TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A roundup published October 29 highlights six security developments, including an active campaign targeting Fortinet firewalls, an Android kit for fake banking apps and a fixed flaw that exposed work login tokens from Microsoft Authenticator. The reports identify risks to passwords, one-time codes, work sessions and cloud keys; the status and scale of some activity remain uncertain.
A security roundup published October 29 selected six developments from The Hacker News’ weekly digest, including an active campaign targeting Fortinet firewalls and a fixed Android flaw that could expose work-account login tokens. The reports describe risks to business systems and personal accounts, but they do not establish that every exposed system or user was compromised.
Fortinet released critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. The roundup says the company asked customers to prioritize the changes and plans to publish more technical details on November 10. The FBI and U.S. Secret Service separately warned that a campaign called FortiBleed, which targets Fortinet firewalls to steal passwords, remained active. Hudson Rock reported finding 40,573 records containing plain-text passwords in 1,703 firewall reports; that is the company’s count, not a confirmed count of victims.
Two of the other reports concern phones. CloudSEK described MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can capture one-time codes and secretly forward calls. CloudSEK said one affiliate was associated with 153 devices and 5,407 text messages. Separately, researchers at Enclave reported that an Android app with no permissions could obtain work-account tokens from Microsoft Authenticator. Microsoft fixed the issue, tracked as CVE-2026-80097.
Trellix traced a backdoor to an empty PDF disguised as a FedEx tax invoice. The attack required the recipient to approve a warning in the PDF reader before the hidden command could run. Cequence reported that a scanner seeking files such as .env files, cloud keys and SSH keys rotated through about 32 false AI-bot identities. In a separate patching concern, CISA added the PHP2Shell vulnerability to its Known Exploited Vulnerabilities catalog and gave U.S. federal agencies three days to address it. VulnCheck counted 1,358 Gotenberg exploitation attempts in 30 days; the roundup noted that Gotenberg was not on that CISA list.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Passwords and Tokens Face Different Routes
The reports show several ways account access can be put at risk: stolen firewall passwords, one-time codes captured by fake banking apps, work tokens exposed through an app flaw, and secret files sought on websites. Tokens matter because they can let someone use an already authenticated session, while password and code theft can help attackers enter accounts in the first place.
For organizations, the combination raises a practical prioritization issue. A flaw appearing on CISA’s catalog is a strong patching signal for federal agencies, but the Gotenberg figures cited by VulnCheck suggest teams may also need to assess software outside that catalog. The figures do not by themselves show how many systems were vulnerable or successfully breached.
For individuals, the roundup’s suggested steps are direct: install banking apps through trusted app stores, decline PDF prompts to launch other software, and update Microsoft Authenticator. For IT teams, it points to patching Fortinet products, limiting internet access to administrative logins, resetting potentially exposed credentials, and setting a minimum supported Authenticator version.
Products Worth Considering
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
Six Reports From One Weekly Digest
The source article says The Hacker News published a weekly security digest containing 30 stories on October 29. Its author selected six, checked each against an original advisory or research report, and presented an action for each. The piece describes most statistics as figures reported by the security companies that identified the activity, some of which also sell security products.
The six items cover firewalls, mobile banking, malicious PDFs, authenticator tokens, website scanning and patch priorities. Their evidence differs: some are vendor or researcher findings, while others are government warnings or software advisories. The source article’s recommendations are its own practical reading of those reports.
CISA’s Known Exploited Vulnerabilities catalog identifies vulnerabilities that federal agencies must address under government deadlines. Its presence or absence does not, by itself, establish whether a particular flaw is being exploited in every setting or whether it poses no risk to systems outside the catalog.
“The official must-patch list is a floor, not a ceiling.”
— Thorsten Meyer AI roundup
The Scale of Exposure Is Unknown
The cited counts come from researchers and security companies; the material does not independently confirm how many people or organizations were affected. Hudson Rock’s password records and CloudSEK’s device and text figures are attributed estimates, while VulnCheck’s 1,358 figure refers to recorded exploitation attempts over 30 days, not confirmed successful breaches.
The roundup does not identify how many Fortinet devices remain unpatched, whether the FortiBleed campaign succeeded against specific victims, or how widely the Android banking kit has been deployed. It also does not provide the scanner’s full infrastructure or establish that every request claiming to come from an AI bot was malicious. Further technical details on the Fortinet fixes were still pending publication.
Patches and Technical Details Ahead
Fortinet is scheduled to publish details of its October 22 fixes on November 10. Organizations using Fortinet products can apply the available updates, review whether administrative logins are exposed to the internet, and consider resetting VPN and administrator passwords as the roundup advises.
Security teams can check the CISA catalog for required actions, then assess other exploited and internet-facing software, including Gotenberg where it is in use. Individuals can update Authenticator and install banking apps only through trusted sources. The source material does not give a date for further reporting on the MR ROBOT kit, the PDF backdoor or the scanner activity.
Key Questions
Are this week’s reports proof that my passwords or tokens were stolen?
No. The reports describe vulnerabilities, tools and observed activity, but the roundup does not confirm compromise of any particular reader’s account or organization.
What should Fortinet customers do?
Apply the available FortiOS, FortiManager and FortiAnalyzer fixes, review exposure of administrative logins, and consider resetting VPN and administrator passwords. Fortinet’s further technical details are scheduled for November 10.
Was the Microsoft Authenticator issue fixed?
Yes. The roundup says Microsoft fixed the Android issue tracked as CVE-2026-80097. Users should update the app; organizations can set a minimum supported version.
Does CISA’s list cover every urgent vulnerability?
No. The roundup notes that Gotenberg was absent from the cited CISA catalog despite VulnCheck reporting 1,358 exploitation attempts in 30 days. Teams should assess their own exposure and patch priorities as well as consult the catalog.
Source: Thorsten Meyer AI
