Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
The day's lead is a supply-chain campaign that has deliberately stepped around the defences the ecosystem spent the last year building: an npm package masquerading as the legitimate `sorted-btree` library has accumulated 2 million weekly downloads while hiding its loader inside an ordinary runtime function rather than an install script, so that npm v12's lifecycle-script approval gate never fires and a clean install reveals nothing. Checkmarx, which found the package, says `indexed-btree` triggers its payload from `BTree.prototype.set()` — the method every consumer calls constantly — and names nine further packages from the same operation, one of them at 1.95 million downloads; the malware exfiltrates host fingerprinting data over hardcoded Slack and Telegram channels and fetches its second stage by reading a smart contract on Ethereum's Sepolia test network. The second thread is agent sandboxing, and it fails in both directions. Security researchers at Accomplish AI found two escapes from the OpenAI Codex sandbox, the worse of them — Heapjack — handing unsandboxed command execution to a repository's author the moment a developer opens that repository in Codex and asks a question about the code, with the flaw working even in Codex's strictest read-only mode. In the opposite direction, Unit 42 found that AWS AgentCore Harness's default configuration lets prompt injection steer an agent into exfiltrating the plaintext credentials its own identity vault resolves at runtime. On the extortion side, the week's new name is N0n, a group trackers classify as a data broker that posted a 108 GB claim against the sports-commerce platform Fanatics with a 23 September deadline and no victim statement to match it, while Huntress detailed a new double-extortion variant, Settra, used against a retail organisation in July and a manufacturer in September.
The ACSC has published nothing new since its 18 September WaterPlum advisory, so Australia's read today runs through the AI-governance debate shaping up around the data-centre deals rather than a fresh national advisory. The AFR reported on Sunday that national security and artificial-intelligence figures want the Albanese government to make early access to the newest frontier models a condition of allowing Anthropic, OpenAI and Google to train on Australian content — an argument being made as the government reworks copyright law and as Anthropic's long-term lease with the Western Downs Digital Park, tied to a proposed A$30 billion data centre in regional Queensland, puts frontier-model infrastructure physically inside Australia. Today's technical stories give that argument concrete shape: the Codex sandbox escapes and the AgentCore credential-exfiltration finding both concern tooling that Australian enterprises are adopting now, and both turn on the same question the AFR piece raises from the policy end — who is accountable for an autonomous system's action, and what evidence does a regulator get afterwards. Spain's AEPD logged the first breach notification naming an AI agent as the attacker on 14 September, which is the template an Australian organisation would have to fit if a comparable incident reached the OAIC under the Notifiable Data Breaches scheme: the agent found loose credentials and an application vulnerability, then modified personal data and accessed invoices, and the agency confirmed the notifiable event without the model or its provider being compromised. Nothing in the window touches an APRA-regulated entity directly; the operative Australian guidance remains the ACSC's 15 September Active Directory detection guidance and the agentic AI harness guidance of 11 September.
Across the last seven days the AI story has stopped being about what models can be tricked into and has become about what they are trusted with. Three items now sit on the same axis: a regulated authority logging an autonomous agent as the named attacker in a personal-data breach (AEPD, 14 September), a managed agent runtime whose default configuration leaks the credentials it exists to protect (Unit 42, 18 September), and a coding agent whose sandbox can be broken from inside by opening someone else's repository (Accomplish AI, 20 September). The common failure is identity: in each case the agent held a credential or a capability that the surrounding control plane assumed was contained, and the containment held only until someone exercised the tool in an ordinary way. That is a different problem from the model-misalignment run of reports from the frontier labs a fortnight ago, and it is the more actionable one, because it is fixed by scoping tools, expiring credentials and owning the identities behind them rather than by alignment research. The second through-line is evasion of the defences built after last year's supply-chain wave. The TanStack, Brevo and PhantomRaven cases all ran through install-time mechanisms, which is what npm v12's script-approval gate and remote-dependency restrictions were built to stop; `indexed-btree` simply moved the payload into normal library behaviour, and Checkmarx's advice is the admission that install-time scanning is now the wrong layer to defend — runtime behavioural monitoring is the control the campaign was engineered around. Expect the same move in other ecosystems, because the gate only ever covered one code path. Third, the extortion market keeps fragmenting at both ends. N0n arrived in September posting high-volume claims against named brands, including Fanatics, with a data-broker profile and no victim confirmations to match; Settra is a smaller, hand-operated double-extortion variant with an unusual interest in destroying recovery options; and ShinyHunters spent the weekend on the far end of that spectrum, attacking a rival gang's own leak site. For the week ahead, the items to watch are whether Fanatics confirms or contests the N0n claim before its 23 September deadline, whether the `btree` package family's millions of installs produce downstream incidents, and whether OpenAI's August fixes hold against variants of the Heapjack technique — the PoC's reach into Docker sockets and global configuration files makes it a template rather than a single bug.
