The Signal
Must Know
Identity · Securityaffairs
What happened
CISA, the FBI, HHS, USDA and the Department of Transportation issued a joint advisory about attacks against industrial refrigeration controllers and cold-chain monitoring systems used across healthcare, chemical, food and transport organizations. [1]
The advisory says malicious actors may target electronic and commercial refrigeration controllers in grocery and cold-storage facilities, including unpatched or internet-accessible devices. [1]
Why it matters
The advisory describes potential equipment hazards, inventory loss, shortened equipment life, fire hazards and consumer safety risks from spoiled products. [1]
Identity · Theregister Security
What happened
Researchers exploited weaknesses in Android apps used by two unnamed automakers to gain remote access to connected cars, including the ability to start engines, flash headlights, and sound horns. [2]
The exploit paths used public vehicle-identification information, internal API queries, identity-platform weaknesses, and account takeover to issue commands through the mobile apps. [2]
Why it matters
After reaching the identity servers, the researchers could view or modify user-account data, log into car owners’ accounts, and issue the demonstrated vehicle commands. [2]
Exploitation · Helpnetsecurity
What happened
Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, where the funds were possibly converted into cryptocurrency. [5]
Crédit Mutuel Arkéa confirmed the attack after blockchain investigator ZachXBT tracked more than $100 million in suspected stolen funds moving out of centralized exchange accounts. [5]
Why it matters
The case separates the initial account misuse from subsequent tracing of suspected fund movements. [5]
Cloud · Theregister Security
What happened
Iris Ohyama took its Iris Plaza online store and associated systems offline after finding a suspicious file on a third-party cloud service and confirming unauthorized access. [4]
The potentially compromised cloud environment contained information for approximately 7.7 million people: 5.8 million registered or former customers and 1.9 million non-account purchasers or promotion participants. [4]
Why it matters
The company has not established whether attackers took personal information or the full extent of the intrusion, so the reported 7.7 million records remain at risk rather than confirmed exfiltrated. [4]
Incident · Securityaffairs
What happened
Doctor Web found malware hidden in GitHub projects presented as security tools; the campaign targets blockchain game enthusiasts and information-security professionals, and more than 2,000 PCs were infected at the time of its research. [3]
The malicious projects conceal code in project files, including pre-build commands, PowerShell in configuration files, and obfuscated Python and Go code; some projects include installation instructions for Visual Studio and the GitHub downloads. [3]
Why it matters
After a victim opens a project, a PowerShell script contacts attacker-controlled servers and legitimate platforms, retrieves an encrypted link, and unpacks a folder disguised as a Windows Photos component. [3]
Also Worth Knowing
AI & Agents · Helpnetsecurity
What happened
Elastic Security Threat Command reported that attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases. [6]
This compresses the analytical distinction between endpoint infection and follow-on account access. [6]