Secretariat

A US-UK-led "Joint Disruption Week" against West African scam centres led to 28 arrests in Ghana and Nigeria, the rescue of 117 trafficking victims and the removal of more than 3.7 million fraudulent social media accounts, Pages and Groups, the largest takedown of its kind. India joined the operation, which was hosted by the UK's National Crime Agency, and tech partners identified over $11 million in potentially freezable funds.

Japan's National Cybersecurity Office has confirmed multiple breaches at companies handling large volumes of personal data, driven by web vulnerabilities, supply-chain compromise and weak data management. Its 9 October 2026 advisory urges firms to patch fast, enforce MFA, audit contractors, minimise and encrypt data, and treat cybersecurity as a board-level issue as AI-driven attacks grow more sophisticated.

CISF screeners at Goa's Dabolim airport intercepted two Delhi-bound passengers carrying concealed Bluetooth cheating kits linked to the IIT Goa Non-Teaching Staff Recruitment exam. One admitted he had sat the exam in place of another candidate. Both were handed to police and a case has been registered.

South Korea's ARTEX-linked bank hacks did not breach isolated internal networks. They hit poorly managed, internet-facing portals built for loan brokers, sales staff and partners. Korean regulators agree, and say the network-separation easing is not to blame. For India's NBFCs, digital lenders and fintechs, which rely heavily on agent, partner and API access, the lesson is to secure every external touchpoint as tightly as the core.

HexStrike AI is an open-source Model Context Protocol (MCP) server that lets AI agents such as Claude, GPT, Copilot and Cursor select, configure and run more than 150 security tools on their own. This explainer covers its architecture, tool arsenal and value for authorised testing. It also sets out the governance controls CISOs need before any pilot: scoping, human approval gates, isolation, logging and dual-use risk.

Court filings and an FBI subpoena response now circulating among threat-intelligence researchers show what Telegram hands over to investigators: a user's numeric ID, username, phone number and last-login IP address with a timestamp. In one case, Telegram also switched on additional logging for the targeted accounts to capture that data. The records undercut the belief, common among cybercriminals, that Telegram offers complete anonymity.

Attackers are running Google search ads for "claude mac" whose destination is a genuine Bing search result. The chain passes through a compromised retail site to a fake Claude download page that copies a malicious terminal command to the clipboard. Push Security calls the technique "Adception": it slips past Google's ad review and link scanners by showing them only trusted domains, and serves the payload only to victims who arrive through the exact path.

Pakistan's NCCIA Islamabad has arrested four men, Asad Ullah, Sibtain Ali, Noman Niaz and Sami Ullah, accused of harassing and blackmailing a woman by sharing objectionable images and videos of her with her family and in WhatsApp groups. Four phones were recovered. The swift action under PECA 2016 sends a clear message that image-based abuse of women will be pursued and punished.

Pakistan's NCCIA Multan has arrested two men, Mamoon Rauf and Muhammad Mubashir Murtaza, accused of using a fake steel sale-and-purchase ad on TikTok to trick a buyer into transferring money into their bank accounts. Two mobile phones were recovered, and a case has been registered under PECA 2016 (amended 2025) and the Pakistan Penal Code. The case shows how TikTok ads are becoming a storefront for fake trade deals.

The Indian state of Karnataka has signed a memorandum of understanding with voice AI company ElevenLabs. The two will explore uses of voice AI in governance, AI safety and voice restoration, with safeguards against deepfakes, unauthorised voice cloning, fraud and impersonation. Under a voice restoration initiative, eligible people who have lost their voice will get free lifetime licences to speak again in a synthetic version of their own voice, including in Kannada.

Pakistan's NCCIA has arrested 37 suspects at an alleged illegal call centre in Lahore's Johar Town that targeted US citizens. Operators allegedly posed as US mobile carriers selling phones to harvest card details, then used them for unauthorised transactions. The raid comes days after earlier busts in the same neighbourhood, raising hard questions about why Lahore's scam-centre industry keeps rebuilding faster than it is dismantled.

CERT-In has issued a critical advisory (CIAD-2026-0046) warning that attackers are stealing payment API credentials from NBFCs, fintechs, payment providers and wallets, then triggering fund transfers directly to mule accounts. It flags the possible use of AI-assisted offensive frameworks. The alert follows a wave of AI-assisted API breaches at seven South Korean financial firms that exposed data on more than 67,000 people. In both cases attackers went through weakly guarded side APIs.