CERT-In said on October 15 that AI agents under test read business records on live Indian systems. No victim detected the access, and CERT-In calls the weaknesses behind it ordinary: exposed credentials and loose cloud roles.
Perspective Coverage
10 publishers
- Builder
- Builder 35%
- Operator
- Operator 48%
- Investor
- Investor 17%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence66
Hong Kong researchers recover decoded headphone audio from up to six meters with a radio beam
Researchers from two Hong Kong universities intercepted headphone audio from as far as six meters with a radio transmitter, Kaspersky reports. The signal is taken after decoding, so call encryption does not apply, but the attacker has to be close and tune to each device.
Publishers:kaspersky.com
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence55
SkyNet users in St. Petersburg still report outages days into an attack BO Team claimed
SkyNet, a St. Petersburg internet provider, has been under a DDoS attack since October 6, the company said. Ukrainian group BO Team claims it also disabled more than 15,000 devices. SkyNet has not confirmed that.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence50
Belarusian Cyber Partisans spent nearly two years inside a Russian healthcare network, Solar says
Security firm Solar says Belarusian Cyber Partisans were inside an unnamed Russian healthcare network from early 2024 until its discovery in December 2025. That network connects to numerous other providers, and Solar says the foothold gave the intruders a possible route into them.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence40
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 67%
- Investor
- Investor 11%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+18
- Incentives40
- Confidence60
Microsoft links post-compromise NeedyMantis malware to the DAEMON Tools supply-chain actor
Microsoft says China-aligned NeedyMantis malware, active since at least October 2025, is installed after attackers already have access, to keep it long term. Because entry routes vary, organisations in the five sectors it targets need to look for copies already installed.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap0
- Incentives40
- Confidence60
Securelist says the newest CoolClient deploys a signed kernel-mode driver as a Windows service to hide its process, files and registry keys. It was seen in Pakistan, Mongolia and Myanmar.
Reality
- Evidence62
- Adoption30
- Hype gap+10
- Incentives35
- Confidence60
Bitdefender says a China-nexus cluster hit Central Asian governments with seven RAT families, five undocumented. The AI fingerprint is in the workflow, not the code.
Reality
- Evidence60
- Adoption20
- Hype gap+10
- Incentives
- Not scored
- Confidence58
CISA says CVE-2026-72529 and CVE-2026-72530 are under active exploitation. For federal civilian agencies, patching an exposed instance is only half of the obligation.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 68%
- Investor
- Investor 7%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence70
Kaspersky says malware reached Android car head units through the vendor's own update mechanism, using a flag that installs apps the device never had. The payload has no interface at all.
Perspective Coverage
8 publishers
- Builder
- Builder 36%
- Operator
- Operator 50%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence68
Arctic Wolf links a June 2026 intrusion in Venezuela to a new Go framework whose extended build reads replacement C2 addresses from a smart contract, and says the feature has been used.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 57%
- Investor
- Investor 9%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence58
Kaspersky traced one submitted installer to a modified Chinese wallpaper tool whose signed executable sideloads a malicious libcef.dll, and the same installer switches Windows Defender off before it ever runs.
Perspective Coverage
4 publishers
- Builder
- Builder 24%
- Operator
- Operator 67%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence66
Kaspersky found two cross-platform JavaScript RATs, NodeRabbit and PollCat, reaching engineers in aviation and fintech through fake recruiters, from a group that until now shipped native C, C++ and Go.
Perspective Coverage
4 publishers
- Builder
- Builder 45%
- Operator
- Operator 49%
- Investor
- Investor 6%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives35
- Confidence65
A Northern California freelance marketplace's own messaging system carried Excel macro lures to 80,000 of its users across 18 months. Microsoft closed that delivery step in 2022. The same platform lure now shows up in North Korean operations.
Perspective Coverage
6 publishers
- Builder
- Builder 17%
- Operator
- Operator 78%
- Investor
- Investor 5%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence68
Microsoft Defender Experts says fake Kaspersky, Razer and Calibre download sites all funnel to one delivery host that rebuilds the installer per request, which leaves hash blocking almost nothing durable to match.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives40
- Confidence70
Chaotic Eclipse published working code that abuses Falcon's Office macro removal on fully patched Windows 11 25H2 and Server 2025. It is the fourth endpoint product the researcher has dropped exploit code for, and no CrowdStrike response is on record.
Perspective Coverage
5 publishers
- Builder
- Builder 36%
- Operator
- Operator 51%
- Investor
- Investor 13%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence68
CVE-2026-91843 lets an attacker with no credentials run code as root through the login process, and Check Point has published indicators of compromise while saying it has seen no exploitation in the wild.
Perspective Coverage
4 publishers
- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence78
Kaspersky's incident response team says the group, previously seen working against targets in Asia, logged into VPNs from Cloudflare WARP and European hosting addresses, then ran the GhostContainer backdoor in memory on Exchange.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 70%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence58
Kaspersky says a new MacSync variant hides its payload commands in public iCloud calendar events and downloads the next stage from iCloud. Both the instructions and the download ride trusted Apple domains, past defenses that block known-bad hosts.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence68
MacSync now pipes a public iCloud calendar into zsh to stage its Mac payload
Kaspersky says the macOS stealer it first tracked as Mac.c has swapped script droppers for FAT Mach-O binaries in a chain found in September 2026, and its loader now reads shell commands out of a public iCloud calendar file.
Reality
- Evidence68
- Adoption32
- Hype gap0
- Incentives58
- Confidence58