In today’s cybersecurity news…

Meta AI hands over Instagram account access

Attackers exploited Meta’s AI support chatbot to take over high-profile Instagram accounts, such as the Obama White House, the Space Force’s chief master sergeant, and Sephora. Attackers used a VPN to match the target’s region, started a password reset, then convinced the chatbot to replace the account’s email with one they controlled, which triggered a reset code and handed them access. Meta appears to have patched the flaw in the last 24 hours. (404Media)

Dutch police dismantle huge botnet

Dutch authorities dismantled a botnet of roughly 17 million infected computers, phones, and tablets after a researcher tipped off the National Cyber Security Centre. Investigators identified around 200 command-and-control servers and seized several tied to what local reports say was the residential proxy service Asocks, which allegedly routed malicious traffic through compromised consumer devices. This is part of a broader crackdown on botnets used for cyberattacks, phishing, fraud, and proxy abuse, and officials are urging people to update devices, secure Wi-Fi networks, and enable multi-factor authentication. (SecurityWeek)

RedHat packages get backdoored  

A supply-chain attack compromised more than 30 npm packages in Red Hat’s @redhat-cloud-services namespace, injecting the Shai-Hulud worm during install runs to steal CI/CD, cloud, and developer credentials and self-replicate by republishing through compromised accounts, including GitHub Actions. Systems that installed affected packages should be treated as compromised. Red Hat removed the malicious packages, adding there’s no evidence of impact to customer or production environments. (Ars Technica)

Grab navigates data concerns in Taiwan expansion

Southeast Asia’s ride-hailing and delivery giant Grab is facing scrutiny in Taiwan as it expands beyond its current region, with regulators and the public raising concerns about its use of a China-linked mapping system in its regional operations. The issue could complicate approval for its planned expansion into the Taiwanese market, where data security and foreign tech dependencies are under increased focus. (Nikkei Asia)

Huge thanks to our sponsor, Vanta

WordPress malware lurks in Steam profiles

GoDaddy researchers uncovered a malware campaign compromising nearly 2,000 WordPress sites by hiding command-and-control data in Steam Community comments using invisible Unicode characters. The payload built a malicious URL that delivered JavaScript disguised as legitimate libraries and injected it into WordPress pages, before installing a PHP backdoor triggered by specially crafted POST requests and an authentication cookie. GoDaddy recommends restoring from a clean backup when possible, or fully removing all malware components, since leftover backdoor access can reinfect a site. (BleepingComputer)

US troops tracked in active war zones

U.S. lawmakers say foreign adversaries are using commercially purchased mobile location data to track U.S. troops in active war zones, revealing movement patterns that could enable strikes, drone attacks, or counterintelligence operations. Senators warn this stems from the Department of Defense’s failure to restrict access to sensitive location data and urge stronger cybersecurity protections for servicemembers. (Security Magazine)

Windows Netlogon in attackers’ crosshairs

The Centre for Cybersecurity Belgium is warning that attackers are actively exploiting a critical Microsoft Windows Netlogon flaw, which can let unauthenticated attackers send crafted network requests to a domain controller and execute code with System privileges. Microsoft patched the bug in May, but Belgium’s cybersecurity agency says it’s now being exploited in the wild and urged organizations to install updates immediately. Netlogon handles authentication across Windows domain networks, so successful attacks could give threat actors control of domain controllers and connected machines. (SecurityWeek)

Election phishers register thousands of domains

Check Point researchers report that attackers are increasingly targeting U.S. elections through phishing and impersonation rather than voting systems, registering more than 5,000 election-themed domains in two months alongside roughly 17,000 exposed credentials tied to political and government services. The data suggests these domains and leaked logins are being used for scams, misinformation, and account takeover, with AI further lowering the cost and scale of the campaigns. Also noted – voter and election-related data circulating on criminal forums ahead of the midterms. (The Register)