Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
The extortionist behind the largest known customer-data breach of a British airport operator has stepped forward: FulcrumSec claimed the Manchester Airports Group (MAG) compromise and told BleepingComputer it stole roughly 86 GB of data — including nearly 200,000 records of upcoming travel for the remainder of 2026 — and said it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript. BleepingComputer validated one sample record against a traveller's known purchase history before securely deleting the material; MAG, which disclosed on 27 August that car-park, lounge, Fast Track and in-airport Wi-Fi registration data for around 8.7 million customers was stolen, declined to address the specific claims while confirming it had contacted affected customers including everyone with upcoming bookings. The week's agentic-AI security thread also carried into Sunday: Anthropic warned Claude users that infostealer malware including Vidar, LummaC2, StealC, RedLine and AMOS is stealing active login sessions from infected computers to drain paid usage, and Microsoft disclosed TerminalFix, a ClickFix variant that repurposes fake Cloudflare CAPTCHAs to push multi-line commands into Windows Terminal or PowerShell (replacing the traditional Run dialog to maximise script execution success). Socket followed Friday's 19-extension warning with framework-level detail of the campaign's 16 modules — wallet draining, seed-phrase phishing pages impersonating Ledger and Trezor, exchange-session theft and ClickFix-style browser-update lures.
No new ACSC alerts were published in this window; the operative advisory remains the 24 August high-rated alert on active exploitation of TeamCity On-Premises servers within Australia (CVE-2026-63077), referenced across this week's digests. Two Australian security-posture stories anchor today's local angle: the ASX created its first deputy CISO role — Hanlie Botha, previously CISO of Ticketek Entertainment Group with prior cyber security roles at Woolworths Group and Ausgrid, joining Tristan Geering's decade-long tenure — a signal of deepening resilience investment at the heart of Australia's financial-market infrastructure; and the US Justice Department's edited statement on the QTFY takedown, downgrading the US Senate, Federal Reserve and NASA from "victims" to "targets", is a useful reminder for Australian agencies that victim-status claims in takedown announcements can outrun the underlying evidence. The Manchester breach is directly relevant to Australian travellers and the local aviation sector: sample data included vehicle registrations, full postcodes, booking references and IP addresses, and the campaign's through-line — exposed API credentials found in client-side JavaScript — is an initial-access class Australian organisations should audit across their own SaaS integrations (the week's Gitea and TeamCity alerts are the server-side half of the same exposure problem). For AU SMEs and end users, the Socket extension framework and the TerminalFix campaign are the consumer-facing edge of the week's credential-theft wave; treating AI assistant sessions (Claude and similar) as credentials worth protecting is the practical takeaway from Anthropic's disclosure.
Three through-lines carry into Monday. First, the agentic-AI security story has moved through three layers this week: documentation-layer trust failures (the llms.txt research covered Sunday), reward-hacking-driven incident (Hugging Face, 29 August), and now session- and credential-layer theft (Anthropic's infostealer disclosure, 30 August) — the adversary position has shifted from tricking the agent to stealing the human's session, a far broader attack surface. Second, the extortion economy keeps consolidating around pure data extortion: FulcrumSec — a data-only group with prior claims on LexisNexis, Novo Nordisk, Global Schools and Avnet — has now claimed the UK's largest airport breach, sitting alongside Berlin's refusal-to-pay posture (28 August) and the week's accountability rulings on critical-infrastructure attacks; the MAG claim also demonstrates that attacker access narratives (API credentials in client-side JavaScript) are becoming as detailed as vendor incident reports. Third, allied messaging discipline is under scrutiny: the QTFY takedown (27 August) was followed within days by the DOJ's corrected statement downgrading affected US agencies from victims to targets — a reminder that public attribution moves faster than forensic certainty, with direct implications for how Five Eyes partners phrase operational announcements. Watch in the week ahead: whether FulcrumSec publishes its MAG dataset and the technical account it has promised (it has floated redacting upcoming-travel records over "real-world harm" concerns), whether TerminalFix-style CAPTCHA abuse spreads beyond the observed sectors, and whether the ClickFix convergence in the Socket framework signals a merged phishing-and-malware distribution model.
