A fake trading app called Padre Terminal on the Apple App Store functioned as a crypto drainer for Solana users. Since October 25, the attacker stole approximately $23 000 from 27 addresses. Although Apple removed the app, thefts continued through October 29, with the attacker accumulating 229,66 SOL.
Security researchers identified a campaign dubbed Yoba, where hackers disguised a Monero miner as desktop versions of ChatGPT and Claude. The malware used DLL sideloading and SEO poisoning to infect systems. It avoided machines with specific keyboard layouts and utilized Telegram channel avatars to determine command-and-control server addresses.
South Korean police arrested a seven-member hacking group led by a self-taught hacker who targeted over 90 companies. The group used an AI framework called ARTEX to exploit vulnerabilities and extort victims. They demanded $270 000 from 38 companies, though they successfully collected only 300 000 won before their arrest.
Frontier Red Team utilized an internal Claude model to discover dozens of vulnerabilities in browsers and operating systems, including a critical Linux kernel flaw. Additionally, NebuSec researchers found a remote code execution vulnerability in Telegram for Android, which affected versions released over the past four and a half years.
The Australian Signals Directorate (ASD) disrupted the Amadey botnet, disconnecting 180 000 infected devices globally. The agency also intercepted and destroyed a 5 TB database of stolen personal and business data before it could be sold on the darknet, preventing the leak of 4,8 million files belonging to Australians.
