Cybersecurity isn't easing into the week. |
Today, I'm watching a massive bank theft and retail fraud that's just in time for the holiday season. - Ken
Missed a newsletter? Read past issues here. |
|
|
|
Here’s what you need to know: |
|
|
|
€118 Million Stolen From French Bank |
French bank Crédit Mutuel Arkéa reported that attackers exploited a supplier’s platform to steal approximately €118 million from the bank’s own account. Although customer accounts remained unaffected, the incident highlights how compromised third-party access can enable unauthorized financial transactions. |
My Take: This incident makes me wonder if the bank applies the same fraud detection standards to their own accounts as they do to customer transactions.
Monitor institutional accounts for unusual transfers, enforce transaction limits, and require secondary approval for large transfers. |
GPT-6 Cyber Exposes 81 Firefox Vulnerabilities |
OpenAI launched GPT-6 Cyber, a security-focused AI model designed to identify and exploit software vulnerabilities. The model uncovered 81 previously unknown high-severity Firefox vulnerabilities and developed exploits for 948 Linux kernel flaws.
My Take: As AI tools become more capable of exploiting vulnerabilities, security teams need to test whether their existing controls can limit the blast radius if those tools go rogue. Restrict AI tools to isolated testing environments, enforce least-privilege access, and monitor activity for unauthorized actions. |
CISA Warns of Active SonicWall VPN Attacks |
CISA added CVE-2026-19868 to its KEV catalog after confirming attackers exploited a SonicWall SSLVPN authentication bypass vulnerability. The flaw lets attackers with valid alternative credentials bypass SAML authentication and MFA to access internal networks. My Take: Verify that all VPN authentication methods enforce consistent security controls and cannot bypass MFA requirements. Patch affected SonicOS appliances and review SSLVPN logs for suspicious logins and signs of exploitation. |
|
|
|
Stellar Cyber is a full-cycle AI-native SecOps platform purpose-built for enterprise security teams and MSSPs. Stellar Cyber delivers the whole threat picture, empowering organizations to see every threat, know what matters most, and act with speed and confidence. Stellar Cyber’s results are empirically proven: analyst productivity improved by 80% and false positives reduced by over 90%.
Stellar Cyber’s open SecOps platform unifies SIEM, NDR/OT, ITDR/UEBA, detection, investigation, triage, response, and Multi-Layer AI™ under one license. Stellar Cyber is trusted by one-third of the world’s top 250 MSSPs and over 15,000 organizations worldwide.
|
|
|
| Holiday Fraud Schemes Target Retailers and Shoppers |
Flashpoint researchers uncovered refund scams, gift card fraud, retailer impersonation, and compromised ecommerce store access ahead of the holidays. These scams exploit security gaps across retail operations, risking financial losses and customer data theft. |
My Take: I think retailers should examine refund requests alongside payment activity to identify suspicious patterns. Account changes should also be reviewed, since investigating these events separately could allow coordinated fraud to go undetected. Require additional verification for duplicate refund requests, flag unusual gift card activity, and restrict unauthorized account changes. |
GhostMap Android Flaw Traps Phones in Endless Crash Loops |
Bitdefender discovered GhostMap, an Android vulnerability that triggers repeated device crashes when a malicious app is installed, without requiring permissions or execution. The flaw could force users to factory reset their devices and lose data, and Google has not committed to releasing a fix. My Take: I think GhostMap highlights the importance of restricting untrusted app installations. Enforce approved app sources through MDM policies, block sideloading, and maintain recoverable device backups. |
|
|
|
Can You Spot a Holiday Shopping Scam? |
Holiday shopping creates opportunities for scammers to exploit the surge in online purchases, promotional offers, and customer service requests. |
How to protect yourself from holiday shopping fraud: |
- Verify retailers and secure accounts by shopping on trusted websites, checking suspicious offers, and enabling multifactor authentication.
-
Protect payments and gift cards by using secure payment methods, enabling transaction alerts, and purchasing gift cards from reputable sources.
- Detect phishing and impersonation scams by avoiding suspicious links and using deepfake detection tools to identify fraudulent videos, voices, and promotions.
|
Treat unexpected payment requests, account changes, and refund notifications as potential fraud indicators until independently verified. |
|
|
|
Security Tools You Can Use |
| |
|
Do you trust your bank to stop threat actors from stealing your money? |
|
|
|
Yesterday's Pulse Check Results |
Would you detect a vendor changing critical system settings? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
