Hackers altered refrigeration controls at three French blood service sites, but staff protected plasma supplies and prevented damage to blood products.

Behind many online trading scams sits a question most victims never think to ask: who built the website they trusted? On 3 November, authorities in seven countries moved against a company suspected of supplying exactly that. The action against an investment fraud scheme with potential victims in more than 50 countries led to the seizure of over 100 servers and the arrest of seven suspects. The operation was led by Germany's Itzehoe Public Prosecutor's Office, with support from Europol and Eurojust. Authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia took part. They searched 17 locations and seized servers, evidence and assets. The seven suspects were arrested with a view to extradition to Germany. Investigators estimate losses of more than EUR 4 million.

The Investment Fraud Supply Chain

The target was not a single scam group. Investigators say the company supplied fake trading platforms to criminal groups, operating what they describe as a crime-as-a-service model from Cyprus and Israel. Its suspected clients ran fraudulent call centres in Albania, Kosovo and North Macedonia. Those call centre operators allegedly persuaded victims to hand over their savings. In other words, one business built the storefront, and others did the selling.

How Victims Were Drawn In

The scheme promised large, quick returns from trading in cryptocurrencies, foreign currencies or stocks. It started with an advert. The investigation found that affiliate marketing was abused to attract potential victims, with deceptive ads steering people towards fraudulent investment platforms and exploiting their trust in online promotions. The personal data collected this way was then sold to the criminal groups running the call centres. Operators contacted potential victims with supposed investment opportunities and turned that first flicker of interest into repeated demands for money.

Why Victims Kept Paying in This Investment Fraud

The method relied on making the scam look like it was working. Victims were first encouraged to transfer a small amount. Their online accounts then showed fictitious profits, which made the platform seem credible and the investment successful. Supposed brokers used those fake gains, along with constant psychological pressure, to push victims into sending larger and larger sums. The problem surfaced when victims tried to withdraw. Operators used delaying tactics to block payments. Eventually, contact stopped altogether, and victims were left unable to recover their money.

How a Couple's Complaint Exposed the Network

The case began in 2022, when a German couple reported that they could not withdraw money they had invested through an online trading platform. A first international action day that year led to two arrests and seized evidence. With Europol-supported analysis, investigators identified seven more suspects, including suspected call centre managers. A second action day in 2025 brought further arrests and seizures of money and evidence. Analysis of that material exposed the suspected infrastructure provider and its links to call centre operators, setting up this month's operation. In total, the case took four years to reach the company allegedly behind the platforms.

The Role of Europol and Eurojust

Europol's European Financial and Economic Crime Centre analysed the data, cross-checked it against Europol's databases and brought national investigators together to plan joint action. On the action day, Europol sent experts to Albania and Kosovo to support digital forensic work, and its Virtual Command Post supported the coordinated intervention. Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were set up at the agency: one involving Albania, Germany and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust's headquarters in The Hague.

Apache Wicket vulnerabilities: a security update fixes 19 flaws, including CVE-2026-84170 upload DoS and XSS bugs. Upgrade to 8.20.0, 9.25.0 or 10.12.0.

Related Posts:

• Critical MediaTek Vulnerabilities Patched in Chipsets
• Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
• Critical FreePBX Vulnerabilities Patched in User Manager

The post Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0 appeared first on Daily CyberSecurity.

A Bitcoin Core DoS vulnerability allows remote peers to trigger out-of-memory crashes on Windows, macOS, and BSD nodes via TCP socket handling errors.

Related Posts:

• Android SMS of Death Bug Triggers Remote Reboots
• JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach
• CERT/CC Warns of Xerj Authentication Bypass Flaw CVE-2026-97406

The post Bitcoin Core DoS Vulnerability Crashes Remote Nodes appeared first on Daily CyberSecurity.

The FBI seizes Virtualine domain in a court-authorized operation alongside the U.S. Department of Justice , disrupting a so-called bulletproof hosting service accused of facilitating cybercrime, the distribution of child sexual abuse material (CSAM), and international money laundering. Before the seizure, Virtualine.net allegedly provided hosting infrastructure to criminal operations and continued supporting certain services despite repeated abuse notifications from law enforcement agencies and other organizations. The seizure followed a court-authorized operation against Virtualine, which also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. According to court records, the service offered hosting, server solutions and domain purchasing options while advertising its ability to protect customers from law enforcement intervention.

FBI Seizes Virtualine Over Alleged Cybercrime Activity

Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced the seizure of Virtualine.net. Authorities said the domain had been used to facilitate multiple forms of criminal activity, including advertising sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images involving adults and minors, and international money laundering.

