🔍 Read the full analysis: What To Actually Do About This Week’s Security News: Firewalls, Banking Malware, PDFs And Tokens on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
This week’s security developments include an active campaign targeting Fortinet firewall credentials, new Android malware designed to steal banking codes, and a backdoor delivered through a disguised PDF. The source review recommends prioritizing firewall updates, checking credentials and multi-factor authentication, and treating unexpected files and login prompts with caution.
A security review published October 29 highlights six developments for businesses and everyday users, including an active campaign targeting Fortinet firewall credentials and Android malware built to steal banking login codes. The review, drawing on advisories and research reports, recommends prioritizing firewall updates, securing exposed accounts and treating unexpected files and login requests cautiously.
The most urgent item for organizations is a warning from the FBI and U.S. Secret Service that the FortiBleed campaign against Fortinet firewalls remains active. The agencies cite SOCRadar’s verification of more than 86,644 compromised devices across 194 countries. The review says attackers have reused previously leaked passwords, guessed weak credentials and cracked password files, then created administrator accounts to maintain access. It reports that the agencies named ransomware groups INC/Lynx and Payload as buyers of access.
Fortinet separately released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including critical- and high-severity fixes, according to the company. Public advisories were scheduled for November 10. The review distinguishes those product flaws from FortiBleed: Fortinet says the campaign is not a new Fortinet vulnerability and points instead to reused credentials, weak passwords and missing multi-factor authentication.
Other findings cover different routes into accounts and systems. CloudSEK reported an Android crime kit called MR ROBOT that criminals rent to make fake banking apps capable of stealing one-time codes and forwarding calls. Trellix described a backdoor hidden in a blank PDF disguised as a FedEx tax invoice; the reported infection depended on a user accepting the PDF reader’s warning. Researchers also reported and Microsoft fixed an Android Authenticator issue involving work-account login tokens. Cequence said it tracked a scanner cycling through about 32 fake AI-bot identities while seeking password files and cloud keys. Separately, VulnCheck recorded 1,358 attack attempts against Gotenberg in 30 days, while the review says that flaw was absent from CISA’s Known Exploited Vulnerabilities catalog.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Attackers Find Their Way In
The findings matter because they involve common business systems and familiar user habits, not just obscure software. A compromised firewall administrator account can give an attacker a route into an organization’s network. Banking malware that captures one-time codes can undermine protections that users may assume make a login safe. And a document warning or misleading bot identity can turn an ordinary interaction into a security risk.
The practical implication is to address both software flaws and account exposure. Applying vendor fixes matters, but it does not remove passwords already stolen or protect an account that lacks a second authentication factor. Organizations should review which systems face the internet, restrict administrator access and check whether old credentials or configuration files remain exposed. Individual users should install updates and avoid approving unexpected prompts.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Samsung 48-Inch S90H OLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
Six Reports, Different Attack Paths
The source article is a selection from a larger weekly digest published by The Hacker News on October 29. Its author says the six items were chosen for their relevance to businesses and ordinary users, with each checked against an original advisory or research report. The author also cautions that many figures come from security companies that sell protection products; company-reported counts should be read with that context in mind.
The FortiBleed reporting has two separate strands. The FBI and Secret Service warning, issued October 6, concerns an ongoing campaign using credentials and exposed devices. Hudson Rock’s October 27 analysis examined 1,703 configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. Hudson Rock cautioned that these were records, not necessarily distinct people or active accounts; 7,437 local accounts were marked disabled. These figures describe different datasets and should not be treated as a count of currently exploitable users.
The other items show why a single patch list cannot cover every risk. The review says CISA gave federal agencies three days to address PHP2Shell, while Gotenberg’s reported attack attempts did not put it on the cited CISA list. A catalog can help set priorities, but the article argues that security teams should also consider credible reports of active attacks and their own exposure.
“FortiBleed is not a new Fortinet vulnerability.”
— Fortinet, as quoted in its product security response
Exposure Counts Need Context
The available reports do not establish how many Fortinet devices remain vulnerable or accessible today. The figures cited come from separate sources and datasets, and Hudson Rock’s password records include accounts marked disabled. The review also does not provide a confirmed count of victims of MR ROBOT, the PDF backdoor or the Authenticator issue.
Fortinet’s public advisories for the October 22 updates were still expected on November 10, so the supplied material does not identify the specific vulnerabilities or affected versions. The precise scope and impact of the Gotenberg activity are also unclear from the reported attempt count alone: the source does not say how many attempts succeeded. Those limits make it important not to equate observed activity with confirmed compromise.
Prioritize Patches and Account Checks
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s available update guidance, plan and apply relevant fixes, and watch for the scheduled public advisories. Security teams should also check for unexpected administrator accounts, review firewall configuration backups and reset exposed or reused credentials. Where available, enable multi-factor authentication and restrict management interfaces from public access.
Teams should review their own software inventory for PHP2Shell and Gotenberg exposure rather than relying only on one catalog, and follow relevant vendor and government advisories as details change. Users should install the Microsoft fix for the reported Authenticator issue, obtain banking apps from trusted sources, and decline unexpected requests to approve a file or login. The reporting provides no single indicator that ordinary users can use to rule out compromise; suspicious account activity should be reported to the relevant organization or service provider.
Key Questions
What is the most urgent security action for Fortinet customers?
Review Fortinet’s current update guidance for FortiOS, FortiManager and FortiAnalyzer, apply applicable fixes, and check firewall administrator accounts and credentials. Fortinet’s public advisories for the October 22 updates were scheduled for November 10.
Does FortiBleed mean a new Fortinet software flaw was found?
Not according to Fortinet. The company said FortiBleed is not a new Fortinet vulnerability and attributed the campaign to factors including reused credentials, weak passwords and missing multi-factor authentication.
What does MR ROBOT do?
CloudSEK reported that the Android crime kit can be rented to build fake banking apps. Those apps are designed to steal one-time codes and secretly forward calls; the source does not give a confirmed victim total.
Does the Gotenberg attack-attempt count prove systems were breached?
No. VulnCheck reported 1,358 attack attempts in 30 days, but the supplied report does not state how many attempts succeeded. The number is evidence of reported activity, not a confirmed compromise count.
Source: ThorstenMeyerAI.com
