DNS hijacking hides gambling pages on trusted domains
DNS hijacking allowed unauthorized gambling pages to appear beneath legitimate school and government domains, according to Infoblox. DNS, or the Domain Name System, controls which online service a domain name directs visitors to. In two unrelated operations, attackers apparently accessed DNS administration and created records that the domain owners may not have noticed. The resulting hostnames inherited trusted institutional namespaces, making them useful for search engine visibility and traffic generation.
One cluster, attributed to an actor called Hidden Hawk, added individual CNAME records, which redirect one hostname to another, and pointed institutional addresses toward gambling pages hosted mainly on Cloudflare Pages. A separate operation involving an Indian government domain delegated entire subzones to outside authoritative nameservers. A wildcard then allowed numerous hostnames to be controlled beyond the victim's DNS environment. Both techniques created apparently institutional addresses that resolved to illegal gambling doorway pages and benefited from the established reputation of the compromised domains.
Credential exposure was another recurring problem. Hudson Rock said its expanded FortiBleed investigation identified 975 additional domains and 40,573 exposed secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The material came from 1,703 FortiGate source files associated with 1,689 host identifiers and dated to around February 2026. Separately, a scan of 7.25 million public Gitee repositories found 26,400 unique credentials that were verified as still active, including thousands of cloud access keys and an organization administrator credential for a major enterprise AI platform.
Cequence also tracked a scanner impersonating roughly 32 AI bots, including ChatGPT, Claude and Perplexity, while requesting about 90 file paths commonly used for passwords, cloud credentials, private SSH keys and .env configuration files. The actor rotated identities, sent bursts of 50 to 190 requests in about eight seconds from each address and used random paths to identify sites that return a response for every request. The activity affected several sectors and remained active from at least late September through late October.
Several vulnerabilities required immediate attention. Fortinet issued coordinated updates for FortiOS, FortiManager and FortiAnalyzer covering critical and high-severity flaws found through an AI-assisted approach, although technical details were being withheld until November 10, 2026. Wordfence said it continued to observe requests associated with PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 across more than 5 million protected sites. As of October 28, it had not identified a WordPress compromise caused by either vulnerability, and emphasized that scanning attempts do not prove successful exploitation.
Attackers were actively exploiting CVE-2026-42589, a Gotenberg remote code execution flaw rated 9.8 and patched in May 2026. Remote code execution means an attacker can make a vulnerable system run commands from elsewhere. VulnCheck recorded 1,358 exploitation events from 128 source IP addresses over 30 days. Observed attacks installed a Go-based reverse shell called cache_base, which collected host information, contacted a command server, registered the victim and opened remote shell access.
Pillar Security disclosed CVE-2026-93348, rated 8.6, in Unsloth's model-loading process. A hostile model configuration could execute Python code with the model loader's access to datasets, model files, Hugging Face tokens and cloud credentials. The issue was fixed in unsloth_zoo 2026.8.14. XBOW separately reported an unauthenticated, critical remote code execution flaw in a public U.S. Election Assistance Commission logistics calculator. The affected application was not a voting machine or voter registration system, but a crafted request could run code as root inside its backend container.
Software supply chains and trusted management tools also featured prominently. JFrog and SafeDep found 42 hijacked GitHub repositories across 11 owners carrying execution hooks for AI coding assistants and integrated development environments. Polymorphic wrappers between 12.9 and 13.7 MB decoded to the same hidden publishing payload. The associated Miasma-family npm worm stole credentials, spread through packages and repositories, and included a component that deleted the home directory when a victim revoked a stolen GitHub token. Compromised projects also launched workflows aimed at cPanel systems through CVE-2026-41940. Huntress, meanwhile, observed attackers abusing legitimate Hexnode and Rippling mobile device management platforms after persuading users to enroll devices or install management agents, creating a privileged route for rogue remote-management tools.
Huntress also linked multiple September and October incidents to compromised camera management software. The operation used the legitimate WpcMon.exe program to sideload malicious DLL files, which are Windows code libraries, and establish outbound connections. Another driver-based technique appeared in The Gentlemen ransomware operation, which Acronis said had claimed more than 800 victims. Its affiliates target Windows, Linux, NAS and BSD systems and have used vulnerable Safetica ProcessMonitorDriver, tracked as CVE-2025-70795, and Lenovo BootRepair.sys drivers to terminate security processes.
On Android, the patched Microsoft Authenticator flaw CVE-2026-80097, also called AuthMask, allowed a malicious application with no additional permissions to impersonate an installed Microsoft first-party app. If a user completed the presented authentication flow, Authenticator could hand the malicious app authentication tokens for a signed-in work account. Microsoft said successful exploitation could provide access to resources as the affected user. Google also announced that an upcoming Android release will stop apps from writing directly to contacts through WRITE_CONTACTS. Apps will instead use standard contact actions that involve the user, reducing the broad background access granted by the existing permission.
Mobile banking customers face a separate crimeware service called MR ROBOT. CloudSEK described a rented platform whose affiliates use a Telegram bot and web panel to create customized Android banking trojans. The malware targets OTPs, card information, UPI PINs and account credentials, and can forward calls to bypass checks. It imitates around 36 banking, utility and government apps and is distributed through fake app-store pages and messaging lures. One affiliate was estimated to have intercepted 5,407 messages from 153 infected devices.
Other malware developments included NIK C2, which Cisco Talos described as an AI-integrated command-and-control framework.