Patch your devices — this week’s ThreatsDay bulletin reveals a range of critical security incidents: exploitable flaws in Fortinet ships, token theft in Microsoft Authenticator, AI scams harvesting credentials, and much more.
Top Vulnerabilities to Fix Immediately
Fortinet has issued important security updates for FortiOS, FortiManager, and FortiAnalyzer to address several critical and high-severity vulnerabilities. Leveraging AI-driven discovery, these weaknesses posed severe risks and users are urged to apply patches as soon as possible. Details of the fixed issues will be fully disclosed on November 10, 2026. Such updates come amidst heightened targeting of Fortinet gear.
Another alarming flaw (CVE-2026-80097), now patched, involved Microsoft Authenticator. Attackers could use a zero-permission Android app to impersonate a trusted app and trick the Authenticator broker into granting access tokens. This allowed malicious actors to access work accounts without needing additional permissions. These kinds of token theft exploits deepen risks for enterprise users.
Credential Leaks, AI Impersonation & Ransomware Growth
A fresh FortiBleed campaign dubbed “FortiBleed 2.0” exposed secrets from over 1,700 FortiGate appliance files. The leak — older than previously reported material — released 40,573 credentials, including thousands of local-user and LDAP bind records.
AI agents are now being mimicked at scale. One threat actor has posed as roughly 32 distinct AI assistants — including ChatGPT, Claude, and Perplexity — to crawl the web and steal API keys, SSH private keys, cloud credentials, and other sensitive data. Their scan patterns focused on exposed config files, .env paths, and server metadata, operating continuously for weeks.
Ransomware economics are shifting thanks to an AI-assisted operation tied to MR ROBOT — a malware-as-a-service (MaaS) platform targeting Indian bank customers. The service allows affiliates to generate custom Trojans via a Telegram-based builder, intercept calls, steal OTPs, card info, UPI PINs, and more. The operation reportedly stole thousands of messages from dozens of devices.
In parallel, the n0n ransomware group exposed its workflow, showing how it harnesses AI with some 150 models for script generation. Using exposed AWS keys, misconfigured portals, and weak credentials, the group has already impacted at least 23 organizations across 14 countries.
Other Notable Threats
- Camera firmware software has been weaponized: attackers used the legitimate Windows camera management binary “WpcMon.exe” to sideload DLLs and establish persistent, hidden outbound connections.
- A Philippine agency suffered a massive breach of 68GB of government data due to a misconfiguration that left log files openly accessible online.
- Critical remote-code-execution (RCE) flaws are still being exploited, including an unpatched Gotenberg bug (CVE-2026-42589) leading to Go-based reverse-shell backdoors.
- A malicious PDF, masquerading as a FedEx invoice, dropped a multistage SIRIUS backdoor by abusing overlooked PDF features like /OpenAction and /Launch to run encoded PowerShell commands in memory and evade detection.
- New insurgent threat actors ScarlettGroup and platforms like NIK C2 are combining data-extortion tactics and AI-powered C2 frameworks that collapse theft, espionage, and ransomware into one continuous attack flow.
These incidents show both cutting-edge abuse and old mistakes still causing harm. Poor patching, misconfigured systems, overprivileged apps, and trusting third-party credentials remain recurring issues. Threat actors are blending AI for potency and speed, but many successful breaches still come down to basic security hygiene failures.
What to Watch: Organizations must fast-track patching known vulnerabilities, especially in enterprise firewall and authentication tools. AI impersonation demands new threat models and detection strategies. Monitoring leaked credentials, vetting third-party SDKs, and hardening privileges will remain essential defenses as threat actors adopt more sophisticated tools and reuse forgotten vulnerabilities.
