🕵️ RESEARCH & DEEP DIVES
Microsoft, Health-ISAC seize domains of YAM Store, CoGUI, Iron Man phishing ecosystem behind 1B+ messages
Microsoft, Health-ISAC, and law enforcement partners disrupted a Chinese-language phishing kit marketplace that sent over 1 billion malicious messages to more than 75,000 organizations in 150 countries.- Targets Microsoft 365 customers and healthcare organizations, with over 750 million messages aimed at Microsoft customers since January 2026.
- YAM Store (Storm-3119) sold compromised or fraudulently obtained Microsoft and Google accounts, licenses, and storage, including hijacked Microsoft 365 and Azure for Education tenants.
- Phishing kits CoGUI, Haozi, and Iron Man (Storm-2990) delivered lures like unpaid tolls, delivery problems, and account verification, using device-code phishing to steal authentication tokens.
- Iron Man offers over 2,300 templates impersonating banks, retailers, delivery services, and government agencies across 130+ countries, with geofencing, fake CAPTCHA gates, and IP filtering to evade analysis.
- Under a US District Court order, Microsoft seized and redirected the services' domains, deactivated over 20,000 YAM Store accounts, and blocked 100,000 impersonation domains.
Sources 📄 Source: microsoft.com · 📎 Coverage: bleepingcomputer.com · 👁 via Cybersecurity Dive, BleepingComputer (+3)FBI's Operation Lonestar Roundup Disrupts North Korean Famous Chollima Laptop Farms in Texas
The FBI disrupted North Korean FAMOUS CHOLLIMA laptop farms used to infiltrate U.S. companies with fake remote IT workers.- Affects U.S. companies hiring remote IT workers, including 70+ victims across aerospace, energy, finance, healthcare, cybersecurity, defense engineering, and government technology sectors.
- DPRK operatives used stolen identities, VPNs, and U.S.-based facilitators hosting employer-issued laptops at 'laptop farms' to pose as domestic workers and route earnings to North Korea.
- Between Sept. 21-25, 2026, the FBI searched 40+ Texas residences and seized ~187 laptops and KVM devices; two arrests in Ohio followed a 14-defendant indictment over a $3 million scheme.
- Operatives filed false police reports claiming stolen laptops to redirect replacements, used IT staffing firms, and spoofed device hashes — disguising video capture cards as webcams — reusing identifiers across victims.
- CrowdStrike flagged Astrill VPN, AnyDesk, OBS Studio, and PiKVM as tools to review in context; the group remains active and is expected to adapt.
tensorlake npm package 0.5.144 compromised with Shai-Hulud credential-stealing worm
The tensorlake npm package version 0.5.144 was compromised with a Shai-Hulud worm that steals credentials and self-replicates.- Users of the tensorlake npm package (100,000+ lifetime installs), a serverless sandbox for AI agents, are affected; version 0.5.144 published October 8, 2026 is malicious.
- The worm steals npm tokens, SSH keys, AWS/GCP/Azure credentials, Kubernetes and Docker configs, HashiCorp Vault tokens, GitHub CLI config, CI tokens, .env files, and data from 14 cryptocurrency browser extensions.
- It executes via a preinstall script running obfuscated lib/setup.mjs, which drops the Bun runtime to run the ~856 KB obfuscated payload lib/Math_Symbol.js.
- It uses stolen npm/GitHub credentials to republish itself into other packages the victim controls, and includes a dead-man's switch that wipes the machine if an embedded GitHub token is revoked.
- IOCs: C2 domain iseekaigogo[.]com; setup.mjs SHA256 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef; Math_Symbol.js SHA256 b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec; Ethereum contract 0xb614155Fd88114d40549b259457Bcf921Df091B9.
FBI seizes ~200 laptops, charges 14 in Texas raids on North Korean IT-worker laptop farms
The FBI seized nearly 200 laptops and charged 14 people for operating laptop farms that helped North Korean operatives pose as US-based remote IT workers.- US companies across industries in at least 17 states and DC were targeted; more than 70 US firms were defrauded and identities of over 25 US persons compromised.
- The scheme generated roughly $3 million for DPRK IT workers and caused victim companies at least $3 million in losses and remediation costs.
- Operatives used stolen identities, AI-assisted interviews, and company laptops shipped to US facilitators running laptop farms.
- Facilitators installed remote desktop and PiKVM hardware on hosted laptops so overseas workers appeared US-based; Tailscale mesh VPN and Astrill VPN were used.
