The Trust Observatory https://thetrustobservatory.com Machine intelligence. Human accountability. Domain threat bulletins from The Trust Observatory. en-us Fake Crypto App on Apple App Store Linked to $23,000 Wallet Drainhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-323.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-323.htmlThu, 29 Oct 2026 00:00:00 +0000A fraudulent cryptocurrency wallet app on the Apple App Store drained $23,000 by collecting seed phrases from users during setup.Tampered Ledger Hardware Wallets Cost Singapore Users $2.7 Millionhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-322.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-322.htmlThu, 29 Oct 2026 00:00:00 +0000Singapore police confirmed $2.7 million in losses from pre-compromised Ledger hardware wallets sold through unofficial channels. ledger.com: 61.56 / D.New Cisco Firewall Zero-Day Exploited to Crash SSL VPN Deviceshttps://thetrustobservatory.com/bulletins/TTO-2026-1029-321.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-321.htmlThu, 29 Oct 2026 00:00:00 +0000A Cisco firewall zero-day is being actively exploited to crash SSL VPN devices with no authentication required. cisco.com: 61.57 / D.CISA Warns Fragnesia Linux Flaw Being Chained in Active PHP2Shell Attackshttps://thetrustobservatory.com/bulletins/TTO-2026-1029-320.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-320.htmlThu, 29 Oct 2026 00:00:00 +0000CISA confirmed active exploitation chaining a Fragnesia Linux flaw with PHP2Shell techniques to achieve remote code execution on internet-facing PHP servers.Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mininghttps://thetrustobservatory.com/bulletins/TTO-2026-1029-319.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-319.htmlThu, 29 Oct 2026 00:00:00 +0000A returning malware campaign distributes malicious code through Hugging Face repositories to hijack GPU resources for crypto mining. huggingface.co: 51.62 / F.Polymarket Halts Trading After Crypto-Draining Script Discovered in Platform Breachhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-318.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-318.htmlThu, 29 Oct 2026 00:00:00 +0000Polymarket suspended trading after a draining script was injected via a platform breach. Connected wallets remain at risk until approvals are revoked. polymarket.com: 62.84 / D.Hackers Exploit Cisco SD-WAN Flaw to Deploy Custom KeyDrift Malwarehttps://thetrustobservatory.com/bulletins/TTO-2026-1029-317.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-317.htmlThu, 29 Oct 2026 00:00:00 +0000Threat actors are exploiting Cisco SD-WAN to deploy KeyDrift, a custom persistent-access and credential-harvesting malware implant. cisco.com: 61.57 / D.Binance Confirms $5.7 Billion Breach in Largest Crypto Exchange Hack on Recordhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-316.htmlhttps://thetrustobservatory.com/bulletins/TTO-2026-1029-316.htmlThu, 29 Oct 2026 00:00:00 +0000Binance confirmed a $5.7 billion breach affecting hot wallets and customer asset reserves, described as the largest crypto exchange hack on record. binance.com: 60.81 / D. UNM Health Ransomware Attack Forces Surgery Cancellations and Ambulance Diversions https://thetrustobservatory.com/bulletins/TTO-2026-1028-315.html https://thetrustobservatory.com/bulletins/TTO-2026-1028-315.html Wed, 28 Oct 2026 00:00:00 +0000 Ransomware attack on University of New Mexico Health Sciences Center forced surgery cancellations and ambulance diversions. A threat actor claimed 36,000 systems compromised; UNM Health has not confirmed