Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. In these fraud schemes (also known as romance baiting or pig butchering scams), criminals lure targets through social media, dating sites, and messaging apps into fake investment schemes, stealing their money instead of investing the funds as promised. The investigation involved Ukraine's Cyber Police Department, the Main Investigation Department of the National Police of Ukraine, and German law enforcement authorities. According to Ukraine's Cyber Police, the suspects used phone calls and messaging apps to build victims' trust through social engineering and trick them into investing in cryptocurrency, shares, and other financial instruments through fraudulent online trading platforms.
US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet. CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers and cold chain monitoring systems. The activity is global. Healthcare, chemical, food and transport companies use these systems to watch temperatures, keep logs, run defrost cycles and save energy, including in refrigerated trucks. “The authoring organizations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.” reads the advisory published by CISA. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” The targets are electronic temperature controllers and commercial refrigeration controllers used in grocery stores and cold-storage sites. Attackers may exploit flaws in unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles. In plain terms, someone could cook your freezer from the other side of the world. The agencies identify three ways in: bypassing authentication, injecting arbitrary code, and exploiting weak configurations. Once inside, an attacker can change temperatures, which can shorten equipment life, create a fire hazard and destroy stock. Spoiled products that reach consumers can also create a safety risk. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” continues the adviosry. An attacker can also hide the damage. Operators lose sight of current temperatures, and that’s a bad moment to learn a cold room has been warm for hours. CISA’s Chris Butera adds that every organization that depends on these systems should assume it’s a target. The advice follows the Cross-Sector Cybersecurity Performance Goals from CISA and NIST, a minimum set of practices for any organization. Start with exposure. Keep controller panels off the internet, and if you need remote access, put an up-to-date firewall or similar gateway in front of it. Then separate industrial equipment from the office network with its own virtual network. Next, fix the basics. Change default passwords, use strong ones, and add phishing-resistant multifactor authentication where you can. Update firmware, and retire or replace devices the maker no longer supports. Allow only trusted devices and IP addresses to change system settings. Keep tested backups in a separate location, disconnected from the network. Enable logging and regularly check the logs. If devices do not record activity, monitor the network traffic between them. U.S. organizations should report suspicious activity to CISA’s 24/7 operations center or the FBI’s Internet Crime Complaint Center. Healthcare organizations can also contact HHS. Reports should include the date, time and location of the incident, a description of the activity, the number of people affected, the equipment involved, and a contact person within the organization. One control gets forgotten more than the rest. A controller shouldn’t be able to push a freezer past what’s safe, whoever is giving the orders. “The authoring organizations strongly urge industrial refrigeration and cold chain monitoring system owners and operators to secure remote access to their OT systems.” concludes the report. “To strengthen system security, owners and operators should review the following resources and implement recommended mitigations: United Kingdom’s National Cyber Security Centre and Partners: Secure Connectivity Principles for OT“ CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology CISA: Defend the Edge: The Critical Importance of Edge Device Security CISA: Internet Exposure Reduction Guidance Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs. Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals. The researchers discovered that more than 2,000 PCs were infected. “The attackers behind these compromised development projects target blockchain game enthusiasts and (most intriguingly) …information security professionals.” reads the report. “At the time of Doctor Web’s research into this matter, more than 2,000 PCs were infected.” The campaign started two years ago with Visual Studio projects related to blockchain games, game bots and cheats. The attackers targeted people who used crypto wallets. They hid malicious code in project files, including commands that ran before a project was built and PowerShell commands stored in configuration files. They even provided instructions on how to install Visual Studio and download the projects from GitHub, making it easy for people with limited technical knowledge to use them. Now the attackers are targeting cybersecurity professionals. Their new GitHub projects claim to offer tools for automated scanning, security testing and log analysis. Doctor Web found one that pretends to analyze and clean results from the Fscan security scanner. The attackers also hide malicious code