Daily Cybersecurity News – October 12, 2026

What happened

Ledger confirmed that hardware wallets sold through Southeast Asia reseller CryptoBilis contained unauthorized implants linked to a wave of wallet drains that began around October 9, 2026. On-chain researchers estimate suspected losses above $93 million. Ledger stated its own systems and direct sales channels were not compromised.

Former Mt. Gox CEO Mark Karpelès analyzed a device bought in Malaysia and described a small circuit board hidden under the screen padding. It included a microcontroller, antenna, LTE chip, and e-SIM. The implant allegedly monitors the display, captures the recovery seed phrase when shown, and transmits it so attackers can rebuild and empty the wallet remotely without further contact with the original device. The implant passed Ledger's Genuine Check because the real security chip remained intact and arrived in intact packaging.

Who is affected

Customers who purchased Ledger hardware wallets from the CryptoBilis reseller in Southeast Asia, particularly devices obtained in recent months (Ledger advice covers the last 90 days, while on-chain data suggests many drained wallets received funds from June onward). Ledger has not confirmed similar issues with other channels such as European reseller Mediamarkt.

Impact is limited to the supply-chain path through that reseller. Direct Ledger sales and the company's own infrastructure were not breached.

Why it matters

Hardware wallets are trusted precisely because private keys never leave the device. A physical implant that silently captures the seed phrase defeats that model and enables delayed, coordinated draining of many wallets at once. The incident shows that even authorized resellers and intact packaging offer no absolute guarantee against supply-chain tampering.

Operators and high-value holders must treat the entire distribution chain as part of the threat model and verify devices beyond manufacturer checks.

How it could have been prevented

Do not initialize any Ledger device purchased from CryptoBilis. If already set up, immediately move all assets to a newly purchased device obtained directly from Ledger, using a fresh seed phrase, and contact Ledger Support via official channels. File reports with local law enforcement.

Buy only from Ledger's official store or verified direct channels. Never restock returned devices. Physically open and inspect new devices for foreign boards under the screen if high-value funds are at stake. Monitor for phishing that exploits the incident.

What happened

A pre-authentication remote code execution vulnerability in AnyDesk for Linux has a fully working public exploit that grants root access without any user approval of the connection. Researchers released the exploit (dubbed AnyPwn) targeting a heap buffer overflow in the session protocol on direct TCP connections to port 7070.

AnyDesk patched the issue in version 8.0.3 in June 2026. The changelog only mentioned a crash fix and no CVE was assigned at the time. The exploit is probabilistic and needs specific heap layouts, yet researchers showed it can also be reached via AnyDesk relay servers. Windows and macOS versions are not affected.

Who is affected

AnyDesk Linux installations prior to version 8.0.3 that accept direct TCP connections on port 7070. Organizations and individuals running unpatched Linux remote-desktop endpoints, especially those exposed or reachable through relays.

Scale is significant wherever Linux AnyDesk is used for remote support or administration without network restrictions.

Why it matters

Pre-auth RCE to root means an attacker can fully compromise the host before any human interaction. Remote access tools sit at the heart of IT operations; a root shell here enables lateral movement, data theft, and ransomware deployment with minimal friction.

The quiet patch and delayed public disclosure left a window in which many systems remained vulnerable after the fix existed.

How it could have been prevented

Update AnyDesk for Linux to version 8.0.3 or later immediately. Restrict inbound access to TCP port 7070 with firewalls so only trusted sources can reach it. Prefer relay-only configurations where possible and monitor for unexpected connection attempts.

Verify the running version across the estate and treat any pre-8.0.3 Linux instance as high priority for isolation until patched.

What happened

A maximum-severity unauthenticated remote code execution flaw in the Bricksforge WordPress plugin is under active exploitation. The vulnerability tracked as CVE-2026-85097 (CVSS 9.8) affects versions up to and including 3.1.8.9 and was patched in 3.1.8.10.

It stems from insufficient validation of the attacker-controlled URL field inside the temporaryFileUploads parameter during form submission. Attackers obtain a nonce from an unauthenticated AJAX endpoint, upload a GIF/PHP polyglot that passes MIME checks, then submit crafted metadata that causes the server to place PHP code at a .php path and execute it. Patchstack observed exploitation starting October 7, 2026 against the form_submit REST and admin-ajax endpoints.