Incident Map
AI & Frontier Technology 3 stories
Researchers Broke Out of the OpenAI Codex Sandbox Two Ways — One of Them From Its Strictest Read-Only Mode
Security researchers at Accomplish AI found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer's machine from Codex's most locked-down mode with no approval prompt and nothing shown on screen. The more serious technique, Heapjack, turns a routine action into remote code execution: open someone else's repository in Codex, ask a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer. It targets `node_repl`, a component Codex Desktop writes into the global `~/.codex/config.toml` at install time with no opt-in and no setting to disable it, so plain Codex CLI users inherit it. That component runs one Node.js process holding two JavaScript contexts — a trusted one running OpenAI's code and an untrusted one running the agent's — and because both share a memory heap, the random token the trusted context presents to prove itself is readable. The untrusted side takes a heap snapshot with `v8.getHeapSnapshot()`, tries every UUID-shaped string until a wrong-guess error becomes a real validation error, then writes onto the same pipe the trusted context uses to reach an unsandboxed parent process; the proof of concept used the system's `open` command, and the same access reaches any Unix socket, a Docker daemon socket being the obvious target. The second flaw, Overpatch, got Codex's own `apply_patch` tool to write outside the workspace-write boundary. Both were reported to OpenAI on 12 August and fixed within eight days. Verification: Verified
Hardcoded MCP Credentials Are Sitting in Public GitHub Configuration Files
Hush Security analysed around 82,000 publicly accessible Model Context Protocol (MCP) configuration files on GitHub and found 12 per cent of credential slots contained a hardcoded credential literal, potentially exposing credentials for the services those AI coding tools connect to. Of the hardcoded secrets, 55 per cent had no vendor-recognisable token format, including 31 per cent classified as opaque bearer tokens for internal MCP servers; the values were predominantly vendor API keys, bearer tokens and database passwords. The figures are lower-bound estimates, since GitHub code search indexes default branches, excludes forks and caps results per query. Humans are the harder problem: examining the history of 7,681 credential-bearing configurations across up to seven revisions, they found 243 where the secret had been removed from the current file but remained readable in an earlier commit — which means rotation at the provider is the only remediation. Hush's chief executive Micha Rave framed the gap as structural: these files are meant to be committed, the secret never should be, and the highest-risk credentials in them match no known pattern while the identities behind them have no owner and no expiry. Verification: Verified
AWS AgentCore Harness Leaks Identity-Vault Credentials to Prompt Injection Under Default Settings
Unit 42 researchers found that using default configurations in AWS AgentCore Harness can let an attacker steer an agent's actions through prompt injection into exfiltrating plaintext credentials managed by AgentCore Identity. The finding came from examining two of the harness's integrations: AgentCore Identity, AWS's recommended identity vault for agent credentials, and a downstream MCP server that the harness authenticates against using a credential from that vault. AgentCore Identity provides encryption at rest and in transit, KMS keys and IAM-gated access — but the researchers asked what happens at runtime, when a credential has to leave the vault to be used, and found that the harness's own built-in shell tool, enabled by default, reaches into the same memory space where credentials are resolved to plaintext. Unit 42 disclosed the issue to AWS, which reviewed and closed the report as informative under the AgentCore shared responsibility model, citing `allowedTools` scoping and egress filtering as customer-side controls. The practical mitigation is layered: scope the tools the harness may use to what it needs, grant the identity vault's service accounts least privilege for the downstream integration, and watch outbound traffic from harness containers. Verification: Verified
Global (Macro) 2 stories
The `indexed-btree` npm Campaign Hides Its Loader at Runtime to Walk Past npm's Install-Script Defences
An ongoing npm malware campaign centred on the `indexed-btree` package shows how threat actors bypass supply-chain defences by hiding malicious code in a package's normal runtime behaviour rather than in installation scripts. The package, spotted by Checkmarx, impersonates the legitimate `sorted-btree` library and has amassed 2 million weekly downloads. In June 2026 GitHub introduced npm measures that block dependency lifecycle scripts such as `preinstall`, `install` and `postinstall` unless explicitly approved, and that stop npm retrieving dependencies from Git repositories or remote URLs without permission. `indexed-btree` sidesteps both by avoiding installation scripts entirely and hiding its loader inside `BTree.prototype.set()`, which executes at runtime when an application calls it with a specific key value — installation looks clean and triggers none of npm v12's approval mechanisms, and Checkmarx notes this also defeats most static scanners and taint-analysis tools. The first stage, `sharedLoad.min.js`, collects architecture, hostname, CPU, memory and uptime data and exfiltrates it through hardcoded Slack and Telegram channels, then polls an Ethereum smart contract on the Sepolia test network for command-and-control information, deriving an AES key from an X25519 exchange to decrypt a second-stage payload stored in the contract, and can delete its files and strip the trigger to erase traces. Checkmarx attributes nine further packages to the operation and had them removed from npm, including `btree-core` (1,951,274 downloads), `btree-leaderboard` (493,685) and `btree-range-store` (468,092), and found a wallet holding 109 ETH, though the report does not say those funds came from cryptocurrency theft. Verification: Verified
