🔍 Read the full analysis: AI Security Watch: A Blank PDF, Banking Malware And Stolen Tokens on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A six-story security roundup published October 29 highlights Fortinet updates and an active campaign targeting firewall credentials, along with Android banking malware, a backdoor delivered through a blank PDF, and stolen work-account tokens. Researchers and agencies describe the findings; some counts come from security companies, and the incidents do not establish that every exposed device or account was compromised.
A security roundup published October 29 highlights an active campaign targeting Fortinet firewall credentials, new Android banking malware, a backdoor delivered through a blank PDF and a flaw that exposed Microsoft work-account tokens. The six developments matter to businesses and individual users because they affect network access, banking credentials and workplace logins; some reported figures are counts by security firms, not confirmed totals of victims.
The FBI and U.S. Secret Service said on October 6 that the FortiBleed campaign remained active. Their joint advisory cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. According to the roundup, attackers reuse previously leaked passwords, try weak credentials and target password files. The agencies named ransomware groups INC/Lynx and Payload as buyers of access. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the activity to reused credentials and password guessing against devices with weak passwords and no second factor.
Fortinet released security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, covering critical and high-severity issues. The company said public advisories would follow on November 10. Separately, Hudson Rock reported analyzing 1,703 configuration reports from 1,689 devices and finding 40,573 records containing plaintext passwords. Those are records, not a count of people or confirmed active accounts; the report marked 7,437 local accounts as disabled.
Other findings included an Android crime kit called MR ROBOT, which CloudSEK said criminals rent to create fake banking apps that capture one-time codes and forward calls; and a Trellix-reported backdoor hidden in a blank PDF disguised as a FedEx tax invoice. Trellix said the PDF depended on a user approving a reader warning. Researchers also reported that another Android app could obtain Microsoft Authenticator login tokens for a work account; Microsoft has fixed the flaw, identified as CVE-2026-80097. Cequence, meanwhile, tracked a scanner using about 32 false AI-bot identities to seek password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls, Phones and Logins
The findings show how attackers can target different points in the same chain of access: internet-facing firewalls, mobile banking apps, workplace authentication and exposed files. A stolen firewall credential can provide a route into a company network, while a stolen one-time code or work token may let an attacker impersonate a user. The reported methods do not rely on a single new software flaw: the roundup describes reused passwords, weak security settings, social engineering and trust between apps.
For organizations, the practical consequence is that patching alone may not address every risk. Fortinet’s updates need attention, but administrators also need to check for reused credentials, unauthorized accounts and exposed configuration backups. For individuals, installing apps only from trusted sources and treating unexpected permission or warning prompts carefully can reduce exposure. These actions are general precautions, not proof that any particular device has been affected.
The roundup also points to a prioritization problem for security teams. CISA set a three-day remediation deadline for U.S. federal agencies addressing PHP2Shell, while the report says a critical Gotenberg flaw with 1,358 recorded attack attempts in 30 days did not appear on CISA’s Known Exploited Vulnerabilities catalog. That attempt count is attributed to VulnCheck; the source does not establish that the attempts succeeded.
Popular right now
Roborock F25 Ultra Steam Wet Dry Vacuum Mop
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
KitchenAid Classic Series 4.5 Quart Tilt-Head Stand Mixer K45SS, Onyx Black
As an affiliate, we earn on qualifying purchases.
How the Six Findings Connect
The roundup draws from The Hacker News’ October 29 weekly digest, which contained 30 stories. Its author selected six, then consulted original advisories or research reports where available. The selection spans two themes: threats to company-facing systems and attacks on personal or workplace devices. This is a curated report, not a claim that the six incidents are linked or that they represent every major security development that week.
FortiBleed was first described in the source material as a campaign using credentials and configuration data, rather than a newly disclosed Fortinet software vulnerability. The FBI and Secret Service issued their warning on October 6; Hudson Rock published additional analysis on October 27. Fortinet’s October 22 updates are a separate development involving security flaws in several products. The public details of those advisories were scheduled for November 10, leaving customers with the update notice before the full technical descriptions.
The mobile and document findings were reported later in October: Enclave on October 23 and Microsoft on the Authenticator issue, Trellix on October 26, and CloudSEK and Cequence on October 28. The roundup also notes that CISA’s KEV catalog is a tool for prioritizing known exploited vulnerabilities, not a complete inventory of every flaw that may be under attack.
“FortiBleed is not a new Fortinet vulnerability.”
— Fortinet
What the Reports Do Not Establish
The available material does not identify how many organizations or individuals were affected by each finding, or how many reported attack attempts led to successful access. The FortiBleed figure cited from SOCRadar concerns devices it verified as compromised; Hudson Rock’s separate figures concern records in configuration reports and should not be treated as a victim total. The status of the listed accounts varies, and some were marked disabled.
Full public technical details for Fortinet’s October 22 updates were scheduled for November 10, so the source material does not give the vulnerabilities’ identifiers or explain which systems are affected by each one. It also does not say how many users encountered the blank PDF, how widely MR ROBOT has been deployed, or whether the token-theft flaw was exploited before Microsoft fixed it. The roundup describes Cequence’s scanner activity but does not report confirmed theft from the systems it queried.
Patch Updates and Incident Checks
Fortinet customers should apply the updates relevant to FortiOS, FortiManager and FortiAnalyzer and review the company’s advisories when the promised public details are released on November 10. Administrators should also check for unfamiliar firewall administrator accounts, replace reused or weak credentials, enable multifactor authentication where available and protect configuration backups that may contain passwords.
Android users and organizations should install available updates, review banking and authentication apps, and be cautious about unexpected documents and permission requests. Security teams can use CISA’s KEV catalog as one input to patch planning, while checking other credible threat reporting rather than treating the catalog as a complete list of active risks. The source material does not provide a confirmed schedule for further findings on the banking kit, PDF backdoor or scanner activity.
Key Questions
What is the main development in this security roundup?
The October 29 report brings together six recent security findings, including an active campaign targeting Fortinet firewall credentials, Android banking malware and a fixed flaw that could expose Microsoft work-account tokens.
Does FortiBleed exploit a newly disclosed Fortinet vulnerability?
Fortinet says it does not. The company attributed the campaign to reused credentials and password guessing, while the FBI and U.S. Secret Service warned that the activity was still running.
Were 40,573 people affected by exposed firewall passwords?
No. Hudson Rock reported 40,573 password-containing records in its analysis of configuration reports. The roundup says records are not people or necessarily active accounts, and notes that some local accounts were disabled.
What should Fortinet customers do?
Apply the relevant security updates for FortiOS, FortiManager and FortiAnalyzer, then review Fortinet’s public advisories when they are released. Administrators should also review firewall accounts and credential practices, since the FortiBleed campaign described in the report involves stolen or weak passwords.
Has Microsoft fixed the Authenticator token issue?
The source material says Microsoft fixed the Android flaw identified as CVE-2026-80097. It does not state how many users were affected or whether attackers exploited it before the fix.
Source: ThorstenMeyerAI.com
