Cyberattack attempt forces FEC to shut down electronic filing system

🚨 ACTIVE EXPLOITATION

• Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users
  Attackers armed 42 hijacked GitHub repositories with malware that executes when developers open projects in AI coding tools.

  • Affects developers using Claude, Gemini, Cursor, or VS Code who open hijacked repositories belonging to 11 legitimate owners, including developers, students, and one company (Crayon-Biz-LLP).
  • Hidden 12.9–13.7 MB payload in .github/init.js evades GitHub code search indexing; startup hooks (e.g., Claude settings running node .github/init.js) trigger it on session start or folder open.
  • Payload is a rebuilt CI publisher (ci.js) that abuses stolen GitHub/npm access to publish malicious npm packages, feeding more stolen credentials back into the worm loop.
  • npm packages carry a native addon with encrypted .napi_cache (XOR key 0x96) that sleeps on CI systems, containers, and debuggers to evade scanners; Windows build checks for Wireshark, Fiddler, and x64dbg.
  • Hijacked accounts also ran scanner workflows targeting cPanel/WHM CVE-2026-41940; IOCs include C2 43.228.157.68:80, exfiltration at aiarmor.website, operator account CementBeetleSteele, and 14 malicious npm packages like data-pipeline-testmetest.
  Sources 📄 Source: research.jfrog.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• Hackers plant malware in 42 GitHub repos targeting Claude, Gemini, Cursor, and VS Code users
  Hackers have planted malware in 42 legitimate GitHub repositories that executes when developers open projects with AI coding tools.

  • 42 repositories belonging to 11 legitimate owners, including developers, students, and one company, were armed with malware
  • The payload sits in a hidden 12.9–13.7 MB file named .github/init.js, triggered by Claude, Gemini, Cursor, and VS Code startup hooks
  • The payload is a rebuild of a CI publisher (ci.js) meant to turn stolen GitHub and npm access into fresh malicious npm releases
  • The huge file size evaded GitHub code search indexing and the contents API; JFrog found the repos while tracking the 'testmetest' npm worm campaign
  • All 10 wrapper variants decode to the same payload; SafeDep first described the npm side on October 22 with no confirmed victims
  Sources 📎 Coverage: cryptika.com · 👁 via cryptika.com (discovered)

💥 BREACHES & INCIDENTS

• Cyberattack attempt forces FEC to shut down electronic filing system days before midterms
  An attempted cyberattack forced the U.S. Federal Election Commission to take its electronic filing system offline days before the November 3 midterm elections.

  • Affects political committees, campaigns, and compliance firms that file campaign finance disclosures with the FEC; voting systems are not affected since the FEC does not administer elections.
  • The outage blocks submission of mandatory 24-hour and 48-hour campaign spending reports during peak spending, while previously filed reports remain searchable.
  • An FEC electronic filings officer emailed compliance firms saying 'a bad actor' was attempting to breach FEC systems, prompting a defensive shutdown of web-facing services starting late October 26.
  • The FEC status page listed the electronic filing outage as under investigation at 10:15 p.m. ET October 26, with a related FECfile+ submission outage; by October 27 officials said a fix was being implemented but the incident remained unresolved.
  • No attacker attribution, entry method, or evidence of successful data breach has been publicly confirmed; super PACs and dark money groups spent over $50 million per day on average the prior week.
  Sources 📄 Source: reuters.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Cyberattack on Moldova's health insurance agency may have exposed a third of national medical database
  Moldova's National Health Insurance Company confirmed a cyberattack that may have compromised about 30% of its database of personal and payment records.

  • Moldova's National Health Insurance Company (CNAM), which administers the country's compulsory health insurance system, suffered a cyberattack that may have led to data theft.
  • Deputy cybersecurity agency director Ion Vintilă said roughly one-third of CNAM's database — personal information and healthcare payment records — may have been affected.
  • CNAM says the affected system was secured quickly, the database remained intact, and hospitals were not disrupted.
  • No ransom demands were received, and officials believe the operation was an espionage-motivated theft of sensitive information, possibly linked to Russian actors.
  • Separately, Moldova took down more than 80 public services after a related cyberattack on government services.
  Sources 📎 Coverage: risky.biz · 👁 via Risky Business News

• Microsoft Whistleblower Alleges India-Based Engineer Approved to Access U.S. Government Cloud Logs
  A claimed Microsoft whistleblower leaked screenshots showing an India-based engineer was approved through Microsoft's escort process to view U.S. government cloud logs.

