Security news weekly round-up - 16th October 2026

As an internet user with good intentions, when you go online, you try to achieve your tasks as fast as possible, even if you have to submit your personal data. That means when those sites gets breached, you no longer know who has your data. Also, you might think hacking refrigerators is a thing meant for the movies. Well, not anymore.

What to do when a data breach notice doesn't say much

I don't think anyone can say that they are immune to a data breach. One of the takeaways from this article is how to understand terms used in data breach email notifications. Also, it serves as a guide to anyone if you ever fall victim.

From the article:

The language used in a breach notification can be confusing. If it says your data was “accessed” it doesn’t necessarily mean it was actually stolen (i.e., “exfiltrated”). And just because a breached company claims they have seen “no evidence of misuse” there’s absolutely no guarantee that this is true. What they see and what’s actually happening on the cybercrime underground can be two very different things.

AI researcher warns cyberattacks could take down power, banking and water within a year — here's how to prepare

The warning came after attackers hacked the refrigerating systems of stores in France, causing food to spoil.

From the article:

Cyberattacks against critical infrastructure aren't new. The concern is that now AI systems are becoming more capable to the point that they could make certain attacks faster, cheaper and easier to scale.

AI tools can already assist with analyzing software, identifying vulnerabilities and automating parts of cybersecurity research. Those same capabilities could potentially help malicious actors find weaknesses across large numbers of connected systems.

Apate sends AI agents undercover to get scammed so they can gather fraud intelligence

From a reader's perspective, it sounds funny that scammers are wasting their time talking to AI Agents. From the scammers' POV, they will think that they are about to get a victim without knowing that they are talking to something designed to waste their time.

From the article:

It’s a curious evolution of scam-baiting, but it’s not so surprising given how much AI has empowered scammers and hackers. The FBI received more than 22,000 complaints of AI-related crimes in 2025, which resulted in about $893 million in losses. More than $632 million of that came from investment scams

The Dark Web Isn’t Someone Else’s Problem. It Could Be Yours

One of the best articles that I have read in recent times. Don't get me wrong; my personal preference for it is not the sole purpose why I included it. It's the information contained. Where do I even start? I don't know. If you know what the Dark Web is already, this should serve as a revision for you. If you don't, it's an eye-opener.

For real? Yes, for real. Starting with the following excerpt:

Adding to the confusion is the "deep web," a name that makes your inbox sound considerably more sinister than it is. The term covers content that ordinary search engines don't index, including your email and online bank statements.

You already use that part of the web in a regular browser. The names sound like successive levels in a video game, but you don't pass through your checking account on the way to a criminal marketplace.

Fake CAPTCHAs are tricking users into running malware on their own devices

You might have confidence that you will never fall victim to this kind of attack. Yes, that can be true. But guess what? Not everyone is computer literate. And for you and me to be reading this article, it means people still fall for this attack. One of the ways to stay safe from this attack, is to be wary of emails that tell you to open a file, and you are prompted with a CAPTCHA.

From the article:

An attack may begin with an email asking the recipient to review a document, invoice, contract, or file. The link opens a CAPTCHA page that presents verification as a requirement for accessing the content.

Completing the check may lead to a counterfeit Microsoft 365 login page designed to steal credentials. Other campaigns trigger malware downloads or ask users to enable browser notifications, allowing attackers to send further malicious content.

Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

It's really scary when you think about it. You installed an application and you have that trust that it's legit. Unknowingly to you, at a later time, you are running a trojanized copy. The damage can be beyond comprehension.

From the article, here is a bit of information about the Remote Access Trojan (RAT).

The Hirudo payload currently targets eight Indonesian banking apps. Internal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand. The malware detects the specific Indonesian banking app in use on the device, displays a fake update prompt and proceeds to uninstall the true app and download its own modified bank-specific replacement.

Credits

Cover photo by Debby Hudson on Unsplash.

That's it for this week, and I'll see you next time.