Cybersecurity roundup: AI-linked bank attacks, credential theft and exposed GPU monitoring flaw
Summary
This week’s cybersecurity roundup covers suspected AI use in South Korean bank attacks, credential-stealing campaigns, a botnet, account hijacking, a GPU monitoring flaw, and cybercrime convictions and policy changes.
Key points
- South Korean authorities are investigating bank cyberattacks that exposed customers’ personal information; officials said AI may have been used, and CrowdStrike assessed a Chinese-speaking financially motivated actor was likely involved.
- PoeLLM malware targets exposed AI and open-source services for cryptocurrency mining and botnet growth, using keywords in a GitHub poem to find its command-and-control server.
- A GhostAction campaign spread a secret-stealing GitHub Actions workflow to 772 public repositories, targeting 2,577 secrets, including cloud and database credentials.
- A compromised Tensorlake npm SDK version installed a worm that steals credentials and can spread through packages the victim can publish.
- Researchers reported that exposed Nvidia DCGM Exporters leaked telemetry from more than 12,000 GPUs; Nvidia addressed the high-severity flaw in version 4.8.2.
- Domino’s reset accounts accessed through credential stuffing using passwords leaked in unrelated breaches; the company said its systems were not compromised.
- A jury convicted the Uranium Finance hacker over two cryptocurrency exchange hacks, and an Empire Market co-founder was sentenced to 40 years in prison. CISA also narrowed eligibility for its cyber retention incentive.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering malware and supply-chain campaigns, cyberattacks, a software vulnerability, policy developments, and criminal cases.
- Impact
- Reported effects include theft of credentials and other secrets, exposure of customer personal information and GPU telemetry, cryptocurrency theft, service disruption, and account access through credential stuffing. The roundup also reports criminal convictions and sentencing, proposed federal OT security requirements, and remediation or account resets.
CVE
People
Jonathan SpallettaConvicted of computer fraud and money laundering over two 2021 hacks of Uranium Finance.Lee Jae MyungSouth Korean President who said there were signs AI was used in some recent attacks targeting the country's banks.Raheim HamiltonEmpire Market co-founder who was sentenced to 40 years in prison after pleading guilty to a drug conspiracy charge.Thomas PaveyEmpire Market co-founder who pleaded guilty and was scheduled to be sentenced later in the month.
Malware
Vendors
Products
DCGM ExporterResearchers have disclosed CVE-2026-47483, a high-severity flaw in Nvidia’s DCGM Exporter GPU monitoring tool.Gitealeast April 2026 that targets exposed AI and open-source services (mainly LiteLLM, Ollama, Gotenberg and Gitea) to mine cryptocurrency and expand its botnet.GitHub ActionsGitGuardian says the GhostAction supply chain campaign pushed its secret-stealing GitHub Actions workflow to 772 public repositories (belonging to 373 users and organizations) between August 31 and September 30,Gotenbergsince at least April 2026 that targets exposed AI and open-source services (mainly LiteLLM, Ollama, Gotenberg and Gitea) to mine cryptocurrency and expand its botnet.LiteLLMa malware active since at least April 2026 that targets exposed AI and open-source services (mainly LiteLLM, Ollama, Gotenberg and Gitea) to mine cryptocurrency and expand its botnet.Ollamaactive since at least April 2026 that targets exposed AI and open-source services (mainly LiteLLM, Ollama, Gotenberg and Gitea) to mine cryptocurrency and expand its botnet.TensorlakeShai-Hulud-style worm slips into Tensorlake’s npm SDK