610,000 Roblox Accounts Sold for Pocket Change

Roblox — an online gaming and social platform with hundreds of millions of users, particularly children and teenagers — had over 610,000 accounts stolen and sold, according to Ukrainian prosecutors.

A 19-year-old from the city of Drohobych allegedly organised the operation between May 2025 and April 2026, recruiting two 22-year-old associates to help run the sales infrastructure. Their method centred on stolen session tokens, also called cookies — small files a website stores on your device after you log in. If someone steals yours, they can access your account without ever needing your password. Think of it like copying your hotel key card: the lock has no way to tell it wasn't you.

The group disguised information-stealing malware as gaming cheat tools or free in-game bonus software, then harvested the tokens those programs collected. Automated software sorted the stolen accounts by value, checking for virtual currency and rare items. Premium accounts were sold individually; lower-value ones were bundled in bulk. Accounts sold for as little as 70 Russian rubles ($0.80 each), with prosecutors estimating the total operation could have generated around $480,000.

Investigators traced nearly $54,000 in confirmed cryptocurrency proceeds. All three suspects are in custody facing charges including theft, money laundering, and unauthorised access to computer systems, with a maximum sentence of 12 years.

What you should do: If you or your child plays Roblox, log in and check the active sessions in account settings. Sign out of any device you don't recognise. Enable two-factor authentication while you're there.

A newly disclosed proof-of-concept attack called BragJack can hijack the AI assistants built into five major browsers — Google Chrome with Gemini, Microsoft Edge with Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome — according to Dark Reading.

Researcher Gal Weizman at Forever Security found that each browser failed to properly isolate its AI agent from browser extensions. A malicious extension could cross that boundary and feed the AI a stream of instructions until it complied — taking screenshots, reading local files, and activating the camera or microphone, all without a user click. No prompt injection (hiding instructions in content for the AI to read) was needed; attackers could simply issue direct commands.

All five companies were notified, patches have been issued, and Google and Microsoft awarded CVEs for their respective flaws.

What you should do: Keep your browser updated. Only install extensions from sources you genuinely trust — every extension you add is a potential entry point.

What The Events Calendar is: A WordPress plugin with over 600,000 active installations that lets website administrators create and manage event listings on their sites.

What it is: An unauthenticated RCE (remote code execution — an attacker running their own commands on your server) flaw caused by insufficient input validation. An attacker can inject a crafted payload through the comment area of an event page that the server then executes.

Who's at risk: Any WordPress site running The Events Calendar below version 6.17.3.1 with comments enabled. Around 240,000 sites use versions prior to 6.17.

CVSS: 9.8 (Critical — patch today).

Root cause: The plugin processes user-supplied comment data before validating it properly. Because the injected code reaches the vulnerable function before comment moderation occurs, no login or approval is required to trigger it.

Attack vector: An attacker visits an event page on your site, submits a crafted comment containing malicious code, and the server executes it — handing over full control of the WordPress installation. No account needed.

Detection strategies: Check server logs for unexpected POST requests to event comment endpoints. Look for unfamiliar admin accounts created recently. Monitor for unusual file modifications in your WordPress directory.

Recommended actions:

1. Update The Events Calendar to version 6.17.4.1 or later immediately.
2. If you cannot update right away, disable comments on event pages.
3. Audit recently created admin accounts and review access logs for anomalous activity.

These recommendations are AI-generated based on available information at time of writing. Always verify with the official vendor advisory or CVE record before acting in a production environment.

A scam variant flagged by security researcher Bruce Schneier is worth knowing about: attackers are framing malware downloads inside fake CAPTCHA prompts, according to Schneier on Security.

The setup looks like a routine "prove you're human" check — the kind you see on login pages everywhere. Instead of ticking boxes, the fake version asks you to run a command or download a file to "verify" yourself. That file is malware.

The rule is simple: a real CAPTCHA never asks you to download anything or run a command. If a verification prompt on any website asks you to do either of those things, close the tab immediately.

What you should do: Treat any CAPTCHA that asks for a download or a keyboard shortcut as an attack. Share this with anyone who uses the internet less cautiously than you do.

European Commission President Ursula von der Leyen has proposed a new Emergency Security Protocol, modelled on NATO's Article 4, that would allow any single EU member state to convene all 27 governments in response to cyberattacks, sabotage, or drone incursions, according to The Record. Von der Leyen cited recent incidents across Denmark, Lithuania, and Poland as evidence that current EU decision-making is too slow. For businesses operating across EU borders, a formal coordinated response mechanism would mean faster official guidance during major incidents.