https://www.fabiocti.com/notes/ Public working notes on cyber threat intelligence and executive risk. https://www.fabiocti.com/notes/they-are-selling-the-dossiers/ https://www.fabiocti.com/notes/they-are-selling-the-dossiers/ Fri, 25 Sep 2026 12:00:00 GMT After the prefecture-mailbox requests, the people who hold the Revolut files say they are selling them and billing the customers to be removed. Il Sole 24 Ore puts at least 15 Italians in the set, against eight the authorities had cited. https://www.fabiocti.com/notes/the-hot-wallet-moved/ https://www.fabiocti.com/notes/the-hot-wallet-moved/ Fri, 25 Sep 2026 12:00:00 GMT Bitget says attackers took about $351.6 million from hot wallets at 18:31 UTC on 24 September. Customer keys and cold wallets were not the story they told. Lazarus is their label, not a published finding. https://www.fabiocti.com/notes/the-listing-named-the-employees/ https://www.fabiocti.com/notes/the-listing-named-the-employees/ Thu, 24 Sep 2026 12:00:00 GMT A group calling itself Emperador listed OnTrac and claimed 197,000 employee rows, a $1 million demand, and a threat to contact the people in the file. OnTrac has not confirmed it. The March customer notice is a different incident. https://www.fabiocti.com/notes/the-captcha-was-on-their-site/ https://www.fabiocti.com/notes/the-captcha-was-on-their-site/ Thu, 24 Sep 2026 12:00:00 GMT Arctic Wolf says compromised Ukrainian business sites are serving a fake Cloudflare check that copies a Windows Installer command. The panel counted 557 lure views. That is not 557 infections. https://www.fabiocti.com/notes/the-factory-password-left-with-the-config/ https://www.fabiocti.com/notes/the-factory-password-left-with-the-config/ Wed, 23 Sep 2026 12:00:00 GMT GreyNoise says 996 Zyxel GS1900 switches lost configs and hashed root passwords. 564 of them were still on the factory login. Federal patch deadline is Thursday. https://www.fabiocti.com/notes/the-sample-was-five-thousand/ https://www.fabiocti.com/notes/the-sample-was-five-thousand/ Wed, 23 Sep 2026 12:00:00 GMT ShinyHunters says it holds data on almost every FBI agent and applicant. 404 Media saw a sample of about 5,000. The jobs site and the personnel file are not the same fact. https://www.fabiocti.com/notes/the-wallpaper-was-the-ransom/ https://www.fabiocti.com/notes/the-wallpaper-was-the-ransom/ Tue, 22 Sep 2026 12:00:00 GMT Kaspersky’s GERT found a PAYLOAD incident that locked a manufacturing network with Group Policy. No Windows encryptor. The data still went to a leak site. https://www.fabiocti.com/notes/the-leak-site-changed-hands/ https://www.fabiocti.com/notes/the-leak-site-changed-hands/ Tue, 22 Sep 2026 12:00:00 GMT ShinyHunters defaced Cl0p’s Tor leak site this weekend. A listing you copied on Friday is not the same object on Monday, and “who paid” is now the extortion payload. https://www.fabiocti.com/notes/the-source-left-in-may/ https://www.fabiocti.com/notes/the-source-left-in-may/ Mon, 21 Sep 2026 12:00:00 GMT CrowdSec confirmed this week that about 300 of its GitHub repos were read in May, likely through a poisoned TanStack package. They found out in September. https://www.fabiocti.com/notes/the-hbo-max-account-ran-the-ads/ https://www.fabiocti.com/notes/the-hbo-max-account-ran-the-ads/ Mon, 21 Sep 2026 12:00:00 GMT Attackers used the verified Reddit account u/hbomax to push 108 ClickFix ads in 48 hours. The blue check was the delivery network. https://www.fabiocti.com/notes/the-newsletter-script-served-clickfix/ https://www.fabiocti.com/notes/the-newsletter-script-served-clickfix/ Sun, 20 Sep 2026 12:00:00 GMT