A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. 37-year-old Patrick Steven Yaroch worked on a national security investigative squad at the FBI Boston Division (FBI BS) from 2017 to 2025, and as a supervisory special agent in the FBI Headquarters (FBIHQ) Counterintelligence and Espionage Division (CED) between February 2025 and July 2026. He was arrested on July 31 at his residence after self-reporting the crypto theft to Department of Justice (DOJ) National Security Division (NSD) and FBIHQ employees on July 29. The FBI fired Yaroch on July 31, 2026, after first placing him on administrative leave on July 29. Yaroch pleaded guilty on Thursday to wire fraud and money laundering charges, admitting that he used passphrases (obtained from the FBI's case management systems and another platform used to share investigative data) to transfer funds from the cryptocurrency wallets of fraud victims or suspects under FBI investigation to his own wallets.
Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs. Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals. The researchers discovered that more than 2,000 PCs were infected. “The attackers behind these compromised development projects target blockchain game enthusiasts and (most intriguingly) …information security professionals.” reads the report. “At the time of Doctor Web’s research into this matter, more than 2,000 PCs were infected.” The campaign started two years ago with Visual Studio projects related to blockchain games, game bots and cheats. The attackers targeted people who used crypto wallets. They hid malicious code in project files, including commands that ran before a project was built and PowerShell commands stored in configuration files. They even provided instructions on how to install Visual Studio and download the projects from GitHub, making it easy for people with limited technical knowledge to use them. Now the attackers are targeting cybersecurity professionals. Their new GitHub projects claim to offer tools for automated scanning, security testing and log analysis. Doctor Web found one that pretends to analyze and clean results from the Fscan security scanner. The attackers also hide malicious code in Python and Go files, using large blocks of blank spaces to make it harder to spot. Some of these fake security tools even remove the antivirus software installed on the victim’s computer. Once a victim opens the project, a PowerShell script runs and contacts the attackers’ servers and legitimate platforms, including YouTube, Telegram, Google Docs, GitCode and Pastebin. An encrypted string it retrieves holds a link to an archive, which unpacks into a folder disguised as a Windows Photos component. Its main program is Microsoft.exe, a modular app built with the Electron framework. It does most of the damage. The loader collects system information and sends it to a Telegram bot, keeps itself running, raises its privileges, and turns off Windows Defender, UAC, System Restore and shadow copies. It also adds its own Defender exclusions, injects code into legitimate processes, and removes McAfee, ESET and Malwarebytes antivirus products. Its default mode, called Mode3, stacks several evasion tricks. It fakes its parent process, disables Smart App Control, removes security software hooks from ntdll.dll, makes direct system calls, and patches event tracing and antivirus script scanning in memory. If that fails, Mode2 takes over, adding Defender exclusions and injecting through PowerShell. Three payloads follow. AsyncRAT, a remote access backdoor, runs as two identical copies on different ports, which probably lets two operators control one device. A clipper swaps crypto wallet addresses in the clipboard while taking screenshots, and a stealer takes browser data, FileZilla, MobaXterm and Total Commander configs, VPN settings, messenger files, game accounts and Discord tokens. Everything is zipped and sent through Telegram, and the malware edits the hosts file to block antivirus vendors’ domains. The attackers are still developing the malware. Doctor Web found an unfinished component that could install itself as a system service, download Microsoft.exe again if someone deletes it, manage startup and install updates. “Attackers are constantly updating the Trojans to introduce new features. For example, Doctor Web’s researchers discovered certain unused routines that facilitate downloading and decompressing yet another archive—Lodge.7z.” concludes the report. “It contains an Electron project that hasn’t been completed yet. The executable file’s name is WUDFHost.exe. Its code offers us a glimpse of some of the trojan’s future features.” Doctor Web advises users to keep their antivirus software up to date and scan every file they download. The researchers warn that attackers are constantly improving the Trojans and adding new features. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Fake GitHub Security Tools)
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week. The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login. The researchers are highly confident that the attacker is a single person
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty. According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026. If proven guilty, the
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used.
