Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. ‘It’s 100 percent a national security threat’: Accenture contractor connected an AI agent to the Pentagon’s secure network, and then sent data to a high-risk website Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace UK and Germany to jointly develop military AI in 2027 Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer AI policy wonks declare ‘sovereign agents’ a threat to civilization Progress on provable inference for large language models The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources “Black October” for AI Developer Platforms ARTEX Exposed: Mapping the Infrastructure Behind the South Korean Bank Breaches A thousand fewer paths to root Securing Muse: More Than $1 Million in Bug Bounties Paid Out Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles WorkOS October 30th, 2026 Data Security Incident Covert underperformance on safety research tasks GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
French Bank Crédit Mutuel Arkéa says hackers exploited a service provider to steal up to $133 million using the bank’s own account. French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that let attackers make fraudulent transactions of up to $133 million, forcing it to suspend certain systems. Crédit Mutuel Arkéa is a major French cooperative banking and insurance group headquartered in Brest, Brittany, France. The bank says the attacker used its own account to send transactions to other banking organizations, and that customer assets weren’t affected. “French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist and it was working to try to recover the money, in a rare case of cybercriminals successfully stealing from a mainstream bank.” Reuters states. Blockchain researcher ZachXBT first warned of a large unauthorized withdrawal from multiple centralized exchange accounts a day earlier. He said the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as the USDC and USDT stablecoins. “Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.” ZachXBT wrote. “While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.” The attacker remains unidentified, but ZachXBT believes it is highly unlikely to be Lazarus Group, based on money-laundering patterns. According to BleepingComputer, the expert pointed out that the lack of public disclosure allowed attackers to launder $30 million by November 3, potentially preventing EU authorities from freezing the funds. The Paris prosecutor’s cybercrime unit opened an investigation after receiving a complaint from Crédit Mutuel Arkéa, with France’s cybercrime police leading the probe. Arkéa disclosed the incident on November 4, saying it was contained, customer assets were unaffected and some transfers had been delayed. Attackers reportedly accessed the bank through a service provider’s platform, not Fortuneo, and used Arkéa’s own account to move funds through other banks and convert them into cryptocurrency. The bank also warned customers about increased phishing risks. “Crédit Mutuel Arkéa announces that it has been the target of an attack that enabled the execution of fraudulent transactions.” reads the notice published by the bank. “Upon detecting this attack, and in accordance with standard procedures, the Group contacted the relevant regulatory and supervisory authorities to inform them of the situation.” “This incident is now closed and fully under control. Operations are gradually resuming this morning, following thorough verification by the Group and its subsidiaries and the implementation of enhanced security measures.” Crédit Mutuel Arkéa says customer assets were unaffected, although some transfers were delayed. The bank maintains its financial stability, warns of possible phishing attempts and urges customers not to share sensitive information. Its teams are assessing the incident and strengthening security measures, with further updates expected. Arkéa did not confirm ZachXBT’s reported figure but acknowledged significant losses and said some funds were blocked. The bank ruled out internal human error, described the incident as a sophisticated attack and is working with law enforcement to identify the attackers and establish how the breach occurred. When the FAQ asked whether 118 million euros had been stolen, Arkéa wouldn’t give a number: We do not confirm this information and can only validate the order of magnitude. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Crédit Mutuel Arkéa)
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems. The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected. Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets. Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier. According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards.
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System appeared first on Unit 42.
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. The company announced the model on Thursday, saying it significantly improves on earlier AI models in finding software vulnerabilities, validating their impact, and helping developers create fixes. During security testing, GPT-6 Cyber discovered 81 previously unknown high-severity vulnerabilities in Firefox and helped develop patches, many of which Mozilla has already released. In separate Linux kernel research, the model identified 2,308 potential security flaws, successfully reproduced 1,724 vulnerabilities, and developed local privilege escalation exploits for 948 distinct vulnerabilities that could allow an unprivileged user to gain root access.
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis. Researchers at cybersecurity company Dr. Web found that more than 2,000 Windows systems have been compromised so far. One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner. Previous lures included blockchain games, bots, and cheat tools, typically targeting blockchain and game enthusiasts. Dr. Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
Confirm this action.
Leaving now will discard your changes.