Virtualine marketed its services on cybercrime forums, where it openly promoted hosting options for users engaged in illegal activities. In September 2024, the service told a user on Exploit.in that its infrastructure could be used for activities including phishing, carding, email spam and port scanning, while claiming to prohibit child sexual abuse material and terrorism-related content. However, court records allege that Virtualine knowingly hosted a criminal online forum, identified as Vendor 1, that allowed users to post and sell access to nude, sexually suggestive and sexually explicit images and videos involving minors and adults.

Hosting Provider Allegedly Ignored Repeated Abuse Reports

The investigation found that Virtualine continued hosting Vendor 1 despite receiving multiple notifications about sexually explicit images and videos of minors. According to court records, Virtualine assigned an IP address to Vendor 1 around December 2025, with notifications about the material beginning in January 2026. Reports came from law enforcement agencies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children (NCMEC), and an attorney representing a victim. Despite these notifications, Virtualine allegedly continued providing hosting services to the forum. The records also state that Virtualine worked directly with Vendor 1 to develop another website that allowed customers to upload illicit content and download it after making a purchase. Authorities said Virtualine continued hosting this website and had received at least one abuse complaint concerning sexually explicit images of children found on the platform. Vendor 1 also promoted a hack-for-hire service, through which customers could pay hackers to gain unauthorized access to victims’ online accounts and obtain explicit images and videos.

Virtualine Advertised Measures to Evade Law Enforcement

Beyond its hosting services, Virtualine allegedly offered customers additional protection designed to keep criminal infrastructure operational when authorities intervened. In March 2026, the provider advertised an “additional protection plan” that it said could be activated after receiving an official request from law enforcement agencies. Under the arrangement, Virtualine would move a customer’s criminal infrastructure to another shell company not affiliated with the provider, after which the server would be reactivated. The alleged practice illustrates how bulletproof hosting services can be used to maintain online criminal operations by moving infrastructure when enforcement or abuse complaints threaten existing arrangements. Virtualine also promoted its tolerance of abuse on underground forums. In a June 2025 post on HackForums, it claimed to have ignored more abuse reports than other providers.

Cryptocurrency Payments Linked to Money Laundering

Investigators also examined Virtualine’s payment arrangements and their alleged role in concealing criminal proceeds. According to court records, Virtualine accepted payments through Bitcoin, including specific unhosted Bitcoin addresses that allowed customers to make direct payments without their funds being flagged as illicit. The service received payments from criminal customers, some of which investigators could trace directly to various criminal groups. Virtualine then allegedly laundered the funds further to conceal their origin. Authorities identified international money laundering as one of the criminal activities facilitated through the service.

International Cooperation Behind Virtualine Takedown

The FBI’s Washington Field Office led the investigation, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the United Kingdom’s National Crime Agency. Private-sector partners OverRIPE and Lumen also assisted, while the Justice Department’s Office of International Affairs provided additional support. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz are representing the government in the matter. The seizure of Virtualine.net disrupts a hosting service that authorities allege provided infrastructure and financial services to support criminal activity. The case also highlights the role of international law enforcement cooperation in targeting providers accused of enabling cybercrime across multiple jurisdictions.

Apache Kafka fixes 12 vulnerabilities, including CVE-2026-110985, which skips JWT signature verification and grants full cluster access. Patch now.

Related Posts:

• Kerio Connect Vulnerability CVE-2026-112353 Exploited in the Wild to Steal Mailboxes
• FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild to Run Commands
• Details and PoC Exploit Released for Jackson-Databind Flaw CVE-2026-110879 (CVSS 9.8)

The post Apache Kafka Fixes 12 Vulnerabilities, Including a JWT Bypass That Grants Full Cluster Access appeared first on Daily CyberSecurity.

An Intelbras camera vulnerability enables a denial-of-service attack that knocks Mibo cameras offline from the local network. Update to R.260804.

Related Posts:

• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
• Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect

The post Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline appeared first on Daily CyberSecurity.

Body-parser vulnerability CVE-2026-111181 (CVSS 7.5) enables Express denial of service with one request. Upgrade to body-parser 2.4.0 or 1.20.9.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
• Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect

The post Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public appeared first on Daily CyberSecurity.

DOJ officials announced a Cambodia crypto scam extradition after Zheng Zhao allegedly helped launder $36.9M stolen from 174 US victims via USDT.

Related Posts:

• Doppelganger Campaign Targets Israel Elections With Fake News and AI Poisoning
• Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials
• Storm-0940 Uses ARTEX AI Agent to Probe IT and Software Vendors for Supply Chain Access

The post DOJ Extradites Suspect in $36.9M Cambodia Crypto Scam Targeting Americans appeared first on Daily CyberSecurity.