the data exfiltration claim. Systems restored. unmhealth.org AEO Score 53.36 / F. Bithumb Confirms Hack of Internal Employee System as South Korean Financial Sector Faces Coordinated Wave of Intrusions https://thetrustobservatory.com/bulletins/TTO-2026-1028-314.html https://thetrustobservatory.com/bulletins/TTO-2026-1028-314.html Wed, 28 Oct 2026 00:00:00 +0000 Bithumb confirmed unauthorized access to its internal employee mobile groupware application. Employee contact data taken; customer data scope under investigation. Crypto assets and trading unaffected. Part of a coordinated wave hitting 16 South Korean financial firms this October. bithumb.com AEO Score 62.24 / D. Coinbase Customer Contact Data Exposed via Analytics Vendor Amplitude https://thetrustobservatory.com/bulletins/TTO-2026-1028-313.html https://thetrustobservatory.com/bulletins/TTO-2026-1028-313.html Wed, 28 Oct 2026 00:00:00 +0000 A security incident at Amplitude, a third-party analytics provider, exposed a subset of Coinbase customer contact data. Coinbase denies a breach of its own systems; customer funds unaffected. Amplitude has not issued a public statement. coinbase.com AEO Score 62.09 / D. TTO-2026-1027-310: University of Copenhagen Breach Exposes CPR Numbers and PIN Codes for 525,000 People https://thetrustobservatory.com/bulletins/TTO-2026-1027-310.html https://thetrustobservatory.com/bulletins/TTO-2026-1027-310.html Mon, 27 Oct 2026 12:00:00 +0000 An attacker accessed a University of Copenhagen test environment and obtained names, Danish national identity numbers, and PIN codes for 525,000 individuals. ku.dk: 92.0 / A — Low Risk. TTO-2026-1027-311: Storm-0940 Abused ConnectWise Cloud Backup Credentials to Breach 2,250 Microsoft 365 Tenants https://thetrustobservatory.com/bulletins/TTO-2026-1027-311.html https://thetrustobservatory.com/bulletins/TTO-2026-1027-311.html Mon, 27 Oct 2026 12:00:00 +0000 China-state-aligned Storm-0940 used ConnectWise Cloud Backup credentials to silently access 2,250+ Microsoft 365 tenants, escalating to Global Administrator in targeted environments. connectwise.com: 30.39 / F — Critical Risk. TTO-2026-1027-312: Microsoft Authenticator Android Flaw Lets Zero-Permission App Steal Work Account Tokens https://thetrustobservatory.com/bulletins/TTO-2026-1027-312.html https://thetrustobservatory.com/bulletins/TTO-2026-1027-312.html Mon, 27 Oct 2026 12:00:00 +0000 CVE-2026-80097 in Microsoft Authenticator for Android allowed any installed app with zero permissions to steal work account tokens covering mail, calendar, files, and Teams. microsoft.com: 65.69 / D — Medium Risk. TTO-2026-1026-307: Authentication Bypass in BeyondTrust Remote Support Exploited by Nation-State Actor https://thetrustobservatory.com/bulletins/TTO-2026-1026-307.html https://thetrustobservatory.com/bulletins/TTO-2026-1026-307.html Sun, 26 Oct 2026 12:00:00 +0000 China-nexus ARMORY CASTLE exploited a CVSS 9.8 authentication bypass in BeyondTrust Remote Support beginning August 29. beyondtrust.com: 61.92 / D — Medium Risk. TTO-2026-1026-308: Windows Shell Mark of the Web Zero-Day Patched After Active Exploitation https://thetrustobservatory.com/bulletins/TTO-2026-1026-308.html https://thetrustobservatory.com/bulletins/TTO-2026-1026-308.html Sun, 26 Oct 2026 12:00:00 +0000 CVE-2026-96951, a Windows Shell Mark of the Web bypass, was under active exploitation at the time Microsoft patched it in October 2026 Patch Tuesday. microsoft.com: 65.69 / D — Medium Risk. TTO-2026-1026-309: Tailscale SSH Argument Handling Flaw Allowed Root Access via ACL Bypass https://thetrustobservatory.com/bulletins/TTO-2026-1026-309.html