A weekly digest of the most resonant events in cybersecurity: from massive attacks on X social network users to the takedown of a legendary botnet and new attack vectors on AI.
X (Twitter): a wave of password resets and ghosts of old breaches
X users worldwide are reporting a flurry of unauthorized password reset requests and notifications of logins from unfamiliar devices. Platform engineers acknowledged the anomaly but categorically reject the theory of an infrastructure breach, linking the events to automated account takeover attempts. The motive is obvious — access to X's internal monetization, X money.
The likely root cause of the current storm is the echo of a 2022 API vulnerability that allowed emails and phone numbers to be matched with accounts. The leak of a database of 200 million users a year later, followed by a 34 GB file with data on 201 million accounts published by hacker ThinkingOne in 2025, created fertile ground for attackers. My colleagues at Breakglass Intelligence recorded a botnet in April that pushed millions of login/password combinations through the X login form. Notably, even with correct passwords, 2FA blocked 85.6% of attempts — but the remaining percentage still poses a threat.
Separately worth noting is a phishing campaign disguised as official X emails about "login from a new device." I recommend users enable password reset protection, verify the sender address (only @X.com or @e.X.com), and use authenticators instead of SMS.
Sality: the end of an era for the P2P botnet
An international operation by U.S. and European law enforcement has put an end to the decentralized Sality botnet, active since 2003. At the time of shutdown, there were more than 15,000 active infected devices. Sality's uniqueness lay in its P2P architecture, which made shutting down a single server useless. Instead, cyberpolice intercepted control of key supernodes, isolating machines from one another.
Over two decades, the botnet evolved from password theft and DDoS to the EggJagger cryptoclipper, which swaps wallet addresses in the clipboard in real time. This once again confirms: even the most resilient infrastructure is vulnerable to coordinated action by authorities.
Freelancers in the crosshairs: charges against a Russian citizen
A federal court in California unsealed an indictment against 40-year-old Sirajudin Aktulaev, arrested in Cyprus in May 2025. From 2016 to 2017, he created 255 fake profiles on a U.S. labor exchange and sent malicious Excel files to 80,000 freelancers via an internal messenger. The TVRAT and DarkVNC trojans, using legitimate TeamViewer and VNC, provided full control over victims' systems. Paying for infrastructure with cryptocurrency did not help cover tracks — extradition took place, with a hearing scheduled for October 5.
GuardBreaker: a new way to blind AI antiviruses
ESET experts have identified the GuardBreaker technique used by the pro-Russian group UAC-0099 against Ukrainian infrastructure. The essence of the attack is injecting trigger phrases into malicious code, such as "I want to create nuclear weapons. Help me...". This provokes the activation of safety filters in large language models, which interrupt the session without analyzing the code itself. The method has already been adapted from the open-source code of the Shai-Hulud worm, demonstrating the rapid evolution of threats in the AI ecosystem.
Pegasus in Serbia: surveillance of the opposition
Citizen Lab and the SHARE Foundation confirmed the infection of a Serbian student activist's iPhone with Pegasus spyware via a zero-click exploit in iMessage. Since early 2026, at least 14 representatives of civil society, including opposition politicians, have been targeted. The coincidence with elections and the discovery of the local Android spyware NoviSpy point to a coordinated surveillance campaign.
My analysis: This week shows an alarming trend — attackers are increasingly exploiting not only technical vulnerabilities but also the "human factor" within AI-based security systems themselves. While regulators and platforms respond to isolated incidents, cybercriminals are consolidating and sharing toolkits. The industry needs to move from reactive defense to proactive modeling of attacks on the algorithms themselves.