Spy Chips, Deepfake CFOs, and 1,411 Windows Patches in One Wild Wednesday
Wednesday, October 14, 2026 · 5-minute read
The United Kingdom has sanctioned Cryptomus — also known as Heleket — a cryptocurrency exchange accused of processing billions of dollars for ransomware gangs, drug markets, and Russian government-linked entities. The sanctions freeze any UK-held assets and bar British businesses from dealing with the platform. Blockchain analysts say Cryptomus processed over $7 billion since 2022, including payments tied to child exploitation material vendors and human trafficking networks.
↗ Krebs on SecurityA coordinated international law enforcement takedown has disrupted a massive criminal ecosystem responsible for sending over one billion phishing messages to more than 75,000 organisations across 150 countries. The operation targeted the infrastructure — the servers, tools, and services — that cybercriminals rented to run their scam campaigns. Researchers note that 90% of active phishing kits are now generated with AI assistance, and the average fake site only stays live for two days before criminals swap it for a fresh one.
↗ BleepingComputerThe FBI arrested a Canadian cybersecurity executive in Pennsylvania last week, linking him to the ShinyHunters group — the same crew that recently stole sensitive data on thousands of FBI agents. The suspect was attending a cyber insurance conference in Philadelphia when agents moved in. Court records show charges of cyber extortion and conspiracy, though key documents in the case have been sealed.
↗ Krebs on SecurityA new piece of malware called Hirudo is targeting Android users by swapping out real banking apps with convincing fakes. The fakes look identical but are secretly modified to hand over your login credentials — and give attackers live remote control of your device. Victims download Hirudo disguised as a shopping, entertainment, or adult video app, which then silently installs the fake banking replacement. The attack currently targets eight Indonesian banking apps, with credential theft spanning Indonesia, China, India, Mexico, Morocco, and Thailand.
Attackers are using deepfake cloned voices to impersonate executives — often a CFO or CEO — and trick employees into wiring money or resetting account access. A 2025 Gartner survey found 62% of security leaders said their organisation had experienced at least one deepfake attack in the past year, with 43% reporting fake audio calls specifically. The scam typically combines a spoofed phone call with a follow-up email to make the request feel legitimate.
Ivanti Connect Secure is a popular VPN product used by thousands of organisations. This flaw lets an attacker log in without any username or password and then run any commands they want on the device — meaning they can steal credentials and pull out sensitive data at will. Honeypots (decoy servers set up to catch attacks) have already logged 105 real exploit attempts, and CISA confirmed attackers have been abusing this since at least October 1st.
Status: Patch available now. CISA has ordered all US federal agencies to apply it by October 16. If your organisation uses Ivanti Connect Secure, update immediately.
curl is a tool baked into an enormous number of apps, servers, and devices — it's the invisible plumbing that moves data around the internet. This use-after-free flaw means a malicious server can corrupt the memory of any client that uploads a file to it over HTTP/2, and a researcher has already demonstrated that this can lead to the attacker running code on the uploading machine. The attack requires the client to upload roughly 135KB of data to the attacker's server.
Status: Fixed in curl 8.23.0, released today. The curl project cut its release cycle by two weeks to ship this fix early. Update curl and any software that bundles libcurl.
Ghostscript is the behind-the-scenes engine that many PDF readers and document converters rely on. This critical flaw is a heap buffer overflow — a type of bug where a specially crafted PDF file pushes more data into memory than the program expects, letting an attacker take over the server or machine that opens the file. If your organisation accepts PDF uploads from the public, this is especially urgent.
Status: Patch details published. Update Ghostscript immediately and audit any systems that process uploaded PDF files.
Microsoft's October Patch Tuesday fixed a record-breaking 1,411 vulnerabilities — nearly double September's record. The one actively exploited flaw is a security feature bypass in the Windows Shell affecting Windows 10, Windows 11, and some Server versions. Attackers are already using it in the wild. The patch batch also included two publicly disclosed but not yet exploited zero-days.
Status: Fixes released. Run Windows Update today. Windows 10 users: Microsoft has quietly extended free security updates until October 2027, so you're still covered.
Security firm XBOW used OpenAI's publicly available GPT-5.6 Sol model to direct AI agents that found and chained together three previously unknown bugs in Google Chrome, creating a full exploit chain that could run code on a Windows computer just by loading a webpage — no clicking required. The team built the entire attack in six days, and Google confirmed all three bugs, fixed them, and paid XBOW the maximum $250,000 bug bounty. The bugs were never used against real Chrome users. This is notable not because it's scary, but because it shows that AI-assisted security research is maturing fast — the same tools defenders can use to find bugs before criminals do.
AI safety company Anthropic has published a warning that compact AI models are approaching the capability threshold needed to copy themselves from device to device across consumer IoT gadgets — think Android TV boxes, smart ovens, and home routers. If this happens, attackers could assemble distributed botnets that run AI workloads entirely on your home devices without touching a data centre. Anthropic says this isn't happening yet, but it's close enough to warrant planning now.
Ledger, one of the world's most popular hardware cryptocurrency wallets, has confirmed something that sounds like a spy thriller: a hidden chip was implanted inside devices that allowed attackers to steal crypto directly from users' wallets. The company confirmed the spy chip implant was behind a string of thefts that had previously baffled investigators.
Hardware wallets like Ledger exist precisely because keeping crypto on an internet-connected exchange is risky. The whole point is that the device is offline, physically in your hand, and therefore out of reach of remote hackers. A spy chip implant undermines that premise entirely. It means the security guarantee you bought the device for was silently removed — possibly before the box was even opened. This kind of attack is called a supply chain compromise, and it's extremely hard to detect because the device looks and works completely normally.
For most people this won't be an immediate personal threat — targeted hardware tampering at this level is sophisticated and expensive. But the story matters because it punctures the idea that physical hardware is automatically trustworthy. Your security camera, your router, your smart speaker — all of them are manufactured in complex global supply chains where oversight is imperfect. Buying from reputable retailers, checking for signs of tampering on delivery, and keeping firmware updated are the basic hygiene steps that apply to all hardware, not just crypto wallets.
Watch for: More details on exactly how the Ledger chips were implanted and at which point in the supply chain. That answer will determine whether this was an isolated incident or a sign of a broader, systematic problem in how consumer electronics reach your door.