In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

SecurityWeek’s weekly cybersecurity news roundupoffers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.

This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.

Here are this week’s highlights: 

Heartbreaker macOS ransomware rebuilds itself from source

Researcher Patrick Wardle has analyzed Heartbreaker, a Rust-based macOS ransomware sample that was uploaded to VirusTotal in May 2025 and, as of his writing, was still undetected by every antivirus engine on the service. After attempting to set up a LaunchAgent for persistence, it encrypts files in the user’s Downloads folder. It then tries to change its hash by taking its own embedded source code, randomizing identifiers and adding junk functions, and recompiling itself (even trying to install Rust if it’s missing). Wardle believes it’s unlikely to be a major threat in its current form, as it uses a single hardcoded AES key that makes free file recovery possible, and its rebuild process depends on a Rust framework that’s no longer publicly available.

ISO/IEC standard targets AI data poisoning, model theft

ISO and IEC have published ISO/IEC 27090, guidance for detecting and mitigating threats specific to AI systems (including data poisoning and model theft) across their life cycle. The standard is meant to complement ISO/IEC 27001 and 27002, and also flags the risk of corrupted operational data making its way into future model versions through retraining.

WhatsApp’s guarded evidence fails to prove NSO broke injunction

A federal judge has declined to hold NSO Group in contempt over WhatsApp’s claims that the spyware maker violated a 2025 injunction barring it from using WhatsApp’s infrastructure to target users. WhatsApp’s case relied solely on a Meta investigator’s declaration that 23 new accounts carried signatures previously associated with NSO testing, but the judge found it lacked clear and convincing evidence, noting that WhatsApp chose to limit the level of detail (to avoid exposing its detection methods).

Seized ShinyHunters chats put ransom negotiators under scrutiny

Federal investigators believe at least one executive at a US-based consulting firm helped operate Shinywire, a now-defunct ShinyHunters site used to pressure nearly 100 hacked organizations into paying, KrebsOnSecurity reports, citing sources close to the probe. Signal messages that authorities accessed when they arrested ShinyHunters suspect Pepijn van der Stap in the Netherlands reportedly show frequent contact with Canadian cybersecurity executive Edward Dubrovsky and at least one executive at a US consulting firm, who sometimes knew about new victims before the victims themselves. 

Bullhorn forces credential resets as it restores hacked platform

Bullhorn is restoring its ATS/CRM platform after a cyber incident forced it to disable access to its systems, but says it has not yet determined whether customer data was exfiltrated. As systems come back online, non-SSO users must reset their passwords and API users must rotate their API passwords. Bullhorn says there is no indication that Bullhorn Automation, Sourcebreaker, or VMS Sync were affected.

Conduent breach victims could get monitoring and cash under $80 million deal

An $80 million settlement has been proposed to resolve a consolidated class action against Conduent over its 2024 data breach, in which millions of people’s personal and health information was stolen. All class members can claim a year of credit or medical data monitoring and reimbursement of up to $3,500 for documented losses, while those whose data was stolen in a readily accessible format can also claim a pro rata cash payment. The settlement awaits court approval, and Conduent disputes the claims of wrongdoing and liability.

APT28 aims Hookedge backdoor at NATO shipbuilder, engine maker

Symantec has linked Russia’s APT28 (which it tracks as Swallowtail) to Hookedge backdoor attacks on a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer in two NATO member states. At the shipbuilder, where the intrusion lasted at least two months, the attackers stole credentials using two different techniques, opened a persistent SSH tunnel into the internal network, and deployed a previously undocumented loader that decrypts and runs its payload in memory. 

Hijacked Tor exits harvested SSH passwords

A researcher whose own SSH session was intercepted while using Tor found that 333 exit relays (roughly a tenth of all exits) were redirecting SSH connections to a dozen attacker-run servers, which captured the passwords of users who ignored SSH’s warning and then tried to infect the servers they were logging into with Ebury. The relays ran on servers already compromised with Ebury, and their exit policies had been changed to block encrypted email retrieval ports and allow plaintext ones. The Tor Project pulled the relays within three days, and one affected operator has traced its own breach to a reused password. The project has not responded to SecurityWeek’s request for comment.

Railway customers told to rotate all secrets after suspected breach

Developer platform Railway says an unauthorized third party may have accessed encrypted customer environment variables (which can hold API keys and database and registry credentials) and obtained the decrypted contents of some of them. The company believes the incident is part of a series of attacks on platform companies aimed at compromising AI inference providers, and has notified those providers to proactively revoke keys. Although the impact may be limited to a subset of users, Railway has paused all deployments and is urging every customer to rotate stored environment variables and private registry credentials.

Major US banks spot unsanctioned AI agents inside customer accounts

Major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some attempting actions that appear independent of user instructions, Axios reports, citing sources. The agents typically log in with the user’s permission and credentials, which goes against most banks’ rules, and many banks can’t tell whether agent activity is directed by the user. Morgan Stanley has begun blocking third-party agents and JPMorgan, Bank of America and Citi are also restricting them, while most banks are moving toward allowing read-only access.

PingCAP intruder copied customer records and source code over four weeks

TiDB developer PingCAP says an unauthorized party used stolen service account credentials between September 9 and October 7 to access some of its internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names and email addresses, customer contacts, contract and billing details, and encrypted TiDB Cloud API key values, though the company has found no evidence that data stored in TiDB was impacted. PingCAP has invalidated all identified compromised credentials and fixed four vulnerabilities reported by an external firm, and is still determining which customers were affected.