🔍 Read the full analysis: AI Security This Week: A Guide To Firewalls, PDFs And Banking Malware on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published October 29 highlights six developments: an ongoing campaign against Fortinet firewalls, Android banking malware offered as a rental kit, and a backdoor hidden in a fake invoice PDF. It also covers a fixed Microsoft Authenticator flaw, automated scanning using fake AI-bot identities, and a gap between CISA’s must-patch list and other reported risks.
A security roundup published October 29 highlights six recent risks for businesses and consumers, including an ongoing campaign targeting Fortinet firewalls, Android malware marketed to steal banking credentials, and a backdoor delivered through a disguised PDF invoice. The reports point to immediate steps such as updating software, protecting administrator accounts and treating unexpected file warnings with care, while some underlying figures come from cybersecurity firms’ own investigations.
The roundup draws on advisories and research published during the week, selecting six stories from a larger Hacker News digest. The most urgent concerns involve internet-facing network equipment. The FBI and U.S. Secret Service warned on October 6 that a campaign dubbed FortiBleed remained active against Fortinet devices. The agencies cited SOCRadar’s report of more than 86,644 compromised devices across 194 countries; that count is attributed to the security company, not an independent government tally.
Fortinet separately issued security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, with critical- and high-severity fixes. The public details are scheduled for November 10. Fortinet said AI-assisted testing contributed to the findings and warned that attackers may be able to study patches and develop exploits faster. The roundup distinguishes those software flaws from FortiBleed: Fortinet says the campaign does not exploit a new Fortinet vulnerability, but instead uses reused or weak credentials and accounts that lack multifactor authentication.
Other reports concern devices and everyday files. CloudSEK described MR ROBOT, an Android crime kit rented by criminals to make fake banking apps that can steal one-time codes and forward calls. Trellix traced a backdoor to an empty PDF presented as a FedEx tax invoice; the reported infection required the recipient to accept a warning in the PDF reader. Researchers at Enclave also reported that another app could obtain work-account login tokens from Microsoft Authenticator on Android, a flaw Microsoft has fixed under CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks From Firewalls to Banking Apps
The reports matter because they show how attacks can exploit familiar weaknesses across several points in a person’s or company’s digital life: stolen passwords, exposed network devices, deceptive files and mobile account access. A compromised firewall can expose a wider company network, while a banking app designed to intercept one-time codes may undermine protections that users expect to stop account theft.
The stories also show why security teams cannot rely on a single warning list or on the assumption that a file is safe because it appears blank. The roundup says VulnCheck recorded 1,358 attack attempts against Gotenberg in 30 days, while that critical document-tool flaw was not on CISA’s Known Exploited Vulnerabilities list at the time described. The figure is VulnCheck’s reported count; the article does not provide a comparison baseline or independently verify the attempts.
For ordinary users, the practical message is limited but useful: avoid installing banking apps from links or unfamiliar sources, do not approve unexpected security prompts, and use multifactor authentication. For organizations, the reports reinforce the need to patch exposed systems and check whether old credentials or configuration backups could provide access.
Popular right now
Ninja Specialty Coffee Maker CM401, 10-Cup Carafe, Fold-Away Frother, Black
eufy E25 Robot Vacuum and Mop Combo with HydroJet Roller Mop
Dyson V8 Cyclone Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Fit
The roundup is a selection of six stories from a weekly digest of 30 security reports, not a claim that these are the only or objectively largest threats. Its author says the reports were checked against original advisories or research where available and notes that many statistics originate with the security companies that discovered the activity. Those companies also sell security products, a potential interest readers should bear in mind when interpreting their figures.
In the FortiBleed account, attackers reportedly reuse passwords leaked in earlier incidents, guess weak passwords or obtain information from firewall configuration files. The FBI and Secret Service advisory describes the campaign as active; Fortinet attributes it to credential practices rather than a newly identified product vulnerability. Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices counted 40,573 records containing plaintext passwords. The company said some accounts were disabled and stressed that records do not equal individual people or prove that every password remains usable.
The other items span different stages of disclosure. Microsoft has fixed the Authenticator issue, while Fortinet’s detailed advisories are due later. Cequence reported a scanner using about 32 fabricated AI-bot identities while requesting sensitive files and cloud keys. That is a security firm’s account of one scanner, not evidence that all services claiming to be AI bots are malicious.
What the Reports Do Not Establish
Several numbers in the roundup are attributed to vendors or security researchers, and their methods and coverage are not fully set out in the supplied material. The 86,644-device figure is SOCRadar’s count cited by federal agencies, while Hudson Rock’s password-record analysis does not establish that every listed credential was current or used in an intrusion. The roundup does not provide independent confirmation of those totals.
Fortinet’s detailed October 22 advisories were not yet public in the account, so the exact vulnerabilities, affected versions and required update steps remain unclear here. The source also does not provide technical detail sufficient to assess how broadly the PDF backdoor, MR ROBOT kit or fake-bot scanning has spread. The Authenticator issue is described as fixed, but the material does not specify how many users or organizations were affected.
The article’s selection is an editorial judgment about six stories; it does not establish a ranking of risk across the entire 30-item digest. Reported attack attempts, compromised devices and exposed records are different measures and should not be treated as directly comparable.
Updates and Checks to Make Now
Fortinet’s public advisories for the October 22 updates are scheduled for November 10. Administrators should consult Fortinet’s current security notices for affected product versions and follow the vendor’s update guidance rather than waiting for a summary. Organizations using Fortinet equipment should also review administrator access, replace reused or weak passwords, enable multifactor authentication and check whether configuration backups contain sensitive credentials.
Security teams can compare their systems with CISA’s Known Exploited Vulnerabilities catalog, but the roundup’s Gotenberg example is a reminder to review vendor advisories and other reliable vulnerability reporting too. Users should install the corrected Microsoft Authenticator version, keep Android apps updated, and avoid opening unexpected invoice files or accepting unexplained prompts. Further information may emerge as Fortinet publishes advisory details and researchers provide updates on the malware and campaigns described.
Key Questions
What is FortiBleed?
FortiBleed is the name used for a campaign that the FBI and U.S. Secret Service said was still active against Fortinet devices. Fortinet says it involves reused or weak credentials and is not a newly identified Fortinet vulnerability.
What should Fortinet customers do?
Check Fortinet’s current advisories and apply the updates relevant to your product and version. Review administrator accounts and configuration backups, replace weak or reused passwords, and enable multifactor authentication where available.
What does the MR ROBOT Android kit do?
CloudSEK reported that criminals rent the kit to create fake banking apps. Those apps can steal one-time codes and secretly forward calls, according to the company’s research.
Was the Microsoft Authenticator issue fixed?
The roundup says Microsoft fixed the Android issue, identified as CVE-2026-80097, after researchers reported that another app could obtain work-account login tokens. The supplied material does not say how many users were affected.
Does CISA’s list include every serious flaw?
No. The roundup says the Gotenberg flaw was not on CISA’s Known Exploited Vulnerabilities list at the time, despite VulnCheck reporting attack attempts. The list is one reference for security teams, not a complete inventory of every reported risk.
Source: ThorstenMeyerAI.com
