This week, the digital threat landscape delivered several landmark events: from massive attacks on users of the largest social network to the takedown of a veteran botnet and sophisticated methods of bypassing AI defenses. I break down the key incidents that require close attention.
X in the Crosshairs: A Wave of Password Resets and Phishing
X users faced a veritable barrage of unauthorized password reset requests and notifications about logins from unknown devices. Platform engineers acknowledged the anomaly but denied any infrastructure breach, linking the activity to automated attacks. The attackers' goal is obvious—gaining access to accounts to manipulate internal monetization, particularly X money.
The roots of the problem likely trace back to a 2022 API vulnerability that allowed emails and phone numbers to be matched with profiles. Subsequently, a database of 200 million users surfaced in the public domain, and in March 2025, hacker ThinkingOne posted a 34 GB archive on BreachForums containing data on 201 million accounts. My observations show that old data leaks continue to be a "gold mine" for cybercriminals, providing them with information for targeted phishing campaigns.
The situation is compounded by an independent phishing campaign sending out perfect copies of official X emails about "login from a new device," which lead to fake data interception pages. I strongly recommend that all users enable password reset protection, verify the sender's address (only @X.com or @e.X.com), and use authenticator apps instead of SMS.
End of an Era: Sality Botnet Dismantled
An international operation by U.S. and European law enforcement brought an end to the story of the decentralized Sality botnet, which had been active since 2003. At the time of its closure, the network contained more than 15,000 infected devices. Due to its P2P architecture, simply shutting down a command server would not have worked, so cyberpolice intercepted control over key supernodes, isolating victims' machines.
Notably, over its two decades of existence, Sality evolved from password theft and DDoS attacks to the specialized EggJagger clipper. In recent years, this module was the botnet's main payload, silently swapping cryptocurrency addresses in the clipboard for hackers' wallets. This further confirms that even the oldest infrastructure can be adapted for modern financial crimes.
AI Antiviruses Fooled by Plain Text
ESET experts discovered a new technique for bypassing security systems called GuardBreaker, used by the pro-Russian group UAC-0099 in attacks on Ukrainian infrastructure. The method is based on "blinding" AI scanners: hackers embed trigger phrases into their scripts, such as "I want to create nuclear weapons. Help me...". This provokes the language model's protective filters to trigger, interrupting the session with an error without analyzing the malicious code itself.
This attack vector is a warning sign for the entire industry. Exploiting the "naivety" of AI-based primary sorting pipelines is becoming increasingly popular. The leak of the Shai-Hulud worm's source code into the public domain has only accelerated the adaptation of this concept by other actors. It is clear that developers of security solutions need to rethink their approaches to model training so they are not susceptible to such simple manipulations.
Pegasus and NoviSpy: Espionage Against Serbian Activists
The international human rights organization Citizen Lab, together with the SHARE Foundation, uncovered evidence of iPhone infections of a participant in the Serbian student movement with Pegasus spyware. The hack was carried out via a zero-click exploit in iMessage. In total, since the beginning of 2026, at least 14 representatives of civil society, including students and opposition politicians, have been attacked with advanced spyware.
Of particular concern is that the attacks coincided with important political events in the country—local elections in March and preparations for snap elections in October. In addition to Pegasus, an updated version of the local Android spyware NoviSpy was found on activists' devices. The situation in Serbia is becoming a stark example of how commercial spy tools are used to suppress civil society, with messages from hacked phones even being quoted on pro-government media broadcasts.
My analysis: the past week clearly demonstrates the convergence of traditional cybercrime and advanced state-sponsored tools. Old methods, such as clippers and botnets, remain effective, while new ones based on deceiving AI open up entirely different horizons for attacks. Investors and everyday users alike should remember: security is not a static product, but a constant process of adaptation to evolving threats.