iTnews reported on 16 October 2026 that WAGD, an Australian dog-harness retailer on Shopify, remains closed on Shopify's advice after malicious JavaScript delivered through third-party theme extensions redirected at least one shopper to a fake checkout on 13 October. Logbase, maker of the Selleasy upsell app (claimed 49,000+ active stores), said an unauthorised party accessed an internal Selleasy tool and added a malicious script to store settings; the attack window was 07:47–15:00 UTC on 13 October (evening into early morning AEST). Logbase said Shopify confirmed at 15:40 UTC that malicious code delivered through Selleasy had been removed, then locked the abused setting, tightened authentication and hired a third-party firm. Selleasy is currently listed as unavailable on the Shopify App Store. HulkApps separately disclosed that unauthorised configurations altered its Hulk Product Options theme extension in a global attack; developer Roman Zipp documented a function named hijack that cancelled the real checkout click and sent shoppers to lookalike payment domains including biliing[.]top and checkout-confirm[.]top, firing only once per browser session. Shopify temporarily disabled the HulkApps extension while the code was removed. Logbase said it has no evidence of a breach of its own systems but cannot rule out customers entering details on the fake pages. Shopify did not reply to iTnews before publication. Primary: iTnews (16 Oct 2026); vendor notices: Logbase and HulkApps.
iTnews — Shopify tells Australian store to stay shut after hijacked extensions divert shoppers (16 Oct 2026)
ABC News reported on 16 October 2026 that newly surfaced emails show sensitive Australian federal court transcription data was sent to India more than a decade ago under Auscript, and that court leadership treated the 2014 disclosure as a minor issue despite contract language forbidding transfer of information outside Australia. Former Auscript national manager Paul Cutbush raised Public Interest Disclosures with the family court, Federal Court and AFP in December 2014; a 2016 family court reply said there was 'no express provision' preventing offshore work, while Cutbush says the contract did forbid it. ABC links that history to VIQ Solutions (Auscript's successor), which earlier in 2026 breached its Commonwealth contract by allowing highly sensitive court files to be accessed in India; shortly after ABC coverage of that breach, VIQ was put into liquidation amid calls for a forensic audit and national-security concerns. A Federal Circuit and Family Court spokesperson said current leadership was unaware of the earlier Auscript offshoring. Shadow Attorney-General Michaela Cash and Greens leader David Shoebridge called for investigation. Primary: ABC News.
ABC News — Federal courts knew Australian data was sent to India more than a decade ago but took no action (16 Oct 2026)
Poole Group, a Sunshine Coast accounting and business advisory firm founded in 1980, was listed on the LockBit ransomware gang's leak site, according to Banking Daily (16 October). On 16 October a company spokesperson told Banking Daily / Cyber Daily that Poole Group is responding to a cyber incident that affected part of its IT environment in recent days: it implemented containment measures, engaged external cyber security specialists, and notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and the Australian Taxation Office. The investigation into nature and scope is ongoing; the firm says it will contact individuals directly if it determines any were affected. According to Banking Daily, the gang did not disclose what data it allegedly took or list a ransom value. Accounting firms hold tax file numbers, identity documents and financial records, so clients should watch for targeted phishing or invoice-redirection attempts. Primary: Banking Daily company statement (16 Oct). Correction (25 Oct 2026): removed a leak-site tracker link and the gang's publication countdown; the listing is now credited to Banking Daily. The card date has moved from 14 to 16 October 2026, the Perth date of Banking Daily's report (16 October 09:38 AEST, 07:38 Perth time (AWST)); the earlier date came from the tracker. (source: Banking Daily)
Banking Daily — Poole Group investigating LockBit ransomware attack; OAIC, ACSC, ATO notified (16 Oct 2026)
Symantec's Threat Hunter Team says the Aoki (aka Aokigahara) infostealer, a relatively new stealer first seen earlier in 2026, has begun stealing credentials for AI coding assistants, and that older samples did not look for AI-related files, so the capability was added recently. Symantec says the newest version it found targeted .claude.json, Claude desktop cookies, ChatGPT cookies and the Codex config.toml and .env files, and stole tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, along with Amazon Web Services (AWS) credentials. It also steals data from dozens of browsers, cryptocurrency wallet extensions and desktop wallets, password managers (including Bitwarden, 1Password, Dashlane and KeePass config), Discord and Telegram clients, gaming platforms, Outlook and Thunderbird, FTP clients and VPN clients, and records which security products are installed, according to Symantec. Symantec says the malware has no backdoor command list: it collects whatever data is available and sends it to its command-and-control server through a /gate endpoint. Symantec says it stole credential, token and session files rather than source code, with the exception of Cursor's local state database, which can cache chat context and code snippets. Symantec says stolen API keys and OAuth or session tokens let attackers act under a legitimate developer's identity and API quota and can expose connected repositories, cloud services and CI/CD pipelines. Symantec says it does not know what group is behind the malware and there are no indications it is linked to any existing malware family.
