[BREACH] Framework Warns Customers After Metabase Breach Exposes Contact Data

Framework said hackers stole customers’ names, email addresses, phone numbers and physical addresses through a Metabase attack.

Framework notified every customer and said payment information was not included.

Metabase said attackers used an unknown flaw a zero-day to access its cloud service.

@SableIndex | @SableIndexDiscussion

[FRAUD] WhatsApp “Hello” Lured an Accountant Into a $2.5M Crypto Scam

Police arrested a BJP leader after tracing ₹50 lakh in a scam that allegedly cost a 70-year-old accountant ₹21.06 crore.

A WhatsApp contact led him to a fake trading platform, allowed one withdrawal, showed profits above ₹33 crore, then demanded fees.

He made 106 transfers to 76 accounts; police found 15 laundering layers and froze about ₹2 crore.

@SableIndex | @SableIndexDiscussion

[FRAUD] Fake Jury-Duty Calls Drain Florida Family of $25,000

Scammers posing as sheriff’s deputies told a Florida woman she had missed jury duty and faced arrest unless she paid.

The callers used real personal details, spoofed caller ID and fake warrants, then kept her on the phone for hours.

WSJ reports the family ultimately lost $25,000 in cryptocurrency.

@SableIndex | @SableIndexDiscussion

[MALWARE] Fake Odyssey Downloads Hide Password-Stealing Malware

Bitdefender found fake Windows copies of The Odyssey carrying Lumma Stealer that can steal passwords, payment data, browser sessions and crypto wallets.

If a movie download asks you to run an .exe, stop - a video file should not need an installer.

The campaign uses “1080p WEBRip” and “Blu-ray” filenames, VLC-like icons and hidden .exe extensions to look harmless. Stolen session cookies can let criminals enter accounts even when MFA is enabled.

@SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Report Says Coinsbuy Wallets Emptied Across Two Chains

A report says wallets linked to Coinsbuy were emptied around 13:00 UTC; the total exceeds $7.9M.

If you use Coinsbuy, wait before making a transfer; check balances and activity.

Dark Web Informer attributed the claim to analyst SpecterAnalyst, who linked transfers through several exchanges toward Monero, a privacy-focused coin.

Deposits and withdrawals were paused after the incident and later restored, according to the report. Coinsbuy’s news page showed no incident notice.

@SableIndex | @SableIndexDiscussion

[MALWARE] Kimsuky Uses Local AI to Sharpen Phishing Attacks

A North Korean group is using local AI to sharpen phishing; finance-themed ZIP attachments can hide Windows shortcuts that launch PowerShell malware.

Genians identified the group as Kimsuky in an Aug. 9 report, saying local LLMs help process stolen documents and scale lures.

It found Ollama, GPT4All and Msty, plus Git-hosted AsyncRAT payloads.

@SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Valve Warns Steam Hardware Buyers After Logistics Hack

Valve began notifying Steam hardware customers today that a cyberattack at shipping partner CEVA exposed names, addresses, phone numbers, emails, and order details.

Attackers accessed CEVA systems from July 29 to Aug 1; Valve says passwords, Steam Guard codes, and payment data were not exposed. The stolen delivery data can make phishing look genuine.

@SableIndex | @SableIndexDiscussion

[DEVELOPING · RANSOMWARE] CISA Warns Gunra Ransomware Now Targets Global Organizations

CISA, FBI and partners issued a new warning today about Gunra, a ransomware service used by affiliates across the Americas, Europe, Middle East, Africa and Asia-Pacific.

Gunra encrypts files, steals data, then threatens to publish it. Investigators say attackers often move from a compromised VPN to the wider network within days.

@SableIndex | @SableIndexDiscussion

[CRIME] Com Member Sentenced After Sextortion of Nearly 120 Victims

A member of “The Com” was sentenced to two years in prison after blackmailing and sexually extorting nearly 120 victims worldwide.

The victims included children and teenagers. The case shows how online coercion has become organized cybercrime, not just isolated harassment.

@SableIndex | @SableIndexDiscussion

[BREACH] BdThemes WordPress Plugins Create Hidden Admins After Supply-Chain Hack

Researchers say attackers compromised BdThemes’ update infrastructure and used malicious code to create rogue administrator accounts on WordPress sites. The Element Pack plugin has over 100,000 active installs.

The plugins were pulled from WordPress.org on Aug. 8. The injected code could install a webshell without requiring a plugin update or user click.

@SableIndex | @SableIndexDiscussion

[BREACH] Mozilla Replaces Firefox Signing Key After GitHub Exposure

Mozilla replaced the GPG key used to verify some Firefox and Thunderbird releases after an unencrypted copy was committed to a private GitHub repository.

Linux users who installed Firefox through RPM packages should run system updates; most users need no action.

Mozilla revoked the old key and found no evidence of unauthorized access. The exposed key signed Linux tarballs, RPM packages and checksum files - not standard browser updates.