https://thetrustobservatory.com/bulletins/TTO-2026-1026-309.html Sun, 26 Oct 2026 12:00:00 +0000 A design flaw in Tailscale SSH on Linux allowed any SSH-enabled user to obtain a root session by supplying a dash-prefixed username, bypassing non-root ACL restrictions. tailscale.com: 60.84 / D — Medium Risk. Capcom Confirms 11.7 Million CAPCOM ID Accounts Exposed in Membership Service Breach https://thetrustobservatory.com/bulletins/TTO-2026-1025-306.html https://thetrustobservatory.com/bulletins/TTO-2026-1025-306.html Sat, 25 Oct 2026 12:00:00 -0500 capcom.com — AEO Score 61.64 / D — Medium Risk. Capcom confirmed that attackers accessed its CAPCOM ID membership service, exposing email addresses and account metadata for more than 11.7 million users. Quest Diagnostics Reports Unauthorized Access to Patient Laboratory Order and Results Platform https://thetrustobservatory.com/bulletins/TTO-2026-1025-305.html https://thetrustobservatory.com/bulletins/TTO-2026-1025-305.html Sat, 25 Oct 2026 11:00:00 -0500 questdiagnostics.com — AEO Score 62.17 / D — Medium Risk. Quest Diagnostics disclosed unauthorized access to its Quanum LSM laboratory order and results platform, filing an SEC disclosure while the scope of patient data exposure remains under investigation. LiteLLM PyPI Package Poisoned with Credential-Stealing Malware in Supply Chain Attack on AI Infrastructure https://thetrustobservatory.com/bulletins/TTO-2026-1025-304.html https://thetrustobservatory.com/bulletins/TTO-2026-1025-304.html Sat, 25 Oct 2026 10:00:00 -0500 litellm.ai — AEO Score 61.36 / D — Medium Risk. Version 1.107.0 of the LiteLLM Python package was poisoned on PyPI and Docker Hub, dropping a credential harvester and persistent remote code loader targeting cloud and LLM provider API keys. Arista VeloCloud Orchestrator Has Now Yielded Three Exploited Zero-Days in Four Months https://thetrustobservatory.com/bulletins/TTO-2026-1025-303.html https://thetrustobservatory.com/bulletins/TTO-2026-1025-303.html Sat, 25 Oct 2026 09:00:00 -0500 arista.com — AEO Score 61.42 / D — Medium Risk. Arista VeloCloud Orchestrator On-Prem has been hit by three actively exploited zero-day vulnerabilities in four months, including CVE-2026-16812 (CVSS 10.0), which allows unauthenticated remote code execution. Abandoned Popcorn Time Variant Exposes Millions of Devices to Critical RCE With No Patch https://thetrustobservatory.com/bulletins/TTO-2026-1024-302.html https://thetrustobservatory.com/bulletins/TTO-2026-1024-302.html Sat, 24 Oct 2026 07:00:00 -0500 Time4Popcorn's updater fetches unsigned executables over HTTP with no patch and no reachable vendor. Twenty update infrastructure domains identified as takeover-ready. popcorntime.app: 71.35 / C — Medium Risk. CoinDCX Denies Hack as On-Chain Analysts Flag $16 Million in Suspicious Outflows https://thetrustobservatory.com/bulletins/TTO-2026-1024-301.html https://thetrustobservatory.com/bulletins/TTO-2026-1024-301.html Sat, 24 Oct 2026 07:00:00 -0500 India's largest exchange denied a hack after $16M in USDT and TRX moved from associated addresses; independent on-chain analysis disputed the exchange's account of retired wallets. coindcx.com: 59.47 / F — High Risk. HPE Patches Eight Maximum-Severity Aruba Networking Flaws Across Enterprise Infrastructure https://thetrustobservatory.com/bulletins/TTO-2026-1024-300.html https://thetrustobservatory.com/bulletins/TTO-2026-1024-300.html Sat, 24 Oct 2026 07:00:00 -0500 HPE disclosed 72 ArubaOS vulnerabilities, eight rated maximum severity, covering RCE and auth bypass across enterprise