This Week In AI Security: A Rented Trojan, A Blank PDF, And Next Steps

A security roundup published October 29 highlights six developments from the week’s 30-story digest by The Hacker News, including an active Fortinet firewall campaign, rented Android banking malware and a malicious PDF. The author says each item was checked against an original advisory or research report and includes a defensive action for businesses or individual users.

Fortinet issued critical and high-severity fixes on October 22 for FortiOS, FortiManager and FortiAnalyzer. The roundup says the FBI and U.S. Secret Service have warned that a campaign called “FortiBleed,” which targets Fortinet firewalls to steal passwords, remains active. Fortinet is keeping technical details private until November 10. The author recommends applying the fixes, removing administrator logins from public internet access and resetting VPN and administrator passwords.

CloudSEK reported on October 28 that MR ROBOT is an Android crime kit rented by criminals. It can be used to make fake banking apps that steal one-time codes and forward calls, according to the research firm. CloudSEK counted one affiliate’s activity across 153 devices and 5,407 text messages; those figures are the company’s own observations. The suggested user action is to install banking apps only through trusted app stores, not links in messages.

Trellix said an empty PDF disguised as a FedEx tax invoice was used to trigger a hidden backdoor, but only after a victim approved a PDF reader warning. Separately, researchers at Enclave reported that another Android app could obtain work-account login tokens through Microsoft Authenticator despite having zero permissions. Microsoft says it fixed the issue, tracked as CVE-2026-80097. The roundup advises declining prompts to launch content from PDFs and updating Authenticator while setting a minimum allowed app version for managed devices.

Trust Gaps Across Devices and Networks

The six reports point to practical ways attackers can exploit trust in familiar systems: exposed firewall administration, stolen passwords, convincing app links, a user-approved PDF prompt or software that accepts another program’s identity. The roundup’s interpretation is that these risks do not depend on a single novel technique. They can affect both company infrastructure and personal devices.

For organizations, the firewall fixes and token-theft flaw have direct implications for remote access and work accounts. The Android banking kit also shows how fraud tools can be packaged for rental, according to CloudSEK. For individual users, the PDF and fake-app cases underline the risks of approving unexpected prompts or installing apps from messages. These reports describe different incidents and research findings; they do not establish that every system or user was affected.

Patch prioritization is another concern. CISA’s Known Exploited Vulnerabilities catalog gives U.S. federal agencies a required remediation schedule, but the roundup notes that it does not include every vulnerability with reported exploitation. Organizations may need to weigh known exploitation, exposure and severity alongside the catalog when setting patch order.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Logitech MX Mechanical Wireless Illuminated Keyboard Tactile (Graphite)

AmazonView Latest Price

Amazon Kindle Scribe Colorsoft 64GB (1st Generation)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Six Reports From One Weekly Digest

The roundup draws six items from The Hacker News’ weekly digest of 30 stories, published October 29, and says it returned to original advisories or research for the selected items. Its source list includes Fortinet, the FBI and U.S. Secret Service, Hudson Rock, CloudSEK, Trellix, Enclave, Microsoft, Cequence, CISA and VulnCheck. The post also notes that many figures come from security companies that sell protective products, and identifies some counts as those firms’ own observations.

Several items were reported in the final week of October: CloudSEK’s MR ROBOT report on October 28, Cequence’s scanner findings on October 28, and Trellix’s PDF analysis on October 26. Enclave reported the Authenticator issue on October 23. The Fortinet fixes shipped October 22, while the FBI and U.S. Secret Service warning cited in the roundup dates to October 6.

The roundup also compares CISA’s catalog with a separate VulnCheck count. CISA added PHP2Shell on October 26 and gave U.S. federal agencies until October 29 to remediate it. VulnCheck recorded 1,358 Gotenberg exploitation events in a 30-day period, according to the post, while Gotenberg was not on the cited CISA list. That figure is a VulnCheck count; the roundup does not provide further detail about how the events were measured.

““Each one needed one of four things: a login page that faces the internet, a password that was stolen months ago, a person who clicks ‘Allow’, or a piece of software that believes what another program says about itself.””

— The roundup’s author

Scope and Exploitation Details

The roundup does not say how many Fortinet devices were affected by the active campaign, which customers were targeted or whether the campaign succeeded against systems already patched. Fortinet’s technical details are expected on November 10; the full scope may remain unclear until then.

For MR ROBOT, CloudSEK’s counts describe one affiliate’s activity in the figures cited. The post does not establish the kit’s total reach, the number of victims or resulting financial losses. It also does not identify how many users encountered the blank PDF or how widely the backdoor was deployed.

Enclave reported a token-theft path in Microsoft Authenticator for Android, and Microsoft says it fixed the issue. The roundup does not provide the affected app versions, the date the fix became available or evidence of exploitation in the wild. The Cequence scanner’s roughly 32 fake AI-bot identities and its requests for secrets are the company’s observations; the post does not quantify how many sites were accessed or whether credentials were obtained.

The 1,358 Gotenberg events are attributed to VulnCheck over 30 days, but the roundup gives no comparison baseline or detail on successful compromises. A recorded exploitation event does not by itself establish a distinct victim or a successful breach.

Patch Deadlines and Vendor Details

Fortinet is scheduled to publish technical details about its October 22 fixes on November 10. Organizations using the affected products can apply the available updates and review exposure to administrator and VPN access while awaiting those details. Android users and IT teams can update Microsoft Authenticator and set a minimum version for managed devices, following the roundup’s recommendation.

For U.S. federal agencies, the cited CISA deadline for PHP2Shell remediation was October 29. Security teams can check the current KEV catalog and combine it with their own assessment of internet-facing software and reported exploitation. The roundup does not give a future date for further findings on Gotenberg, MR ROBOT or the scanner activity.

Key Questions

What is the main development in this roundup?

The October 29 post selected six security stories from The Hacker News’ weekly digest and paired each with a defensive action. The stories cover firewalls, Android devices, PDFs, web scanners and patch priorities.

What should Fortinet customers do?

The roundup says Fortinet shipped fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. It recommends applying the updates, removing administrator logins from public internet access and resetting VPN and administrator passwords. Fortinet’s technical details are due November 10.

How does the MR ROBOT Android kit work?

According to CloudSEK, criminals can rent the kit to create fake banking apps that steal one-time codes and forward calls. The roundup advises users to avoid installing bank apps from message links.

Was the Microsoft Authenticator issue fixed?

The roundup says Microsoft fixed the Android issue reported by Enclave and tracked as CVE-2026-80097. It recommends updating Authenticator and setting a minimum version for managed devices; the cited material does not specify the affected versions.

Does CISA’s KEV catalog include every exploited vulnerability?

The roundup says Gotenberg was absent from the cited CISA catalog even though VulnCheck recorded 1,358 exploitation events over 30 days. The count is VulnCheck’s observation, and the roundup gives no comparison baseline or details establishing successful compromises.

Source: Thorsten Meyer AI