Spy Chips in Crypto Wallets, 1,411 Windows Fixes & Fake AI Malware Surge
Thursday, October 15, 2026 · 5-minute read
The UK government has frozen the assets of Cryptomus — also known as Heleket — a cryptocurrency platform that processed over $7 billion in transactions since 2022, including payments tied to ransomware gangs, drug markets, and human trafficking. The platform kept rebranding to dodge regulators: first Certa Payments, then Xeltox, then Cryptomus, then Heleket. The UK sanctions freeze any Cryptomus assets held at British banks and bar UK companies from doing any business with them.
↗ Krebs on SecurityThe FBI dismantled a network of laptop farms used by North Korean operatives to pose as American freelance tech workers and funnel wages back to Pyongyang. Two people were arrested and 14 others charged, with nearly 187 laptops seized. The Famous Chollima threat group ran the scheme, earning money that reportedly helped fund North Korea's weapons programs.
↗ BleepingComputerA coordinated international takedown has disrupted a criminal ecosystem responsible for sending over one billion phishing messages to more than 75,000 organizations across 150 countries. Separately, INTERPOL arrested 95 suspects across 17 countries in Latin America and Europe for distributing child sexual abuse material through online messaging groups. Both operations show the growing reach of cross-border law enforcement coordination.
↗ BleepingComputerCriminals are building convincing fake versions of popular AI tools — think fake ChatGPT installers, counterfeit Midjourney apps, bogus Copilot pages — to trick employees into running malware or handing over login credentials. Researchers at ANY.RUN linked over 1,258 cases to these campaigns between April and October 2026 alone. Once inside, attackers steal saved browser passwords, session cookies, and business account access. US companies were among the top targets, accounting for 16% of victims.
Palo Alto Networks has confirmed that attackers are already exploiting a freshly patched flaw — tracked as CVE-2026-0322 — in its PAN-OS software, which runs on its widely used firewall products. The flaw lets an attacker run their own commands on a vulnerable device without needing a username or password. CISA has urgently called on organizations to apply the patch immediately.
A flaw in Drupal's Field UI module — the part of the admin panel where site managers set up data fields — can let an outside attacker run code directly on the web server. No login is needed if the site uses certain common add-on modules. Drupal didn't name which add-ons are affected, so every Drupal site should treat this as urgent. The bug was fixed on October 14 in versions 11.4.10, 11.3.19, and 10.6.19.
Status: Patch available — update your Drupal installation immediately.
Next.js — a popular framework used to build websites and web apps — shipped an emergency patch fixing two separate critical flaws. Both let an attacker run their own code on a server without logging in. One is in how Next.js handles a caching feature; the other is in how it processes SVG image files. A third, less severe bug can crash the site entirely. Fixed versions are 16.4.1 and 15.5.28.
Status: Patch available — developers running Next.js should update immediately.
NGINX, the web server software that quietly powers a huge chunk of the internet, patched five vulnerabilities at once — including one bug that has existed in every version since May 2005. Three of the flaws are memory bugs that could crash the server or let an attacker run malicious code. A fourth could allow someone to sneak past client-certificate authentication. None are known to be exploited yet, but updates 1.30.6 and 1.31.7 are available now.
Status: Patch available — NGINX admins should update to 1.30.6 or 1.31.7.
Microsoft's October 2026 Patch Tuesday is the biggest ever — 1,411 vulnerabilities fixed, smashing last month's record of nearly 1,000. Three are zero-days, including CVE-2026-96951, a Windows Shell security bypass affecting Windows 10 and 11. Windows 10 users get a reprieve: Microsoft quietly extended free security updates until October 2027.
Status: Patches are live — run Windows Update today if you haven't already.
Security firm Push Security released its annual analysis of how attackers are targeting people through web browsers — and the numbers are striking. Four in five ClickFix attacks now reach victims through regular search engine results, not suspicious emails. There are now over 30 criminal phishing kits targeting device login flows, up from zero last year. Perhaps most striking: 90% of phishing kits are now being generated with AI assistance, meaning scam pages are faster to make, harder to spot, and constantly refreshed — phishing domains now last just two days on average before being swapped out.
Ledger, the company behind some of the world's most popular hardware cryptocurrency wallets, has confirmed something that sounds like a spy thriller: physical spy chips were secretly implanted inside devices somewhere in the supply chain, and those chips are responsible for a wave of crypto thefts. Ledger has now asked resellers across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to pull all devices from shelves immediately.
A hardware wallet is supposed to be the gold standard of crypto security — it keeps your private keys completely offline, so even if your computer is hacked, your funds should be safe. The idea behind this attack is deeply unsettling: someone physically modified the devices before they reached customers, adding hidden chips that can silently leak the keys needed to access funds. This kind of attack is called a supply chain attack, and it's extremely hard to detect because the device looks and behaves normally right up until it drains your wallet.
For everyday crypto holders, this is a wake-up call about where you buy your hardware wallet. Ledger has always recommended purchasing only from its official website or authorized retailers — this incident shows exactly why. A discounted Ledger on a third-party marketplace or a reseller you've never heard of carries real risk. If you bought a Ledger device through unofficial channels in Asia recently, treat it as potentially compromised.
Ledger is investigating the full scope of the tampering and hasn't yet confirmed exactly how many devices were affected or where in the supply chain the modification happened. Watch for an official Ledger advisory with guidance on how to check whether your device is safe — and if you have any doubt, move your funds to a new wallet address using a device you trust before doing anything else.