Cisco fixes 13 Snort 3 vulnerabilities, including CVE-2026-20043 and denial of service flaws affecting FTD, Meraki MX and IOS XE.

Related Posts:

• cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts

The post Cisco Fixes 13 Snort 3 Vulnerabilities, Including CVSS 9.0 Out-of-Bounds Write appeared first on Daily CyberSecurity.

FoxIO released details and PoC code for a QPACK amplification attack that can crash HTTP/3 servers, including quic-go, quiche, lsquic and Bun.

Related Posts:

• cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts

The post PoC and Full Details Released for QPACK Amplification Attack That Crashes HTTP/3 Servers appeared first on Daily CyberSecurity.

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

Three IBM critical vulnerabilities, rated up to CVSS 9.9, hit IBM i, Db2 Mirror and Maximo AI Service, including remote code execution. Patch now.

Related Posts:

• SAP Security Patch Day October 2026 Fixes CVSS 10 Cloud SDK Flaw and Three More Critical Bugs
• Discourse Vulnerabilities Let Attackers Hijack Pages for Every Visitor and Read Server Files
• Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

The post IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo AI Service appeared first on Daily CyberSecurity.

Microsoft is testing Windows 11 Quick Settings controls for Android: toggle Do Not Disturb, set volume, and ring a lost phone without Phone Link.

Related Posts:

• Microsoft Patches Windows 11 Local Account Bypass Loophole
• Windows Update Certificate Rotation: Prevent 2027 Failures
• Windows Hybrid Intelligence and the New AI Search Menu

The post Windows 11 Quick Settings Can Now Ring Your Android Phone appeared first on Daily CyberSecurity.

Warden Stealer, a fast-growing Rust infostealer, steals AI agent tokens, browser data, and crypto while bundling its own loader and clipper.

Related Posts:

• 16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases
• The Silent Threat of Midnight Mimosa Malware
• Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients

The post Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data appeared first on Daily CyberSecurity.

CVE-2026-47483 in NVIDIA DCGM Exporter lets unauthenticated attackers crash GPU monitoring. Over 2,000 exposed servers found. Patch to 4.8.2.

Related Posts:

• MariaDB Patches Nine Vulnerabilities Enabling Privilege Escalation and Code Execution
• GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code
• AnyDesk RCE Vulnerability Details and PoC Exploit Code Publicly Disclosed

The post NVIDIA DCGM Exporter Flaw CVE-2026-47483 Lets Attackers Crash GPU Monitoring appeared first on Daily CyberSecurity.

The WordPress 7.1.3 security update is a WordPress security release that fixes stored XSS, SQL injection and more. Update your site now.

Related Posts:

• CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
• Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
• ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3

The post WordPress 7.1.3 Security Update Fixes Stored XSS, SQL Injection and Five More Flaws appeared first on Daily CyberSecurity.

Apache Thrift 0.25.0 fixes 61 Apache Thrift vulnerabilities, including critical heap overflow CVE-2026-91135. Upgrade every binding now.

Related Posts:

• Murrelektronik Will Not Fix Critical AAS Edge Client Flaw CVE-2026-94293, Urges Removal
• Researchers Publish Full Details and PoC Exploit for a WordPress libheif RCE Chain
• PoC Exploit and Technical Details Released for LibreOffice Calc Code Execution Flaw CVE-2026-63277

The post Apache Thrift 0.25.0 Fixes 61 Vulnerabilities, Including Two Critical Heap Overflows appeared first on Daily CyberSecurity.

Struts 7.4.0 fixes four Apache Struts vulnerabilities, including OGNL injection CVE-2026-104711 and a REST plugin DoS. Upgrade now.

Related Posts:

• Murrelektronik Will Not Fix Critical AAS Edge Client Flaw CVE-2026-94293, Urges Removal
• Researchers Publish Full Details and PoC Exploit for a WordPress libheif RCE Chain
• PoC Exploit and Technical Details Released for LibreOffice Calc Code Execution Flaw CVE-2026-63277

The post Apache Struts 7.4.0 Fixes Four Vulnerabilities, Including OGNL Injection and REST Plugin DoS appeared first on Daily CyberSecurity.

Citrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now.

Related Posts:

• Perforce Fixes Six P4 Search Vulnerabilities, Including a CVSS 10 Default Token Flaw
• MediaTek October 2026 Security Bulletin Fixes 31 Flaws, Including Two Critical Modem Bugs
• Researcher Publishes Technical Details and PoC Exploit for macOS HFS+ Kernel Flaw CVE-2026-43682

The post Citrix NetScaler CVE-2026-88779 Exploited in the Wild to Knock SAML Gateways Offline appeared first on Daily CyberSecurity.