Over two million updates were distributed by Dutch cybersecurity firm Eye Security between November 2025 and March 2026 to disable a vulnerable background updater related to a discontinued version of the Popcorn Time streaming application ‘Time4Popcorn’. This could have allowed attackers to gain control of the computers and possibly add to a botnet. Eye discovered the vulnerability during regular threat hunting operations. They noticed a client was regularly trying to connect to an unregistered domain.  Once registered they began receiving around 50 requests per second. Their investigation into the issue, called Operation IXIM, was presented at the Hack.lu conference on October 22. Eye were able to collect over 3.8 million unique device IDs. These were not a reliable way to determine how many devices were affected so they have estimated 2.5 – 3 million Windows machines and 250,000 – 350,000 Macs were impacted.  The background updater would automatically start when the computer booted up. It would check for updates over an unencrypted connection and install any software it received without checking where it came from. It also ran with full permissions on the device (SYSTEM on Windows and root on macOS). Anyone who registered a domain that the updater was still connecting to could potentially deliver malicious code. The vulnerability, tracked as CVE-2026-30612, has been given a severity score of 9.8/10 by the U.S.  Cybersecurity and Infrastructure Security Agency. It affects Windows versions up to 6.2.1.18, macOS versions up to 6.2.1.17 and Android versions up to 3.5.0.173. As there was no company to provide a patch, Eye sought legal advice. They delivered an update using the background updater to stop and disable the service. No files were deleted or data collected. Some antivirus products flagged the update so it was adjusted to improve delivery. Over one million systems were updated by December 2025. Traffic to the controlled domains dropped by around 90%.  By March 1st the number of deliveries per day had dropped to around 5,000 meaning a 98% reduction. Eventually Eye stopped distributing updates as they had over two million downloads. In late March 15 domains were handed over to the non-profit group Shadowserver Foundation. 17 of the 20 domains listed in the report were pointing to Shadowserver. 3 were not under their control. Some of the services could not resolve 14 of the sinkholed domains correctly due to issues with DNSSEC validation.  There was no evidence to suggest any third parties had delivered code via the domains. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities Catalogue as of October 23. Eye have warned that even with the background updater disabled Popcorn Time is not secure. As it uses an old browser engine with the sandbox disabled, unencrypted connections and code from other abandoned domains we recommend uninstalling it.  Users on Windows and Mac can disable the background updater manually, however on Android it will need to be uninstalled as the background updater cannot be disabled. Network defenders can look for Updater.exe on Windows, PT.updd on Mac and traffic to the domains listed in the report.

 Cybersecurity researchers have uncovered an espionage operation targeting defense-related organizations in Europe, including a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency. The campaign has been attributed to APT28, a hacking group associated with Russia’s military intelligence agency, the GRU. According to cybersecurity firm Symantec, the affected organizations were located in two NATO member countries, although their identities and locations have not been disclosed.  The operation relied on a backdoor called Hookedge, which enables attackers to access compromised systems, collect login credentials and investigate internal networks. The malware was documented by Recorded Future’s Insikt Group in August, adding to concerns about the group’s continued efforts to obtain information from strategically important organizations.  One documented intrusion began in July after an employee at a naval shipbuilding company opened a malicious Microsoft Word document delivered through an email attachment. Following the initial compromise, the attackers began examining the organization’s internal network and attempting to obtain credentials that could help them access additional resources.  The activity continued over the following weeks. Investigators found that the hackers repeatedly revisited an infected computer and introduced a previously undocumented tool capable of decrypting and executing malicious code directly in system memory. Researchers have not yet determined the tool’s ultimate purpose, leaving questions about the full scope of the operation unanswered.  The first confirmed infection was recorded on July 24, while associated malicious activity continued to appear as late as September 24. This indicates that the campaign extended across at least two months. However, researchers could not confirm whether the attackers maintained continuous access to the compromised environment throughout that period. Symantec intelligence analyst Dick O’Brien told Recorded Future News that investigators were unable to establish whether sensitive information had been successfully exfiltrated. Nevertheless, the nature of the affected organizations suggests that defense-related intelligence may have been a primary objective. O’Brien noted that prolonged access could have provided attackers with opportunities to collect valuable information. The selection of targets also points toward a wider intelligence-gathering effort involving European government and defense interests. The continued activity observed in September, after the campaign was documented in August, suggests that the operation may still be underway.  APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard, has conducted cyber-espionage operations against military, government and defense organizations across Europe and North America for more than a decade. The group attracted international attention in 2016 following its association with the hacking of the Democratic National Committee ahead of the U.S. presidential election. Western cybersecurity agencies have repeatedly linked the group to operations involving defense infrastructure, military logistics and organizations supporting Ukraine.  In April, British security officials warned that APT28 had exploited internet router vulnerabilities to redirect web traffic and conduct surveillance. Other reported campaigns have targeted maritime, transportation and diplomatic organizations in Poland, Slovenia, Turkey, Greece and the United Arab Emirates. Last year, more than 20 Western intelligence and cybersecurity agencies jointly warned that the group had targeted logistics providers and technology companies involved in delivering foreign assistance to Ukraine. The latest findings add to continuing concerns about cyber-espionage against organizations connected to European defense and security.

 A major data leak from Sydney Tools, an Australian retailer specializing in power tools, hand tools, and industrial equipment, has potentially exposed the personal information of millions of customers and employees. The breach, discovered by cybersecurity researchers at Cybernews, involved an unprotected Clickhouse database that remained publicly accessible online, allowing unauthorized individuals to view sensitive data.   According to the report, the database contained more than 5,000 records related to Sydney Tools employees, including both current and former staff. These records included full names, branch locations, salary details, and sales targets. Given that Sydney Tools reportedly employs around 1,000 people, a large portion of the exposed records likely belong to individuals who no longer work for the company. While no banking details were included in the leak, the exposure of employee information still poses a significant security risk.  Cybercriminals could use these details to craft convincing phishing scams or for identity theft. Beyond employee data, the breach also exposed an even larger volume of customer information. The database reportedly contained over 34 million online purchase records, revealing customer names, email addresses, phone numbers, home addresses, and details of purchased items. The exposure of this information is particularly concerning, as it not only compromises privacy but also increases the risk of targeted scams.  Customers who purchased expensive tools and equipment may be especially vulnerable to fraud or burglary attempts. Cybernews researchers have expressed serious concerns over the extent of the breach, highlighting that the database includes a mix of personally identifiable information (PII) and financial details. This kind of information is highly valuable to cybercriminals, who can exploit it for various fraudulent activities. The researchers attempted to notify Sydney Tools about the security lapse, urging them to secure the exposed database.  However, as of their last update, the data reportedly remained accessible, raising further concerns about the company’s response to the issue. This incident underscores the ongoing risks posed by unprotected databases, which continue to be one of the leading causes of data breaches. Companies handling large volumes of customer and employee information must prioritize data security by implementing robust protection measures, such as encryption, multi-factor authentication, and regular security audits. Failing to do so not only puts individuals at risk but also exposes businesses to legal and reputational damage.  With cybersecurity threats on the rise, organizations must remain vigilant in safeguarding sensitive information. Until Sydney Tools secures the database and provides assurances about how it will handle data protection in the future, customers and employees should remain cautious and monitor their accounts for any suspicious activity.