Cisco's CVE-2026-76519 compromises the gateway's core function. The flaw affects how Secure Email Gateway's Advanced Malware Protection feature handles attachments when File Reputation is enabled. A single crafted email passing through the appliance can write files and execute commands as root without authentication. That level of access complicates incident response: attackers can remove or conceal evidence, so Cisco directs administrators to external network and firewall logs. Private SSH keys used between cluster members may also be exposed, potentially putting the entire cluster at risk. The fix is delivered through a Content Scanner Tools update that requires neither a firmware upgrade nor a restart. Cisco says internal scanning identified the flaw, but it also became aware of exploitation in October. Cisco and CISA both report that attacks occurred before a fix was available.

Hirudo targets the banking app itself. It uninstalls the genuine app and replaces it with a copy signed using a public test key. A hooking engine then feeds the bank's security checks false responses. The process requires the victim to permit both the original app's removal and installation from the new source, creating opportunities for interruption. The engine remains dormant until the remote access trojan writes a trigger file. ThreatFabric also found that the attestation keybox uses a publicly leaked key, with at least two certificates on Google's revocation list, giving backends that check revocation a way to detect forged attestations. Separately, an APK-processing panel was accessible without authentication, exposing storage buckets and credentials.

Two law-enforcement actions targeted the infrastructure and intermediaries supporting wider criminal operations. Microsoft, Health-ISAC and partners obtained a US court order to seize domains behind YAM Store, CoGUI and Iron Man System. YAM Store sells hijacked Microsoft 365 and Azure for Education tenants, as well as fabricated nonprofit tenants, to kit operators who rent them to other criminals. In the North Korean IT worker case, US-based facilitators who host company laptops are among those facing prosecution. Authorities seized 187 laptops across 40 locations in Texas. The FBI says North Korean workers are increasingly recruiting American facilitators to evade improved detection. Of the 14 people charged, only two have been arrested; the others remain at large.

Microsoft tracked three Chinese-language phishing kits, CoGUI, Haozi and Iron Man System, to developers it calls Storm-2990, which facilitated over one billion phishing emails and SMS messages to more than 75,000 organisations since January 2026. The kits run on hijacked Microsoft 365 and Azure for Education tenants resold by YAM Store, an access broker tracked as Storm-3119. Microsoft's Digital Crimes Unit worked with law enforcement and partners to disrupt the primary developers and infrastructure.

A federal grand jury in Ohio charged U.S. citizens and Chinese nationals with wire fraud, money laundering and identity theft conspiracies tied to a North Korean remote IT worker scheme. US-based facilitators hosted company-issued laptops at their homes, known as laptop farms, helping workers secure jobs at more than 70 US companies. The scheme generated roughly $3 million in revenue believed to have been sent to sanctioned North Korean entities.

CISA added CVE-2026-104935, an authentication bypass in Ivanti Connect Secure, to its Known Exploited Vulnerabilities Catalogue on 13 October 2026. The zero-day allows remote, unauthenticated execution of arbitrary commands on versions 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier. Threat actors are exploiting it for credential theft and data exfiltration, with commands running in memory so Ivanti's Integrity Checker Tool may miss evidence.

ThreatFabric identified Hirudo, an Android banking trojan delivered through shopping, adult video and short drama apps that install it as a separate package behind a fake update prompt. It replaces eight Indonesian banking apps with modified copies containing a hooking engine that disables the apps' signature, Accessibility, screen-capture and Play Integrity checks. Hirudo combines credential theft with live remote control, and its code names targets across Indonesia, China, India, Mexico, Morocco and Thailand.

Cisco disclosed CVE-2026-76519, a critical arbitrary file write vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can send an email with a crafted attachment through an affected device to write files and execute commands with root privileges. The flaw affects appliances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525, and Cisco PSIRT became aware of active exploitation in October 2026.