Incident Map
Transport 1 story
FulcrumSec Claims Manchester Airports Hack, Theft of 86 GB of Data
Extortion group FulcrumSec claimed responsibility for the Manchester Airports Group (MAG) data breach — the largest known customer-data breach of a British airport operator — telling BleepingComputer it stole approximately 86 GB covering Manchester, London Stansted and East Midlands airports. MAG disclosed on 27 August that car-park, lounge, Fast Track and in-airport Wi-Fi registration data for around 8.7 million customers was stolen, with only email addresses exposed for the "vast majority". In FulcrumSec's telling, the intrusion used airport-specific Iterable API credentials exposed in client-side JavaScript, and the haul includes nearly 200,000 records of upcoming travel for the remainder of 2026 with dates, times and booking-linked personal information. BleepingComputer validated one sample record against the traveller's known Manchester purchase history — including Fast Track purchases, scheduled arrival times, terminal used, amounts paid and trip purpose — and observed purchase references, full postcodes, IP addresses, device information and customer-engagement data, but no payment-card or bank-account details. FulcrumSec, a data-extortion group active since 2025 with prior claims on LexisNexis, Novo Nordisk, Global Schools and Avnet, says it intends to publish the data and a technical account of the intrusion, but is considering withholding or redacting the upcoming-travel records over "real-world harm" concerns. MAG declined to address the specific claims, confirming instead that affected customers with upcoming bookings had been contacted. The incident has not caused operational disruption; MAG says passenger safety and aviation security were not compromised. **Verification:** Verified **Breach:** Confirmed breach
Global (Macro) 2 stories
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Microsoft disclosed TerminalFix, a new ClickFix variant that directs victims to Windows Terminal or PowerShell instead of the traditional Windows Run dialog, "increasing the likelihood that complex, multi-line scripts execute successfully". The campaign targets organisations across multiple sectors, using compromised websites as the starting point: visitors are served fake Cloudflare CAPTCHA verifications prompting them to copy and execute a malicious PowerShell command, in a multi-stage chain that leverages DLL sideloading, steganographic payload extraction and a reverse tunnel back to attacker infrastructure. **Verification:** Verified
Anthropic Warns Infostealer Malware Is Hijacking Claude Sessions to Drain Usage
Anthropic is warning Claude users that general-purpose infostealer malware on their machines has stolen active Claude login sessions, letting attackers access accounts and consume paid usage — and because infostealers copy an already-authenticated browser session, the attacker may not need passwords or 2FA. The company is signing affected users out, removing saved payment methods and refunding unauthorised charges, and has identified Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs. Anthropic stresses the malware is unrelated to Claude itself and typically arrives via downloads or malicious apps (the affected user who shared the notification had installed a pirated game), and warns that signing out stops the stolen session but does not remove the malware — the next login can be stolen the same way. **Verification:** Verified
Financial Services 2 stories
Socket Details 16-Module Framework Behind Chrome and Edge Extension Campaign
Socket followed its 19-extension warning (28 August, covered in Saturday's digest) with framework-level detail on the campaign it tracks as "Superior", active since early 2024: 16 "highly extensible" modules that drain EVM, Solana and Tron wallets by hijacking legitimate Connect Wallet and Swap buttons; replace Ledger and Trezor websites with convincing seed-phrase phishing pages; steal sessions, tokens, account data and balances from Coinbase, Binance, Kraken, OKX, MEXC, KuCoin, Bybit and MetaMask; record credentials and form entries; harvest Facebook and LinkedIn account information; exfiltrate browser history; and display ClickFix-style fake browser-update prompts. Five of the extensions were acquired from their original creators and injected with malware via automatic updates — the "Enable Right Click & Copy — Smart Unlock + OCR" extension had at least 70,000 Chrome users (and 10,000 on Edge) when it turned malicious. The malware removes Content Security Policy headers from every visited website and maintains an encrypted WebSocket connection to command-and-control servers; Google removed the Chrome instance, and the Edge version remained available when Socket published. None of the malicious extensions remain in the Chrome Web Store; Socket advises users who installed them to assume credential compromise and move crypto assets to newly created wallets. **Verification:** Reported
ASX Creates Deputy CISO Role
The Australian Securities Exchange has created a deputy chief information security officer role, appointing Hanlie Botha — most recently CISO of Ticketek Entertainment Group, with prior cyber security roles at Woolworths Group and Ausgrid — as its inaugural holder. ASX CIO Tim Whiteley said the new role supports the exchange's "ever-increasing efforts required to protect ASX from cyber threats"; CISO Tristan Geering has held the top security role for a decade and has been with ASX for 26 years. **Verification:** Verified
Government 1 story
US Officials Backpedal on Claims That Government Agencies Were Hacked
US officials have walked back claims that multiple government agencies were victims of the Chinese espionage platform QTFY, disrupted by the FBI and DOJ in a domain-seizure operation covered in this digest on 27 August. A freshly edited Justice Department statement says the US Senate, the Federal Reserve, NASA and others were "among the targets of QTFY" — a previous version called them victims — with a note appended saying the edits were made to ensure the release accurately reflects the government's allegations in the affidavit supporting the domain seizures. Reuters could not establish which agencies the government believes were actually breached rather than merely targeted; the Justice Department, FBI and CISA did not respond to requests for clarification. **Verification:** Verified
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |