JEDI-SEC | Security Research & Digital Defense

Category: Security News

  • Attack on email hosting provider for German far right party AfD exposed 345k accounts

    Attack on email hosting provider for German far right party AfD exposed 345k accounts

    The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach for the first time today, after AfD officially disclosed the September attack on its hosting provider last week. AfD said in its statement that “only a few email accounts were illegally copied,” but admitted a large amount of the data was taken from them, resulting in an extensive data breach. The emails were added to what the party described as “an activist website,” which summarised the email chains into searchable topics and has led to the publication of various revelations, such as a party co-leader’s opinions on colleagues’ “deeply problematic” racial discourse. Per a report from investigative journalist Lilith Wittmann, citing conversations with the cybercriminals responsible for the hack-and-leak job and party sources, the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers’ claims about how the attack unfolded. The Register contacted Alternita Dienstleistungs for its take. AfD said the owners of the affected email accounts have been notified, and that it reported the attack to security authorities. “We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy. “We are extremely worried that, apparently, the content of the stolen documents was analyzed using a very rudimentary AI. This analysis focused on keywords, not the context. The alleged scandals published so far do not stand up to scrutiny – a fact that, thankfully, is being confirmed by a growing number of commentators on social media.” Among the AI-generated summaries compiled by the “activist site” are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents, and more. Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. The AfD’s position is that the AI summaries of the emails are not to be trusted, but it has not specifically commented on the veracity of the raw email files available for download via torrent. It did not immediately respond to our request for input, but has told reporters previously that it will not comment on whether the emails, or the stories that have been written based on them, are to be trusted. ®

    Source: The Register — Security · 2026-10-27

  • Attack on email hosting provider for German far right party AfD exposed 345k accounts

    Attack on email hosting provider for German far right party AfD exposed 345k accounts

    The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach for the first time today, after AfD officially disclosed the September attack on its hosting provider last week. AfD said in its statement that “only a few email accounts were illegally copied,” but admitted a large amount of the data was taken from them, resulting in an extensive data breach. The emails were added to what the party described as “an activist website,” which summarised the email chains into searchable topics and has led to the publication of various revelations, such as a party co-leader’s opinions on colleagues’ “deeply problematic” racial discourse. Per a report from investigative journalist Lilith Wittmann, citing conversations with the cybercriminals responsible for the hack-and-leak job and party sources, the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers’ claims about how the attack unfolded. The Register contacted Alternita Dienstleistungs for its take. AfD said the owners of the affected email accounts have been notified, and that it reported the attack to security authorities. “We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy. “We are extremely worried that, apparently, the content of the stolen documents was analyzed using a very rudimentary AI. This analysis focused on keywords, not the context. The alleged scandals published so far do not stand up to scrutiny – a fact that, thankfully, is being confirmed by a growing number of commentators on social media.” Among the AI-generated summaries compiled by the “activist site” are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents, and more. Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. The AfD’s position is that the AI summaries of the emails are not to be trusted, but it has not specifically commented on the veracity of the raw email files available for download via torrent. It did not immediately respond to our request for input, but has told reporters previously that it will not comment on whether the emails, or the stories that have been written based on them, are to be trusted. ®

    Source: The Register Security · 2026-10-27

  • Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

    Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

    An attacker who gained access to Keystone’s website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.

    Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve

    Source: The Hacker News · 2026-10-27

  • AI-Generated Fake Login Pages Are Making Account Takeovers Easier

    AI-Generated Fake Login Pages Are Making Account Takeovers Easier

    Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. 

    Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain

    Source: The Hacker News · 2026-10-27

  • Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

    Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

    The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.

    According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It’s assessed to pick up

    Source: The Hacker News · 2026-10-27

  • Hiding Capabilities in AI Models

    Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”

    Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.

    Source: Schneier on Security · 2026-10-27

  • Copenhagen University Breach Compromises Data on Half a Million People

    Hackers have stolen personal information on over 520,000 people from the University of Copenhagen

    Source: Infosecurity Magazine · 2026-10-27

  • Samsung TVs without mics may listen through soundbars, researcher says

    A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent.

    The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room.

    The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung.

    Samsung advertises similar features on some of its AI-enabled TVs. The company says its Pet Care and Family Care features use on-device AI to detect a dog barking or a baby crying and alert users. This doesn’t confirm log4j’s claims about the package or the data it reports.

    However, log4j says that on TVs without microphones, the software searches for connected devices such as soundbars or Bluetooth microphones and uses those to listen instead.

    The TV was also collecting geolocation data and mapping local networks, they said, adding that it ran a service on the TV that analyzes traffic on the local network.

    log4j also says that the system uses a neural network tailored to a particular region to analyze your viewing habits. A neural network is a type of machine-learning model. log4j said:

    “…in youtube it’s looking for videos you watch, ads you skip, progress in a video, etc.”