@SableIndex | @SableIndexDiscussion

[RANSOMWARE] CISA Confirms SharePoint Flaw Is Fueling Ransomware Attacks

CISA says ransomware gangs are now exploiting a SharePoint Server flaw that lets attackers run code on unpatched systems.

More than 200 internet-exposed servers remained vulnerable when checked by Shadowserver. The flaw can be exploited with low privileges and little complexity.

@SableIndex | @SableIndexDiscussion

[MALWARE] Microsoft Patches 400 Flaws After Lazarus Zero-Day Attacks

Microsoft released security updates for 400 vulnerabilities, including a Windows zero-day already exploited by North Korea’s Lazarus group.

After gaining local access, attackers can exploit the flaw without further user interaction, obtain SYSTEM privileges and deploy a stealthy rootkit.

Two more zero-days were publicly disclosed, while 42 vulnerabilities were rated critical.

@SableIndex | @SableIndexDiscussion

[EXPLAINED · CRIME] Scattered Spider Wins by Making Employees Open the Door

Scattered Spider does not usually begin with an exotic software exploit. Its operators call a company’s help desk, sound convincing and persuade someone to hand them access.

That simple idea has produced extraordinary damage. In July 2026, the US Justice Department described the group as responsible for more than 100 network intrusions, over $100 million in ransom payments and millions more in disruption. The statement accompanied the extradition of 19-year-old Peter Stokes, an alleged member who has not been convicted.

Scattered Spider is less a traditional gang than a shifting cybercrime network. Authorities and researchers also track parts of the same activity as Octo Tempest, UNC3944, 0ktapus and Muddled Libra. Those labels describe overlapping behavior, not a reliable membership list.

The attack often starts with research. Criminals collect an employee’s name, role, phone number and internal vocabulary from social media, leaked databases and previous breaches. They then impersonate that employee to technical support, or pose as support when contacting the employee.

The goal is a password reset and a new multifactor-authentication device. If persuasion fails, the attackers may flood the victim with login prompts, steal a one-time code or convince a mobile carrier to transfer the victim’s number to another SIM. No Hollywood-style hacking is required when the criminal can make the real support process work on their behalf.

Once inside, the group frequently uses legitimate administration software such as AnyDesk, TeamViewer or ScreenConnect. These tools are common in real IT departments, so their presence alone may not trigger an alarm. The intruders steal data, move through cloud accounts and sometimes deploy ransomware. CISA says recent activity has included DragonForce.

The 2023 MGM Resorts attack showed what this method can do. Hotel systems, digital room keys and casino operations were disrupted. MGM later estimated that the incident reduced quarterly earnings by roughly $100 million. The attackers did not need to defeat every security product; they needed an identity trusted by those products.

The network also appears willing to move quickly between targets and monetization methods. A 2026 US complaint alleges that Stokes and accomplices demanded about $8 million from a jewelry retailer. The company expelled them and paid nothing, yet still recorded at least $2 million in response and disruption costs.

Arrests matter, but they do not automatically dismantle Scattered Spider. A loose network can replace an operator, reuse stolen access and reorganize under another name. Its most valuable capability is fluent, patient social engineering - not a single server that police can seize.

The uncomfortable lesson is that an employee can follow a familiar support procedure and still open the door. Strong defenses require phishing-resistant security keys, strict identity checks for password resets and callbacks through a known company number. A convincing voice should never be enough to transfer control of an account.

@SableIndex | @SableIndexDiscussion

[FRAUD] FBI Warns Hackers Are Stealing Private Photos for Blackmail

The FBI says criminals are breaking into social media accounts to steal intimate photos and videos, including content belonging to children.

Stolen material may be sold on criminal marketplaces or used for sextortion. Victims can then face repeated harassment, stalking and threats aimed at obtaining more images or money.

@SableIndex | @SableIndexDiscussion

[DEVELOPING · MALWARE] Poisoned AI Package Exposes Secrets From Thousands of Companies

Researchers say malicious LiteLLM releases captured files linked to more than 2,500 organizations after circulating on PyPI for only 40 minutes.

The malware ran whenever Python started, stealing cloud keys, SSH keys, database passwords and AI-provider credentials, even without LiteLLM being imported.

The figure shows potential exposure, not 2,500 confirmed breaches. Confirmed downstream victims include Mercor and Checkmarx; CERT-EU says a related compromise exfiltrated about 91.7 GB from a European Commission cloud account.

@SableIndex | @SableIndexDiscussion

[MALWARE] 737 Fake VPN Extensions Routed Users Through Proxies

Researchers found 737 Chrome VPN and proxy extensions with 75,486 installs; 274 impersonated established brands such as Proton VPN, ExpressVPN and AdGuard.

While connected, the extensions routed entire browser sessions through SOCKS5 servers tied to one provider, exposing destinations, IP addresses and any data sent over plain HTTP.

@SableIndex | @SableIndexDiscussion