Home / Cybersecurity / FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access…
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
thehackernews.com Oct 9, 2026

FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

Curated by · TechCapsules ·

AI-summarised brief · reviewed before publication

The FBI and six allied agencies issued a joint advisory on Oct. 8 detailing a campaign by hackers linked to China‑based Integrity Technology Group (ITG), a firm sanctioned by the U.S. and U.K. The actors stole email from government bodies, law‑enforcement, healthcare and religious groups across Southeast Asia, Africa and North America, using a custom tool with over 1,300 penetration‑testing scripts to scan for vulnerabilities, guess Microsoft 365 and Exchange passwords, and copy mailboxes. They also operated a web portal that granted unidentified third parties access to the harvested messages. Investigations show the group has been active since at least Jan. 2021 and previously ran a botnet of more than 200,000 compromised devices. ITG denies the accusations, while U.S. officials claim its leadership has long gathered intelligence for Chinese security agencies.

💡 Why It Matters

  • · By exposing a supply‑chain of stolen communications that can be redistributed to unknown actors, the advisory reveals a new layer of cyber‑espionage that bypasses traditional detection and amplifies the reach of state‑aligned threat groups.
Capsules Cybersecurity
Read full article on thehackernews.com
More in Cybersecurity →
China-based suspect used AI tools in S Korea bank hacks: report
bdnews24.com · Oct 8

China-based suspect used AI tools in S Korea bank hacks: report

CrowdStrike identified a 26‑year‑old suspect from Guangdong, China, as the likely perpetrator of recent cyberattacks on South Korean banks. The attacker employed the Chinese‑developed AI penetration‑testing tool ARTEX and large‑language models such as Anthropic’s Claude to locate vulnerabilities, gather information, and even draft a resume for a security researcher. Analysis of AI coding‑tool sessions linked the suspect’s personal details, including a Maoming address and Telegram account. The case underscores growing concerns about AI agents’ role in facilitating financially motivated cybercrime.

💡 The incident demonstrates how readily available AI tools can lower the barrier to sophisticated hacking, forcing financial institutions to reassess their defensive posture against autonomous threat actors.

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
thehackernews.com · Oct 8

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and…

A new phishing kit, dubbed Wazza, has emerged that targets banking, manufacturing, and government entities across the United States, Europe, and Australia. Unlike traditional kits that simply mimic login pages, Wazza incorporates a multi‑stage routing chain that filters traffic, validates sessions, and selectively delivers an Adobe‑themed Device Code phishing page. The kit’s sophisticated delivery mechanism obscures malicious intent until the final lure is served, complicating automated detection and increasing investigation time for managed security service providers.

💡 By hiding its payload behind layered traffic controls, Wazza forces defenders to deploy deeper behavioral analysis, raising the bar for early threat detection and response.

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
thehackernews.com · Oct 8

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Cybersecurity researchers exposed a long‑running npm supply‑chain attack dubbed MALFEX, orchestrated by a lone threat actor. Twelve malicious packages, including “function‑flag,” “tlxbnhd,” and “img‑to‑native,” were published since August 2023, collectively downloaded 40,767 times. The packages use post‑install hooks to download and execute Windows executables or Go binaries that deliver an Overlord RAT or a Node.js stealer. The operator’s Portuguese‑language commits and Brazilian handle suggest a Brazilian origin, but the attack targets are global.

💡 The campaign demonstrates how seemingly benign npm packages can become sophisticated delivery mechanisms for remote‑access trojans and data stealers, expanding the threat surface for developers and enterprises alike.

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
thehackernews.com · Oct 8

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google…

Attackers compromised the .gh, .sl, and .as country‑code top‑level domains, issuing unauthorized HTTPS certificates for several Google and YouTube names. Google’s systems were untouched, but the hijacked domains could allow attackers to impersonate Google sites and intercept encrypted traffic. Chrome immediately blocked the rogue certificates via CRLSets, and Google worked with Let's Encrypt, ZeroSSL, and other CAs to revoke the 12 certificates logged between September 22 and 27. The incident also exposed other global brands, though specifics remain undisclosed.

💡 The breach shows how DNS hijacks can undermine even the most secure sites, revealing that certificate authorities can be tricked into issuing valid keys for compromised domains. It underscores the need for stricter DNS and CAA controls to prevent future exploitation.

Print Infrastructure Is the Biggest Zero Trust Gap CIOs Haven’t Closed, Survey Finds
financialpost.com · Oct 8

Print Infrastructure Is the Biggest Zero Trust Gap CIOs Haven’t Closed, Survey…

Vasion’s latest research, released in St. George, Utah, shows that document and print workflows remain the weakest link in enterprise Zero Trust strategies. The survey of chief information officers and senior IT leaders found 54 percent consider the risk to these workflows “known and accepted,” yet only 16 percent have actually incorporated printing devices into a Zero Trust architecture. Respondents cited legacy hardware, fragmented management tools and limited visibility as barriers to securing print infrastructure. The study also highlighted that most organizations continue to rely on traditional perimeter defenses, leaving printers and multifunction devices exposed to credential theft and data leakage. Vasion warns that the unchecked gap could undermine broader cybersecurity investments. Without remediation, attackers can pivot from printers to network assets.

💡 Overlooked printers give hackers a foothold that can quickly expand into a full‑scale network breach.

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
thehackernews.com · Oct 7

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT‑UA uncovered over 100 compromised sites that inject malicious JavaScript to deliver LunexStealer, a data‑stealing malware. The attacks, linked to threat cluster UAC‑0277, use forged Cloudflare verification pages to prompt users to run a command that downloads an MSI package via ClickFix. The malware installs a browser extension, LUNARAXE, and a native messaging host, NAIVEMESS, enabling file system access and remote command execution. CERT‑UA recommends restricting MSI execution, blocking vulnerable drivers, and limiting browser extensions.

💡 The campaign demonstrates how attackers blend social engineering with blockchain‑based command retrieval, expanding the attack surface for credential theft and remote control.