wireless and edge infrastructure. hpe.com: 61.71 / D — Medium Risk. Initia Halts Blockchain After $2.6 Million Token Minting Exploit https://thetrustobservatory.com/bulletins/TTO-2026-1024-299.html https://thetrustobservatory.com/bulletins/TTO-2026-1024-299.html Sat, 24 Oct 2026 07:00:00 -0500 An attacker exploited a MoveVM flaw to mint unauthorized tokens on Initia Chain and cash out $2.6 million; Initia suspended the network and rollups to protect bridge assets. initia.xyz: 60.98 / D — Medium Risk. Arista VeloCloud Zero-Day Puts Enterprise SD-WAN Deployments at Risk https://thetrustobservatory.com/bulletins/TTO-2026-1023-298.html https://thetrustobservatory.com/bulletins/TTO-2026-1023-298.html Fri, 23 Oct 2026 07:00:00 -0500 Arista Networks disclosed a zero-day vulnerability in VeloCloud affecting enterprise SD-WAN edge deployments; remote exploitation is possible under standard configurations. DMARC present; SPF not configured. arista.com: 61.43. LiteLLM Pipeline Compromise Carries Supply Chain Risk for AI Deployments https://thetrustobservatory.com/bulletins/TTO-2026-1023-297.html https://thetrustobservatory.com/bulletins/TTO-2026-1023-297.html Fri, 23 Oct 2026 07:00:00 -0500 A security compromise targeting LiteLLM's pipeline infrastructure affects downstream AI deployments routing traffic through the gateway. One threat intelligence source has flagged the domain; finding not yet independently corroborated. litellm.ai: 61.36. Capcom Account Breach Exposes 11.7 Million Player Records https://thetrustobservatory.com/bulletins/TTO-2026-1023-296.html https://thetrustobservatory.com/bulletins/TTO-2026-1023-296.html Fri, 23 Oct 2026 07:00:00 -0500 Capcom disclosed unauthorized access to 11.7 million player accounts. DMARC present; SPF not configured -- an authentication gap with direct relevance to post-breach communications to affected users. capcom.com: 61.63. Patient Data Exposure at Quest Diagnostics Affects Millions https://thetrustobservatory.com/bulletins/TTO-2026-1023-295.html https://thetrustobservatory.com/bulletins/TTO-2026-1023-295.html Fri, 23 Oct 2026 07:00:00 -0500 Quest Diagnostics disclosed unauthorized access to patient records. Domain infrastructure and authentication posture are intact at the time of assessment. questdiagnostics.com: 62.12. Operation Dream Job: Lazarus Weaponizes Windows Kernel Zero-Day to Deploy Post-Quantum-Encrypted Backdoor Against Defense Sector https://thetrustobservatory.com/bulletins/TTO-2026-1022-294.html https://thetrustobservatory.com/bulletins/TTO-2026-1022-294.html Thu, 22 Oct 2026 14:00:00 -0500 Lazarus Group exploited CVE-2026-68820, a use-after-free in the Windows afd.sys kernel driver, as a zero-day against defense, aerospace, and aviation targets. The campaign deployed FudModule 3.1 and used post-quantum key encapsulation (ML-KEM/Kyber) in its C2 channel. Patched August 11, 2026. Plex2Shell: Four-Vulnerability Chain Enables Unauthenticated Remote Code Execution on Plex Servers https://thetrustobservatory.com/bulletins/TTO-2026-1022-293.html https://thetrustobservatory.com/bulletins/TTO-2026-1022-293.html Thu, 22 Oct 2026 07:00:00 -0500 A chained four-CVE exploit against Plex Media Server enables unauthenticated remote code execution; exploitation began within 24 hours of public technical details. Payloads include XMRig miners and a persistent Linux backdoor. plex.tv: 61.77. CVE-2024-4577 Exploitation Surges as PHP CGI Flaw Becomes Persistent Mass Campaign https://thetrustobservatory.com/bulletins/TTO-2026-1022-292.html https://thetrustobservatory.com/bulletins/TTO-2026-1022-292.html Thu, 22 Oct 2026 