🔍 Read the full analysis: This Week’s AI Threat Brief: Banking Malware, Blank PDFs And Tokens on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A weekly security roundup published October 29 highlights six risks: an active campaign targeting Fortinet firewalls, rented Android banking malware, a backdoor delivered through a blank PDF, an Android Authenticator flaw Microsoft has fixed, automated scanners posing as AI bots, and a gap between CISA’s patch list and reported attack activity. The roundup draws on vendor and agency reports; some counts come from security companies and have limits. Its immediate actions include reviewing firewall credentials, applying security updates and checking exposure to affected software.
ThorstenMeyerAI.com published a six-story security brief on October 29, highlighting an active campaign targeting Fortinet firewalls, Android malware built to steal banking credentials, a backdoor hidden in a blank-looking PDF, and other recent threats. The report says it selected six stories from a 30-item weekly Hacker News digest and checked the original advisories or research reports, giving businesses and individual users a short list of risks and suggested actions.
The most immediate concern for network administrators is FortiBleed, an ongoing campaign against Fortinet firewall devices. The brief says the FBI and U.S. Secret Service warned on October 6 that attackers were reusing exposed passwords, guessing weak credentials and cracking password files made with an older method. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices in 194 countries. Those figures are attributed to the security firm, not presented as an independent government count.
Fortinet separately released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, with critical- and high-severity fixes. Public advisories are scheduled for November 10, according to the brief. It also cites Hudson Rock’s October 27 analysis of 1,703 configuration reports from 1,689 devices, which found 40,573 records containing plaintext passwords. Hudson Rock said these were records, not necessarily active accounts or distinct people; 7,437 local accounts were marked disabled. Fortinet has said FortiBleed is not a new Fortinet vulnerability and has linked the campaign to reused or weak passwords and missing multifactor authentication.
Other items concern different points of exposure. CloudSEK reported an Android crime kit called MR ROBOT, rented by criminals to create fake banking apps that can steal one-time codes and forward calls. Trellix said it traced a backdoor to an apparently empty PDF disguised as a FedEx tax invoice; its account says the infection required a user to accept a PDF reader warning. Researchers at Enclave reported that another app could obtain work-account login tokens through Microsoft Authenticator on Android. Microsoft has fixed the issue, listed as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls and Phones
The reports matter because they describe routes into both business networks and personal accounts, rather than one isolated class of attack. A compromised firewall can expose a network’s perimeter and its stored configuration details. Fake banking apps and stolen authentication tokens can put financial or workplace accounts at risk, while a malicious document can turn a routine invoice into a point of entry.
The roundup also cautions against treating one official list as a complete measure of exposure. It says CISA gave U.S. federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was not on CISA’s Known Exploited Vulnerabilities list despite VulnCheck recording 1,358 attack attempts over 30 days. That attempt count comes from VulnCheck and does not, by itself, establish how many attacks succeeded. For security teams, the practical point is to combine formal patch requirements with their own assessment of exposed systems and credible threat reporting.
Several findings also involve trust decisions: whether a password is still safe, whether a document warning should be accepted, or whether an app claiming to be an AI bot is genuine. The report’s suggested actions—patching, reviewing credentials and checking software exposure—address those risks without implying that any one measure can prevent every attack.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
How the Six Reports Fit Together
The article is a weekly selection, not a single incident investigation. Thorsten Meyer says the Hacker News digest for October 29 contained 30 stories; his site chose six for business and everyday-user relevance and checked the original research or advisories. The source notes that many statistics came from security vendors that also sell protective products, so their counts are attributed to the firms.
Alongside the firewall, banking malware, PDF and Authenticator reports, the brief describes Cequence’s account of an automated scanner that rotated through about 32 fake AI-bot identities while requesting password files and cloud keys. It also contrasts CISA’s required patching list with the Gotenberg activity count reported by VulnCheck. These are separate findings from different researchers and agencies, not evidence that all six threats are linked.
For Fortinet customers, the brief distinguishes the active credential-based FortiBleed campaign from the company’s October 22 security updates. The publicly available advisories for those updates were not due until November 10, leaving the specific vulnerability details undisclosed at the time of publication.
““Most numbers below come from the security companies that found the problem. They are good at this work, and they also sell protection against it.””
— Thorsten Meyer, author of the roundup
Limits of Counts and Disclosure
The precise scale of the FortiBleed campaign remains uncertain. The figures cited in the brief come from SOCRadar and Hudson Rock, and Hudson Rock warns that configuration records do not necessarily represent active accounts or unique people. The source does not establish how many of the reported devices remain vulnerable or how many intrusions led to further compromise.
Fortinet’s October 22 updates included critical- and high-severity fixes, but the detailed public advisories were scheduled for November 10. Until those disclosures, the roundup does not provide the affected versions, individual vulnerability identifiers or full technical details. The supplied material also does not give the number of victims or successful infections for MR ROBOT, the PDF backdoor or the Authenticator issue. VulnCheck’s Gotenberg figure is described as attack attempts, not confirmed successful compromises.
Patch Releases and Defensive Checks
Fortinet customers should follow the vendor’s security guidance and apply the available updates for FortiOS, FortiManager and FortiAnalyzer, then review firewall accounts, stored configurations, reused passwords and multifactor authentication. The November 10 advisories should clarify the specific flaws addressed by the October 22 releases. Security teams can also compare their exposed software with CISA’s KEV list while checking other credible reporting for risks absent from that catalog.
Organizations should confirm whether they use the affected Android Authenticator version and install Microsoft’s fix, while users should avoid accepting unexpected document-reader warnings or installing banking apps from unverified sources. The reports do not supply a complete victim count or a consolidated incident timeline; further vendor advisories and independent analysis may refine what is known.
Key Questions
What is the main development in this security brief?
ThorstenMeyerAI.com published a six-story roundup on October 29, summarizing recent threats and security findings from vendor research and agency advisories. It is a report on several separate developments, not a single coordinated attack.
What is FortiBleed, according to the brief?
It is the name used for an ongoing campaign targeting Fortinet firewalls with reused or weak credentials, according to the source material. Fortinet said the campaign is not a new Fortinet vulnerability; the brief also reports that the FBI and U.S. Secret Service warned it was still active.
Has Microsoft fixed the Authenticator issue?
Yes. The roundup says Microsoft fixed the reported Android issue, identified as CVE-2026-80097. It does not specify in the supplied material which app versions are affected or give further installation instructions.
Does the Gotenberg figure mean 1,358 systems were compromised?
No. The source describes 1,358 recorded attack attempts over 30 days, citing VulnCheck. It does not say that those attempts succeeded or that 1,358 separate systems were compromised.
What should organizations do now?
Review Fortinet’s update guidance and patch affected products, check firewall credentials and multifactor authentication, and track the scheduled November 10 advisories. Teams should also assess their exposure to the other named products and apply relevant vendor fixes.
Source: ThorstenMeyerAI.com
