Here are today’s top cybersecurity stories for Tuesday, October 27, 2026.
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
The Australian Signals Directorate gained access to the Amadey operation’s backend and cut its controller off from about 180,000 infected computers worldwide. ESET identified 53 separate Amadey botnets with no shared infrastructure. Sold as a service since 2018, Amadey mainly installs other malware such as the StealC infostealer. The Hacker News
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Enclave published details of CVE-2026-80097, a CVSS 8.6 flaw in Microsoft Authenticator for Android. A malicious app posing as Teams obtained Microsoft Graph tokens for mail, files, and calendars. Microsoft fixed the flaw in version 6.2606.4246, says it saw no exploitation, and disputes Enclave’s claim of no user interaction. The Hacker News
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Arctic Wolf Labs reports hundreds of cases in which attackers use Teams external chat with fake IT support identities. Victims receive a mail bomb, then a call, then install a remote access tool. Arctic Wolf links the activity to the STAC4749 cluster and Chaos ransomware. The Hacker News
Warp Discloses Breach Exposing AI Agent Logs and User Telemetry Data
Warp says an attack on a third-party vendor exposed agent decision logs and telemetry for roughly 1 percent of its users. The platform has at least 800,000 users. Warp has not said whether source code, prompts, or credentials were exposed, and it engaged CrowdStrike and informed law enforcement. BleepingComputer
Energy Giant ENGIE Discloses Data Breach Affecting Customers
Attackers stole customer data after breaching a marketing platform used by ENGIE’s business partners. ENGIE says its internal systems were not compromised and the incident is limited to customers in France. Exposed data includes names, contact details, meter identifiers, and contract numbers, but no banking data. BleepingComputer
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
Xint showed OpenAI’s compaction step returned a model’s hidden reasoning in readable form when asked to copy it word for word. OpenAI fixed the problem on October 23 and paid a $6,000 reward. Only gpt-5.6-sol was tested, and Xint saw no attacks in the wild. The Hacker News
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Authentication Weaknesses
CERT-UA warns of unauthorized access to Dahua cameras and recorders through the Easy4IP peer-to-peer service. Serial numbers follow a predictable pattern, which allows brute-force guessing without lockouts. CERT-UA advises disabling P2P, keeping devices off the internet, and updating firmware. The Hacker News
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
The University of New Mexico Health System sent ambulances to other hospitals and canceled appointments at more than 30 clinics. Employees reported messages on their computers claiming student, employee, and patient data was stolen. The health system calls it an active law enforcement investigation. SecurityWeek
CISA Publishes Strategy With Eye on the Next Four Years
CISA released “CISA 2030: Defend, Harden, Prevail,” a 10-page strategy built on three pillars. The agency will review core services within 60 days and implement changes over 180 days. Acting Director Nick Andersen urged critical infrastructure owners, operators, and vendors to act now. CyberScoop
Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
The Blue Initiative database indexes about 30,000 IT and OT vulnerabilities relevant to ships and ports. It lists more than 580 vulnerabilities known to be exploited and 37 affecting maritime-specific products. Cydome, ClassNK, Bureau Veritas, MTS-ISAC, and Rakuten Maritime launched it. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
