American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

thehackernews.com Oct 29, 2026

American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

Curated by Shubham · TechCapsules · Oct 29, 2026

AI-summarised brief · reviewed before publication

A new phishing campaign, Skyw4lker, targets U.S. manufacturing, technology, and healthcare firms by sending password‑protected business documents that lure victims into a legitimate Microsoft device‑authorization flow. The attackers host the documents on Google sites, then redirect users to Microsoft authentication, where the victim unknowingly grants access tokens. ANY.RUN’s sandbox analysis revealed obfuscated JavaScript, a PHP backend, and repeated polling to capture IP and geolocation data. The FBI’s 2024 complaint data shows phishing remains the most reported internet crime, underscoring the campaign’s relevance.

💡 Why It Matters

· By exploiting legitimate authentication flows, Skyw4lker bypasses traditional credential‑stealing defenses, forcing security teams to adopt behavioral analysis and interactive sandboxes to detect and mitigate such subtle attacks.

Capsules Cybersecurity

Read full article on thehackernews.com

Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security…

Adobe released security patches for Campaign Classic, fixing eight critical vulnerabilities that could enable arbitrary code execution, privilege escalation, and security feature bypass. The flaws affected versions 7.4.4 build 9402 and earlier on Windows and Linux, and were resolved in build 9403. Additionally, a high‑severity code injection flaw (CVE‑2026‑48360, CVSS 9.6) in Adobe Connect Desktop and Mobile was fixed across Windows, macOS, and Android. Adobe reports no known wild exploits and urges users to update to the latest builds for protection.

💡 The fixes close high‑risk entry points that could let attackers take full control of Campaign Classic and Connect environments, safeguarding sensitive marketing data and preventing potential widespread compromise.

techcrunch.com · Oct 29

South Korea’s financial industry hit by fresh wave of cyberattacks

South Korea’s financial sector faced a new wave of cyberattacks, targeting brokerages Daishin Securities and Mirae Asset Global Investments and crypto exchange Bithumb. Daishin disclosed that 38,490 customers’ personal data—names, emails, and phone numbers—were exposed, and it has notified authorities and will compensate losses. Mirae and Bithumb reported separate incidents, though no data breach confirmation yet. The attacks follow a September series linked to a China‑based hacker using AI tool Artex. Regulators urge stronger cybersecurity and plan checks across private IT systems.

💡 The breaches expose systemic weaknesses in Asia’s financial defenses, prompting urgent regulatory action and heightened scrutiny of AI‑driven hacking tactics.

thehackernews.com · Oct 29

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors are probing a newly patched Oracle E‑Business Suite flaw, CVE‑2026‑101767, after Oracle released a critical patch last week. The vulnerability, a 9.8‑scored unauthenticated SQL injection in the Thin Client Framework servlet, can be chained to remote code execution, allowing attackers to run OS commands as the EBS application account. Horizon3.ai discovered and reported the flaw on July 24, 2026, and Defused Cyber confirmed exploratory exploits on October 27. Oracle urges immediate patching; workarounds are available for those unable to update.

💡 The flaw exposes core financial, payroll, and HR data to attackers, underscoring the urgency of patching legacy enterprise systems before exploitation escalates.

thehackernews.com · Oct 28

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic…

The U.S. Cybersecurity and Infrastructure Security Agency added Adobe Commerce, Magento, and Google’s Brotli decoder to its Known Exploited Vulnerabilities catalog after evidence of active attacks. Sansec reported that attackers used CVE‑2026‑48356 (PolyShell) to breach hundreds of e‑commerce sites, injecting a malicious loader via a Magento CMS block. CVE‑2026‑111497 (Broccoli2Shell) has also been exploited, with traffic from a Dutch IP targeting Node.js and other platforms. Vendors, including PHP, Node.js, and Google, have released patches, and federal agencies must remediate by November 10, 2026.

💡 The widespread use of Brotli in cloud services means the vulnerability could affect millions of deployed applications, turning a routine compression library into a mass‑exploitation vector. Prompt patching is essential to prevent large‑scale crashes and potential remote code execution across critical infrastructure.

thehackernews.com · Oct 28

Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access…

Tailscale issued version 1.104.4 to remediate critical flaws in its built‑in SSH server that allowed root‑level socket forwarding. The vulnerabilities stemmed from the tailscaled background process, which performed network‑connection forwarding as root after a superficial path check; a timing attack could replace the checked path and grant access to privileged sockets such as Docker’s control socket or the tailscaled local API. Exploitation required an attacker to already control a device permitted by the network’s policy to open an SSH session with forwarding enabled, but no stolen credentials were needed. Researcher Erica Windisch of Cyberdione Labs disclosed the “Tailworm” chain, demonstrating rapid lateral movement across trusted devices and root shell acquisition. The patch changes forwarding to run under the logged‑in user and relies on OS file permissions, while Tailscale advises disabling forwarding via TS_SSH_DISABLE_FORWARDING=1, tightening access rules, and using check mode for sensitive systems. The self‑hosted headscale server remains unpatched as of the latest release.

💡 By turning a trusted device into a conduit for root‑only sockets, the flaw enabled near‑instant lateral escalation across an organization’s zero‑trust network, forcing admins to reassess device‑based trust models.

quantumcomputingreport.com · Oct 28

IonQ Deploys Intercontinental Hybrid QKD and PQC Architecture Securing Enterprise Links Between…

IonQ announced the launch of an operational hybrid quantum‑safe security network linking its Geneva and Seoul facilities. The architecture combines physical quantum‑key distribution (QKD) with algorithmic post‑quantum cryptography (PQC) to protect mission‑critical data and communications against “harvest‑now‑decrypt‑later” attacks. By using QKD for short‑range, high‑density endpoints and PQC for long‑distance key agreement, the deployment overcomes the photon‑attenuation limits of conventional fiber links without relying on untrusted repeaters. IonQ frames the link as a repeatable, defense‑in‑depth blueprint for multinational enterprises and sovereign bodies facing accelerated post‑quantum migration deadlines. The rollout coincides with industry‑wide warnings that 256‑bit elliptic‑curve cryptography could be broken by mid‑2020s quantum computers, prompting tighter regulatory timelines for quantum‑resistant encryption.

💡 It demonstrates a scalable, real‑world model for merging physical and algorithmic quantum defenses, giving global enterprises a concrete path to meet looming quantum‑security mandates.