💥 BREACHES & INCIDENTS
- Nippon Columbia malware incident may expose 8.7M Daiichi Kosho karaoke customer records
Daiichi Kosho disclosed that malware on a contractor terminal at Nippon Columbia may have exposed 8.72 million customer and employee records.- Affects customers of Big Echo, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining karaoke chains in Japan
- ~8.63 million customer records and ~93,000 employee records at risk, including names, genders, dates of birth, email addresses, and phone numbers; passwords not included
- Malware was found on an employee's computer at contractor Nippon Columbia Group on October 5 (infection activity October 1-2); the affected system was isolated the next day
- Daiichi Kosho's own systems were not breached; no confirmed data theft or leaks, and no unauthorized use of loyalty points detected
- NCG reset passwords and authentication credentials and is investigating the cause, scope, and possible online leakage
🕵️ RESEARCH & DEEP DIVES
- Kimsuky's Operation GitPower spear-phishes Ukrainian diplomacy and security experts
North Korean APT Kimsuky is targeting Ukrainian experts in diplomacy, security, and international policy with reply-baiting spear-phishing attacks as part of Operation GitPower.- Targets Ukrainian civil society figures and experts in diplomacy, security, and international policy, plus South Korean financial institutions, retail businesses, and corporate personnel
- Attacks use reply-baiting spear phishing with no initial links or attachments, luring targets with fake international conference invitations (e.g., KCSCON 2026) and analytical collaboration requests
- Malicious LNK files disguised as PDFs, financial documents, and Zoom installers execute hidden, size-padded PowerShell scripts that fetch payloads from GitHub, GitLab, and Codeberg using hardcoded Personal Access Tokens, with Pastebin as a fallback channel
- Decoy documents show traces of the AI agent 'opencode' in PDF metadata, including unreplaced LLM placeholder text like '(temporary value)', indicating AI-assisted mass production of lures
- Malware includes anti-analysis checks for VMs, x64dbg, and sandbox usernames; C2 infrastructure includes qweasdzxc.mygamesonline[.]org, wersdfxcv.mygamesonline[.]org, pokijhgcfsdfghnj.mywebcommunity[.]org, and mykolapalinchak.medianewsonline[.]com
📋 ADVISORIES
- 📄 Source for Google unveils AISeal enclave architecture to isolate Android on-device AI data from host OS — blog.google