🔍 Read the full analysis: What To Watch In AI Security After This Week’s Malware And Token News on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A roundup published October 29 highlights six security developments: an active campaign targeting Fortinet firewall credentials, an Android banking crime kit, a malicious PDF lure, an Android authenticator token issue, automated bot impersonation and uneven patch-list coverage. The reports point to practical priorities for organizations and users, but several figures come from security firms’ own analyses and do not establish how many victims remain exposed.
A security roundup published October 29 highlights six current risks for organizations and individual users, including an active campaign stealing access to Fortinet firewalls, Android malware marketed as a banking crime kit, and a fixed issue involving Microsoft Authenticator work-account tokens. The developments matter because attackers are targeting network access, mobile banking and workplace credentials, while security teams must decide which vulnerabilities to address first.
The FBI and U.S. Secret Service warned on October 6 that the FortiBleed campaign remains active. Their advisory cites security firm SOCRadar’s report of more than 86,644 compromised devices across 194 countries. According to the roundup, attackers reuse previously exposed passwords, guess weak credentials and exploit poorly protected firewall accounts to create administrator access. The agencies named ransomware groups INC/Lynx and Payload as buyers of access. These are findings and assessments cited by the agencies and researchers, not a count independently verified in the roundup.
On October 27, Hudson Rock reported analyzing configuration data from 1,703 reports covering 1,689 devices, and finding 40,573 records containing plaintext passwords. The company said the records included local accounts and Active Directory connection accounts, while stressing that a record does not necessarily represent an active user: 7,437 local accounts were marked disabled. Separately, Fortinet issued coordinated security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, including critical- and high-severity fixes. The public advisories are scheduled for November 10.
Other items in the roundup include MR ROBOT, an Android crime kit CloudSEK said criminals can rent to build fake banking apps; a Trellix report about a backdoor hidden in a blank PDF presented as a FedEx tax invoice; and research by Enclave into an Android issue that could expose Microsoft Authenticator work-account tokens to another app. Microsoft has fixed that issue, identified as CVE-2026-80097. Cequence also reported one scanner using about 32 false AI-bot identities while requesting password files and cloud keys from websites.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Protecting Firewalls, Phones and Accounts
The reports show how attackers can combine stolen or weak credentials with exposed network equipment and convincing prompts, rather than relying on a single new vulnerability. A compromised firewall can give an intruder a route into a company network; a stolen authenticator token can put a work account at risk; and a fake banking app can target a person’s login codes and calls.
For defenders, the Fortinet updates and the continuing credential campaign are separate issues that call for parallel responses: apply vendor fixes, and review firewall accounts and access controls. The roundup also cautions against treating one official vulnerability list as a complete measure of risk. CISA set a three-day remediation deadline for U.S. federal agencies for PHP2Shell, while a critical Gotenberg flaw was not listed in the cited catalog despite VulnCheck recording 1,358 attack attempts in 30 days. The attempt count is VulnCheck’s report; the roundup provides no independent verification or comparison baseline.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Connect
The source article selects six items from a 30-story weekly Hacker News security digest, then refers readers to the original advisories and research. Its author notes that many figures come from the security companies that discovered or analyzed the activity, some of which sell security products. That distinction matters: reported device totals, records and attack attempts describe different things and should not be treated as interchangeable victim counts.
The roundup says Fortinet attributes FortiBleed to reused credentials and password guessing, rather than a new Fortinet vulnerability. The company released the separate product security updates on October 22 and said public advisories would follow November 10. In its account of the patching risk, Fortinet warned that AI tools could help attackers reverse-engineer patches and build exploits faster; this is the company’s assessment, not a measured prediction for every flaw.
The other reports span different stages of response. Microsoft has already fixed the Authenticator issue, while the MR ROBOT and PDF-backdoor stories describe threats identified by security researchers. The CISA and Gotenberg examples concern prioritization: a federal patch deadline does not mean every high-risk flaw is on CISA’s Known Exploited Vulnerabilities catalog.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
Exposure Counts and Fix Status
The available reports do not establish how many Fortinet devices remain vulnerable or accessible today, how many exposed credentials are still usable, or how many victims have suffered confirmed follow-on breaches. SOCRadar’s device figure and Hudson Rock’s configuration-record count come from separate analyses and measure different things. The roundup also does not provide independent confirmation of the malware operators’ reach or the scanner activity Cequence observed.
Fortinet’s October 22 updates are confirmed, but the public advisories and detailed vulnerability information were not due until November 10. That leaves the specific flaws, affected product versions and remediation instructions unclear in the supplied material. For the Gotenberg issue, the cited attack-attempt count does not by itself establish successful exploitation or explain why the flaw was absent from CISA’s list.
Advisories and Remediation Deadlines
Fortinet’s public advisories are scheduled for November 10; administrators should check the vendor’s guidance and apply the relevant updates to FortiOS, FortiManager and FortiAnalyzer. Organizations should also review firewall accounts, remove unnecessary administrator access, replace reused passwords and use multifactor authentication, particularly for internet-facing systems. These steps address the credential campaign described by the agencies, not just the separate software fixes.
Users should install available updates for Microsoft Authenticator and Android, and seek banking apps through official channels rather than links in unsolicited messages. Security teams can compare their own assets against CISA’s KEV catalog while separately tracking high-risk flaws such as the Gotenberg issue cited in the roundup. The next developments to watch are the Fortinet advisories, further evidence about active exposure, and updated guidance from agencies and vendors.
Key Questions
What is the main security development in this roundup?
The leading concern is the ongoing FortiBleed campaign, which the FBI and U.S. Secret Service said targets Fortinet firewall access using compromised or weak credentials. Fortinet also issued separate security updates for three product lines.
Does the FortiBleed report describe a new Fortinet vulnerability?
No. Fortinet said FortiBleed is not a new Fortinet vulnerability and pointed to reused credentials and password guessing. The October 22 product updates address separate security issues.
Has the Microsoft Authenticator issue been fixed?
Yes. The roundup says Microsoft fixed the Android issue involving work-account login tokens and identifies it as CVE-2026-80097. Users should apply available app and device updates.
Should organizations rely only on CISA’s KEV list to prioritize patches?
No. The roundup notes that the cited critical Gotenberg flaw was absent from the list, despite VulnCheck reporting 1,358 attack attempts in 30 days. Teams should use the catalog as one input and also assess vendor advisories and their own exposure.
Source: ThorstenMeyerAI.com
