🔍 Read the full analysis: AI Security Questions Raised By This Week’s Firewall And Trojan News on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A security roundup published October 29 highlights active attacks on Fortinet firewalls alongside new reports on Android banking malware, a malicious PDF and stolen work-account tokens. The reports also raise questions about how quickly organizations patch exposed systems and whether AI-themed identities can be trusted; several claims come from security firms and need that context.
A security roundup published October 29 has drawn attention to an active campaign against Fortinet firewalls, alongside reports of Android banking malware, a backdoor delivered through a fake invoice, and a flaw involving Microsoft Authenticator on Android. The developments matter because they involve exposed network devices and everyday business accounts, while showing that stolen credentials and user prompts can be as consequential as software vulnerabilities.
The roundup, by Thorsten Meyer, selected six stories from The Hacker News’ October 29 weekly digest. It reports that Fortinet issued coordinated security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including critical- and high-severity fixes. Fortinet said public advisories for those updates would follow on November 10. Separately, the FBI and U.S. Secret Service warned on October 6 that a campaign dubbed FortiBleed was still active.
According to the agencies’ advisory, the campaign reuses previously leaked passwords, targets weak credentials and takes advantage of older password-storage practices. The agencies cited SOCRadar as verifying more than 86,644 compromised devices across 194 countries. That is a figure attributed to the security firm, not an independently established count in the supplied material. The agencies said attackers create administrator accounts and may sell access; they named INC/Lynx and Payload as ransomware groups that buy access.
Other items in the roundup include CloudSEK’s report on MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can steal one-time codes and forward calls; Trellix’s account of a backdoor hidden in a blank PDF disguised as a FedEx tax invoice; and research by Enclave on an Android issue that could expose Microsoft Authenticator work-account tokens to another app. Microsoft has fixed the Authenticator issue, identified as CVE-2026-80097. Cequence also reported tracking a scanner that used about 32 fabricated AI-bot identities while seeking password files and cloud keys.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls and Phones
The reports point to several routes into business systems: reused passwords against internet-facing firewalls, deceptive files that depend on a user approving a warning, and mobile apps that handle authentication tokens. The common thread is not a single new technique but the exposure of valuable access through credentials, software behavior and user decisions.
For organizations, compromised firewall access can provide a route into wider networks, while stolen work-account tokens may give an attacker access without needing to repeat a normal sign-in. The roundup’s account of MR ROBOT also shows how criminal services can package fraud tools for rental, although the source does not establish how widely this kit has been used or how many victims it has caused.
The reports also bear on how teams prioritize fixes. The roundup says CISA gave U.S. federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was not on CISA’s Known Exploited Vulnerabilities catalog despite VulnCheck recording 1,358 attack attempts in 30 days. That number is attributed to VulnCheck; the source does not specify the method behind the attempt count. The comparison underscores that a government catalog is one input to patch decisions, not a complete inventory of risk.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
How the Six Reports Connect
The roundup is a selection and synthesis, not a single incident report. Meyer says The Hacker News’ Thursday digest contained 30 stories and that he chose six for business and general readers, checking original advisories or research reports where possible. The six cover firewalls, Android devices, email and document delivery, AI-themed web traffic, and vulnerability prioritization.
Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the campaign to credentials reused from earlier incidents, password guessing and weak passwords without multifactor authentication. That distinction matters: the ongoing campaign described by the agencies is separate from Fortinet’s October software updates. The source says the updates include fixes found with AI-assisted testing, but it does not provide the technical details of each flaw because the public advisories were scheduled for November 10.
The security firms cited in the roundup have relevant expertise, but several numerical findings come from firms that sell security services or products. Hudson Rock, for example, analyzed 1,703 firewall configuration reports from 1,689 devices and counted 40,573 password-containing records. It said 7,437 local-account records were marked disabled and cautioned that the figures represent records, not people, and that not all credentials remain usable.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
What the Reports Do Not Establish
The supplied material does not give technical details for Fortinet’s October 22 fixes, the affected product versions, or the conditions required to exploit each flaw. Fortinet’s public advisories were due on November 10, so the specific exposure and remediation requirements were not yet clear from this roundup.
The number of FortiBleed victims and the extent of current access remain uncertain. SOCRadar’s reported device count and Hudson Rock’s configuration-record analysis use different datasets and should not be treated as interchangeable counts of people or confirmed active compromises. The roundup also does not provide independent confirmation of the reported Android kit’s reach, the number of infected devices, or the impact of the PDF backdoor and Authenticator issue.
Cequence’s finding describes one scanner using about 32 fake AI-bot identities; it does not establish that the scanner was operated by an AI system or that its requests led to successful theft. The source also does not explain VulnCheck’s counting method for Gotenberg attack attempts. Those limits leave the scale and outcomes of several reported activities unresolved.
Advisories and Patch Decisions Ahead
Fortinet’s public advisories scheduled for November 10 should provide more detail on the October 22 updates and help customers identify affected systems and required actions. Organizations using Fortinet products will need to review those notices and separately examine firewall access practices, including reused or weak passwords, administrator accounts and multifactor authentication.
Security teams can also compare CISA’s Known Exploited Vulnerabilities catalog with vendor advisories and other credible threat reporting when setting patch priorities. The roundup recommends treating the six reports as prompts for concrete checks rather than assuming every organization has been affected. For users, the reported incidents reinforce basic caution around unexpected files and app permission requests, but the source does not offer a confirmed victim tally or a single action that addresses every threat.
Key Questions
What is FortiBleed?
FortiBleed is the name used for a campaign targeting Fortinet firewalls with credentials, including passwords leaked in earlier incidents or weak passwords, according to the FBI and U.S. Secret Service advisory described in the roundup. Fortinet said the campaign is not a new Fortinet vulnerability.
Are the Fortinet software updates separate from FortiBleed?
Yes. The roundup describes FortiBleed as a credential-focused campaign and separately reports that Fortinet issued updates for FortiOS, FortiManager and FortiAnalyzer on October 22. The public advisories for those updates were scheduled for November 10.
What does the MR ROBOT Android kit reportedly do?
CloudSEK reported that criminals rent the MR ROBOT crime kit to make fake banking apps. The apps can steal one-time codes and secretly forward calls, according to the firm; the roundup does not state how many devices or victims were affected.
Was the Microsoft Authenticator issue fixed?
Yes. The roundup says Microsoft fixed the Android issue reported by Enclave, which could allow another app to obtain work-account login tokens. It is identified as CVE-2026-80097.
Does CISA’s vulnerability catalog include every serious flaw?
No. The roundup says a critical Gotenberg flaw was not listed in CISA’s Known Exploited Vulnerabilities catalog, while VulnCheck reported 1,358 attack attempts in 30 days. That figure is attributed to VulnCheck, and the source does not give its counting method.
Source: ThorstenMeyerAI.com