in Python and Go files, using large blocks of blank spaces to make it harder to spot. Some of these fake security tools even remove the antivirus software installed on the victim’s computer. Once a victim opens the project, a PowerShell script runs and contacts the attackers’ servers and legitimate platforms, including YouTube, Telegram, Google Docs, GitCode and Pastebin. An encrypted string it retrieves holds a link to an archive, which unpacks into a folder disguised as a Windows Photos component. Its main program is Microsoft.exe, a modular app built with the Electron framework. It does most of the damage. The loader collects system information and sends it to a Telegram bot, keeps itself running, raises its privileges, and turns off Windows Defender, UAC, System Restore and shadow copies. It also adds its own Defender exclusions, injects code into legitimate processes, and removes McAfee, ESET and Malwarebytes antivirus products. Its default mode, called Mode3, stacks several evasion tricks. It fakes its parent process, disables Smart App Control, removes security software hooks from ntdll.dll, makes direct system calls, and patches event tracing and antivirus script scanning in memory. If that fails, Mode2 takes over, adding Defender exclusions and injecting through PowerShell. Three payloads follow. AsyncRAT, a remote access backdoor, runs as two identical copies on different ports, which probably lets two operators control one device. A clipper swaps crypto wallet addresses in the clipboard while taking screenshots, and a stealer takes browser data, FileZilla, MobaXterm and Total Commander configs, VPN settings, messenger files, game accounts and Discord tokens. Everything is zipped and sent through Telegram, and the malware edits the hosts file to block antivirus vendors’ domains. The attackers are still developing the malware. Doctor Web found an unfinished component that could install itself as a system service, download Microsoft.exe again if someone deletes it, manage startup and install updates. “Attackers are constantly updating the Trojans to introduce new features. For example, Doctor Web’s researchers discovered certain unused routines that facilitate downloading and decompressing yet another archive—Lodge.7z.” concludes the report. “It contains an Electron project that hasn’t been completed yet. The executable file’s name is WUDFHost.exe. Its code offers us a glimpse of some of the trojan’s future features.” Doctor Web advises users to keep their antivirus software up to date and scan every file they download. The researchers warn that attackers are constantly improving the Trojans and adding new features. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Fake GitHub Security Tools)
The BBC plans to use emergency FM radio to keep the UK informed during prolonged blackouts, with a self-sufficient studio ready for 72 hours. If electricity fails across the UK for days, the BBC says it has a plan to keep people informed. David Sillito, the BBC’s media and arts correspondent, explained the strategy in a BBC News report, starting with the 2015 Lancaster floods and ending with a simple lesson: when digital infrastructure fails, FM radio may be the most reliable way to reach the public. On December 5, 2015, the River Lune flooded Lancaster, cutting electricity to 61,500 people. Roger Kemp, an engineering professor at Lancaster University specializing in safety and electrical systems, was watching television when the power went out. The following day, he described the scene to the BBC as almost resembling a zombie movie, with residents searching for phone reception and queuing at the only working telephone box. Homes lost heating and lighting, while some water supplies stopped because their pumps depended on electricity. Railway stations, petrol stations and shops closed, cash machines stopped working, and traffic lights failed. Only two communication systems remained operational: copper landlines and FM radio. Local station The Bay continued broadcasting using an emergency generator and a single landline. Kemp’s subsequent report highlighted the irony: a society increasingly dependent on digital infrastructure had relied on technologies dating back decades to receive essential information. The incident illustrated the risk of a wider catastrophe known as a Black Sky event, in which electricity, water, shops and communications fail simultaneously. At a recent UK resilience summit, discussions focused on maintaining essential services for at least 72 hours. One expression often heard in civil contingency circles, “nine meals from anarchy”, captures the concern that three days without food could turn an emergency into widespread disorder. “We are nine meals from anarchy” is a phrase often heard in the civil contingency world. A brutal reminder of the fear that three days without food would be enough to turn a crisis into chaos. If a Black Sky event takes out electricity, water, shops and communications, there is a good reason the government wants us to have our own supplies.” BBC states. “In a major emergency, we are being told to hunker down and turn on an FM radio, as thousands did in Lancaster. This is why the BBC has its own Black Sky plan.” The government’s Be Ready campaign warns that severe weather and cyberattacks could disrupt essential services, although it says there is no specific threat to the electricity grid. According to government advice reported