Symantec (Broadcom) Threat Hunter Team — Aoki: Infostealer Targets AI Coding Assistant Credentials (15 Oct 2026)
Forescout Research – Vedere Labs published an analysis on 15 October 2026 of ROMULUS, a web panel it found while investigating an incident that works as a reusable backend for ClickFix lures, the fake pages that trick people into pasting and running a command themselves. Forescout identified six IP addresses running ROMULUS. One server delivered the same trojanised Stardock DeElevation installer that Huntress reported on 28 September in a campaign using ChatGPT Custom GPTs to send victims to ClickFix pages. A second route runs a hidden PowerShell staging script that downloads the legitimate 7zr.exe from GitHub and a password-protected 7z archive from orbitflownetwork[.]lol, then unpacks an executable inflated to about 842 MiB, apparently to exceed upload and scanning size limits, which carries encrypted shellcode and LegionLoader, a loader active since 2019 (also called CurlyGate, RobotDropper and Satacom) that fetches further payloads. Forescout does not know who runs ROMULUS and says it may be a private panel, a criminal delivery service, an affiliate framework or copied software; it says it has no link to the RomulusLoader malware Proofpoint tied to Silver Fox earlier this year. UPDATE (20 Oct): Siemens ProductCERT confirmed on 19 October that a ClickFix campaign shipped a genuine signed copy of Siemens Software Center 3.5.8.7 with a malicious archive.dll inside AllMyBasic.msi to drop a remote access trojan (CVE-2026-110936, fixed in 4.0.9.8; separate card on this desk), and The Hacker News ties that activity to ROMULUS. Extra indicators from Siemens: 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127. Primary: Forescout; wires: Infosecurity Magazine, The Hacker News.
Forescout Vedere Labs — ROMULUS: Analysis of a new multi-payload ClickFix delivery platform (15 Oct 2026)
An ABC investigation published on 15 October 2026 found that the same LinkedIn accounts used to groom businessman Alexander Csergo, the first person convicted of reckless foreign interference in Australia, also reached out to many other Australians. LinkedIn records the Australian Federal Police obtained during the Csergo case show two accounts posing as think-tank and consultancy representatives (including 'Vera Su' of 'Nesa Consulting') built thousands of connections worldwide; between 2016 and 2025 they targeted more than 100 people linked to Australia and messaged 58 of them, offering paid consulting work for 'valuable advice' and, in one message, asking for information 'from important people in the government'. Those approached included people listing jobs at Austrade, the Department of Foreign Affairs and Trade, Investment NSW, Invest Victoria and Tourism Australia, an AFP commander and senior federal officials; Steven Miles, now Queensland Opposition Leader, was connected to the Vera Su account in April 2021 while deputy premier, though the ABC saw no messages and understands he did not reply. Some recipients shared personal contact details or moved conversations to WeChat, phone calls or meetings. A fictitious security firm, 'Data 31', also sought retired Australian police officers as part-time 'security expert' consultants, contacting at least seven Australians, according to Information Age's summary of the ABC reporting. The AFP alleges the operation was run by China's Ministry of State Security (MSS); the Chinese embassy called the claims 'entirely groundless', and ASIO would not comment. Csergo was approached through LinkedIn in Shanghai in November 2021, convicted in March and sentenced in September to three years and six months' jail; the court heard his reports used publicly available material. The accounts have since been deregistered following the AFP investigation; LinkedIn told Information Age that fake accounts breach its terms and it is focused on state-sponsored abuse. The Five Eyes partners warned in June about Chinese intelligence recruiting through online job platforms.
