953 Online Stores Hit in Stealthy Skimming Spree

Since July 2025, attackers have quietly planted loader code — small scripts that pull in malicious payloads — across 953 online stores, most running Magento (an open-source e-commerce platform popular with small and mid-sized retailers), according to Sansec.

The attackers cycled through five different domains to deliver their scripts. When earlier domains expired, they simply re-registered them and kept going. In October 2026, they switched to a new loader domain sitting behind Cloudflare's infrastructure, making it harder to detect. That domain alone has already appeared on 83 stores.

The loader is designed to be selective: it only activates for real visitors, not security researchers or automated scanners. Previous versions served scripts from crypto-themed sites, including one mimicking the Ledger crypto wallet brand — strongly suggesting the goal is financial theft from shoppers at checkout.

One patched store with no known security gaps was compromised within an hour of a clean scan. Investigators found a rogue administrator account and a backdoor (a hidden access point planted by attackers) had already been installed weeks earlier.

Sansec notes the final payload has not yet been captured, but the pattern points squarely at payment card theft.

What you should do: If you shop online, check your card statements for unfamiliar transactions after any purchase from a smaller or independent online store. If you run a Magento store, scan for unauthorised admin accounts, audit for backdoors, and apply all available patches immediately.

Attackers are impersonating IT support staff inside Microsoft Teams to trick employees into handing over remote access to their computers, according to research from Arctic Wolf Labs reported by The Hacker News.

The pattern is consistent across hundreds of cases. It starts with mail bombing — flooding a target's inbox with hundreds of subscription emails to create panic — then a Teams message arrives from a fake "Help Desk" or "IT Support" account, offering to fix the chaos. Victims are persuaded to install remote monitoring tools like AnyDesk or TeamViewer, giving attackers direct keyboard access.

From there, attackers conduct reconnaissance (mapping out the network and identifying valuable targets), move laterally (spreading through connected systems on the same network) to domain controllers, and ultimately deploy Chaos ransomware.

The fake accounts use Microsoft 365 tenant domains that look legitimate, including names like helpdeskteam365.onmicrosoft.com.

What you should do: Be sceptical of any unsolicited Teams message from someone claiming to be IT support, especially if your inbox was just flooded with spam. Verify the person's identity through a separate, known channel before granting any remote access.

What Brotli is: Brotli is a widely used data compression library developed by Google that shrinks files and web content before sending them over the internet, and is embedded in a large number of applications and programming frameworks.

What it is: A critical out-of-bounds write flaw (where a program writes data beyond the reserved memory space it was given, like overfilling a container until it spills into a neighbour's) allows specially crafted input to corrupt memory in ways that can crash an application, leak its contents, or execute attacker-controlled code.

Who's at risk: Any application that passes attacker-controlled data through an affected Brotli decoder — including compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files. Microsoft .NET, Visual Studio, PowerShell, Node.js, and two Python packages are all confirmed affected.

CVSS: 9.2 (Critical — patch today). Microsoft also rates this 8.1 under CVSS v3.1 and assesses exploitation as "More Likely."

Root cause: The Brotli decoder failed to validate that incoming data would stay within its allocated buffer before writing. The underlying bug was actually fixed in Brotli's source code in February 2026, but was not recognised as a security vulnerability at the time, so no security advisory was issued until now.

Attack vector: An attacker sends a maliciously crafted Brotli-compressed payload — either as a server response retrieved by a target application, or as a request body processed by a web framework. If the data reaches the vulnerable decoder, it can trigger memory corruption, leading to a crash or, in demonstrated cases on Node.js running on Linux, arbitrary code execution (RCE — running the attacker's own commands on the target machine). No authentication is required.

Recommended actions:

1. Update Brotli to version 1.0.10, 1.1.1, or 1.2.1. Apply Microsoft's October 25 patches for .NET (8.0.33, 9.0.22, 10.0.14), Visual Studio 2019/2022/2026, and PowerShell 7.4–7.6.
2. Update Python packages Brotli and brotlicffi to version 1.2.1 and 1.2.1.0 respectively.
3. Review any application that fetches or processes external compressed content and confirm it runs a patched Brotli version.

A joint guide published on October 16, 2026 by NIST, CISA, and the NSA on AI agent incident response makes one thing clear: the first question in any security incident is always "whose credentials were used?" That principle applies to everyone, not just enterprise security teams.

Credential sprawl — having API keys, login tokens, and account access scattered across apps and services you've forgotten about — means attackers can act under your identity long before you notice anything is wrong. Reviewed by BeyondTrust via Bleeping Computer.

What you should do: Spend ten minutes today reviewing which apps and services have access to your accounts. On Google, visit myaccount.google.com/permissions. On Microsoft, check myapps.microsoft.com. Revoke anything you don't recognise or no longer use.

Siemens, Schneider Electric, ABB, Rockwell Automation, and Johnson Controls have all published advisories following the disclosure of PHP2Shell — two critical flaws in the PHP web scripting engine allowing unauthenticated remote code execution (running commands on a server without needing a password). Confirmed attacks against honeypots (decoy systems used to detect intrusions) have already been recorded, according to SecurityWeek.

Several Schneider Electric and ABB products are confirmed affected. If your organisation uses industrial control or operational technology systems from these vendors, check for their advisories and apply available patches immediately.