by the Express, households should maintain at least three days of food and drinking water and keep a battery-powered FM radio. Sillito also recommends a hand-cranked radio that can generate its own power. The BBC’s contingency plan revolves around precisely this technology. Around 100 people would operate a dedicated emergency radio studio, equipped with secure communications independent of the internet, alongside enough fuel, water and food to survive at least three days without resupply. Reports published by French outlet Telesatellite and Open magazine on November 7 describe a self-contained studio, generators powering transmission facilities and FM radio as the fallback communication channel. Only a small number of BBC staff know the complete details. The studio would broadcast pre-prepared government announcements, with scripts already published online. These include practical instructions on daily water consumption and disposing of toilet waste when flushing is impossible. Additional reporting would come from satellite vehicles and journalists stationed at emergency centres across the UK. Transmission towers, disconnected from the internet, would use diesel generators and storage tanks ranging from 5 to 40,000 litres, providing approximately three days of power. Satellite phones would support communications between teams, with agreed meeting points and procedures if those systems also failed. FM radio remains central because it can reach almost everywhere, even during a major blackout or disruptive cyberattack. The BBC’s planning assumptions have evolved. An insider told Sillito that the original scenario considered outages lasting five to seven days, while the latest advice from the National Energy System Operator suggests electricity could return within two to three days. The corporation’s contingency arrangements have surfaced before. In October 2022, media reports described leaked draft scripts for a national blackout, including half-hourly Radio 4 updates from an emergency broadcasting centre at an undisclosed rural location. There is, however, a discrepancy in the Express report, which claims that only around 100 people worldwide know the full details. The BBC says approximately 100 people would operate the emergency studio, while only a small number have access to the complete plan. Concerns about grid resilience are not new, but the massive blackout affecting Spain, Portugal and south-western France in April 2025 renewed attention to the issue. Lord Harris, chair of the National Preparedness Commission, argues that the consequences extend well beyond losing electricity. Water supplies could stop because pumping stations need power, while sewage systems could become blocked when water can no longer circulate. Governments across Europe increasingly advise citizens to maintain emergency supplies, and Harris believes the UK has been slow to prepare its population. Some initiatives are already underway. ARIA, the government’s Advanced Research and Invention Agency, is investing £70 million in high-altitude aircraft designed to provide at least a week of emergency mobile and internet connectivity over the UK. Programme director Rico Chandra has warned that satellites alone have limitations when terrestrial networks fail. Harris argues that decades of efficiency-driven decisions have gradually removed essential redundancies. One example is the migration of emergency services from dedicated radio systems to mobile network technology, potentially exposing their communications to the same outages affecting the public. The government maintains that the transition to 4G and 5G provides reliable and resilient communications. “The UK has one of the most resilient electricity systems in the world, and there has never been a complete outage in the grid’s 75-year history.” The Cabinet Office states describing the UK electricity system. Government efforts to improve resilience predate the current debate. In May 2024, then deputy prime minister Oliver Dowden launched the previous Conservative government’s disaster preparedness initiative. During his investigation, Sillito also reconsidered the BBC’s isolated transmission infrastructure. What initially appeared outdated became a strength: independence from the internet could help keep broadcasting alive when digital networks collapse. Yet the UK is preparing to switch off its copper landline network on January 31, 2027, while the future of FM radio is also under review. The government’s position is that copper landlines, although useful during power cuts, have become unreliable and increasingly difficult to maintain. Kemp is less convinced that the country is moving in the right direction. Asked whether his report had improved national preparedness for a Black Sky event, he argued that the planned landline shutdown showed little consideration for how people would communicate during a prolonged power failure. Sillito experienced a smaller reminder while preparing his report: a power cut in his own street, leaking torch batteries, missing candles and an emergency radio he could not find. His conclus: “If anything, we’ve gone backwards,” he said. “Switching off the public switch telephone network, I think shows that there has been really no thought at all about how you communicate when you’ve no longer got power.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BBC)
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.
Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000 to 67,000 people and around 2,200 corporations were affected, and personal, employment, income and loan data was exposed. Hunt.io dug into the infrastructure behind the campaign, and its findings add a lot to what CrowdStrike and Genians already published. CrowdStrike reported on October 7 and Genians Security Center on October 12, and both pointed to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that a single Chinese-speaking individual motivated by money ran it, and not an established threat group. DeepSeek v4.1 Flash was the main model, with GLM 5.3 and Grok 4.6 as backups, reached partly through a reseller domain, xcai[.]pro. The public indicators were a server at 38.244.50[.]120, which hosted the ARTEX console, plus a Hong Kong address and nine proxies. Genians said the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain. “CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established threat group.” reads the report published by Hunt.io. “The infrastructure reportedly accessed these services in part through the reseller domain xcai[.]pro. Both reports described a two-server configuration, consisting of a Hong Kong-based IP address used as primary infrastructure and 38.244.50[.]120, which hosted the ARTEX console.” Hunt.io notified the relevant national CERT before publishing, and says the report holds no personal records or credentials. The company’s own scanning showed 38.244.50[.]120 sits on Cogent’s network in Los Angeles, with 15 open ports. The ARTEX login page, with a Chinese title meaning “autonomous penetration testing console”, appears on ports 443 and 8090. Other services include a Gemini2API admin console and a Tinyproxy server. Searching its AttackCapture platform for that address, Hunt.io found another open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. It held 42 files in 2 subdirectories, 105 MB in all, and the platform had logged warnings on September 5, September 26 and October 5. A file in it names 38.244.50[.]120 as the jump host, and its own comment tells the operator never to paste the credentials into a session. It sat in an open directory. Three scripts back up the link. They keep reverse SSH tunnels alive, run a local relay, and copy files to the jump host, one tunnel is named grok2api, and the credentials file also holds keys for Zhipu AI’s GLM models, an OpenAI-compatible relay and a proxy service. That explains how several language models ran in one campaign. The AI setup is the most striking part. A state file shows the harness is Claude Code itself, version 2.1.221, started 510 times since August 4, but it isn’t talking to Anthropic. A small proxy, ds-models-shim.py, fixes a compatibility problem by faking a model list and sending requests to DeepSeek, and another, xcai-effort-shim.py, adds a reasoning setting because the DeepSeek backend otherwise skips its reasoning step. The route runs from Claude Code through Claude Code Router, an open-source project, to xcai and then to DeepSeek. “A small local proxy, ds-models-shim.py, addresses a compatibility issue: the official /v1/models endpoint returns a 404 response when queried against a non-Anthropic backend, preventing Claude Code from discovering the available models. The shim intercepts that specific request and returns a locally defined model list containing deepseek-v4-pro and deepseek-flash. All other requests are forwarded to api.deepseek.com/anthropic.” states the report. The same file counts 19 custom skills, reusable instruction sets for the agent, with 147 recorded uses. They cover code audit, reconnaissance, web injection, WAF bypass testing, authentication testing, Telegram Mini Apps, APK download and decompiling, cloud phone control and payment logic testing. Next to the payment skill sat three self-registered test accounts with tokens for a cash-in deposit API, dated September 12, and a comment calls them an authorized, self-built test. The setup fits testing for insecure direct object reference flaws, a technique CrowdStrike and Genians described against Korean loan and inquiry services. The directory also held supporting tools. A script queried FOFA, a Chinese asset search engine like Shodan, through a third-party API, and a comment says the primary membership had expired and a backup key was in use. Proxy scripts enumerated a rotating proxy service at 154.201.79[.]246:443, where 79 unique exit IPs showed up among the first 100 identities tested. A separate directory at 23.248.226[.]250:8001 held a small staged setup for JNDI and LDAP exploitation, retrieved on October 5 at 03:42 UTC. It confirms command execution through a DNS callback, and one script lets web and LDAP traffic share a single port. Hunt.io’s analysis describes the tooling without publishing steps to reproduce it. Other recovered files include tools aimed at a cryptocurrency exchange’s admin session and withdrawals, Linux privilege escalation exploits, iOS probe source code and Android kernel and firmware utilities. Hunt.io says their connection to the Korean breaches isn’t confirmed. Hunt.io then showed how to hunt ARTEX servers. Searching for an ARTEX certificate issuer returned 19 IP addresses, and searching its malware classification returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Those figures show where addresses are registered, not where the operator sits. “The result returned 19 distinct IP addresses, including 38.244.50[.]120. This method is precise but limited to hosts that expose a matching certificate. Systems using a different certificate will not appear in these results.” continues the report. Matching the console’s page title returned about 1,300 IPs, and a looser search found 21 title strings, 19 of them likely ARTEX consoles, in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese. A malware-name search in AttackCapture gave 280 results with open directories. One at 130.94.31[.]86:18888 in Seoul held two small scripts, and another at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writes a file named artex_probe_11876.txt. More hosts held exploitation kits for DedeCMS and FangCMS, a CAPTCHA bypass suite, a RuoYi and Spring administrative console exploit and CAPTCHA-based login automation. Together they show the framework attracting many operators. For defenders, the advice is plain. Remove public access and put administration behind VPNs or allowlists, and reset SSH passwords and rotate API keys, proxy credentials and tokens that exposed files may have revealed. Patch internet-facing services, watch for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Also restrict access to model gateways, watch their requests, and enforce compliance rules on managed phones. Hunt.io’s lesson is that an investigation shouldn’t stop at the first list of indicators, because The company also published indicators of compromise in its analysis. “The findings highlight risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ARTEX)
Software vendors can boost revenue by tracking customer usage across products, while AI accelerates pricing and consumption decisions. It is hard to find any software vendor that sells just one product. Portfolios have expanded from modules to editions, cloud services, add-ons, and now AI capabilities. A lot can be achieved through an expanded portfolio. IDC research commissioned by Thales shows that customers with consolidated agreements “spend more, churn less, and deepen their relationship with the vendor over time.” However, there is one thing to note. Purchasing four products from the same vendor does not mean they will be treated as a single vendor, as each product has its own licensing, measurement, and sales terms. The Size of the Prize Existing customers are an obvious place to look for growth. The possible upside could be considerable. According to IDC research on software vendors from June 2026, 55% of software vendors believe that enhanced monetization would bring a 6% to 10% uplift in revenue, and 29% expect more than 10%. IDC has also linked a SaaS provider’s ability to capitalize systematically on new features and capabilities to net revenue retention and growth. Companies that excel at this see it in their valuations too. McKinsey research shows top-quartile B2B SaaS companies achieve 113% net revenue retention, growing 13% from existing customers alone, against 98% for bottom-quartile peers. Capturing that opportunity becomes harder when the commercial systems behind the portfolio cannot see across it. Sales teams may know a customer well, but they also need to know what that customer has bought, what they are entitled to use, and how much of it they are consuming. That information is what turns a general cross-sell conversation into a relevant one. Where Portfolio Revenue Leaks Away Product launches or acquisitions might occur at different times, and the business units could operate independently. With time, each one may build its own licensing approach, customer database, product catalog, and commercial model. IDC’s vendor research found that only 25% of software vendors have centralized usage data. In practice, vendors need to at least unify the entitlement system first. All of the products need to sit in one catalog before the vendor can create a bundled offer across them. Getting there can stall for technical, organizational, or budget reasons. But the reason to overcome those barriers comes back to the customer experience. A company may be optimized internally around separate product lines or business units, while customers still have to go to multiple places to access and manage products they bought from the same vendor. Customer pressure has historically forced companies to restructure and centralize around that problem. Licensing and entitlement ownership can move out of individual product lines and into a central function, such as engineering operations, product operations, supply chain operations, or SaaS operations. For that to work, the central function needs real authority rather than existing in name only. A customer could be approaching the limits of Product A while another part of the company sells Product B, which would be a logical next purchase. The usage data contains the signal, but it may sit in a system that the team responsible for Product B never sees. AI can multiply this problem quickly. Vendors no longer need to launch an entirely new application before they have something new to monetize. A new model, agent, workflow, or premium