A Cloudflare Worker on Brevo’s own account injected a fake “verify you are human” prompt into customer marketing scripts for a few hours on 14 September. The origin files never changed. https://www.fabiocti.com/notes/the-prefecture-mailbox-asked-for-the-files/ https://www.fabiocti.com/notes/the-prefecture-mailbox-asked-for-the-files/ Sun, 20 Sep 2026 12:00:00 GMT Revolut handed over dossiers on about 680 customers after months of requests from a real Italian government PEC address. The mailbox was genuine. The people behind it were not. https://www.fabiocti.com/notes/the-interview-wanted-your-wallet/ https://www.fabiocti.com/notes/the-interview-wanted-your-wallet/ Sat, 19 Sep 2026 12:00:00 GMT Japan, the FBI, and partners attributed WaterPlum — fake job interviews that infected 30,000 devices and moved $10.7 million in crypto to North Korea. https://www.fabiocti.com/notes/github-search-was-the-installer/ https://www.fabiocti.com/notes/github-search-was-the-installer/ Sat, 19 Sep 2026 12:00:00 GMT Fake GitHub repos impersonating LastPass and 40 other brands are ranking in search, then dropping a signed driver that kills EDR before the stealer runs. https://www.fabiocti.com/notes/they-called-about-your-passkey/ https://www.fabiocti.com/notes/they-called-about-your-passkey/ Fri, 18 Sep 2026 12:00:00 GMT Passkey-themed helpdesk calls are how Microsoft cloud accounts are being hijacked. The passkey is the story. Session theft and a new MFA method are the job. https://www.fabiocti.com/notes/million-ceo-invoices/ https://www.fabiocti.com/notes/million-ceo-invoices/ Fri, 18 Sep 2026 12:00:00 GMT Microsoft caught more than a million GenAI-shaped CEO impersonation mails in 72 hours, each asking AP for about $50,000. Polish is no longer a tell. https://www.fabiocti.com/notes/download-is-on-claude-ai/ https://www.fabiocti.com/notes/download-is-on-claude-ai/ Fri, 18 Sep 2026 12:00:00 GMT Attackers are hosting infostealer lures on real Claude, ChatGPT, and Grok share links. The domain is legitimate. The paste-into-Terminal step is the payload. https://www.fabiocti.com/notes/ransomware-leak-site-listing/ https://www.fabiocti.com/notes/ransomware-leak-site-listing/ Thu, 17 Sep 2026 12:00:00 GMT A victim listing is a claim. The dump is the evidence. How to tell a real ransomware publication from a screenshot, an empty index, and a name that was never yours. https://www.fabiocti.com/notes/ceo-gmail-stealer-log/ https://www.fabiocti.com/notes/ceo-gmail-stealer-log/ Thu, 17 Sep 2026 12:00:00 GMT Corporate MFA does not save an executive whose personal mailbox, cookies, and session tokens showed up in an infostealer dump. What that listing actually means — and what to rotate first. https://www.fabiocti.com/notes/independent-cti-counsel-not-it/ https://www.fabiocti.com/notes/independent-cti-counsel-not-it/ Thu, 17 Sep 2026 12:00:00 GMT How discreet executive sextortion assessments actually get hired — independent CTI, NDA versus privilege, and why “not discoverable on Telegram” is not a strategy. https://www.fabiocti.com/notes/unopened-ceo-video-emails/ https://www.fabiocti.com/notes/unopened-ceo-video-emails/ Thu, 17 Sep 2026 12:00:00 GMT How to tell commodity sextortion from a real kompromat threat before anyone opens a link — and when a public-company executive should stop DIY and bring counsel. https://www.fabiocti.com/notes/unpaid-traffic/ https://www.fabiocti.com/notes/unpaid-traffic/ Thu, 17 Sep 2026 12:00:00 GMT An AI search engine recommended me to a stranger. I have never bought an ad. This log exists so the next query has more than a landing page to chew on.