- The seizures, dubbed Operation Lonestar Roundup, ran Sept 21-25 under the DOJ's DPRK RevGen: Domestic Enabler Initiative; two US residents were arrested.
Cisco Talos and Recorded Future detail UAT-6275 espionage campaign targeting CIS government organizations
Cisco Talos and Recorded Future jointly reported UAT-6275 (TAG-193) espionage activity targeting government organizations across the Commonwealth of Independent States.- Targets government institutions in nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus, with interest in diplomacy, water resources, and energy.
- Activity observed June 2025 through August 2026; overlaps with Silent Lynx and sits within the broader YoroTrooper cluster; Talos assesses a Kazakhstan nexus with medium confidence.
- Four infection-chain types use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088.
- Payloads include custom reverse shells Chvost, Laplas, and PickleShell providing interactive remote access; recovered artifacts suggest preparation against Linux hosts and internet-facing appliances.
- Three publicly accessible staging directories and a GitHub repository's commit history exposed payload builds, tool inventories, and C2 infrastructure changes.
DOJ, FBI and Meta lead Joint Disruption Week crackdown on West African scam networks
An international Joint Disruption Week disrupted West African scam networks with 28 arrests, 3.7 million accounts removed and 117 trafficking victims rescued.- Targets users in the US, UK and beyond via fake American and British profiles on Facebook and Instagram; over 3.7 million accounts, Pages and Groups removed.
- Operation led to 28 arrests in Ghana and Nigeria, seizure of 350+ devices, and rescue of 117 people trafficked into scam centers; 89 fraud victims lost about $8.3 million.
- Networks used romance and investment scams, cryptocurrency schemes, fake military and law-enforcement identities, digital arrest threats, and job/task scams demanding upfront fees.
- Silent Push mapped 35,000+ malicious domains and ~700 communication channels; industry identified $11 million in potentially freezable funds and Coinbase stopped $415,000 in losses.
- No malware family, hashes, or IOCs were disclosed; the schemes relied on social engineering rather than software vulnerabilities.
russian-influence-latam — Dark Reading
fake-watchguard-vpn-phishing — cryptika.com (discovered)
📋 ADVISORIES
CERT/CC: Multiple TLS libraries mishandle X.509 Name Constraints, enabling delegation bypass
CERT/CC coordinated a study of 13 TLS libraries finding inconsistent or missing enforcement of X.509 Name Constraints that can let certificates escape a CA's allowed namespace.- Affects widely used TLS/PKI libraries: GnuTLS, OpenSSL, wolfSSL, Go crypto/x509, Mbed TLS, pyca/cryptography, AWS-LC, s2n-tls, Apple Security.framework, Mozilla NSS, LibreSSL, and Haskell crypton-x509-validation.
- Name Constraints are meant to keep a subordinate CA within an allowed namespace; discrepancies let a constrained name be accepted by one library and rejected by another.
- Specific issues include GnuTLS case-sensitive DNS matching (CVE-2026-3833, fixed in 3.8.13), pyca/cryptography not checking constraints against the requested peer name (CVE-2026-34073, fixed in 46.0.6), and wolfSSL wildcard handling (CVE-2026-3547, fixed in 5.9.0).
- OpenSSL merged PR #30319 fixing OSSL_parse_url extracting the wrong host from URIs like https://victim.com/path@attacker.com; Mbed TLS does not enforce non-critical Name Constraints in the reported configuration.
- Exploitation requires an attacker to obtain a trusted signature over chosen certificate fields and use the accepted identity for authorization; effects are deployment-specific.
Global crackdown disrupts West African scam networks: 28 arrests, 3.7M accounts removed
An international law enforcement and tech industry operation disrupted West African scam networks, arresting 28 people and removing over 3.7 million fraudulent social media accounts.- Targets users in the US, UK and beyond via fake social media profiles posing as American and British users, using romance scams, fraudulent job offers, and impersonation fraud
- Meta removed over 3.7 million Facebook and Instagram accounts, pages and groups; Microsoft suspended linked accounts; Google, OpenAI and 11 other companies participated
- Operation began Oct 6, 2026, hosted by the UK NCA in London, with law enforcement from 10 countries sharing real-time intelligence on scam centers in Nigeria and Ghana
- 19 people arrested in Ghana and 9 in Nigeria; 356 devices seized; 117 trafficking victims rescued from forced