ABC News — Alleged Chinese spies targeted former premier and AFP commander via LinkedIn (15 Oct 2026)
Google's Chrome Releases blog says the Stable channel was updated on 15 October 2026 to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 for Linux, rolling out over the coming days and weeks, with 10 security fixes. The one Critical bug is CVE-2026-110922, a use-after-free in Prerender reported by Xinyang Ge on 2 October. The six High bugs are CVE-2026-110913 (memory corruption in DOM, reported by Xinyang Ge of Anthropic, assisted by Claude, on 29 September), CVE-2026-110919 and CVE-2026-110921 (use-after-free in V8), CVE-2026-110920 (memory corruption in V8), CVE-2026-110918 (memory corruption in Core, found by Google) and CVE-2026-110917 (memory corruption in SVG, reported by C0rk1). The three Medium bugs are CVE-2026-110916 (improper input validation in Desktop), CVE-2026-110915 (use-after-free in Compositing) and CVE-2026-110914 (memory corruption in Workers). Google does not say any of them is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. The same day, Extended Stable moved to 152.0.7977.169 for Windows and Mac with 10 fixes, including Critical CVE-2026-110151 and CVE-2026-110922, and Chrome 155.0.8059.84 for Android carries the same fixes as desktop. This follows the 13 October 155.0.8059.79/.80 release, which is a separate card. Primary: Chrome Releases (15 Oct 2026); wire: Cyber Security News (17 Oct 2026).
Chrome Releases — Stable Channel Update for Desktop, 155.0.8059.84/.85 (15 Oct 2026)
Israel's National Cyber Directorate (INCD) published four CVE records on 15 October 2026 for Unitronics UniStream Pro (B10/C10) with UniLogic: CVE-2026-45449 (OS command injection, CWE-78), CVE-2026-45450 (memory-buffer restriction, CWE-119), CVE-2026-45451 (improper authentication, CWE-287) and CVE-2026-45452 (externally controlled format string, CWE-134). Each is rated CVSS 3.1 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) — network reachable with low privileges and no user interaction. Affected builds are UniStream Pro B10/C10 with UniLogic prior to 1.41.329. Solutions in the CVE records: upgrade UniLogic and UniStream to 1.41.329 or above for CVE-2026-45449, and to 1.42.220 or above for the other three. No exploitation is stated in the records. Unitronics PLCs have previously been targeted in OT incidents; treat internet-exposed HMI/PLC pairs as high priority. Primary: CVE/INCD records.
CVE-2026-45449 — Unitronics UniStream Pro/UniLogic OS command injection (INCD, 15 Oct 2026)
Palo Alto Networks Unit 42 published on 15 October 2026 an investigation into CL-UNK-1211, a still-unattributed cluster that targeted government entities and state-affiliated infrastructure from October 2025 through April 2026. Operators focused on Linux environments for reconnaissance and long-term access, attempting to dump databases and exfiltrate government mailboxes to reach linked social-media accounts. Initial access used custom and open-source PHP web shells, including persistence by rewriting auto_prepend_file under /etc/php/ and /opt/plesk/php/ (one implant posed as /usr/lib/php/plesk_sys_driver.php). Credential theft included a malicious sudo alias in .bashrc that logged passwords to a SolarWinds-named file, PHP login-page hooks, and searches of configs and shell history. A custom Go RAT Unit 42 names SysGoRAT (first seen as sys-control-client) talks over WebSocket to a hardcoded C2 (104.194.158.65:443 by default) with seven command types. Operators also used LinPEAS, PwnKit (CVE-2021-4034), a React2Shell (CVE-2025-55182) scanner, log wiping, endpoint-protection disablement, and red-team decoys (e.g. RedTeamOps2025). Multiple scripts carried conversational LLM-style reasoning comments, which Unit 42 takes as evidence of AI-generated or AI-agent-driven payloads. No individual victim country is named in the public report. Primary: Unit 42.
Unit 42 — AI-powered espionage campaign targets government Linux infrastructure (CL-UNK-1211 / SysGoRAT, 15 Oct 2026)
JetBrains assigned CVE-2026-111094 on 15 October 2026 for TeamCity builds before 2026.2, 2026.1.4 and 2025.11.8: remote code execution was possible through a whitelist bypass in the build messages protocol (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network, high attack complexity, no privileges or user interaction). The same advisory set includes CVE-2026-111095 (stored XSS in the classic project overview, CVSS 8.0) and CVE-2026-111096 (stored XSS in the classic build log, CVSS 6.7). JetBrains lists the fixes on its privacy-security issues-fixed page; there is no report of in-the-wild use in the CVE records. Distinct from the 6 October TeamCity Kotlin DSL sandbox RCE card (CVE-2026-106218) already on this desk. Primary: JetBrains issues-fixed / CVE records.
