🚨 ACTIVE EXPLOITATION
- Google disrupts 1.3M-device XCPE Android TV botnet, bans maker Videostrong
Google dismantled the XCPE backdoor botnet embedded in Android TV firmware by manufacturer Videostrong, which sold access to criminal affiliates.- Affects over 1.3 million Android TV set-top boxes (e.g., MECOOL models), plus Android-based telehealth devices, karaoke machines, and digital signage; backdoor appeared in 206 device models.
- The x.cpe backdoor (also com.oemservice) is preinstalled in the firmware partition, runs with system privileges, and reinstalls itself from the /oem/ partition on reboot.
- It contacts C2 on anyevonline[.]com subdomains, then receives commands via an MQTT broker (mqtt.szbboys[.]com), enabling silent app installs, disabling Play Protect, shell commands, screenshots, keystroke injection, and reverse shells.
- Videostrong sold access to affiliates whose modules ran ad fraud, enrolled devices into residential proxy networks (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer), and deployed further backdoors (Moyu, Spirit, Bird).
- Taking down affiliate C2 domains cuts access to at least 10 million additional compromised devices; Google banned Videostrong from building certified Android devices.
Sources 📄 Source: cloud.google.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, The Hacker News
💥 BREACHES & INCIDENTS
Abrigo takes Sageworks lending platform offline after 'irregular activity', restores most services
Abrigo took its Sageworks lending platform offline on October 30 after detecting irregular activity and has since restored most functionality.- Affects US community banks and credit unions using Abrigo's Sageworks platform, which serves more than 2,400 entities and handles sensitive banking customer data
- Sageworks was disabled at ~11:25 am ET on October 30 after 'irregular activity' was detected; Online Portal Now, Sageworks Analyst, and Sageworks API were impacted
- Most Sageworks functionality has been restored, but borrower-facing features remain offline; Abrigo has not confirmed whether the incident was a breach or technical issue
- Earlier in 2026, an alleged ShinyHunters member claimed theft of 1.7 million Salesforce records from Abrigo, though no breach has been confirmed
Mercado Bitcoin halts withdrawals after $40M in suspicious transfers across 10 blockchains
Brazilian crypto exchange Mercado Bitcoin suspended deposits and withdrawals after researchers flagged $40 million in suspicious transfers across at least 10 blockchains.- Affects Mercado Bitcoin customers; exchange halted deposits and withdrawals on November 2, 2026 after detecting a security incident in one of its systems.
- Blockchain security firm Hypernative flagged over $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar; the exchange has not confirmed that amount.
- Transfers were ordinary wallet movements with valid signatures, not a smart contract exploit; how the attacker obtained signing access or which system was compromised remains unknown.
- Most outflows occurred between 06:19 and 06:53 UTC; preliminary estimates include about 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM plus 200+ other tokens.
- Mercado Bitcoin says it contained the incident, that customers were unharmed and no data leaked, and has published attacker destination addresses to help track funds.
Sources 📄 Source: coindesk.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Apple spyware alerts hit German lawmakers' iPhones; BSI warns devices may be compromised
Apple threat notifications warn German Bundestag members and officials their iPhones may have been hacked with government-backed spyware.- German Bundestag lawmakers, government officials, ministry staff, journalists, and members of Chancellor Merz's Asia delegation received Apple spyware threat notifications
- Apple's latest batch of threat notifications went to users in 99 countries, including Beirut-based filmmaker Radwan Mortada
- The spyware can steal messages, location data, and other sensitive data, often using zero-click exploits requiring no user interaction
- Germany's BSI warned recipients to assume their devices may have been compromised; the government said it is investigating, though whether Merz was targeted is unconfirmed
- The attacker is unknown; mercenary spyware vendors like NSO Group, maker of Pegasus, are typical sources of such tools
🕵️ RESEARCH & DEEP DIVES
- DKIM replay attacks: attackers rebroadcast legitimate signed emails to bypass DMARC
Attackers are replaying legitimate DKIM-signed emails unchanged so they pass authentication and reach new targets.- Affects any domain sending DKIM-signed email — abuse has been seen with Apple, PayPal, DocuSign, HelloSign, Google, and Microsoft-branded messages.
- DKIM signatures stay valid wherever a message travels and are not tied to a recipient or expiration, so a captured signed email can be replayed to thousands of recipients.
- Attackers obtain a legitimate signed email via mailing lists, compromised mailboxes, list archives, or forwarding rules, then resend it byte-for-byte from their own servers; DKIM passes, so DMARC passes even though SPF fails, and DKIM key rotation does not stop it.
- In one Google campaign, attackers embedded a phishing lure in an OAuth app name so Google generated a DKIM-signed alert from no-reply@accounts.google.com, then relayed it via fwd-03.fwd.privateemail.com with phishing pages hosted on sites.google[.]com stealing credentials.
- Replay abuses the sending domain's reputation to deliver scams, invoices, or credential-harvesting lures that bypass traditional email security filters.
🔓 CVEs & KEV
CVE-2026-119085 — AWS virtual-engineering-workbench — CVSS 9.4 — Template injection in the publishing component of awslabs Virtual Engineering...
CVE-2026-105769 — chainguard kaniko — CVSS 9.3 — kaniko can send the build's Azure (Entra ID) access token to lookalike ACR re...
CVE-2026-88811 — SUSE Rancher — CVSS 9.1 — SUSE Rancher Manager Meta Proxy Flaw Leaks Cloud Provider Credentials
CVE-2026-81938 — Grafana Enterprise Metrics (GEM) — CVSS 7.7 — Arbitrary file read via Alertmanager receiver configuration in Grafana MimirG...