Software vendors can boost revenue by tracking customer usage across products, while AI accelerates pricing and consumption decisions. It is hard to find any software vendor that sells just one product. Portfolios have expanded from modules to editions, cloud services, add-ons, and now AI capabilities. A lot can be achieved through an expanded portfolio. IDC research commissioned by Thales shows that customers with consolidated agreements “spend more, churn less, and deepen their relationship with the vendor over time.” However, there is one thing to note. Purchasing four products from the same vendor does not mean they will be treated as a single vendor, as each product has its own licensing, measurement, and sales terms. The Size of the Prize Existing customers are an obvious place to look for growth. The possible upside could be considerable. According to IDC research on software vendors from June 2026, 55% of software vendors believe that enhanced monetization would bring a 6% to 10% uplift in revenue, and 29% expect more than 10%. IDC has also linked a SaaS provider’s ability to capitalize systematically on new features and capabilities to net revenue retention and growth. Companies that excel at this see it in their valuations too. McKinsey research shows top-quartile B2B SaaS companies achieve 113% net revenue retention, growing 13% from existing customers alone, against 98% for bottom-quartile peers. Capturing that opportunity becomes harder when the commercial systems behind the portfolio cannot see across it. Sales teams may know a customer well, but they also need to know what that customer has bought, what they are entitled to use, and how much of it they are consuming. That information is what turns a general cross-sell conversation into a relevant one. Where Portfolio Revenue Leaks Away Product launches or acquisitions might occur at different times, and the business units could operate independently. With time, each one may build its own licensing approach, customer database, product catalog, and commercial model. IDC’s vendor research found that only 25% of software vendors have centralized usage data. In practice, vendors need to at least unify the entitlement system first. All of the products need to sit in one catalog before the vendor can create a bundled offer across them. Getting there can stall for technical, organizational, or budget reasons. But the reason to overcome those barriers comes back to the customer experience. A company may be optimized internally around separate product lines or business units, while customers still have to go to multiple places to access and manage products they bought from the same vendor. Customer pressure has historically forced companies to restructure and centralize around that problem. Licensing and entitlement ownership can move out of individual product lines and into a central function, such as engineering operations, product operations, supply chain operations, or SaaS operations. For that to work, the central function needs real authority rather than existing in name only. A customer could be approaching the limits of Product A while another part of the company sells Product B, which would be a logical next purchase. The usage data contains the signal, but it may sit in a system that the team responsible for Product B never sees. AI can multiply this problem quickly. Vendors no longer need to launch an entirely new application before they have something new to monetize. A new model, agent, workflow, or premium feature could all require decisions about entitlements, usage, and price. Over time, however, customers can end up with a growing collection of meters, contract terms, entitlements, and invoice lines. The vendor sees one expanding portfolio. The customer sees the work required to understand and manage it. Buyers are already feeling this pressure. IDC’s customer research found that 45% struggle to reconcile purchased licenses with actual usage, while 39% cite inflexible licensing models as a challenge. At the same time, 60% of buyers report an active drive to reduce the number of software vendors they use. Consolidating with a strategic supplier becomes much less attractive if it leaves the customer managing the same complexity under a single company name. What Unified Portfolio Monetization Enables A shared entitlement system brings products from different business units into one catalog, giving vendors a consistent view of what customers have bought and what they can use. That common foundation is what makes portfolio-wide bundles and offers possible. Vendors do not necessarily have to wait for every commercial system to be consolidated before they get there. Thales can bring third-party license generators onto one platform, while Central Migrate and Thales’s internal migration expertise and best practices support the move from existing licensing systems. Shared credits or pooled consumption can provide another option. Customers have a single balance that can be used across multiple products or capabilities. As vendors add AI features with different consumption patterns, this gives them room to introduce new capabilities without automatically introducing a standalone commercial model for each. M&A Creates Another Portfolio Opportunity The same issue appears after an acquisition. CEOs are looking for the “1+1=3” outcome: creating more value from the combined business than the two companies could separately. The acquirer can sell its portfolio to the acquired company’s customers, while the acquired company’s products can be introduced to the acquirer’s customer base. The problem is that full M&A integration can take time, particularly when ERP and ordering systems are involved. Entitlement systems can be unified much sooner and with considerably less work than a full ordering-system integration. That allows portfolio monetization to run in parallel with the heavier systems work rather than waiting for it to finish. The business can start cross-selling across the combined customer base sooner, giving leadership a way to demonstrate acquisition ROI faster. Turning Usage Into Expansion Opportunities Usage data then becomes useful beyond billing. Vendors can see which customers own Product A but not Product B, which customers are consuming, and which customers are regularly reaching the limits of their current entitlement. They can also change the renewal conversation. Actual consumption provides a much stronger basis for discussing the next contract than assumptions made when the previous agreement was signed. It shows what customers are using heavily, what they are barely touching, and where there may be a natural opportunity for upselling and cross-selling. Buyers appear open to this kind of consolidation. IDC found that 86% are somewhat and extremely interested in a single licensing agreement covering multiple products from the same vendor. Runaway costs are the biggest concern around vendor consolidation, cited by 74%, followed by lack of flexibility at 62% and lack of transparency at 59%. Those concerns put some useful boundaries around portfolio monetization. Bringing more products into one commercial relationship needs to make them easier for the customer to understand and manage. Visibility into consumption, clear entitlements, and controls over spend become more important as the portfolio grows. Making a Larger Portfolio Easier to Buy AI is likely to keep adding features, agents, models, and new forms of consumption to software portfolios. Portfolio growth works better when the entitlement system cuts across product and business-unit silos. Customers can see what they own, understand what they are consuming, and use more of the vendor’s products without having to navigate a new commercial process each time. The IDC report shows that buyers already want greater flexibility, visibility, and control. The opportunity for vendors is to make expansion across the portfolio easier to buy and manage, even as the underlying technology becomes more complex. About the Author: Manoj Tharakan is Director of Product Management, CDI, at Thales, where he works on software licensing, SaaS billing, and monetization. With over 20 years across software licensing, SaaS billing, and monetization, he’s helped build the systems vendors rely on to actually get paid for the value they create. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems. The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected. Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets. Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier. According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
Confirm this action.
Leaving now will discard your changes.