Google Threat Intelligence Group (GTIG) and Mandiant, working with ManageEngine's Threat Analysis Lab, disclosed on 15 October 2026 that AOMEI Technology's origin update servers for AOMEI Backupper were repeatedly tampered with between April and July 2026. In confirmed windows on 28 May (10 minutes), 16 July (6 minutes) and 20 July (5 minutes) UTC, attackers briefly changed the unsigned down_html.ini and Notifycfg.ini files that Backupper polls over HTTPS so any client that checked for an update during those minutes downloaded and ran a trojanised package. There was no software vulnerability: the client trusted the MD5 checksum inside the same unsigned configuration file that named the download. GTIG tracks the cluster as UNC7017. On hit machines a CROSSROAD downloader staged a signed Radmin binary beside an attacker DLL that loaded the SHINYROAD implant (later Adaptix C2 on some hosts), set a scheduled task, and restored the local update file so the machine looked clean while the vendor's download page also looked clean again within minutes. GTIG telemetry spans IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States; victimology is opportunistic. AOMEI told Mandiant on 29 July that it had secured the servers; ManageEngine said it had not independently confirmed containment as of publication. Backupper's changelog through 8.5.0 (9 Oct) lists no change to update verification. Primary: Google Cloud / GTIG (15 Oct); vendor analysis: ManageEngine Threat Analysis Lab; wire: The Hacker News (16 Oct). UPDATE (19 Oct, BleepingComputer): ManageEngine says it first told AOMEI about the suspicious activity on 7 June, when AOMEI suggested the files may have been altered in transit (the researchers disagreed). After capturing the 16 July tampering, ManageEngine sent AOMEI the original and modified files, hashes and differences, advised it to preserve evidence before moving the configuration files to new infrastructure, and put it in touch with Mandiant. AOMEI told BleepingComputer it is treating the matter as a high priority, that its chief technology officer is leading an internal investigation, and that a more detailed response will follow. It has not said how the attackers got into its update infrastructure or confirmed that the compromise is fully resolved. UPDATE (19–20 Oct): AOMEI released Backupper 8.5.1 on 19 October as a security update for the tampering incident. Its changelog says it turns off the in-app entry points for promotional pop-up content and automatic software updates, adds asymmetric encryption to remote configuration files including the .ini files, stops using the old update domain www2.aomeisoftware.com, separates software updates from marketing configuration and download resources, and only accepts update files from official AOMEI websites. In an email to The Record on 20 October, AOMEI confirmed that attackers repeatedly altered configuration files on its update servers between April and July. It said its own investigation after ManageEngine's first warning 'rectified some potential vulnerabilities' but could not find the root cause, and that it only found traces of the intrusion in server logs after ManageEngine supplied the exact tampering times in July. AOMEI said it has not yet identified or notified infected customers, will assess and contact potentially affected users, has released a free detection tool, and saw anomalies only in Backupper, not AnyViewer. Google said it has notified the victims it identified, and that in the 20 July window the attackers also used an invisible pop-up to make machines send Windows password hashes to an attacker-controlled server, which could work even where the malware itself was blocked. Vendor: AOMEI changelog; wire: The Record (20 Oct).
Google Threat Intelligence / Mandiant — Investigating ephemeral supply-chain tampering (AOMEI / UNC7017, 15 Oct 2026)
BK Japan (株式会社ビーケー・ジャパン), operator of Burger King restaurants in Japan, published a customer notice on 15 October 2026 saying a third party gained unauthorised access to the system that manages official smartphone-app member data. The access window was Friday 2 October through Wednesday 7 October 2026; the company says it confirmed the leak on Tuesday 13 October and immediately blocked the source. About 11.18 million member records were involved. Fields named in the notice include member ID, email address, registration type, prefecture, gender, date of birth, name (kanji and kana), phone number, whether the member had mobile-order history, and whether the email was verified. BK Japan says it does not hold credit-card numbers, so cards were not in the leak, and that login-password leakage has not been confirmed. It has not confirmed secondary misuse so far. Actions listed: cut off the attacker, temporary mitigations, an incident response team, a report to Japan's Personal Information Protection Commission, ongoing investigation with external specialists, and email notices to affected customers. Primary: BK Japan customer PDF notice (15 Oct 2026); wires: Kyodo (15 Oct) and BleepingComputer.
BK Japan — apology and notice on unauthorised access to official-app member information (15 Oct 2026, Japanese PDF)