feature could all require decisions about entitlements, usage, and price. Over time, however, customers can end up with a growing collection of meters, contract terms, entitlements, and invoice lines. The vendor sees one expanding portfolio. The customer sees the work required to understand and manage it. Buyers are already feeling this pressure. IDC’s customer research found that 45% struggle to reconcile purchased licenses with actual usage, while 39% cite inflexible licensing models as a challenge. At the same time, 60% of buyers report an active drive to reduce the number of software vendors they use. Consolidating with a strategic supplier becomes much less attractive if it leaves the customer managing the same complexity under a single company name. What Unified Portfolio Monetization Enables A shared entitlement system brings products from different business units into one catalog, giving vendors a consistent view of what customers have bought and what they can use. That common foundation is what makes portfolio-wide bundles and offers possible. Vendors do not necessarily have to wait for every commercial system to be consolidated before they get there. Thales can bring third-party license generators onto one platform, while Central Migrate and Thales’s internal migration expertise and best practices support the move from existing licensing systems. Shared credits or pooled consumption can provide another option. Customers have a single balance that can be used across multiple products or capabilities. As vendors add AI features with different consumption patterns, this gives them room to introduce new capabilities without automatically introducing a standalone commercial model for each. M&A Creates Another Portfolio Opportunity The same issue appears after an acquisition. CEOs are looking for the “1+1=3” outcome: creating more value from the combined business than the two companies could separately. The acquirer can sell its portfolio to the acquired company’s customers, while the acquired company’s products can be introduced to the acquirer’s customer base. The problem is that full M&A integration can take time, particularly when ERP and ordering systems are involved. Entitlement systems can be unified much sooner and with considerably less work than a full ordering-system integration. That allows portfolio monetization to run in parallel with the heavier systems work rather than waiting for it to finish. The business can start cross-selling across the combined customer base sooner, giving leadership a way to demonstrate acquisition ROI faster. Turning Usage Into Expansion Opportunities Usage data then becomes useful beyond billing. Vendors can see which customers own Product A but not Product B, which customers are consuming, and which customers are regularly reaching the limits of their current entitlement. They can also change the renewal conversation. Actual consumption provides a much stronger basis for discussing the next contract than assumptions made when the previous agreement was signed. It shows what customers are using heavily, what they are barely touching, and where there may be a natural opportunity for upselling and cross-selling. Buyers appear open to this kind of consolidation. IDC found that 86% are somewhat and extremely interested in a single licensing agreement covering multiple products from the same vendor. Runaway costs are the biggest concern around vendor consolidation, cited by 74%, followed by lack of flexibility at 62% and lack of transparency at 59%. Those concerns put some useful boundaries around portfolio monetization. Bringing more products into one commercial relationship needs to make them easier for the customer to understand and manage. Visibility into consumption, clear entitlements, and controls over spend become more important as the portfolio grows. Making a Larger Portfolio Easier to Buy AI is likely to keep adding features, agents, models, and new forms of consumption to software portfolios. Portfolio growth works better when the entitlement system cuts across product and business-unit silos. Customers can see what they own, understand what they are consuming, and use more of the vendor’s products without having to navigate a new commercial process each time. The IDC report shows that buyers already want greater flexibility, visibility, and control. The opportunity for vendors is to make expansion across the portfolio easier to buy and manage, even as the underlying technology becomes more complex. About the Author: Manoj Tharakan is Director of Product Management, CDI, at Thales, where he works on software licensing, SaaS billing, and monetization. With over 20 years across software licensing, SaaS billing, and monetization, he’s helped build the systems vendors rely on to actually get paid for the value they create. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems. The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected. Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets. Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier. According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards.
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
Confirm this action.
Leaving now will discard your changes.