Who is affected

WordPress sites running the Bricksforge plugin (a companion to the Bricks visual builder) at version 3.1.8.9 or earlier. Any site that has not applied the 3.1.8.10 patch remains fully exposed to unauthenticated takeover.

Bricksforge is used for animations, advanced forms and related features; exposure depends on how widely the plugin is installed and left unpatched.

Why it matters

Unauthenticated RCE on a WordPress site typically yields full site control, web shells, data theft, malware distribution, and pivoting into the hosting environment. Active exploitation means scanners and attackers are already weaponizing the bug.

Site owners and hosts must treat this as an emergency patch because the attack chain requires no credentials and leads directly to code execution.

How it could have been prevented

Update the Bricksforge plugin to version 3.1.8.10 or later at once. If immediate update is impossible, disable the plugin or block the bricksforge form_submit and related AJAX/REST endpoints at the web application firewall.

Scan for unexpected PHP files in uploads and temporary directories, review access logs for suspicious temporaryFileUploads traffic, and rotate any credentials that may have been exposed after compromise.

What happened

Researchers detailed an ongoing AI-augmented initial-access campaign by a Russian-speaking financially motivated broker tracked as CyberXero. The actor combines commodity tools such as Cobalt Strike with an orchestration layer powered by Anthropic's Claude Code and has been active since at least July 2026.

It runs two parallel pipelines: a global automated campaign against WordPress and e-commerce sites that exploits known flaws including wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815 in the Support Board plugin, plus a more targeted manual campaign against Ukrainian energy and critical infrastructure. Confirmed exfiltration from four Ukrainian organizations yielded more than 628,000 records of Ukrainian individuals; additional compromises occurred in Poland, China and the Netherlands. An exposed open directory leaked the actor's working files, AI session logs, toolkits and victim data.

Who is affected

WordPress and e-commerce sites vulnerable to the listed CVEs worldwide, plus specifically targeted Ukrainian energy, heating and critical-infrastructure entities. Confirmed victim organizations in Ukraine, with spillover victims in other countries.

Roughly 628,000 personal records from Ukrainian individuals have already been harvested in the confirmed cases.

Why it matters

AI agents are being used at scale for scanning, exploit chaining, reconnaissance and post-exploitation, lowering the skill and time required for broad opportunistic campaigns while still supporting high-value targeted work. Ukrainian critical infrastructure remains a focus amid broader geopolitical tension.

Initial-access brokers sell or leverage footholds for further crime; the volume of records and continued activity make this a live threat to both commercial and national-security targets.

How it could have been prevented

Patch WordPress core and plugins immediately, especially anything related to CVE-2026-63030, CVE-2026-60137 and Support Board (CVE-2026-4815). Remove or harden unnecessary plugins, enforce least privilege, and monitor for web shells and unusual admin-panel access.

Segment critical infrastructure networks, require multi-factor authentication everywhere, and hunt for Cobalt Strike beacons and anomalous outbound connections. Treat any exposed directory or leaked tooling as a signal to rotate credentials and review logs.

What happened

Bitdefender uncovered a preinstalled malware campaign called Midnight Mimosa on low-cost Android phones built on MediaTek platforms and sold through online marketplaces. The malware is embedded in device firmware before first boot, runs with system privileges, and cannot be uninstalled by the user.

It silently installs and removes apps, grants itself Accessibility, Notification Access and other permissions, and loads remote code. Operators use it for ad and click fraud, device fingerprinting, and turning phones into residential-proxy botnet nodes. The primary system component (labeled "System" or variants such as com.android.system.lite) is platform-signed; malicious logic hides in a native library activated at runtime. Thousands of unique devices across more than 150 countries have been observed, with Mexico, France and Italy most affected. Many devices are counterfeits using flagship names such as i17 Pro Max or S25 Ultra.

Who is affected

Buyers of inexpensive Android handsets from online marketplaces, especially MediaTek-based models and counterfeits. Common infected models include Doogee S200 X and Cubot KINGKONG X. Users in 150-plus countries; highest volumes reported in Mexico, France, Italy, the United States, Germany, Brazil and Spain.