    The tracking that’s on the record

    While log4j’s claims haven’t been independently verified, Samsung has used automatic content recognition (ACR), a system that identifies what’s on screen. Earlier this year, Texas Attorney General Ken Paxton settled with Samsung, getting the company to agree that it would get Texans’ express consent before collecting or processing ACR viewing data.

    A class action complaint filed in New York in January also accused Samsung of using ACR to record video and audio passing through the TV. The complaint accused Samsung of using machine-learning algorithms to analyze and link this data back to consumers. This includes information displayed when the TV is used as a computer monitor, it said, adding that the information can be linked to different people using the TV. The case was voluntarily dismissed in July.

    The New York complaint added:

    “Samsung exploits this Sensitive Information by (a) selling targeted advertisements to its corporate advertising clients, and (b) providing it to third-party advertising companies such as Google and X (f/k/a Twitter) for targeted advertising.”

    A separate class action complaint filed in California this month accuses Samsung Electronics America of not being transparent about its ACR data collection.

    This isn’t the first time that Samsung has been criticized for allegedly picking up in-room audio. In 2015, privacy group EPIC filed a complaint with the FTC, accusing Samsung of recording conversations and relaying them elsewhere. The nonprofit said at the time:

    “Everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service.”

    EPIC identified text-to-speech company Nuance as the third party.

    What you can do

    We can’t confirm all of log4j’s allegations, and Samsung doesn’t appear to have commented. But there have been multiple complaints about the data smart TVs collect. You can turn off features such as ACR, internet-based advertising, and voice recognition where possible.

    log4j has also raised concerns about whether monitoring services are truly off. They said:

    “ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.

    i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.”

    log4j says disconnecting your TV from Wi-Fi is the best option for immediate peace of mind, though that also means losing internet-based TV features. They also suggest using an Apple TV or a modifiable Android TV box with open-source software.

    What do cybercriminals know about you?

    Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

    Source: Malwarebytes Labs · 2026-10-27

  • First ISC2 AI Security Certification Expected for Early 2027

    ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification

    Source: Infosecurity Magazine · 2026-10-27

  • From federal SOCs to Talos: Ryan Fetterman on practical security research

    From federal SOCs to Talos: Ryan Fetterman on practical security research

    From federal SOCs to Talos: Ryan Fetterman on practical security research

    What does it mean to be “blue collar” for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos. He shares the realities of detection engineering — including the creative, often frustrating ways attackers evolve their tactics to stay one step ahead of traditional defenses.

    Beyond the technical grind, Ryan shares his philosophy on building a career in security without burning out. From the value of project-based learning to the importance of finding time to step away from the keyboard, here’s Ryan’s take on what it really means to navigate today’s cybersecurity industry.

    Amy Ciminnisi: Tell me a little bit about the journey that has taken you to Talos, from early on in your career through to now. How did you get here? I actually don’t know that much about it.

    Ryan Fetterman: I’ve been doing security about 15 years now, and my career was largely shaped by where I started in the DC area. I spent about a decade there. I started out in consulting and then pivoted over to research, but that was a great place to get started.

    I got a lot of great experience in federal agencies and government consulting, continued my education down there, got trained up, got certifications and things like that. And that was where I got my first exposure to doing actual security operations, which is what I really stuck with. It was my first exposure to Splunk.

    Querying lots of log data and building visualizations and analytics in Splunk was the first time in my career that I felt it was kind of my natural inclination. It seems like it should have been more obvious to me looking back on it, but it’s something that I try to explain to people a lot. When you first get into security, there’s a desire to kind of find your specialization and start working towards it. But in my experience, it’s just not something that you can rush.

    I met the people connected with that space, which eventually led to me going to work for Splunk. I worked on the Splunk research team, SURGe. And then after the Cisco acquisition of Splunk, I ultimately became reorganized into Talos.

    AC: I’m sure there have been so many challenges, so many obstacles in your way as you’re trying to do this research. Can you share one that you’ve faced and how it shaped your perspective on cybersecurity?

    RF: Something that stuck with me was actually my first advanced persistent threat (APT) incident. Now, you can look this up. It’s called Pandora Song if you search for the C2. I was in the DC area working in a federal SOC, and I was doing some of the first host-based analytics at the time, which have now become kind of the concentration of a lot of detection. Engineering and analytics are host-based, so this was kind of pioneering at the time.

    I was looking at a lot of host-based sensors and writing analytics in Splunk, actually, and we had been tipped off to this incident by a third party. I was looking through the details of the incident and how the attacker was carrying out the progression of their attack…

    Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.

    Source: Cisco Talos Intelligence · 2026-10-27