🔍 Read the full analysis: AI Security Risks This Week: Firewalls, Banking Trojans And Tokens on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A roundup dated October 29 identifies six security developments, including an active campaign targeting Fortinet firewall credentials, a rented Android banking fraud kit and a fixed Microsoft Authenticator issue. The reporting draws on vendor and researcher findings; some figures are company counts, and several technical details remain unpublished.
A security roundup published October 29 highlights six risks affecting business firewalls, Android banking users, workplace authentication and exposed software, including an active campaign against Fortinet devices and a rented mobile banking trojan. The report, based on advisories and research from security agencies and companies, says organizations should prioritize firewall security updates and account protection while checking their software exposure.
The FBI and U.S. Secret Service warned on October 6 that the FortiBleed campaign targeting Fortinet firewalls remained active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices in 194 countries. The campaign uses previously exposed or weak credentials, according to the source material; attackers can then create administrator accounts and sell access. The agencies named ransomware groups INC/Lynx and Payload as buyers. Fortinet says the activity does not exploit a new Fortinet vulnerability.
Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, covering critical- and high-severity issues. The company said public advisories would follow on November 10. Separately, CloudSEK reported on October 28 that an Android crime kit called MR ROBOT is rented to criminals and can be used to make fake bank apps that steal one-time codes and forward calls. Trellix said an empty PDF disguised as a FedEx tax invoice was used to deliver a backdoor, with the attack requiring a user to accept a PDF reader warning.
Researchers at Enclave reported that another Android app could obtain workplace login tokens from Microsoft Authenticator under a specific scenario; Microsoft has issued a fix, identified as CVE-2026-80097. Cequence reported tracking a scanner that cycled through about 32 false AI-bot identities while seeking password files and cloud keys. On patch prioritization, CISA gave federal agencies three days to address PHP2Shell, while VulnCheck counted 1,358 Gotenberg attack attempts in 30 days. Gotenberg was not listed in CISA’s Known Exploited Vulnerabilities catalog at the time described.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls and Phones
The six developments show how security failures can span both internet-facing business equipment and everyday devices used for banking and work. A compromised firewall can provide a route into an organization; a stolen account or authentication token can let an intruder act as a legitimate user. The report’s examples do not establish that all the incidents share a single operator or technical cause.
For defenders, the Fortinet story carries two distinct tasks: apply the available product updates and address credentials that may already be exposed. A software patch does not, by itself, change a reused or stolen password. For individuals, the banking kit and malicious PDF findings underline the importance of checking app sources and treating unexpected security prompts as a warning, not as routine approval requests.
The Gotenberg comparison also points to a limitation in relying on a single official list. CISA’s catalog is a defined prioritization resource, not a complete inventory of every vulnerable product or reported attack. Organizations still need to review their own software and credible vendor advisories.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Breville BES870XL Barista Express Espresso Machine, Brushed Stainless Steel
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
How This Week’s Risks Emerged
The roundup is a selection of six stories from a 30-item Hacker News digest, published by ThorstenMeyerAI.com on October 29. Its author says the underlying advisories and research reports were checked and notes that many statistics come from security firms that also sell protection services. Those figures should be read as the reporting organizations’ findings, not as independently verified totals.
The FortiBleed warnings predate the roundup: the FBI and Secret Service issued their notice on October 6. Fortinet’s security updates followed on October 22. Hudson Rock added an analysis on October 27 of 1,703 firewall configuration reports from 1,689 devices, counting 40,573 records containing passwords in plain text. The company said those were records, not individual people, and that some accounts were inactive: 7,437 local accounts were marked disabled.
Other findings arrived in the final days of the week. Trellix published its PDF investigation on October 26, CloudSEK and Cequence reported findings on October 28, and Enclave’s report on Microsoft Authenticator was dated October 23. The source material says Microsoft fixed the Authenticator issue. It does not describe the issue as an ongoing vulnerability after that fix.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
Counts and Advisories Still Pending
Several headline figures come from security vendors’ own investigations. The roundup does not provide independent confirmation of SOCRadar’s compromised-device count, Hudson Rock’s records, or VulnCheck’s Gotenberg attempt count. The measurements have different units and scopes and should not be treated as directly comparable totals of victims or successful intrusions.
Fortinet’s public advisories for the October 22 updates were scheduled for November 10, so the source material does not identify the individual flaws, affected versions or full remediation details. It is also unclear how many organizations have installed the updates or how many firewall accounts identified in the reported configuration files remain usable. The source does not give the number of victims of MR ROBOT or the PDF backdoor, nor does it establish that the scanner tracked by Cequence succeeded in obtaining data.
The Authenticator issue is described as fixed by Microsoft, but the material does not detail the conditions required for token exposure or the versions affected. It also does not establish whether any work tokens were stolen before the fix.
Apply Fixes and Check Exposure
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s available security updates and plan deployment according to their exposure and change procedures. They should also audit firewall administrator accounts, remove accounts that are no longer needed, change credentials that may have been reused or exposed, and use multifactor authentication where available. Fortinet’s scheduled November 10 advisories are expected to provide more detail on the October 22 fixes.
Teams should check whether they use Gotenberg or other affected software and consult vendor and agency guidance rather than relying only on CISA’s catalog. Android users and administrators should verify that banking apps come from trusted sources, install available app and operating-system updates, and avoid approving unexpected prompts. Organizations using Microsoft Authenticator should confirm that the relevant fix is installed and follow Microsoft’s guidance as more technical information becomes available.
Key Questions
What is the main firewall risk in this report?
The FBI and U.S. Secret Service said the FortiBleed campaign remained active and targeted Fortinet firewall access using credentials that had been exposed earlier or were weak. Fortinet said the campaign did not exploit a new Fortinet vulnerability.
Has Fortinet released updates?
Yes. Fortinet released updates for FortiOS, FortiManager and FortiAnalyzer on October 22. The public advisories describing the issues were scheduled for November 10, according to the source material.
What does the MR ROBOT Android kit do?
CloudSEK reported that criminals can rent the kit to create fake banking apps that steal one-time codes and secretly forward calls. The report does not give a confirmed victim total.
Was the Microsoft Authenticator issue fixed?
The source says Microsoft fixed the Android token exposure issue, identified as CVE-2026-80097. It does not specify the affected versions or say whether attackers stole tokens before the fix.
Does CISA’s list cover every serious vulnerability?
No. The roundup describes CISA’s Known Exploited Vulnerabilities catalog as a patch-prioritization resource and says Gotenberg was absent despite VulnCheck reporting attack attempts. Organizations should also review their software inventory and relevant vendor advisories.
Source: ThorstenMeyerAI.com