Anyone who purchased a budget or suspiciously branded device that arrived with unknown system apps is potentially affected.

Why it matters

Firmware-level preinstallation means the device is owned before the user ever powers it on. System privileges let operators maintain persistence, harvest data, commit fraud and rent the device into botnets, creating both privacy and availability risks for the owner and a ready pool of attack infrastructure for others.

Supply-chain compromise of consumer hardware at this scale erodes trust in low-cost devices and can fuel larger DDoS or proxy-based campaigns.

How it could have been prevented

Prefer devices from reputable manufacturers purchased through official channels. Upon unboxing, check for unexpected system apps that lack icons or reinstall themselves. Use mobile-security tools that detect anomalous system behavior.

If infection is suspected, stop using the device for sensitive accounts, perform a full factory reset only if the malware is not deeply firmware-resident (many cases require returning or discarding the hardware), and avoid sideloading. Enterprises should ban unapproved budget Android devices from corporate networks.

What happened

Japanese karaoke operator Daiichi Kosho disclosed that a malware infection at supplier Nippon Columbia Group (NCG) may have exposed personal data of roughly 8.724 million customers. Between October 1 and 2, 2026, malware was found on an NCG employee PC that temporarily held outsourced customer data; the device was isolated on October 2 and Daiichi Kosho was notified on October 5.

Exposed fields potentially include names, genders, dates of birth, email addresses and telephone numbers. NCG has reset affected passwords and continues investigating whether data actually left the environment. No evidence of further misuse has been confirmed in the public notice.

Who is affected

Approximately 8.7 million customers of Daiichi Kosho brands, chiefly Big Echo (about 5.6 million) and DK Dining (about 3.5 million), plus users of Mega Big, Banana Club, Karaoke Club Dam and B-Garage. The data belonged to people who registered or made reservations at the company's stores.

Impact is limited to contact and demographic information handled by the supplier; payment-card data was not mentioned.

Why it matters

Supply-chain breaches remain a high-leverage path into large customer databases even when the primary brand's own systems stay intact. Eight million records of names, birth dates, emails and phones create fertile material for targeted phishing, smishing and social-engineering attacks against Japanese consumers.

The incident adds to a recent string of Japanese corporate breaches and underscores persistent third-party risk management gaps.

How it could have been prevented

Customers should watch for phishing emails, SMS or calls that reference karaoke accounts and never supply passwords or payment details in response. Daiichi Kosho states it will never ask for that information.

Organizations must enforce strict controls on how suppliers store and process customer data, require rapid notification clauses, minimize data retained on employee endpoints, and monitor third-party access. Reset credentials and increase monitoring after any supplier incident.

What happened

AWS released Strands Box, an open-source sandbox for AI agents now in developer preview. It combines kernel-enforced isolation (macOS Seatbelt on Apple silicon Macs, Linux support planned) with a policy layer that evaluates an agent's prior actions before allowing new ones.

Agent shell commands, Python execution, MCP tool calls and network traffic pass through four checkpoints that consult the Dogwood Local Engine. Actions are denied by default unless a rule permits them. Shared event history lets rules correlate behavior across tools (for example, blocking outbound HTTP after a read from a sensitive directory). The network gateway can inject secrets so the agent never sees real API keys.

Who is affected

Developers and organizations building or running autonomous coding agents, incident-response agents, or other LLM-powered tools that execute code, call APIs or touch files. Currently limited to Apple-silicon Macs in preview; Linux is forthcoming.

Anyone adopting agentic workflows who needs stronger containment than simple containers or microVMs.

Why it matters

AI agents frequently run with broad permissions ("YOLO mode") and can escape working directories, destroy data or exfiltrate credentials. Pure isolation walls off the environment but does not constrain how tools inside the wall are used. Strands Box adds a policy engine that reasons over history, giving operators finer control and reducing blast radius of agent mistakes or prompt-injection attacks.

Open-sourcing both the sandbox and the Dogwood policy language lets the community inspect, extend and harden the approach.