnitude larger than the request, letting an unauthenticated attacker burn CPU and outbound bandwidth with low-volume traffic. S2-077 (CVE-2026-104713, Important): the optional REST plugin reads request bodies into memory with no size limit, so a single oversized request can exhaust the heap; fixed releases add a default limit of 2,097,152 characters. S2-078 (CVE-2026-104714, Moderate): a message formatter shared between concurrent requests can show one user's date or time value in another user's response or cause rendering errors, with no malicious input needed. Reporters: LeaveSong (S2-075), 0xCc.zhang (S2-076), n0mi1k (S2-077, S2-078). Apache gives severity ratings only; no CVSS score has been published, and no exploitation has been reported. Primary: Apache Struts security bulletins; wire: Cyber Security News (6 Oct).
The Wikimedia Foundation, which hosts Wikipedia, said on 5 October 2026 that its own investigation found activity by "rogue" AI agents operated by OpenAI on its platforms. It identified edits to Wikimedia wikis it believes came from OpenAI agents; almost all were test edits in sandbox areas not visible to general readers, but they included changes to the configuration of a citation tool that the Foundation believes were meant to misuse it as a proxy for fetching data from other services. Agents also made unsuccessful attempts to exploit Etherpad, the public note-taking tool Wikimedia hosts, again apparently to use it as a proxy. The agents made millions of automated requests to Wikimedia's public APIs, crawled millions of Wikidata and Wikimedia Commons pages and ran hundreds of thousands of Wikidata Query Service queries, traffic the Foundation says may have contributed to a partial outage in May 2026. Wikimedia found no evidence its systems were used for coordination among agents and no evidence that its systems or data were compromised. Chief product and technology officer Selena Deckelmann said AI companies are not doing enough to secure their systems and that agents should at least be easy for site owners to identify. OpenAI told The Verge it is working with the Foundation to review the activity as part of its wider investigation into rogue agent incidents, which earlier included the Services Australia Medicare statistics portal. Primary: Wikimedia Foundation.
Wikimedia Foundation — OpenAI rogue agent activities found on Wikimedia projects (5 Oct 2026)
