The Teen Who Hacked the FBI — Then Got Caught Extorting Boeing
Thursday, October 8, 2026 · 5-minute read
Japan's cybersecurity coordination center, JPCERT/CC, is raising the alarm about a wave of data breaches hitting Japanese organizations. Attackers have been abusing APIs built for mobile apps and going after known flaws in business intelligence tools like Metabase. What makes this especially messy: some of the systems that leaked data were never meant to face the public internet at all.
JPCERT/CC admits its picture is incomplete — these are separate incidents, not a single coordinated campaign. But the pattern is clear enough to warn defenders. The agency published a list of suspicious IP addresses and recommends locking down every API endpoint, even the ones you think no one knows about.
↗ The Hacker NewsSouth Korean financial firms were targeted in a cyberattack campaign that ran from late September into early October. Researchers at CrowdStrike found the attackers used ARTEX — an open-source penetration testing tool built in China — alongside large language models to automate and sharpen their attacks. Data was stolen, and South Korean authorities have opened a probe.
This is one of the first documented cases of an AI-assisted hacking tool being used in a real financial crime campaign. The attackers weren't especially well hidden — they left configuration files and session histories sitting in open directories on a Hong Kong-based server, which is how researchers found them.
↗ The Hacker NewsA RAT called ASHVEIN is being used against Ukrainian government personnel. The malware steals passwords saved in Chrome and Firefox, takes screenshots, and lets attackers run commands on an infected machine — all while hiding its instructions inside invisible parts of web pages. The group behind it, UAC-0099, is aligned with Russia and has been active for some time.
↗ The Hacker NewsSixteen malicious Firefox extensions are impersonating popular crypto wallet tools like Rabby and OKX. When you use one to import a wallet, the extension silently grabs your recovery phrase and private keys and sends them straight to attacker-controlled servers. The extension names are deliberately bland and forgettable — things like "clean-file-bar" and "manager-square" — designed not to raise suspicion.
All 16 extensions have been identified, but the broader lesson holds: fake extensions are increasingly sophisticated and hard to spot by name alone.
The FakeGit campaign has roared back to life, flooding GitHub with more than 17,000 fake code repositories. Anyone who downloads and runs code from these repos gets infected with SmartLoader, which then drops a password-stealing program called StealC onto their machine. Developers who pull in outside code as part of their work are especially at risk.
This is the vulnerability that the ShinyHunters hacking group used to break into dozens of organizations — including the FBI's own recruitment website. Oracle PeopleSoft had a flaw that let attackers walk in through the front door without valid credentials. ShinyHunters first found it in June and later discovered a trick to bypass the temporary fix security firm Mandiant had suggested, using a URL-encoding technique to sneak past web filters.
Status: Oracle has issued a patch. Apply it immediately if you run PeopleSoft. The workaround rules alone are not enough — attackers have already bypassed them.
Cisco just patched five critical flaws in NX-OS, the operating system powering its Nexus data center switches. An attacker who exploits these flaws can run any code they want on the switch with full administrator privileges — essentially owning the device and anything that flows through it. These switches sit at the heart of enterprise networks, so a compromise here is serious.
Status: Patches released by Cisco. IT teams running Nexus switches should prioritize applying these updates today.
Microsoft's latest Windows update, KB5124010, is crashing some games and applications after installation. This isn't a security vulnerability in the traditional sense, but a bad update that breaks things — which can push people to uninstall it, leaving them exposed to the security fixes it also contains. Microsoft has acknowledged the issue.
Status: Microsoft is investigating. Hold off on uninstalling the update — wait for Microsoft's guidance rather than rolling it back and losing the security protections it includes.
Microsoft announced that Teams will soon support third-party tools that can detect deepfakes and flag impersonation attempts during video meetings. This is a direct response to a real and growing threat: criminals are already using AI-generated video to impersonate executives on calls and trick employees into transferring money or handing over credentials. The feature won't be built-in Microsoft technology — instead, Teams will open the door for specialist security vendors to plug their detection tools into the platform. No launch date has been confirmed yet, but the announcement signals that even Microsoft sees this as urgent enough to prioritize.
OpenAI is now embedding hidden watermarks into text produced by ChatGPT and Codex for users in the European Union. The goal is to make AI-generated content traceable — so that if someone uses AI to write fake news or disinformation, investigators have a way to identify its origin. The watermarks are invisible to the naked eye and survive basic editing. This is partly a response to pressure from EU regulators, but it's also a preview of where the industry is heading globally.
A teenager in Amman, Jordan, who goes by the hacker handle "Rey" — Spanish for "king" — has been detained by Jordanian authorities and is reportedly cooperating with the FBI. His alleged group, ShinyHunters, was in the middle of extorting a former Boeing subsidiary when he was arrested. It's the kind of story that reads like fiction, but the details make it even stranger.
Rey's alleged operation ran at a remarkable scale. ShinyHunters exploited a critical flaw in Oracle PeopleSoft — the HR software used by huge organizations — to break into dozens of companies across healthcare, education, transportation, and government. That list included the FBI's own recruitment website, which exposed sensitive personal data on more than 5,000 FBI staff, including their medical and psychiatric records. When a temporary workaround was published by security firm Mandiant, ShinyHunters found a way around it using a simple URL-encoding trick. Rey then taunted the FBI publicly on Twitter while simultaneously trying to frame a recently arrested Dutch co-conspirator by plastering his avatar across the posts.
The arrest was reportedly triggered — or at least accelerated — by ShinyHunters' attempted extortion of Jeppesen ForeFlight, a navigation and aviation data company that Boeing sold last year for over $10 billion. Sources told KrebsOnSecurity the stolen data "could pose operational safety and security risks." Rey's father is believed to work for Royal Jordanian Airlines, which flies Boeing planes. Extorting a Boeing unit while your dad works for a Boeing customer airline is either bold or reckless — probably both. Jeppesen ForeFlight says it has seen no impact on its operations.
The deeper lesson here isn't about one teenager's hubris. It's about how much damage a single unpatched software flaw in a widely used HR platform caused across dozens of major organizations. The PeopleSoft vulnerability was a zero-day for months before Oracle patched it — and even after the patch, the workaround rules weren't enough. Watch this case closely: Rey is now reportedly helping the FBI identify other ShinyHunters members, which means more arrests could follow.