  • Applies to Microsoft Government Community Cloud (GCC-Moderate, environment DProdMgd151/'GCCM') customers, not classified DoD systems
  • Screenshots show incident 815678445, 'Escort Request: GCCM - Request to view GCC-M logs', created by engineer Viraj Chokhany, owned by the O365 Escort Team, and marked resolved, with an approval image for his account alias
  • A further image requests sharing Geneva logs for two incidents, with instructions to load all rows, expand full logs, and share results; no returned log contents are shown
  • Microsoft's GCC rules require U.S. citizenship verification and background checks for elevated access to customer content, but GCC support carries no general assurance about an agent's location or citizenship
  • The allegations, shared by Conspiracookie on X, remain unverified and do not establish unauthorized access, a breach, or a FedRAMP violation
  Sources 📄 Source: x.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• Microsoft whistleblower alleges India-based engineer approved to view US government cloud logs
  A claimed Microsoft whistleblower shared screenshots showing an India-based engineer was approved to view logs from a US government cloud environment.

  • Allegations concern Microsoft's GCC-Moderate government cloud environment, specifically environment DProdMgd151 ('GCCM'), not classified DoD systems.
  • Screenshots show engineer Viraj Chokhany requesting logs via Microsoft's escort process, with incident 815678445 ('Escort Request: GCCM- Request to view GCC-M logs') marked resolved and approved by the O365 Escort Team.
  • A further image shows a request to share Geneva logs for two incidents, with instructions to expand and share full logs; no returned log contents are shown.
  • The claims were shared by the account Conspiracookie on X; neither Chokhany's citizenship nor the screenshots' authenticity has been independently verified.
  • Approval does not establish unauthorized access or a breach; Microsoft's GCC rules require screening before temporary elevated access to customer content.
  Sources 📎 Coverage: cryptika.com · 👁 via cryptika.com (discovered)

🕵️ RESEARCH & DEEP DIVES

• INTERPOL's Operation Serengeti III nets 1,462 arrests, disrupts 10,909 networks, recovers $105M
  INTERPOL-coordinated Operation Serengeti III led to 1,462 arrests, disruption of 10,909 malicious networks, and recovery of over $105 million across 21 countries.
  • Targets: cyber-enabled fraud, ransomware, business email compromise, online scams, and digital extortion across 20 African countries plus the US, June 29–August 31, 2026.
  • Investigators identified 65,929 victims, with linked financial losses exceeding $385 million.
  • In Uganda, 365 foreign nationals were arrested for investment and pension fraud targeting Asian victims via rotating call centres, fake trading platforms, and fraudulent websites.
  • In Angola, nine suspects were arrested and over 2,000 crypto mining devices plus six illegal power transformers valued at over $1 million were seized.
  • In Nigeria, a phishing/BEC operation using ~2.1 million email addresses and AI to scrape LinkedIn data was dismantled; a separate investment fraud scheme moved $2.4 million, largely laundered via cryptocurrency.
  Sources 📄 Source: interpol.int · 📎 Coverage: darkreading.com · 👁 via Dark Reading

📋 ADVISORIES

• Google patches Chrome vulnerabilities, most severe allowing arbitrary code execution
  Google has released Chrome security updates fixing multiple vulnerabilities, the most severe of which could allow arbitrary code execution.
  • Applies to Chrome users on Windows, Mac, Linux, Android, iOS, and ChromeOS/ChromeOS Flex.
  • Affected versions: Chrome prior to 156.0.8078.73/.74 for Windows and Mac, and prior to 156.0.8078.73 for Linux.
  • The update includes 52 security fixes, including critical memory corruption in FileSystem (CVE-2026-118306), plus use-after-free and input validation flaws in V8, Skia, ANGLE, PDFium, and other components.
  • Exploitation of the most severe flaws could allow arbitrary code execution in the context of the logged-on user, enabling program installation, data modification, or creation of new accounts.
  • No reports of exploitation in the wild; flaws are reachable via drive-by compromise (crafted web content).
  Sources 📎 Coverage: cisecurity.org · 👁 via CIS Advisories