The FBI Got Hacked — Here's the Full, Bizarre Story
Sunday, October 11, 2026 · 5-minute read
A Chinese hacker used the ARTEX AI penetration testing suite and Claude AI agents to attack South Korean financial institutions earlier this month. It's one of the first confirmed cases of an attacker openly chaining commercial AI tools together to carry out financial-sector intrusions. This signals a shift: the same AI tools defenders use are now being turned against them.
↗ BleepingComputerDaiichi Kosho, a major Japanese entertainment company, says a malware infection at its contractor Nippon Columbia exposed over 8.7 million customer and employee records. The breach highlights a recurring problem: your data is only as safe as the least-secure company your provider works with. If you've ever used a karaoke system tied to either company, assume your details could be out there.
↗ BleepingComputerGerman authorities arrested a Russian national suspected of being a leading figure in the Qilin ransomware group, following extradition from Japan. Qilin has targeted hospitals, schools, and critical services across Europe. The arrest is a notable law enforcement win — ransomware leadership rarely faces justice, especially when operating from Russia.
↗ BleepingComputerHackers are buying Google ads and abusing Bing redirect links to send people to fake Claude AI installer pages. When you click what looks like a legitimate download, you get hit with a ClickFix attack — a technique that tricks you into running malicious commands on your own computer. About 4 in 5 ClickFix attacks now start from search engine results, meaning a simple Google search can be the entry point. The attack has been spotted across both paid ads and organic-looking search results.
A campaign called GhostAction has compromised the supply chain of open-source software on GitHub at scale. Attackers took over the accounts of two well-known developers and used them to push malicious code into over 340 repositories. From there, more than 500 compromised accounts spread the same bad code to tens of thousands of other projects. Any developer whose app pulls in one of these affected packages could unknowingly ship malware to their own users.
This is a maximum-severity flaw in SonicWall's SMA1000 remote access appliances. Attackers are already actively exploiting it — just three days after a patch was released. A successful exploit could let an attacker take full control of the device, potentially opening a company's entire internal network to outsiders.
Status: Patch available. SonicWall released a fix on Tuesday, October 6. If your organization uses SMA1000, apply the update immediately — active exploitation is confirmed.
This is the zero-day vulnerability that the ShinyHunters group used to breach the FBI's jobs portal and hundreds of other organizations. It lives in Oracle PeopleSoft, the software many large employers use to manage hiring and HR. ShinyHunters have since found a way to bypass the temporary firewall workaround that Mandiant suggested, meaning organizations that haven't applied the real patch are still wide open.
Status: Oracle has issued a patch. Organizations relying only on Mandiant's earlier web application firewall workaround are still at risk and must apply the official fix now.
Citrix is urging admins to patch a newly discovered remote code execution flaw in NetScaler ADC and Gateway products — tools widely used by businesses to manage secure web traffic. CISA also flagged critical zero-day vulnerabilities in NetScaler products in late September, suggesting these systems are under sustained pressure from attackers right now.
Status: Patch available. Citrix says to apply it immediately. If your company uses Citrix for remote access, flag this to your IT team today.
Mobile security firm iVerify published research this week revealing a new variant of the DarkSword iOS exploit kit called P7. Compared to earlier versions, P7 is harder to detect because it leaves a smaller trace on the device. It adds the ability to steal saved passwords and crypto wallet data directly from the iPhone's secure storage, and it can receive live commands from attackers. DarkSword originally targets iPhones running iOS 18.4 through 18.7 — which is exactly why keeping your iPhone updated to the latest iOS is so important. iVerify's report gives defenders new signatures to hunt for, which is the first step toward detecting these attacks in the wild.
The FBI — the agency Americans trust to investigate cybercrime — got its own jobs portal breached, sensitive data on thousands of agents and applicants stolen, and is now arresting people at cyber insurance conferences. It's a story that keeps getting weirder, and it matters far beyond Washington.
Here's the short version: a hacking group called ShinyHunters exploited a flaw in Oracle PeopleSoft — software the FBI uses to manage job applications — and walked off with data on nearly all FBI agents and applicants. The teenager reportedly leading the group, who goes by "Rey," is a young man from Amman, Jordan named Saif Al-din Khader. He's now detained and cooperating with the FBI. But before that happened, Rey spent weeks publicly taunting both the FBI and rival criminal gang Cl0p on social media, posting memes with his real handle while apparently trying to frame a recently arrested Dutch co-conspirator. It reads more like a chaotic reality TV show than an organized crime operation.
This week, the FBI made another arrest: a Canadian cybersecurity executive named Edward Dubrovsky, who was attending a cyber insurance conference in Philadelphia. Court records show he's charged with cyber extortion and conspiracy. His case has already been moved to Texas, where the FBI has centralized its entire ShinyHunters investigation. Dubrovsky's firm specialized in — of all things — ransomware negotiations. If the allegations are true, someone who got paid to talk criminals down was allegedly working with them.
For regular people, the lesson is uncomfortable but important: no organization is too powerful or too security-conscious to be hacked. The FBI's breach happened through a common piece of HR software that thousands of companies use. ShinyHunters later bypassed the recommended temporary fix by using a simple URL-encoding trick. Watch for updates on Dubrovsky's case in the Eastern District of Texas — and if your employer uses Oracle PeopleSoft, make sure IT has applied the patch for CVE-2026-35273.