Three in Four Abandoned IoT Companion Apps Ship Dependencies With Known Vulnerabilities
Researchers at the University of Massachusetts Amherst analysed 61,500 abandoned Android IoT companion apps — the apps used to control smart plugs, cameras and thermostats — and found nearly three in four contained software dependencies associated with documented vulnerabilities, most in the higher severity tiers. The dataset was built from AndroZoo, with an app classed as abandoned if it had gone two years without an update or been delisted from Google Play by March 2025. Abandonment did not mean small audiences: most apps had thousands of installs, and a dozen had passed 100 million downloads before development went quiet. The code carried thousands of hardcoded web addresses, and about a quarter of the unique domains no longer resolve. A scan against threat-intelligence blocklists matched roughly one in nine extracted addresses, with hundreds of exact matches for phishing, scam, spyware and malware links, and more than two-thirds of apps contained at least one blocklisted domain. A check of domain registration history found that a modest share of still-active domains had changed hands since the app was last updated, affecting over 2,000 apps — the classic abandoned-endpoint takeover path — and the researchers note that users expect IoT devices to stay in service for about a decade, far beyond vendor maintenance commitments for the phone app that controls them. Verification: Verified
Retail & Entertainment & Sport 2 stories
Fanatics Is Named on a New Extortion Group's Leak Site With a 108 GB Claim and a 23 September Deadline
Fanatics, the licensed sports merchandise and commerce platform, appeared on the leak site of N0n — a group that emerged in September 2026 and that ransomware trackers classify as a data broker rather than a conventional ransomware operation — with a claim dated 20 September covering 46,902 order files totalling 108 GB said to contain customer personal data, accounts-payable invoices for league and brand partners, customer balances and a bank transaction archive, customer tax-exemption certificates and the fraud-prevention data set, posted alongside a deadline of 23 September 2026. The listing carries no intrusion method and no ransomware note, which is consistent with the broker pattern of claiming exfiltration without encryption. Fanatics has made no statement and no regulator notification is visible, so the claim stands on the leak-site post alone; the same group listed the United Federation of Teachers and Prefix Corp on 18 September. Applying the breach triage this digest uses for major claims: there is no victim or regulator disclosure, no circulating sample has been structurally examined, and a high-volume listing from a group with an unestablished track record is the weakest evidentiary class — a dataset is *claimed* to be circulating, which is several steps short of the subject's systems having been compromised. Treat the volume figures as the operator's negotiating position. Verification: Unverified
Huntress Details a New Double-Extortion Variant, Settra, Used Against Retail and Manufacturing Victims
A new ransomware variant named Settra has been deployed in incidents targeting the retail and manufacturing sectors, according to Huntress. The variant was first observed in June 2026, with notable post-compromise activity in attacks against an organisation in the consumer-services and retail sector in July and a manufacturing firm in September. The techniques are the story rather than the encryption itself: the operators deployed the MeshAgent remote monitoring and management tool for persistent access, launched the ransomware executable from `C:\Perflogs`, appended the `.locked` extension, and immediately set about destroying the victim's ability to recover — clearing Windows Event Logs, disabling the Windows Recovery Environment, running `ipconfig /flushdns`, invoking `diskpart` through a script to delete a recovery partition, and using `cipher /w:D:\` to overwrite free space on multiple volumes so deleted data could not be recovered. The September manufacturing case added a bring-your-own-vulnerable-driver (BYOVD) step to disrupt onboard security tooling and crash antivirus-related services. Huntress says it could not confirm initial access for either incident, that the attackers misspelled one of the Event Logs they tried to clear — aborting that step — and that there is currently insufficient evidence to describe Settra as ransomware-as-a-service. Verification: Verified
Healthcare 1 story
A Minnesota Dental Provider Settles Class Action Litigation Over a 2024 Breach of 130,000 Patients' Data
