Cyber Brief: Open Code API Key Breach, Rank Math Backdoor and AI-Assisted Intrusions
· 1:41:48 · Watch on YouTube ↗
Summary
The briefing covers exposed Open Code API keys, malicious Rank Math Pro updates, reported AI-assisted intrusions, Siemens DLL side-loading, Pegasus targeting in Serbia and Bullhorn's platform shutdown.
Key points
- Open Code says a breach exposed stored API keys for 1.4% of console users. Some users reported unauthorized charges up to $1,700; co-founder Dax Rod attributed the abuse to model-distillation activity.
- Researcher Snorre Fagerland reported observing a Chinese-speaking operator use AI agents to target over 1,200 websites and breach more than 100 companies, with estimated costs of about $50 per successful intrusion.
- Rank Math says paid plugin downloads and updates delivered malware during an October 15–16 window. Installing clean version 3.0.124 alone does not remove all persistence; it recommends clean backups, scanning and credential changes.
- Nikkei says stolen credentials exposed 1.83 million records, including about 150,000 containing identifying information. It revoked the credentials and reported no evidence of misuse or an online leak as of October 16.
- Microsoft is privately previewing AI-agent controls that can revoke write permissions, require human approval or shut agents down, alongside guardian agents that investigate and contain other agents.
- Siemens linked malicious DLL bundles using its legitimate signed Software Center program to the Romulus ClickFix operation. Version 4.0.9.8 fixes the loading flaw; Siemens says its systems and update channels were not breached.
- Citizen Lab confirmed Pegasus on Vladan Jokic's phone in Serbia. Separately, Bullhorn disabled platform access after a cyberattack; data theft remained undetermined and no restoration timeline was available.
Article Details
- Topics
- [21:34] Open Code API key exposure and credential-handling risks
- [26:03] Reported AI-assisted website intrusions using Karen
- [34:56] Rank Math Pro supply-chain backdoor and recovery guidance
- [38:36] Nikkei credential compromise and exposed records
- [46:43] Microsoft previews risk-based AI-agent access controls
- [52:43] ClickFix delivery and Siemens Software Center DLL side-loading
- [57:40] Pegasus targeting of government critics in Serbia
- [01:01:44] Bullhorn platform shutdown and incident recovery
MITRE ATT&CK
T1078 · Valid AccountsNikkei says attackers used stolen credentials to access a development system and expose cloud-stored records.T1195.002 · Compromise Software Supply ChainMalicious Rank Math Pro downloads and updates distributed a persistent backdoor through the software supply chain.T1204 · User ExecutionFake verification prompts tricked users into running the Siemens program bundled with malicious DLLs.T1574.002 · DLL Side-LoadingAttackers bundled the legitimate signed Siemens Software Center program with malicious DLLs that the program loaded to execute attacker code.
People
Dax RodOpen Code co-founder who said attackers used exposed API keys with AI agents for at least 48 hours in model-distillation activity.Jose OregonHuntress researcher credited with reporting the Siemens Software Center vulnerability used to load malicious DLLs.Rada TrajkovicProsecutor whose device researchers were still analyzing after an Apple spyware-targeting warning; infection was not confirmed in the transcript.Satya NadellaMicrosoft CEO quoted on designing systems that minimize the trust required in AI models, in discussion of agent security controls.Snorre FagerlandNorseForge researcher who reported observing AI-assisted intrusions through exposed Karen instances.Vladan JokicUniversity of Belgrade Rector and supporter of Serbia's student protest movement whose phone Citizen Lab confirmed was infected with Pegasus.
Malware
Vendors
Bullhorn[01:01:44] >> Bullhorn takes staffing platform offlineCrowdStrike[01:02:02] working with CrowdStrike on securityMicrosoft[20:46] Microsoft details new Star Blizzard andNSO Group[58:20] elections. NSO Group and Serbia'sRank Math[34:56] >> Rank Math Pro updates deliver aSiemens[52:43] >> Click fix attackers borrow Siemens'
Products
Bullhorn[01:01:44] >> Bullhorn takes staffing platform offlineOpen Code[21:07] first one's open code breach.Project Perception[47:27] bundle and project perception.Rank Math PRO[34:56] >> Rank Math Pro updates deliver aSiemens Software Center[52:47] genuine signed Siemens software centerWordPress[35:01] copies of its paid WordPress SEO plugin