07:00:00 -0500 Mass exploitation of a critical argument injection flaw in Windows PHP CGI installations continues two years after disclosure, with operators deploying XMRig miners and Quasar RAT at scale. php.net: 62.81. Compromised UpdraftCentral Keys Deliver Silent WordPress Backdoors Across Plugin Ecosystem https://thetrustobservatory.com/bulletins/TTO-2026-1022-291.html https://thetrustobservatory.com/bulletins/TTO-2026-1022-291.html Thu, 22 Oct 2026 07:00:00 -0500 Attackers used compromised UpdraftCentral API keys to push authenticated backdoor plugins to WordPress sites, creating persistent admin accounts that survive plugin removal. updraftcentral.com: 60.4. Ransomware Groups Intensify Exploitation of Palo Alto Networks Vulnerabilities in Active Campaigns https://thetrustobservatory.com/bulletins/TTO-2026-1021-290.html https://thetrustobservatory.com/bulletins/TTO-2026-1021-290.html Tue, 21 Oct 2026 07:00:00 -0500 Multiple ransomware affiliates are using Palo Alto Networks firewall and GlobalProtect device compromise as a primary network entry vector. paloaltonetworks.com: 61.96. Hackers Weaponize Cairn AI Penetration Testing Platform to Automate Large-Scale Attack Campaigns https://thetrustobservatory.com/bulletins/TTO-2026-1021-289.html https://thetrustobservatory.com/bulletins/TTO-2026-1021-289.html Tue, 21 Oct 2026 07:00:00 -0500 Threat actors are abusing Cairn, an AI-powered pen-test platform, to run automated attack chaining campaigns against production environments at scale. cairn.io: 71.14. Stolen UpdraftCentral API Keys Exploited to Deploy Backdoors Across WordPress Sites https://thetrustobservatory.com/bulletins/TTO-2026-1021-288.html https://thetrustobservatory.com/bulletins/TTO-2026-1021-288.html Tue, 21 Oct 2026 07:00:00 -0500 Attackers are using stolen UpdraftCentral API keys to backdoor WordPress sites registered under compromised management consoles. updraftcentral.com: 60.40. Yam Store Phishing-as-a-Service Marketplace Dismantled; Operation Behind 1 Billion Phishing Messages Seized https://thetrustobservatory.com/bulletins/TTO-2026-1021-287.html https://thetrustobservatory.com/bulletins/TTO-2026-1021-287.html Tue, 21 Oct 2026 07:00:00 -0500 Microsoft, Cloudflare, and partners seized Yam Store (Storm-3119), a Chinese-language PhaaS marketplace behind 1 billion+ phishing messages targeting 75,000+ organizations in 2026. yam.ink: 71.72. Maximum-Severity SSRF Vulnerability in SonicWall SMA Devices Exploited in Active Attacks https://thetrustobservatory.com/bulletins/TTO-2026-1021-286.html https://thetrustobservatory.com/bulletins/TTO-2026-1021-286.html Tue, 21 Oct 2026 07:00:00 -0500 A maximum-severity SSRF flaw in SonicWall Secure Mobile Access appliances allows unauthenticated attackers to reach internal network resources. sonicwall.com: 61.87. Supply Chain Attack on AOMEI Backupper Delivered Backdoor to Organizations in 11 Countries https://thetrustobservatory.com/bulletins/TTO-2026-1020-278.html https://thetrustobservatory.com/bulletins/TTO-2026-1020-278.html Mon, 20 Oct 2026 07:00:00 -0500 Attackers tampered with AOMEI Backupper update files delivering a CROSSROAD/Radmin/SHINYROAD backdoor chain. Confirmed victims in 11 countries. aomei.com: 71.94. Critical BlockStrap Flaw in Adobe Commerce Enables Arbitrary Code Execution on Magento Servers https://thetrustobservatory.com/bulletins/TTO-2026-1020-277.html https://thetrustobservatory.com/bulletins/TTO-2026-1020-277.html Mon, 20 Oct 2026 07:00:00 -0500 CVE-2026-103849 (BlockStrap) is a critical RCE in Adobe Commerce and Magento Open Source through 2.4.9. blockstrap.com: 60.78.