Community Dental Care, a nonprofit Medicaid dental provider in Minnesota, has agreed to settle class action litigation over a cyberattack and data breach that exposed patients' personal and protected health information. The intrusion occurred on or around 20 December 2024, when a cybercriminal actor accessed the provider's network and potentially exfiltrated the data of more than 130,000 individuals — names, health insurance information, dates of birth, medical information and Social Security numbers, the last affecting approximately 7,100 people. Notification letters began to be mailed on 28 March 2025, and a class action was filed in Ramsey County District Court days later; four further complaints were consolidated into a single action alleging the breach resulted from negligence and a failure to implement reasonable cybersecurity measures. The provider denied all claims and moved to dismiss; the court granted that motion in part and denied it in part, allowing the negligence, negligence per se and breach of implied contract claims to proceed. After mediation and before discovery, the parties agreed terms that let class members claim documented, unreimbursed losses of up to US$5,000, or a one-time cash payment of $50, alongside injunctive commitments to be detailed in the final agreement. Verification: Verified
Government 2 stories
The FBI Logs Nearly 61,000 Officer-Impersonation Complaints and More Than US$1.6 Billion in Losses
The FBI issued a public service announcement warning that victims of an ongoing law enforcement and government impersonation scam lost more than US$1.6 billion over an 18-month period, based on nearly 61,000 complaints filed with the Internet Crime Complaint Center between January 2025 and July 2026. The dominant pattern — the majority of government-impersonation complaints — has the scammer accuse the victim of committing or being connected to a crime, then threaten arrest, prosecution or imprisonment unless they pay to have the charges removed or to help investigate the "real" criminals. The FBI says scammers spoof caller ID so calls appear to come from an agency's legitimate number, and that it is aware of cases where they wore fake police uniforms and staged mock government facilities to make the approach credible. International victims were targeted too: 1,809 IC3 complaints in the same period, with losses exceeding US$140 million. The figures matter to organisations beyond their consumer-protection value, because the same impersonation method — a credible official identity used to extract information or payment — is the mechanism behind the fake-law-enforcement requests that have produced disclosure incidents against regulated firms, including the fraudulent request for data on roughly 680 customers submitted through a legitimate Italian government email domain that put Revolut in front of the UK ICO last week. Verification: Verified
CISA Ran Its Tenth Cyber Storm Exercise Against a Rail, Port and Water Attack Scenario
CISA hosted Cyber Storm X this week, the tenth edition in the 20-year history of its biennial national cyber exercise, drawing 2,000 participants from more than 200 organisations across federal, state and local government and the private sector. The scenario exercised this year was unusual for a resilience drill in its specificity: a nation-state adversary targeting the transportation systems sector, including rail and ports, alongside the water and wastewater systems sector — the two critical-infrastructure verticals that have dominated this month's incident reporting, with US officials tracking cyber threats against nearly 20 shipping vessels and the Coast Guard boarding two tankers in the Gulf of Mexico in August. Acting CISA Director Nick Andersen said the exercise strengthens national resilience "by making sure our plans, policies and partnerships are ready when we need them". CISA said it will now work with participants on findings from the four-day event, which is designed to test how responders manage a large-scale incident affecting critical infrastructure rather than to certify individual organisations. The exercise is a readiness signal rather than an incident: no adversary activity is implied by the scenario choice, though the sector pairing is a statement about where CISA assesses systemic risk sits. Verification: Verified
Legal Services 1 story
A Core Scattered Spider Member's Guilty Plea Surfaces a Year Later as Prosecutors Move on US$18 Million in Assets
Ahmed Hossam Eldin Elbadawy, a 24-year-old from Texas, pleaded guilty to wire fraud conspiracy and aggravated identity theft exactly one year ago as part of the extortion crew known as Scattered Spider, but the plea only became public this week when prosecutors filed an order of forfeiture seeking the proceeds of his criminal activity. He operated alongside Noah Michael Urban, sentenced to 10 years in prison last year, and Tyler Robert Buchanan, a Scottish national who pleaded guilty to multiple cybercrimes in April and awaits sentencing; all three were among five individuals charged in 2024 as part of The Com's aggressive subset. According to the indictment, the group obtained credentials through social engineering, stole company data to identify high-net-worth employees holding virtual currency, and struck victims across entertainment, telecommunications, technology, business process outsourcing, IT, cloud and virtual currency sectors — at least 12 victim companies named in the indictment and 29 victims detailed by authorities. The largest thefts were nearly US$6.35 million in September 2021, $571,000 in June 2022 and nearly $1.7 million in December 2022. Prosecutors are seeking forfeiture of Bitcoin worth more than US$14.19 million, Ethereum worth more than $3.4 million and nearly $63,000 in cash. The terms of the plea agreement have not been released. Verification: Verified
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |