The October 8, 2026 ThreatsDay bulletin from The Hacker News is a weekly roundup of separate cybersecurity stories, not a single investigation. Two headline items are a WhatsApp-delivered Windows remote access trojan (RAT) and a ransomware affiliate that collected extortion money outside the ransomware program it worked for. The remaining items range from malicious developer extensions and packages to post-quantum cryptography gaps in healthcare devices, a session-cookie flaw, an insider sentencing, and an enforcement update against scam centers. Each story below is credited to its own researcher, company, news outlet, or agency. None should be read as part of one campaign or one threat actor.
The stories at a glance
The table lists each story, who reported it, and how much weight the bulletin’s claims can carry. Sections below give the detail for each.
As an Amazon Associate I earn from qualifying purchases.
| Story | Reported by | Strength of the reporting |
|---|---|---|
| WhatsApp lure deploys Windows RAT | Morphisec (infection-chain analysis), relayed by The Hacker News | Delivery channel reported; chain described by Morphisec |
| Ransomware affiliate turns rogue | CloudSEK | The researcher’s account of the affiliate’s activity |
| Medical devices face PQC gaps | Forescout, 2026 | Figures for Forescout’s own dataset, not a census of all hospitals |
| Predictable cookies enable impersonation | Resecurity (vendor not named) | The researcher’s account; the affected product is not identified |
| Exposed server reveals attack tools | ThreatMon | The researcher’s account; initial intrusion method unclear |
| Insider sabotage and sentencing | U.S. Department of Justice | Official case outcome |
| AI assistant privacy (Meta Muse) | Meta, in a response reproduced in the bulletin | Company statement |
| Scam-center enforcement | Fox News account of a statement by FBI Director Kash Patel | Reported statement; the dollar figure is not independently verified |
| Malicious VS Code extensions and themes; compromised npm and RubyGems packages | Socket (one quoted build); other reporters not identified in the bulletin summary | Partly attributed; package names and indicators are time-bound |
| Power BI phishing delivers RMM | Not identified in the bulletin summary | Headline-level detail only |
| File upload flaw enables web shells | Not identified in the bulletin summary | Headline-level detail only |
WhatsApp lure and a Windows RAT
The malware item centers on a financial-document executable named “Statement.exe.” It was reportedly delivered through WhatsApp. That describes the delivery channel as reported; nothing in the bulletin indicates that WhatsApp itself was compromised. Morphisec describes the Windows infection that followed as a multi-stage chain ending in VulcanRAT207.A:
- Host screening. The malware checks the machine before it proceeds.
- Attempted elevation. The chain tries to gain higher privileges on the host.
- Signed driver to disable security software. The chain uses a legitimately signed driver, GoFly64.sys, to terminate selected security processes. This is a bring-your-own-vulnerable-driver (BYOVD) pattern: a driver that is properly signed but contains a flaw can be abused, and drivers run with kernel privileges, which is why they can reach security tools that user-mode programs cannot.
- DLL side-loading. A legitimate program is made to load a malicious DLL placed next to it.
- Process injection and a WebSocket RAT. Morphisec describes injected code and a remote access trojan that communicates over WebSocket.
The practical point is that a valid signature does not make a driver safe. Defenders who rely on signature trust alone miss this class of abuse.
#1 Best Overall
Developer ecosystems: extensions, themes and packages
The bulletin groups three developer-facing threats: malicious Visual Studio Code extensions and themes, and compromised npm and RubyGems packages. Together they show that editor marketplaces and package registries can deliver malicious code to developer workstations and to continuous integration (CI) environments, where build secrets are often present.
Socket researcher Kirill Boychenko is quoted in the bulletin on one malicious build: “That build contains the same Solana address, AES key, and execution model previously documented in GlassWorm activity.” The quote links the build to earlier GlassWorm activity by its shared components. Attribute it to Boychenko as quoted in The Hacker News unless you have checked the original Socket report.
Package names, versions, and indicators in this area change quickly. Check the original advisories before using any name from this bulletin as a block rule.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Ransomware affiliate Azazel
CloudSEK reports that Azazel, a Russian-speaking affiliate linked to the Gentlemen ransomware operation, ran its own leak site, named Leakned, separate from the program’s site. According to CloudSEK, Azazel collected extortion proceeds outside the program, on top of publishing victim data. That is the researcher’s account of the incident.
The headline’s “betrayal” applies to two parties. Victims faced publication of their data, and the operator lost revenue it expected to share. In a typical ransomware-as-a-service arrangement, affiliates pay a share of their proceeds to the operator, so funds kept outside that arrangement undermine the operator’s model. The bulletin does not support any estimate of the operation’s total victim count, and nothing here should be read that way.
For incident responders, the case has a practical lesson: a leak posting may not come from the brand a team expects. Monitor leak sites by affiliate and listing, not only by the ransomware name.
An exposed attacker staging server
ThreatMon reports an exposed staging service linked to an intrusion it associates with Viva Aerobus. The server held 17 named post-exploitation tools, which are the utilities attackers use after gaining access, and traces of activity. Exposed attacker infrastructure gives defenders a view of the tools in use, but the server itself is evidence and not a source of verified victim counts.
The initial intrusion method is unclear in the bulletin’s account. After access, the chain used Microsoft SQL Server’s xp_cmdshell, a feature that runs operating-system commands from inside SQL Server. It is disabled by default in current SQL Server editions, so its use generally means someone enabled it before the attack.
Rank #3
Healthcare devices and post-quantum readiness
Post-quantum cryptography (PQC) replaces public-key algorithms that future quantum computers could break. Forescout’s 2026 report examined more than 2.5 million devices across more than 50 healthcare delivery organization networks. Its findings are for that dataset, not for every hospital. Readiness varied sharply by device class, as measured by whether the device’s SSH implementation supports PQC in its studied environments:
| Device class | SSH implementations that support PQC (Forescout’s studied environments) |
|---|---|
| IoMT (Internet of Medical Things) | 6% |
| OT (operational technology) | 16% |
| IT | 50% |
Forescout also reports that 31% of exposed healthcare systems in its analysis supported TLS 1.3. Forescout links the gap to long-lived medical equipment that is hard to update, which makes transition planning slower than in ordinary IT.
Forescout’s planning frame is practical. Work through these steps in order:
- Map each device and the sensitive data it handles.
- Determine which assets can be upgraded and which must be replaced or isolated.
- Prioritize migration by exposure and by the sensitivity of the data at risk.
Inventory is the first step, not proof that every device can be upgraded. The 6% figure for IoMT does not mean the rest can be fixed on a schedule.
Web flaws: predictable cookies and file uploads
Predictable cookies enable impersonation
Resecurity attributes a cookie bypass in a yard management system to two design flaws. The system used a hard-coded signing secret that was identical to the cookie name. It also signed a public database identifier rather than a random session identifier. Together, the flaws reportedly allowed cookie forgery for any user whose ID was accessible through the API. The product is not named, and the bulletin does not say it is public.
A session cookie is the trust token the server accepts on each request. If anyone can compute a valid token from a value they already know, the server cannot tell the real user from an impersonator.
File upload flaw enables web shells
The bulletin’s summary of this item is a headline: a software file-upload flaw enables web shells. A web shell is a script placed on a server that lets an attacker run commands through a web browser. The bulletin does not identify the affected product or versions in its summary, so check the vendor’s advisory before assuming exposure.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Phishing that delivers remote management software
The bulletin reports a Power BI phishing campaign that delivers a remote monitoring and management (RMM) tool. RMM software gives an operator remote control of a machine, and attackers often use it because administrators expect it on managed systems. The bulletin’s summary does not describe how the phishing message led to the installation, so the detail is limited to the headline.
Best Value
Insider sabotage ends in a 32-month sentence
The U.S. Department of Justice reports that former employee Daniel Rhyne was sentenced to 32 months in prison for a computer attack and an extortion attempt against a former employer. According to the bulletin, the sentence followed a guilty plea. This is an official case outcome, and it is separate from the allegations in the other stories.
AI privacy: Meta’s Muse assistant
The privacy question here concerns memory: what an AI assistant keeps about a user, including details about other people. Meta’s response, as reproduced in the bulletin, says: “Muse remembers what matters most to you, including information about others that you choose to share, so it can be a helpful personal assistant.” The quote describes the feature as Meta designs it and does not settle the privacy question on its own.
Scam-center enforcement and a $17 billion figure
The bulletin’s enforcement item relays a Fox News account of a statement by FBI Director Kash Patel. The account reports a $17 billion figure for Operation Blackout and quotes Patel: “There is no safe haven for criminals targeting Americans.” The dollar figure is a reported statement. It is not an independently verified or audited seizure total. Confirm it against FBI releases before citing it as settled, and treat the quotation as a reported statement until you have the original.
What ties these stories together
These items do not describe one campaign, but they share a pattern of trust and control failures. Extensions, packages, signed drivers, session cookies, and exposed servers each work because something was trusted more than it should be, or left reachable when it should not have been. This is an editorial reading across separate reports, not a finding from one coordinated investigation.
The controls that address these patterns are ordinary and checkable:
Quick Recap
- Audit installed editor extensions and themes against their publisher and update history, and remove any you cannot account for.
- Pin dependency versions in npm and RubyGems projects and review install-time scripts before packages reach build and CI systems.
- Turn on driver blocklisting where your security stack supports it, and alert on drivers loaded from user-writable folders.
- Keep databases and staging systems off the public internet, and confirm that xp_cmdshell and similar command features stay disabled unless there is a documented need.
- Issue session identifiers from a cryptographically secure random source, keep signing secrets out of application code, and never use a public user ID as a session token.
- Inventory medical and operational-technology devices and the data they handle before setting post-quantum migration priorities.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
