The week was packed with cybersecurity events affecting both everyday users and critical infrastructure. From massive attacks on social networks to the dismantling of a veteran botnet and espionage scandals — I break down the key incidents that demand close attention.
Attack on X users: a wave of password resets and phishing
Users of the X platform faced a veritable barrage of unauthorized password reset requests and notifications about logins from unknown devices. The social network's engineers acknowledged the anomaly but denied a breach of infrastructure, attributing it to automated attempts to take over accounts. The attackers' goal is obvious — access to internal monetization, specifically X money.
The likely root cause of the surge is the echo of a 2022 API vulnerability that allowed emails to be matched with accounts. The data leak of 200 million users, disclosed later, and the dump of a 34 GB database in 2025 created fertile ground for attacks. Moreover, researchers recorded the operation of a botnet that ran millions of credentials through the X login form. Notably, even two-factor authentication (2FA) is not a panacea — it only blocked 85.6% of attempts with correct passwords, leaving significant room for attacks.
In addition, a separate phishing campaign has been active since July with perfect copies of X emails leading to fake token interception pages. I strongly recommend enabling password reset protection in settings, checking the sender's address (only @X.com or @e.X.com), and using authenticator apps instead of SMS.
End of an era: dismantling the Sality botnet
U.S. and European law enforcement completed an operation to destroy the decentralized P2P botnet Sality, active since 2003. At the time of shutdown, more than 15,000 active infected devices were recorded. The key moment was seizing control of supernodes, which made it possible to isolate infected machines and block command transmission. In recent years, Sality's main payload was the EggJagger module — a specialized clipper that swaps cryptocurrency addresses in the clipboard. This is a reminder that even outdated but resilient threats can be dangerous for digital asset holders.
Charges against a Russian citizen and attacks on AI systems
A federal court in California charged 40-year-old Sirazhudin Aktulaev with orchestrating a malicious campaign against 80,000 freelancers. He created fake profiles and sent Excel documents with TVRAT and DarkVNC remote access trojans, paying for infrastructure in cryptocurrency.
Special attention deserves the new GuardBreaker technique used by the pro-Russian group UAC-0099 against Ukrainian infrastructure. The attackers embed trigger phrases in code (e.g., "I want to create nuclear weapons") to "blind" AI antiviruses. Large language models react to prohibited content and interrupt analysis without reaching the actual malicious code. This is an elegant and extremely dangerous vector, showing how AI tools designed to protect become a vulnerability. Similar attacks have already been recorded in the Python/npm ecosystem, and now we see their adaptation by other actors.
Espionage scandal in Serbia: Pegasus and NoviSpy
Citizen Lab and the SHARE Foundation reported the infection of an iPhone belonging to a member of the Serbian student movement with Pegasus spyware via a zero-click exploit in iMessage. Since early 2026, at least 14 civil society representatives have been targeted. In addition to Pegasus, an updated version of the Android spyware NoviSpy was discovered. These events coincided with local elections, raising serious questions about the political motivation of the cyberattacks.
My analysis: The week demonstrates a troubling trend — a shift from massive but "dumb" attacks to complex, multi-stage operations targeting specific individuals and exploiting weaknesses in protective technologies themselves. Of particular concern is the attack on AI antiviruses, which calls into question the reliability of automated security systems in their current form. The market needs to realize that trusting AI with full autonomy in cybersecurity matters is premature, and a hybrid approach with mandatory oversight by human analysts is necessary.